e. System Safety Guidelines.
(1) Experience from previous certification programs has shown that a single failure due to a loss or malfunction of the display system, a sensor, or some other dependent system, which causes the misleading display of primary flight information, may have negative safety effects. It is recommended that the display system design and architecture implement monitoring of the primary flight information to reduce the probability of displaying misleading information.
(2) Experience from previous certification programs has shown that the combined failure of both primary displays with the loss of the standby system can result in failure conditions with catastrophic effects.
(3) When an integrated standby display is used to provide a backup means of primary flight information, the safety analysis should substantiate that common cause failures have been adequately addressed in the design, including the design of software and complex hardware. In particular, the safety analysis should show that the independence between the primary instruments and the integrated standby instruments is not violated because the integrated standby display may interface with a large number of airplane components, including power supplies, pitot static ports, and other sensors.
(4) There should be a means to detect the loss or erroneous primary flight information, either as a result of a display system failure or the failure of an associated sensor. When loss or malfunction of primary flight information is detected, the means used to indicate the lost or erroneous information should ensure that the erroneous information will not be used by the flightcrew (for example, removal of the information from the display or placement of an “X” through the failed display).
(5) The means used to indicate the lost or erroneous information, when it is detected, should be independent of the failure mechanism. For example, the processor that originates the erroneous parameter should not be the same processor that annunciates or removes the erroneous parameter from the display. Common mode failures of identical processor types should be considered (for example, common mode failures may exist in a processor used to compute the display parameters and an identical processor used for monitoring and annunciating failures.)
(6) A catastrophic failure condition should not result from the failure of a single component, part, or element of a system. Failure containment should be provided by the system design to limit the propagation of the effects of any single failure and preclude catastrophic failure conditions. In addition, there should not be a common cause failure that could affect both the single component, part, or element and its failure containment provisions.
(7) For safety-critical display parameters, there should be a means to verify the correctness of sensor input data. Range, staleness, and validity checks should be used where possible.
(8) The latency period induced by the display system, particularly for alerts, should not be excessive and should take into account the criticality of the alert and the required crew response time to minimize propagation of the failure condition.
(9) For those systems that integrate windowing architecture into the display system, a means should be provided to control the information shown on the displays, such that the integrity of the display system as a whole will not be adversely impacted by anomalies in the functions being integrated. This means of controlling the display of information, called window manager in this AC, should be developed to the software assurance level at least as high as the highest integrity function of any window. For example, a window manager should be level “A” if the information displayed in any window is level “A” (see RTCA DO-178B). SAE ARP 4754, Certification Consideration for Highly-Integrated or Complex Aircraft Systems, provides a recommended practice for system development assurance.
(10) System Safety Assessment Guidelines. The complete set of failure conditions to be considered in the display system safety analysis and the associated safety objective are established during the system safety assessment, and agreed upon by the applicant and the approving civil airworthiness authority. The safety assessment should consider the full set of display system intended functions as well as display system architecture and design philosophy (for example, failure modes, failure detection and annunciation, redundancy management, system and component independence and isolation). The system safety analysis is required by § 25.1309, and indirectly by other regulations, including § 25.901, § 25.903, and § 25.1333.
(a) This AC adopts the ARAC recommendations for revising the current AC 25.1309-1A. This AC uses the terms “major” and “hazardous” to identify what AC 25.1309-1A refers to as a “major” failure condition. Also, for major and hazardous failure conditions identified as “Improbable” in AC 25.1309-1A and AC 25-11, this AC includes the ARAC recommended probabilities “Remote” and “Extremely Remote,” respectively.
(b) This AC also includes the ARAC recommended terms “catastrophic,” “failure,” “failure condition,” “hazardous failure condition,” and “minor failure condition.” ARAC recommended that these terms be included if the current AC 25.1309-1A is revised. Appendix 3 of this AC 25-11A includes the definitions of these terms.
(c) The following tables provide examples of failure conditions and associated hazard classifications and safety objectives common to numerous display systems
28 that are already certified. These tables are provided to support consistency in determining hazard classifications across multiple applicants, multiple certification offices, and multiple display system designs; however, these are only examples.
These examples do not replace the need for a system safety assessment and are not an exhaustive list of failure conditions. For these example failure conditions, additional functional capabilities or less operational mitigation may result in higher hazard classifications, while reduced functional capability or increase operational mitigation may result in lower hazard classifications.
1 Attitude (Pitch and Roll). The following table lists examples of safety objectives for attitude related failure conditions.
Table 3 Example Safety Objectives for Attitude Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of all attitude displays, including standby display Catastrophic Extremely Improbable Loss of all primary attitude displays Major – Hazardous(*) Remote - Extremely Remote (*) Display of misleading attitude information on both primary displays Catastrophic Extremely Improbable Display of misleading attitude information on one primary display
Hazardous Extremely Remote Display of misleading attitude information on the standby display Major Remote Display of misleading attitude information on one primary display combined with a standby failure (loss of attitude or incorrect attitude)
Catastrophic Extremely Improbable (**)
(*) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
(**) Consistent with the “Loss of all attitude display, including standby display” safety objective, since the flightcrew may not be able to identify the correct display.
Consideration will be given to the ability of the flightcrew to control the airplane after a
29 loss of attitude primary display on one side in some flight phases (for example, during takeoff).
2 Airspeed. The following table lists examples of safety objectives for airspeed related failure conditions.
Table 4 Example Safety Objectives for Airspeed Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of all airspeed displays, including standby display Catastrophic Extremely Improbable Loss of all primary airspeed displays Major – Hazardous(*) Remote - Extremely Remote(*) Display of misleading airspeed information on both primary displays, coupled with loss of stall warning or loss of over-speed warning Catastrophic Extremely Improbable Display of misleading airspeed information of the standby display (primary airspeed still available) Major Remote Display of misleading airspeed information on one primary display combined with a standby failure (loss of airspeed or incorrect airspeed)
Catastrophic Extremely Improbable (**)
(*) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
(**) Consistent with the “Loss of all airspeed display, including standby display” safety objective, since the flightcrew may not be able to separate out the correct display.
30 3 Barometric Altitude. The following table lists examples of safety objectives for barometric altitude related failure conditions.
Table 5 Example Safety Objectives for Barometric Altitude Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of all barometric altitude displays, including standby display Catastrophic Extremely Improbable Loss of all barometric altitude primary displays Major – Hazardous(*) Remote - Extremely Remote(*) Display of misleading barometric altitude information on both primary displays Catastrophic Extremely Improbable Display of misleading barometric altitude information on the standby display (primary barometric altitude still available) Major Remote Display of misleading barometric altitude information on one primary display combined with a standby failure (loss of altitude or incorrect altitude) Catastrophic Extremely Improbable (**)
(*) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
(**) Consistent with the “Loss of all barometric altitude display, including standby display” safety objective since the flightcrew may not be able to separate out the correct display. Consideration should be given that barometric setting function design is commensurate with the safety objectives identified for barometric altitude.
4 Heading. The following table lists examples of safety objectives for heading related failure conditions.
(aa) The standby heading may be provided by an independent integrated standby or the magnetic direction indicator.
(bb) The safety objectives listed below can be alleviated if it can be demonstrated that track information is available and correct.
Table 6 Example Safety Objectives for Heading Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of stabilized heading in the flight deck Major Remote Loss of all heading displays in the flight deck Catastrophic Extremely Improbable Display of misleading heading information on both pilots' primary displays Major – Hazardous(*) Remote - Extremely Remote(*) Display of misleading heading information on one primary display combined with a standby failure (loss of heading or incorrect heading)
Major – Hazardous (*) Remote – Extremely Remote(*)
(*) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
(**) This assumes the availability of an independent, non-stabilized heading required by § 25.1303 (a)(3).
32 5 Navigation and Communication (Excluding Heading, Airspeed, and Clock Data). The following table lists examples of safety objectives for navigation and communication related failure conditions.
Table 7 Example Safety Objectives for Certain Navigation and Communication Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of display of all navigation information Major(*) Remote(*) Non-restorable loss of display of all navigation information coupled with a total loss of communication functions Catastrophic Extremely Improbable Display of misleading navigation information simultaneously to both pilots Major – Hazardous Remote – Extremely Remote Loss of all communication functions Major Remote
(*) “All” means loss of all navigation information, excluding heading, airspeed, and clock data. If any or all of the latter information is also lost then a higher classification may be warranted.
33 6 Other Parameters (Typically Shown on Electronic Display Systems). The following table lists examples of safety objectives for failure conditions related to other parameters typically shown on electronic display systems.
Table 8 Example Safety Objectives for Failure Conditions of Other Parameters
Failure Condition
Hazard Classification Qualitative Probability Display of misleading flight path vector information to one pilot Major Remote (*) Loss of all vertical speed displays Major Remote Display of misleading vertical speed information to both pilots Major Remote Loss of all slip/skid indication displays Major Remote Display of misleading slip/skid indication to both pilots Major Remote Display of misleading weather radar information Major Remote (**) Total loss of flightcrew alerting displays Major (***) Remote Display of misleading flightcrew alerting information Major Remote Display of misleading flightcrew procedures Major - Catastrophic Remote – Extremely Improbable (****)
Loss of the standby displays Major Remote
(*) The safety objective may be more stringent depending on the use and on the phase of flight.
(**) Applicable to the display part of the system only.
(***) Applicable to the general case, however, some cases could be more severe.
Additional guidance is in the ARAC recommendations for proposed AC 25.1322.
(****) To be evaluated depending on the particular procedures and associated situations.
7 Engine. Table 9, below, lists examples of generally accepted safety objectives for engine related failure conditions. Appendix 2 of this AC provides additional guidance for powerplant displays.
(aa) The term “required engine indications” refers specifically to the engine thrust/power setting parameter (for example, engine pressure ratio, fan speed, or torque) and any other engine indications that may be required by the flightcrew to maintain the engine within safe operating limits (for example, rotor speeds or exhaust gas temperature).
(bb) The information in Table 9 is based on the premise that the display failure occurs while operating in an autonomous engine control mode.
Autonomous engine control modes, such as those provided by full authority digital engine controls, protect continued safe operation of the engine at any thrust lever setting. Hence, the flight deck indications and associated flightcrew actions are not the primary means of protecting safe engine operation.
(cc) Where the indications serve as the primary means of assuring continued safe engine operation, the hazard classification may be more severe. For example, under the table entry “Loss of one or more required engine indications on more than one engine,” the hazard classification would change to “Catastrophic” and the probability would change to “Extremely Improbable.”
(dd) Each of the general failure condition descriptions provided in Table 9 represents a set of more specific failure conditions. The hazard classifications and probabilities provided in Table 9 represent the most severe outcome typically associated with any failure condition within the set. If considered separately, some of the specific failure conditions within each set would likely have less severe hazard classifications and probabilities.
Table 9 Example Safety Objectives for Engine Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of one or more required engine indications for a single engine Major Remote Misleading display of one or more required engine indications for a single engine Major Remote Loss of one or more required engine indications for more than one engine Hazardous Extremely Remote(*) Misleading display of any required engine indications for more than one engine Catastrophic Extremely Improbable(**)
(*) The worst anticipated outcomes associated with this class of failure may often be driven by consideration of the simultaneous loss of all required engine indications. In any case, those outcomes will typically include both a high speed takeoff abort and loss of the backup means to assure safe engine operations. High speed aborts have typically been classified as “hazardous” by the FAA due to the associated impacts on both flightcrew workload and safety margins. Since any number of single failures or errors can defeat the protections of a typical autonomous engine control, losing the ability to backup the control is considered a sufficiently large reduction in the safety margins to also warrant a “hazardous” classification. Hence the “Extremely Remote” design guideline was chosen.
(**) If the power setting parameter is indicating higher than actual during takeoff, this can lead directly to a catastrophe, either due to a high speed runway overrun or impacting an obstacle after takeoff. This classification has been debated and sustained by the FAA numerous times in the past. Hence the “Extremely Improbable” probability is listed.
8 Use of Display Systems as Controls. Hazard classifications and safety objectives are not provided for display systems used as controls because the failure conditions are dependant on the functions and systems being controlled or on alternative means of control. The use of display systems as controls is described in Chapter 7 of this AC. The following table lists the failure conditions when display systems are used as controls.
36 Table 10 Failure Conditions for Display Systems Used as Controls
Failure Condition
Qualitative Probability Total loss of capability to use the display system as a control Depends on system being controlled.
Undetected erroneous input from the display system as a control Depends on system being controlled.
22. – 30. [RESERVED]
CHAPTER 5.
ELECTRONIC DISPLAY INFORMATION ELEMENTS AND FEATURES
31. Display Information Elements and Features. This chapter provides guidance for the display of information elements including text, labels, symbols, graphics, and other depictions (such as schematics) in isolation and in combination. It covers the design and format of these information elements within a given display area. Chapter 6 of this AC covers the integration of information across several display areas in the flight deck, including guidance on flight deck information location, display arrangement, windowing, redundancy management, and failure management.
a. General.
(1) The following list provides objectives for each display information element, in accordance with its intended function:
• Each flight, navigation, and powerplant instrument for use by any pilot must be plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path (§ 25.1321(a)).
• The displayed information should be easily and clearly discernable, and have enough visual contrast for the pilot to see and interpret it. Overall, the display should allow the pilot to identify and discriminate the information without eyestrain. Refer to paragraph 16a(4) of this AC for additional guidance regarding contrast ratio.
• For all display configurations, all foreseeable conditions relative to lighting should be considered. Foreseeable lighting considerations should include failure modes such as lighting and power system failure, the full range of flight deck lighting and display system lighting options, and the operational environment (for example, day and night operations). If a visual indicator is provided to indicate a malfunction of an instrument, it must be effective under all foreseeable lighting conditions (§ 25.1321(e)).
• Information elements (text, symbol, etc.) should be large enough for the pilot to see and interpret in all foreseeable conditions relative to the operating environment and from the flightcrew station (see related regulation). If two or more pilots need to view the information, the information elements should also be discernable and interpretable over these viewing distances.
• The pilots should have a clear, unobstructed, and undistorted view of the displayed information.