4-20 for the EFVS sensor, since it is assumed any error can be electronically compensated during installation. With EFVS operations, the aircraft is flown essentially irrespective of the EFVS/HUD dynamic error, to the MDA or DA. From this point to 100 ft height above touchdown zone elevation, the EFVS conformality error introduces error in the pilot’s ability to track along the extended centerline/vertical glide path as the pilot flies the flight path vector and glidepath reference line toward the EFVS image of the runway.
4.5.3.4.8 Sensor/sensor processor.
4.5.3.4.8.1 Dynamic range. The minimum required dynamic range for passive EFVS should be 48 db. For active EFVS, side lobes should be 23 db below the main beam, and 40 db dynamic range plus sensitivity time control (STC).
4.5.3.4.8.2 Sensor image calibration. Visible image calibrations and other built-in tests that cannot be achieved within a total latency of 100 milliseconds should occur only on either pilot command or be coordinated by aircraft data to only occur in non-critical phases of flight. If other than normal imagery is displayed during the non-uniformity correction (NUC) or other built-in tests, the image must be removed from the pilot’s display. This prohibits excessive times to complete maintenance or calibration functions which would remove or degrade the EFVS imagery during critical phases of flight, unless the pilot commands the action (with full knowledge of effect based on training and experience).
Abnormal imagery should be removed from the display to eliminate the potential for any misleading information.
4.5.3.4.8.3 Sensor resolution. As a minimum, EFVS resolution performance shall adequately resolve (for pilot identification) the runway threshold and the touchdown zone to enable the intended function. For example, an EFVS should resolve a 60 ft wide runway from 200 ft height above touchdown zone elevation with a typical 3- degree glide slope. The sensor resolution was established by providing this resolution at a minimum range, allowing the pilot to continue the descent below DA or MDA.
(These values do not take into account pilot decision time or actual atmospheric conditions, or the use of nonprecision approaches which may require greater distances.)
A 60 ft wide runway was chosen as the ICAO minimum runway width to support an instrument approach procedure.
4.5.3.4.8.4 Passive sensor optical distortion. Optical distortion should be 5 percent or less across the minimal FOR as defined in
4-21 paragraph 4.5.3.4.2 and no greater than 8 percent outside the minimal FOR.
4.5.3.4.8.5 Sensor sensitivity. In this context, the EFVS sensor sensitivity should be at least a noise equivalent temperature difference (NETD) of 50o mK tested at an appropriate ambient temperature, for passive EFVS systems or -20dB sm/sm (square meter/square meter) surface at Rmax from 200 ft height above touchdown zone elevation with a typical 3-degree glide slope for active EFVS systems.
Passive sensors for different visible or short-wave infrared sources can require very sensitive detectors, as specified by low noise equivalent powers.
4.5.3.4.8.6 Failure messages. EFVS malfunctions detected by the system, and which can adversely affect the normal operation of the EFVS, should be annunciated. As a minimum, specific in-flight failure message(s) for sensor failure and frozen image must be displayed to the flight crew.
4.5.3.4.8.7 Blooming. The sensor should incorporate features to minimize blooming, which can create an unusable or objectionable image. Objectionable blooming is defined as the condition that obscures the required visual cues defined in Figure 3. Blooming to the extent the required visual references are no longer distinctly visible and identifiable is unacceptable.
4.5.3.4.8.8 Image persistence. The image persistence time constant should be less than 100 milliseconds. However, burn-in or longer image persistence caused by high energy sources (for example, the sun saturating the infrared sensor elements), should be removed from the image to comply with paragraph 4.5.3.4.6, Image artifacts, by a secondary on-demand process (for example, the NUC process).
4.5.3.4.8.9 Dead pixels. Dead pixels or sensor elements replaced by a “bad pixel” replacement algorithm should be limited to 1 percent average of the total display area, with no cluster greater than 0.02 percent within the minimum FOR. A small number of disparate dead pixel elements can be effectively replaced by image processing but eventually, the algorithms will degrade the image quality and accuracy due to the sheer number and closely-spaced location of the element.
4.5.3.4.8.10 Parallax. The effects of parallax caused by lateral, vertical, and longitudinal offset of the sensor from the pilots’ design eye points may not impede the EFVS from performing its
4-22 intended function, as evaluated during flight test. Parallax should not cause unsatisfactory landing performance parameters (e.g., flare height; sink rate, touchdown location; groundspeed during landing, exit and taxi) between EFVS operations and visual operations in the same aircraft.
5-1 CHAPTER 5. SYSTEMS INSTALLATION CONSIDERATIONS
5.1 EVS/SVS/CVS Installations Considerations
5.1.1 EVS/SVS/CVS Pilot Controls.
5.1.1.1 The EVS/SVS/CVS display controls should be visible to, and within reach of, the pilot flying from any normal seated position. The position and movement of the controls should not lead to inadvertent operation.
5.1.1.2 The EVS/SVS/CVS controls, except those located on the pilot’s control inceptor (e.g., control wheel, yoke, stick, etc.), must be adequately illuminated for all normal background lighting conditions and must not create any objectionable reflections on other flight instruments.
5.1.1.3 There must be a means to modulate illumination unless fixed illumination of the EVS/SVS/CVS controls is shown to be satisfactory under all lighting conditions.
5.1.2 EVS/SVS/CVS Preventive Maintenance. Use manufacturer data for preventive maintenance (for example, Instructions for Continued Airworthiness, per 14 CFR §
21.50 and FAA Order 8110.54A), or other methods, techniques, and practices acceptable to the Administrator.
5.1.3 EVS/SVS/CVS Built-In Test (BIT). Provide a BIT capability that, at a minimum, limits the exposure time to latent failures consistent with the exposure limits in the system safety assessment.
5.1.4 The electrical system must be able to furnish the required power at the proper voltage for the EVS/SVS/CVS.
5.1.5 EVS/SVS/CVS System Safety Design Criteria. The overall safety requirement of the aircraft is based on installed equipment. A complete functional hazard assessment (FHA) and system safety analysis (SSA) should be conducted to identify failure modes and classify the hazard levels. To meet the safety criteria in 14 CFR §§ 23/25/27/29.1309, the system design will be demonstrated through analysis and engineering tests to preclude failures that can cause hazardously misleading information to be presented to the pilot or crew, or which can otherwise subsequently cause an unsafe condition. The following guidelines do not preclude the results of a full SSA.
The results of an SSA found acceptable to the FAA should prevail.
5.1.6 EVS/SVS/CVS Required Safety Level.
5.1.6.1.1 The airworthiness standard under which approval is sought can impact criticality (for example, 14 CFR part 23, 25, 27, or 29). Recognizing that each implementation and integration of each installation can be unique, the applicant should perform a thorough FHA, SSA, and Failure Mode and
5-2 Effects Analysis (FMEA). A system safety assessment should be performed in accordance with 14 CFR §§ 23/25/27/29.1309 that addresses both the loss as well as the incorrect display of information, including hazardously misleading information. Undetected failure conditions which cause a hazardously misleading EFVS depiction must have a probability no greater than that appropriate for the hazard effects they create.
5.1.6.1.2 To support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable), the applicant must perform a safety assessment based on the proposed installation for the given aircraft and intended function for each phase of flight. Information presented to a pilot on a PFD is considered truth unless flagged otherwise. Therefore, presenting hazardously misleading information to the pilot must be avoided. One example of hazardously misleading information (HMI) would be the aircraft level ramifications of a “frozen EVS/SVS/CVS display” that is undetected by the flight crew.
5.1.6.1.3 Once the safety assessment has been completed, for any hazard or failure classification greater than Major, a fault tree analysis (FTA) should be evaluated using the guidance found in the FAA system safety advisory circular that is applicable to the installation (e.g., AC 23.1309-1E, AC
25.1309-1A, AC 27-1B (containing AC 27.1309) and 29-2C). The FTA should include the display monitor, power supply, IR camera and sensors, cable, status annunciations, and other components that affect the top-level events.
5.1.6.1.4 The variables influencing the outcome of the failure condition and its classification vary between 14 CFR parts 23, 25, 27, and 29. In general, the sensor or system performance and level of design should be consistent with the SSA. Table 2 provides sample system operating phases for consideration. The results of an SSA found acceptable to the FAA should prevail.
Table 2. System Operating Phases for Considerations
GROUND TAKEOFF IN-FLIGHT LANDING
(1)Taxi
(2) Maintenance
(1) Takeoff Roll Prior to V1,
(2) Takeoff Roll After V1,
(3) Takeoff After VR to 200’
(4) Rejected Takeoff
(1) Climb
(2) Gear Up,
(3) Cruise
(4) Descent,
(5) Gear Down,
(6) Approach 200’ to 0’
(7) Go Around
(1) Touchdown & Rollout
(2) Taxi
5-3
5.1.6.1.5 The normal operation (without malfunction) of the EVS/SVS/CVS may not adversely affect, or be adversely affected by other normally operating aircraft functions. The criticality of the EVS/SVS/CVS system’s function to display imagery, including the potential to display hazardously misleading information, should be assessed according to the applicable 14 CFR §§ 23/25/27/29.1309, AC 25-11B chapter 4, and AC 23/25/27/29.1309, System Safety Analysis and Assessment for Part 23/25 Airplanes. Likewise, the hazard effects of any malfunction of the EVS/SVS/CVS that could adversely affect interfaced equipment or associated systems should be determined and assessed according to the applicable 14 CFR §§ 23/25/27/29.1309, AC 25-11B chapter 4, and AC 23/25/27/29.1309. As applicable, similar criteria are found in SAE ARP 4754, and ARP 4761.
5.1.7 EVS/SVS/CVS Environmental Specifications. The EVS/SVS/CVS should meet all specified operating conditions and should provide required operating performance, life and reliability when operating within the aircraft and subsystem flight envelope as specified in RTCA DO-160F (or as revised) Environmental Conditions and Test Procedures for Airborne Equipment. These criteria must also include the high-intensity radiated fields (HIRF), electromagnetic interference (EMI), and lightning requirements as specified in the certification basis of the aircraft to be installed. A lightning zone analysis and assessment of the effects of lightning strike on the camera in conjunction with other cockpit equipment should be accomplished. The installation must be designed in a manner that lightning strikes on the EVS/SVS/CVS system does not cause catastrophic effects on the aircraft.
5.2 EFVS Display (HUD or Equivalent) Installation Considerations
5.2.1 EFVS Annunciations. Any modes of EFVS operation should be annunciated on the flight deck and visible to the crew. The modes of the EFVS operation must be made available to the flight data recorder as required.
5.2.2 EFVS Display.
5.2.2.1 Display resolution. Since the sensor can be active or passive, the EFVS display should adequately resolve a 60 ft. wide runway from 200 ft. height above touchdown zone elevation with a typical 3-degree glide slope. The pilot needs to be able to detect and accurately identify the visual references in the image.
5.2.2.2 Imagery and symbology display. Imagery must not degrade presentation of essential flight information on the HUD. The pilot's ability to see and use the required primary flight display information such as primary attitude, airspeed, altitude, and command bars must not be hindered or compromised by the EFVS image on the HUD.
5-4
5.2.2.3 Flare Cue. An EFVS Landing System must have a flare cue because it is intended to enable landing in low visibility. The flare cue, whether a flare prompt or flare guidance, should demonstrate compliance to the landing criteria found in paragraph 6.2. For some aircraft, flare guidance may be required because a flare prompt is not sufficient.
5.2.2.3.1 Flare Prompt. A flare prompt is intended to notify the pilot that it is time to initiate the flare maneuver, but does not guide the pilot’s manual pitch control inputs. The pilot should use situational information (e.g., altitude, vertical rate, attitude, FPV, perspective view of the runway) from the EFVS to judge the magnitude and rate of manual pitch control inputs. The appearance and dynamic behavior of the flare prompt should be distinguishable from command guidance. The flare prompt should appear timely and conspicuously to the pilot using the HUD so that the flare maneuver will be neither too early nor too late and within the touchdown zone as described in paragraph 6.2 of this document.
5.2.2.3.2 Flare Guidance. Flare guidance provides explicit command guidance for the pilot to perform the flare maneuver in so that the flare would be neither too early nor too late and within the touchdown zone as described in paragraph 6.2 of this document.
5.2.3 EFVS Maintenance. Instructions for Continued Airworthiness are to be furnished after final design approval (reference 14 CFR § 21.50 and FAA Order 8110.54A).
5.2.4 EFVS Built-in Test (BIT). Provide a BIT capability (or equivalent means) that, at a minimum, limits the exposure time to latent failures in support of the system safety assessment.
5.2.5 EFVS System Safety Design Criteria to support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable).
5.2.5.1 The overall level of safety of the aircraft is based on installed equipment.
A complete system safety analysis (SSA) should be conducted to identify failure modes and classify the hazard levels. To meet the safety criteria, the system design should preclude failures that can cause hazardously misleading information (HMI) to be presented to the pilot or crew, or which can otherwise subsequently cause an unsafe condition. For example, HMI could include information providing attitude, altitude, and distance cues as outside terrain imagery. This demonstration should be accomplished through analysis and engineering tests.
5.2.5.1.1 The EFVS system must perform its intended function for each applicable operation and phase of flight that it would use.
5.2.5.1.2 The normal operation of the EFVS cannot adversely affect, or be adversely affected by other aircraft systems. Annunciate detected
5-5 malfunctions of the EFVS system and remove the malfunctioning display elements.
5.2.5.2 Appendix B, Table 4 lists the categories of systems and failure probabilities to meet the safety criteria in 14 CFR part 25 airplanes (AC
25.1309-1A). For 14 CFR part 23 aircraft, similar information can be found in 14 CFR § 23.1309 and AC 23.1309-1E. The following additional guidance helps assess the criticality of the EFVS display, including the potential to display HMI:
AC 25-11B (chapter 4), AC 23.1311-1C, and AC 27-1B and AC 29-2C, as appropriate for the installation.
5.2.5.3 Validate all alleviating flightcrew actions that are considered in the EFVS safety analysis during testing either for incorporation in the AFM/AFMS or RFM/RFMS limitation section, procedures section or for inclusion in type-specific training.
5.2.6 EFVS Approach System Required Level of Safety to support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable).
5.2.6.1 When you are designing an EFVS Approach System, establish safety design goals for airworthiness approval. The safety criteria for each phase of flight, including approach and landing systems are defined in terms of accuracy, continuity, availability, and integrity. FAA design guidance provides criteria to determine the overall required level of safety for the aircraft, in any mode of flight, for any combination of failures which can cause an unsafe condition to be fully assessed and categorized. This includes the probability of the pilot(s) to cope with these failures. The hazard level for any aircraft system depends on the ability of the pilot(s) to cope with failures. For failures where the SSA assumes a particular pilot intervention to limit the hazard effects, for example from Catastrophic or Hazardous to Major or Minor, the applicant must show the pilot can be relied on to perform that intervention. For example, the pilot might be assumed to detect a system error because of other displays or view out the window. It should be demonstrated that pilots can detect the error in a timely fashion and not be hazardously misled. The demonstration must validate the proposed hazard classification, as applicable (see Appendix B, Table 4).
5.2.6.2 The applicant should demonstrate a satisfactory safety (failure and performance) level which must not be less than the safety level required for non-EFVS Approach System based precision and non-precision approaches with decision altitudes of 200 ft. or above. In showing compliance, probabilities cannot be factored by the fraction of approaches which are made using EFVS. Consideration, however, can be given to the
5-6 EFVS Approach System critical flight time, such as from the highest DH that can be expected for an EFVS Approach System based approach to 100 ft. above the TDZE.
5.2.6.3 The design assurance levels (DALs) are directly linked to the specific intended use and to the specific EFVS Approach System installation as an integrated part of the cockpit flight information system.
5.2.6.4 There are failure modes within the EFVS Approach System which determine that software and hardware DALs should be RTCA/DO-178C (or latest version). In no case should the DAL for EFVS Approach System be less than Level C. However, dependent upon the mitigations for failure conditions in the design, stemming from the specific EFVS and cockpit installations, the DALs can be higher than Level C.
5.2.6.5 The aircraft level functional hazard analysis (FHA) you prepare should determine whether the minimum required DAL level C is adequate for your specific installation. An example FHA is shown in Appendix B, but is a model case only and cannot be applied to any specific aircraft without independent analysis.
5.2.6.6 For general guidance only. An example system safety analysis (SSA) of an EFVS Approach System was performed for a certification on an instrument flight capable aircraft for straight-in landings from nonprecision and precision approach and landing operations per 14 CFR §
91.176(b) is shown in Appendix B. The applicant must provide the applicable 14 CFR §§ 23, 25, 27, and 29.1309 analysis that is specific for each installation approval.
5.2.6.7 Conduct a safety analysis to show the EFVS Approach System meets all the integrity criteria for the aircraft, HUD, and EFVS. Demonstrate system and subsystem malfunctions which are not shown to be extremely improbable as appropriate in a simulation or in flight. The malfunction annunciation and fault detection schemes must achieve the determined level of safety.
5.2.7 EFVS Landing System Required Level of Safety to support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable).
5.2.7.1 The applicant must demonstrate a satisfactory level of safety (failure and performance) appropriate to the operations being addressed, but with the visual segment primarily accomplished by the use of an EFVS Landing System rather than natural vision.
5.2.7.2 To achieve the required safety level, the minimum baseline safety levels required for the installed EFVS Landing System equipment regardless of visibility, should be dependent on the demonstrated performance.
5-7
5.2.7.3 An aircraft level Functional Hazard Analysis (FHA) and System Safety Assessment (SSA) should be prepared by the applicant to assess the hazard level associated with system failure conditions and to determine the minimum required software and hardware Design Assurance Levels (DAL) based on the applicant’s specific installation. Mitigating system design features include redundancy, independent guidance display, system monitoring, pilot in the loop, pilot not flying, etc. In no case should the DAL be less than DAL C.
5.2.7.4 The minimum required safety level for an EFVS Landing System (EFVS to touchdown and roll out in visibilities not less than RVR 1000 feet) is based on the assumption that the EFVS being certified can demonstrate that the flight crew verify that the aircraft is safely approaching the runway for EFVS Landing System based landing, or, if not, to initiate a timely go around at the RVR level that the applicant is requesting. This provides additional integrity to the operation. Depending on the applicant’s design, it may be possible that the proposed visibility can also compensate for loss of EFVS imagery, such that the pilot can use the remaining symbolic flight information on the HUD and the external view to safely land. System evaluation should consider EFVS Landing System failure modes and whether the pilot can safely land and rollout with available natural vision plus whatever remains of EFVS Landing System.
In no case should the pilot continue the landing if enhanced or natural vision is not at least that specified in the instrument approach procedure.
A Safe landing should not be assumed with only available natural vision after total loss of EFVS Landing System (i.e., symbology and image).
5.2.7.5 In showing compliance with these safety criteria, do not factor probabilities of EFVS Landing System failure conditions by the fraction of approaches which require EFVS Landing System. Also, do not factor probabilities of EFVS Landing System failure conditions by a statistical distribution of visibility conditions. The exposure time used for EFVS Landing System failure calculations should be the elapsed time from descent below the highest expected DA/DH for the EFVS Landing System based approach to completion of rollout to a safe taxi speed.
5.2.8 System Safety Assessment to support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable).
5.2.8.1 An aircraft level Functional Hazard Analysis (FHA) should be prepared by the applicant to assess the hazard level associated with system failure conditions and to determine that the minimum required software and hardware Design Assurance Levels (DALs) are appropriate to the applicant’s specific intended function.
5.2.8.2 The DALs are directly linked to the specific intended use and to the specific EFVS installation as an integrated part of the cockpit flight
5-8 information system. The availability and integrity of situational and flight path information from sources other than the EFVS image and the ability of the pilot monitoring to monitor the operation should be considered when assessing the appropriate hazard levels for the EFVS.
5.2.8.3 The applicant should provide a System Safety Assessment (SSA) for compliance to the applicable 14 CFR §§ 23/25/27/29.1309 regulation.
5.2.8.4 The safety assessment should show that the applicant’s specific installation meets all the integrity criteria for the aircraft systems, and EFVS.
5.2.8.5 The applicant may need to demonstrate by flight test or simulation, combinations of EFVS malfunctions that are not shown to be extremely improbable (10-9).
5.2.8.6 Any malfunction fault detection and annunciation schemes must satisfy the required levels of safety and must perform their intended functions.
5.2.8.7 All aircraft configurations to be certified must be addressed.
5.2.9 EFVS Fail Safe Features. The normal operation of the EFVS may not adversely affect, or be adversely affected by other normally operating aircraft systems. Malfunctions of the EFVS which could cause display of misleading information must be annunciated and the misleading information removed. The criticality of the EFVS’s function to display imagery, including the potential to display hazardously misleading information, should be assessed according to 14 CFR 25.1309, AC 25-11B, and AC 25.1309-1A.
Likewise, the hazard effects of any malfunction of the EFVS that could adversely affect interfaced equipment or associated systems should be determined and assessed according to 14 CFR 25.1309, AC 25-11B, and AC 25.1309-1A. As applicable, similar criteria are found in 14 CFR 23.1309, and AC 23.1309-1E, 14 CFR § 27.1309 and AC 27-1B and 14 CFR § 29.1309 and AC 29-2C. This requirement must be met through a system safety assessment and documented via FTA, failure mode and effects analysis (FMEA), and failure mode and effects analysis substantiation (FMEA Substantiation), or equivalent safety documentation.
5.2.10 EFVS Environmental Specifications. The EFVS must meet all specified operating criteria and must provide required operating performance, life and reliability when operating within the aircraft and subsystem flight envelope as specified in RTCA/DO- 160G (as revised) Environmental Conditions and Test Procedures for Airborne Equipment, or future versions. These criteria must also include the HIRF, EMI, and lightning requirements as specified in the certification basis of the aircraft to be installed.
5-9
5.3 HIRF Considerations for All Installations (EVS, SVS, CVS, and EFVS).
5.3.1 The immunity of critical avionics/electronics and electrical systems to High-Intensity Radiated Fields (HIRF) must be established. Critical functions are those whose failure would contribute to or cause a failure condition that would prevent the continued safe flight and landing of the aircraft. Refer to AC 20-158A, The Certification of Aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment, for compatibility with other systems.
5.3.2 New avionics/electronics and electrical systems performing critical functions should be designed and installed to preclude component damage and interruption of function due to both the direct and indirect effects of HIRF. For these systems, compliance must be shown to 14 CFR § 23.1308(a), 25.13l7(a), 27.13l7(a), or 29.1317(a), as appropriate.
Note: AC 20-158A (paragraph 6) provides guidance on Approaches to Compliance.