consistent color philosophy throughout the display. The FAA does not intend to limit electronic displays to the below listed colors, although these have been shown to work well. The following section depicts colors found acceptable for compliance with § 23.1322, and other recommended colors as related to their functional meaning for electronic display systems. Deviations may be approved with acceptable justification. The use of the colors red and yellow for other than warnings and cautions is discouraged.
22.2 Color for Display Features Color code display features should be as follows:
Warnings Red Flight envelope and system limits Red Cautions, abnormal sources Amber/Yellow Earth Tan/Brown Scales and associated figures White Engaged modes, flight guidance Green Sky Cyan/Blue ILS deviation pointer Magenta Flight director bar Magenta/Green Pilot selectable references (bugs) Magenta
22.3 Color Sets One of the following color sets should be used:
Color Set 1 Color Set 2 Fixed reference symbols, that is, lubber lines White Yellow* Current data, values White Green Armed modes White Cyan Selected data, values Green Cyan Selected heading Magenta** Cyan Active route/flight plan Magenta White *The extensive use of the color yellow for other than caution/abnormal information is discouraged.
**In color set 1, magenta is associated with those analog parameters that constitute "fly to" or "keep centered" type information.
22.4 Color for Depiction of Weather Precipitation and Turbulence The depiction of weather precipitation and turbulence should be coded as follows:
Precipitation 0-1 mm/hr Black 1~4 Green 4-12 Amber/ Yellow 12-50 Red Above 50 Red or Magenta Turbulence White or Magenta Icing Light Blue A background color (neutral color) will enhance display presentation.
22.5 Color Deviation When the color assignments deviate from the above color set, the applicant should ensure the chosen color assignments are not susceptible to confusion of symbol meaning and increased workload. Where appropriate, color assignment should be consistent with other color displays in the panel. Luminance and color differences should not be confusing or ambiguous under any operating ambient illumination conditions. The specific colors should be consistent with change in brightness on the displays over the full range of ambient light conditions. Under high and low levels of lighting, color degradation should not prevent the pilot from properly interpreting display information. Where precipitation is integrated with other information, the precipitation colors can be presented at half intensity. Service experience has shown that this provides enhanced presentation and reduced ambiguity. Warnings should be at full intensity.
22.6 Enhancement Color is an enhancement for understanding the display information that leads to performance improvement, but it should not be the sole means of discrimination of critical information. Use symbols or letters, as well as color, to further enhance the effectiveness of the display. Use of color alone has been shown to be less effective than when used with distinct symbol (object, graphic, or letter). Color degradation should be obvious and should not preclude the pilot from interpreting the remaining display information. Displays should remain legible, stable, and unambiguous when operating in a degraded mode.
22.7 Color for Warnings and Cautions For warnings and cautions, § 23.1322 provides specific requirements for assigning red and amber for visual annunciations. Use red as the warning annunciation for emergency operating conditions when immediate flight crew recognition is required, and immediate correction or compensatory action may be required. Use amber for the cautionary annunciation for abnormal operating conditions when immediate flight crew awareness is required, and subsequent flight crew action may be required. Use white or another unique color for advisory annunciations of operating conditions that require flight crew awareness and, possibly, action. Use green for indication of safe operating conditions.
22.8 Airplane Flight Manual Include a complete list of warnings, cautions, and annunciation messages in the AFM, supplemental AFM, and placards. If the manufacturer's Pilot Operating Guide is found adequate and acceptable, it may be referenced in the AFM or supplemental AFM as a means to satisfy this requirement
23.0 COLOR FOR AVIATION ROUTINE WEATHER
23.1 General For electronic color graphic display of aviation routine weather to surface meteorological data, refer to METARS see TSO-C157, Aircraft Flight Information Services-Broadcast (FIS-B) Data Link Systems and Equipment and RTCA/DO-267A, Minimum Aviation System Performance Standards (MASPS) for Flight Information Services-Broadcast (FIS-B) Data Link.
24.0 GENERAL INSTALLATION REQUIREMENTS The TC/STC/ATC/ASTC applicant must show that the installed electronic display system configuration (including hardware and software) meets the appropriate airplane certification basis.
This demonstration must include applicable functional TSO(s), or equivalent, functional performance, interoperability, aircraft-level and system-level safety assessments, environmental qualification, system integration test, flight test, software assurance, hardware assurance, and other certification activities (as required to show compliance to the regulations). TC/STC/ATC/ASTC applicants may use TSO data to support airworthiness assessment if they show that the TSO requirements apply to the installation.
25.0 AIRCRAFT ELECTRICAL POWER SOURCE
25.1 Electrical Power Install each electronic display instrument system so that it receives electrical power from a bus that provides the necessary reliability, according to the § 23.1309 safety assessment, without jeopardizing other essential or critical electrical loads connected to that bus. The applicant should provide a means to indicate when adequate power is available for proper operation of the instrument.
25.2 Power Interruptions Use techniques that reduce the momentary power interruptions or design the equipment so momentary power interruptions will not adversely affect the availability or integrity of essential information required for continued safe flight and landing. The category selected from RTCA/DO- 160() for momentary power interruptions should be appropriate for the intended use. The PFD being used by the pilot during the takeoff phase of flight should be usable within one second after a momentary power interruption up to a 200-millisecond duration. Large electrical loads required to restart an engine (for example, turboprops and small jets) should not affect the availability or integrity of essential information required for continued safe flight and landing.
25.3 Independent Power Source
a. Each reversionary or standby display providing primary flight information should be powered from a power source independent of the source for the primary display. It should function independently from the primary display, such as a second alternator or battery. The power source for each reversionary display should provide for uninterrupted operation for at least 30 minutes after failure of the power source for the primary display. The independent power source may be provided by manual or automatic means. Section 23.1353(h) requires a minimum supply of 30 minutes of electrical power to the essential loads for continued safe flight and landing of the airplane should a complete loss of the primary electrical power generating system occur, including the reversionary displays. The airplane's primary electrical power includes the airplane's electrical generating system and the airplane's starter battery when only one battery is installed. The starter battery is not considered an acceptable standby power source unless a proper state of charge is monitored and displayed to the pilot. In this case, an ELOS may be required.
b. The intent of this guidance may be met by a power generation and distribution architecture with multiple power sources and multiple distribution paths. The paths must be designed such that any single failure of a power generation or distribution component does not adversely affect the primary, reversionary, or standby displays. It does not need independent sources for the primary and reversionary or standby displays.
c. For single engine airplanes where the engine drives the power generation devices, the engine is not considered to be a single power source for this guidance. For example, a single engine airplane with two engine driven alternators, one powering a PFD and the other powering a reversionary PFD, is considered to meet this guidance. However, this does not exempt the applicant from the § 23.1353(h) requirements. Section 23.1331(c) requires two independent sources of power, but it does not require installing dual alternators or vacuum systems on single engine airplanes. There are other options. First, you could include a dedicated battery with a 30-minute capacity for electrical instrument loads essential to continued safe flight and landing. Second, you could use of differently powered types of instruments for primary and standby. Finally, you could verify the aircraft battery used for starting by a system safety analysis under § 23.1309. See AC 23- 17B for more guidance.
26.0 SAFETY ASSESSMENTS
26.1 Regulations Before and After Amendment 23-41 Part 23 regulations, promulgated before Amendment 23-41, were based on single-fault or fail-safe concepts. A single failure would cause the loss of only one primary instrument function. Only mechanical or electromechanical instruments that function independently of the primary parameter display were envisioned; that is, flight and powerplant instruments were isolated and independent.
Sometimes, several other instrument functions (indication of the function, display, or indicator) are housed in a common case. Since electronic displays permit presentation of several parameters on one display, a failure in the electronic display may affect more than one required parameter. Section 46
23.1309, Amendment 23-41, allowed approval of more advanced and complex systems.
Amendment 23-41 also incorporated § 23.1311 into part 23, which provides the standards for electronic displays. Section 23.1311, Amendment 23-49, revised and clarified the secondary instruments and the visibility requirements.
26.2 Common-Mode Failures Section 23.1311(b) states that "the electronic display indicators, including their systems and installations, and considering other airplane systems, must be designed so that one display of information essential for continued safe flight and landing will remain available to the crew, without need for immediate action by any pilot for continued safe operation, after any single failure or probable combination of failures." In general, without considering specific characteristics of an airplane design, information essential to continued safe flight and landing are attitude, airspeed, altitude, warnings, and any applicable propulsion parameter(s). Address major common-mode failures. Design systems such that a fault in one system does not cause a fault in a different system. These include such failures induced by software errors, lightning effects, electromagnetic interference, power transients, cooling, etc., that could simultaneously affect the display of more than one parameter. AC 23.1309-1C explains the criticality of these failure conditions.
26.3 Safety Analysis
a. AC 23.1309-1C describes safety assessment methods for identifying and classifying each failure condition and choosing the method(s) of safety assessment. Certification of electronic display systems may involve new and complex technology that may not use traditional serviceproven design concepts. In this case, technically qualified judgment can be enhanced when a quantitative analysis is included in the safety assessment, whether or not a quantitative analysis is required by § 23.1309.
b. The use of electronic displays allows a higher degree of integration than was practical with previous electromechanical instruments. Evaluating failure states and determining display function criticality in highly integrated systems may be complex. Safety assessment determination should refer to the display function and include all causes that could affect the displays of that function, not only the display equipment.
c. Installing electronic systems in cockpits creates complex functional interrelationships between the pilots and other display and control systems. The FHA identifies the failure conditions for all display functions, analyzes the effects on the aircraft and flight crew, and assigns the corresponding criticality classification (no safety effect, minor, major, hazardous, catastrophic). It also considers both loss of functions, malfunctions, and situations that provide misleading information.
d. A pilot initiated preflight test may be used to reduce failure exposure times associated with the safety analysis required under § 23.1309. If the flight crew is required to test a system before each flight, assume, for the safety analysis, the flight crew will accomplish this test at least once a day, providing the preflight test is conveniently and acceptably implemented.
27.0 SOFTWARE AND HARDWARE DEVELOPMENT ASSURANCE
27.1 General Applicants must show compliance with § 23.1309, regardless of the intended function of the display system. The equipment shall be designed to the appropriate software and hardware development assurance level(s) based on the intended function and application of the equipment, including the aircraft class in which it is to be installed (see AC 23.1309-1C, Figure 2). The appropriate development assurance level(s) are determined by an analysis of the failure modes of the equipment and a categorization of the effects of the failure on the operation of the aircraft. For the analysis for displays, a failure is defined as either a loss of function or the output of misleading information. Flight guidance information must meet the appropriate design assurance levels required for that function.
27.2 Software Guidance
27.2.1 General AC 20-115B discusses how RTCA/DO-178B provides an acceptable means for showing that software complies with pertinent airworthiness requirements. All software used in electronic displays systems should be developed to the guidance of RTCA/DO-178B, Software Considerations in Airborne Systems and Equipment Certification, dated December 1, 1992, or another acceptable means of compliance, as agreed to between the applicant and the appropriate FAA Aircraft Certification Office (ACO).
27.2.2 Software Levels Determine all software levels by appropriate safety assessments (see AC 23.1309-1C, Figure 2) and any more requirements, such as those specified by functional TSOs.
27.2.3 Field-Loadable Software (FLS) Many electronic displays systems use Field-Loadable Software (FLS) as part of the TC/STC/ASC/ASTC installation. FLS is software that can be loaded without removal of the equipment from the aircraft installation. FLS might also include software loaded into a line replaceable unit (LRU) or hardware element at a repair station or shop. FLS can refer to either executable code or data. When obtaining certification approval for use of the FLS capability, refer to the guidance in Order 8110.49 and AC 20-145.
27.3 Electronic Hardware Guidance If the electronic display system contains electronic devices whose functions cannot feasibly be evaluated by test and/or analysis, the electronic devices should comply with RTCA/DO-254, or other acceptable means of compliance, as agreed to by the appropriate ACO. Determine the 48
hardware levels for all hardware by the appropriate safety assessments (see AC 23.1309-1C, Figure
2) and any more requirements, such as those specified by functional TSOs.
28.0 ENVIRONMENTAL CONDITIONS
28.1 General The equipment environmental limits established by the manufacturer should be compatible with the operating environment of the airplane. Evaluation of the equipment installation should consider factors such as the maximum operating altitude of the airplane and whether the equipment is located within a temperature and pressure-controlled area. Applicable methods for testing the performance characteristics of equipment for specified environmental conditions are provided in RTCA/DO- 160(). Either test or analysis, or both, ensures the compatibility between the operational environment and the environmental equipment category of the laboratory tests.
28.2 Temperature Electronic systems reliability is strongly related to the temperature of the solid-state components in the system. Component temperatures are dependent on internal thermal design and external cooling.
In evaluating the temperature environment, consider the additional heat generated by the equipment, especially in a location where airflow is restricted. To determine if adequate cooling is provided, the evaluation should make maximum use of previous data from comparable installations, thus limiting ground or flight tests to those installations that cannot be verified conveniently by other means. When the equipment-operating environment cannot be verified from previous experience or from an evaluation of temperature values in that equipment location, a cooling test should be conducted.
28.3 Attitude Information Attitude information should continue to be presented for a minimum of 30 minutes after the inflight loss of cooling for the primary instrument when operating in the normal operating environment (temperature/altitude). If proper performance of the flight instrument function(s) is adversely affected due to in-flight loss of cooling, such failure conditions should be annunciated.
Consider automatic over-temperature shutdown of the system a failure condition. Document subsequent pilot actions in the AFM or on placards. These actions may include procedures to allow possible recovery of a system that has an over-temperature shutdown condition.
28.4 Annunciation Annunciation of in-flight loss of cooling or fan monitors may not be required if it is shown by a safety analysis or test demonstration that a hazardous or catastrophic failure condition does not occur. The safety analysis should consider the reliability of the fans, redundancies of the functions, reversionary features (such as the ability to transfer critical functions), the annunciation of overtemperature and its response time, and the availability of other flight instrumentation. In some systems, cooling fans may only be installed to extend the life of the components and not to prevent a failure condition or shutdown of the equipment. These types of installations do not require fan 49
monitors or temperature sensors. If the cooling fans are needed to prevent a hazardous or catastrophic failure condition, install fan monitors or another method to determine the status of the cooling fan during preflight checks.
29.0 ELECTROMAGNETIC PROTECTION Current trends indicate increasing reliance on electrical and electronic systems for safe operations.
For systems that perform flight, propulsion, navigation, and instrumentation functions, consider electromagnetic effects. AC 23.1309-1C and AC 23-17B provide more guidance for lightning and High Intensity Radiated Fields (HIRF) protection.
30.0 ELECTROMAGNETIC INTERFERENCE The electronic display instrument system should not be the source of objectionable conducted or radiated interference. Conducted or radiated interference from other equipment or systems installed in the airplane should not adversely affect the displays.
31.0 IMPLOSION PROTECTION Design and construct the display unit to prevent implosion when the unit is operating over the range of normal and abnormal operating environment in the airplane. When a display unit has a component containing lower pressure than the ambient atmospheric pressure and it is susceptible to implosion, no incapacitation of the flight crew or adjacent equipment should result if an implosion occurs. Test the display unit for the most severe environmental conditions of pressure and temperature levels. Also test for variations in both normal and abnormal operating conditions (including overpressure and decompression) specified by RTCA/DO-160(). To verify that the display unit is acceptable if an implosion occurs, the unit should meet the requirements in UL 1418 listed in paragraph 3.4 of this AC. Similarity of a particular display to a unit already tested may be used to comply with this requirement.
32.0 CONFIGURATION MANAGEMENT BY ELECTRONIC IDENTIFICATION GUIDANCE Configuration management may be necessary because the system may contain many hardware elements and functional software components, with multiple approved configurations.
Identification of software components field-loaded into hardware elements may be implemented by electronic means. Section 21.607, requires equipment with a TSO to be permanently and legibly marked with specific information. Compliance with § 21.607 may be shown when an electronic identification query system stored in non-volatile memory provides the required information. This approach is commonly referred to as an "electronic TSO nameplate." The electronic identification system must be verifiable on board the aircraft when the aircraft is on the ground at any geographic location. The system must provide the specific information required by § 21.607 for all applicable functional TSOs being integrated. All hardware elements that support a functional TSO must have a physical TSO nameplate. Even when electronic identification (that is, electronic nameplate) is used, a physical TSO nameplate must be included on supporting hardware elements. See AC 20-145 for more guidance.