28 that are already certified. These tables are provided to support consistency in determining hazard classifications across multiple applicants, multiple certification offices, and multiple display system designs; however, these are only examples.
These examples do not replace the need for a system safety assessment and are not an exhaustive list of failure conditions. For these example failure conditions, additional functional capabilities or less operational mitigation may result in higher hazard classifications, while reduced functional capability or increase operational mitigation may result in lower hazard classifications.
1 Attitude (Pitch and Roll). The following table lists examples of safety objectives for attitude related failure conditions.
Table 3 Example Safety Objectives for Attitude Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of all attitude displays, including standby display Catastrophic Extremely Improbable Loss of all primary attitude displays Major – Hazardous(*) Remote - Extremely Remote (*) Display of misleading attitude information on both primary displays Catastrophic Extremely Improbable Display of misleading attitude information on one primary display
Hazardous Extremely Remote Display of misleading attitude information on the standby display Major Remote Display of misleading attitude information on one primary display combined with a standby failure (loss of attitude or incorrect attitude)
Catastrophic Extremely Improbable (**)
(*) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
(**) Consistent with the “Loss of all attitude display, including standby display” safety objective, since the flightcrew may not be able to identify the correct display.
Consideration will be given to the ability of the flightcrew to control the airplane after a
29 loss of attitude primary display on one side in some flight phases (for example, during takeoff).
2 Airspeed. The following table lists examples of safety objectives for airspeed related failure conditions.
Table 4 Example Safety Objectives for Airspeed Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of all airspeed displays, including standby display Catastrophic Extremely Improbable Loss of all primary airspeed displays Major – Hazardous(*) Remote - Extremely Remote(*) Display of misleading airspeed information on both primary displays, coupled with loss of stall warning or loss of over-speed warning Catastrophic Extremely Improbable Display of misleading airspeed information of the standby display (primary airspeed still available) Major Remote Display of misleading airspeed information on one primary display combined with a standby failure (loss of airspeed or incorrect airspeed)
Catastrophic Extremely Improbable (**)
(*) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
(**) Consistent with the “Loss of all airspeed display, including standby display” safety objective, since the flightcrew may not be able to separate out the correct display.
30 3 Barometric Altitude. The following table lists examples of safety objectives for barometric altitude related failure conditions.
Table 5 Example Safety Objectives for Barometric Altitude Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of all barometric altitude displays, including standby display Catastrophic Extremely Improbable Loss of all barometric altitude primary displays Major – Hazardous(*) Remote - Extremely Remote(*) Display of misleading barometric altitude information on both primary displays Catastrophic Extremely Improbable Display of misleading barometric altitude information on the standby display (primary barometric altitude still available) Major Remote Display of misleading barometric altitude information on one primary display combined with a standby failure (loss of altitude or incorrect altitude) Catastrophic Extremely Improbable (**)
(*) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
(**) Consistent with the “Loss of all barometric altitude display, including standby display” safety objective since the flightcrew may not be able to separate out the correct display. Consideration should be given that barometric setting function design is commensurate with the safety objectives identified for barometric altitude.
4 Heading. The following table lists examples of safety objectives for heading related failure conditions.
(aa) The standby heading may be provided by an independent integrated standby or the magnetic direction indicator.
(bb) The safety objectives listed below can be alleviated if it can be demonstrated that track information is available and correct.
Table 6 Example Safety Objectives for Heading Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of stabilized heading in the flight deck Major Remote Loss of all heading displays in the flight deck Catastrophic Extremely Improbable Display of misleading heading information on both pilots' primary displays Major – Hazardous(*) Remote - Extremely Remote(*) Display of misleading heading information on one primary display combined with a standby failure (loss of heading or incorrect heading)
Major – Hazardous (*) Remote – Extremely Remote(*)
(*) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.
(**) This assumes the availability of an independent, non-stabilized heading required by § 25.1303 (a)(3).
32 5 Navigation and Communication (Excluding Heading, Airspeed, and Clock Data). The following table lists examples of safety objectives for navigation and communication related failure conditions.
Table 7 Example Safety Objectives for Certain Navigation and Communication Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of display of all navigation information Major(*) Remote(*) Non-restorable loss of display of all navigation information coupled with a total loss of communication functions Catastrophic Extremely Improbable Display of misleading navigation information simultaneously to both pilots Major – Hazardous Remote – Extremely Remote Loss of all communication functions Major Remote
(*) “All” means loss of all navigation information, excluding heading, airspeed, and clock data. If any or all of the latter information is also lost then a higher classification may be warranted.
33 6 Other Parameters (Typically Shown on Electronic Display Systems). The following table lists examples of safety objectives for failure conditions related to other parameters typically shown on electronic display systems.
Table 8 Example Safety Objectives for Failure Conditions of Other Parameters
Failure Condition
Hazard Classification Qualitative Probability Display of misleading flight path vector information to one pilot Major Remote (*) Loss of all vertical speed displays Major Remote Display of misleading vertical speed information to both pilots Major Remote Loss of all slip/skid indication displays Major Remote Display of misleading slip/skid indication to both pilots Major Remote Display of misleading weather radar information Major Remote (**) Total loss of flightcrew alerting displays Major (***) Remote Display of misleading flightcrew alerting information Major Remote Display of misleading flightcrew procedures Major - Catastrophic Remote – Extremely Improbable (****)
Loss of the standby displays Major Remote
(*) The safety objective may be more stringent depending on the use and on the phase of flight.
(**) Applicable to the display part of the system only.
(***) Applicable to the general case, however, some cases could be more severe.
Additional guidance is in the ARAC recommendations for proposed AC 25.1322.
(****) To be evaluated depending on the particular procedures and associated situations.
7 Engine. Table 9, below, lists examples of generally accepted safety objectives for engine related failure conditions. Appendix 2 of this AC provides additional guidance for powerplant displays.
(aa) The term “required engine indications” refers specifically to the engine thrust/power setting parameter (for example, engine pressure ratio, fan speed, or torque) and any other engine indications that may be required by the flightcrew to maintain the engine within safe operating limits (for example, rotor speeds or exhaust gas temperature).
(bb) The information in Table 9 is based on the premise that the display failure occurs while operating in an autonomous engine control mode.
Autonomous engine control modes, such as those provided by full authority digital engine controls, protect continued safe operation of the engine at any thrust lever setting. Hence, the flight deck indications and associated flightcrew actions are not the primary means of protecting safe engine operation.
(cc) Where the indications serve as the primary means of assuring continued safe engine operation, the hazard classification may be more severe. For example, under the table entry “Loss of one or more required engine indications on more than one engine,” the hazard classification would change to “Catastrophic” and the probability would change to “Extremely Improbable.”
(dd) Each of the general failure condition descriptions provided in Table 9 represents a set of more specific failure conditions. The hazard classifications and probabilities provided in Table 9 represent the most severe outcome typically associated with any failure condition within the set. If considered separately, some of the specific failure conditions within each set would likely have less severe hazard classifications and probabilities.
Table 9 Example Safety Objectives for Engine Failure Conditions
Failure Condition
Hazard Classification Qualitative Probability Loss of one or more required engine indications for a single engine Major Remote Misleading display of one or more required engine indications for a single engine Major Remote Loss of one or more required engine indications for more than one engine Hazardous Extremely Remote(*) Misleading display of any required engine indications for more than one engine Catastrophic Extremely Improbable(**)
(*) The worst anticipated outcomes associated with this class of failure may often be driven by consideration of the simultaneous loss of all required engine indications. In any case, those outcomes will typically include both a high speed takeoff abort and loss of the backup means to assure safe engine operations. High speed aborts have typically been classified as “hazardous” by the FAA due to the associated impacts on both flightcrew workload and safety margins. Since any number of single failures or errors can defeat the protections of a typical autonomous engine control, losing the ability to backup the control is considered a sufficiently large reduction in the safety margins to also warrant a “hazardous” classification. Hence the “Extremely Remote” design guideline was chosen.
(**) If the power setting parameter is indicating higher than actual during takeoff, this can lead directly to a catastrophe, either due to a high speed runway overrun or impacting an obstacle after takeoff. This classification has been debated and sustained by the FAA numerous times in the past. Hence the “Extremely Improbable” probability is listed.
8 Use of Display Systems as Controls. Hazard classifications and safety objectives are not provided for display systems used as controls because the failure conditions are dependant on the functions and systems being controlled or on alternative means of control. The use of display systems as controls is described in Chapter 7 of this AC. The following table lists the failure conditions when display systems are used as controls.
36 Table 10 Failure Conditions for Display Systems Used as Controls
Failure Condition
Qualitative Probability Total loss of capability to use the display system as a control Depends on system being controlled.
Undetected erroneous input from the display system as a control Depends on system being controlled.
22. – 30. [RESERVED]
CHAPTER 5.
ELECTRONIC DISPLAY INFORMATION ELEMENTS AND FEATURES
31. Display Information Elements and Features. This chapter provides guidance for the display of information elements including text, labels, symbols, graphics, and other depictions (such as schematics) in isolation and in combination. It covers the design and format of these information elements within a given display area. Chapter 6 of this AC covers the integration of information across several display areas in the flight deck, including guidance on flight deck information location, display arrangement, windowing, redundancy management, and failure management.
a. General.
(1) The following list provides objectives for each display information element, in accordance with its intended function:
• Each flight, navigation, and powerplant instrument for use by any pilot must be plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path (§ 25.1321(a)).
• The displayed information should be easily and clearly discernable, and have enough visual contrast for the pilot to see and interpret it. Overall, the display should allow the pilot to identify and discriminate the information without eyestrain. Refer to paragraph 16a(4) of this AC for additional guidance regarding contrast ratio.
• For all display configurations, all foreseeable conditions relative to lighting should be considered. Foreseeable lighting considerations should include failure modes such as lighting and power system failure, the full range of flight deck lighting and display system lighting options, and the operational environment (for example, day and night operations). If a visual indicator is provided to indicate a malfunction of an instrument, it must be effective under all foreseeable lighting conditions (§ 25.1321(e)).
• Information elements (text, symbol, etc.) should be large enough for the pilot to see and interpret in all foreseeable conditions relative to the operating environment and from the flightcrew station (see related regulation). If two or more pilots need to view the information, the information elements should also be discernable and interpretable over these viewing distances.
• The pilots should have a clear, unobstructed, and undistorted view of the displayed information.
• Information elements should be distinct and permit the pilots to immediately recognize the source of the information elements when there are multiple sources of the same kind of information. For example, if there are multiple sources for vertical guidance information, then each informational element should be distinct so the flightcrew can immediately recognize the source of the vertical guidance.
(2) Factors to consider when designing and evaluating the viewability and readability of the displayed information include:
• Position of displayed information: Distance from the design eye position (DEP) is generally used. If cross-flight deck viewing of the information is needed, distance from the offside DEP, accounting for normal head movement, should be used. For displays not mounted on the front panel, the distance determination should include any expected movement away from the DEP by the flightcrew.
• Vibrations: Readability should be maintained in adverse conditions, such as vibration. One possible cause of vibration is sustained engine imbalance.
AC 25-24, Sustained Engine Imbalance, provides readability guidance for that condition.
• Visual Angles: Account for both the position of the displayed information as well as font height. SAE ARP 4102/7, Electronic Displays, provides additional information on this subject.
• Readability of Display Information: The Illuminating Engineering Society classifies three main parameters that affect readability: luminance, size, and contrast. Size is the combination of font size and distance from the display.
b. Consistency. Display information should be presented so it is consistent with the flight deck design philosophy in terms of symbology, location, control, behavior, size, shape, color, labels, dynamics and alerts. Consistency also applies to the representation of information on multiple displays on the same flight deck. Display information representing the same thing on more than one display on the same flight deck should be consistent.
Acronyms and labels should be used consistently, and messages/annunciations should contain text in a consistent way. Inconsistencies should be evaluated to ensure that they are not susceptible to confusion or errors, and do not adversely impact the intended function of the system(s) involved.
c. Display Information Elements.
(1) Text. Text should be shown to be distinct and meaningful for the information presented. Messages should convey the meaning intended. Abbreviations and
39 acronyms should be clear and consistent with established standards. For example, International Civil Aviation Organization (ICAO) document 8400, Procedures for Air Navigation Services ICAO Abbreviations and Codes, provides internationally recognized standard abbreviations and airport identifiers.
(a) Regardless of the font type, size, color, and background, text should be readable in all foreseeable lighting and operating conditions from the flightcrew station (§ 25.1321(a)). General guidelines for text are as follows:
• Standard grammatical use of upper and lower case letters is recommended for lengthy documentation and lengthy messages. Using this format is also helpful when the structure of the text is in sentence form.
• The use of only upper case letters for text labels is acceptable.
• Avoid contractions, such as “can’t” instead of “cannot.”
• Break lines of text only at spaces or other natural delimiters.
• Avoid abbreviations and acronyms where practical.
• SAE ARP 4102/7, Electronic Displays, provides guidelines on font sizes that are generally acceptable.
(b) The choice of font also affects readability. The following guidelines apply:
• To facilitate readability, the font chosen should be compatible with the display technology. For example, serif fonts may become distorted on some low pixel resolution displays. However, on displays where serif fonts have been found acceptable, they have been found to be useful for depicting full sentences or larger text strings.
• Sans serif fonts (for example, Futura or Helvetica) are recommended for displays viewed under extreme lighting conditions.
(2) Labels. Labels may be text or icons. The following paragraphs provide guidance on labeling items such as knobs, buttons, symbols, and menus. This guidance applies to labels that are on a display, label a display, or label a display control.
Section 25.1555(a) requires that each flight deck control, other than controls whose function is obvious, must be plainly marked as to its function and method of operation.
Controls whose functions are not obvious should be marked or identified so that a flightcrew member with little or no familiarity with the airplane is able to rapidly, accurately, and consistently identify their functions.