8.5.3 No single failure, malfunction, or probable combinations of failures should result in the loss of powerplant information, or an erroneous display of powerplant parameters that would jeopardize continued safe flight and landing of the airplane. In most cases, for engines with limit protections, loss of powerplant displays with no additional failures will not cause immediate jeopardy to continued safe flight and landing.
8.5.3.1 A secondary display providing powerplant parameters may be used for cases of loss of a primary powerplant display provided the secondary display is located so the pilot can adequately view the powerplant parameters.
8.5.3.2 Throttle or power lever position may be used in place of lost powerplant display parameters. This would apply if throttle position or power lever position provides a positive indication of powerplant power level required to maintain safe flight to a landing, and has a means to preclude exceeding powerplant operating limits.
8.5.3.3 Each proposed airframe, engine, and airframe/engine interface, including appropriate human factors considerations, needs to be evaluated by the FAA to determine its adequacy. Appropriate procedures for operation of an integrated electronic powerplant display system should be in the Airplane Flight Manual (AFM).
8.5.4 Requirements for Continuous Display of Powerplant Information:
8.5.4.1 Display primary powerplant parameters continuously in the pilot’s primary field-of-view when they are required. For example, a parameter defined as primary for engine start, but not for other normal engine operation, may only have to be displayed continuously during engine start. All parameters that are determined to be primary for other engine operations should be displayed continuously during these engine operations.
8.5.4.2 Prior to reaching or exceeding any operating limit, the required powerplant parameters should be indicated without pilot action. Crew attention to flight instrument displays required for continued safe flight and landing takes precedence over the continuous display of powerplant information that is not required for continuous safe flight and landing.
8.5.4.3 When a required display parameter is not displayed full time, adequate monitoring of the function should be provided. In addition, provide a manual select option for the pilot to display the information.
8.5.4.4 When any operating limit is reached or exceeded for the required powerplant parameter, the alerts for each phase of flight should be provided in a timely manner, and in a form that enables the flight crew to identify and carry out the necessary remedial actions.
8.5.4.5 The required powerplant information should be displayed continuously during a critical takeoff and landing phase of flight to minimize pilot distraction until an established rate of climb or minimum altitude is achieved.
8.5.5 Displays which provide multiple powerplant parameters should be such that any parameter, display, or alert will not suppress another display or alert that also requires immediate crew awareness necessary to conduct safe operation of the aircraft and engine(s). Alerts that could cause subsequent activation of other displays or alerts should be presented in a manner and form to ensure appropriate identification and prioritization of all significant hazards and required crew actions.
8.5.6 Direct-reading alphanumeric-only displays are most valuable when integrated with an analog display by adding a precise, quantitative indication to compliment an analog display’s qualitative indication. Direct-reading alphanumeric powerplant displays should not be used in place of analog instruments to indicate values of engine parameters where trend or rate-of-change information is important. Direct-reading alphanumeric displays limit the flight crew’s ability to assess trend information and result in reduced crew awareness. Direct-reading alphanumeric displays are also limited in their ability to provide a comparison of parameters from multiple engines or to check the general proximity of differing parameters against their individual limits. While these shortcomings can be compensated for with additional design provisions, the use of direct-reading alphanumeric displays should be made with care and evaluated for each airframe, engine, and airframe/engine integration. The required § 23.1305 powerplant instruments referred to as “indicators” should have the ability to provide trend or rate-of-change information, unless a finding of equivalence is made for direct-reading alphanumeric displays. The finding of equivalence should consider the following factors:
8.5.6.1 The visibility and relative location of the indicated parameter should be reviewed, including appropriate conditions of lighting and instrument panel vibration.
8.5.6.2 The ability to assess necessary trend or rate-of-change information quickly, including if and when this information may be needed during in-flight engine restarts.
8.5.6.3 The ability to assess how close the indicated parameter is relative to a limit.
8.5.6.4 For multiengine aircraft, the value to the crew of quickly and accurately comparing engine-to-engine data.
8.5.6.5 Compensating engine design features or characteristics that would forewarn the crew prior to the parameter reaching the operating limit (e.g., redline).
8.5.7 Marking of electronic displays on powerplant parameters is not always the most efficient or effective when performed in accordance with § 23.1549. AC 20-88A provides alternate methods of marking electronic powerplant displays. A finding of equivalence for
15 other methods of marking the displays may be performed. However, this should be evaluated on a case-by-case basis, which is dependent upon each airframe, engine, integration, and appropriate human factors considerations.
8.6 ELECTRONIC DISPLAYS OF NAVIGATION INFORMATION:
8.6.1 Guidance Information:
Information used by the pilot for steering commands, to monitor deviation from a navigation path, and information needed for immediate control of the airplane (pitch and roll attitude, altitude, airspeed and heading) must be in the pilot’s primary field-of-view.
Other data including identification of displayed information, alert flags and mode status indications must also be in the primary field-of-view. Secondary display of this information may be placed outside the primary field-of-view. For additional guidance, refer to specific TSO’s and AC’s.
8.6.2 Other Navigation Information:
Many navigation systems provide advisory information not immediately required by the pilot. This information is typically an aid to situation awareness, determination of system status, and reduction of pilot workload. The display for this data may be provided outside the pilot’s primary field-of-view.
8.6.3 Display Integration:
8.6.3.1 Navigation guidance information may be integrated with the primary flight displays.
Common examples are horizontal situational indicators (HSI’s) that combine inputs from a directional gyro along with a course deviation indicator, or a flight director integrated with the attitude direction indicator (ADI). Additionally, information from more than one navigation source may be displayed separately or simultaneously.
8.6.3.2 In an integrated display, a failure in the navigation system should not inhibit the continued display of primary flight information.
8.6.3.3 If information from more than one navigation source can be displayed, the selected source should be continuously indicated to the pilot. If multiple sources can be displayed simultaneously, the display should indicate unambiguously what information is provided by each source and which is for guidance. Distinctive scales or points should differentiate between angular deviations (e.g., ILS, VOR) and linear deviations (e.g., GPS, FMS).
8.6.3.4 If the airplane is equipped with an autopilot, which is coupled to the guidance system, the input to the autopilot should coincide with the navigation source selected for guidance as described in paragraph 8.6.3.3 of this AC.
8.6.3.5 If other information is included on the guidance display, designers should exercise good human factors concepts, such as those outlined in Section 7 and 8 of the “HF Design Guide,” Document No. DOT/FAA/CT-96/1.
8.6.4 Reversionary Navigation Displays:
8.6.4.1 Reversionary navigation displays are additional displays that can provide a secondary means to primary flight parameters. Reversion requirements for navigation display information are dependent upon the rules under which the aircraft is operated and the hazards associated with the loss of the display. No reversionary display is required for advisory navigation information not required by any rule or standard. Applicants should recognize that this paragraph applies only to navigation information, and that integration of other non-navigation information (for example, traffic, weather or flight parameters) may affect the hazards associated with the loss of the display. In these cases, the applicant should perform an FHA in accordance with AC 23.1309-1C. Reversionary displays may be either electronic or analog displays.
8.6.4.2 The reversionary (secondary) guidance display, if required, may be outside the pilot’s primary field-of-view, if it is usable from the pilot’s position with minimum head movement. See paragraph 8.4.2 of this AC.
8.7 Electronic Checklist:
Policy and guidance on electronic checklist displays are contained in AC 23-8A. If installed, an electronic checklist certification should include an FAA approved AFM or a Pilot’s Operating Handbook (POH) which fulfills the requirements of an AFM.
9. AIRWORTHINESS CONSIDERATIONS.
9.1 GENERAL CRITERIA:
Evaluations of the electronic display system should consider airworthiness regulations, recommended practices, and standards from industry documents as listed in paragraph 3.4 of this AC. SAE documents AS 8034, ARP’s 4067 and 1068B, and other documents listed in paragraph 3.4 may be used as guidelines for evaluating the visual performance parameters of the electronic displays relative to viewing, photocolorimetric, luminance characteristics, etc. The certification basis should include the regulatory sections, as appropriate, listed in paragraph 3.1 of this AC. Efforts should be made by the applicant to ensure that human performance considerations were adequately addressed throughout the design process. The applicant is encouraged to develop human performance considerations, including evaluation plans, and present them to the FAA early in the certification process.
9.2 CONTROLS AND DISPLAYS:
Controls and displays should be clearly visible and usable by the pilot, with the least practicable deviation from the normal position and from the line of vision when the pilot is looking forward along the flight path. Controls should have an appropriate amount of tactile feel (for example, detents, friction, stops or damping, etc.) so that they can be changed without undue concentration, which minimizes the potential for inadvertent changes. Controls need to be designed for the pilot to use intuitively. The controls should be easily identified and located in all lighting conditions, allow differentiation of one control from another, and have feedback through the system appropriate for the function being controlled.
9.3 LOCATION OF PRIMARY DISPLAYS:
9.3.1 Use the basic T-configuration for airplanes certificated under § 23.1321, Amendment 23-14 or later amendment. The basic T-configuration is defined as an arrangement where the airspeed and altitude data are centered, respectively, directly to the left and right of the attitude data, with the direction data located directly below the attitude data. Deviations from the basic T-configuration are acceptable if the droop angle (angle below the §
23.1321(d) position) is 15° or less, or when the elevated angle is 10° or less. These angles are measured from a horizontal reference line, which passes through the center of the attitude reference data with lines passing through the center of the airspeed and altitude data.
9.3.2 Deviations from the limits of +10°, -15° could be approved through an equivalent level of safety finding when these limits have been substantiated based on satisfactory service experience or research. Flight instrument arrangements having deviations greater than +10°, -15° from a horizontal reference line passing through the attitude display would require an equivalent level of safety finding. These findings should be human factors substantiation, and a complete display installation evaluation, considering the following items (See paragraph 7.1.2 of this AC):
(1) the display arrangement and its alignment to the normal line of the pilot's vision,
(2) cockpit view,
(3) the integration of other functions within the displays,
(4) the data presented, format, symbology, etc. within the display, and
(5) the ease of manipulating controls associated with the displays.
This evaluation should consider the different types of operations under which the airplane may be operated as defined by § 23.1559(b).
9.3.3 Use of unique displays or arrangements for attitude, altitude, airspeed and navigation data, integration of combinations of these functions, or rearrangement of them from the basic T-configuration may be approved when an equivalent safety finding, and a human factors evaluation is provided. Coordination with the Small Airplane Directorate is required.
9.4 FAILURE ISOLATION:
Any probable failure of the electronic display system should not degrade the normal operation of other required equipment connected to it or cause a flight hazard. Likewise, the failure of other equipment should not result in a failure or degraded performance of the electronic display.
9.5 SAFETY ASSESSMENTS:
Safety assessment methods are described in AC 23.1309-1C for identifying and classifying each Failure Condition and choosing the method(s) of safety assessment. Certification of electronic display systems may involve new and complex technology that may not utilize traditional service-proven design concepts. In this case, technically qualified judgment can be enhanced when a quantitative analysis is included in the safety assessment, whether or not a quantitative analysis is required by § 23.1309.
9.6 ELECTROMAGNETIC PROTECTION:
Current trends indicate increasing reliance on electrical/electronic systems for safe operations. For systems that perform flight, propulsion, navigation, and instrumentation functions, electromagnetic effects should be considered. AC 23.1309-1C provides additional guidance.
9.7 ENVIRONMENTAL CONDITIONS:
9.7.1 The equipment environmental limits established by the manufacturer should be compatible with the operating environment of the airplane. Evaluation of the equipment installation should consider factors such as the maximum operating altitude of the airplane, and whether the equipment is located within a temperature and pressure-controlled area.
Applicable methods for testing the performance characteristics of equipment for specified environmental conditions are provided in RTCA/DO-160D. Either test or analysis, or both, ensures the compatibility between the operational environment and the environmental equipment category of the laboratory tests.
9.7.2 Electronic systems reliability is strongly related to the temperature of the solid-state components in the system. Component temperatures are dependent on internal thermal design and external cooling. In evaluating the temperature environment, consider the additional heat generated by the equipment, especially in a location where airflow is restricted. For determining if adequate cooling is provided, the evaluation should make
19 maximum use of previous data from comparable installations, thus limiting ground or flight tests to those installations that cannot be verified conveniently by other means.
When the equipment-operating environment cannot be verified from previous experience or from an evaluation of temperature values in that equipment location, a cooling test should be conducted.
9.7.3 Attitude information should continue to be presented for a minimum of 30 minutes after the in-flight loss of cooling for the primary instrument when operating in the normal operating environment (temperature/altitude). If proper performance of the flight instrument function(s) is adversely affected due to in-flight loss of cooling, such failure conditions should be annunciated. Automatic over-temperature shutdown of the system should be considered a Failure Condition. Subsequent pilot actions should be documented in the AFM or on placards. These actions may include procedures to allow possible recovery of a system that has an over-temperature shutdown condition.
9.7.4 Annunciation of in-flight loss of cooling or fan monitors may not be required if it is shown by a safety analysis or test demonstration that a Hazardous or Catastrophic Failure Condition does not occur. The safety analysis should consider the reliability of the fans, redundancies of the functions, reversionary features (such as the ability to transfer critical functions), the annunciation of over-temperature and its response time, and the availability of other flight instrumentation. In some systems, cooling fans may only be installed to extend the life of the components and not to prevent a Failure Condition or shutdown of the equipment. These types of installations do not require fan monitors or temperature sensors. If the cooling fans are needed to prevent a Hazardous or Catastrophic Failure Condition, install fan monitors or another method to determine the status of the cooling fan during preflight checks.
9.8 SOFTWARE QUALIFICATION:
AC 20-115B discusses how RTCA/DO-178B provides an acceptable means for showing that software complies with pertinent airworthiness requirements. AC 23.1309-1C provides additional guidance on determining the Software Development Assurance Levels.
9.9 ELECTROMAGNETIC INTERFERENCE:
The electronic display instrument system should not be the source of objectionable conducted or radiated interference; nor should it be adversely affected by conducted or radiated interference from other equipment or systems installed in the airplane.
9.10 LEGIBILITY:
9.10.1 All displayed symbols and graphics should be clearly differentiable from one another and legible under all ambient illumination conditions. These conditions range from the night environment to direct sunlight through any window with the operational brightness at the luminance expected at the displays useful end-of-life state. The end-of-life luminance level
20 represents the expected value of the display brightness or minimum acceptable output that is established by the manufacturers. The display luminance should sufficiently provide a comfortable level of viewing with rapid adaptation when transitioning from looking outside the cockpit.
9.10.2 The luminance level of some displays will gradually diminish over the life of the unit. As part of the continued airworthiness requirements of § 23.1529, consider establishing an operational in-flight evaluation or maintenance evaluation to determine the minimum luminance level appropriate for the type of display, flight deck location, method of format, symbology, color used, etc. Although an automatic luminance control compensation is not required, the incorporation of such a system may decrease pilot workload. Regardless of whether an automatic luminance control is incorporated, provide a manual luminance control that is not adversely affected by failure of any automatic luminance control.
Luminance control should not result in some information disappearing while other information remains visible.
9.11 SYMBOLOGY AND FORMAT:
9.11.1 Electronic displays in the cockpit should have related symbology and format, and should be consistent with their intended use. Appendix A to SAE ARP 4102/7 provides recommended symbols for Electronic Attitude Direction Indicators (EADI) and Primary Flight Displays (PFD) used in the flight deck of transport aircraft.
9.11.2 Symbols should be distinctive to minimize misinterpretation or confusion with other symbols utilized in the displays. The type and function of symbology should be clearly defined and appropriately classified for pilot understanding. Symbols representing the same functions on more than one display should utilize the same shape and/or colorcoding. Also, use of flashing letters such as an “X” should be consistent: flashing, when used, should not be a caution for one parameter and a warning for another. Although the use of different types of symbols and formats among displays is discouraged, it may be acceptable, if the pilot can quickly and consistently recognize, interpret, and respond correctly to the symbol or format without incurring excessive pilot workload. For example, to indicate bank angle on the attitude displays in the cockpit, the type of pointer, ground (fix) or sky (moveable), should be similar for ease of interpretation and to minimize confusion.
9.11.3 Powerful formats are possible with an electronic display system, but too much information could result in clutter and reduce the efficiency of the pilot cues. Density of the information on the display should be compatible with the pilot's ability to recognize essential information and to minimize misinterpretation. Symbols and markings that are displayed during specific phases of flight may be removed at other times to reduce clutter.
Consider the minimum display size for suitable readability. In the reversionary or compacted modes, when combining essential information on a display after another display or unit fails, the display format should not be confusing and the information should still be usable. Determine whether the reversionary or compacted mode is usable in normal
21 operation or only under emergency/abnormal operating conditions. Attitude, altitude, and airspeed information on the primary electronic display should not be inhibited during these modes. The approved configuration (whether basic-T configuration or a new configuration) should be preserved.
9.11.4 Presentation of airspeed, altitude, attitude, or certain propulsion parameters (as applicable) should convey to the pilot a quick-glance sense of rate and trend information. For airspeed and altitude, direct-reading alphanumeric displays may not be adequate on the primary display or on the standby instruments, but it is acceptable on a display used as supplementary information. If the applicant proposes a direct-reading alphanumeric display, they should demonstrate that the pilot response is equal to or better than the response with analog data (symbology) using a human factors evaluation (see paragraph
7.1.2. of this AC). The application of direct-reading alphanumeric displays to propulsion parameters should be made with care and it is subject to evaluation on a case-by-case basis. See paragraph 8.5.6 of this AC.
9.11.5 The display of a round dial-moving pointer with a digital readout is acceptable. To accommodate a larger operating range on a linear tape, adopt a moving scale display with the present value on a digital readout. Since the moving scale display typically does not provide any inherent visual cue of the relationship of present value to low or high airspeed limits, quick-glance awareness cues may be needed.
9.11.5.1 It is important that airspeed displays with moving scales provide appropriate low-speed awareness cues. The low-airspeed awareness cues should include a caution cue at some multiple of the stall speed below the normal operating range, and a warning cue above the stall warning speed (reference § 23.207(c)). The low airspeed awareness cues should be accurate for any airplane weight and flap configuration (usually angle-of-attack based).
The applicant may choose a single conservative speed value to account for various weight and flap configurations (reference § 23.1545(a)(4)). Also, airspeed moving scale displays should have low-speed markings displayed in the lower airspeed scale and high-speed markings at the upper part of the scale.
9.11.5.2 Linear tape altimeter displays should include enhancements denoting standard 500- and 1,000-foot increments, and convey unambiguously, at a glance, the present altitude.
9.11.6 The heading display should provide a clear and unmistakable display of aircraft symbol and heading. A Horizontal Situation Indicator (HSI) should provide a clear and unmistakable display of aircraft position, heading, and track relative to the desired course/track. Pilot computation or interpretation should be minimized. On the primary display, the heading scale should have a mode that presents at least 180° of arc (270° is recommended). Other display formats may be acceptable and have been previously approved, but they need to be evaluated for human factors effectiveness.
9.11.7 Alternative formats or arrangements to those described above should have an adequate human factors evaluation (see paragraph 7.1.2 of this AC) completed to show that pilot response is timely and accurate to at least the level of the existing conventional displays.
Human factors criteria should be defined as part of the design process. Because displays are a function of the specific cockpit layout and configuration, human factors evidence needs to be provided during certification. Specific human factors evaluation/studies that have been performed may support the configuration of displays and their location in the cockpit. An alternative is validating these evaluations/studies on each airplane during the installation process of the certification.
9.11.8 Integration of a number of display parameters into one common display provides distinct benefits, but raises some certification issues. New approaches presenting data and commands to the pilot are encouraged. To overcome the issues that may occur as a result of this integration, present the data and commands in a simple format to alleviate any increase in pilot workload. Specific areas to address are more intuitive guidance commands, combination of various navigation sensors, and similar functions. An example would be where the pilot selects a destination point (that is, a runway, an altitude, a fix, etc.). The system commands would provide guidance to that point, which could integrate the attitude sensor information, navigation data, air data information, etc., in a common display command element without the raw data being provided to the flight crew. The overall goal of this effort is to meet or exceed the existing cockpit performance levels currently in operational use while maintaining pilot workload at acceptable levels.
9.12 ANNUNCIATION:
9.12.1 The electronic display system should provide the pilot with visibly discernible annunciators that will indicate to the pilot the system operating modes. The visual annunciators should be distinctive under all normal lighting conditions and consistent with cockpit warnings.
Under night lighting with the display average brightness at the lowest usable level for prolonged flight, visual annunciators should be usable. Annunciations should be consistently located in a specific area of the electronic display, to ensure proper interpretation by the pilot. Except for a flight director display, use of the display selection control position as annunciation is acceptable only when the control position is in direct view of the pilot, without head movement, and when the control position is obvious under all lighting conditions. When a failure occurs or when reversionary modes are used, an annunciation of abnormal system status shall be provided per § 23.1311(a)(7). The display should not provide hazardously misleading information. Annunciations that require flight crew action should be evaluated to determine if the required actions can be accomplished in a timely manner without exceptional pilot skill.
9.12.2 Where multiple system configurations and more than one sensor input are available for source selection, the switching configuration by annunciation or by selector switch position should be readily visible, readable, and should not be hazardously misleading to the pilot using the system. Labels for mode and source selection annunciators should be compatible throughout the cockpit. To ensure that the flight crew can properly interpret the system status, cautionary annunciation methods should be consistent when numerous interface switching configurations are possible.
9.12.3 Alerting messages should differentiate between normal and abnormal indications.
Abnormal indications should be clear and unmistakable, using techniques such as different shapes, sizes, colors, flashing, boxing, outlining, etc. Individual alerts should be provided for each function essential for safe operation.
9.13 IMPLOSION PROTECTION:
The display unit should be designed and constructed to prevent implosion when the unit is operating over the range of normal and abnormal operating environment in the airplane.
When a display unit contains a component containing lower pressure than the ambient atmospheric pressure and it is susceptible to implosion, no incapacitation of the flight crew or adjacent equipment should result, if an implosion occurs. Test the display unit for the most severe environmental conditions of pressure and temperature levels, and for variations in both normal and abnormal operating conditions (including overpressure and decompression) specified by RTCA/DO-160D. To verify that the display unit is acceptable in the event of an implosion, the unit should meet the requirements in United Laboratories (UL) Document No. 1418 listed in paragraph 3.5 of this AC. Similarity of a particular display to a unit already tested may be used to comply with this requirement.
9.14 COLOR STANDARDIZATION:
9.14.1 Color is considered an enhancement for understanding the display information that leads to performance improvement. Select color to minimize display interpretation errors. A proliferation of color sets can ultimately reduce safety rather than increase it. Using contrast between basic colors provides a better differentiation of display elements than arbitrarily using colors near to each other in the color table. Prior to defining the color standard to be used in a specific display, establish a consistent color philosophy throughout the display. The FAA does not intend to limit electronic displays to the below listed colors, although these have been shown to work well. The following table depicts colors found acceptable for compliance with § 23.1322, and other recommended colors as related to their functional meaning for electronic display systems:
9.14.1.1 Display features should be color coded as follows:
Warnings Red Flight envelope and system limits Red Cautions, abnormal sources Amber/Yellow Earth Tan/Brown Scales and associated figures White Engaged modes Green Sky Cyan/Blue ILS deviation pointer Magenta Flight director bar Magenta/Green
9.14.1.2 Specified display features should be allotted colors from one of the following color sets:
Color Set 1 Color Set 2 Fixed reference symbols White Yellow* Current data, values White Green Armed modes White Cyan Selected data, values Green Cyan Selected heading Magenta** Cyan Active route/flight plan Magenta White *The extensive use of the color yellow for other than caution/abnormal information is discouraged.
**In color Set 1, magenta is associated with those analog parameters that constitute "fly to" or "keep centered" type information.
9.14.1.3 The depiction of weather precipitation and turbulence should be coded as follows:
Precipitation 0-1 mm/hr Black 1-4 " Green 4-12 " Amber/Yellow 12-50 " Red Above 50 " Magenta (other colors may be acceptable) Turbulence " White or Magenta
9.14.1.4 Background color Background color may be used to enhance display (Gray or other shade) presentation.
9.14.2 When the color assignments deviate from the above color set, the applicant should ensure that the chosen color assignments are not susceptible to confusion of symbol meaning and increased workload. Where appropriate, color assignment should be consistent with other color displays in the panel. Luminance and color differences