AC 20-167B the applicant should show the pilot can perform that intervention. For example, a pilot might be assumed to detect a system error because of other displays or what is being viewed out the window. It should be demonstrated that pilots can detect the error in a timely fashion and not be hazardously misled. The demonstration must validate the proposed hazard classification, as applicable.
5.7.9.2 The applicant should demonstrate a satisfactory safety (failure and performance) level which should not be less than the safety level required for non-EFVS approach system based precision and non-precision approaches with decision altitudes of 200 ft. or above. In showing compliance, probabilities cannot be factored by the fraction of approaches which are made using EFVS. Consideration, however, can be given to the EFVS approach system critical flight time, such as from the highest DA/DH that can be expected for an EFVS approach system based approach to 100 ft. above the TDZE.
5.7.9.3 The design assurance levels (DALs) are directly linked to the specific intended use and to the specific EFVS approach system installation as an integrated part of the flightdeck flight information system.
5.7.9.4 There are failure modes within the EFVS approach system which determine that software and hardware DALs should use the criteria of the latest versions of RTCA DO-178 (for software) and DO-254 (for hardware) level C as a minimum. Depending upon specific functions or system architecture, a higher DAL (for example see RTCA DO-315A, appendix C) may result from the DAL allocation analysis.
5.7.9.5 The safety assessment process, starting with the FHA, should determine whether the minimum required DAL C is adequate for your specific installation. The example FHA shown in RTCA DO 315A, appendix C is a model case only and cannot be applied to any specific aircraft without independent analysis.
5.7.9.6 The applicant must provide the applicable analysis that is specific for each installation approval. An example SSA of an EFVS approach system is shown in RTCA DO-315A, appendix C.
5.7.9.7 The applicant must conduct a safety analysis to show the EFVS approach system meets all the integrity criteria for the aircraft, HUD, and EFVS.
The applicant should demonstrate system and subsystem malfunctions, which are not extremely improbable, as appropriate in a simulation or in flight. The malfunction annunciation and fault detection schemes must achieve the determined level of safety.
5.7.10 EFVS landing system required level of safety analysis (as applicable).
To demonstrate compliance with §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309:
5-6
AC 20-167B
5.7.10.1 The applicant should demonstrate a satisfactory level of safety (failure and performance) appropriate to the operations being addressed, but with the visual segment primarily accomplished by the use of an EFVS landing system rather than natural vision.
5.7.10.2 To achieve the required safety level, the minimum baseline safety levels required for the installed EFVS landing system equipment regardless of visibility, should be dependent on the demonstrated performance.
5.7.10.3 An aircraft level FHA and SSA should be prepared by the applicant to assess the hazard level associated with system failure conditions and to determine the minimum required software and hardware DALs based on the applicant’s specific installation. Mitigating system design features include redundancy, independent guidance display, system monitoring, pilot in the loop, pilot not flying, etc. In no case should the DAL be less than DAL B.
5.7.10.4 The minimum required safety level for an EFVS landing system (EFVS to touchdown and roll out in visibilities not less than runway visual range (RVR) 1000 feet) is based on the assumption that the EFVS being approved can demonstrate that the flightcrew can verify that the aircraft is safely approaching the runway for EFVS landing system based landing, or if not, to initiate a timely go-around if sufficient enhanced visibility is not achieved. This provides additional integrity to the operation. Depending on the applicant’s design, it may be possible that the proposed natural visibility can also compensate for loss of EFVS imagery, such that the pilot can use the remaining symbolic flight information on the HUD and the external view to safely land. System evaluation should consider EFVS landing system failure modes and whether the pilot can safely land and rollout with available natural vision plus whatever capability remains of the EFVS landing system. A safe landing should not be assumed with only available natural vision after total loss of the EFVS landing system (i.e., symbology and image).
5.7.10.5 In showing compliance with these safety criteria, the applicant should not factor probabilities of EFVS landing system failure conditions by the fraction of approaches which require use of the EFVS landing system.
Also, the applicant should not factor probabilities of EFVS landing system failure conditions by a statistical distribution of visibility conditions. The exposure time used for EFVS landing system failure calculations should be the elapsed time from descent below the highest expected DA/DH for the EFVS landing system-based approach to completion of rollout to a safe taxi speed.
5-7
AC 20-167B
5.7.11 SSA analysis (as applicable).
To demonstrate compliance with §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309 analysis should contain the following elements:
5.7.11.1 An aircraft-level FHA should be prepared by the applicant to assess the hazard level associated with system failure conditions and to determine that the minimum required software and hardware DALs are appropriate to the applicant’s specific intended function.
5.7.11.2 The DALs are directly linked to the specific intended use and to the specific EFVS installation as an integrated part of the flightdeck flight information system. The availability and integrity of situational and flight path information from sources other than the EFVS image and the ability of the pilot monitoring the operation should be considered when assessing the appropriate hazard levels for the EFVS.
5.7.11.3 Under §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309, the applicant must provide an SSA.
5.7.11.4 The SSA should show that the applicant’s specific installation meets all the integrity criteria for the aircraft systems, and EFVS.
5.7.11.5 The applicant may need to demonstrate by flight test or simulation, combinations of EFVS malfunctions that are not shown to be extremely improbable (10-9) as determined by the AIR certification branch and the project specific certification plan (PSCP).
5.7.11.6 Any malfunction fault detection and annunciation schemes must satisfy the required levels of safety and must perform their intended functions.
5.7.11.7 All aircraft configurations to be approved must be addressed.
5.7.12 EFVS Fail Safe Features.
Under 23.2500, 25.1353(a), 27.1351(b), and 29.1353(a), the normal operation of the EFVS must not adversely affect or be adversely affected by other normally operating aircraft systems. Warning information (e.g. annunciations) must be provided to alert the crew to unsafe EFVS operating conditions, including detected malfunctions of the EFVS which could cause display of misleading information. The misleading information should be removed. Alerting annunciations should be displayed to the flightcrew in accordance with AC 23.1311-1C, AC 25.1322-1, AC 25-11B, AC 27-1B CHG 1-9, and AC 29-2C CHG 9 as applicable. Under §§ 23.2500, 23.2505, 25.1309,
27.1309, and 29.1309, the applicant must assess the criticality of the EFVS’s function to display imagery, including the potential to display hazardously misleading information.
That assessment should include the hazardous effects of any malfunction of the EFVS that could adversely affect interfaced equipment or associated systems. See AC 23- 1309-1E, AC 25-11B, and ARAC-recommended 25.1309 and Arsenal Guidance, AC 5-8
AC 20-167B 27-1B CHG 1-9 and AC 29-2C CHG 9. This requirement should be met through an SSA and documented via FTA, FMEA, and FMEA substantiation, or equivalent safety documentation.
5-9
AC 20-167B CHAPTER 6. PERFORMANCE EVALUATION
6.1 EVS/EFVS Performance Demonstration.
The performance demonstration used to establish aircraft system compliance with applicable FAA airworthiness criteria typically includes bench testing, simulation, flight testing, data collection, and data reduction to show that the proposed performance criteria can be met. The performance evaluations should therefore include demonstrations of the kinds of operations and those operations’ flight regimes that are stated as the system’s intended functions. For EFVS, the applicant should demonstrate performance at the lateral and vertical limits for the type of approach (for example, precision, non-precision, and approach with vertical guidance) for which operational credit is sought. Appendix B of this AC provides sample EFVS flight test considerations.
6.1.1 This AC does not prescribe specific test procedures. We recognize that alternative methods can be used. In accordance with §§ 21.17 and 21.97, your test procedures and compliance reports must show compliance with the applicable airworthiness criteria.
System performance tests are the most important tests, as they relate to operational capability. Subsystem tests are used to test subsystems during system buildup to ensure appropriate subsystem performance as it relates to overall system performance.
6.1.2 The applicant should use some or all these four general verification methods as necessary (Refer to AC 23.1309-1E, AC 25.1329-1C, AC 27-1B or AC 29-2C CHG 9 as applicable).
6.1.2.1 Analysis.
Demonstrate compliance using an engineering analysis.
6.1.2.2 Flight Test.
Demonstrate compliance using an aircraft that is fully representative for the purpose of the test in terms of flightdeck geometry, instrumentation, alerts, indications, and controls in the air and on the ground.
6.1.2.3 Laboratory Test.
Demonstrate compliance using an engineering bench representative of the final EVS/CVS/EFVS system being approved.
6.1.2.4 Simulation.
Demonstrate compliance using a flight simulator as accepted by the AIR certification branch in the PSCP.
6.1.3 The applicant should specify the individual verification methods used in the certification plan. Confirm that the responsible AIR certification branch agrees with your plan before you begin. For extensions, features, and design decisions not explicitly specified in this AC, you should conduct human factors evaluations. Conduct these 6-1
AC 20-167B evaluations through appropriate combinations of analyses, bench testing, simulation, or flight testing.
6.1.4 The applicant should verify both the installed system and the individual system components meet the EVS/CVS/EFVS criteria described in Chapter 4 of this AC.
6.1.5 The applicant should demonstrate the system meets performance criteria specified in Chapter 4 by flight test and/or other appropriate means, which can include the use of a flight simulator. An example of a flight test program for EFVS is described in appendix C in this AC. The flight test program assumes that the guidance system utilized to satisfactorily position the aircraft at the DA/DH or MDA has been separately tested and shown to fully perform its intended function. Testing and data collection to demonstrate this is not addressed in this AC.
6.1.6 The applicant should conduct an evaluation of the system used during anticipated operational scenarios, including:
6.1.6.1 EFVS Flight Testing.
Unapproved EFVS systems may be operated on test flights provided that the operation is conducted under § 91.176(d) and the aircraft is issued an experimental certificate under § 21.191.
6.1.6.2 Section 21.191, Experimental Certificates.
Identifies a number of purposes for which an experimental certificate can be issued. Not all of those are eligible for the exception in § 91.176(d).
Section 91.176(d) limits the exception purposes to only those listed in §§ 21.191(a) and 21.191(b). Please note, however, that using an unapproved EFVS to conduct an EFVS operation outside this specific scope would still require a waiver from the applicable operating rules.
For the Administrator to determine that the flight test operations can be conducted safely in accordance with § 91.176(d) and all other applicable regulations, the FAA will evaluate the flight test in accordance with FAA Order 8130.2J, Airworthiness Certification of Aircraft. FAA Order 8130.2J contains detailed instructions about how to obtain an experimental certificate (Chapter 4, Sec. 2 and Chapter 10.) It also describes what the applicant’s program letter must contain (appendix C) and lists what operating limitations must be applied to the experimental certificate (appendix D). As a part of the airworthiness certification process, the FAA determines whether the operations proposed by the applicant can be safely conducted. The FAA issues operating limitations when the program letter is approved, and the experimental certificate is issued.
6.2 Performance Demonstration of EFVS Landing System.
Where appropriate for the performance demonstration, the non-visual conditions can be achieved either by natural obscuration or by the use of a visibility-limiting device in 6-2
AC 20-167B front of the pilot. Caution should be used if the applicant chooses to use a visibilitylimiting device for system performance demonstrations. Visibility-limiting devices may not adequately simulate low visibility conditions for all EFVS landing system landing performance demonstrations because of the unrealistically good external visibility outside the HUD FOV and the unrealistic EFVS landing system image performance in good atmospheric conditions.
6.2.1 Under §§ 23.2610, 25.1523, 27.1523, and 29.1523, the applicant must consider the workload associated with the use of EFVS landing system for approach, landing and rollout.
6.2.2 The system may fly final approach courses with offsets greater than 3 degrees. In this case, the applicant should establish the maximum allowable final approach course offset by flight test. The flight test should address factors related to the offset, such as HUD/EFVS FOV, crosswinds, and the maximum drift angle for a conformal FPV.
6.2.3 The EFVS landing system image with superimposed flight symbology must not mislead, distract or jeopardize the safety of the landing and rollout. Performance should be demonstrated to be no worse than that normally achieved in visual operations for the specific aircraft for all performance parameters measured. See §§ 23.2600, 25.771,
27.771, 29.771 and §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309. The applicant may propose a valid means for establishing performance normally achieved that the FAA may accept as a benchmark for the EFVS demonstrations.
6.2.4 Benchmark data establishing equivalence to normal visual operations with the specific aircraft is not normally necessary. However, if flight test results show deviations for the standard criteria listed above, then benchmark data might be necessary to establish the equivalence of EFVS landing system operations to normal visual operations for that specific aircraft.
6.2.5 Without requiring exceptional pilot skill, alerting, strength, or workload, the EFVS image/symbology should provide the visual cues for the pilot to perform the following items:
6.2.5.1 Speed control within +10/-5 knots of the approach speed, whether manually controlled or with auto-throttle, as proposed by the applicant, up to the point where the throttles are retarded for landing.
6.2.5.2 A smooth transition through flare to landing.
6.2.5.3 Approach, flare, and landing at a normal sink rate for the aircraft.
6.2.5.4 Touchdown within the touchdown zone. The lateral touchdown performance should be demonstrated to be no worse than that achieved in visual landings for the specific aircraft.
6.2.5.5 Prompt and predictable correction of any lateral deviation away from the runway centerline to smoothly intercept the centerline.
6-3
AC 20-167B
6.2.5.6 Touchdowns with a bank angle that is not hazardous to the aircraft.
Demonstrated performance of the installed EFVS at representative visibilities for EFVS approach system and EFVS landing system operations as described in this AC will determine any additional limitation (for example, crosswind and offset).
6.2.5.7 A normal de-rotation.
6.2.5.8 Satisfactory and smooth control of the path of the aircraft along the runway centerline through rollout to a safe taxi speed.
6.2.5.9 A safe go-around anytime including up to touchdown in all aircraft approach/landing configurations to be certified.
6-4
AC 20-167B Appendix A APPENDIX A. FAA EFVS 14 CFR COMPLIANCE (PARTIAL LIST) A.1 Airworthiness Standards.
• Certification Procedures for Products and Articles (14 CFR part 21).
• Normal Category Airplanes (14 CFR part 23).
• Transport Category Airplanes (14 CFR part 25).
• Normal Category Rotorcraft (14 CFR part 27).
• Transport Category Rotorcraft (14 CFR part 29).
A.2 EFVS Compliance.
The following requirements address EFVS compliance. These requirements may also be in addition to those requirements applicable to a HUD and the basic avionics installation. The amount of new test data can be determined by the individual application, availability, and relevance of data.
Table A-1. EFVS Acceptable Methods of Compliance 14 CFR Description Acceptable Method of Compliance
23.2135, 25.143, 27.143,
29.143 General controllability and maneuverability Analysis, Simulation, Flight Test
23.2160, 25.251, 27.251,
29.251 Vibration and buffeting Flight Test
23.2210, 23.2230, 25.301,
27.301, 29.301 Loads Analysis
23.2230, 25.303, 27.303,
29.303 Factor of safety Analysis
23.2235, 25.307, 27.307,
29.307 Proof of structure Analysis A-1
AC 20-167B Appendix A 14 CFR Description Acceptable Method of Compliance
25.561m 25.562(c)(5) Emergency landing conditions; Head Injury Criterion (HIC) Analysis
23.2240, 25.571, 27.571,
29.571 Damage-tolerance and fatigue evaluation of structure Analysis
25.571(e) Damage-tolerance and fatigue evaluation of structure(discrete source) evaluation Analysis and/or Test (See Note)
23.2515, 25.581, 27.610,
29.610 Lightning protection Analysis
23.2250, 25.601, 27.601,
29.601 General Design and Construction Drawing
23.2250, 23.2260, 25.603,
27.603, 29.603 Materials Drawing
23.2260, 25.605, 27.605,
29.605 Fabrication methods Drawing
23.2255, 25.609, 27.609,
29.609 Protection of structure Drawing
23.2255, 25.611, 27.611,
29.611 Accessibility provisions Drawing
23.2260, 25.613, 27.613,
29.613 Material Strength properties and material design values Drawing, Analysis, Test (See Note)
23.2265, 25.619, 27.619,
29.619 Special factors Analysis
23.2265, 25.625, 27.625,
29.625 Fitting Factors Analysis
23.2245, 25.629(d)(8) Aeroelastic stability Analysis, Test A-2
AC 20-167B Appendix A 14 CFR Description Acceptable Method of Compliance
23.2320(d), 25.631,
29.631 Bird strike damage Analysis, or Test if necessary. (Testing should be accomplished unless the analysis shows that the integrity of the original structure has not been compromised by EFVS installation modification.)
23.2600, 25.771, 27.771,
29.771 Pilot compartment Flight Test
23.2600(a), 25.773,
27.773, 29.773 Pilot compartment view Flight Test
23.2600, 23.2610, 25.777,
27.777, 29.777 Flight deck controls Flight Test
23.2500, 23.2505,
25.1301, 27.1301, 29.1301 Function and installation Ground Test and Flight Test
25.1302 Installed systems and equipment for use by the flightcrew Analysis, Simulation, Flight Test
23.2500, 23.2505,
25.1309, 27.1309, 29.1309 Equipment, systems, and installations Analysis and/or Test and Design data
25.1316, 27.1316, 29.1316 System lightning protection Analysis and Ground Test
23.2520, 25.1317,
27.1317, 29.1317 High-intensity Radiated Fields (HIRF) Protection Ground Test and Flight Test Analysis/Data
23.2500, 23.2610,
25.1321, 27.1321, 29.1321 Arrangement and visibility Ground Test and Flight Test
23.2605, 25.1322,
27.1322, 29.1322 Warning, caution, advisory lights Ground Test and Flight Test
25.1323, 27.1323, 29.1323 Airspeed indicating systems Flight Test A-3
AC 20-167B Appendix A 14 CFR Description Acceptable Method of Compliance
23.2500 23.2505, 23.2510,
23.2600, 23.2605,
27.1335, 29.1335 Flight director systems Ground Test and Flight Test
23.2525, 23.2500,
23.2525, 23.2605,
25.1351, 27.1351, 29.1351 Electrical Systems and Equipment;
General Analysis
25.1353, 29.1353 Electrical equipment and installation Analysis
23.2500, 23.2505,
23.2510, 23.2525,
25.1357, 27.1357, 29.1357 Circuit protective devices Analysis and Ground Test
23.2500, 23.2600,
25.1381, 27.1381, 29.1381 Instrument lights Ground Test and Flight Test
23.2165(a)(1), 23.2540(a),
23.2600(a), 25.1419,
27.1419, 29.1419 Ice protection Analysis
23.2510, 25.1431, 29.1431 Electronic equipment Analysis and Ground Test
23.1549(e), 25.1459(e),
27.1459(e), 29.1459(e) Flight data recorders Flight test
23.2610, 25.1501,
27.1501, 29.1501 Operating Limitations and Information;
General Flight Test
23.2610, 25.1523,
27.1523, 29.1523 Minimum flightcrew Flight Test or Simulation
23.2610, 25.1525,
27.1525, 29.1525 Kinds of operation Flight Test
23.1529, 25.1529,
27.1529, 29.1529 Instructions for Continued Airworthiness Design Data A-4