operations the source of the displayed navigation information and the active navigation mode should be available on the primary flight display or immediately adjacent to the primary flight display.
6.5.2.5 The selected source should be annunciated if multiple or different types of navigation sources (flight management system, instrument landing system, global navigation satellite system (GNSS) landing system, etc.) can be selected (manually or automatically).
6.5.2.6 An alert should be given when the information presented to the flightcrew is no longer meeting the required integrity level, in particular when there is a single sensor or loss of independence.
6-11
CHAPTER 7. ELECTRONIC DISPLAY SYSTEM CONTROL DEVICES
7.1 General.
Each electronic display system control device has characteristics unique to its operation that need to be considered when designing the functions the display system controls, and the redundancy provided during failure modes. Despite the amount of redundancy that may be available to achieve a given task, the flight deck should still present a consistent user interface scheme for the primary displays and a compatible, if not consistent, user interface scheme for auxiliary displays throughout the flight deck.
7.2 Multi-Function Control Labels.
Multi-function controls should be labeled such that the pilot is able to—
7.2.1 Rapidly, accurately, and consistently identify and select all functions of the control device;
7.2.2 Quickly and reliably identify what item on the display is “active” as a result of cursor positioning, as well as what function will be performed if the item is selected using the selector buttons and/or changed using the multi-function control; and
7.2.3 Determine quickly and accurately the function of the control without extensive training or experience.
7.3 Multi-Function Controls.
The installation guidelines below apply to control input devices that are dedicated to operating a specific function (for example, control knobs and wheels), as well as new control features (for example, a cursor control device (CCD)).
7.3.1 “Hard” Controls.
7.3.1.1 Mechanical controls used to set numeric data on a display should have adequate friction or tactile detents to allow a flightcrew without extensive training or experience to set values (for example, setting an out-of-view heading bug to a displayed number) to a required level of accuracy within a time appropriate to the task.
7.3.1.2 The input for display response gain to control should be optimized for gross motion as well as fine positioning tasks without overshoots. In accordance with § 25.777(b), the direction of movement of the cockpit controls must meet the requirements of § 25.779. Wherever practicable, the sense of motion involved in the operation of other controls must correspond to the sense of the effect of the operation on the airplane or on the part operated. Controls of a variable nature using a rotary motion must 7-1
move clockwise from the off position, through an increasing range, to the full on position.
7.3.2 “Soft” Controls.
7.3.2.1 There are two interactive types of soft control displays, one type affects airplane systems and the other type does not. Displays that use a graphical user interface (GUI) permit information within different display areas to be directly manipulated by the flightcrew (for example, changing range, scrolling crew alert messages or electronic checklists, configuring windows, or layering information). This level of display interaction affects only the presentation of display information and has a minimal effect on flight deck operations. The other level of display interaction provides a GUI to control airplane system operations (for example, utility controls on displays traditionally found in overhead panel functions, flight management system (FMS) operations, and graphical flight planning).
7.3.2.2 The design of display systems that will be used as soft controls is dependent on the functions they control. Consider the following guidelines when designing these display systems:
7.3.2.2.1 The GUI and control device should be compatible with the airplane system they will control. The hardware and software design assurance levels and tests for the GUI and control device should be commensurate with the level of criticality of the airplane system they will control.
7.3.2.2.2 Redundant methods of controlling the system may lessen the criticality required of the display control. Particular attention should be paid to the interdependence of display controls (that is, vulnerability to common mode failures), and to the combined effects of the loss of control of multiple systems and functions.
7.3.2.2.3 The applicant should demonstrate that the failure of any display control does not unacceptably disrupt operation of the airplane (that is the allocation of flightcrew member tasks) in normal, non-normal, and emergency conditions.
7.3.2.2.4 To show compliance with §§ 25.777(a) and 25.1523, the applicant should show that the flightcrew can conveniently access required and backup control functions in all expected flight scenarios, without impairing airplane control, flightcrew task performance, and flightcrew resource management.
7.3.2.2.5 Control system latency and gains can be important in the acceptability of a display control. Usability testing should therefore accurately replicate the latency and control gains that will be present in the actual airplane.
7-2
7.3.2.2.6 The final display response to control input should be fast enough to prevent undue concentration being required when the flightcrew sets values or display parameters (§ 25.771(a)). The initial indication of a response to a soft control input should take no longer than 250 milliseconds. If the initial response to a control input is not the same as the final expected response, a means of indicating the status of the pilot input should be made available to the flightcrew.
7.3.2.2.7 To show compliance with § 25.771(e), the applicant should show by test and/or demonstration in representative motion environment(s) (for example, turbulence) that the display control is acceptable for controlling all functions that the flightcrew may access during these conditions.
7.4 Cursor Control Devices.
When the input device controls cursor activity on a display, it is called a cursor control device (CCD). The CCDs are used to position display cursors on selectable areas of the displays. These selectable areas are “soft controls” intended to perform the same functions as mechanical switches or other controls on conventional control panels.
Typically, CCDs control several functions and are the means for directly selecting display elements. When designing CCDs, in addition to the guidance provided in paragraphs 7.2, 7.3, and 7.5 of this chapter, consider the guidance in the following paragraphs, which address design considerations unique to CCDs. Additional guidance on cursor control is contained in AC 20-170, Integrated Modular Avionics Development, Verification, and Approval Using RTCA/DO-297 and Technical Standard Order-C153, October 28, 2010.
7.4.1 The CCD design and installation should enable the flightcrew to operate the CCD without exceptional skill during foreseeable flight conditions, both normal and adverse (for example, turbulence and vibrations). Certain selection techniques, such as double or triple clicks, should be avoided.
7.4.2 The safety assessment of the CCD should address reversion to alternate means of control following loss of the CCD. This includes an assessment on the impact of the failure on flightcrew workload.
7.4.3 The functionality of the CCD should be demonstrated with respect to the flightcrew interface considerations outlined below:
7.4.3.1 The ability of the flightcrew to share tasks, following CCD failure, with appropriate workload and efficiency.
7.4.3.2 The ability of the flightcrew to use the CCD with accuracy and speed of selection required of the related tasks, under foreseeable operating conditions (for example, turbulence, engine imbalance, and vibration).
7-3
7.4.3.3 Satisfactory flightcrew task performance and CCD functionality, whether the CCD is operated with a dominant or non-dominant hand.
7.4.3.4 Hand stability support position (for example, wrist rest).
7.4.3.5 Ease of recovery from incorrect use.
7.5 Cursor Displays.
7.5.1 The cursor symbol should be restricted from areas of primary flight information or where occlusion of display information by a cursor could result in misinterpretation by the flightcrew. If a cursor symbol is allowed to enter a critical display information field, it should be demonstrated that the cursor symbol’s presence will not cause interference during any phase of flight or failure condition.
7.5.2 Because the cursor is a directly controllable element on the display, it has unique characteristics. Consider the following when designing a cursor display:
7.5.2.1 Presentation of the cursor should be clear, unambiguous, and easily detectable in all foreseeable operating conditions.
7.5.2.2 The failure mode of an uncontrollable and distracting display of the cursor should be evaluated.
7.5.2.3 Because in most applications more than one flightcrew member will be using one cursor, the applicant should establish an acceptable method for handling “dueling cursors” that is compatible with the overall flight deck philosophy (for example, “last person on display wins”). Acceptable methods should also be established for handling other possible scenarios, including the use of two cursors by two pilots.
7.5.2.4 If more than one cursor is used on a display system, a means should be provided to distinguish between the cursors.
7.5.2.5 If a cursor is allowed to fade from a display, some means should be employed for the flightcrew to quickly locate it on the display system.
Common examples of this are “blooming” or “growing” the cursor to attract the flightcrew’s attention.
7-4
CHAPTER 8. SHOWING COMPLIANCE FOR APPROVAL OF
ELECTRONIC DISPLAY SYSTEMS
8.1 General Compliance Considerations (Test and Compliance).
This chapter provides guidance for demonstrating compliance to the regulations for the approval of electronic flight deck displays. Since so much of display system compliance is dependent on subjective evaluations, this chapter focuses on providing specific guidance that facilitates these types of evaluations.
8.2 Means of Compliance.
8.2.1 The acceptable means of compliance for a display system depends on many factors and is determined on a case-by-case basis. For example, when the proposed display system technology is mature and well understood, means such as analogical reasoning documented as a “Statement of Similarity” may be sufficient. However, more rigorous and structured methods, such as analysis and flight test, are appropriate if the proposed display system design is deemed novel, complex, or highly integrated.
8.2.2 The acceptable means of compliance depends on other factors as well. These include the subjectivity of the acceptance criteria and the evaluation facilities of the applicant (for example, high-fidelity flight simulators) and the manner in which these facilities are used (for example, data collection).
8.2.3 When subjective criteria are used to satisfy a means of compliance, the subjective data should be collected from multiple people (including pilots, engineers, and human factor specialists.)
8.2.4 The following guidance describes means of compliance for electronic displays:
8.2.4.1 System Descriptions. This may include system architecture, description of the layout and general arrangement of the flight deck, description of the intended function, flightcrew interfaces, system interfaces, functionality, operational modes, mode transitions, and characteristics (for example, dynamics of the display system), and applicable requirements addressed by this description. Layout drawings and/or engineering drawings may show the geometric arrangement of hardware or display graphics.
Drawings typically are used in cases where showing compliance to the regulations can easily be reduced to simple geometry, arrangement, or the presence of a given feature on the drawing. The following questions may be used to evaluate whether the description of intended function is sufficiently specific and detailed:
8.2.4.1.1 Does each system, feature, and function have a stated intended function?
8.2.4.1.2 What assessments, decisions, or actions are the flightcrew members intended to make based on the display system?
8-1
8.2.4.1.3 What other information is assumed to be used in combination with the display system?
8.2.4.1.4 What is the assumed operational environment in which the equipment will be used? For example, the pilots’ tasks and operations within the flight deck, phase of flight, and flight procedures.
8.2.4.2 Statement of Similarity. This is a substantiation to demonstrate compliance by a comparison to a previously approved display (system or function). The comparison details the physical, logical, and functional and operational similarities of the two systems. Substantiation data from previous installations should be provided for the comparison. This method of compliance should be used with care because the flight deck should be evaluated as a whole, rather than merely as a set of individual functions or systems. For example, display functions that have been previously approved on different programs may be incompatible when applied to another flight deck. Also, changing one feature in a flight deck may necessitate corresponding changes in other features, in order to maintain consistency and prevent confusion (for example, use of color).
8.2.4.3 Calculation and Engineering Analyses. These include assumptions of relevant parameters and contexts, such as the operational environment, pilot population, and pilot training. Examples of calculations and engineering analyses include human performance modeling of optical detections, task times, and control forces. For analyses that are not based on advisory material or accepted industry standards, validation of calculations and engineering analyses using direct participant interaction with the display should be considered.
8.2.4.4 Evaluation. This is an assessment of the design conducted by the applicant, who then provides a report of the results to the FAA.
Evaluations typically use a display design model that is more representative of an actual system than drawings. Evaluations have two defining characteristics that distinguish them from tests: (1) the representation of the display design does not necessarily conform to the final documentation, and (2) the FAA may or may not be present.
Evaluations may contribute to a finding of compliance, but they generally do not constitute a finding of compliance by themselves.
8.2.4.4.1 Evaluations may begin early in the certification program. They may involve static assessments of the basic design and layout of the display, part-task evaluations and/or, full task evaluations in an operationally representative environment (environment may be simulated). A wide variety of development tools may be used for evaluations, from mockups to full installation representations of the actual product or flight deck.
8-2
8.2.4.4.2 In cases where human subjects (typically pilots) are used to gather data (subjective or objective), the applicant should fully document the process used to select subjects, the subjects’ experience, the type of data collected, and the method(s) used to collect the data. The resulting information should be provided to the FAA as early as possible to obtain agreement between the applicant and the FAA on the extent to which the evaluations are valid and relevant for certification credit. Additionally, credit will depend on the extent to which the equipment and facilities actually represent the flight deck configuration and realism of the flightcrew tasks.
8.2.4.5 Test. This means of compliance is conducted in a manner very similar to evaluations (see above), but is performed on conformed systems (or conformed items relevant to the test), in accordance with an approved test plan, with either the FAA or its designated representative present. A test can be conducted on a test bench, in a simulator, and/or on the actual airplane, and is often more formal, structured, and rigorous than an evaluation.
8.2.4.5.1 Bench or simulator tests that are conducted to show compliance should be performed in an environment that adequately represents the airplane environment, for the purpose of those tests.
8.2.4.5.2 Flight tests should be used to validate and verify data collected from other means of compliance such as analyses, evaluations, and simulations.
According to § 25.1523, during the certification process, the flightcrew workload assessments and failure classification validations should be addressed in a flight simulator or an actual airplane, although the assessments may be supported by appropriate analyses (see AC 25.1523-1, Minimum Flightcrew, for a description of the types of analyses).
8-3
CHAPTER 9. CONTINUED AIRWORTHINESS AND MAINTENANCE
9.1 Continued Airworthiness and Maintenance.
The following paragraphs provide guidance for preparing instructions for the continued airworthiness of the display system and its components to show compliance with §§ 25.1309 and 25.1529 (including appendix H to part 25), which require preparing Instructions for Continued Airworthiness. The following guidance is not a definitive list, and other maintenance tasks may be developed as a result of the safety assessment, design reviews, manufacturer’s recommendations, and Maintenance Steering Group 3 (MSG-3) analyses that are conducted.
9.2 General.
Information on preparing the Instructions for Continued Airworthiness can be found in appendix H to part 25. In addition to those instructions, maintenance procedures should be considered for the following:
9.2.1 Reversionary switches not used in normal operation. These switches should be checked during routine maintenance because, if a switch failure is not identified until the airplane is in flight, the switching or backup display/sensor may not be available when required. These failures may be addressed by a system safety assessment and should be addressed in the airplane’s maintenance program (for example, MSG-3).
9.2.2 Display cooling fans and filters integral with cooling ducting.
9.3 Design for Maintainability.
The display system should be designed to minimize maintenance error and maximize maintainability.
9.3.1 The display mounting, connectors, and labeling should allow quick, easy, safe, and correct access for identification, removal, and replacement. Means should be provided (for example, using physically coded connectors) to prevent inappropriate connections of system elements.
9.3.2 If the system has the capability of providing information on system faults (for example, diagnostics) to maintenance personnel, it should be displayed in text instead of coded information.
9.3.3 If the flightcrew needs to provide information to the maintenance personnel (for example, overheat warning), problems associated with the display system should be communicated to the maintenance personnel as appropriate, relative to the task and criticality of the information displayed.
9.3.4 The display components should be designed so they can withstand cleaning without internal damage, scratching, and/or crazing (cracking).
9-1
9.4 Maintenance of Display Characteristics.
9.4.1 Maintenance procedures may be used to ensure that the display characteristics remain within the levels presented and accepted at certification.
9.4.2 Experience has shown that display quality may degrade with time and become difficult to use. Examples include lower brightness/contrast, distortion or discoloration of the screen (blooming effects), and areas of the screen that may not display information properly.
9.4.3 Test methods and criteria may be established to determine if the display system remains within acceptable minimum levels. Display system manufacturers may alternatively provide “end of life” specifications for the displays that could be adopted by the airplane manufacturer.
9-2
Appendix A APPENDIX A. PRIMARY FLIGHT INFORMATION A.1 General.
This appendix provides additional guidance for displaying primary flight information.
Displaying primary flight information is required by §§ 25.1303(b) and 25.1333(b). The requirements for arranging primary flight information are specified in § 25.1321(b).
A.2 Attitude.
A.2.1 Pitch attitude display scaling should be such that during normal maneuvers (for example, approach or climb at high thrust-to-weight ratios) the horizon remains visible in the display with at least 5° pitch margin available.
A.2.2 An accurate, easy, quick-glance interpretation of attitude should be possible for all unusual attitude situations and other “non-normal” maneuvers sufficient to permit the pilot to recognize the unusual attitude and initiate an appropriate recovery within one second. Information to perform effective manual recovery from unusual attitudes using chevrons, pointers, and/or permanent ground-sky horizon on all attitude indications is recommended.
A.2.3 Both fixed airplane reference and fixed earth reference bank pointers (“ground and/or sky” pointers) are acceptable as a reference point for primary attitude information. A mix of these types in the same flight deck is not recommended.
A.2.4 There should be a means to determine the margin to stall and to display that information when necessary. For example, a pitch limit indication is acceptable.
A.2.5 There should be a means to identify an excessive bank angle condition prior to stall buffet.
A.2.6 Sideslip should be clearly indicated to the flightcrew (for example, a split trapezoid on the attitude indicator) and an indication of excessive sideslip should be provided.
A.3 Continued Function of Primary Flight Information (Including Standby) in Conditions of Unusual Attitudes or in Rapid Maneuvers.
A.3.1 Primary flight information must continue to be displayed in conditions of unusual attitudes or in rapid maneuvers (§ 25.1301). The pilot must also be able to rely on primary or standby instrument information for recovery in all attitudes and at the highest pitch, roll, and yaw rates that may be encountered (§ 25.1301).
A.3.2 In showing compliance with the requirements of §§ 25.1301(d), 25.1309(a), 25.1309(b),
25.1309(c), and 25.1309(d), the analysis and test program must consider the following conditions that might occur due to pilot action, system failures, or external events— A-1
Appendix A
• Abnormal attitude (including the airplane becoming inverted),
• Excursion of any other flight parameter outside protected flight boundaries, or
• Flight conditions that may result in higher than normal pitch, roll, or yaw rates.
A.3.3 For each of the conditions identified above, primary flight displays and standby indicators must continue to provide useable attitude, altitude, airspeed, and heading information and any other information that the pilot may require to recognize and execute recovery from the unusual attitude and/or arrest the higher than normal pitch, roll, or yaw rates (§ 25.1301).
A.4 Airspeed and Altitude.
A.4.1 Airspeed and altitude displays should be able to convey to the flightcrew a quick-glance sense of the present speed or altitude. Conventional round-dial moving pointer displays inherently give some of this sense that may be difficult to duplicate on moving scales.
Scale length is one attribute related to this quick-glance capability. The minimum visible airspeed scale length found acceptable for moving scales has been 80 knots.
Since this minimum is dependent on other scale attributes and airplane operational speed range, variations from this should be verified for acceptability. A displayed altitude that is geometrically derived should be easily discernible from the primary altitude information, which is barometrically derived altitude. To ensure the pilot can easily discern the two, the label “GSL” should be used to label geometric height above mean sea level. See paragraph F.5.4.4 of appendix F of this AC for airspeed considerations specific to a head-up display (HUD).
A.4.2 Airspeed reference marks (bugs) on conventional airspeed indicators perform a useful function by providing a visual reminder of important airspeed parameters. Including bugs on electronic airspeed displays is encouraged. Computed airspeed/angle-of-attack bugs such as Vstall warning, V1, VR, V2, flap limit speeds, etc., displayed on the airspeed scale should be evaluated for accuracy. The design of an airspeed indicator should include the capability to incorporate a reference mark that will reflect the current target airspeed of the flight guidance system. This has been required in the past for some systems that have complex speed selection algorithms, in order to give the flightcrew adequate information for system monitoring as required by § 25.1309(c).
A.4.3 Scale units marking for air data displays incorporated into primary flight displays are not required (“knots,” “airspeed” for airspeed, “feet,” “altitude” for altimeters) as long as the content of the readout remains clear. For altimeters with the capability to display both English and Metric units, the scale and primary present value readout should remain scaled in English units with no units marking required. The Metric display should consist of a separate present value readout that does include units marking.
A.4.4 Airspeed scale markings such as stall warning, maximum operation speed/maximum operating Mach number, or flap limits, should be displayed to provide the flightcrew a quick-glance sense of speed relative to key targets or limits. The markings should be A-2