ARP 5364 Human Factor Considerations in the Design of Multifunction Display Systems for Civil Aircraft ARP 5365 Human Interface Criteria for Cockpit Display of Traffic Information AS 8034 Minimum Performance Standard for Airborne Multipurpose Electronic Displays AS 8055 Minimum Performance Standard for Airborne Head Up Display (HUD) ARD 50017 Aeronautical Charting ARD 50062 Human Factors Issues Associated With Terrain Separation Assurance Display Technology
3.4.3 Underwriter's Laboratory (UL), Inc.
You may obtain the Underwriter's Laboratories (UL), Inc., document listed below from Global Engineering Documents, 15 Inverness Way East, Englewood, CO 80112.
UL 1418 Implosion Protected Cathode Ray Tubes for Television Type Appliances, Revised 1992
3.4.4 General Aviation Manufacturers Association (GAMA) The following documents are available from their GAMA website at www.gama.aero/home.php.
General Aviation Manufacturers Association (GAMA) Publication No. 10, Recommended Practices and Guidelines for Part 23 Cockpit/Flight Deck Design.
General Aviation Manufacturers Association (GAMA) Publication No. 12, Recommended Practices and Guidelines for an Integrated Cockpit/Flightdeck in a 14 CFR Part 23 Certificated Airplane.
4.0 BACKGROUND Amendment 23-41, effective November 26, 1990, established airworthiness standards, in § 23.1311, for installing electronic display instrument systems in normal, utility, acrobatic, and commuter category airplanes. The first electronic displays were developed and were direct replacements for the conventional electromechanical components, with later designs providing more extensive information integration. Betore Amendment 23-41, most electronic display instrument systems were approved by special condition for installation in part 23 airplanes. Amendment 23-49, effective March 11, 1996, further amended part 23, to harmonize the Federal Aviation Regulations 7
with the Joint Aviation Requirements (JAR). The last revision of § 23.1311 removed redundant requirements and clarified which secondary instruments are required, including the visibility requirements for those instruments.
5.0 SCOPE This AC is generally applicable only to an applicant seeking issuance of certain type certificates.
These include a type certificate (TC), an amended type certificate (ATC), or a supplemental type certificate (STC) for the approval of a new type design or a change in the type design. This AC does not completely address Synthetic Vision Systems (SVS) or Enhanced Vision Systems (EVS), and Head-Up Displays (HUD). Contact the Small Airplane Directorate if there are any conflicts with other guidance or advisory circulars and this AC. The Small Airplane Directorate will coordinate and resolve the conflict.
6.0 ACRONY MS/DEFINITIONS
6.1 Acronyms AC Advisory Circular ACO Aircraft Certification Office Air Data Computer Attitude Direction Indicator Aviation Digital Data Service Aircraft Flight Manual Aircraft Flight Manual Supplement Attitude Heading Reference System Aerospace Research Document Aerospace Recommended Practice Acrospace Standard Amended Supplemental Type Certificate Amended Type Certificate Civil Air Regulations Code of Federal Regulations Current Icing Potential Cathode-Ray Tubes Electronic Attitude Direction Indicator Electronic Horizontal Situation Indicator Engine Indication and Crew Alert System Equivalent Level of Safety Enhanced Vision Systems Federal Aviation Administration Federal Aviation Regulation Flight Director Functional Hazard Assessment Field-Loadable Software Failure Modes and Effects Analysis 8
FOV Field-Of-View GPS Global Positioning System HIRF High Intensity Radiated Fields HUD Head-Up Display HSI Horizontal Situation Indicators ICAO International Civil Aviation Organization FR Instrument Flight Rules ILS Instrument Landing System IMA Integrated Modular Avionics IMC Instrument Meteorological Conditions JAR Joint Aviation Requirements LCD Liquid Crystal Displays LED Light Emitting Diodes METAR ICAO Routine Aviation Weather Report MFD Multifunction Flight Display ND Navigation Display PFD Primary Flight Display PFI Primary Flight Information POH Pilot's Operating Handbook RAIM Receiver Autonomous Integrity Monitoring (used with GPS) SAE Society of Automotive Engineers STC Supplemental Type Certificate SVS Synthetic Vision Systems TAS Traffic Advisory System TAWS Terrain Awareness Warning System TER Temporary Flight Restrictions TC Type Certificate TCAS Traffic Alert and Collision Avoidance System TSO Technical Standard Order OL Underwriter's Laboratories VOR Very High Frequency Omni-Directional Range VFR Visual Flight Rules VMC Visual Meteorological Conditions WAAS Wide Area Augmentation System
6.2 Definitions This section contains definitions for terms in this document.
Accuracy: A degree of conformance between the estimated or measured value and the true value.
Adverse Operating Condition: A set of environmental or operational circumstances applicable to the airplane, combined with a failure or other emergency situation, that results in a significant increase in normal flight crew workload.
Component: Any self-contained part, combination of parts, subassemblies, or units that perform a distinct function necessary to the operation of the system.
Continued Safe Flight and Landing: This phrase means the airplane can continue controlled flight and landing, possibly using emergency procedures, without requiring exceptional pilot skill or strength. On landing, some airplane damage may occur as a result of a Failure Condition.
Conventional: A system is considered "Conventional" if its function, the technological means to implement its function, and its intended use are all the same as, or closely similar to, that of previously approved systems that are commonly used. The systems that have established an adequate service history and the means of compliance for approval are generally accepted as "Conventional."
Critical: Critical usually defines a function whose loss would prevent the continued safe flight and landing of the airplane.
NOTE: The term "Critical Function" is associated with a Catastrophic Failure Condition.
Newer documents may not refer specifically to the term "Critical Function."
Criticality: Indication of the hazard level associated with a function, hardware, software, etc., considering abnormal behavior (of this function, hardware, software, etc.) alone, in combination, or in combination with external events.
Design-Eye Box: A three-dimensional volume of space surrounding the Design Eye Reference Point that designers and evaluators use to determine the acceptability of display and control locations.
Design-Eve Reference Point: A single reference point in space selected by the designer where the midpoint between the pilot's eyes is assumed to be located when the pilot is properly seated at the pilot's station.
Development Assurance: All those planned and systematic actions used to substantiate, to an adequate level of confidence, that errors in requirements, design, and implementation have been identified and corrected such that the system satisfies the applicable certification basis.
Enhanced Vision System: An electronic means, though the use of an infrared sensor, imageintensifier, radar, or other sensor, to provide the pilot with an image of the external scene.
Equipment Essential to Safe Operation: Equipment installed to comply with the applicable certification requirements of 14 CFR part 23 or operational requirements of 14 CFR parts 91 and 135.
Failure: An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
NOTE: Errors may cause failures but are not considered failures.
Failure Conditions: A condition affecting either the airplane or its occupants, or both, either direct or consequential, caused or contributed to by one or more failures or errors considering flight phase and relevant adverse operational or environmental conditions or external events.
Failure Conditions may be classified according to their severity. See AC 23.1309-1C for more information on definitions of failure conditions.
Field-of-View: The angular extent of the display that can be seen by either pilot with the pilot seated at the pilot's station. See section 15 for more information on the field-of view.
Fix: A generic name for a geographical position. A fix may be referred to as a fix, waypoint, intersection, reporting point, etc.
flight Plan: Refers to any sequence of fixes that are interconnected by the desired path.
Flight plans may range from the simplest that include only the aircraft's present position, the active waypoint, and the desired path between them, to more complicated plans that include departure and destination airports with multiple intermediate fixes.
Function: The lowest defined level of a specific action of a system, equipment, and flight crew performance aboard the airplane that, by itself, provides a complete recognizable operational capability (for example, an airplane heading is a function). One or more systems may contain a specific function or one system may contain multiple functions.
Functional Hazard Assessment: A systematic, comprehensive examination of airplane and system functions to identify potential Minor, Major, Hazardous, and Catastrophic Failure Conditions that may arise as a result of a malfunction or a failure to function.
Hardware: An object that has physical being. Generally refers to circuit cards, power supplies, etc.
Hazard: Any condition that compromises the overall safety of the airplane or that significantly reduces the ability of the flight crew to cope with adverse operating conditions.
Head-Up Display: A see-through flight display presented in the pilot's forward view of the outside world.
Independent: A component, part, element, or system that is not relying on some other component, part, element, or system for accomplishing its function. This design concept ensures that the failure of one item does not cause a failure of another item. For redundancy, each means of accomplishing the same function need not necessarily be identical.
Indicator: A means for displaying information of a parameter. More than one indicator could be depicted on one display. For example, a primary flight display may have indicators for attitude, altitude, airspeed, heading, and navigation.
Instrument: Devices physically contained in one unit and devices composed of two or more physically separate units or components connected together. (One example is a remote indicating gyroscopic direction indicator that includes a magnetic sensing element, a gyroscopic unit, an amplifier, and an indicator connected together.)
Map Orientation: Refers to the rule that determines the directional relation of the map to the upper part of the display depiction. Using a North-up rule, the North side of the map would be toward the top of the display and the south side of the map would be at the bottom. Using a desired path-up rule, the map would be oriented so the desired path would be vertical on the map and pointing straight up toward the top of the display.
Map Range: The geographic extent of the map region (for example, the distance covered by the map representation in either the vertical or horizontal direction).
Malfunction: Failure of a system, subsystem, unit, or part to operate in the normal or usual manner. A condition whereby the operation is outside specified limits.
Multi-Function Display: An MFD is any physical display unit, other than the PFD, used to present various information, on which the layout may be reconfigured.
Navigation: The process of planning, recording, and controlling the movement of an airplane from one place to another.
Navigation Display: The display or suite of instruments by which navigation data is presented to the pilot.
Navigation Information: Information that aids the flightcrew in determining the aircraft's location in a given environment (for example, on flight plans, VORS, NDBS, features on the airport surface including taxiway, signage, etc).
Primary: As used for instruments, it is defined in § 23.1311(c) as the "display of a parameter that is located in the instrument panel such that the pilot looks at it first when wanting to view that parameter."
Primary Flight Display: A PFD is a single physical unit that always provides the primary display of all the following: altitude, airspeed, aircraft heading (direction) and attitude located directly in front of the pilot in a fixed layout in accordance with § 23.1321. It may provide other information pertinent to guidance and fundamental control of flight of the airplane, such as critical engine parameters.
Primary Flight Information: A PFI refers to those functions or parameters required by the airworthiness and operational rules, such as airspeed, altitude, attitude, and heading (direction), that are on the PFD.
Primary Function: A function that is installed to comply with the applicable regulations for the required function, and one that provides the most pertinent controls or information instantly and directly to the pilot.
Primary Navigation: Where the pilot looks first for a display of navigation information such as on an HSI or CDI. It displays vertical and lateral deviation and it may have the digital distance indication to/from the selected fix.
Redundancy: The presence of more than one independent means for accomplishing a given function. Each means of accomplishing the function need not necessarily be identical.
Reversionary Display: A secondary means to provide information initially presented on the PFD or MFD by the transfer of information to an alternate display.
Scale: The relative proportion of the linear dimensions of objects on a display to the dimensions of the corresponding objects and distances being represented (for example, 1 inch = 100 nautical miles).
Secondary Display: A means to provide display of information on another display.
Standby Instrument: A dedicated instrument that is always available that presents primary flight information.
Supplemental: Another function that is not required or intended to meet all the airworthiness and operational requirements.
System: A combination of components, parts, and elements that is interconnected to perform one or more functions.
Synthetic Vision System: A system used to create a synthetic image representing the environment external to the airplane. An image display based entirely or partially on an internal database carried on the aircraft.
Time-Critical Warning: A subset of warning. A Time-Critical Warning is the highest level of warning for conditions that require immediate flight crew response to maintain the immediate safe operation of the airplane. Examples of Time-Critical Warnings include:
Predictive and Reactive Windshear Warnings Terrain Awareness Warnings (TAWS) TCAS Resolution Advisory Overspeed Warnings Low Energy Warnings 13
Track: The projection on the earth's surface of the path of an aircraft, the direction of which is usually expressed in degrees from North (true, magnetic, or grid). A track is the actual flight path of an aircraft over the surface of the earth.
NOTE: For more definitions related to safety assessments, refer to AC 23.1309-1C for the appropriate definitions.
7.0 DISPLAY DESCRIPTION The following paragraphs give a brief description of an electronic display. They do not cover all the capabilities and details of these displays or the information presented on them.
7.1 General Electronic displays have replaced many of the traditional electromechanical and analog instruments that provide flight and powerplant information. These displays also augment and/or combine the functionality of conventional systems, such as radios and navigational systems. The major display technologies now used are multicolor cathode-ray tubes (CRTS), liquid crystal displays (LCDs), electro luminescence, plasma, and light emitting diodes (LEDs). The initial electronic displays mimicked the traditional mechanical and electromechanical flight and powerplant instruments.
Colors, symbols, and formats resemble these conventional instruments.
7.2 Display Configuration Electronic displays may be installed in several configurations. A basic electronic display may provide only one flight or powerplant parameter, while more sophisticated systems integrate many parameters on one electronic display. One of the major design goals for these systems is eliminating separate conventional gauges, instruments, and annunciators. Recent installations show a trend toward a higher degree of integration. Integration of various systems should include analysis to ensure that complexity and workload are compatible with general aviation pilots' capabilities. For example, an integrated primary flight display provides several parameters such as attitude, heading (direction), airspeed, and altitude. For more guidance on Integrated Modular Avionics (IMA) that implement TSO authorized hardware elements, see TSO-C153 and AC 20-145.
8.0 FLIGHT DISPLAYS
8.1 Instrument Requirements
a. Sections 23.1303, 23.1305, 23.1311, and 23.1321, with the applicable operating rules (14 CFR part 91, part 121, and part 135), incorporate flight and powerplant instrument requirements for part 23 airplanes. The navigation equipment requirements are given in operational rules specified in 88 91.205, 121.303, 121.305, 121.307, 135.143, 135.149, 135.159, 135.161, and 135.165. Display requirements for navigation information are dependent on the navigation system installed in the aircraft. Instruments and equipment required for flights under part 91, part 121, and part 135 may be affected by the electronic display installation. These instruments and equipment include 14
gyroscopic bank and pitch, gyroscopic direction, gyroscopic rate-of-turn, slip-skid instruments, and other required communication and navigational equipment.
b. There have been applications to install equipment, such as flight and navigation displays, as non-required. These applications request approval for these installations as Situation Awareness (SA) only. It is not acceptable to label an instrument as "SA-Only" and assume that its failure condition is acceptable. Installing compelling displays that provide Primary Flight Information (PFI), but do not meet the appropriate operational and airworthiness requirements, and labeling them as "Supplemental" or "SA-Only" is not acceptable. Section 13.6 provides more guidance.
c. The basis for certification has been that the equipment should perform its intended function and not present a hazard. Instruments that aid situation awareness should be certified under the part 23 requirements, including § 23.1301 and § 23.1309. These displays could provide hazardous misleading information. PFI is essential for safe operation. An instrument that provides - PFI should meet the minimum standards of applicable TSOs or an equivalent standard. It also should meet the guidance in AC 23.1309-1C, AC 23-17B, and the guidance in this AC.
8.2 Primary Flight Information (PFI) Primary flight information (PFI) refers to those functions or parameters that are required by the airworthiness and operational rules, such as airspeed, altitude, attitude, and heading (direction). It may provide other information pertinent to guidance and fundamental control of flight, such as critical engine parameters. Attitude, airspeed, altitude, and heading (direction) are the PFI required in § 23.1311(a)(3) and (5), and they must be arranged according to § 23.1321 in the "basic T" arrangement. Direction should be heading with track displayed, if available as a selectable option.
We recommended the horizon reference line on the PFD be at least 3.25 inches wide in straight and level flight for integrated displays. This recommendation is not intended to prevent replacement of mechanical instruments with an electronic display of a similar horizon reference line. When the true horizon is no longer on the display, the artificial horizon line should provide a distinctive demarcation between sky and ground (or the background). Display of PFI on reversionary or standby displays should be arranged in the basic T-configuration, but it is not required.
8.2.1 Acceptable Methods for Compliance with Section 23.1311(b).
There are three acceptable methods for meeting the requirements of § 23.1311(b): "The electronic display indicators, including their systems and installations, and considering other airplane systems, must be designed so that one display of information essential for continued safe flight and landing will remain available to the crew, without need for immediate action by any pilot for continued safe operation, after any single failure or probable combination of failures." This can be accomplished by using dedicated standby instruments, dual PFDs, or through reversionary displays that display independent attitude. Electronic display systems without dedicated standby instruments should have at least two independent displays able to provide primary flight information to the pilot. These displays should be powered such that any single failure of the power generation and distribution systems cannot remove the display of primary flight information from both displays.
Change 1
8.3 Standby Instruments The purpose of standby instruments or another independent PFD is to ensure that primary flight information is available to the pilot during all phases of flight and during system failures. Individual indicators should be a minimum of 2 inches in diameter or, if combined, a minimum 3 inches displayed.
8.3.1 Dual PFDs Electronic display systems with dual PFDs should incorporate dual, independently powered sensors that provide primary flight parameters such as Attitude Heading Reference System (AHRS) with comparators and dual Air Data Computer (ADC). Dual PFDs with dual AHRSs and ADCS, which include checking and are powered by multiple power sources and distribution systems, are significantly more reliable than presently certified mechanical systems. For systems with these characteristics, dedicated standby instruments are not required.
8.3.2 PFD and Autopilot with an AHRS.
a. For normal operation, when utilizing a single AHRS to drive the PFD and the autopilot simultaneously, the installation must mitigate hazardous or catastrophic system level failures. An example configuration supporting proper mitigation would include all of the following:
(1) A dedicated standby attitude instrument within the primary maximum field-of-view (FOV) or independent reversionary attitude display;
(2) An AHRS with appropriate comparator or monitor of equivalent performance; and
(3) An appropriate system warning/caution annunciation associated with an AHRS malfunction.
b. Further, if an aircraft is equipped with multiple AHRS, it may be acceptable, when one AHRS fails, to drive both the autopilot and the PFD from a single AHRS as long as an AHRS independent attitude display (required for some aircraft classes) is located in the primary maximum field of view. The failure must be annunciated to the pilot, and the pilot must be able to select the non-failed AHRS. For aircraft that do not have an independent attitude indicator, when one AHRS fails, the autopilot should be manually or automatically disengaged. The autopilot may be reengaged if appropriate mitigation is available (e.g. see 1 and 3 above). The AFM or supplemental AFM should contain the appropriate procedures applicable to the equipment installed. See Section
11.0 for additional guidance. Consider AC 23.1309-1C (or the latest version) guidance for these configurations.
c. Displays not meeting FOV guidance criteria may require additional human factors airworthiness evaluation by the certification authority. See section 15 for additional guidance.
8.4 Reversionary Flight Displays Instead of Standby Instruments or Dual PFDs
8.4.1 General Requirements
a. Reversionary flight displays provide a secondary means to provide PFI through alternate display formats on another PFD or MFD by the transfer of information to an alternate display or by some other means. The function of an MFD system is to provide the pilot access to various data, or combinations of data, used to fly the aircraft, to navigate, to communicate, and/or to manage aircraft systems. The MFD would also display PFI as needed to ensure continuity of operations. Part 23, § 23.1311(b), states that the system "must be designed so that one display of information essential for continued safe flight and landing will remain available to the crew, without need for immediate action by any pilot for continued safe operation, after any single failure or probable combination of failures." To meet the requirements of § 23.1311(b), a full-time standby display, another independent PFD, or an independent reversionary attitude display, must be installed. Reversionary modes can be automatically and manually selected or only manually selected, but it will require an Equivalent Level of Safety (ELOS) if the PFI is not provided by a dedicated standby instrument or by another PFD.
b. Only on a reversionary implementation would a project specific Equivalent Level of Safety approved by the Small Airplane Directorate be required. Reversionary configurations are significantly more reliable than presently certified mechanical systems, and the skills required while flying in reversionary mode are identical with those used when flying in primary mode.
Traditional external standby flight instruments (either electronic or mechanical) offer potential safety problems associated with delay in pilot reaction. The pilot may delay a decision to transition to standby instruments and to transition to partial panel techniques, as opposed to the simple action the pilot would take to switch displays. A nearly identical display of all flight information in the same format as normally shown on the PFD provides a significant safety enhancement over reversion to external standby instruments. This is especially true when the size, location, arrangement, and information provided by the standby instruments is significantly different from that on the PFD.
c. Reversionary display modes should provide consistent display formats to the PFD. The reversionary flight information should be presented by an independent source and display to prevent complete loss of PFI due to a single failure. The reversionary configuration should have two independent displays that incorporate dual-independently powered AHRS and dual ADC subsystems that provide PFIS. The reversionary system response time should provide flight critical information on the MFD in less than one second after a switch or an automatic operation.
d. A reversionary configuration should have a single pilot action that would force both the PFD and MFD displays into reversionary mode operation. A single pilot action that results in display of PFI within one second or less is generally considered an equivalent level of safety.
However, the PFI must be displayed in substantially the same format and size in the reversionary mode as it is in normal mode. This reversionary configuration would provide backup information essential to continued safe flight and landing with an intuitive control that allows instant, 17
simultaneous access to reversionary mode on both the PFD and MFD displays. The single pilot action should be easily recognized, readily accessible, and have the control within the pilot's primary field of view. An acceptable method for the single pilot action is the red color and the lighted red "halo" ring that announces its position on the panel.
8.4.2 Reversionary Methods
a. One method is to have an automatic reversionary display with a single pilot action that would force both the PFD and MFD displays into reversionary mode operation. If PFI on another display is not provided, provide automatic switching to ensure PFI is available to the pilot.
Automatic reversion must provide a complete display of PFI on the remaining display within one second if a fault is detected.
b. Most possible faults should be covered by this automatic reversionary capability. Only a total loss of the display may not be reliably detected automatically, but such a failure condition would be obvious to the pilot. Faults that result in automatic switching should be extensive enough to ensure PFI is available at the reliability level required by AC 23.1309-1C. If such a malfunction occurs, a single pilot action should provide a full display of the essential information on the remaining display within one second. All modes, sources, frequencies, flight plan data, etc.
would be exactly as they were on the PFD before the failure.
c. Another method would include a means to access the reversionary mode only manually through a single pilot action. Manual activation of the reversionary mode on the MFD through single action by the pilot is acceptable when procedures to activate the PFI are accomplished before entering critical phases of flight. The PFI would be displayed continuously on the reversionary display during critical phases of flight (for example, takeoff, landing, and missed or final approach).
8.5 Display of Attitude For flights under IFR conditions in part 91 and part 135 operations, and under VER at night for part 135 operations, attitude information is required. The loss of all attitude information or the presentation of misleading attitude information could result in a catastrophic failure condition where the pilot could not continue safe flight and landing of the airplane.
8.6 Display of Direction (Heading or Track)
8.6.1 General
a. The loss of direction (heading or track) information could result in reduced capability of the pilot to cope with adverse operating conditions. The orientation of any secondary navigation display is optional (for example, Track-up, North-up, Heading-Up). For flights under IFR conditions, a stabilized heading indicator must provide the primary display of the direction parameter. A non-stabilized magnetic direction indicator (compass) or track may provide the reversionary display of direction.