8. PROJECT SPECIFIC CERTIFICATION PLAN (PSCP). On January 25, 1999, the FAA, in coordination with the Aerospace Industries Association (AIA) and the General Aviation Manufacturers Association (GAMA), introduced The FAA and Industry Guide to Product Certification. This aid communicates the design and production certification process for aircraft. It describes how to plan, manage, and document an effective and efficient product certification process. A crucial part of this process is the development of a “Project Specific Certification Plan (PSCP).” The applicant should develop a comprehensive PSCP that includes the following:
a. Project Description: A summary of the project.
b. System Description:
(1) A comprehensive system description that includes a brief summary of the product as it relates to existing flight deck displays, sensors, added sensors, switches, annunciator lights, control panels, electrical components, interior arrangement, other interfaces, product part number, etc.
(2) A layout and description of any changes to the flight instrument panels and flight engineer panels.
(3) Information regarding software aspects of certification and any applicationspecific integrated circuits (ASIC) approved under TSO-C151a should be referenced, and made available upon request. Additional documentation may be required for added features that were not approved under TSO-C151a.
c. Project Schedule:
(1) A detailed project schedule that identifies all major milestones and schedules for any required deliverables (i.e., test plans).
(2) Schedules for operational and maintenance aspects, as well as foreign authority validation requirements.
d. Certification Basis and Means of Compliance:
(1) A certification matrix that identifies the applicable regulations, AC’s, current policies, certification basis, and the procedures or methods that will be used to comply with those regulations.
(2) Any testing or analyses applicable to the project that have been previously approved by the FAA under an STC, TC, TSO, or Parts Manufacturer Approval (PMA) held by the applicant. The approval date, letter reference number, and references as to how the specific approval was granted (i.e., STC, TSO, letter of approval, etc.) should be included in this section.
e. Communication and Coordination:
(1) If applicable, identification of all designated engineering representatives (DER), designated airworthiness representatives (DAR), designated manufacturing inspection representatives (DMIR), or designated alteration station (DAS) specialists working on the program.
(2) Identification of all delegated functions, which should include any stipulations, coordination, and limitations that are placed upon those delegations.
f. Human Factors Plan: This section should address human factors issues and provide human factors support for decisions regarding the flightcrew interface issues resulting from the TAWS installation.
g. Testing Plan: This section should contain the requirements for the planning, preparation, and conduct of FAA required testing, including any delegations.
h. Conformity Plan: This section should describe the activities associated with conformity of parts, simulators, and aircraft installations.
i. Continued Airworthiness Plan: This section should provide the instructions for continued airworthiness for the TAWS installation.
j. Compliance Documentation: This section should describe the procedures for submittal and processing of compliance documentation.
9. SYSTEM SAFETY ASSESSMENT.
a. The applicant should perform a system safety assessment (SSA) to establish the hazards associated with the proposed installation. The applicant should develop the SSA in accordance with the guidance provided in AC 25.1309-1A (System Design and Analysis) and Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 4761 (Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment).
b. The TSO-C151a requires a probability of 10-5 for unannunciated failure, hazardously misleading information (HMI), and false alerts at the box level. Therefore, the box as installed must meet the following criteria:
(1) The probability of a failure that would lead to the loss of all functions as they are described in paragraph 6. (System Description) of this AC shall be less than or equal to 10-3 per flight hour.
(2) The probability of a false caution and/or warning alert due to undetected or latent failures shall be less than or equal to 10-4 per flight hour.
(3) The probability of an unannunciated failure of the system to provide the required alerting functions due to undetected or latent failures shall be less than or equal to 10-4 per flight hour.
(4) The probability of the system to provide HMI to the TAWS display due to undetected or latent failures shall be less than or equal to 10-4 per flight hour.
(5) Failure of the installed TAWS shall not degrade the integrity of any essential or critical system installed in the airplane with which the TAWS interfaces.
10. SOFTWARE. The applicant should provide evidence that the TAWS software meets the requirements of TSO-C151a and that it meets the appropriate software levels for any added feature (s).
11. POSITION SOURCE. TAWS uses the estimated position of the airplane with reference to the terrain/obstacle to determine when an alert should be annunciated. The applicant should provide evidence that the TAWS position source (horizontal and vertical) is suitable for each phase of flight (i.e., enroute, remote/oceanic, terminal, and approach, as provided by TSO-C151a, Appendix 1, Section 10) for which approval is sought.
a. Horizontal Position Source.
(1) TAWS that interface with previously approved navigation systems:
(a) Class A equipment may use approved Area Navigation (RNAV), which may include GPS.
(b) Class B equipment is required to interface with an approved GPS for horizontal position.
(c) Previously approved RNAV and GPS systems that are used for navigation are considered suitable for TAWS horizontal position inputs.
(d) The RNAV system must meet the requirements of TSO-115, or be installed in accordance with AC 90-45A for RNAV systems.
(e) GPS must meet the requirements of TSO-C129a, or be installed in accordance with AC 20-130A and/or AC 20-138.
(f) If a Wide Area Augmentation System (WAAS) is used as a position source, it should meet TSO C-145.
(g) TAWS functions that require this navigation source for operations should be automatically disabled when the source has degraded to a point where its accuracy can no longer support the TAWS functions (i.e., IRU, dead reckoning). An annunciation of this loss of function is required. If the installation does not provide this automatic feature, then an indication should be provided to the flightcrew that the function is no longer available, and the appropriate crew action should be noted in the AFM. A means for testing the position source for accuracy and reliability is unnecessary for these systems.
(2) TAWS equipment with internal GPS position source: Class A and Class B equipment that use a GPS internal to the TAWS for horizontal position information, must use a GPS that is capable of detecting a positional error that exceeds the appropriate alarm limit for the existing phase of flight, in accordance with DO-208 or equivalent.
When this alarm limit is activated, the GPS-computed position is considered unsuitable for the TAWS and the functions that require GPS for operations should be automatically disabled and an annunciation provided to the flightcrew. If the installation does not provide this automatic feature, then an indication should be provided to the flightcrew that the function is no longer available, and the appropriate crew action should be noted in the AFM. This type of TAWS equipment will not be approved for navigation unless it meets the provisions of paragraph 11.a.(1) of this AC. The applicant must be able to demonstrate that the TAWS, as installed on the aircraft, provides the appropriate position information (latitude/longitude) for the TAWS functions.
b. Vertical Position Source. The following sources are considered suitable for use in establishing vertical position. They may be used as a sole source or in combination.
The applicant must be able to demonstrate that the TAWS, as installed on the aircraft, provides the appropriate vertical information for the TAWS functions.
(1) Barometric Altitude. Vertical position information provided by a barometric altitude source that meets the requirements of TSO-C10b, or later versions, is considered acceptable as a source of vertical position information.
(2) Radio Altimeter. Vertical position information provided by a radio altimeter that meets the accuracy specified in TSO-C67 or later versions, is considered acceptable as a source of vertical position information. Class B equipment does not require a radio altitude input.
(3) Air Data Computers. Vertical position information provided by an air data computer that meets the accuracy requirements of TSO-C106, or later versions, is considered acceptable as a source of vertical position information.
(4) GPS. Vertical position information provided by GPS may be used in combination with other sources of vertical position. If GPS is used as the only means for the determination of vertical position then it must meet the requirements of TSO-C145, or later versions.
12. TERRAIN DATABASE. The terrain database for TAWS has been validated via the TSO-C151A authorization process, so there is no need to revalidate the database during the installation process. However, there are two areas of concern that must be addressed during the installation process:
a. Updates. The installed system must be capable of accepting updated terrain databases (and obstacle databases as well, if included). The TAWS manufacturers must have a procedure in place whereby the manufacturer can inform the airplane owner/operator about updates, or the airplane owner/operator can learn about updates.
The procedure must contain sufficient information to enable the owner/operator to make a logical safety decision as to whether it is appropriate to purchase and install the update.
This information should be contained in the instructions for continued airworthiness.
b. Valid Regional Data. The Instructions for Continued Airworthiness should identify the procedures for determining the status of the terrain database. Operators should use this information to determine if the current terrain database is appropriate for the area of intended operation
13. DISPLAY PRESENTATION. The terrain display for TAWS is primarily a strategic planning tool that the flightcrew will use to identify potential flight vertical of horizontal errors and correct these errors before an alert occurs. It is not intended for tactical navigation during alert conditions. When an alert occurs, the flightcrew should perform the appropriate procedures before referencing the terrain display for information.
NOTE: A terrain display is not mandatory for Class B equipment. (For further definition, see paragraph 6.b. of this AC and TSO-C151a.)
a. Terrain Display.
(1) The TAWS equipment approved under TSO-C151a must be capable of providing terrain and alerting data to display hardware. The display hardware may be stand alone or interfaced with existing equipment, such as a weather radar (WXR), navigation displays, or other compatible display systems. The actual display presentation format that the flightcrew sees will depend on the onboard display hardware, the options made available by the TSO-C151a manufacturer, and the features desired by the customer/user. Regardless of what format is used, the display presentation must enhance the flightcrew’s terrain situational awareness.
(2) The terrain display system is an output from the TAWS; therefore:
(a) the possibility of failure of that system should be no greater than 10-3 per average flight hour, and
(b) the possibility of misleading information on the display due to undetected or latent failures, should be no greater than 10-4 per average flight hour.
(3) During the development of the TAWS equipment, the applicant should use a representative sample of pilots to participate in the design and evaluation process for the proposed presentation format.
(4) The applicant should consider the selection of a terrain display where the display is used for multiple functions. In these cases, a means should be provided to select and de-select the display of terrain. However, care must be exercised in the selection of such a multifunction implementation, to ensure that the display sharing is appropriate for the specific functions. The use of the TAWS situation awareness display should not unacceptably detract from the usability of existing functions. Since the TAWS display is not to be used for navigation, the use of the display should not impair the ability of the pilot to perform required navigation functions. An example of such an impairment would be an installation that forces the pilot to chose between the TAWS display and the needed navigation information in situations where both are likely to be used simultaneously and continuously (e.g., instrument approach in the vicinity of hazardous terrain). If the timesharing of the display between TAWS and other functions is deemed acceptable, the design must facilitate simple switching between the functions, with minimal time delays, so that both functions are sufficiently accessible in realistic flight scenarios.
(5) The terrain display should be installed in a location that is acceptable for monitoring by the pilot as a planning tool to identify potential flight path conflicts. In general, the terrain display should be in a location similar to other situation awareness displays, such as electronic maps and weather radar.
b. Terrain Display Presentation. TAWS equipment shall be designed to interface with a terrain display, either color or monochromatic. If there are multiple terrain views available, at least one terrain display shall be capable of providing all of the following terrain-related information:
(1) The terrain should be depicted relative to the airplane’s position such that the pilot may estimate the relative bearing to the terrain of interest.
(2) The terrain should be depicted relative to the airplane’s position such that the pilot may estimate the distance to the terrain of interest.
(3) The terrain depicted should be oriented to either the heading or track of the airplane. In addition, a north-up orientation may be added as a selectable format.
(4) Variations in terrain elevation depicted relative to the airplane’s elevation (above and below) should be visually distinct. Terrain that is more than 2000 feet below the airplane’s elevation need not be depicted.
(5) Terrain that generates alerts should be displayed in a manner to distinguish it from non-hazardous terrain, consistent with the caution and warning alert level.
(6) The terrain display presentation should be clear, unambiguous, and readily usable by the flightcrew during day and night operations under all ambient lighting conditions expected in service.
(7) The terrain display should be viewable in direct sunlight, and at least one display must be viewable by one of the pilots.
(8) An inhibited failed and/or inoperative TAWS should be indicated to the flightcrew in a manner consistent with the flight deck design philosophy.
(9) The terrain display presentation should complement and be compatible with the terrain alerting function of the TAWS.
(10) Terrain mapping should allow the flightcrew to determine relative terrain elevation.
(11) The terrain display should be designed so that the flightcrew can readily determine if terrain is a threat to the airplane.
(12) The colors and/or textures used for threat terrain should be intuitive and indicate the immediacy of the threat.
(13) If the terrain is presented on a shared display, the terrain mode and terrain information should be easily distinguishable from weather and other features.
(14) For color displays, the selected colors should complement the discreet visual and aural alerts that are presented to the flightcrew. Accordingly, any colors that are used for the threat terrain display should match the colors used for the discreet visual alerts.
(15) If additional terrain views are provided, they must not present information that is inconsistent or incompatible with the features described above. Each view should be consistent with the other as far as color, scale, and textural information. When transitioning between views, the range scale should remain the same for each view. Each view will be carefully evaluated to ensure that it does not interfere with or reduce the effectiveness of the TAWS as a whole, and that it meets the other relevant portions of this Page 17
Advisory Circular. Since such displays may include functionality that goes beyond the scope of this AC, they also will be evaluated based on other relevant regulations, guidance material, or industry standards, as appropriate.
c. Pop-Up Mode-Switching Functionality.
(1) General Considerations. If implemented, an automatic pop-up feature should incorporate the following considerations in its design:
(a) The pop-up functionality should automatically display TAWS-related information when a TAWS caution alert occurs.
(b) The pop-up functionality should be implemented consistently for weather, Predictive Windshear System (PWS), and traffic alerts.
(c) The display system should be designed so that it is very evident that an automatic pop-up has occurred.
(d) The terrain display mode should be annunciated on the display. If this is not feasible then a mode annunciation light should be installed near the terrain display.
(e) Manually switching back to the original mode of operation should require minimal effort.
(f) Automatic switching back to the original mode of operation after the caution or warning ceases should not be allowed unless it is part of the aircraft design philosophy.
(2) Pop-Up Inhibit Feature. For dual displays, pop-up functionality can be inhibited if the terrain map is on at least one display when a terrain alert occurs.
However, if the terrain map is not on a display when a terrain alert occurs, the terrain map, with the alerts, should be automatically displayed on both the left and right displays.
(3) Prioritizing Pop-Up Displays Between Systems. In installations where the TAWS and the Predictive Windshear System (PWS) share the same display, and automatic pop-up functionality is employed, the display priorities indicated in Table 1, below, are recommended:
TABLE 1.
Prioritization of Pop-Up Displays Where TAWS and
Predictive Windshear System (PWS) Share the Same Display
Priority Description Highest 1 Terrain Awareness Warning 2 Predictive Windshear Warning 3 Terrain Awareness Caution 4 Predictive Windshear Caution 5 Standard Terrain Display Lowest 6 Weather Radar
(4) If the system provides alerting for obstacle threats, the prioritization for warnings and cautions should be the same as those for terrain. The priorities are listed in the table above.
d. Auto-Range Switching Mode. An auto-ranging function during alerts is not
required. However, if provided, an auto-ranging display should be designed so that it is
very evident to the flightcrew that the range has been automatically selected. The range
selected for auto-ranging should provide a usable depiction of the threat on the display.
Switching back to a manually-selected range should require minimal effort.
14. ALERTS.
a. In addition to being complaint with the requirements of § 25.1322, the TAWS
alerts should be clear, concise, and unambiguous.
b. The Human Factors Plan specified in the PSCP (see paragraph 8.f.) should be used to establish that the visual and aural alerts are consistent with the alerting philosophy of the airplane flight deck in which the TAWS equipment is installed. This is particularly important with retrofit installations, which may include the re-use of previously-installed alerting annunciations. The plan should consider that the visual alerts are:
• located in the pilots primary field of view, as defined by the human factors plan
• consistent with their associated voice, or aural call out
• consistent with the colors specified in § 25.1322, both in the discrete and textural display formats.
15. ALERT PRIORITIZATION.
a. Installations of TAWS on aircraft also equipped with a Reactive Windshear System (RWS), Predictive Windshear System (PWS), and Traffic Alert and Collision Avoidance System (TCAS) should include an alert prioritization scheme such that:
(1) Only one alert is given at any one time, and
(2) Alerts for situations requiring immediate action by the flightcrew have priority in situations where conditions for multiple alerts may occur.
NOTE: In older aircraft, the system architecture may preclude the prioritization of alerts for multiple alerting systems. If such is the case, a prioritization scheme is not required. However, if simultaneous alerts can be given, then the aural words must be understandable and the associated visual alerts must not be confusing to the flightcrew.
b. Implementing this prioritization scheme within the TAWS equipment is acceptable. Table 2, below, displays an example of the recommended alert prioritization:
TABLE 2.
Recommended Alert Prioritization between the TAWS and Other Systems Installed Priority Description Highest 1 Reactive Windshear Warning Class A/B 2 Sink Rate Pull-Up Warning (Excessive Rates of Descent) Class A 3 Terrain Closure Pull-Up Warning (Excessive Closure Rates) Class A/B 4 Terrain Awareness Pull-Up Warning (FLTA) 5 Predictive Windshear Warning 6 Minimums (Voice Callouts) Class A/B 7 Terrain Awareness Caution (FLTA) Class A 8 Too Low Terrain (Flight Into Terrain When Not in Landing Configuration) Class A/B 9 PDA (“Too Low Terrain”) Caution Class A/B 10 Altitude Callouts (Voice callouts) Class A 11 Too Low Gear (Flight Into Terrain When Not in Landing Configuration) Class A 12 Too Low Flaps (Flight Into Terrain When Not in Landing Configuration) Class A/B 13 Sink Rate (Excessive Rates of Descent) Class A/B 14 Don’t Sink (Negative Climb Rate or Altitude Loss After Take-off) Class A 15 Glideslope (Excessive Downward Deviation From an ILS Glideslope) 16 PWS Caution 17 Approaching Minimums (Voice Callouts) 18 Bank Angle (Voice Callouts) 19 Reactive Windshear Caution 20 TCAS RA (“Climb,” “Descend,” etc.)
Lowest 21 TCAS TA (“Traffic, Traffic”)
16. SYSTEM INHIBIT.
a. A means for one of the flightcrew to inhibit the following TAWS functions must be provided:
• FLTA
• PDA Page 21
• Basic GPWS - Flight into terrain when not in the landing configuration
• Basic GPWS – Excessive downward deviation from the ILS glideslope
b. Care should be taken to ensure that instinctive, inadvertent, or habitual reflexive action by the flightcrew does not inhibit the these functions. (Provisions for a guarded switch could be a possible means of compliance.) Appropriate annunciation of the inhibited functions must be provided to the flightcrew. Flightcrew procedures for disabling various TAWS functions should be identified in the Airplane Flight Manual (AFM). For Class A equipment, inhibiting the FLTA and PDA functionality should not affect the Basic GPWS functions.
17. FLIGHT DATA RECORDER. For those applications that require crash-survivable flight data recording in accordance with the requirements of § 25.1459(e) (Flight recorders), a means should be provided to record the FLTA alerts in the same manner as is currently done for the Basic GPWS. (It is not necessary to distinguish between Basic GPWS and the new FLTA and PDA alerts.) A means also should be provided to record a FLTA and/or PDA-inhibit.
18. SYSTEMS EVALUATIONS WITH SIMULATORS. Simulators may be used as a tool to evaluate specific installations of TAWS. The level of simulation fidelity required will depend on the type of credit being sought. Some of the characteristics of a TAWS installation and flight deck integration that may be evaluated via simulation are:
• displays,
• alert prioritization,
• mode transitions,
• pop-up displays,
• auto-ranging,
• self test,
• operational workload issues,
• accessibility and usability of the TAWS controls,
• and systems failure modes.
19. GROUND TEST CONSIDERATIONS.
a. A ground test should be conducted for each TAWS installation. The level of
testing required will be determined by the scope of the installation (First of a Model vs.
Follow-on). Some items to consider for ground test should include:
• an acceptable location of TAWS controls, displays, and annunciators;