5-3
5.1.6.1.5 The normal operation (without malfunction) of the EVS/SVS/CVS may not adversely affect, or be adversely affected by other normally operating aircraft functions. The criticality of the EVS/SVS/CVS system’s function to display imagery, including the potential to display hazardously misleading information, should be assessed according to the applicable 14 CFR §§ 23/25/27/29.1309, AC 25-11B chapter 4, and AC 23/25/27/29.1309, System Safety Analysis and Assessment for Part 23/25 Airplanes. Likewise, the hazard effects of any malfunction of the EVS/SVS/CVS that could adversely affect interfaced equipment or associated systems should be determined and assessed according to the applicable 14 CFR §§ 23/25/27/29.1309, AC 25-11B chapter 4, and AC 23/25/27/29.1309. As applicable, similar criteria are found in SAE ARP 4754, and ARP 4761.
5.1.7 EVS/SVS/CVS Environmental Specifications. The EVS/SVS/CVS should meet all specified operating conditions and should provide required operating performance, life and reliability when operating within the aircraft and subsystem flight envelope as specified in RTCA DO-160F (or as revised) Environmental Conditions and Test Procedures for Airborne Equipment. These criteria must also include the high-intensity radiated fields (HIRF), electromagnetic interference (EMI), and lightning requirements as specified in the certification basis of the aircraft to be installed. A lightning zone analysis and assessment of the effects of lightning strike on the camera in conjunction with other cockpit equipment should be accomplished. The installation must be designed in a manner that lightning strikes on the EVS/SVS/CVS system does not cause catastrophic effects on the aircraft.
5.2 EFVS Display (HUD or Equivalent) Installation Considerations
5.2.1 EFVS Annunciations. Any modes of EFVS operation should be annunciated on the flight deck and visible to the crew. The modes of the EFVS operation must be made available to the flight data recorder as required.
5.2.2 EFVS Display.
5.2.2.1 Display resolution. Since the sensor can be active or passive, the EFVS display should adequately resolve a 60 ft. wide runway from 200 ft. height above touchdown zone elevation with a typical 3-degree glide slope. The pilot needs to be able to detect and accurately identify the visual references in the image.
5.2.2.2 Imagery and symbology display. Imagery must not degrade presentation of essential flight information on the HUD. The pilot's ability to see and use the required primary flight display information such as primary attitude, airspeed, altitude, and command bars must not be hindered or compromised by the EFVS image on the HUD.
5-4
5.2.2.3 Flare Cue. An EFVS Landing System must have a flare cue because it is intended to enable landing in low visibility. The flare cue, whether a flare prompt or flare guidance, should demonstrate compliance to the landing criteria found in paragraph 6.2. For some aircraft, flare guidance may be required because a flare prompt is not sufficient.
5.2.2.3.1 Flare Prompt. A flare prompt is intended to notify the pilot that it is time to initiate the flare maneuver, but does not guide the pilot’s manual pitch control inputs. The pilot should use situational information (e.g., altitude, vertical rate, attitude, FPV, perspective view of the runway) from the EFVS to judge the magnitude and rate of manual pitch control inputs. The appearance and dynamic behavior of the flare prompt should be distinguishable from command guidance. The flare prompt should appear timely and conspicuously to the pilot using the HUD so that the flare maneuver will be neither too early nor too late and within the touchdown zone as described in paragraph 6.2 of this document.
5.2.2.3.2 Flare Guidance. Flare guidance provides explicit command guidance for the pilot to perform the flare maneuver in so that the flare would be neither too early nor too late and within the touchdown zone as described in paragraph 6.2 of this document.
5.2.3 EFVS Maintenance. Instructions for Continued Airworthiness are to be furnished after final design approval (reference 14 CFR § 21.50 and FAA Order 8110.54A).
5.2.4 EFVS Built-in Test (BIT). Provide a BIT capability (or equivalent means) that, at a minimum, limits the exposure time to latent failures in support of the system safety assessment.
5.2.5 EFVS System Safety Design Criteria to support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable).
5.2.5.1 The overall level of safety of the aircraft is based on installed equipment.
A complete system safety analysis (SSA) should be conducted to identify failure modes and classify the hazard levels. To meet the safety criteria, the system design should preclude failures that can cause hazardously misleading information (HMI) to be presented to the pilot or crew, or which can otherwise subsequently cause an unsafe condition. For example, HMI could include information providing attitude, altitude, and distance cues as outside terrain imagery. This demonstration should be accomplished through analysis and engineering tests.
5.2.5.1.1 The EFVS system must perform its intended function for each applicable operation and phase of flight that it would use.
5.2.5.1.2 The normal operation of the EFVS cannot adversely affect, or be adversely affected by other aircraft systems. Annunciate detected
5-5 malfunctions of the EFVS system and remove the malfunctioning display elements.
5.2.5.2 Appendix B, Table 4 lists the categories of systems and failure probabilities to meet the safety criteria in 14 CFR part 25 airplanes (AC
25.1309-1A). For 14 CFR part 23 aircraft, similar information can be found in 14 CFR § 23.1309 and AC 23.1309-1E. The following additional guidance helps assess the criticality of the EFVS display, including the potential to display HMI:
AC 25-11B (chapter 4), AC 23.1311-1C, and AC 27-1B and AC 29-2C, as appropriate for the installation.
5.2.5.3 Validate all alleviating flightcrew actions that are considered in the EFVS safety analysis during testing either for incorporation in the AFM/AFMS or RFM/RFMS limitation section, procedures section or for inclusion in type-specific training.
5.2.6 EFVS Approach System Required Level of Safety to support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable).
5.2.6.1 When you are designing an EFVS Approach System, establish safety design goals for airworthiness approval. The safety criteria for each phase of flight, including approach and landing systems are defined in terms of accuracy, continuity, availability, and integrity. FAA design guidance provides criteria to determine the overall required level of safety for the aircraft, in any mode of flight, for any combination of failures which can cause an unsafe condition to be fully assessed and categorized. This includes the probability of the pilot(s) to cope with these failures. The hazard level for any aircraft system depends on the ability of the pilot(s) to cope with failures. For failures where the SSA assumes a particular pilot intervention to limit the hazard effects, for example from Catastrophic or Hazardous to Major or Minor, the applicant must show the pilot can be relied on to perform that intervention. For example, the pilot might be assumed to detect a system error because of other displays or view out the window. It should be demonstrated that pilots can detect the error in a timely fashion and not be hazardously misled. The demonstration must validate the proposed hazard classification, as applicable (see Appendix B, Table 4).
5.2.6.2 The applicant should demonstrate a satisfactory safety (failure and performance) level which must not be less than the safety level required for non-EFVS Approach System based precision and non-precision approaches with decision altitudes of 200 ft. or above. In showing compliance, probabilities cannot be factored by the fraction of approaches which are made using EFVS. Consideration, however, can be given to the
5-6 EFVS Approach System critical flight time, such as from the highest DH that can be expected for an EFVS Approach System based approach to 100 ft. above the TDZE.
5.2.6.3 The design assurance levels (DALs) are directly linked to the specific intended use and to the specific EFVS Approach System installation as an integrated part of the cockpit flight information system.
5.2.6.4 There are failure modes within the EFVS Approach System which determine that software and hardware DALs should be RTCA/DO-178C (or latest version). In no case should the DAL for EFVS Approach System be less than Level C. However, dependent upon the mitigations for failure conditions in the design, stemming from the specific EFVS and cockpit installations, the DALs can be higher than Level C.
5.2.6.5 The aircraft level functional hazard analysis (FHA) you prepare should determine whether the minimum required DAL level C is adequate for your specific installation. An example FHA is shown in Appendix B, but is a model case only and cannot be applied to any specific aircraft without independent analysis.
5.2.6.6 For general guidance only. An example system safety analysis (SSA) of an EFVS Approach System was performed for a certification on an instrument flight capable aircraft for straight-in landings from nonprecision and precision approach and landing operations per 14 CFR §
91.176(b) is shown in Appendix B. The applicant must provide the applicable 14 CFR §§ 23, 25, 27, and 29.1309 analysis that is specific for each installation approval.
5.2.6.7 Conduct a safety analysis to show the EFVS Approach System meets all the integrity criteria for the aircraft, HUD, and EFVS. Demonstrate system and subsystem malfunctions which are not shown to be extremely improbable as appropriate in a simulation or in flight. The malfunction annunciation and fault detection schemes must achieve the determined level of safety.
5.2.7 EFVS Landing System Required Level of Safety to support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable).
5.2.7.1 The applicant must demonstrate a satisfactory level of safety (failure and performance) appropriate to the operations being addressed, but with the visual segment primarily accomplished by the use of an EFVS Landing System rather than natural vision.
5.2.7.2 To achieve the required safety level, the minimum baseline safety levels required for the installed EFVS Landing System equipment regardless of visibility, should be dependent on the demonstrated performance.
5-7
5.2.7.3 An aircraft level Functional Hazard Analysis (FHA) and System Safety Assessment (SSA) should be prepared by the applicant to assess the hazard level associated with system failure conditions and to determine the minimum required software and hardware Design Assurance Levels (DAL) based on the applicant’s specific installation. Mitigating system design features include redundancy, independent guidance display, system monitoring, pilot in the loop, pilot not flying, etc. In no case should the DAL be less than DAL C.
5.2.7.4 The minimum required safety level for an EFVS Landing System (EFVS to touchdown and roll out in visibilities not less than RVR 1000 feet) is based on the assumption that the EFVS being certified can demonstrate that the flight crew verify that the aircraft is safely approaching the runway for EFVS Landing System based landing, or, if not, to initiate a timely go around at the RVR level that the applicant is requesting. This provides additional integrity to the operation. Depending on the applicant’s design, it may be possible that the proposed visibility can also compensate for loss of EFVS imagery, such that the pilot can use the remaining symbolic flight information on the HUD and the external view to safely land. System evaluation should consider EFVS Landing System failure modes and whether the pilot can safely land and rollout with available natural vision plus whatever remains of EFVS Landing System.
In no case should the pilot continue the landing if enhanced or natural vision is not at least that specified in the instrument approach procedure.
A Safe landing should not be assumed with only available natural vision after total loss of EFVS Landing System (i.e., symbology and image).
5.2.7.5 In showing compliance with these safety criteria, do not factor probabilities of EFVS Landing System failure conditions by the fraction of approaches which require EFVS Landing System. Also, do not factor probabilities of EFVS Landing System failure conditions by a statistical distribution of visibility conditions. The exposure time used for EFVS Landing System failure calculations should be the elapsed time from descent below the highest expected DA/DH for the EFVS Landing System based approach to completion of rollout to a safe taxi speed.
5.2.8 System Safety Assessment to support the 14 CFR §§ 23/25/27/29.1309 analysis (as applicable).
5.2.8.1 An aircraft level Functional Hazard Analysis (FHA) should be prepared by the applicant to assess the hazard level associated with system failure conditions and to determine that the minimum required software and hardware Design Assurance Levels (DALs) are appropriate to the applicant’s specific intended function.
5.2.8.2 The DALs are directly linked to the specific intended use and to the specific EFVS installation as an integrated part of the cockpit flight
5-8 information system. The availability and integrity of situational and flight path information from sources other than the EFVS image and the ability of the pilot monitoring to monitor the operation should be considered when assessing the appropriate hazard levels for the EFVS.
5.2.8.3 The applicant should provide a System Safety Assessment (SSA) for compliance to the applicable 14 CFR §§ 23/25/27/29.1309 regulation.
5.2.8.4 The safety assessment should show that the applicant’s specific installation meets all the integrity criteria for the aircraft systems, and EFVS.
5.2.8.5 The applicant may need to demonstrate by flight test or simulation, combinations of EFVS malfunctions that are not shown to be extremely improbable (10-9).
5.2.8.6 Any malfunction fault detection and annunciation schemes must satisfy the required levels of safety and must perform their intended functions.
5.2.8.7 All aircraft configurations to be certified must be addressed.
5.2.9 EFVS Fail Safe Features. The normal operation of the EFVS may not adversely affect, or be adversely affected by other normally operating aircraft systems. Malfunctions of the EFVS which could cause display of misleading information must be annunciated and the misleading information removed. The criticality of the EFVS’s function to display imagery, including the potential to display hazardously misleading information, should be assessed according to 14 CFR 25.1309, AC 25-11B, and AC 25.1309-1A.
Likewise, the hazard effects of any malfunction of the EFVS that could adversely affect interfaced equipment or associated systems should be determined and assessed according to 14 CFR 25.1309, AC 25-11B, and AC 25.1309-1A. As applicable, similar criteria are found in 14 CFR 23.1309, and AC 23.1309-1E, 14 CFR § 27.1309 and AC 27-1B and 14 CFR § 29.1309 and AC 29-2C. This requirement must be met through a system safety assessment and documented via FTA, failure mode and effects analysis (FMEA), and failure mode and effects analysis substantiation (FMEA Substantiation), or equivalent safety documentation.
5.2.10 EFVS Environmental Specifications. The EFVS must meet all specified operating criteria and must provide required operating performance, life and reliability when operating within the aircraft and subsystem flight envelope as specified in RTCA/DO- 160G (as revised) Environmental Conditions and Test Procedures for Airborne Equipment, or future versions. These criteria must also include the HIRF, EMI, and lightning requirements as specified in the certification basis of the aircraft to be installed.
5-9
5.3 HIRF Considerations for All Installations (EVS, SVS, CVS, and EFVS).
5.3.1 The immunity of critical avionics/electronics and electrical systems to High-Intensity Radiated Fields (HIRF) must be established. Critical functions are those whose failure would contribute to or cause a failure condition that would prevent the continued safe flight and landing of the aircraft. Refer to AC 20-158A, The Certification of Aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment, for compatibility with other systems.
5.3.2 New avionics/electronics and electrical systems performing critical functions should be designed and installed to preclude component damage and interruption of function due to both the direct and indirect effects of HIRF. For these systems, compliance must be shown to 14 CFR § 23.1308(a), 25.13l7(a), 27.13l7(a), or 29.1317(a), as appropriate.
Note: AC 20-158A (paragraph 6) provides guidance on Approaches to Compliance.
6-1 CHAPTER 6. PERFORMANCE EVALUATION
6.1 EVS/SVS/EFVS Performance Demonstration
6.1.1 The performance demonstration, establishing aircraft system compliance with applicable FAA regulations, typically includes bench testing, simulation flight testing, data collection, and data reduction to show that the proposed performance criteria can be met. Minimal performance standards necessitate an evaluation of the system used during anticipated operational scenarios. The performance evaluations should therefore include demonstrations of taxi, take-off, missed approaches, failure conditions, cross wind conditions, and approaches into specific airports as appropriate for the system’s intended function. For EFVS, the applicant should demonstrate performance at the lateral and vertical limits for the type of approach (for example, precision, nonprecision, and approach with vertical guidance) for which operational credit being sought. Appendix D provides sample EFVS flight test considerations.
6.1.2 No specific test procedures are cited, as it is recognized that alternative methods can be used. Alternate procedures can be used if it can be demonstrated that they provide all the information needed to show compliance with the applicable regulations. System performance tests as they relate to operational capability are the most important tests.
Subsystem tests are used as subsystems are added during system buildup to ensure appropriate subsystem performance as it relates to overall system performance.
6.1.3 The applicant should use any of these four general verification methods (refer to AC
25.1329-1C, AC 23.1309-1E, AC 27-1B or AC29-2C as applicable)
6.1.3.1 Analysis. Demonstrate compliance using an engineering analysis.
6.1.3.2 Flight Test. Demonstrate compliance using an aircraft that is fully representative for the purpose of the test in terms of flight deck geometry, instrumentation, alerts, indications, and controls (in the air or on the ground).
6.1.3.3 Laboratory Test. Demonstrate compliance using an engineering bench representative of the final EVS/SVS/CVS/EFVS system being certified.
6.1.3.4 Simulation. Demonstrate compliance using a flight simulator.
6.1.4 Specify the individual verification methods that you use in the certification plan.
Confirm the appropriate certification office agrees with your plan before you begin. For extensions, features, and design decisions not explicitly specified in this AC, conduct human factors evaluations. Conduct these evaluations through analyses, bench, simulation, or flight testing.
6.1.5 Verify both the installed system and the individual system components meet the EVS/SVS/CVS/EFVS criteria described in Chapter 4.
6-2
6.1.6 Demonstrate the system meets performance criteria specified in Chapter 4 by flight test and other appropriate means, which can include use of a flight simulator. An example of a flight test program for EFVS is described in Appendix D in this AC. The flight test program assumes that the guidance system utilized to satisfactorily position the aircraft at the DA/DH or MDA has been separately tested and shown to fully perform its intended function. Testing and data collection to demonstrate this is not part of this document.
6.1.7 Airframe and equipment manufacturer based tests or analyses, as applicable, should be developed and conducted to validate the detailed system criteria. No specific test procedures are cited because alternative methods can be used. You can use alternate procedures if you can demonstrate that they provide all the required information.
System performance tests as they relate to operational capability are the most important tests. Subsystem tests are used as subsystems are added during system buildup to ensure appropriate subsystem performance as it relates to overall system performance.
6.1.8 Conduct an evaluation of the system used during anticipated operational scenarios.
6.1.9 For EFVS testing: If the aircraft meets all of the applicable airworthiness requirements specified in 14 CFR §§ 91.176(a)(1)(i), (a)(2)(iii), (b)(1)(i), and (b)(2)(iii) does not aply to operations conducted in an aircraft issued an experimental certificate under 14 CFR § 21.191 for the purposes of research and development or showing compliance with regulations, provided that the operations can be conducted safely in accordance with operating limitations issued for that purpose
6.2 Performance Demonstration of EFVS Landing System.
6.2.1 Where appropriate for the performance demonstration, the non-visual conditions can be achieved either by natural obscuration or by use of a visibility limiting device in front of the pilot. Caution should be used if the applicant chooses to use a visibility limiting device for system performance demonstrations. Visibility-limiting devices may not adequately simulate low visibility conditions for all EFVS Landing System landing performance demonstrations because of the unrealistically good external visibility outside the HUD FOV and the unrealistic EFVS Landing System image performance in good atmospheric conditions.
6.2.2 The workload associated with the use of EFVS Landing System for approach, landing and rollout must be considered when showing compliance with 14 CFR §§ 23/25/27/29.1523.
6.2.3 Final approach course offsets greater than 3 degrees will be subject to additional flight test evaluation. The maximum allowable final approach course offset is established by flight test. These tests should include the factors related to the offset, such as HUD/EFVS field of view, crosswinds, and the maximum drift angle for a conformal flight path vector.
6-3
6.2.4 The EFVS Landing System image, with superimposed flight symbology, must not mislead, distract or jeopardize the safety of the landing and rollout. Performance shall be demonstrated to be no worse than that normally achieved in visual operations for the specific aircraft for all performance parameters measured. The applicant may propose a valid means for establishing performance normally achieved that the FAA may accept as a benchmark for the EFVS demonstrations.
6.2.5 Benchmark data establishing equivalence to normal visual operations with the specific aircraft would not normally be necessary. However, if flight test results show deviations for the standard criteria listed above, then benchmark data might be used to establish the equivalence of EFVS Landing System operations to normal visual operations for that specific aircraft.
6.2.6 Without requiring exceptional pilot skill, alerting, strength, or workload, the image/symbology should provide the visual cues for the pilot to perform the following items.
6.2.6.1 Speed control within +10/-5 knots of the approach speed, whether manually controlled or with auto-throttle, as proposed by the applicant, up to the point where the throttles are retarded for landing.
6.2.6.2 A smooth transition through flare to landing.
6.2.6.3 Approach, flare, and landing at a normal sink rate for the aircraft.
6.2.6.4 All touchdowns in the touchdown zone. Lateral touchdown performance must be demonstrated to be no worse than that achieved in visual operations for the specific aircraft. Longitudinal touchdown performance must be demonstrated within the touchdown zone which is the first one third, or the first 3000ft, of the usable runway, whichever is more restrictive, and demonstrated to be equivalent or better than that achieved in visual operations for the specific aircraft.
6.2.6.5 Prompt and predictable correction of any lateral deviation away from the runway centerline to smoothly intercept the centerline.
6.2.6.6 Touchdowns with a bank angle that is not hazardous to the airplane.
6.2.6.7 Demonstrated performance of the installed EFVS at representative visibilities for EFVS Approach System and EFVS Landing System operations as described in this document, will determine any additional limitation (for example, crosswind and offset).
6.2.6.8 A normal derotation.
6.2.6.9 Satisfactory and smooth control of the airplane from touchdown to a safe taxi speed.
6-4
6.2.6.10 Satisfactory and smooth control of the path of the airplane along the runway centerline through rollout to a safe taxi speed.
6.2.6.11 A safe go around anytime including up to touchdown in all configurations to be certified.
6.3 Environmental Qualification and Design Assurance.
6.3.1 Installed equipment meets the criteria in RTCA/DO-160G (as revised).
6.3.2 Design Assurance.
6.3.2.1 Follow the criteria of RTCA/DO-178C or higher, Software Considerations in Airborne Systems and Equipment Certification, to conduct software design assurance tests. The version must be current at time of application.
6.3.2.2 Follow the criteria of RTCA/DO-254, Design Assurance Guideline for Airborne Electronic Hardware, to conduct hardware design assurance tests, if applicable. The version must be current at time of application.
Appendix A A-1 APPENDIX A. FAA EFVS 14 CFR COMPLIANCE (PARTIAL LIST) A.1 Airworthiness Standards.
A.1.1 Certification Procedures for Products and Parts (14 CFR part 21).
A.1.2 Normal, Utility, Acrobatic, and Commuter Category Airplanes (14 CFR part 23).
A.1.3 Transport Category Airplanes (14 CFR part 25).
A.1.4 Normal Category Rotorcraft (14 CFR part 27).
A.1.5 Transport Category Rotorcraft (14 CFR part 29).
A.2 EFVS Compliance.
The following requirements address EFVS and some of them could be in addition to HUD criteria and the basic avionics installation. The amount of new test data can be determined by the individual application, availability, and relevance of data.
Table 3. EFVS Acceptable Methods of Compliance 14 CFR § Description Acceptable Method of Compliance 23/25/27/29.143 General controllability and maneuverability Analysis, Simulation, Flight Test 23/25/27/29.251 Vibration and buffeting Flight Test 23/25/27/29.301 Loads Analysis 23/25/27/29.303 Factor of safety Analysis 23/25/27/29.307 Proof of structure Analysis
25.561/25.562(c)(5)) Emergency landing conditions;
Head Injury Criterion (HIC) Analysis 25/27/29.571 and
23.573 Damage-tolerance and fatigue evaluation of structure Analysis