Table 4-3. Example Safety Objectives for Barometric Altitude Failure Conditions Failure Condition Hazard Classification Qualitative Probability Loss of all barometric altitude displays, including Catastrophic Extremely Improbable standby display Loss of all barometric altitude primary displays Major – Hazardous1 Remote – Extremely Remote1 Display of misleading barometric altitude information on both primary Catastrophic Extremely Improbable displays Display of misleading barometric altitude information on the standby Major Remote display (primary barometric altitude still available) Display of misleading barometric altitude information on one primary display combined with a Catastrophic Extremely Improbable2 standby failure (loss of altitude or incorrect altitude) 1 System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
2 Consistent with the “Loss of all barometric altitude display, including standby display” safety objective since the flightcrew may not be able to separate out the correct display. Consideration should be given that barometric setting function design is commensurate with the safety objectives identified for barometric altitude.
4.7.4.4 Heading. Table 4-4 lists examples of safety objectives for heading r elated failure conditions.
4.7.4.4.1 The standby heading may be provided by an independent integrated standby or the magnetic direction indicator.
4.7.4.4.2 The safety objectives listed below can be alleviated if it can be demonstrated that track information is available and correct.
4-9
Table 4-4. Example of Safety Objectives for Heading Failure Conditions Failure Condition Hazard Classification Qualitative Probability Loss of stabilized heading in the flight deck Major2 Remote2 Loss of all heading displays in the flight deck Catastrophic Extremely Improbable Display of misleading heading information on both Major – Hazardous1 Remote – Extremely Remote1 pilots’ primary displays Display of misleading heading information on one primary display combined Major – Hazardous1 Remote – Extremely Remote1 with a standby failure (loss of heading or incorrect heading) 1 System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
2 This assumes the availability of an independent, non-stabilized heading required by § 25.1303(a)(3).
4.7.4.5 Navigation and Communication (Excluding Heading, Airspeed, and Clock Data). Table 4-5 lists examples of safety objectives for navigation and communication related failure conditions.
4-10
Table 4-5. Example Safety Objectives for Certain Navigation and Communication
Failure Conditions
Failure Condition Hazard Classification Qualitative Probability Loss of display of all navigation information Major1 Remote1 Non-restorable loss of display of all navigation information coupled with a total loss of communication functions Catastrophic Extremely Improbable Display of misleading navigation information simultaneously to both pilots Major – Hazardous Remote – Extremely Remote Loss of all communication functions Major Remote 1 “All” means loss of all navigation information, excluding heading, airspeed, and clock data. If any or all of the latter information is also lost then a higher classification may be warranted.
4.7.4.6 Other Parameters (Typically Shown on Electronic Display Systems).
Table 4-6 lists examples of safety objectives for failure conditions related to other parameters typically shown on electronic display systems.
4-11
Table 4-6. Example Safety Objectives for Failure Conditions of Other Parameters Failure Condition Hazard Classification Qualitative Probability Display of misleading flight path vector information to one pilot Major Remote1 Loss of all vertical speed displays Major Remote Display of misleading vertical speed information to both pilots Major Remote Loss of all slip/skid indication displays Major Remote Display of misleading slip/skid indication to both pilots Major Remote Display of misleading weather radar information Major Remote2 Total loss of flightcrew alerting displays Major Remote Display of misleading flightcrew alerting information Major3 Remote Display of misleading flightcrew procedures Major – Catastrophic Remote – Extremely Improbable4 Loss of the standby displays Major Remote 1 The safety objective may be more stringent depending on the use and phase of flight.
2 Applicable to the display part of the system only.
3 Applicable to the general case, however, some cases could be more severe. Additional guidance is in AC 25.1322-1, Flightcrew Alerting.
4 To be evaluated depending on the particular procedures and associated situations.
4.7.4.7 Engine. Table 4-7 lists examples of generally accepted safety objectives for engine related failure conditions. Appendix B of this AC provides additional guidance for powerplant displays.
4.7.4.7.1 The term “required engine indications” refers specifically to the engine thrust/power setting parameter (for example, engine pressure ratio, fan 4-12
speed, or torque) and any other engine indications that may be required by the flightcrew to maintain the engine within safe operating limits (for example, rotor speeds or exhaust gas temperature).
4.7.4.7.2 The information in table 4-7 is based on the premise that the display failure occurs while operating in an autonomous engine control mode.
Autonomous engine control modes, such as those provided by full authority digital engine controls, protect continued safe operation of the engine at any thrust lever setting. Hence, the flight deck indications and associated flightcrew actions are not the primary means of protecting safe engine operation.
4.7.4.7.3 Where the indications serve as the primary means of assuring continued safe engine operation, the hazard classification may be more severe. For example, under the table entry “Loss of one or more required engine indications on more than one engine,” the hazard classification would change to “Catastrophic” and the probability would change to “Extremely Improbable.”
4.7.4.7.4 Each of the general failure condition descriptions provided in table 4-7 represents a set of more specific failure conditions. The hazard classifications and probabilities provided in table 4-7 represent the most severe outcome typically associated with any failure condition within the set. If considered separately, some of the specific failure conditions within each set would likely have less severe hazard classifications and probabilities.
4-13
Table 4-7. Example Safety Objectives for Engine Failure Conditions Failure Condition Hazard Classification Qualitative Probability Loss of one or more required engine indications for a Major Remote single engine Misleading display of one or more required engine indications for a single Major Remote engine Loss of one or more required engine indications for more Hazardous Extremely Remote1 than one engine Misleading display of any required engine indications Catastrophic Extremely Improbable2 for more than one engine 1 The worst anticipated outcomes associated with this class of failure may often be driven by consideration of the simultaneous loss of all required engine indications. In any case, those outcomes will typically include both a high speed takeoff abort and loss of the backup means to assure safe engine operations. High-speed aborts have typically been classified as “hazardous” by the FAA due to the associated impacts on both flightcrew workload and safety margins. Since any number of single failures or errors can defeat the protections of a typical autonomous engine control, losing the ability to back up the control is considered a sufficiently large reduction in the safety margins to also warrant a “hazardous” classification. Hence the “Extremely Remote” design guideline was chosen.
2 If the power setting parameter is indicating higher than actual during takeoff, this can lead directly to a catastrophe, either due to a high speed runway overrun or impacting an obstacle after takeoff. This classification has been debated and sustained by the FAA numerous times in the past. Hence the “Extremely Improbable” probability is listed.
4.7.4.8 Use of Display Systems as Controls. Hazard classifications and safety objectives are not provided for display systems used as controls because the failure conditions are dependent on the functions and systems being controlled or on alternative means of control. The use of display systems as controls is described in chapter 7 of this AC. Table 4-8 lists the failure conditions when display systems are used as controls.
Table 4-8. Failure Conditions for Display Systems Used as Controls Failure Condition Qualitative Probability Total loss of capability to use the display Depends on system being controlled system as a control Undetected erroneous input from the display Depends on system being controlled system as a control 4-14
CHAPTER 5. ELECTRONIC DISPLAY INFORMATION ELEMENTS AND FEATURES
5.1 Display Information Elements and Features.
This chapter provides guidance for the display of information elements including text, labels, symbols, graphics, and other depictions (such as schematics) in isolation and in combination. It covers the design and format of these information elements within a given display area. Chapter 6 of this AC covers the integration of information across several display areas in the flight deck, including guidance on flight deck information location, display arrangement, windowing, redundancy management, and failure management.
5.2 General.
5.2.1 The following list provides objectives for each display information element, in accordance with its intended function:
5.2.1.1 Each flight, navigation, and powerplant instrument for use by the flightcrew must be plainly visible from each pilot’s crew station with the minimum practicable deviation from this normal position and line of vision when looking forward along the flight path (§ 25.1321(a)).
5.2.1.2 The displayed information should be easily and clearly discernible, and have enough visual contrast for the pilot to see and interpret it. Overall, the display should allow the pilot to identify and discriminate the information without eyestrain. See paragraph 3.2.4 of this AC for additional guidance regarding contrast ratio.
5.2.1.3 For all display configurations, all foreseeable conditions relative to lighting should be considered. Foreseeable lighting considerations should include failure modes such as lighting and power system failure, the full range of flight deck lighting and display system lighting options, and the operational environment (for example, day and night operations). If a visual indicator is provided to indicate a malfunction of an instrument, it must be effective under all foreseeable lighting conditions (§ 25.1321(e)).
5.2.1.4 Information elements (text, symbol, etc.) should be large enough for the pilot to see and interpret in all foreseeable conditions relative to the operating environment and from the flightcrew station (see related regulation). If two or more pilots need to view the information, the information elements should also be discernible and interpretable over these viewing distances.
5.2.1.5 The pilots should have a clear, unobstructed, and undistorted view of the displayed information.
5-1
5.2.1.6 Information elements should be distinct and permit the pilots to immediately recognize the source of the information elements when there are multiple sources of the same kind of information. For example, if there are multiple sources for vertical guidance information, then each informational element should be distinct so the flightcrew can immediately recognize the source of the vertical guidance.
5.2.2 Factors to consider when designing and evaluating the viewability and readability of the displayed information include (1) position of displayed information, (2) vibrations,
(3) visual angles, and (4) readability of displayed information.
5.2.2.1 Position of Displayed Information.
Distance from the design eye position (DEP) is generally used. If crossflight deck viewing of the information is needed, distance from the offside DEP, accounting for normal head movement, should be used. For displays not mounted on the front panel, the distance determination should include any expected movement away from the DEP by the flightcrew.
5.2.2.2 Vibrations.
Readability should be maintained in adverse conditions, such as vibration.
One possible cause of vibration is sustained engine imbalance. AC 25-24, Sustained Engine Imbalance, provides readability guidance for that condition.
5.2.2.3 Visual Angles.
Account for both the position of the displayed information as well as font height. SAE ARP4102/7, Electronic Displays, provides additional information on this subject.
5.2.2.4 Readability of Display Information.
The Illuminating Engineering Society classifies three main parameters that affect readability—luminance, size, and contrast. Size is the combination of font size and distance from the display.
5.3 Consistency.
Display information should be presented so it is consistent with the flight deck design philosophy in terms of symbology, location, control, behavior, size, shape, color, labels, dynamics, and alerts. Consistency also applies to the representation of information on multiple displays on the same flight deck. Display information representing the same thing on more than one display on the same flight deck should be consistent. Acronyms and labels should be used consistently, and messages/annunciations should contain text in a consistent way. Inconsistencies should be evaluated to ensure that they are not susceptible to confusion or errors, and do not adversely impact the intended function of the system(s) involved.
5-2
5.4 Display Information Elements.
5.4.1 Text should be shown to be distinct and meaningful for the information presented.
Messages should convey the meaning intended. Abbreviations and acronyms should be clear and consistent with established standards. For example, International Civil Aviation Organization (ICAO) document 8400, Procedures for Air Navigation Services ICAO Abbreviations and Codes, provides internationally recognized standard abbreviations and airport identifiers.
5.4.2 Regardless of the font type, size, color, and background, text should be readable in all foreseeable lighting and operating conditions from the flightcrew station (§ 25.1321(a)).
General guidelines for text are as follows:
5.4.2.1 Standard grammatical use of upper and lower case letters is recommended for lengthy documentation and lengthy messages. Using this format is also helpful when the structure of the text is in sentence form.
5.4.2.2 The use of only upper case letters for text labels is acceptable.
5.4.2.3 Avoid contractions, such as “can’t” instead of “cannot.”
5.4.2.4 Break lines of text only at spaces or other natural delimiters.
5.4.2.5 Avoid abbreviations and acronyms where practical.
5.4.2.6 SAE ARP4102/7 provides guidelines on font sizes that are generally acceptable.
5.4.3 The choice of font also affects readability. The following guidelines apply:
5.4.3.1 To facilitate readability, the font chosen should be compatible with the display technology. For example, serif fonts may become distorted on some low pixel resolution displays. However, on displays where serif fonts have been found acceptable, they have been found to be useful for depicting full sentences or larger text strings.
5.4.3.2 Sans serif fonts (for example, Futura or Helvetica) are recommended for displays viewed under extreme lighting conditions.
5.5 Labels.
Labels may be text or icons. The following paragraphs provide guidance on labeling items such as knobs, buttons, symbols, and menus. This guidance applies to labels that are on a display, label a display, or label a display control. Section 25.1555(a) requires that each flight deck control, other than controls whose function is obvious, must be plainly marked as to its function and method of operation. Controls whose functions are not obvious should be marked or identified so that a flightcrew member with little or no 5-3
familiarity with the airplane is able to rapidly, accurately, and consistently identify their functions.
5.5.1 Text and icons should be shown to be distinct and meaningful for the function(s) they label. Standard or non-ambiguous symbols, abbreviations, and nomenclature should be used. For example, in order to be distinct from barometric altitude, any displayed altitude that is geometrically derived should be labeled “GSL.”
5.5.2 If a control performs more than one function the labels should include all intended functions, unless the function of the control is obvious. Labels of graphical controls accessed via a cursor control device should be included on the graphical display.
5.5.3 The following are guidelines and recommendations for labels:
5.5.3.1 Data fields should be uniquely identified either with the unit of measurement or a descriptive label. However, some basic “T” instruments have been found to be acceptable without units of measurement.
5.5.3.2 Labels should be consistent with related labels located elsewhere in the flight deck.
5.5.3.3 When a control or indication occurs in multiple places (for example, a “Return” control on multiple pages of a flight management function), the label should be consistent across all occurrences.
5.5.4 Labels should be placed such that—
5.5.4.1 The spatial relationships between labels and the objects they reference are clear;
5.5.4.2 Labels for display controls are on or adjacent to the controls they identify;
5.5.4.3 Labels for display controls are not obstructed by the associated controls;
5.5.4.4 Labels are oriented to facilitate readability—for example, the labels continuously maintain an upright orientation or align with an associated symbol such as a runway or airway; and
5.5.4.5 On multi-function displays, a label should be used to indicate the active function(s), unless its function is obvious. When the function is no longer active or being displayed, the label should be removed unless another means of showing availability of that function is used. For example, graying out an inactive menu button.
5.5.5 When using icons instead of text labels, only brief exposure to the icon should be needed in order for the flightcrew to determine the function and method of operation of a control. The use of icons should not cause flightcrew confusion.
5-4
5.6 Symbols.
5.6.1 Electronic display symbol appearance and dynamics should be designed to enhance flightcrew comprehension and retention, and minimize flightcrew workload and errors in accordance with the intended function. The following list provides guidance for symbol appearance and dynamics:
5.6.1.1 Symbols should be positioned with sufficient accuracy to avoid interpretation errors or significantly increase interpretation time.
5.6.1.2 Each symbol used should be identifiable and distinguishable from other related symbols.
5.6.1.3 The shape, dynamics, and other symbol characteristics representing the same function on more than one display on the same flight deck should be consistent.
5.6.1.4 Symbol modifiers used to convey multiple levels of information should follow depiction rules clearly stated by the applicant. Symbol modifiers are changes to easily recognized baseline symbols such as colors, fill, and borders.
5.6.1.5 Symbols that represent physical objects (for example, navigational aids and traffic) should not be misleading as to the object’s physical characteristics (including position, size, envelope, and orientation).
5.6.2 Within the flight deck, avoid using the same symbol for different purposes, unless it can be shown that there is no potential for misinterpretation errors or increases in flightcrew training times.
5.6.3 It is recommended that standardized symbols be used. The symbols in the following SAE documents have been found to be acceptable for compliance to the regulations:
• SAE ARP4102/7, Electronic Displays, appendices A through C (for primary flight, navigation, and powerplant displays).
• SAE ARP5289A, Electronic Aeronautical Symbols (for depiction of navigation symbology).
• SAE ARP5288, Transport Category Airplane Head Up Display (HUD) Systems (for HUD symbology).
5-5
5.7 Indications.
5.7.1 General.
Paragraphs 5.7.2 through 5.7.4 provide guidance on numeric readouts, gauges, scales, dials, tapes, and graphical depictions such as schematics. Graphics related to interactivity are discussed in paragraph 5.10 of this chapter and chapter 7 of this AC.
Graphics and display indications should—
5.7.1.1 Be readily understood and compatible with other graphics and indications in the flight deck,
5.7.1.2 Be identifiable and readily distinguishable, and
5.7.1.3 Follow the guidance for viewability presented in paragraphs 5.1, 5.2, 5.3, and 5.4 of this chapter.
5.7.2 Numeric Readouts.
Numeric readouts include displays that emulate rotating drum readouts where the numbers scroll, as well as displays where the digit locations stay fixed.
5.7.2.1 Data accuracy of the numeric readout should be sufficient for the intended function and to avoid inappropriate flightcrew response. The number of significant digits should be appropriate to the data accuracy. Leading zeroes should not be displayed unless convention dictates otherwise (for example, heading and track). As the digits change or scroll, there should not be any confusing motion effects such that the apparent motion does not match the actual trend.
5.7.2.2 When a numeric readout is not associated with any scale, tape, or pointer, it may be difficult for pilots to determine the margin relative to targets or limits, or compare between numeric parameters. A scale, dial, or tape may be needed to accomplish the intended flightcrew task.
5.7.2.3 For North, numeric readouts of heading should indicate 360, as opposed to
000.
5.7.3 Scales, Dials, and Tapes.
Scales, dials, and tapes with fixed and/or moving pointers have been shown to effectively improve flightcrew interpretation of numeric data.
5.7.3.1 The displayed range should be sufficient to perform the intended function.
If the entire operational range is not shown at any given time, the transition to the other portions of the range should not be distracting or confusing.
5.7.3.2 Scale resolution should be sufficient to perform the intended task. Scales may be used without an associated numeric readout if alone they provide 5-6