CHAPTER 3. ELECTRONIC DISPLAY HARDWARE
3.1 Display Hardware Characteristics.
The following paragraphs provide general guidance and a means of compliance for electronic display hardware with respect to its basic visual, installation, and power bus transient handling characteristics. A more detailed set of display hardware characteristics can be found in the following SAE International (formerly the Society of Automotive Engineers) documents:
• For electronic displays, SAE Aerospace Standards (AS) 8034B, Minimum Performance Standard for Airborne Multipurpose Electronic Displays.
• For HUDs, SAE AS8055, Minimum Performance Standard for Airborne Head Up Display (HUD).
• For liquid crystal displays (LCDs), SAE Aerospace Recommended Practice (ARP) 4256A, Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft.
Note 1: For LCDs, the quantitative criterion in SAE ARP4256A is not considered a reliable predictor of acceptable specular reflectivity characteristics. Accordingly, this aspect of LCD performance should be specifically assessed via flightcrew evaluation to establish that there are not internal or external reflections that can result in flightcrew distraction or erroneous interpretation of displayed information.
Note 2: With regard to the criteria for malfunction indication in SAE ARP4256A, the FAA has determined that showing the fonts and symbols to be tolerant to the loss of a single column, line, or element is an acceptable alternative to providing a malfunction indication. Proposed designs that do not use fonts and symbols that are tolerant to these faults are acceptable if they meet the criteria in SAE ARP4256A.
Note 3: The applicant should notify the FAA certification engineer if any visual display characteristics do not meet the guidelines in the applicable SAE documents.
Note 4: The most recent revision of the referenced SAE documents should be considered. If there is a conflict between the guidance in an SAE document and this AC, follow the guidance in this AC.
3.2 Visual Display Characteristics.
The visual display characteristics of a flight deck display are directly linked to their optical characteristics. Display defects (for example, element defects or stroke tails) should not impair readability of the display or create erroneous interpretation. In addition to the information elements and features identified in chapter 5 of this AC, and the visual characteristics in SAE ARP4256A, SAE AS8034B, and SAE AS8055, described above, the display should meet the criteria for the following characteristics.
These characteristics are independent of the proposed display technology.
3-1
3.2.1 Physical Display Size.
A display should be large enough to present information in a form that is usable (for example, readable or identifiable) to the flightcrew from the flightcrew station (see related regulation) in all foreseeable conditions, relative to the operational and lighting environment and in accordance with its intended function(s).
3.2.2 Resolution and Line Width.
The resolution and minimum line width should be sufficient to support all the displayed images such that the displayed information is visible and understandable without misinterpretation from the flightcrew station (see related regulation) in all foreseeable conditions, relative to the operational and lighting environment.
3.2.3 Luminance.
Information should be readable over a wide range of ambient illumination under all foreseeable conditions relative to the operating environment, including but not limited to—
• Direct sunlight on the display,
• Sunlight through a front window illuminating white shirts (reflections),
• Sun above the forward horizon and above a cloud deck in a flightcrew member’s eyes, and
• Night and/or dark environment.
3.2.3.1 For low ambient conditions, the display should be dimmable to levels allowing for the flightcrew’s adaptation to the dark, such that outside vision and an acceptable presentation are maintained.
3.2.3.2 Automatic luminance adjustment systems can be employed to decrease pilot workload and increase display life. Operation of these systems should be satisfactory over a wide range of ambient light conditions, including the extreme cases of a forward low sun and a quartering rearward sun shining directly on the display.
3.2.3.2.1 Some manual adjustment should be retained to provide for normal and non-normal operating differences so that the luminance variation is not distracting and does not interfere with the flightcrew’s ability to perform their tasks.
3.2.3.2.2 Displays or layers of displays with uniformly filled areas conveying information such as weather radar imagery should be independently adjustable in luminance from overlaid symbology. The range of luminance control should allow detection of color differences between adjacent small filled areas no larger than 5 milliradians in principal dimension. While at this setting, overlying map symbology, if present, should be discernible.
3-2
3.2.3.3 Display luminance variation within the entire flight deck should be minimized so that displayed symbols, lines, or characters of equal luminance remain uniform under any luminance setting and under all foreseeable operating conditions.
3.2.4 Contrast Ratio.
3.2.4.1 The display’s contrast ratio should be sufficient to ensure that the information is discernible under the whole ambient illumination range from the flightcrew station (see related regulation) under all foreseeable conditions relative to the operating environment.
3.2.4.2 The contrast between all symbols, characters, lines, and their associated backgrounds should be sufficient to preclude confusion or ambiguity of any necessary information.
3.2.5 Chromaticity.
3.2.5.1 The display chromaticity differences, in conjunction with luminance differences, should be sufficient to allow graphic symbols to be discriminated from each other, from their backgrounds (for example, external scene or image background) and background shaded areas, from the flightcrew station (see related regulation), in all foreseeable conditions relative to the lighting environment. Raster or video fields (for example, non-vector graphics such as weather radar) should allow the image to be discriminated from overlaid symbols, and should allow the desired graphic symbols to be displayed. See SAE AS8034B, sections 4.3.3 and 4.3.4, for additional guidance.
3.2.5.2 The display should provide chromaticity stability over the foreseeable conditions relative to the range of operating temperatures, viewing envelope, image dynamics, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.
3.2.6 Gray Scale.
3.2.6.1 The number of shades of gray and the difference between shades of gray that the display can provide should be adequate for all image content and its use, and should accommodate all viewing conditions.
3.2.6.2 The display should provide sufficient gray scale stability over the foreseeable range of operating temperatures, viewing envelope, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.
3-3
3.2.7 Display Response.
The dynamic response of the display should be sufficient to provide discernibility and readability of the displayed information without presenting misleading, distracting, or confusing information. The response time should be sufficient to ensure dynamic stability of colors, line widths, gray scale, and relative positioning of symbols.
Undesirable display artifacts and characteristics, such as smearing of moving images and loss of luminance, should be minimized so that information is still readable and identifiable under all foreseeable conditions, not distracting, and does not lead to misinterpretation of data.
3.2.8 Display Refresh Rate.
The display refresh rate should be sufficient to prevent flicker effects that result in misleading information or difficulty in reading or interpreting information. The display refresh rate should be sufficient to preclude the appearance of unacceptable flicker.
3.2.9 Display Update Rate.
The display update rate should be sufficient to preclude objectionable motion artifacts that could be misleading or distracting.
3.2.10 Display Defects.
Display defects, such as element defects and stroke tails, resulting from hardware and graphical imaging causes should not impair readability of the displays or induce or cause erroneous interpretation. This is covered in more detail in SAE ARP4256A, SAE AS8034B, and SAE AS8055.
3.2.11 Reflections.
Each pilot compartment must be free of glare and reflections that could interfere with the normal duties of a minimum flightcrew. This must be shown in day and night flight tests under non-precipitation conditions (§ 25.773(a)(2)). The criteria and the basic workload functions and factors for a minimum flightcrew are described in appendix D to part 25 and § 25.1523.
3.2.12 Flight Deck Viewing Envelope.
The size of the viewing envelope should provide visibility of the flight deck displays over the flightcrew’s normal range of head motion and should support cross-flight deck viewing if necessary, for example, when it is required that the captain be able to view and use the first officer’s primary flight information. See paragraph 3.3.3 for installation guidance.
3.3 Installation.
3.3.1 Flight deck display equipment and installation designs should be compatible with the overall flight deck design characteristics (such as flight deck size and shape, flightcrew member position, position of windows, external luminance, etc.) as well as the airplane environment (such as temperature, altitude, electromagnetic interference, and vibration).
3-4
3.3.2 RTCA (formerly the Radio Technical Commission for Aeronautics) DO-160G, Environmental Conditions and Test Procedures for Airborne Equipment, and European Organisation for Civil Aviation Electronics (EUROCAE) ED-14G, Environmental Conditions and Test Procedures for Airborne Equipment, provide information that may be used for an acceptable means of qualifying display equipment for use in the airplane environment.
3.3.3 The display unit must be located in the flight deck such that flight, navigation, and powerplant information for use by any pilot is plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path (§ 25.1321(a)). The primary flight information on the primary display should not be visually obstructed and should remain prominent.
3.3.4 The installation of the display equipment must not adversely affect its readability and the external scene visibility of the flightcrew (see related regulation) under all foreseeable conditions relative to the operating and lighting environment (§ 25.773(a)(1)).
3.3.5 The installation of the display equipment must not cause glare or reflection, either on the displays or on the flight deck windows, that could interfere with the normal duties of the minimum flightcrew (§ 25.773(a)(2)) under all foreseeable conditions.
3.3.6 If the display system design is dependent on cross-flight deck viewing for its use, the installation should take into account the viewing angle limitations of the display units, the size of the displayed information, and the distance of the display from each flightcrew member.
3.3.7 When a display is used to align or overlay symbols with real-world external data (for example, HUD symbols), the display should be installed such that positioning accuracy of these symbols is maintained during all phases of flight. Appendix F of this AC and SAE ARP5288, Transport Category Airplane Head Up Display (HUD) Systems, provide additional details regarding the symbol positioning accuracy for conformal symbology on a HUD.
3.3.8 The display system components should not cause physical harm to the flightcrew under foreseeable conditions relative to the operating environment (for example, turbulence, emergency egress, bird strike, hard landing, and emergency landing).
3.3.9 The installed display must not visually obstruct other controls and instruments or prevent those controls and instruments from performing their intended function (§ 25.1301).
3.3.10 The display system must not be adversely susceptible to electromagnetic interference from other airplane systems (§ 25.1431) under all foreseeable conditions.
3-5
3.3.11 The display components should be installed in such a way that they retain mechanical integrity (secured in position) for all foreseeable conditions relative to the flight environment.
3.3.12 Liquid spill on or breakage of a display system component in the flight deck should not result in a hazard.
3.4 Power Bus Transient.
RTCA DO-160G and EUROCAE ED-14G provide information that may be used for an acceptable means of qualifying display equipment such that the equipment performs its intended function when subjected to anomalous input power. SAE ARP4256A, Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft, provides additional information for power transient recovery (specifically for the display unit).
3.4.1 Flight deck displays and display systems should be insensitive to power transients caused by normal load switching operation of the airplane, in accordance with their intended function.
3.4.2 The electronic attitude display should not be unusable or unstable for more than one second after electrical bus transients due to engine failure. Only displays on one side of the airplane should be affected by an engine failure. Recognizably valid pitch and roll data should be available within one second on the affected displays, and any effects lasting beyond one second should not interfere with the ability to obtain quick glance valid attitude. For most airplanes, an engine failure after takeoff will simultaneously create a roll acceleration, new pitch attitude requirements, and an electrical transient.
Attitude information is paramount; if there is an engine failure, transfer to standby attitude or transfer of control of the airplane to the other pilot cannot be reliably accomplished in a timely enough manner to prevent an unsafe condition. In testing this failure mode, experience has shown that switching the generator off at the control panel may not result in the longest electrical transient. One practical way to simulate this failure is with a fuel cut, which will allow the generator output voltage and frequency to decrease until the bus control recognizes the failure. Other engine failure conditions may be more critical (such as sub-idle stalls), which cannot be reasonably evaluated during flight test. Analysis should identify these failure modes and show that the preceding criteria are met.
3.4.3 Non-normal bus transients (for example, generator failure) should not initiate a power up initialization or cold start process.
3.4.4 The display response to a short-term power interrupt (<200 milliseconds) should be such that the intended function of the display is not adversely affected.
3.4.5 Following in-flight long-term power interrupts (>200 milliseconds), the display system should quickly return to operation in accordance with its intended function, and should continue to permit the safe control of the airplane in attitude, altitude, airspeed, and direction.
3-6
3.4.6 The large electrical loads required to restart some engine types should not affect more than one pilot’s display during the start sequence.
3-7
CHAPTER 4. SAFETY ASPECTS OF ELECTRONIC DISPLAY SYSTEMS
4.1 General.
This chapter provides additional guidance and interpretative material for applying §§ 25.1309 and 25.1333(b) to the approval of display systems. Using electronic displays and integrated modular avionics allows designers to integrate systems to a much higher degree than was practical with previous flight deck components. Although operating the airplane may become easier as a result of the integration, evaluating the conditions in which the display system could fail and determining the severity of the resulting failure effects may become more complex. The evaluation of the failure conditions should identify the display function and include all causes that could affect that function’s display and display equipment. Section 25.1309 defines the basic safety requirements for the airworthiness approval of airplane systems. The tables in this chapter use the ARAC-recommended text for revising the existing § 25.1309 hazard classifications and associated probabilities. The ARAC recommendations for revising the existing AC 25.1309-1A, System Design and Analysis, provide guidance that may be used to establish an acceptable means of compliance. See appendix E of this AC for references on where to find more information regarding the ARAC recommendations.
4.2 Identification of Failure Conditions.
One of the initial steps in establishing compliance with § 25.1309 is identifying the failure conditions that are associated with a display or a display system. The following paragraphs provide material that may be useful in supporting this initial activity. The analysis of the failure condition should identify the impacted functionality, the effect on the airplane and/or its occupants, any considerations related to phase of flight, and identify any flight deck indication, flightcrew action, or other relevant mitigation means.
4.2.1 The type of display system failure conditions will depend, to a large extent, on the architecture (integrated modular avionics, federated system, non-federated system, etc.), design philosophy, and implementation of the system. Types of failure conditions include the following:
4.2.1.1 Loss of function (system or display).
4.2.1.2 Failure of display controls, that is, loss of function or malfunction such that controls perform in an inappropriate manner, including erroneous display control.
4.2.1.3 Malfunction (system or display) that leads to partial loss of data, or erroneous display of data that is either— 4-1
• Detected by the system (for example, flagged or comparator alert), and/or easily detectable by the flightcrew, or
• Difficult to detect by the flightcrew or not detectable and assumed to be correct (for example, “Misleading display of ….”).
4.2.2 When a flight deck design includes primary and standby displays, consider failure conditions involving the failure of standby displays in combination with the failure of primary displays. The flightcrew may use standby instruments in two complementary roles following the failure of primary displays:
4.2.2.1 Redundant display to cope with failure of main instruments, or
4.2.2.2 Independent third source of information to resolve inconsistencies between primary instruments.
4.2.3 When the display of erroneous information is caused by failure of other systems that interface with the display system, the effects of these failures may not be limited to the display system. Associated failure conditions may be dealt with at the airplane level or within the other systems’ safety assessment, as appropriate, in order to assess the cumulative effect.
4.3 Effects of Display Failure Conditions.
The effects of display system failure conditions on safe operations are highly dependent on pilot skills, flight deck procedures, phase of flight, type of operations being conducted, and instrument or visual meteorological conditions.
4.3.1 Based on previous airplane certification programs, paragraph 4.6 of this AC shows examples of safety objectives for certain failure conditions. These safety objectives do not preclude the need for a safety assessment of the actual effects of these failures, which may be more or less severe depending on the design. Therefore, during the § 25.1309 safety assessment process, the FAA will need to agree with the applicant’s hazard classifications for these failure conditions in order for the assessment to be considered valid.
4.3.2 When assessing the effects that result from a display failure, consider the following, accounting for phases of flight when relevant:
4.3.2.1 Effects on the flightcrew’s ability to control the airplane in terms of attitude, speed, accelerations, and flight path, potentially resulting in—
• Controlled flight into terrain,
• Loss of control of the airplane during flight and/or during critical flight phases (approach, takeoff, go-around, etc.), 4-2
• Inadequate performance capability for phase of flight, including loss of obstacle clearance capability, and exceeding takeoff or landing field length,
• Exceeding the flight envelope,
• Exceeding the structural integrity of the airplane, and
• Causing or contributing to pilot-induced oscillations.
4.3.2.2 Effects on the flightcrew’s ability to control the engines, such as—
• Those effects resulting in shutting down a non-failed engine in response to the failure of a different engine, and
• Undetected, significant thrust loss.
4.3.2.3 Effects on the flightcrew’s management of the airplane systems.
4.3.2.4 Effects on the flightcrew’s performance, workload, and ability to cope with adverse operating conditions.
4.3.2.5 Effects on situation awareness. For example, the specific effects must be identified, such as situation awareness related to navigation or system status.
4.3.2.6 Effects on automation if the display is used as a controlling device.
4.3.3 When the display system is used as a control device for other airplane systems, consider the cumulative effect of a display system failure on all of the controlled systems.
4.4 Mitigation of Failure Conditions.
4.4.1 When determining mitigation means for a failure condition, consider the following:
4.4.1.1 Protection against common mode failures.
4.4.1.2 Fault isolation and reconfiguration.
4.4.1.3 Redundancy (for example, heading information may be provided by an independent integrated standby and/or a magnetic direction indicator).
4.4.1.4 Availability, level, timeliness, and type of alert provided to the flightcrew.
4.4.1.5 The flight phase and the airplane configuration.
4.4.1.6 The duration of the condition.
4.4.1.7 The airplane motion cues that may be used by the flightcrew for recognition.
4-3
4.4.1.8 Expected flightcrew corrective action on detection of the failure and/or operational procedures.
4.4.1.9 In some flight phases, ability of the flightcrew to control the airplane after a loss of primary attitude display on one side.
4.4.1.10 The flightcrew’s ability to turn off a display (for example, full bright display at night).
4.4.1.11 Protections provided by other systems (for example, flight envelope protection or augmentation systems).
4.4.2 The mitigation means should be described in the safety analysis/assessment document or by reference to another document (for example, a system description document). The continued performance of the mitigation means, in the presence of the failure conditions, should also be identified and assured.
4.4.3 The safety assessment should include the rationale and coverage of any display system protection and monitoring philosophies used in the design. The safety assessment should also include an evaluation of each of the identified display system failure conditions and an analysis of the exposure to common mode/cause or cascade failures in accordance with ARAC’s recommendations for revising AC 25.1309-1A.
Additionally, the safety assessment should justify and describe any functional partitioning schemes employed to reduce the effect of integrated component failures or functional failures.
4.5 Validation of the Classification of Failure Conditions and Their Effects.
There may be situations where the severity of the effect of the failure condition identified in the safety analysis needs to be confirmed. Laboratory, simulator, or flight test may be appropriate to accomplish the confirmation. The method of validating the failure condition classification will depend on the effect of the condition, assumptions made, and any associated risk. If flightcrew action is expected to cope with the effect of a failure condition, the information available to the flightcrew should be useable for detection of the failure condition and to initiate corrective action.
4.6 System Safety Guidelines.
4.6.1 Experience from previous certification programs has shown that a single failure due to a loss or malfunction of the display system, a sensor, or some other dependent system, which causes the misleading display of primary flight information, may have negative safety effects. It is recommended that the display system design and architecture implement monitoring of the primary flight information to reduce the probability of displaying misleading information.
4-4
4.6.2 Experience from previous certification programs has shown that the combined failure of both primary displays with the loss of the standby system can result in failure conditions with catastrophic effects.
4.6.3 When an integrated standby display is used to provide a backup means of primary flight information, the safety analysis should substantiate that common cause failures have been adequately addressed in the design, including the design of software and complex hardware. In particular, the safety analysis should show that the independence between the primary instruments and the integrated standby instruments is not violated because the integrated standby display may interface with a large number of airplane components, including power supplies, pitot static ports, and other sensors.
4.6.4 There should be a means to detect the loss or erroneous primary flight information, either as a result of a display system failure or the failure of an associated sensor. When loss or malfunction of primary flight information is detected, the means used to indicate the lost or erroneous information should ensure that the erroneous information will not be used by the flightcrew (for example, removal of the information from the display or placement of an “X” through the failed display).
4.6.5 The means used to indicate the lost or erroneous information, when it is detected, should be independent of the failure mechanism. For example, the processor that originates the erroneous parameter should not be the same processor that annunciates or removes the erroneous parameter from the display. Common mode failures of identical processor types should be considered (for example, common mode failures may exist in a processor used to compute the display parameters and an identical processor used for monitoring and annunciating failures).
4.6.6 A catastrophic failure condition should not result from the failure of a single component, part, or element of a system. Failure containment should be provided by the system design to limit the propagation of the effects of any single failure and preclude catastrophic failure conditions. In addition, there should not be a common cause failure that could affect both the single component, part, or element and its failure containment provisions.
4.6.7 For safety-critical display parameters, there should be a means to verify the correctness of sensor input data. Range, staleness, and validity checks should be used where possible.
4.6.8 The latency period induced by the display system, particularly for alerts, should not be excessive and should take into account the criticality of the alert and the required crew response time to minimize propagation of the failure condition.
4.6.9 For those systems that integrate windowing architecture into the display system, a means should be provided to control the information shown on the displays, such that the integrity of the display system as a whole will not be adversely impacted by anomalies in the functions being integrated. This means of controlling the display of information, called window manager in this AC, should be developed to the software 4-5