3.2.7 Display Response.
The dynamic response of the display should be sufficient to provide discernibility and readability of the displayed information without presenting misleading, distracting, or confusing information. The response time should be sufficient to ensure dynamic stability of colors, line widths, gray scale, and relative positioning of symbols.
Undesirable display artifacts and characteristics, such as smearing of moving images and loss of luminance, should be minimized so that information is still readable and identifiable under all foreseeable conditions, not distracting, and does not lead to misinterpretation of data.
3.2.8 Display Refresh Rate.
The display refresh rate should be sufficient to prevent flicker effects that result in misleading information or difficulty in reading or interpreting information. The display refresh rate should be sufficient to preclude the appearance of unacceptable flicker.
3.2.9 Display Update Rate.
The display update rate should be sufficient to preclude objectionable motion artifacts that could be misleading or distracting.
3.2.10 Display Defects.
Display defects, such as element defects and stroke tails, resulting from hardware and graphical imaging causes should not impair readability of the displays or induce or cause erroneous interpretation. This is covered in more detail in SAE ARP4256A, SAE AS8034B, and SAE AS8055.
3.2.11 Reflections.
Each pilot compartment must be free of glare and reflections that could interfere with the normal duties of a minimum flightcrew. This must be shown in day and night flight tests under non-precipitation conditions (§ 25.773(a)(2)). The criteria and the basic workload functions and factors for a minimum flightcrew are described in appendix D to part 25 and § 25.1523.
3.2.12 Flight Deck Viewing Envelope.
The size of the viewing envelope should provide visibility of the flight deck displays over the flightcrew’s normal range of head motion and should support cross-flight deck viewing if necessary, for example, when it is required that the captain be able to view and use the first officer’s primary flight information. See paragraph 3.3.3 for installation guidance.
3.3 Installation.
3.3.1 Flight deck display equipment and installation designs should be compatible with the overall flight deck design characteristics (such as flight deck size and shape, flightcrew member position, position of windows, external luminance, etc.) as well as the airplane environment (such as temperature, altitude, electromagnetic interference, and vibration).
3-4
3.3.2 RTCA (formerly the Radio Technical Commission for Aeronautics) DO-160G, Environmental Conditions and Test Procedures for Airborne Equipment, and European Organisation for Civil Aviation Electronics (EUROCAE) ED-14G, Environmental Conditions and Test Procedures for Airborne Equipment, provide information that may be used for an acceptable means of qualifying display equipment for use in the airplane environment.
3.3.3 The display unit must be located in the flight deck such that flight, navigation, and powerplant information for use by any pilot is plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path (§ 25.1321(a)). The primary flight information on the primary display should not be visually obstructed and should remain prominent.
3.3.4 The installation of the display equipment must not adversely affect its readability and the external scene visibility of the flightcrew (see related regulation) under all foreseeable conditions relative to the operating and lighting environment (§ 25.773(a)(1)).
3.3.5 The installation of the display equipment must not cause glare or reflection, either on the displays or on the flight deck windows, that could interfere with the normal duties of the minimum flightcrew (§ 25.773(a)(2)) under all foreseeable conditions.
3.3.6 If the display system design is dependent on cross-flight deck viewing for its use, the installation should take into account the viewing angle limitations of the display units, the size of the displayed information, and the distance of the display from each flightcrew member.
3.3.7 When a display is used to align or overlay symbols with real-world external data (for example, HUD symbols), the display should be installed such that positioning accuracy of these symbols is maintained during all phases of flight. Appendix F of this AC and SAE ARP5288, Transport Category Airplane Head Up Display (HUD) Systems, provide additional details regarding the symbol positioning accuracy for conformal symbology on a HUD.
3.3.8 The display system components should not cause physical harm to the flightcrew under foreseeable conditions relative to the operating environment (for example, turbulence, emergency egress, bird strike, hard landing, and emergency landing).
3.3.9 The installed display must not visually obstruct other controls and instruments or prevent those controls and instruments from performing their intended function (§ 25.1301).
3.3.10 The display system must not be adversely susceptible to electromagnetic interference from other airplane systems (§ 25.1431) under all foreseeable conditions.
3-5
3.3.11 The display components should be installed in such a way that they retain mechanical integrity (secured in position) for all foreseeable conditions relative to the flight environment.
3.3.12 Liquid spill on or breakage of a display system component in the flight deck should not result in a hazard.
3.4 Power Bus Transient.
RTCA DO-160G and EUROCAE ED-14G provide information that may be used for an acceptable means of qualifying display equipment such that the equipment performs its intended function when subjected to anomalous input power. SAE ARP4256A, Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft, provides additional information for power transient recovery (specifically for the display unit).
3.4.1 Flight deck displays and display systems should be insensitive to power transients caused by normal load switching operation of the airplane, in accordance with their intended function.
3.4.2 The electronic attitude display should not be unusable or unstable for more than one second after electrical bus transients due to engine failure. Only displays on one side of the airplane should be affected by an engine failure. Recognizably valid pitch and roll data should be available within one second on the affected displays, and any effects lasting beyond one second should not interfere with the ability to obtain quick glance valid attitude. For most airplanes, an engine failure after takeoff will simultaneously create a roll acceleration, new pitch attitude requirements, and an electrical transient.
Attitude information is paramount; if there is an engine failure, transfer to standby attitude or transfer of control of the airplane to the other pilot cannot be reliably accomplished in a timely enough manner to prevent an unsafe condition. In testing this failure mode, experience has shown that switching the generator off at the control panel may not result in the longest electrical transient. One practical way to simulate this failure is with a fuel cut, which will allow the generator output voltage and frequency to decrease until the bus control recognizes the failure. Other engine failure conditions may be more critical (such as sub-idle stalls), which cannot be reasonably evaluated during flight test. Analysis should identify these failure modes and show that the preceding criteria are met.
3.4.3 Non-normal bus transients (for example, generator failure) should not initiate a power up initialization or cold start process.
3.4.4 The display response to a short-term power interrupt (<200 milliseconds) should be such that the intended function of the display is not adversely affected.
3.4.5 Following in-flight long-term power interrupts (>200 milliseconds), the display system should quickly return to operation in accordance with its intended function, and should continue to permit the safe control of the airplane in attitude, altitude, airspeed, and direction.
3-6
3.4.6 The large electrical loads required to restart some engine types should not affect more than one pilot’s display during the start sequence.
3-7
CHAPTER 4. SAFETY ASPECTS OF ELECTRONIC DISPLAY SYSTEMS
4.1 General.
This chapter provides additional guidance and interpretative material for applying §§ 25.1309 and 25.1333(b) to the approval of display systems. Using electronic displays and integrated modular avionics allows designers to integrate systems to a much higher degree than was practical with previous flight deck components. Although operating the airplane may become easier as a result of the integration, evaluating the conditions in which the display system could fail and determining the severity of the resulting failure effects may become more complex. The evaluation of the failure conditions should identify the display function and include all causes that could affect that function’s display and display equipment. Section 25.1309 defines the basic safety requirements for the airworthiness approval of airplane systems. The tables in this chapter use the ARAC-recommended text for revising the existing § 25.1309 hazard classifications and associated probabilities. The ARAC recommendations for revising the existing AC 25.1309-1A, System Design and Analysis, provide guidance that may be used to establish an acceptable means of compliance. See appendix E of this AC for references on where to find more information regarding the ARAC recommendations.
4.2 Identification of Failure Conditions.
One of the initial steps in establishing compliance with § 25.1309 is identifying the failure conditions that are associated with a display or a display system. The following paragraphs provide material that may be useful in supporting this initial activity. The analysis of the failure condition should identify the impacted functionality, the effect on the airplane and/or its occupants, any considerations related to phase of flight, and identify any flight deck indication, flightcrew action, or other relevant mitigation means.
4.2.1 The type of display system failure conditions will depend, to a large extent, on the architecture (integrated modular avionics, federated system, non-federated system, etc.), design philosophy, and implementation of the system. Types of failure conditions include the following:
4.2.1.1 Loss of function (system or display).
4.2.1.2 Failure of display controls, that is, loss of function or malfunction such that controls perform in an inappropriate manner, including erroneous display control.
4.2.1.3 Malfunction (system or display) that leads to partial loss of data, or erroneous display of data that is either— 4-1
• Detected by the system (for example, flagged or comparator alert), and/or easily detectable by the flightcrew, or
• Difficult to detect by the flightcrew or not detectable and assumed to be correct (for example, “Misleading display of ….”).
4.2.2 When a flight deck design includes primary and standby displays, consider failure conditions involving the failure of standby displays in combination with the failure of primary displays. The flightcrew may use standby instruments in two complementary roles following the failure of primary displays:
4.2.2.1 Redundant display to cope with failure of main instruments, or
4.2.2.2 Independent third source of information to resolve inconsistencies between primary instruments.
4.2.3 When the display of erroneous information is caused by failure of other systems that interface with the display system, the effects of these failures may not be limited to the display system. Associated failure conditions may be dealt with at the airplane level or within the other systems’ safety assessment, as appropriate, in order to assess the cumulative effect.
4.3 Effects of Display Failure Conditions.
The effects of display system failure conditions on safe operations are highly dependent on pilot skills, flight deck procedures, phase of flight, type of operations being conducted, and instrument or visual meteorological conditions.
4.3.1 Based on previous airplane certification programs, paragraph 4.6 of this AC shows examples of safety objectives for certain failure conditions. These safety objectives do not preclude the need for a safety assessment of the actual effects of these failures, which may be more or less severe depending on the design. Therefore, during the § 25.1309 safety assessment process, the FAA will need to agree with the applicant’s hazard classifications for these failure conditions in order for the assessment to be considered valid.
4.3.2 When assessing the effects that result from a display failure, consider the following, accounting for phases of flight when relevant:
4.3.2.1 Effects on the flightcrew’s ability to control the airplane in terms of attitude, speed, accelerations, and flight path, potentially resulting in—
• Controlled flight into terrain,
• Loss of control of the airplane during flight and/or during critical flight phases (approach, takeoff, go-around, etc.), 4-2
• Inadequate performance capability for phase of flight, including loss of obstacle clearance capability, and exceeding takeoff or landing field length,
• Exceeding the flight envelope,
• Exceeding the structural integrity of the airplane, and
• Causing or contributing to pilot-induced oscillations.
4.3.2.2 Effects on the flightcrew’s ability to control the engines, such as—
• Those effects resulting in shutting down a non-failed engine in response to the failure of a different engine, and
• Undetected, significant thrust loss.
4.3.2.3 Effects on the flightcrew’s management of the airplane systems.
4.3.2.4 Effects on the flightcrew’s performance, workload, and ability to cope with adverse operating conditions.
4.3.2.5 Effects on situation awareness. For example, the specific effects must be identified, such as situation awareness related to navigation or system status.
4.3.2.6 Effects on automation if the display is used as a controlling device.
4.3.3 When the display system is used as a control device for other airplane systems, consider the cumulative effect of a display system failure on all of the controlled systems.
4.4 Mitigation of Failure Conditions.
4.4.1 When determining mitigation means for a failure condition, consider the following:
4.4.1.1 Protection against common mode failures.
4.4.1.2 Fault isolation and reconfiguration.
4.4.1.3 Redundancy (for example, heading information may be provided by an independent integrated standby and/or a magnetic direction indicator).
4.4.1.4 Availability, level, timeliness, and type of alert provided to the flightcrew.
4.4.1.5 The flight phase and the airplane configuration.
4.4.1.6 The duration of the condition.
4.4.1.7 The airplane motion cues that may be used by the flightcrew for recognition.
4-3
4.4.1.8 Expected flightcrew corrective action on detection of the failure and/or operational procedures.
4.4.1.9 In some flight phases, ability of the flightcrew to control the airplane after a loss of primary attitude display on one side.
4.4.1.10 The flightcrew’s ability to turn off a display (for example, full bright display at night).
4.4.1.11 Protections provided by other systems (for example, flight envelope protection or augmentation systems).
4.4.2 The mitigation means should be described in the safety analysis/assessment document or by reference to another document (for example, a system description document). The continued performance of the mitigation means, in the presence of the failure conditions, should also be identified and assured.
4.4.3 The safety assessment should include the rationale and coverage of any display system protection and monitoring philosophies used in the design. The safety assessment should also include an evaluation of each of the identified display system failure conditions and an analysis of the exposure to common mode/cause or cascade failures in accordance with ARAC’s recommendations for revising AC 25.1309-1A.
Additionally, the safety assessment should justify and describe any functional partitioning schemes employed to reduce the effect of integrated component failures or functional failures.
4.5 Validation of the Classification of Failure Conditions and Their Effects.
There may be situations where the severity of the effect of the failure condition identified in the safety analysis needs to be confirmed. Laboratory, simulator, or flight test may be appropriate to accomplish the confirmation. The method of validating the failure condition classification will depend on the effect of the condition, assumptions made, and any associated risk. If flightcrew action is expected to cope with the effect of a failure condition, the information available to the flightcrew should be useable for detection of the failure condition and to initiate corrective action.
4.6 System Safety Guidelines.
4.6.1 Experience from previous certification programs has shown that a single failure due to a loss or malfunction of the display system, a sensor, or some other dependent system, which causes the misleading display of primary flight information, may have negative safety effects. It is recommended that the display system design and architecture implement monitoring of the primary flight information to reduce the probability of displaying misleading information.
4-4
4.6.2 Experience from previous certification programs has shown that the combined failure of both primary displays with the loss of the standby system can result in failure conditions with catastrophic effects.
4.6.3 When an integrated standby display is used to provide a backup means of primary flight information, the safety analysis should substantiate that common cause failures have been adequately addressed in the design, including the design of software and complex hardware. In particular, the safety analysis should show that the independence between the primary instruments and the integrated standby instruments is not violated because the integrated standby display may interface with a large number of airplane components, including power supplies, pitot static ports, and other sensors.
4.6.4 There should be a means to detect the loss or erroneous primary flight information, either as a result of a display system failure or the failure of an associated sensor. When loss or malfunction of primary flight information is detected, the means used to indicate the lost or erroneous information should ensure that the erroneous information will not be used by the flightcrew (for example, removal of the information from the display or placement of an “X” through the failed display).
4.6.5 The means used to indicate the lost or erroneous information, when it is detected, should be independent of the failure mechanism. For example, the processor that originates the erroneous parameter should not be the same processor that annunciates or removes the erroneous parameter from the display. Common mode failures of identical processor types should be considered (for example, common mode failures may exist in a processor used to compute the display parameters and an identical processor used for monitoring and annunciating failures).
4.6.6 A catastrophic failure condition should not result from the failure of a single component, part, or element of a system. Failure containment should be provided by the system design to limit the propagation of the effects of any single failure and preclude catastrophic failure conditions. In addition, there should not be a common cause failure that could affect both the single component, part, or element and its failure containment provisions.
4.6.7 For safety-critical display parameters, there should be a means to verify the correctness of sensor input data. Range, staleness, and validity checks should be used where possible.
4.6.8 The latency period induced by the display system, particularly for alerts, should not be excessive and should take into account the criticality of the alert and the required crew response time to minimize propagation of the failure condition.
4.6.9 For those systems that integrate windowing architecture into the display system, a means should be provided to control the information shown on the displays, such that the integrity of the display system as a whole will not be adversely impacted by anomalies in the functions being integrated. This means of controlling the display of information, called window manager in this AC, should be developed to the software 4-5
assurance level at least as high as the highest integrity function of any window. For example, a window manager should be level “A” if the information displayed in any window is level “A” (see RTCA DO-178C, Software Considerations in Airborne Systems and Equipment Certification). SAE ARP4754A, Guidelines for Development of Civil Aircraft Systems, provides a recommended practice for system development assurance.
4.7 System Safety Assessment Guidelines.
4.7.1 The complete set of failure conditions to be considered in the display system safety analysis and the associated safety objective are established during the system safety assessment, and agreed upon by the applicant and the approving civil aviation authority.
The safety assessment should consider the full set of display system intended functions as well as display system architecture and design philosophy (for example, failure modes, failure detection and annunciation, redundancy management, and system and component independence and isolation). The system safety analysis is required by § 25.1309 and indirectly by other regulations, including §§ 25.901, 25.903, and
25.1333.
4.7.2 This AC adopts the ARAC recommendations for revising AC 25.1309-1A. This AC uses the terms “major” and “hazardous” to identify what AC 25.1309-1A refers to as a “major” failure condition. Also, for major and hazardous failure conditions identified as “improbable” in AC 25.1309-1A and in the original version of AC 25-11, this AC includes the ARAC-recommended probabilities “remote” and “extremely remote,” respectively.
4.7.3 This AC also includes the ARAC recommended terms “catastrophic,” “failure,” “failure condition,” “hazardous failure condition,” and “minor failure condition.” ARAC recommended that these terms be included if AC 25.1309-1A is revised. Appendix C of this AC includes the definitions of these terms.
4.7.4 The following tables provide examples of failure conditions and associated hazard classifications and safety objectives common to numerous display systems that are already certified. These tables are provided to support consistency in determining hazard classifications across multiple applicants, multiple certification offices, and multiple display system designs; however, these are only examples. These examples do not replace the need for a system safety assessment and are not an exhaustive list of failure conditions. For these example failure conditions, additional functional capabilities or less operational mitigation may result in higher hazard classifications, while reduced functional capability or increased operational mitigation may result in lower hazard classifications.
4.7.4.1 Attitude (Pitch and Roll). Table 4-1 lists examples of safety objectives for attitude related failure conditions.
4-6
Table 4-1. Example Safety Objectives for Attitude Failure Conditions Failure Condition Hazard Classification Qualitative Probability Loss of all attitude displays, including standby display Catastrophic Extremely Improbable Loss of all primary attitude displays Major – Hazardous1 Remote – Extremely Remote1 Display of misleading attitude information on both Catastrophic Extremely Improbable primary displays Display of misleading attitude information on one Hazardous Extremely Remote primary display Display of misleading attitude information on the Major Remote standby display Display of misleading attitude information on one primary display combined Catastrophic Extremely Improbable2 with a standby failure (loss of attitude or incorrect attitude) 1 System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
2 Consistent with the “Loss of all attitude display, including standby display” safety objective, since the flightcrew may not be able to identify the correct display. Consideration will be given to the ability of the flightcrew to control the airplane after a loss of attitude primary display on one side in some flight phases (for example, during takeoff).
4.7.4.2 Airspeed. Table 4-2 lists examples of safety objectives for airspeed related failure conditions.
4-7
Table 4-2. Example Safety Objectives for Airspeed Failure Conditions Failure Condition Hazard Classification Qualitative Probability Loss of all airspeed displays, Catastrophic Extremely Improbable including standby display Loss of all primary airspeed Major – Hazardous1 Remote – Extremely Remote1 displays Display of misleading airspeed information on both primary displays, coupled Catastrophic Extremely Improbable with loss of stall warning or loss of over-speed warning Display of misleading airspeed information of the Major Remote standby display (primary airspeed still available) Display of misleading airspeed information on one primary display combined Catastrophic Extremely Improbable2 with a standby failure (loss of airspeed or incorrect airspeed) 1 System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
2 Consistent with the “Loss of all airspeed display, including standby display” safety objective, since the flightcrew may not be able to separate out the correct display.
4.7.4.3 Barometric Altitude. Table 4-3 lists examples of safety objectives for barometric altitude related failure conditions.
4-8