22.4 Color for Depiction of Weather Precipitation and Turbulence. The depiction of weather precipitation and turbulence should be coded as indicated in the table below:
Table 6 – Color for Depiction of Weather Precipitation and Turbulence Precipitation 0-1 mm/hr Black 1-4 mm/hr Green 4-12 mm/hr Amber/Yellow 12-50 mm/hr Red Above 50 mm/hr Red or Magenta Turbulence mm/hr White or Magenta Icing mm/hr Light Blue Note: A background color (neutral color) will enhance display presentation.
22.5 Color Deviation. When the color assignments deviate from the above color set, the applicant should ensure the chosen color assignments are not susceptible to confusion of symbol meaning and increased workload. Where appropriate, color assignment should be consistent with other color displays in the panel. Luminance and color differences should not be confusing or ambiguous under any operating ambient illumination conditions. The specific colors should be consistent with change in brightness on the displays over the full range of ambient light conditions.
Under high and low levels of lighting, color degradation should not prevent the pilot from properly interpreting display information. Where precipitation is integrated with other information, the precipitation colors can be presented at half intensity. Service experience has shown that this provides enhanced presentation and reduced ambiguity. Warnings should be at full intensity.
22.6 Enhancement. Color is an enhancement for understanding the display information that leads to performance improvement, but it should not be the sole means of discrimination of critical information. Use symbols or letters, as well as color, to further enhance the effectiveness of the display. Use of color alone has been shown to be less effective than when used with distinct symbol (object, graphic, or letter). Color degradation should be obvious and should not preclude the pilot from interpreting the remaining display information. Displays should remain legible, stable, and unambiguous when operating in a degraded mode.
22.7 Color for Warnings and Cautions. For warnings and cautions, § 23.1322 provides specific requirements for assigning red and amber for visual annunciations. Use red as the warning annunciation for emergency operating conditions when immediate pilot recognition is required, and 47
immediate correction or compensatory action may be required. Use amber for the cautionary annunciation for abnormal operating conditions when immediate pilot awareness is required, and subsequent pilot action may be required. Use white or another unique color for advisory annunciations of operating conditions that require pilot awareness and, possibly, action. Use green for indication of safe operating conditions.
22.8 Airplane Flight Manual. Include a complete list of warnings, cautions, and annunciation messages in the AFM, supplemental AFM, and placards. If the manufacturer's Pilot Operating Guide is found adequate and acceptable, it may be referenced in the AFM or supplemental AFM as a means to satisfy this requirement.
22.9 Color for Aviation Routine Weather. For electronic color graphic display of aviation routine weather to surface meteorological data see TSO-C157 and AC 20-149 for guidance.
23.0 General Installation Requirements. The TC/STC/ATC/ASTC applicant must show that the installed electronic display system configuration (including hardware and software) meets the appropriate airplane certification basis. This demonstration must include applicable TSO-C113, and functional TSO(s), or equivalent, functional performance, interoperability, aircraft-level and system-level safety assessments, environmental qualification, system integration test, flight test, software assurance, hardware assurance, and other certification activities (as required to show compliance to the regulations). TC/STC/ATC/ASTC applicants may use TSO data to support airworthiness assessments if they show that the TSO requirements apply to the installation.
24.0 Aircraft Electrical Power Source.
24.1 Electrical Power. Install each electronic display instrument system so that it receives electrical power from a bus that provides the necessary reliability, according to the § 23.1309 safety assessment, without jeopardizing other essential or critical electrical loads connected to that bus.
The applicant should provide a means to indicate when adequate power is available for proper operation of the instrument.
24.2 Power Interruptions. Use techniques that reduce the momentary power interruptions or design the equipment so momentary power interruptions will not adversely affect the availability or integrity of essential information required for continued safe flight and landing. The category selected from RTCA/DO-160 for momentary power interruptions should be appropriate for the intended use. RTCA/DO-160 provides information that may be used for an acceptable means of qualifying display equipment such that they perform their intended function when subjected to anomalous input power. Large electrical loads required to restart an engine (for example, turboprops and small jets) should not affect the availability or integrity of essential information required for continued safe flight and landing.
24.3 Independent Power Source.
a. Each reversionary or standby display providing primary flight information should be powered from a power source independent of the source for the primary display. It should function independently from the power source of the primary display, such as a second alternator or battery.
b. Section 23.1331(c), Amendment 23-62, requires, for certification of IFR operations and for the heading, altitude, airspeed, and attitude, there must be at least:
(1) Two independent sources of power (not driven by the same engine on multiengine airplanes), and a manual or an automatic means to select each power source; or
(2) A separate display of parameters for heading, altitude, airspeed, and attitude that has a power source independent from the airplane's primary electrical power system.
c. Section 23.1353(h), Amendment 23-62, requires, in the event of a complete loss of the primary electrical power generating system, the battery must be capable of providing electrical power to those loads that are essential to continued safe flight and landing for:
(1) At least 30 minutes for airplanes that are certificated with a maximum altitude of 25,000 feet or less, and
(2) At least 60 minutes for airplanes that are certificated with a maximum altitude over 25,000 feet.
Note: The time period includes the time to recognize the loss of generated power and to take appropriate load shedding action.
d. The airplane's primary electrical power includes the airplane's electrical generating system and the airplane's starter battery when only one battery is installed. The starter battery is not considered an acceptable standby power source unless a proper state of charge is monitored and displayed to the pilot. The aircraft battery used for starting may satisfy the requirements of § 23.1353(h) provided its adequacy is shown through a system safety analysis under § 23.1309. In this case, an ELOS may be required; AC 23-17C provides more guidance.
e. The intent of this guidance may be met by a power generation and distribution architecture with multiple power sources and multiple distribution paths. The paths must be designed such that any single failure of a power generation or distribution component does not adversely affect the primary, reversionary, or standby displays. It does not need independent power generation sources for the primary and reversionary or standby displays for single engine airplanes if there is a different dedicated source.
f. For single engine airplanes where the engine drives the power generation devices, the engine is not considered to be a single power source for this guidance. For example, a singleengine airplane with two engine driven alternators, one powering a PFD and the other powering a reversionary PFD, is considered to meet this guidance. However, this does not exempt the applicant from the § 23.1353(h) requirements.
25.0 Safety Assessments.
25.1 Regulations Before and After Amendment 23-41. Part 23 regulations issued before Amendment 23-41 were based on single-fault or fail-safe concepts. A single failure would cause the loss of only one primary instrument function. Only mechanical or electromechanical instruments that function independently of the primary parameter display were envisioned; that is, flight and powerplant instruments were isolated and independent. Sometimes, several other instrument functions (indication of the function, display, or indicator) are housed in a common case. Since electronic displays permit presentation of several parameters on one display, a failure in the electronic display may affect more than one required parameter. Section 23.1309, Amendment 23-41 and later, allowed approval of more advanced and complex systems. Amendment 23-41, and later, also incorporated § 23.1311 into part 23, which provides the standards for electronic displays.
25.2 Common-Mode Failures. Section 23.1311(b) states that the electronic display indicators, including their systems and installations, and considering other airplane systems, must be designed so that one display of information essential for continued safe flight and landing will be available within one second to the crew by a single pilot action or by automatic means for continued safe operation, after any single failure or probable combination of failures. In general, without considering specific characteristics of an airplane design, information essential to continued safe flight and landing that should be considered are attitude, airspeed, altitude, warnings and any applicable propulsion parameter(s). Common-mode failures should be addressed. See AC
23.1309-1E for more guidance.
25.3 Safety Analysis.
a. AC 23.1309-1E describes safety assessment methods for identifying and classifying each failure condition and choosing the method(s) of safety assessment. Certification of electronic display systems may involve new and complex technology that may not use traditional serviceproven design concepts. In this case, technically qualified judgment can be enhanced when a quantitative analysis is included in the safety assessment, whether or not a quantitative analysis is required by § 23.1309.
b. The use of electronic displays allows a higher degree of integration than was practical with previous electromechanical instruments. Evaluating failure states and determining display function criticality in highly integrated systems may be complex. Safety assessment determination should refer to the display function and include all causes that could affect the displays of that function, not only the display equipment.
c. Installing electronic systems in cockpits creates complex functional interrelationships between the pilots and the display and control systems. The FHA identifies the failure conditions for all display functions, analyzes the effects on the aircraft and pilot, and assigns the corresponding criticality classification (no safety effect, minor, major, hazardous, catastrophic). It also considers both loss of functions, malfunctions, and situations that provide misleading information.
d. A pilot initiated preflight test may be used to reduce failure exposure times associated with the safety analysis required under § 23.1309. If the pilot is required to test a system before each flight, assume, for the safety analysis, the pilot will accomplish this test at least once a day, providing the preflight test is conveniently and acceptably implemented.
26.0 Software and Hardware Development Assurance.
26.1 General. Applicants must show compliance with § 23.1309, regardless of the intended function of the display system. The equipment should be designed to the appropriate software and hardware development assurance level(s) based on the intended function and application of the equipment, including the aircraft class in which it is to be installed (see AC 23.1309-1E, Figure 2).
The appropriate development assurance level(s) are determined by an analysis of the failure modes of the equipment and a categorization of the effects of the failure on the operation of the aircraft.
For the analysis for displays, a failure is defined as either a loss of function or the output of misleading information. Flight guidance information must meet the appropriate design assurance levels required for that function.
26.2 Software Guidance.
26.2.1 General. AC 20-115B addresses how RTCA/DO-178B provides an acceptable means for showing that software complies with pertinent airworthiness requirements. All software used in electronic displays systems should be developed to the guidance of RTCA/DO-178B, Software Considerations in Airborne Systems and Equipment Certification, dated December 1, 1992, or another acceptable means of compliance, as agreed to between the applicant and the appropriate FAA ACO.
26.2.2 Software Levels. Determine all software levels by appropriate safety assessments (see AC 23.1309-1E, Figure 2) and any more requirements, such as those specified by functional TSOs.
26.2.3 Field-Loadable Software (FLS). Many electronic displays systems use FLS as part of the TC/ATC/STC/ASTC installation. FLS is software that can be loaded without removal of the equipment from the aircraft installation. FLS might also include software loaded into a line replaceable unit (LRU) or hardware element at a repair station or shop. FLS can refer to either executable code or data. When obtaining certification approval for use of the FLS capability, refer to the guidance in Order 8110.49 and AC 20-170.
26.3 Electronic Hardware Guidance. If the electronic display system contains electronic devices whose functions cannot feasibly be evaluated by test and/or analysis, the electronic devices should comply with AC 23-1309-1E, 8110.105 CHG 1, and AC 20-152, which addresses how to use RTCA/DO-254. These documents provide acceptable means for showing that complex hardware complies with the pertinent airworthiness requirements. Determine the hardware levels for all hardware by the appropriate safety assessments (see AC 23.1309-1E, Figure 2) and any more requirements, such as those specified by functional TSOs.
27.0 Environmental Conditions.
27.1 General. The equipment environmental limits established by the manufacturer should be compatible with the operating environment of the airplane. Evaluation of the equipment installation should consider factors such as the maximum operating altitude of the airplane and whether the equipment is located within a temperature and pressure-controlled area. Applicable methods for testing the performance characteristics of equipment for specified environmental conditions are provided in RTCA/DO-160F. Eith er test or analysis, or both, ensures the compatibility between the operational environment and the environmental equipment category of the laboratory tests.
27.2 Temperature. Electronic systems reliability is strongly related to the temperature of the solid-state components in the system. Component temperatures are dependent on internal thermal design and external cooling. In evaluating the temperature environment, consider the additional heat generated by the equipment, especially in a location where airflow is restricted. To determine if adequate cooling is provided, the evaluation should make maximum use of previous data from comparable installations, thus limiting ground or flight tests to those installations that cannot be verified conveniently by other means. When the equipment-operating environment cannot be verified from previous experience or from an evaluation of temperature values in that equipment location, a cooling test should be conducted.
27.3 Attitude Information. It is recommended that attitude information continue to be presented for a minimum of 30 to 60 minutes after the in-flight loss of cooling for the primary instrument when operating in the normal operating environment (temperature/altitude). If proper performance of the flight instrument function(s) is adversely affected due to in-flight loss of cooling, such failure conditions should be annunciated. The applicant should consider automatic over-temperature shutdown of the system a failure condition. The subsequent pilot actions should be documented in the AFM or on placards. These actions may include procedures to allow possible recovery of a system that has an over-temperature shutdown condition.
27.4 Annunciation. Annunciation of in-flight loss of cooling or fan monitors may not be required if it is shown by a safety analysis or test demonstration that a hazardous or catastrophic failure condition does not occur. The safety analysis should consider the reliability of the fans, redundancies of the functions, reversionary features (such as the ability to transfer critical functions), the annunciation of over-temperature and its response time, and the availability of other flight instrumentation. In some systems, cooling fans may only be installed to extend the life of the components and not to prevent a failure condition or shutdown of the equipment. These types of installations do not require fan monitors or temperature sensors. If the cooling fans are needed to prevent a hazardous or catastrophic failure condition, install fan monitors or another method to determine the status of the cooling fan during preflight checks.
28.0 Electromagnetic Protection. Current trends indicate increasing reliance on electrical and electronic systems for safe operations. For systems that perform flight, propulsion, navigation, and instrumentation functions, consider electromagnetic effects. AC 20-136A, AC 20-155, AC 20-158, AC 23.1309-1E, and AC 23-17C provide more guidance for lightning and HIRF protection.
29.0 Electromagnetic Interference. The electronic display instrument system should not be the source of detrimental conducted or radiated interference. Conducted or radiated interference from other equipment or systems installed in the airplane should not adversely affect the displays.
30.0 Implosion Protection. Design and construct the display unit to prevent implosion when the unit is operating over the range of normal and abnormal operating environments in the airplane.
When a display unit has a component containing lower pressure than the ambient atmospheric pressure and it is susceptible to implosion, no incapacitation of the pilot or adjacent equipment should result if an implosion occurs. Test the display unit for the most severe environmental conditions of pressure and temperature levels. Also test for variations in both normal and abnormal operating conditions (including overpressure and decompression) as specified by RTCA/DO-160F.
Similarity of a particular display to a unit already tested may be used to comply with this requirement.
31.0 Configuration Management by Electronic Identification Guidance. Configuration management may be necessary because the system may contain many hardware elements and functional software components, with multiple approved configurations. Identification of software components field-loaded into hardware elements may be implemented by electronic means.
Section 21.607 requires equipment with a TSO to be permanently and legibly marked with specific information. Compliance with § 21.607 may be shown when an electronic identification query system stored in non-volatile memory provides the required information. This approach is commonly referred to as an “electronic TSO nameplate.” The electronic identification system must be verifiable on board the aircraft when the aircraft is on the ground at any geographic location.
The system must provide the specific information required by § 21.607 for all applicable functional TSOs being integrated. All hardware elements that support a functional TSO must have a physical TSO nameplate. Even when electronic identification (that is, electronic nameplate) is used, a physical TSO nameplate must be included on supporting hardware elements. See AC 20-170 for more guidance.