6.3.3.1.5 The automatic or requested display of the inhibited parameter should not create unacceptable clutter on the display. Also, simultaneous multiple “pop-ups” should not create unacceptable clutter on the display.
6.3.3.1.6 If the presence of a new parameter is not sufficiently self-evident, suitable alerting or other annunciations should accompany the automatic presentation of the parameter.
6.3.3.2 Pop-up display of information. Certain types of information, such as terrain and TCAS, are required by the operation regulations to be displayed, yet they are only necessary or required in certain phases of flight (similar to the part-time display of required airplane parameters (see paragraph 6.2.3 of this chapter)), or under specific conditions. One method commonly employed to display this information is called “automatic pop-up.” Automatic pop-ups may be in the form of an overlay, such as a TCAS overlay on the moving map, or in a separate window as a part of a display format. Pop-up window locations should not obscure required information. Consider the following criteria for displaying automatic pop-up information:
6.3.3.2.1 Information is automatically displayed when its value indicates a predetermined condition, or when the associated parameter reaches a predetermined value.
6.3.3.2.2 Pop-up information should appropriately attract the flightcrew’s attention while minimizing task disruption.
6.3.3.2.3 If the flightcrew deselects the display of the automatic pop-up information, then another automatic pop-up should not occur until a new condition/event causes it.
6.3.3.2.4 If an automatic pop-up condition is activated and the system is in the wrong configuration or mode to display the information, and the system configuration cannot be automatically changed, then an annunciation should be displayed in the color associated with the nature of the alert, prompting the flightcrew to make the necessary changes for the display of the information. This guidance differs from the part-time display of information required by part 25 because the required information should be displayed regardless of the configuration.
6.3.3.2.5 If a pop-up or simultaneous multiple pop-ups occur and obscure information, it should be shown that the obscured information is not relevant or necessary for the current flightcrew task. Additionally, the pop-ups should not cause a misleading presentation.
6.3.3.2.6 If more than one automatic pop-up occurs simultaneously on one display area, for example a terrain and TCAS pop-up, then the system should 6-7
prioritize the pop-up events based on their criticality. Pop-up display orientation should be in track-up or heading-up.
6.3.3.2.7 Any information to a given system that is not continuously displayed, but the safety assessment determines it is necessary to be presented to the flightcrew, should automatically pop-up or otherwise indicate that its display is required.
6.4 Managing Display Configuration.
The following paragraphs address managing the information presented by an electronic display system and its response to failure conditions and flightcrew selections. The following paragraphs also provide guidance on the acceptability of display formats and their required physical location on the flight deck, both during normal flight and in failure modes. Manual and automatic system reconfiguration and source switching are also addressed.
6.4.1 Normal Conditions.
In normal conditions (that is, non-failure conditions) there may be a number of possible display configurations that may be selected manually or automatically. All possible display configurations available to the flightcrew should be designed and evaluated for arrangement, visibility, and interference.
6.4.2 System Failure Conditions (Reconfiguration).
The following paragraphs provide guidance on manual and automatic display system reconfiguration in response to display system failures. Arrangement and visibility requirements also apply in failure conditions. Alternative display locations used in non-normal conditions should be evaluated by the FAA or its designees to determine if the alternative locations meet the criteria for acceptability.
6.4.2.1 Moving display formats to different display locations on the flight deck or using redundant display paths to drive display information is acceptable to meet availability and integrity requirements.
6.4.2.2 In an instrument panel configuration with a display unit for primary flight information positioned above a display unit for navigation information, it is acceptable to move the primary flight information to the lower display unit if the upper display unit fails.
6.4.2.3 In an instrument panel configuration with a display unit for primary flight information positioned next to a display unit for navigation information, it is acceptable to move the primary flight information to the display unit directly adjacent to it if the preferred display unit fails. It is also acceptable to switch the navigation information to a centrally located auxiliary display (multi-function display).
6-8
6.4.2.4 If several possibilities exist for relocating the failed display, a recommended flightcrew procedure should be considered and documented in the AFM.
6.4.2.5 It is acceptable to have manual or automatic switching capability (automatic switching is preferred) in case of system failure; however, the ARAC recommendation for revising § 25.1333(b) requires that the equipment, systems, and installations must be designed so that sufficient information is available to assure control of the airplane’s airspeed, altitude, heading, and attitude by one of the pilots without additional flightcrew action, after any single failure or combination of failures that is not assessed to be extremely improbable.
6.4.2.6 The following means to reconfigure the displayed information are acceptable:
6.4.2.6.1 Display unit reconfiguration. Moving a display format to a different location (for example, moving the primary flight information to the adjacent display unit) or the use of a compacted format may be acceptable.
6.4.2.6.2 Source/graphic generator reconfiguration. The reconfiguration of graphic generator sources either manually or automatically to accommodate a failure may be acceptable. In the case where both the captain and first officer’s displays are driven by a single graphic generator source, there should be clear, cautionary alerting to the flightcrew that the displayed information is from a single graphic generator source.
6.4.2.6.3 In certain flight phases, manual reconfiguration may not satisfy the need for the pilot controlling the airplane to recover primary flight information without delay. Automatic reconfiguration might be necessary to ensure the timely availability of information that requires immediate flightcrew member action.
6.4.2.6.4 When automatic reconfiguration occurs (for example, display transfer), it should not adversely affect the performance of the flightcrew and should not result in any trajectory deviation.
6.4.2.6.5 When the display reconfiguration results in the switching of sources or display paths that is not annunciated and is not obvious to the flightcrew, care should be taken that the flightcrew is aware of the actual status of the systems when necessary, depending on flight deck philosophy.
6-9
6.5 Methods of Reconfiguration.
6.5.1 Compacted Format.
6.5.1.1 The term “compacted format,” as used in this AC, refers to a reversionary display mode where selected display components of a multi-display configuration are combined in a single display format to provide higher priority information following a display failure. The “compacted format” may be automatically selected in case of a primary display failure, or it may be manually (automatic selection preferred) selected by the flightcrew. Except for training purposes, the “compacted format” should not be selectable unless there is a display failure. The concepts and requirements of § 25.1321, as discussed in paragraph 6.2.3 of this chapter, still apply.
6.5.1.2 The compacted display format should maintain the same display attributes (color, symbol location, etc.) and include the same required information, as the primary formats it is replacing. The compacted format should ensure the proper operation of all the display functions it presents, including annunciation of navigation and guidance modes, if present.
However, due to size constraints and to avoid clutter, it may be necessary to reduce the amount of display functions on the compacted format. For example, in some cases, the use of numeric readouts in place of graphical scales has been found to be acceptable. Failure flags and mode annunciations should, wherever possible, be displayed in a location common with the normal format.
6.5.2 Sensor Selection and Annunciation.
6.5.2.1 Automatic switching of sensor data to the display system is recommended, especially with highly integrated display systems to address those cases where multiple failure conditions may occur at the same time and require immediate flightcrew action. Manual switching may be acceptable in less complex systems or if immediate flightcrew action is not required.
6.5.2.2 Independent attitude, direction, and air data sources are required for the captain and first officer’s displays of primary flight information (see § 25.1333). If sources can be switched such that the captain and first officer are provided with single sensor information, each of them should receive a clear annunciation indicating the vulnerability to misleading information.
6.5.2.3 If sensor information sources cannot be switched, then no annunciation is required.
6.5.2.4 There should be a means of determining the source of the displayed navigation information and the active navigation mode. For approach 6-10
operations the source of the displayed navigation information and the active navigation mode should be available on the primary flight display or immediately adjacent to the primary flight display.
6.5.2.5 The selected source should be annunciated if multiple or different types of navigation sources (flight management system, instrument landing system, global navigation satellite system (GNSS) landing system, etc.) can be selected (manually or automatically).
6.5.2.6 An alert should be given when the information presented to the flightcrew is no longer meeting the required integrity level, in particular when there is a single sensor or loss of independence.
6-11
CHAPTER 7. ELECTRONIC DISPLAY SYSTEM CONTROL DEVICES
7.1 General.
Each electronic display system control device has characteristics unique to its operation that need to be considered when designing the functions the display system controls, and the redundancy provided during failure modes. Despite the amount of redundancy that may be available to achieve a given task, the flight deck should still present a consistent user interface scheme for the primary displays and a compatible, if not consistent, user interface scheme for auxiliary displays throughout the flight deck.
7.2 Multi-Function Control Labels.
Multi-function controls should be labeled such that the pilot is able to—
7.2.1 Rapidly, accurately, and consistently identify and select all functions of the control device;
7.2.2 Quickly and reliably identify what item on the display is “active” as a result of cursor positioning, as well as what function will be performed if the item is selected using the selector buttons and/or changed using the multi-function control; and
7.2.3 Determine quickly and accurately the function of the control without extensive training or experience.
7.3 Multi-Function Controls.
The installation guidelines below apply to control input devices that are dedicated to operating a specific function (for example, control knobs and wheels), as well as new control features (for example, a cursor control device (CCD)).
7.3.1 “Hard” Controls.
7.3.1.1 Mechanical controls used to set numeric data on a display should have adequate friction or tactile detents to allow a flightcrew without extensive training or experience to set values (for example, setting an out-of-view heading bug to a displayed number) to a required level of accuracy within a time appropriate to the task.
7.3.1.2 The input for display response gain to control should be optimized for gross motion as well as fine positioning tasks without overshoots. In accordance with § 25.777(b), the direction of movement of the cockpit controls must meet the requirements of § 25.779. Wherever practicable, the sense of motion involved in the operation of other controls must correspond to the sense of the effect of the operation on the airplane or on the part operated. Controls of a variable nature using a rotary motion must 7-1
move clockwise from the off position, through an increasing range, to the full on position.
7.3.2 “Soft” Controls.
7.3.2.1 There are two interactive types of soft control displays, one type affects airplane systems and the other type does not. Displays that use a graphical user interface (GUI) permit information within different display areas to be directly manipulated by the flightcrew (for example, changing range, scrolling crew alert messages or electronic checklists, configuring windows, or layering information). This level of display interaction affects only the presentation of display information and has a minimal effect on flight deck operations. The other level of display interaction provides a GUI to control airplane system operations (for example, utility controls on displays traditionally found in overhead panel functions, flight management system (FMS) operations, and graphical flight planning).
7.3.2.2 The design of display systems that will be used as soft controls is dependent on the functions they control. Consider the following guidelines when designing these display systems:
7.3.2.2.1 The GUI and control device should be compatible with the airplane system they will control. The hardware and software design assurance levels and tests for the GUI and control device should be commensurate with the level of criticality of the airplane system they will control.
7.3.2.2.2 Redundant methods of controlling the system may lessen the criticality required of the display control. Particular attention should be paid to the interdependence of display controls (that is, vulnerability to common mode failures), and to the combined effects of the loss of control of multiple systems and functions.
7.3.2.2.3 The applicant should demonstrate that the failure of any display control does not unacceptably disrupt operation of the airplane (that is the allocation of flightcrew member tasks) in normal, non-normal, and emergency conditions.
7.3.2.2.4 To show compliance with §§ 25.777(a) and 25.1523, the applicant should show that the flightcrew can conveniently access required and backup control functions in all expected flight scenarios, without impairing airplane control, flightcrew task performance, and flightcrew resource management.
7.3.2.2.5 Control system latency and gains can be important in the acceptability of a display control. Usability testing should therefore accurately replicate the latency and control gains that will be present in the actual airplane.
7-2
7.3.2.2.6 The final display response to control input should be fast enough to prevent undue concentration being required when the flightcrew sets values or display parameters (§ 25.771(a)). The initial indication of a response to a soft control input should take no longer than 250 milliseconds. If the initial response to a control input is not the same as the final expected response, a means of indicating the status of the pilot input should be made available to the flightcrew.
7.3.2.2.7 To show compliance with § 25.771(e), the applicant should show by test and/or demonstration in representative motion environment(s) (for example, turbulence) that the display control is acceptable for controlling all functions that the flightcrew may access during these conditions.
7.4 Cursor Control Devices.
When the input device controls cursor activity on a display, it is called a cursor control device (CCD). The CCDs are used to position display cursors on selectable areas of the displays. These selectable areas are “soft controls” intended to perform the same functions as mechanical switches or other controls on conventional control panels.
Typically, CCDs control several functions and are the means for directly selecting display elements. When designing CCDs, in addition to the guidance provided in paragraphs 7.2, 7.3, and 7.5 of this chapter, consider the guidance in the following paragraphs, which address design considerations unique to CCDs. Additional guidance on cursor control is contained in AC 20-170, Integrated Modular Avionics Development, Verification, and Approval Using RTCA/DO-297 and Technical Standard Order-C153, October 28, 2010.
7.4.1 The CCD design and installation should enable the flightcrew to operate the CCD without exceptional skill during foreseeable flight conditions, both normal and adverse (for example, turbulence and vibrations). Certain selection techniques, such as double or triple clicks, should be avoided.
7.4.2 The safety assessment of the CCD should address reversion to alternate means of control following loss of the CCD. This includes an assessment on the impact of the failure on flightcrew workload.
7.4.3 The functionality of the CCD should be demonstrated with respect to the flightcrew interface considerations outlined below:
7.4.3.1 The ability of the flightcrew to share tasks, following CCD failure, with appropriate workload and efficiency.
7.4.3.2 The ability of the flightcrew to use the CCD with accuracy and speed of selection required of the related tasks, under foreseeable operating conditions (for example, turbulence, engine imbalance, and vibration).
7-3
7.4.3.3 Satisfactory flightcrew task performance and CCD functionality, whether the CCD is operated with a dominant or non-dominant hand.
7.4.3.4 Hand stability support position (for example, wrist rest).
7.4.3.5 Ease of recovery from incorrect use.
7.5 Cursor Displays.
7.5.1 The cursor symbol should be restricted from areas of primary flight information or where occlusion of display information by a cursor could result in misinterpretation by the flightcrew. If a cursor symbol is allowed to enter a critical display information field, it should be demonstrated that the cursor symbol’s presence will not cause interference during any phase of flight or failure condition.
7.5.2 Because the cursor is a directly controllable element on the display, it has unique characteristics. Consider the following when designing a cursor display:
7.5.2.1 Presentation of the cursor should be clear, unambiguous, and easily detectable in all foreseeable operating conditions.
7.5.2.2 The failure mode of an uncontrollable and distracting display of the cursor should be evaluated.
7.5.2.3 Because in most applications more than one flightcrew member will be using one cursor, the applicant should establish an acceptable method for handling “dueling cursors” that is compatible with the overall flight deck philosophy (for example, “last person on display wins”). Acceptable methods should also be established for handling other possible scenarios, including the use of two cursors by two pilots.
7.5.2.4 If more than one cursor is used on a display system, a means should be provided to distinguish between the cursors.
7.5.2.5 If a cursor is allowed to fade from a display, some means should be employed for the flightcrew to quickly locate it on the display system.
Common examples of this are “blooming” or “growing” the cursor to attract the flightcrew’s attention.
7-4
CHAPTER 8. SHOWING COMPLIANCE FOR APPROVAL OF
ELECTRONIC DISPLAY SYSTEMS
8.1 General Compliance Considerations (Test and Compliance).
This chapter provides guidance for demonstrating compliance to the regulations for the approval of electronic flight deck displays. Since so much of display system compliance is dependent on subjective evaluations, this chapter focuses on providing specific guidance that facilitates these types of evaluations.
8.2 Means of Compliance.
8.2.1 The acceptable means of compliance for a display system depends on many factors and is determined on a case-by-case basis. For example, when the proposed display system technology is mature and well understood, means such as analogical reasoning documented as a “Statement of Similarity” may be sufficient. However, more rigorous and structured methods, such as analysis and flight test, are appropriate if the proposed display system design is deemed novel, complex, or highly integrated.
8.2.2 The acceptable means of compliance depends on other factors as well. These include the subjectivity of the acceptance criteria and the evaluation facilities of the applicant (for example, high-fidelity flight simulators) and the manner in which these facilities are used (for example, data collection).
8.2.3 When subjective criteria are used to satisfy a means of compliance, the subjective data should be collected from multiple people (including pilots, engineers, and human factor specialists.)
8.2.4 The following guidance describes means of compliance for electronic displays:
8.2.4.1 System Descriptions. This may include system architecture, description of the layout and general arrangement of the flight deck, description of the intended function, flightcrew interfaces, system interfaces, functionality, operational modes, mode transitions, and characteristics (for example, dynamics of the display system), and applicable requirements addressed by this description. Layout drawings and/or engineering drawings may show the geometric arrangement of hardware or display graphics.
Drawings typically are used in cases where showing compliance to the regulations can easily be reduced to simple geometry, arrangement, or the presence of a given feature on the drawing. The following questions may be used to evaluate whether the description of intended function is sufficiently specific and detailed:
8.2.4.1.1 Does each system, feature, and function have a stated intended function?
8.2.4.1.2 What assessments, decisions, or actions are the flightcrew members intended to make based on the display system?
8-1
8.2.4.1.3 What other information is assumed to be used in combination with the display system?
8.2.4.1.4 What is the assumed operational environment in which the equipment will be used? For example, the pilots’ tasks and operations within the flight deck, phase of flight, and flight procedures.
8.2.4.2 Statement of Similarity. This is a substantiation to demonstrate compliance by a comparison to a previously approved display (system or function). The comparison details the physical, logical, and functional and operational similarities of the two systems. Substantiation data from previous installations should be provided for the comparison. This method of compliance should be used with care because the flight deck should be evaluated as a whole, rather than merely as a set of individual functions or systems. For example, display functions that have been previously approved on different programs may be incompatible when applied to another flight deck. Also, changing one feature in a flight deck may necessitate corresponding changes in other features, in order to maintain consistency and prevent confusion (for example, use of color).
8.2.4.3 Calculation and Engineering Analyses. These include assumptions of relevant parameters and contexts, such as the operational environment, pilot population, and pilot training. Examples of calculations and engineering analyses include human performance modeling of optical detections, task times, and control forces. For analyses that are not based on advisory material or accepted industry standards, validation of calculations and engineering analyses using direct participant interaction with the display should be considered.
8.2.4.4 Evaluation. This is an assessment of the design conducted by the applicant, who then provides a report of the results to the FAA.
Evaluations typically use a display design model that is more representative of an actual system than drawings. Evaluations have two defining characteristics that distinguish them from tests: (1) the representation of the display design does not necessarily conform to the final documentation, and (2) the FAA may or may not be present.
Evaluations may contribute to a finding of compliance, but they generally do not constitute a finding of compliance by themselves.
8.2.4.4.1 Evaluations may begin early in the certification program. They may involve static assessments of the basic design and layout of the display, part-task evaluations and/or, full task evaluations in an operationally representative environment (environment may be simulated). A wide variety of development tools may be used for evaluations, from mockups to full installation representations of the actual product or flight deck.
8-2
8.2.4.4.2 In cases where human subjects (typically pilots) are used to gather data (subjective or objective), the applicant should fully document the process used to select subjects, the subjects’ experience, the type of data collected, and the method(s) used to collect the data. The resulting information should be provided to the FAA as early as possible to obtain agreement between the applicant and the FAA on the extent to which the evaluations are valid and relevant for certification credit. Additionally, credit will depend on the extent to which the equipment and facilities actually represent the flight deck configuration and realism of the flightcrew tasks.
8.2.4.5 Test. This means of compliance is conducted in a manner very similar to evaluations (see above), but is performed on conformed systems (or conformed items relevant to the test), in accordance with an approved test plan, with either the FAA or its designated representative present. A test can be conducted on a test bench, in a simulator, and/or on the actual airplane, and is often more formal, structured, and rigorous than an evaluation.
8.2.4.5.1 Bench or simulator tests that are conducted to show compliance should be performed in an environment that adequately represents the airplane environment, for the purpose of those tests.
8.2.4.5.2 Flight tests should be used to validate and verify data collected from other means of compliance such as analyses, evaluations, and simulations.
According to § 25.1523, during the certification process, the flightcrew workload assessments and failure classification validations should be addressed in a flight simulator or an actual airplane, although the assessments may be supported by appropriate analyses (see AC 25.1523-1, Minimum Flightcrew, for a description of the types of analyses).
8-3