AMC 25.1322 Alerting Systems

• ED Decision 2011/004/R found in: CS-25 Amdt 27 - Large Aeroplanes (Jan 2023)

AMC 25.1322 Alerting Systems ED Decision 2011/004/R Paragraph 1. Purpose 2. Applicability 3. Related Examples, Regulations, Documents, and Definitions 4. Background 5. Designing a Flight crew Alerting System a. General b. Flight crew Alerting Philosophy c. Design Considerations 6. Alert Functional Elements a. Warning Alerts b. Time-Critical Warning Alerts c. Master Visual and Aural Alerts d. Caution Alerts e. Advisory Alerts 7. Alerting System Reliability and Integrity 8. Managing Alerts a. Rules and General Guidelines b. Multiple Aural Alerts c. Multiple Visual Alerts d. Alert Inhibits 9. Clearing and Recalling Visual Alert Messages 10. Interface or Integration with Other Systems 11. Colour Standardisation 12. Minimising the Effects of False and Nuisance Alerts 13. Showing Compliance for Approval of a Flight crew Alerting System 14. Integrating Flight crew Alerting System Elements into the Existing Fleet a. General b. Visual Alerts c. Aural Alerts d. Tactile Alerts 15. Alerts for Head-Up Displays (HUDs) List of Appendices Appendix 1 Examples for Including Visual System Elements in an Alerting System Appendix 2 Examples for Including Aural System Elements in an Alerting System Appendix 3 Regulations Appendix 4 Related Documents Appendix 5 Definitions 1. Purpose This AMC provides an acceptable means of compliance and guidance material for showing compliance with certain requirements of CS-25, for the design approval of flight crew alerting functions. This AMC addresses the type of alert function elements that should be considered (including visual, aural, and tactile or haptic elements), alert management, interface or integration of alerts with other systems, and colour standardisation. The appendices to this AMC also provide examples for including visual and aural system elements in an alerting system. 2. Scope a. This AMC is applicable to aeroplane manufacturers, modifiers, avionics manufacturers, EASA type-certification engineers, human factor specialists and test pilots. b. This AMC is applicable to new aeroplanes. It may also be applicable to modified aeroplanes and to integrating flight crew alerting system elements into existing aeroplanes. It applies to individual aircraft systems that provide flight crew alerting functions that may or may not be integrated with a central alerting system, as well as to systems whose primary function is alerting, such as a central alerting system. 3. Related Examples, Certification Specifications, Documents, and Definitions Appendix 1 of this AMC provides examples for including visual system elements in an alerting system. Appendix 2 of this AMC provides examples for including aural system elements in an alerting system. Appendix 3 of this AMC lists the airworthiness and operational certification specifications related to this AMC. Appendix 4 of this AMC lists related AMCs and other documents that are provided for information purposes and are not necessarily directly referenced in this AMC. Appendix 5 provides definitions written to support the content of this AMC and its associated certification specification. 4. Background a. While the flight crew is ultimately responsible for the operation of the aeroplane, the provision of an alerting system that aids the flight crew in identifying non-normal operational or aeroplane system conditions and in responding in an appropriate and timely manner is an essential feature of every flight deck design. In the past, aeroplanes were designed with discrete lights for the alerting function. Now the alerting function can be integrated with other systems, including electronic display systems, tactile warning systems, and aural warning or tone generating systems. b. CS-25 often provides references to an alert, such as a warning, to provide awareness of a non-normal condition. Many of these certification specifications were written without recognition of a consistent flight deck alerting philosophy, and may use the term “warning” and “alert” in a generic sense. This AMC does not intend to conflict with or replace the intent of those certification specifications. The intent here is to standardise flight crew alerting terminology used and to provide a means for applicants to show compliance with those certification specifications. 5. Designing a Flight crew Alerting System a. General. The purpose of flight crew alerts on aeroplanes is to attract the attention of the flight crew, to inform them of specific non-normal aeroplane system conditions or certain non-normal operational events that require their awareness, and, in modern alerting systems, to advise them of possible actions to address these conditions. The ability of an alert to accomplish its intent depends on the design of the complete alert function. This includes the sensor and the sensed condition required to trigger an alert, how that information is subsequently processed, including the level of urgency and priority assigned, and the choice of alert presentation elements to express the assigned level of urgency. Conditions that do not require flight crew awareness should not generate an alert. b. Flight crew Alerting Philosophy. When developing a flight crew alerting system, use a consistent philosophy for alerting conditions, urgency and prioritisation, and presentation. (1) Alerting conditions. Establish how aeroplane system conditions or operational events that require an alert (for example, engine overheating, windshear, etc.), will be determined. (2) Urgency and Prioritisation. Establish how the level of urgency (Warning, Caution and Advisory) associated with each alerting condition will be prioritised and classified to meet the requirements listed in [CS 25.1322(b)](#_DxCrossRefBm1709821114) and [CS 25.1322(c)(1)](#_DxCrossRefBm1709821114). If an alert’s urgency and prioritisation is context sensitive, state what information should be considered (for example, the priority associated with different alerting conditions may vary depending on the state of the aeroplane, phase of flight, system configuration, etc.). (3) Presentation. Establish a consistent alert presentation scheme (for example, location of the alert on the flight deck, alert combinations [aural, visual, tactile], information presented in the Alert message, and colour and graphical coding standardisation). Also, determine the format in which that alert will be presented (for example, structure and timing of Alert messages) to support the alerting function’s purpose. c. Design Considerations. Consider the following concepts and elements when designing an alerting system: (1) Only non-normal aeroplane system conditions and operational events that require flight crew awareness to support flight crew decision making and facilitate the appropriate flight crew response should cause an alert. However, conditions that require an alert depend on the specific system and aeroplane design, and overall flight-deck philosophy. For example, the failure of a single sensor in a multi-sensor system may not necessarily result in an alert condition that requires pilot awareness. However, for a single sensor system, such a failure should result in an alert condition that provides the flight crew with the information needed to assure continued safe flight and landing. (2) All alerts presented to the flight crew, (for example, light, aural annunciation, engine-indication-and-crew-alerting system (EICAS) message, master caution) must provide the flight crew with the information needed to identify the non-normal operational or aeroplane system condition and determine the corrective action, if any ([CS 25.1322(a)(1)](#_DxCrossRefBm1709821114)). Appropriate flight crew corrective actions are normally defined by aeroplane procedures (for example, in checklists) and are part of a flight crew training curriculum or considered basic airmanship. (3) Implement a consistent flight crew alerting philosophy as described in paragraph 5.b of this AMC. (4) Include the appropriate combination of alerting system presentation elements, which typically include: (a) Master visual alerts (b) Visual alert information (includes Failure flag indications) (c) Master aural alerts (d) Voice information (e) Unique tones (unique sounds) (f) Tactile or haptic information (5) Use logic-based integrated alerting systems to ensure that alerting system elements are synchronised and provide the proper alert presentation format for each urgency level. For example, the onset of the Master visual alert should normally occur simultaneously with the onset of the Master aural alert. (6) Present the alerts according to the urgency and prioritisation philosophy outlined in paragraph 5.b and described in detail in paragraph 8.a of this AMC. (7) Visual alerts must conform to the colour convention of [CS 25.1322(e)](#_DxCrossRefBm1709821114). Paragraph 11 of this AMC provides guidance on the colour convention. (8) If using aural alerts with multiple meanings, a corresponding visual, tactile, or haptic alert should be provided to resolve any potential uncertainty relating to the aural alert and clearly identify the specific alert condition. 6. Alert Functional Elements. The functional elements used in the alerting and information functions for Warning and Caution alerts must provide timely attention-getting cues, resulting in immediate flight crew awareness, through at least two different senses ([CS 25.1322(c)(2)](#_DxCrossRefBm1709821114)). Functional elements used for Advisory alerts do not require immediate flight crew awareness and are normally provided through a single sense. a. Warning Alerts. Several alert functional element combinations are used to comply with [CS 25.1322(c)(2)](#_DxCrossRefBm1709821114) (two-senses requirement). The typical alert-element combinations for Warning alerts (not including Time-critical warning alerts) are shown below. (1) Master visual alert, Visual alert information, and Master aural alert. (2) Master visual alert, Visual alert information, and Voice information or Unique tone. Note 1: Voice information may be preceded by a Master aural alert. Note 2: A tactile alert may be combined with a visual or aural alert to meet the [CS 25.1322](#_DxCrossRefBm1709821114) requirement for a combination of two senses. b. Time-Critical Warning Alerts. Some Warnings may be so time-critical for the safe operation of the aeroplane that general alerts such as a Master visual alert and a Master aural alert may not provide the flight crew with immediate awareness of the specific alerting condition that is commensurate with the level of urgency of flight crew response necessary. In such cases, Warning elements dedicated to specific alerting conditions should be provided that give the flight crew immediate awareness without further reference to other flight deck indications. Examples of such Time-critical warnings include reactive windshear and ground proximity. The alerting elements for Time-critical warnings should include: — Unique Voice information or Unique tone, or both, for each alerting condition, and — Unique Visual alert information in each pilot’s primary field of view for each alerting condition. Note: A unique tactile alert sensed by each pilot can also meet the [CS 25.1322(c)(2)](#_DxCrossRefBm1709821114) requirement for one of the two senses. c. Master Visual and Aural Alerts. A Master visual alert and a Master aural alert may not be warranted if other visual and aural means provide more timely attention-getting characteristics. If a Master visual alert and/or a Master aural alert are used, they should aid in the overall attention-getting characteristics and the desired flight crew response and not distract the flight crew from the time‑critical condition. For example, unique Visual alert information presented in each pilot’s primary field of view is acceptable in place of a Master visual alert if it provides immediate awareness and sufficient attention-getting characteristics. However, an aural alert, such as an aural command to “pull up,” or another sensory cue, would still be required to meet [CS 25.1322(c)(2)](#_DxCrossRefBm1709821114). d. Caution Alerts (1) The alert elements used for Caution are typically identical to those used for Warnings, as both require immediate flight crew awareness. (2) Some Caution alerts are related to conditions that are precursors to potential Time‑critical warning conditions. In these cases, the alerting system elements associated with the Caution should be consistent with the elements for related Time-critical warnings (described in paragraph 6.b of this AMC). For example, reactive windshear warnings, ground-proximity warnings, and Caution alerts can develop into Time-critical warning alerts. e. Advisory Alerts (1) The alerting and informing functional elements for advisories must meet the applicable requirements of [CS 25.1322](#_DxCrossRefBm1709821114) and should include Visual alert information. Advisory information should be located in an area where the flight crew is expected to periodically scan for information. (2) Advisory information does not require immediate flight crew awareness. Therefore, it does not require alerting that uses a combination of two senses. In addition, a Master visual alert or Master aural alert is not typically used since immediate flight crew awareness is not needed. (3) Aural or visual information such as maintenance messages, information messages, and other status messages associated with conditions that do not require an alert may be presented to the flight crew, but the presentation of this information should not interfere with the alerting function or its use. 7. Alerting System Reliability and Integrity a. The alerting system, considered alone and in relation to other systems, should meet the safety objectives of the relevant system safety standards (for example, CS 25.901(b)(2), CS 25.901(c), and CS 25.1309(b)). The reliability and integrity of the alerting system should be commensurate with the safety objectives associated with the system function, or aeroplane function, for which the alert is provided. b. When applying the CS 25.1309(b) system safety analysis process to a particular system or function that has an associated flight crew alert, assess both the failure of the system or function and a failure of its associated alert (CS 25.1309(d)(4)). This should include assessing the effect of a single (common or cascading mode) failure that could cause the failure of a system function and the failure of any associated alerting function. A failure is defined as: “An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended. This includes both loss of function and malfunction.” Therefore, in conducting the safety analysis, both loss of functions and malfunctions should be considered. c. Since the flight crew alerting function is often integrated with, or is common to, other systems, the impact of a failure or error in the alerting system must be assessed separately and in relation to other systems as required by CS 25.1309(b). The cascading effects of a failure or error in the alerting function, and in the interfacing system, should be analysed. Give special consideration to avoid alerting that, through misinterpretation, could increase the hazard to the aeroplane (CS 25.1309(c)). For example, there should not be a foreseeable way that a fire warning for one engine could be misinterpreted as a fire on a different engine. d. Assess the reliability of the alerting system by evaluating the reduction in the safety margin if the alerting system fails. The evaluation should address: (1) Loss of the complete alerting function. (2) A malfunction. (3) Loss or malfunction of one alert in combination with the system condition for which the alert is necessary. e. The integrity of the alerting system should be examined because it affects the flight crew’s trust and response when assessing an alert. Since the individual assessment of a False or Nuisance alert for a given system may lead to a specific consequence, the impact of frequent False or Nuisance alerts increases the flight crew’s workload, reduces the flight crew’s confidence in the alerting system, and affects their reaction in case of a real alert. For example, if False or Nuisance alerts are presented the flight crew may ignore a real alert when it is presented. 8. Managing Alerts. Prioritise alerts so that the most urgent alert is presented first to the flight crew. a. Rules and General Guidelines (1) All flight deck alerts must be prioritised into Warning, Caution, and Advisory categories ([CS 25.1322(b)](#_DxCrossRefBm1709821114)). (2) To meet their intended function(s), alerts must be prioritised based upon urgency of flight crew awareness and urgency of flight crew response (§ 25.1301(a)). Normally, this means Time-critical warnings are first, other Warnings are second, Cautions are third, and Advisories are last ([CS 25.1322(b)](#_DxCrossRefBm1709821114)). (3) Depending on the phase of flight, there may be a need to re-categorise certain alerts from a lower urgency level to a higher urgency level. Furthermore, prioritisation within alert categories may be necessary if the presentation of multiple alerts simultaneously would cause flight crew confusion, or the sequencing of flight crew response is important. For example, when near threatening terrain, Time-critical warnings must be prioritised before other Warnings within the Warning alert category ([CS 25.1322](#_DxCrossRefBm1709821114)(c)(1)). JAA TGL-12 (TAWS), also identifies situations where prioritisation within alert categories is necessary. (4) The prioritisation scheme within each alert category, as well as the rationale, should be documented and evaluated, by following the guidance in paragraph 13, The Showing of Compliance, of this AMC. (5) Documentation should include the results of analyses and tests that show that any delayed or inhibited alerts do not adversely impact safety. b. Multiple Aural Alerts (1) Aural alerts should be prioritised so that only one aural alert is presented at a time. If more than one aural alert needs to be presented at a time, each alert must be clearly distinguishable and intelligible by the flight crew ([CS 25.1322](#_DxCrossRefBm1709821114)(a)(2)). (2) When aural alerts are provided, an active aural alert should finish before another aural alert begins. However, active aural alerts must be interrupted by alerts from higher urgency levels if the delay to annunciate the higher-priority alert impacts the timely response of the flight crew ([CS 25.1301(a)](#_DxCrossRefBm1709821116)). If the condition that triggered the interrupted alert is still active, that alert may be repeated once the higher-urgency alert is completed. If more than one aural alert requires immediate awareness and the interrupted alert(s) affects the safe operation of the aeroplane, an effective alternative means of presenting the alert to the flight crew must be provided to meet the requirements of [CS 25.1322](#_DxCrossRefBm1709821114)(a)(1) and (a)(2). c. Multiple Visual Alerts (1) Since two or more visual alerts can occur at the same time, applicants must show that each alert and its relative priority are readily and easily detectable and intelligible by the flight crew ([CS 25.1322](#_DxCrossRefBm1709821114)(a)(2)). (2) When multiple alerts exist in a specific category (for example, multiple Warning alerts or multiple Caution alerts), a means for the flight crew to determine the most recent or most urgent alert must be provided ([CS 25.1322](#_DxCrossRefBm1709821114)(c)(1)). For example, the most recent or highest priority alert may be listed at the top of its own category. If the alert is time-critical and shares a dedicated display region it must have the highest alerting priority to satisfy its intended function ([CS 25.1301(a)](#_DxCrossRefBm1709821116)). (3) Displays must either conform to the alert colour convention or, in the case of certain monochromatic displays not capable of conforming to the colour conventions, use other visual coding techniques per [CS 25.1322(e)](#_DxCrossRefBm1709821114). This is necessary so the flight crew can easily distinguish the alert urgency under all foreseeable operating conditions, including conditions where multiple alerts are provided ([CS 25.1322](#_DxCrossRefBm1709821114)(a)(2)). d. Alert Inhibits (1) Alert inhibit functions must be designed to prevent the presentation of an alert that is inappropriate or unnecessary for a particular phase of operation ([CS 25.1322](#_DxCrossRefBm1709821114)(d)(1)). Alert inhibits can also be used to manage the prioritisation of multiple alert conditions. Inhibiting an alert is not the same as clearing or suppressing an alert that is already displayed. (2) Alert inhibits should be used in the following conditions: (a) When an alert could cause a hazard if the flight crew was distracted by or responded to the alert. (b) When the alert provides unnecessary information or awareness of aeroplane conditions. (c) When a number of consequential alerts may be combined into a single higher‑level alert. (3) Alerts can be inhibited automatically by the alerting system or manually by the flight crew. (4) For operational conditions not recognised by the alerting system, provide a means for the flight crew to inhibit a potential alert that would be expected to occur as the result of the specific operation (for example, preventing a landing configuration alert for a different landing flap setting). For as long as the inhibit exists, there should be a clear and unmistakable indication that the flight crew manually inhibited that alert. 9. Clearing and Recalling Alert Messages. Clearing Alert messages from the current Warning, Caution, and Advisory display allows the flight crew to remove a potential source of distraction and makes it easier for the flight crew to detect subsequent alerts. a. The following guidance should be applied for clearing and recalling or storing Alert messages: (1) If a message can be cleared and the condition still exists, the system should provide the ability to recall any cleared Alert message that has been acknowledged. (2) Either through a positive indication on the display or through normal flight crew procedures, a means should be provided to identify if Alert messages are stored (or otherwise not in view). b. The Alert message must be removed from the display when the condition no longer exists ([CS 25.1322(a)(3)](#_DxCrossRefBm1709821114)). 10. Interface or Integration with Other Systems (Checklist, Synoptics, Switches, Discrete lamps). a. The colour of all visual alerting annunciations and indications must conform to the colour convention in [CS 25.1322](#_DxCrossRefBm1709821114)(e). Use consistent wording, position, colour and other shared attributes (for example, graphic coding) for all alerting annunciations and indications. b. Information displayed in the flight deck associated with the alert condition must facilitate the flight crew’s ability to identify the alert ([CS 25.1322](#_DxCrossRefBm1709821114)(a)(1)(i)) and determine the appropriate actions, if any ([CS 25.1322](#_DxCrossRefBm1709821114)(1)(ii)). c. Information conveyed by the alerting system should lead the flight crew to the correct checklist procedure to facilitate the appropriate flight crew action. Some flight deck alerting systems automatically display the correct checklist procedure or synoptic display when an alert is presented. Some alerts do not display an associated checklist procedure because the correct flight crew action is covered by training or basic airmanship (for example, autopilot disconnect and Time-critical warnings). In all cases, the aeroplane or system certification test programme should verify that the alerts provide or direct the flight crew to the correct procedures. d. If multiple checklists can be displayed (for example, multiple checklists associated with multiple alerts), the flight crew should be able to readily and easily choose the appropriate checklist and action for each alert. For example, the flight crew must be able to easily distinguish which checklist has priority regarding what the flight crew needs to do first to determine the appropriate actions, if any ([CS 25.1322](#_DxCrossRefBm1709821114)(a)(1)(ii)). 11. Colour Standardisation. The objective of colour standardisation is to maintain the effectiveness of visual alerts by enabling the flight crew to readily distinguish between alert categories. a. Visual alert indications must conform to the following colour convention ([CS 25.1322](#_DxCrossRefBm1709821114)(e)): (1) Red for Warning alert indications. (2) Amber or yellow for Caution alert indications. (3) Any colour except red or green for Advisory alert indications. Note: Green is usually used to indicate “normal” conditions; therefore, it is not an appropriate colour for an Advisory alert. An Advisory alert is used to indicate a “non-normal” condition. b. A separate and distinct colour should be used to distinguish between Caution and Advisory alerts. If a distinctive colour is not used to distinguish between Caution and Advisory alerts, other distinctive coding techniques must be used to meet the general requirements of [CS 25.1322](#_DxCrossRefBm1709821114)(a)(2) so that the flight crew can readily and easily detect the difference between Caution and Advisory alerts. c. The colour displayed for the Warning Master visual alert must be the same colour used for the associated Warning alerts and the colour displayed for the Caution Master visual alert must be the same colour used for the associated Caution alerts ([CS 25.1322](#_DxCrossRefBm1709821114)(e)(1)). d. The colours red, amber, and yellow must be used consistently ([CS 25.1322](#_DxCrossRefBm1709821114) (e)(1)). This includes alert colour consistency among propulsion, flight, navigation, and other displays and indications used on the flight deck. e. For monochromatic displays that are not capable of conforming to the colour convention required by [CS 25.1322](#_DxCrossRefBm1709821114)(e)(2), use display coding techniques (for example, shape, size, and position) so the flight crew can clearly distinguish between Warning, Caution, and Advisory alerts. This requirement is similar to using selected colour coding on multicolour displays that allows the flight crew to easily distinguish between Warning, Caution, and Advisory alerts ([CS 25.1322](#_DxCrossRefBm1709821114)(e)). These coding techniques must also meet the general alerting requirement in [CS 25.1322](#_DxCrossRefBm1709821114)(a)(2) so the alerts are readily and easily detectable and intelligible by the flight crew under all foreseeable operating conditions, including conditions where multiple alerts are provided. The wide use of monochromatic displays on the flight deck with flight crew alerting is normally discouraged, except when an increased safety benefit is demonstrated, for example, a HUD used as a primary flight display. f. [CS 25.1322(f)](#_DxCrossRefBm1709821114) requires that the use of the colours red, amber and yellow on the flight deck for functions other than flight crew alerting must be limited and must not adversely affect flight crew alerting. Consistent use and standardisation for red, amber, and yellow is required to retain the effectiveness of flight crew alerts. It is important that the flight crew does not become desensitised to the meaning and importance of colour coding for alerts, which could increase the flight crew’s processing time, add to their workload, and increase the potential for flight crew confusion or errors. g. Where red, amber and yellow are proposed for non-flight crew alerting functions, substantiate that there is an operational need to use these colours to provide safety related awareness information. Examples of acceptable uses of red, amber, or yellow for non-alerting functions include: — Weather radar display (for areas of severe/hazardous weather conditions that should be avoided); — TAWS terrain display (for local terrain relative to the current altitude). 12. Minimising the Effects of False and Nuisance Alerts. As much as possible, the alerting functions or system should be designed to avoid False alerts and Nuisance alerts, while providing reliable alerts to the flight crew when needed. The effects of Nuisance and False alerts distract the flight crew, increase their potential for errors, and increase their workload. [CS 25.1322(d)](#_DxCrossRefBm1709821114) requires that an alert function be designed to minimise the effects of False and Nuisance alerts. Specifically, a flight crew alerting system must be designed to: a. Prevent the presentation of an alert when it is inappropriate or unnecessary. b. Provide a means to suppress an attention-getting component of an alert caused by a failure of the alerting system that interferes with the flight crew’s ability to safely operate the aeroplane. This means must not be readily available to the flight crew so that it can be operated inadvertently or by habitual, reflexive action. c. Permit each occurrence of attention-getting cues for Warning and Caution alerts to be acknowledged and then suppressed, unless the alert is required to be continuous ([CS 25.1322(c)](#_DxCrossRefBm1709821114)). Reaching forward and pressing a switch light is a common, acceptable means of suppressing the attention-getting components of an aural alert, a flashing master warning, or a caution light. d. Remove the presentation of the alert when the condition no longer exists ([CS 25.1322](#_DxCrossRefBm1709821114)(a)(3)). e. Pulling circuit breakers is not an acceptable primary means for the flight crew to suppress a False alert. 13. The Showing Of Compliance a. Certification evaluations may be different from project to project because of the complexity, degree of integration, and specifics of the proposed alerting function or system. We recommend developing a plan to establish how compliance with the rules will be shown and to document how issues will be identified, tracked, and resolved throughout the life cycle of the type investigation programme. We also recommend including the Agency early in the developmental process to discuss the acceptability of any proposed flight deck design and alerting philosophy and the conditions that should be alerted to the flight crew. Typically, the certification programme is used for this purpose. For addressing human factors and pilot interface issues, in addition to the guidance in this AMC, compliance with CS 25.1302 and associated AMC must be shown. b. When following the guidance in this AMC, document any divergence from this AMC, and provide the rationale for decisions regarding novel or unusual features used in the design of the alerting system. This will facilitate the certification evaluation because it will enable the Agency to focus on areas where the proposed system diverges from the AMC and has new or novel features. c. In accordance with the certification programme, provide an evaluation of the alerting system. In this case an evaluation is an assessment of the alerting system conducted by an applicant, who then provides a report of the results to the Agency. Evaluations are different from tests because the representation of the alerting system does not necessarily conform to the final documentation and the Agency may or may not be present. Evaluations by the applicant may contribute to a finding of compliance, but they do not constitute a complete showing of compliance by themselves. (1) The evaluation should include assessments of acceptable performance of the intended functions, including the human-machine interface, and acceptability of alerting system failure scenarios. The scenarios should reflect the expected operational use of the system. Specific aspects that should be included during the evaluation(s) are: (a) Visual, aural, and tactile/haptic aspects of the alert(s). (b) Effectiveness of meeting intended function from the human/machine integration, including workload, the potential for flight crew errors, and confusion. (c) Normal and emergency inhibition and suppression logic and accessibility of related controls. (d) Proper integration with other systems, including labelling. This may require testing each particular alert and verifying that the appropriate procedures are provided. (e) Acceptability of operation during failure modes per CS 25.1309. (f) Compatibility with other displays and controls, including multiple Warnings. (g) Ensuring that the alerting system by itself does not issue Nuisance alerts or interfere with other systems. (h) Inhibiting alerts for specific phases of flight (for example, take-off and landing) and for specific aeroplane configurations (for example, abnormal flaps and gear). (2) The validation of the performance and integrity aspects will typically be accomplished by a combination of the following methods: — Analysis — Laboratory test — Simulation — Flight test (3) Evaluate the alerts in isolation and combination throughout the appropriate phases of flight and manoeuvres, as well as representative environmental and operational conditions. The alerting function as a whole needs to be evaluated in a representative flight deck environment. Representative simulators can be used to accomplish the evaluation of some human factors and workload studies. The level and fidelity of the simulator should be commensurate with the certification credit being sought. The simulator should represent the flight deck configuration and be validated by the Agency. The assessment of the alerts may be conducted in a laboratory, simulator, or the actual aeroplane. Certain elements of the alerting system may have to be validated in the actual aeroplane. The evaluation should be conducted by a representative population of pilots with various backgrounds and expertise. (4) Evaluations should also verify the chromaticity (red looks red and amber looks amber) and discriminability (colours can be distinguished from each other) of the colours being used, under the expected lighting levels. Evaluations may also be useful to verify the discriminability of graphic coding used on monochromatic displays. These evaluations can be affected by the specific display technology being used, so a final evaluation with production representative hardware is sometimes needed. 14. Integrating Flight crew Alerting System Elements into the Existing Fleet a. General (1) This material provides recommendations to applicants on how to retrofit existing aeroplanes so they comply with [CS 25.1322](#_DxCrossRefBm1709821114) without major modifications to the current flight crew alerting system. (2) System upgrades to existing aeroplanes should be compatible with the original aeroplane’s flight crew alerting philosophy. The existing alerting system might not be able to facilitate the integration of additional systems and associated alerts due to limitations in the system inputs, incompatible technologies between the aeroplane and the system being added, or economic considerations. (a) We discourage incorporating a new additional master visual function into the flight crew alerting system. If it is not feasible to include additional systems and associated alerts in the existing master visual function, an additional master visual function may be installed, provided that it does not delay the flight crew’s response time for recognising and responding to an alert. (b) Where possible, new alerts should be integrated into the existing flight crew alerting system. If these alerts cannot be integrated, individual annunciators or an additional alerting display system may be added. (c) Not all alerts associated with failure flags need to be integrated into the central alerting system. However, for those alerts requiring immediate flight crew awareness, the alert needs to meet the attention-getting requirements of [CS 25.1322](#_DxCrossRefBm1709821114)(c)(2) as well as the other requirements in [CS 25.1322](#_DxCrossRefBm1709821114). Thus, a Master visual alert or Master aural alert may not be initiated, but an attention-getting aural or tactile indication must still accompany an attention-getting visual failure flag to meet the attention-getting requirement of [CS 25.1322](#_DxCrossRefBm1709821114)(a)(1), which requires attention-getting cues through at least two different senses for Warning and Caution alerts. b. Visual Alerts. Following the guidance in paragraphs 5 and 6 of this AMC, determine whether or not the added system features will require activation of an aeroplane Master visual alert. c. Aural Alerts (1) Using the guidance in this AMC, determine if an added system will require activating an aural alert. (2) The new aural alert should be integrated into the existing aural alerting system and functions. If this is not possible, a separate aural alerting system may be installed, provided that a prioritisation scheme between existing aural alerts and the new aural alerts is developed so that each alert is recognised and can be acted upon in the time frame appropriate for the alerting situation. This may require a demonstration of any likely combination of simultaneous alerts. After the new and existing alerts have been merged, follow the guidance in this AMC for determining how to prioritise the alerts. d. Tactile Alerts (1) Using the guidance in this AMC, determine if an added system will require activating a tactile alert. (2) If possible, incorporate the new tactile alert into the existing alerting system. If this is not possible, a separate tactile alerting system may be installed, provided that the following elements are included: (a) A prioritisation scheme between existing tactile alerts and the new tactile alerts should be developed so that each alert is recognised and can be acted upon in the time frame appropriate for the alerting situation. After the new and existing alerts have been merged, follow the guidance in this AMC for determining how to prioritise the alerts. (b) A means to ensure that an individual alert can be understood and acted upon. This may require a demonstration of any likely combination of simultaneous alerts. 15. Alerts for Head-Up Displays (HUDs) a. HUDs have visual characteristics that merit special considerations for alerting. First, most HUDs are single-colour (monochromatic) displays and are not capable of using different colours, such as red, amber and yellow to signify alert information. Second, HUDs are located in the pilot’s forward field of view, separated from the instrument panel, and focused at optical infinity. As a result, many visual indications on the instrument panel are not visible to the pilot while viewing the HUD, and the timely detection of visual alerts displayed on the instrument panel may not be possible. Therefore, even though HUDs are not intended to be classified as integrated caution and warning systems, they do need to display certain alerts, such as Time‑critical warnings, to perform their role as a primary flight display (PFD). Monochromatic HUDs are not required to use red and amber to signify Warning and Caution alerts, but do need to provide the equivalent alerting functionality (for example, attention-getting, clearly understandable, not confusing) as current head-down display (HDD) PFDs ([CS 25.1322(e)](#_DxCrossRefBm1709821114)). b. Alerting functions presented in the HUD should not adversely affect the flight crew’s use of the HUD by obstructing the flight crew’s outside view through the HUD. c. Time-critical warnings that are displayed on the HDD PFD also need to be presented on the HUD to ensure equivalent timely pilot awareness and response (for example, ACAS II, windshear, and ground-proximity warning annunciations) ([CS 25.1301(a)](#_DxCrossRefBm1709821116)). Otherwise, the physical separation of the HUD and head-down fields of view and the difference in accommodation (that is, focal distance) would hinder timely pilot awareness of visual alerts displayed head-down. d. While a pilot is using the HUD, if the master alerting indications are not visible or attention-getting, the HUD needs to display alerts that provide the pilot with timely notification of Caution conditions, Warning conditions, or both. e. [CS 25.1322(e)](#_DxCrossRefBm1709821114) requires visual alert indications on monochromatic displays to use coding techniques so the flight crew can clearly distinguish between Warning, Caution, and Advisory alerts. Since monochromatic HUDs are incapable of using colours to distinguish among Warning, Caution, and Advisory information, other visual display features (coding techniques) are necessary, such as shape, location, texture, along with the appropriate use of attention-getting properties such as flashing, outline boxes, brightness, and size. The use of these visual display features should be consistent within the set of flight deck displays, so that the intended meaning is clearly and unmistakably conveyed. For example, Time-critical warnings might be boldly displayed in a particular central location on the HUD, while less critical alerts, if needed, would be displayed in a different manner. f. For multi-colour HUDs, the display of Warning and Caution alerts should be consistent with HDD PFD presentations. g. Pilot flying and pilot monitoring roles should account for the use of HUDs to ensure timely awareness of certain alerts, especially because of field of view factors. (1) For single-HUD installations, when the pilot flying is using the HUD, the other pilot should be responsible for monitoring the head-down instruments and alerting systems for system failures, modes, and functions that are not displayed on the HUDs. (2) For dual-HUD installations there needs to be greater reliance on master alerting indications that are capable of directing each pilot’s attention to non-HUD alerts when both HUDs are in use. If master alerting indications do not provide sufficient attention to each pilot while using the HUD, then each HUD should provide annunciations that direct the pilot’s attention to HDDs. The types of information that should trigger the HUD master alerting display are any Cautions or Warnings not already duplicated on the HUD from the HDD. [Amdt 25/11]