13 CHAPTER 2.
ELECTRONIC DISPLAY SYSTEM OVERVIEW
11. General. The following paragraphs provide guidance that applies to the overall electronic display system. This chapter, together with Chapters 3 through 7 of this AC, provides compliance objectives and design guidance. Chapter 8 provides general guidance on how to show compliance for approval of electronic display systems. The material in Chapters 2 through 9 and Appendices 1 and 2 of this AC constitutes an overall method of compliance for the approval of an electronic display system.
a. Design Philosophy. The applicant should establish, document, and follow a design philosophy for the display system that supports the intended functions (§ 25.1301). The documented design philosophy may be included as part of a system description, certification plan, or other document that is submitted to the FAA during a certification project. The design philosophy should include a high level description of:
(1) General philosophy of information presentation – for example, is a “quiet, dark” flight deck philosophy used or is some other approach used?
(2) Color philosophy on the electronic displays – the meaning and intended interpretation of different colors – for example, does magenta always represent a constraint?
(3) Information management philosophy – for example, when should the pilot take an action to retrieve information or is it brought up automatically? What is the intended interpretation of the location of the information?
(4) Interactivity philosophy - for example, when and why is pilot confirmation of actions requested? When is feedback provided?
(5) Redundancy management philosophy – for example, how are single and multiple display failures accommodated? How are power supply and data bus failures accommodated?
b. Human Performance Considerations. The applicant should establish and document the following human performance elements when developing a display system:
• Flightcrew workload,
• Flightcrew training time to become sufficiently familiar with using the display, and
• The potential for flightcrew error.
A high workload or excessive training time may indicate a display design that is difficult to use, requires excessive concentration, or may be prone to flightcrew errors. Compliance considerations are included in Chapter 8 of this AC.
c. Addressing Intended Function in the Certification Plan. The certification plan should identify the appropriate part 25 rules. An important part of the certification plan will be the system description(s) and all intended functions, including attitude, altitude, airspeed, engine parameters, horizontal situation display, etc. To demonstrate compliance with § 25.1301(a), an applicant must show that the design is appropriate for its intended function.
The applicant’s description of intended function needs to be sufficiently specific and detailed for the FAA to be able to evaluate that the system is appropriate to its intended function. The ARAC recommendations for adding a new § 25.1302 and the guidance material associated with those recommendations, provide additional information on intended function requirements and guidance. General and/or ambiguous intended function descriptions are not acceptable (for example, a function described only as “situation awareness”). Some displays may be intended to be used for situation awareness, but that term needs to be clarified or qualified to explain what type of specific situation awareness will be provided. More detailed descriptions may be warranted for designs that are new, novel, highly integrated, or complex. Many modern displays have multiple functions and applicants should describe each intended function. A system description is one place to document the intended function(s).
d. Display systems and display components that are not intended for use by the flightcrew (such as maintenance displays) should not interfere with the flying duties of the flightcrew.
12. – 15. [RESERVED]
CHAPTER 3.
ELECTRONIC DISPLAY HARDWARE
16. Display Hardware Characteristics. The following paragraphs provide general guidance and a means of compliance for electronic display hardware with respect to its basic visual, installation, and power bus transient handling characteristics. A more detailed set of display hardware characteristics can be found in the following SAE International (formerly the Society of Automotive Engineers) documents:
• For electronic displays – SAE Aerospace Standards (AS) 8034A, Minimum Performance Standard for Airborne Multipurpose Electronic Displays.
• For head up displays - SAE AS8055, Minimum Performance Standard for Airborne Head Up Display (HUD).
• For liquid crystal displays (LCDs) – SAE Aerospace Recommended Practice (ARP) 4256A, Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft.
NOTE 1: For LCDs, the quantitative criterion in SAE ARP 4256A, paragraph 4.2.6., equation 5, is not considered a reliable predictor of acceptable specular reflectivity characteristics. Accordingly, this aspect of LCD performance should be specifically assessed via flightcrew evaluation to establish that there are not internal or external reflections that can result in flightcrew distraction or erroneous interpretation of displayed information.
NOTE 2: With regard to the criteria for malfunction indication in SAE ARP 4256A, paragraph 3.4, the FAA has determined that showing the fonts and symbols to be tolerant to the loss of a single column, line, or element is an acceptable alternative to providing a malfunction indication. Proposed designs that do not use fonts and symbols that are tolerant to these faults are acceptable if they meet the criteria in SAE ARP 4256A.
NOTE 3: The applicant should notify the FAA certification engineer if any visual display characteristics do not meet the guidelines in the applicable SAE documents.
NOTE 4: The most recent revision of the referenced SAE documents should be considered. If there is a conflict between the guidance in an SAE document and AC 25-11A, follow the guidance in AC 25-11A.
a. Visual Display Characteristics. The visual display characteristics of a flight deck display are directly linked to their optical characteristics. Display defects (for example, element defects or stroke tails) should not impair readability of the display or create
16 erroneous interpretation. In addition to the information elements and features identified in Chapter 5 of this AC, and the visual characteristics in SAE ARP 4256A, SAE AS 8034A, and SAE AS 8055, described above, the display should meet the criteria for the following characteristics. These characteristics are independent of the proposed display technology.
(1) Physical Display Size. A display should be large enough to present information in a form that is usable (for example, readable or identifiable) to the flightcrew from the flightcrew station (see related regulation) in all foreseeable conditions, relative to the operational and lighting environment and in accordance with its intended function(s).
(2) Resolution and Line Width. The resolution and minimum line width should be sufficient to support all the displayed images such that the displayed information is visible and understandable without misinterpretation from the flightcrew station (see related regulation) in all foreseeable conditions, relative to the operational and lighting environment.
(3) Luminance. Information should be readable over a wide range of ambient illumination under all foreseeable conditions relative to the operating environment, including but not limited to:
• Direct sunlight on the display,
• Sunlight through a front window illuminating white shirts (reflections),
• Sun above the forward horizon and above a cloud deck in a flightcrew member’s eyes, and
• Night and/or dark environment.
(a) For low ambient conditions, the display should be dimmable to levels allowing for the flightcrew’s adaptation to the dark, such that outside vision and an acceptable presentation are maintained.
(b) Automatic luminance adjustment systems can be employed to decrease pilot workload and increase display life. Operation of these systems should be satisfactory over a wide range of ambient light conditions, including the extreme cases of a forward low sun and a quartering rearward sun shining directly on the display.
1 Some manual adjustment should be retained to provide for normal and nonnormal operating differences so that the luminance variation is not distracting and does not interfere with the flightcrew’s ability to perform their tasks.
17 2 Displays or layers of displays with uniformly filled areas conveying information such as weather radar imagery should be independently adjustable in luminance from overlaid symbology. The range of luminance control should allow detection of color differences between adjacent small filled areas no larger than 5 milliradians in principal dimension; while at this setting, overlying map symbology, if present, should be discernible.
(c) Display luminance variation within the entire flight deck should be minimized so that displayed symbols, lines, or characters of equal luminance remain uniform under any luminance setting and under all foreseeable operating conditions.
(4) Contrast Ratio.
(a) The display’s contrast ratio should be sufficient to ensure that the information is discernable under the whole ambient illumination range from the flightcrew station (see related regulation) under all foreseeable conditions relative to the operating environment.
(b) The contrast between all symbols, characters, lines, and their associated backgrounds should be sufficient to preclude confusion or ambiguity of any necessary information.
(5) Chromaticity.
(a) The display chromaticity differences, in conjunction with luminance differences, should be sufficient to allow graphic symbols to be discriminated from each other, from their backgrounds (for example, external scene or image background) and background shaded areas, from the flightcrew station (see related regulation), in all foreseeable conditions relative to the lighting environment.
Raster or video fields (for example, non-vector graphics such as weather radar) should allow the image to be discriminated from overlaid symbols, and should allow the desired graphic symbols to be displayed. See SAE AS 8034A, sections
4.3.3 and 4.3.4, for additional guidance.
(b) The display should provide chromaticity stability over the foreseeable conditions relative to the range of operating temperatures, viewing envelope, image dynamics, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.
(6) Gray Scale.
(a) The number of shades of gray and the difference between shades of gray that the display can provide should be adequate for all image content and its use, and should accommodate all viewing conditions.
(b) The display should provide sufficient gray scale stability over the foreseeable range of operating temperatures, viewing envelope, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.
(7) Display Response. The dynamic response of the display should be sufficient to provide discernibility and readability of the displayed information without presenting misleading, distracting, or confusing information. The response time should be sufficient to ensure dynamic stability of colors, line widths, gray scale, and relative positioning of symbols. Undesirable display artifacts and characteristics, such as smearing of moving images and loss of luminance, should be minimized so that information is still readable and identifiable under all foreseeable conditions, not distracting, and does not lead to misinterpretation of data.
(8) Display Refresh Rate. The display refresh rate should be sufficient to prevent flicker effects that result in misleading information or difficulty in reading or interpreting information. The display refresh rate should be sufficient to preclude the appearance of unacceptable flicker.
(9) Display Update Rate. The display update rate should be sufficient to preclude objectionable motion artifacts that could be misleading or distracting.
(10) Display Defects. Display defects, such as element defects and stroke tails, resulting from hardware and graphical imaging causes should not impair readability of the displays or induce or cause erroneous interpretation. This is covered in more detail in SAE ARP 4256A, SAE AS 8034A, and SAE AS 8055.
(11) Reflections. Each pilot compartment must be free of glare and reflections that could interfere with the normal duties of a minimum flightcrew. This must be shown in day and night flight tests under non-precipitation conditions (§ 25.773(a)(2)). The criteria and the basic workload functions and factors for a minimum flightcrew are described in Appendix D to part 25, § 25.1523.
(12) Flight Deck Viewing Envelope. The size of the viewing envelope should provide visibility of the flight deck displays over the flightcrew’s normal range of head motion, and support cross-flight deck viewing if necessary; for example, when it is required that the captain be able to view and use the first officer’s primary flight information. See paragraph 16b3, below, for installation guidance.
b. Installation.
(1) Flight deck display equipment and installation designs should be compatible with the overall flight deck design characteristics (such as flight deck size and shape, flightcrew member position, position of windows, external luminance, etc.) as well as
19 the airplane environment (such as temperature, altitude, electromagnetic interference, and vibration).
(2) RTCA DO-160E, Environmental Conditions and Test Procedures for Airborne Equipment, and European Organization for Civil Aviation Electronics (EUROCAE) ED-14E, Environmental Conditions and Test Procedures for Airborne Equipment, provide information that may be used for an acceptable means of qualifying display equipment for use in the airplane environment.
(3) The display unit must be located in the flight deck such that flight, navigation, and powerplant information for use by any pilot is plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path (§ 25.1321(a)). The primary flight information on the primary display should not be visually obstructed and should remain prominent.
(4) The installation of the display equipment must not adversely affect its readability and the external scene visibility of the flightcrew (see related regulation) under all foreseeable conditions relative to the operating and lighting environment (§25.773
(a)(1)).
(5) The installation of the display equipment must not cause glare or reflection, either on the displays or on the flight deck windows, that could interfere with the normal duties of the minimum flightcrew (§ 25.773 (a)(2)) under all foreseeable conditions.
(6) If the display system design is dependent on cross-flight deck viewing for its use, the installation should take into account the viewing angle limitations of the display units, the size of the displayed information, and the distance of the display from each flightcrew member.
(7) When a display is used to align or overlay symbols with real-world external data (for example, HUD symbols), the display should be installed such that positioning accuracy of these symbols is maintained during all phases of flight. SAE ARP 5288, Transport Category Airplane Head Up Display (HUD) Systems, provides additional details regarding the symbol positioning accuracy for conformal symbology on a HUD.
(8) The display system components should not cause physical harm to the flightcrew under foreseeable conditions relative to the operating environment (for example, turbulence or emergency egress).
(9) The installed display must not visually obstruct other controls and instruments or prevent those controls and instruments from performing their intended function (§ 25.1301).
(10) The display system must not be adversely susceptible to electromagnetic interference from other airplane systems (§ 25.1431) under all foreseeable conditions.
(11) The display components should be installed in such a way that they retain mechanical integrity (secured in position) for all foreseeable conditions relative to the flight environment.
(12) Liquid spill on or breakage of a display system component in the flightdeck should not result in a hazard.
c. Power Bus Transient. RTCA DO-160E and EUROCAE document ED-14E provide information that may be used for an acceptable means of qualifying display equipment such that the equipment performs its intended function when subjected to anomalous input power. SAE ARP 4256A, Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft, provides additional information for power transient recovery (specifically for the display unit).
(1) Flight deck displays and display systems should be insensitive to power transients caused by normal load switching operation of the airplane, in accordance with their intended function.
(2) The electronic attitude display should not be unusable or unstable for more than one second after electrical bus transients due to engine failure. Only displays on one side of the airplane should be affected by an engine failure. Recognizably valid pitch and roll data should be available within one second on the affected displays and any effects lasting beyond one second should not interfere with the ability to obtain quick glance valid attitude. For most airplanes an engine failure after takeoff will simultaneously create a roll acceleration, new pitch attitude requirements, and an electrical transient.
Attitude information is paramount; if there is an engine failure, transfer to standby attitude or transfer of control of the airplane to the other pilot cannot be reliably accomplished in a timely enough manner to prevent an unsafe condition. In testing this failure mode, experience has shown that switching the generator off at the control panel may not result in the longest electrical transient. One practical way to simulate this failure is with a fuel cut which will allow the generator output voltage and frequency to decrease until the bus control recognizes the failure. Other engine failure conditions may be more critical (such as sub-idle stalls) which cannot be reasonably evaluated during flight test. Analysis should identify these failure modes and show that the preceding criteria are met.
(3) Non-normal bus transients (for example, generator failure) should not initiate a power up initialization or cold start process.
(4) The display response to a short term power interrupt (<200 milliseconds) should be such that the intended function of the display is not adversely affected.
(5) Following in-flight long term power interrupts (>200 milliseconds), the display system should quickly return to operation in accordance with its intended function, and should continue to permit the safe control of the airplane in attitude, altitude, airspeed, and direction.
(6) The large electrical loads required to restart some engine types should not affect more than one pilot’s display during the start sequence.
17. – 20. [RESERVED]
CHAPTER 4.
SAFETY ASPECTS OF ELECTRONIC DISPLAY SYSTEMS
21. General. This chapter provides additional guidance and interpretative material for applying §§ 25.1309 and 25.1333(b) to the approval of display systems. Using electronic displays and integrated modular avionics allows designers to integrate systems to a much higher degree than was practical with previous flight deck components. Although operating the airplane may become easier as a result of the integration, evaluating the conditions in which the display system could fail and determining the severity of the resulting failure effects may become more complex. The evaluation of the failure conditions should identify the display function and include all causes that could affect that function’s display and display equipment. Section 25.1309 defines the basic safety requirements for the airworthiness approval of airplane systems. The tables in this chapter use the ARAC recommended text for revising the existing § 25.1309 hazard classifications and associated probabilities. The ARAC recommendations for revising the existing AC 25.1309-1A, System Design and Analysis, provide guidance that may be used to establish an acceptable means of compliance. Refer to Appendix 5 of this AC for references on where to find more information regarding the ARAC recommendations.
a. Identification of Failure Conditions. One of the initial steps in establishing compliance with § 25.1309 is identifying the failure conditions that are associated with a display or a display system. The following paragraphs provide material that may be useful in supporting this initial activity. The analysis of the failure condition should identify the impacted functionality, the effect on the airplane and/or its occupants, any considerations related to phase of flight, and identify any flight deck indication, flightcrew action, or other relevant mitigation means.
(1) The type of display system failure conditions will depend, to a large extent, on the architecture (Integrated Modular Avionics, Federated System, Non-Federated System, etc.), design philosophy, and implementation of the system. Types of failure conditions include:
• Loss of function (system or display).
• Failure of display controls – loss of function or malfunction such that controls perform in an inappropriate manner, including erroneous display control.
• Malfunction (system or display) that leads to:
o Partial loss of data, or
o Erroneous display of data that is either:
- Detected by the system (for example, flagged or comparator alert), and/or easily detectable by the flightcrew; or
- Difficult to detect by the flightcrew or not detectable and assumed to be correct (for example, “Misleading display of ….”).
(2) When a flight deck design includes primary and standby displays, consider failure conditions involving the failure of standby displays in combination with the failure of primary displays. The flightcrew may use standby instruments in two complementary roles following the failure of primary displays:
(a) Redundant display to cope with failure of main instruments, or
(b) Independent third source of information to resolve inconsistencies between primary instruments.
(3) When the display of erroneous information is caused by failure of other systems which interface with the display system, the effects of these failures may not be limited to the display system. Associated failure conditions may be dealt with at the airplane level or within the other systems’ safety assessment, as appropriate, in order to assess the cumulative effect.
b. Effects of Display Failure Conditions. The effects of display system failure conditions on safe operations are highly dependent on pilot skills, flight deck procedures, phase of flight, type of operations being conducted, and instrument or visual meteorological conditions.
(1) Based on previous airplane certification programs, paragraph 21e of this AC shows examples of safety objectives for certain failure conditions. These safety objectives do not preclude the need for a safety assessment of the actual effects of these failures, which may be more or less severe depending on the design. Therefore, during the § 25.1309 safety assessment process, the FAA will need to agree with the applicant’s hazard classifications for these failure conditions in order for the assessment to be considered valid.
(2) When assessing the effects that result from a display failure consider the following, accounting for phases of flight when relevant:
• Effects on the flightcrew’s ability to control the airplane in terms of attitude, speed, accelerations, and flight path, potentially resulting in:
o Controlled flight into terrain,
24 o Loss of control of the airplane during flight and/or during critical flight phases (approach, take-off, goaround, etc.), o Inadequate performance capability for phase of flight, including:
Loss of obstacle clearance capability, and Exceeding takeoff or landing field length.
o Exceeding the flight envelope, o Exceeding the structural integrity of the airplane, and o Causing or contributing to pilot induced oscillations.
• Effects on the flightcrew’s ability to control the engines, such as:
o Those effects resulting in shutting down a non-failed engine in response to the failure of a different engine, and o Undetected, significant thrust loss.
• Effects on the flightcrew’s management of the airplane systems.
• Effects on the flightcrew’s performance, workload and ability to cope with adverse operating conditions.
• Effects on situation awareness; for example, the specific effects must be identified, such as situation awareness related to navigation or system status.
• Effects on automation if the display is used as a controlling device.
(3) When the display system is used as a control device for other airplane systems, consider the cumulative effect of a display system failure on all of the controlled systems.
c. Mitigation of Failure Conditions.
(1) When determining mitigation means for a failure condition consider the following:
• Protection against common mode failures.
• Fault isolation and reconfiguration.