AMC 25-11 Electronic Flight Deck Displays

ED Decision 2020/024/R

Chapter 1 Background

Chapter 2 Electronic Display System Overview

Chapter 3 Electronic Display Hardware

Chapter 4 Safety Aspects of Electronic Display Systems

Chapter 5 Electronic Display Information Elements and Features

Chapter 6 Organising Electronic Display Information Elements

Chapter 7 Electronic Display System Control Devices

Chapter 8 Showing Compliance for Approval of Electronic Display Systems

Chapter 9 Continued Airworthiness and Maintenance

List of Appendices

CHAPTER 1 BACKGROUND

1.       What is the purpose of this AMC?

This AMC provides an Acceptable Means of Compliance for demonstrating compliance with certain Certification Specifications of CS-25, as well as general guidance for the design, installation, integration, and approval of electronic flight deck displays, components, and systems installed in large aeroplanes.

Appendix 1 to this AMC provides additional guidance for displaying primary flight information (required by CS 25.1303(b) and CS 25.1333(b)), and Appendix 2 to this AMC provides additional guidance for powerplant displays.

2.       Who does this AMC apply to?

a.       The acceptable means of compliance and guidance provided in this document is directed to aeroplane and avionics manufacturers, modifiers, and operators of large aeroplanes.

b.       This material describes acceptable means, but not the only means, for demonstrating compliance with the applicable certification specifications. The Agency will consider other methods of demonstrating compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive Agency and industry experience in determining compliance with the relevant certification specifications. Applicants for a European Technical Standard Order (ETSO) approval should consider following this AMC when the ETSO does not provide adequate or appropriate specifications.

3.       [RESERVED]

4.       General

This AMC applies to the design, integration, installation, and certification approval of electronic flight deck displays, components, and systems for large aeroplanes. As a minimum this includes:

—          General airworthiness considerations,

—          Display system and component characteristics,

—          Safety and criticality aspects,

—          Functional characteristics,

—          Display information characteristics,

—          Guidance to manage display information,

—          Flight crew interface and interactivity, and

—          Airworthiness approval (means of compliance) considerations.

Table 1, below, lists the topics included in this AMC. Table 2, below, lists the topics not included in this AMC.

Table 1: Topics Covered in this AMC

Table 2: Topics Outside this AMC

In addition to this AMC, new AMC 25.1302 published in CS-25 Amendment 3, provides acceptable means of compliance with certification specifications associated with the design of flight crew interfaces such as displays, indications, and controls. AMC 25.1322 provides a means of compliance for flight crew alerting systems. The combination of these AMCs is intended to embody a variety of design characteristics and human-centred design techniques that have wide acceptance, are relevant, and can be reasonably applied to large aeroplane certification projects.

Other advisory material is used to establish guidance for specific functionality and characteristics provided by electronic displays. This AMC is not intended to replace or conflict with these existing AMCs but rather provides a top-level view of flight deck displays. Conflicts between this AMC and other advisory material will be resolved on a case-by-case basis in agreement with the Agency.

5.       Definitions of Terms Used in this AMC

a.       For the purposes of this AMC, a “display system” includes not only the display hardware and software components but the entire set of avionic devices implemented to display information to the flight crew. Hardware and software components of other systems that affect displays, display functions, or display controls should take into account the display aspects of this AMC. For example, this AMC would be applicable to a display used when setting the barometric correction for the altimeter, even though the barometric set function may be part of another system.

b.       For the purposes of this AMC, “foreseeable conditions” means the full environment in which the display or the display system is assumed to operate, given its intended function. This includes operating in normal, non-normal, and emergency conditions.

c.       Definitions of technical terms used in this AMC can be found in Appendix 3 of this AMC. The acronyms used throughout this document are included in Appendix 4 of this AMC.

6.       Background

a.       Electronic displays can present unique opportunities and challenges to the design and certification process. In many cases, the demonstration of compliance with Certification Specifications related to the latest flight deck display system capabilities has been subject to a great deal of interpretation by applicants and the Agency. At the time the first electronic displays were developed, they were direct replacements for the conventional electromechanical components. The initial release of AMC 25-11 established an Acceptable Means of Compliance for the approval of Cathode Ray Tube (CRT)-based electronic display systems used for guidance, control, or decision-making by the flight crews of large aeroplanes. This initial release was appropriate for CRTs, but additional specifications were needed to update AMC 25-11 to address new technologies. Additional appendices have been added to address Head-Up Displays (Appendix 6) and Weather Displays (Appendix 7).

b.       The FAA and EASA have established a number of specifications intended to improve aviation safety by requiring that the flight deck design have certain capabilities and characteristics. The approval of flight deck displays and display systems has typically been addressed by invoking many specifications that are specific to certain systems, or to specifications with general applicability such as CS 25.1301(a), CS 25.771(a), and CS 25.1523. Thus, this AMC provides acceptable means of compliance and guidance related to these and other applicable airworthiness specifications.

7. - 10. [RESERVED]

CHAPTER 2 ELECTRONIC DISPLAY SYSTEM OVERVIEW

11.     General

The following paragraphs provide acceptable means of compliance and guidance that applies to the overall electronic display system. This chapter, together with Chapters 3 through 7 of this AMC, provides compliance objectives and design guidance. Chapter 8 provides general guidance on how to show compliance for approval of electronic display systems. The material in Chapters 2 through 9 and Appendices 1 and 2 of this AMC constitutes an overall method of compliance for the approval of an electronic display system.

a.       Design Philosophy.

The applicant should establish, document, and follow a design philosophy for the display system that supports the intended functions (CS 25.1301). The documented design philosophy may be included as part of a system description, certification programme, or other document that is submitted to the Agency during a certification project. The design philosophy should include a high level description of:

(1)     General philosophy of information presentation – for example, is a “quiet, dark” flight deck philosophy used or is some other approach used?

(2)     Colour philosophy on the electronic displays – the meaning and intended interpretation of different colours – for example, does magenta always represent a constraint?

(3)     Information management philosophy – for example, when should the pilot take an action to retrieve information or is it brought up automatically? What is the intended interpretation of the location of the information?

(4)     Interactivity philosophy - for example, when and why is pilot confirmation of actions requested? When is feedback provided?

(5)     Redundancy management philosophy – for example, how are single and multiple display failures accommodated? How are power supply and data bus failures accommodated?

b.       Human Performance Considerations.

The applicant should establish and document the following human performance elements when developing a display system:

—         Flight crew workload during normal and non-normal operations, including emergencies,

—         Flight crew training time to become sufficiently familiar with using the display, and

—         The potential for flight crew error.

A high workload or excessive training time may indicate a display design that is difficult to use, requires excessive concentration, or may be prone to flight crew errors. Compliance considerations are included in Chapter 8 of this AMC.

c.       Addressing Intended Function in the Certification Programme

The certification programme should identify the appropriate CS-25 certification specifications. An important part of the certification programme will be the system description(s) and all intended functions, including attitude, altitude, airspeed, engine parameters, horizontal situation display, etc. To demonstrate compliance with CS 25.1301(a), an applicant must show that the design is appropriate for its intended function. The applicant’s description of intended function needs to be sufficiently specific and detailed for the Agency to be able to evaluate that the system is appropriate to its intended function. (CS 25.1302 and associated AMC provide additional information on intended function). General and/or ambiguous intended function descriptions are not acceptable (for example, a function described only as “situation awareness”). Some displays may be intended to be used for situation awareness, but that term needs to be clarified or qualified to explain what type of specific situation awareness will be provided. More detailed descriptions may be warranted for designs that are new, novel, highly integrated, or complex. Many modern displays have multiple functions and applicants should describe each intended function. A system description is one place to document the intended function(s).

Display systems and display components that are not intended for use by the flight crew (such as maintenance displays) should not interfere with the flying duties of the flight crew.

12 - 15.        [RESERVED]

CHAPTER 3 ELECTRONIC DISPLAY HARDWARE

16.     Display Hardware Characteristics

The following paragraphs provide general guidance and a means of compliance for electronic display hardware with respect to its basic visual, installation, and power bus transient handling characteristics. A more detailed set of display hardware characteristics can be found in the following SAE International (formerly the Society of Automotive Engineers) documents:

—          For electronic displays – SAE Aerospace Standards (AS) 8034B, '''Minimum Performance Standard for Airborne Multipurpose Electronic Displays'''.

—          For head up displays - SAE AS8055, “Minimum Performance Standard for Airborne Head Up Display (HUD)”.

—          For liquid crystal displays (LCDs) – SAE Aerospace Recommended Practice (ARP) 4256A, “Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft”.

NOTE 1: For LCDs, the quantitative criterion in SAE ARP 4256A, paragraph 4.2.6., equation 5, is not considered a reliable predictor of acceptable specular reflectivity characteristics. Accordingly, this aspect of LCD performance should be specifically assessed via flight crew evaluation to establish that there are not internal or external reflections that can result in flight crew distraction or erroneous interpretation of displayed information.

NOTE 2: With regard to the criteria for malfunction indication in SAE ARP 4256A, paragraph 3.4, the Agency has determined that showing the fonts and symbols to be tolerant to the loss of a single column, line, or element is an acceptable alternative to providing a malfunction indication. Proposed designs that do not use fonts and symbols that are tolerant to these faults are acceptable if they meet the criteria in SAE ARP 4256A.

NOTE 3: The applicant should notify the Agency if any visual display characteristics do not meet the guidelines in the applicable SAE documents.

NOTE 4: The most recent revision of the referenced SAE documents should be considered. If there is a conflict between the guidance in an SAE document and AMC 25-11, follow the guidance in AMC 25-11.

a.       Visual Display Characteristics

The visual display characteristics of a flight deck display are directly linked to their optical characteristics. Display defects (for example, element defects or stroke tails) should not impair readability of the display or create erroneous interpretation. In addition to the information elements and features identified in Chapter 5 of this AMC, and the visual characteristics in SAE ARP 4256A, SAE AS 8034B, and 8055 described above, the display should meet the criteria for the following characteristics. These characteristics are independent of the proposed display technology.

(1)     Physical Display Size. A display should be large enough to present information in a form that is usable (for example, readable or identifiable) to the flight crew from the flight crew stationin all foreseeable conditions, relative to the operational and lighting environment and in accordance with its intended function(s).

(2)     Resolution and Line Width. The resolution and minimum line width should be sufficient to support all the displayed images such that the displayed information is visible and understandable without misinterpretation from the flight crew station in all foreseeable conditions, relative to the operational and lighting environment.

(3)     Luminance. Information should be readable over a wide range of ambient illumination under all foreseeable conditions relative to the operating environment, including but not limited to:

—         Direct sunlight on the display,

—         Sunlight through a front window illuminating white shirts (reflections),

—         Sun above the forward horizon and above a cloud deck in a flight crew member’s eyes, and

—         Night and/or dark environment.

(a)     For low ambient conditions, the display should be dimmable to levels allowing for the flight crew’s adaptation to the dark, such that outside vision and an acceptable presentation are maintained.

(b)     Automatic luminance adjustment systems can be employed to decrease pilot workload and increase display life. Operation of these systems should be satisfactory over a wide range of ambient light conditions, including the extreme cases of a forward low sun and a quartering rearward sun shining directly on the display.

1.       Some manual adjustment should be retained to provide for normal and non-normal operating differences so that the luminance variation is not distracting and does not interfere with the flight crew’s ability to perform their tasks.

2.       Displays or layers of displays with uniformly filled areas conveying information such as weather radar imagery should be independently adjustable in luminance from overlaid symbology. The range of luminance control should allow detection of colour differences between adjacent small filled areas no larger than 5 milliradians in principal dimension; while at this setting, overlying map symbology, if present, should be discernible.

(c)      Display luminance variation within the entire flight deck should be minimised so that displayed symbols, lines, or characters of equal luminance remain uniform under any luminance setting and under all foreseeable operating conditions.

(4)     Contrast Ratio

(a)     The display’s contrast ratio should be sufficient to ensure that the information is discernable under the whole ambient illumination range from the flight crew station under all foreseeable conditions relative to the operating environment.

(b)     The contrast between all symbols, characters, lines, and their associated backgrounds should be sufficient to preclude confusion or ambiguity of any necessary information.

(5)     Chromaticity

(a)     The display chromaticity differences, in conjunction with luminance differences, should be sufficient to allow graphic symbols to be discriminated from each other, from their backgrounds (for example, external scene or image background) and background shaded areas, from the flight crew station, in all foreseeable conditions relative to the lighting environment. Raster or video fields (for example, non-vector graphics such as weather radar) should allow the image to be discriminated from overlaid symbols, and should allow the desired graphic symbols to be displayed. See SAE AS 8034A, sections 4.3.3 and 4.3.4, for additional guidance.

(b)     The display should provide chromaticity stability over the foreseeable conditions relative to the range of operating temperatures, viewing envelope, image dynamics, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.

(6)     Grey Scale

(a)     The number of shades of gray and the difference between shades of gray that the display can provide should be adequate for all image content and its use, and should accommodate all viewing conditions.

(b)     The display should provide sufficient gray scale stability over the foreseeable range of operating temperatures, viewing envelope, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.

(7)     Display Response. The dynamic response of the display should be sufficient to present discernable and readable information that is not misleading, distracting, or confusing. The response time should be sufficient to ensure dynamic stability of colours, line widths, gray scale, and relative positioning of symbols. Undesirable display characteristics, such as smearing of moving images and loss of luminance, should be minimised so that information is still readable and identifiable under all foreseeable conditions, not distracting, and does not lead to misinterpretation of data.

(8)     Display Refresh Rate. The display refresh rate should be sufficient to prevent flicker effects that result in misleading information or difficulty in reading or interpreting information. The display refresh rate should be sufficient to preclude the appearance of unacceptable flicker.

(9)     [RESERVED]

(10)   Display Defects. Display defects, such as element defects and stroke tails, resulting from hardware and graphical imaging causes should not impair readability of the displays or induce or cause erroneous interpretation. This is covered in more detail in SAE ARP 4256A, SAE AS 8034B, and 8055.

(11)    [RESERVED]

(12)             Flight Deck Viewing Envelope. The size of the viewing envelope should provide visibility of the flight deck displays over the flight crew’s normal range of head motion, and support cross-flight deck viewing if necessary; for example, when it is required that the captain be able to view and use the first officer’s primary flight information.

b.       Installation

(1)     Flight deck display equipment and installation designs should be compatible with the overall flight deck design characteristics (such as flight deck size and shape, flight crew member position, position of windows, external luminance, etc.) as well as the aeroplane environment (such as temperature, altitude, electromagnetic interference, and vibration).

(2)     European Organisation for Civil Aviation Electronics (EUROCAE) ED-14 Environmental Conditions and Test Procedures for Airborne Equipment, at the latest revision, provides information that may be used for an acceptable means of qualifying display equipment for use in the aeroplane environment.

(3)     [RESERVED]

(4)     The installation of the display equipment must not adversely affect its readability and the external scene visibility of the flight crew under all foreseeable conditions relative to the operating and lighting environment (CS 25.1321(a), CS 25.773(a)(1)).

(5)     The installation of the display equipment must not cause glare or reflection, either on the displays or on the flight deck windows, that could interfere with the normal duties of the minimum flight crew (CS 25.773(a)(2)) under all foreseeable conditions.

(6)     If the display system design is dependent on cross-flight deck viewing for its use, the installation should take into account the viewing angle limitations of the display units, the size of the displayed information, and the distance of the display from each flight crew member.

(7)     When a display is used to align or overlay symbols with real-world external data (for example, HUD symbols), the display should be installed such that the positioning accuracy of these symbols is maintained during all phases of flight. Appendix 6 to this AMC and SAE ARP 5288, Transport Category Aeroplane Head Up Display (HUD) Systems, provides additional details regarding the symbol positioning accuracy for conformal symbology on an HUD.

(8)     The display system components should not cause physical harm to the flight crew under foreseeable conditions relative to the operating environment (for example, turbulence or emergency egress, bird strike, hard landing, and emergency landing).

(9)     The installed display must not visually obstruct other controls and instruments or prevent those controls and instruments from performing their intended function (CS 25.1301).

(10)    The display system must not be adversely susceptible to electromagnetic interference from other aeroplane systems (CS 25.1431) under all foreseeable conditions.

(11)    The display components should be installed in such a way that they retain mechanical integrity (secured in position) for all foreseeable conditions relative to the flight environment.

(12)    Liquid spill on or breakage of a display system component in the flight deck should not result in a hazard.

c.       Power Bus Transient. EUROCAE document ED-14, at the latest revision, provides information that may be used for an acceptable means of qualifying display equipment such that the equipment performs its intended function when subjected to anomalous input power. SAE ARP 4256A, Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft, provides additional information for power transient recovery (specifically for the display unit).

(1)     Flight deck displays and display systems should be insensitive to power transients caused by normal load switching operation of the aeroplane, in accordance with their intended function.

(2)     The electronic attitude display should not be unusable or unstable for more than one second after electrical bus transients due to engine failure. Only displays on one side of the aeroplane should be affected by an engine failure. Recognisably valid pitch and roll data should be available within one second on the affected displays and any effects lasting beyond one second should not interfere with the ability to obtain quick glance valid attitude. For most aeroplanes an engine failure after take-off will simultaneously create a roll acceleration, new pitch attitude requirements, and an electrical transient. Attitude information is paramount; if there is an engine failure, transfer to standby attitude or transfer of control of the aeroplane to the other pilot cannot be reliably accomplished in a timely enough manner to prevent an unsafe condition. In testing this failure mode, experience has shown that switching the generator off at the control panel may not result in the longest electrical transient. One practical way to simulate this failure is with a fuel cut which will allow the generator output voltage and frequency to decrease until the bus control recognises the failure. Other engine failure conditions may be more critical (such as sub-idle stalls) which cannot be reasonably evaluated during flight test. Analysis should identify these failure modes and show that the preceding criteria are met.

(3)     Non-normal bus transients (for example, generator failure) should not initiate a power up initialisation or cold start process.

(4)     The display response to a short term power interrupt (<200 milliseconds) should be such that the intended function of the display is not adversely affected.

(5)     Following in-flight long term power interrupts (>200 milliseconds), the display system should quickly return to operation in accordance with its intended function, and should continue to permit the safe control of the aeroplane in attitude, altitude, airspeed, and direction.

(6)     The large electrical loads required to restart some engine types should not affect more than one pilot’s display during the start sequence.

17. – 20.      [RESERVED]

CHAPTER 4. SAFETY ASPECTS OF ELECTRONIC DISPLAY SYSTEMS

21.     General. This chapter provides additional guidance and interpretative material for applying CS 25.1309 and CS 25.1333(b) to the approval of display systems. Using electronic displays and integrated modular avionics allows designers to integrate systems to a much higher degree than was practical with previous flight deck components. Although operating the aeroplane may become easier as a result of the integration, evaluating the conditions in which the display system could fail and determining the severity of the resulting failure effects may become more complex. The evaluation of the failure conditions should identify the display function and include all causes that could affect that function’s display and display equipment. CS 25.1309 defines the basic safety specifications for the airworthiness approval of aeroplane systems

a.       Identification of Failure Conditions. One of the initial steps in establishing compliance with CS 25.1309 is identifying the failure conditions that are associated with a display or a display system. The following paragraphs provide material that may be useful in supporting this initial activity. The analysis of the failure condition should identify the impacted functionality, the effect on the aeroplane and/or its occupants, any considerations related to phase of flight, and identify any flight deck indication, flight crew action, or other relevant mitigation means.

(1)     The type of display system failure conditions will depend, to a large extent, on the architecture (Integrated Modular Avionics, Federated System, Non-Federated System, etc.), design philosophy, and implementation of the system. Types of failure conditions include:

—         Loss of function (system or display).

—         Failure of display controls – loss of function or malfunction such that controls perform in an inappropriate manner, including erroneous display control.

—         Malfunction (system or display) that leads to:

—          Partial loss of data, or

—          Erroneous display of data that is either:

—         Detected by the system (for example, flagged or comparator alert), and/or easily detectable by the flight crew; or

—         Difficult to detect by the flight crew or not detectable and assumed to be correct (for example, “Misleading display of ….”).

(2)     When a flight deck design includes primary and standby displays, consider failure conditions involving the failure of standby displays in combination with the failure of primary displays. The flight crew may use standby instruments in two complementary roles following the failure of primary displays:

(a)     Redundant display to cope with failure of main instruments, or

(b)     Independent third source of information to resolve inconsistencies between primary instruments.

(3)     When the display of erroneous information is caused by failure of other systems which interface with the display system, the effects of these failures may not be limited to the display system. Associated failure conditions may be dealt with at the aeroplane level or within the other systems’ safety assessment, as appropriate, in order to assess the cumulative effect.

b.       Effects of Display Failure Conditions. The effects of display system failure conditions on safe operations are highly dependent on pilot skills, flight deck procedures, phase of flight, type of operations being conducted, and instrument or visual meteorological conditions.

(1)     Based on previous aeroplane certification programmes, paragraph 21e of this AMC shows examples of safety objectives for certain failure conditions. These safety objectives do not preclude the need for a safety assessment of the actual effects of these failures, which may be more or less severe depending on the design. Therefore, during the CS 25.1309 safety assessment process, the Agency will need to agree with the applicant’s hazard classifications for these failure conditions in order for the assessment to be considered valid.

(2)     When assessing the effects that result from a display failure, consider the following, accounting for phases of flight when relevant:

—         Effects on the flight crew’s ability to control the aeroplane in terms of attitude, speed, accelerations, and flight path, potentially resulting in:

—          Controlled flight into terrain,

—          Loss of control of the aeroplane during flight and/or during critical flight phases (approach, take-off, go-around, etc.),

—          Inadequate performance capability for phase of flight, including:

—         Loss of obstacle clearance capability, and

—         Exceeding take-off or landing field length.

—          Exceeding the flight envelope,

—          Exceeding the structural integrity of the aeroplane, and

—          Causing or contributing to pilot induced oscillations.

—         Effects on the flight crew’s ability to control the engines, such as:

—          Those effects resulting in shutting down a non-failed engine in response to the failure of a different engine, and

—          Undetected, significant thrust loss.

—         Effects on the flight crew’s management of the aeroplane systems.

—         Effects on the flight crew’s performance, workload and ability to cope with adverse operating conditions.

—         Effects on situation awareness; for example, the specific effects must be identified, such as situation awareness related to navigation or system status.

—         Effects on automation if the display is used as a controlling device.

(3)     When the display system is used as a control device for other aeroplane systems, consider the cumulative effect of a display system failure on all of the controlled systems.

c.       Mitigation of Failure Conditions

(1)     When determining mitigation means for a failure condition consider the following:

—         Protection against common mode failures.

—         Fault isolation and reconfiguration.

—         Redundancy (for example, heading information may be provided by an independent integrated standby and/or a magnetic direction indicator).

—         Availability of, level of, timeliness of, and type of, alert provided to the flight crew.

—         The flight phase and the aircraft configuration.

—         The duration of the condition.

—         The aircraft motion cues that may be used by the flight crew for recognition.

—         Expected flight crew corrective action on detection of the failure, and/or operational procedures.

—         In some flight phases, ability of the flight crew to control the aeroplane after a loss of primary attitude display on one side.

—         The flight crew’s ability to turn off a display (for example, full bright display at night).

—         Protections provided by other systems (for example, flight envelope protection or augmentation systems).

(2)     The mitigation means should be described in the safety analysis/assessment document or by reference to another document (for example, a system description document). The continued performance of the mitigation means, in the presence of the failure conditions, should also be identified and assured.

(3)     The safety assessment should include the rationale and coverage of any display system protection and monitoring philosophies used in the design. The safety assessment should also include an evaluation of each of the identified display system failure conditions and an analysis of the exposure to common mode/cause or cascade failures in accordance with AMC 25.1309. Additionally, the safety assessment should justify and describe any functional partitioning schemes employed to reduce the effect of integrated component failures or functional failures.

d.       Validation of the Classification of Failure Conditions and Their Effects.

There may be situations where the severity of the effect of the failure condition identified in the safety analysis needs to be confirmed. Laboratory, simulator, or flight test may be appropriate to accomplish the confirmation. The method of validating the failure condition classification will depend on the effect of the condition, assumptions made, and any associated risk. If flight crew action is expected to cope with the effect of a failure condition, the information available to the flight crew should be useable for detection of the failure condition and to initiate corrective action.

e.       System Safety Guidelines

(1)     Experience from previous certification programmes has shown that a single failure due to a loss or malfunction of the display system, a sensor, or some other dependent system, which causes the misleading display of primary flight information, may have negative safety effects. It is recommended that the display system design and architecture implement monitoring of the primary flight information to reduce the probability of displaying misleading information.

(2)     Experience from previous certification programmes has shown that the combined failure of both primary displays with the loss of the standby system can result in failure conditions with catastrophic effects.

(3)     When an integrated standby display is used to provide a backup means of primary flight information, the safety analysis should substantiate that common cause failures have been adequately addressed in the design, including the design of software and complex hardware. In particular, the safety analysis should show that the independence between the primary instruments and the integrated standby instruments is not violated becausethe integrated standby display may interface with a large number of aeroplane components, including power supplies, pitot static ports, and other sensors.

(4)     There should be a means to detect the loss of or erroneous display of primary flight information, either as a result of a display system failure or the failure of an associated sensor. When loss or malfunction of primary flight information is detected, the means used to indicate the lost or erroneous information should ensure that the erroneous information will not be used by the flight crew (for example, removal of the information from the display or placement of an “X” through the failed display).

(5)     The means used to indicate the lost or erroneous information, when it is detected, should be independent of the failure mechanism. For example, the processor that originates the erroneous parameter should not be the same processor that annunciates or removes the erroneous parameter from the display. Common mode failures of identical processor types should be considered (for example, common mode failures may exist in a processor used to compute the display parameters and an identical processor used for monitoring and annunciating failures.)

(6)     A catastrophic failure condition should not result from the failure of a single component, part, or element of a system. Failure containment should be provided by the system design to limit the propagation of the effects of any single failure and preclude catastrophic failure conditions. In addition, there should not be a common cause failure that could affect both the single component, part, or element and its failure containment provisions.

(7)     For safety-critical display parameters, there should be a means to verify the correctness of sensor input data. Range, staleness, and validity checks should be used where possible.

(8)     The latency period induced by the display system, particularly for alerts, should not be excessive and should take into account the criticality of the alert and the required crew response time to minimise propagation of the failure condition.

(9)     For those systems that integrate windowing architecture into the display system, a means should be provided to control the information shown on the displays, such that the integrity of the display system as a whole will not be adversely impacted by anomalies in the functions being integrated. This means of controlling the display of information, called window manager in this AMC, should be developed to the software assurance level at least as high as the highest integrity function of any window. For example, a window manager should be level “A” if the information displayed in any window is level “A” (see AMC 20-115 Software Considerations for Airborne Systems and Equipment Certification). SAE ARP 4754A/EUROCAE ED-79A, Guidelines for development of civil aircraft and systems, provides a recommended practice for system development assurance.

(10)    System Safety Assessment Guidelines.The complete set of failure conditions to be considered in the display system safety analysis and the associated safety objective are established during the system safety assessment, and agreed upon by the applicant and the approving civil airworthiness agency. The safety assessment should consider the full set of display system intended functions as well as display system architecture and design philosophy (for example, failure modes, failure detection and annunciation, redundancy management, system and component independence and isolation). The system safety analysis is required by CS 25.1309, and indirectly by other specifications, including CS 25.901, CS 25.903, and CS 25.1333.

The following tables provide examples of failure conditions and associated safety objectives common to numerous display systems that are already certified. These tables are provided to identify a set of failure conditions that need to be considered; however, these are only examples. These examples do not replace the need for a system safety assessment and are not an exhaustive list of failure conditions. For these example failure conditions, additional functional capabilities or less operational mitigation may result in higher safety objectives, while reduced functional capability or increase operational mitigation may result in lower safety objectives.

1        Attitude (Pitch and Roll). The following table lists examples of safety objectives for attitude related failure conditions.

Table 3 Example Safety Objectives for Attitude Failure Conditions

Notes

(1)     System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2)     Consistent with the “Loss of all attitude display, including standby display” safety objective, since the flight crew may not be able to identify the correct display. Consideration will be given to the ability of the flight crew to control the aeroplane after a loss of attitude primary display on one side in some flight phases (for example, during take-off).

2        Airspeed. The following table lists examples of safety objectives for airspeed related failure conditions.

Table 4 Example Safety Objectives for Airspeed Failure Conditions

Notes

(1)     System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2)     Consistent with the “Loss of all airspeed display, including standby display” safety objective, since the flight crew may not be able to separate out the correct display.

3        Barometric Altitude. The following table lists examples of safety objectives for barometric altitude related failure conditions.

Table 5 Example Safety Objectives for Barometric Altitude Failure Conditions

Notes

(1)     System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2)     Consistent with the “Loss of all barometric altitude display, including standby display” safety objective since the flight crew may not be able to separate out the correct display. Consideration should be given that barometric setting function design is commensurate with the safety objectives identified for barometric altitude.

4        Heading. The following table lists examples of safety objectives for heading related failure conditions.

(aa)    The standby heading may be provided by an independent integrated standby or the magnetic direction indicator.

(bb)   The safety objectives listed below can be alleviated if it can be demonstrated that track information is available and correct.

Table 6 Example Safety Objectives for Heading Failure Conditions

Notes

(1)     System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2)     This assumes the availability of an independent, heading required by CS 25.1303(a)(3).

5        Navigation and Communication (Excluding Heading, Airspeed, and Clock Data). The following table lists examples of safety objectives for navigation and communication related failure conditions.

Table 7 Example Safety Objectives for Certain Navigation and Communication Failure Conditions

Note

(1)     “All” means loss of all navigation information, excluding heading, airspeed, and clock data. If any or all of the latter information is also lost then a higher classification may be warranted.

6        Other Parameters (Typically Shown on Electronic Display Systems). The following table lists examples of safety objectives for failure conditions related to other parameters typically shown on electronic display systems.

Table 8 Example Safety Objectives for Failure Conditions of Other Parameters

Notes

(1)     The safety objective may be more stringent depending on the use and on the phase of flight

(2)     Applicable to the display part of the system only.

(3)     See also AMC 25.1322.

(4)     To be evaluated depending on the particular procedures and associated situations.

7        Engine. Table 9, below, lists examples of generally accepted safety objectives for engine related failure conditions. Appendix 2 of this AMC provides additional guidance for powerplant displays.

(aa)    The term “required engine indications” refers specifically to the engine thrust/power setting parameter (for example, engine pressure ratio, fan speed, or torque) and any other engine indications that may be required by the flight crew to maintain the engine within safe operating limits (for example, rotor speeds or exhaust gas temperature).

(bb)   The information in Table 9 is based on the premise that the display failure occurs while operating in an autonomous engine control mode. Autonomous engine control modes, such as those provided by full authority digital engine controls, protect continued safe operation of the engine at any thrust lever setting. Hence, the flight deck indications and associated flight crew actions are not the primary means of protecting safe engine operation.

(cc)    Where the indications serve as the primary means of assuring continued safe engine operation, the hazard classification may be more severe. For example, under the table entry “Loss of one or more required engine indications on more than one engine,” the hazard classification would change to “Catastrophic” and the probability would change to “Extremely Improbable.”

(dd)   Each of the general failure condition descriptions provided in Table 9 represents a set of more specific failure conditions. The hazard classifications and probabilities provided in Table 9 represent the most severe outcome typically associated with any failure condition within the set. If considered separately, some of the specific failure conditions within each set would likely have less severe hazard classifications and probabilities.

Table 9 Example Safety Objectives for Engine Failure Conditions

Notes

(1)     The worst anticipated outcomes associated with this class of failure may often be driven by consideration of the simultaneous loss of all required engine indications. In any case, those outcomes will typically include both a high speed take-off abort and loss of the backup means to assure safe engine operations. High speed aborts have typically been classified as “hazardous” by the Agency due to the associated impacts on both flight crew workload and safety margins. Since any number of single failures or errors can defeat the protections of a typical autonomous engine control, losing the ability to backup the control is considered a sufficiently large reduction in the safety margins to also warrant a “hazardous” classification. Hence the “Extremely Remote” design guideline was chosen.

(2)     If the power setting parameter is indicating higher than actual during take-off, this can lead directly to a catastrophe, either due to a high speed runway overrun or impacting an obstacle after take-off. This classification has been debated and sustained by the Agency numerous times in the past. Hence the “Extremely Improbable” probability is listed.

8        Use of Display Systems as Controls. Hazard classifications and safety objectives are not provided for display systems used as controls because the failure conditions are dependant on the functions and systems being controlled or on alternative means of control. The use of display systems as controls is described in Chapter 7 of this AMC. The following table lists the failure conditions when display systems are used as controls.

Table 10 Failure Conditions for Display Systems Used as Controls

22.– 30.       [RESERVED]

CHAPTER 5 ELECTRONIC DISPLAY INFORMATION ELEMENTS AND FEATURES

31.     Display Information Elements and Features. This chapter provides guidance for the display of information elements including text, labels, symbols, graphics, and other depictions (such as schematics) in isolation and in combination. It covers the design and format of these information elements within a given display area. Chapter 6 of this AMC covers the integration of information across several display areas in the flight deck, including guidance on flight deck information location, display arrangement, windowing, redundancy management, and failure management.

a.       General

(1)     The following list provides objectives for each display information element, in accordance with its intended function:

—         Each flight, navigation, and powerplant instrument for use by any pilot must be plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path (CS 25.1321(a)).

—         The displayed information should be easily and clearly discernable, and have enough visual contrast for the pilot to see and interpret it. Overall, the display should allow the pilot to identify and discriminate the information without eyestrain. Refer to paragraph 16a(4) of this AMC for additional guidance regarding contrast ratio.

—         For all display configurations, all foreseeable conditions relative to lighting should be considered. Foreseeable lighting considerations should include failure modes such as lighting and power system failure, the full range of flight deck lighting and display system lighting options, and the operational environment (for example, day and night operations). If a visual indicator is provided to indicate a malfunction of an instrument, it must be effective under all foreseeable lighting conditions (CS 25.1321(e)).

—         Information elements (text, symbol, etc.) should be large enough for the pilot to see and interpret in all foreseeable conditions relative to the operating environment and from the flight crew station. If two or more pilots need to view the information, the information elements should also be discernable and interpretable over these viewing distances.

—         The pilots should have a clear, unobstructed, and undistorted view of the displayed information.

—         Information elements should be distinct and permit the pilots to immediately recognise the source of the information elements when there are multiple sources of the same kind of information. For example, if there are multiple sources for vertical guidance information, then each informational element should be distinct so the flight crew can immediately recognise the source of the vertical guidance.

(2)     Factors to consider when designing and evaluating the viewability and readability of the displayed information include:

—         Position of displayed information: Distance from the design eye position (DEP) is generally used. If cross-flight deck viewing of the information is needed, distance from the offside DEP, accounting for normal head movement, should be used. For displays not mounted on the front panel, the distance determination should include any expected movement away from the DEP by the flight crew.

—         Vibrations: Readability should be maintained in adverse conditions, such as vibration. One possible cause of vibration is sustained engine imbalance. AMC 25-24, Sustained Engine Imbalance, provides readability guidance for that condition.

—         Visual Angles: Account for both the position of the displayed information as well as font height. SAE ARP 4102/7, Electronic Displays, provides additional information on this subject.

—         Readability of Display Information: The Illuminating Engineering Society classifies three main parameters that affect readability: luminance, size, and contrast. Size is the combination of font size and distance from the display.

b.       Consistency. Display information should be presented so it is consistent with the flight deck design philosophy in terms of symbology, location, control, behaviour, size, shape, colour, labels, dynamics and alerts. Consistency also applies to the representation of information on multiple displays on the same flight deck. Display information representing the same thing on more than one display on the same flight deck should be consistent. Acronyms and labels should be used consistently, and messages/annunciations should contain text in a consistent way. Inconsistencies should be evaluated to ensure that they are not susceptible to confusion or errors, and do not adversely impact the intended function of the system(s) involved.

c.       Display Information Elements

(1)     Text.Text should be shown to be distinct and meaningful for the information presented. Messages should convey the meaning intended. Abbreviations and acronyms should be clear and consistent with established standards. For example, International Civil Aviation Organization (ICAO) document 8400, Procedures for Air Navigation Services ICAO Abbreviations and Codes, provides internationally recognised standard abbreviations and airport identifiers.

(a)     Regardless of the font type, size, colour, and background, text should be readable in all foreseeable lighting and operating conditions from the flight crew station (CS 25.1321(a)). General guidelines for text are as follows:

—          Standard grammatical use of upper and lower case letters is recommended for lengthy documentation and lengthy messages. Using this format is also helpful when the structure of the text is in sentence form.

—          The use of only upper case letters for text labels is acceptable.

—          Break lines of text only at spaces or other natural delimiters.

—          Avoid abbreviations and acronyms where practical.

—          SAE ARP 4102/7, Electronic Displays, provides guidelines on font sizes that are generally acceptable.

(b)     The choice of font also affects readability. The following guidelines apply:

—          To facilitate readability, the font chosen should be compatible with the display technology. For example, serif fonts may become distorted on some low pixel resolution displays. However, on displays where serif fonts have been found acceptable, they have been found to be useful for depicting full sentences or larger text strings.

—          Sans serif fonts (for example, Futura or Helvetica) are recommended for displays viewed under extreme lighting conditions.

(2)     Labels. Labels may be text or icons. The following paragraphs provide guidance on labelling items such as knobs, buttons, symbols, and menus. This guidance applies to labels that are on a display, label a display, or label a display control. CS 25.1555(a) requires that each flight deck control, other than controls whose function is obvious, must be plainly marked as to its function and method of operation. Controls whose functions are not obvious should be marked or identified so that a flight crew member with little or no familiarity with the aeroplane is able to rapidly, accurately, and consistently identify their functions.

(a)     Text and icons should be shown to be distinct and meaningful for the function(s) they label. Standard or non-ambiguous symbols, abbreviations, and nomenclature should be used; for example, in order to be distinct from barometric altitude, any displayed altitude that is geometrically derived should be labelled “GSL.”

(b)     If a control performs more than one function the labels should include all intended functions, unless the function of the control is obvious. Labels of graphical controls accessed via a cursor control device should be included on the graphical display.

(c)      The following are guidelines and recommendations for labels:

—          Data fields should be uniquely identified either with the unit of measurement or a descriptive label. However, some basic “T” instruments have been found to be acceptable without units of measurement.

—          Labels should be consistent with related labels located elsewhere in the flight deck.

—          When a control or indication occurs in multiple places (for example, a “Return” control on multiple pages of a flight management function), the label should be consistent across all occurrences.

(d)     Labels should be placed such that:

—          The spatial relationships between labels and the objects they reference are clear.

—          Labels for display controls are on or adjacent to the controls they identify.

—          Labels for display controls are not obstructed by the associated controls.

—          Labels are oriented to facilitate readability. For example, the labels continuously maintain an upright orientation or align with an associated symbol such as a runway or airway.

—          On multi-function displays, a label should be used to indicate the active function(s), unless its function is obvious. When the function is no longer active or being displayed, the label should be removed unless another means of showing availability of that function is used. For example, greying out an inactive menu button.

(e)     When using icons instead of text labels, only brief exposure to the icon should be needed in order for the flight crew to determine the function and method of operation of a control. The use of icons should not cause flight crew confusion.

(3)     Symbols

(a)     Electronic display symbol appearance and dynamics should be designed to enhance flight crew comprehension and retention, and minimise flight crew workload and errors in accordance with the intended function. The following list provides guidance for symbol appearance and dynamics:

—          Symbols should be positioned with sufficient accuracy to avoid interpretation errors or significantly increase interpretation time.

—          Each symbol used should be identifiable and distinguishable from other related symbols.

—          The shape, dynamics, and other symbol characteristics representing the same function on more than one display on the same flight deck should be consistent.

—          Symbol modifiers used to convey multiple levels of information should follow depiction rules clearly stated by the applicant. Symbol modifiers are changes to easily recognised baseline symbols such as colours, fill, and borders.

—          Symbols that represent physical objects (for example, navigational aids and traffic) should not be misleading as to the object’s physical characteristics (including position, size, envelope, and orientation).

(b)     Within the flight deck, avoid using the same symbol for different purposes, unless it can be shown that there is no potential for misinterpretation errors or increases in flight crew training times.

(c)      It is recommended that standardised symbols be used. The symbols in the following SAE documents have been found to be acceptable for compliance with the regulations:

—          SAE ARP 4102/7, Electronic Displays, Appendices A through C (for primary flight, navigation, and powerplant displays);

—          SAE ARP 5289A, Electronic Aeronautical Symbols, (for depiction of navigation symbology); and

—          SAE ARP 5288, Transport Category Aeroplane Head Up DisplayD) Systems, (for HUD symbology).

(4)     Indications.The following paragraphs provide guidanceon numeric readouts, gauges, scales, tapes and graphical depictions such as schematics. Graphics related to interactivity are discussed in paragraph 31e of this chapter and Chapter 7 of this AMC. Graphics and display indications should:

—         Be readily understood and compatible with other graphics and indications in the flight deck.

—         Be identifiable and readily distinguishable.

—         Follow the guidance for viewability presented in paragraphs 31a, 31b, 31c(1), and 31c(2) of this chapter.

(a)     Numeric Readouts. Numeric readouts include displays that emulate rotating drum readouts where the numbers scroll, as well as displays where the digit locations stay fixed.

1        Data accuracy of the numeric readout should be sufficient for the intended function and to avoid inappropriate flight crew response. The number of significant digits should be appropriate to the data accuracy. Leading zeroes should not be displayed unless convention dictates otherwise (for example, heading and track). As the digits change or scroll, there should not be any confusing motion effects such that the apparent motion does not match the actual trend.

2        When a numeric readout is not associated with any scale, tape, or pointer, it may be difficult for pilots to determine the margin relative to targets or limits, or compare between numeric parameters. A scale, dial, or tape may be needed to accomplish the intended flight crew task.

3        For North, numeric readouts of heading should indicate 360, as opposed to 000.

(b)     Scales, Dials, and Tapes. Scales, dials, and tapes with fixed and/or moving pointers have been shown to effectively improve flight crew interpretation of numeric data.

1        The displayed range should be sufficient to perform the intended function. If the entire operational range is not shown at any given time, the transition to the other portions of the range should not be distracting or confusing.

2        Scale resolution should be sufficient to perform the intended task. Scales may be used without an associated numeric readout if alone they provide sufficient accuracy for the intended function. When numeric readouts are used in conjunction with scales, they should be located close enough to the scale to ensure proper association, yet not detract from the interpretation of the graphic or the readout.

3        Delimiters, such as tick marks, should allow rapid interpretation without adding unnecessary clutter. Markings and labels should be positioned such that their meaning is clear yet they do not hinder interpretation. Pointers and indexes should not obscure the scales or delimiters such that they can no longer be interpreted. Pointers and indexes should be positioned with sufficient accuracy for their intended function. Accuracy includes effects due to data resolution, latency, graphical positioning, etc.

(c)      Other Graphical Depictions. Depictions include schematics, synoptics, and other graphics such as attitude indications, moving maps, and vertical situation displays.

1        To avoid visual clutter, graphic elements should be included only if they add useful information content, reduce flight crew access or interpretation time, or decrease the probability of interpretation error.

2        To the extent it is practical and necessary, the graphic orientation and the flight crew’s frame of reference should be correlated. For example, left indications should be on the left side of the graphic and higher altitudes should be shown above lower altitudes.

3        If there are multiple depictions, such as “thumbnail” or overlaid depictions, the orientation (for example, heading up, track up, North up, etc.) should be the same for each depiction. This does not apply to other systems where the captain and first officer may select different presentations of the same information and are used exclusively by that flight crew member.

4        Graphics that include 3-Dimensional effects, such as raised buttons or the aeroplane flight path in a perspective view, should ensure that the symbol elements used to achieve these effects will not be incorrectly interpreted.

(5)     Colour Coding

(a)     If colour is used for coding at least one other distinctive coding parameter should be used (for example, size, shape, location, etc.). Normal aging of the eye can reduce the ability to sharply focus on red objects, or discriminate blue from green. For pilots with such a deficiency, display interpretation workload may be unacceptably increased unless symbology is coded in more dimensions than colour alone. However, the use of colour alone for coding information has been shown to be acceptable in some cases, such as weather radar and terrain depiction on the lateral view of the navigation display.

(b)     To ensure correct information transfer, the consistent use and standardisation of colour is highly desirable. In order to avoid confusion or interpretation error, there should not be a change in how the colour is perceived over all foreseeable conditions. Colours used for one purpose in one information set should not be used for an incompatible purpose that could create a misunderstanding within another information set. In particular, consistent use and standardisation for red and amber or yellow, per CS 25.1322, is required to retain the effectiveness of flight crew alerts. A common application is the progression from green to amber to red, representing increasing degrees of threat, potential hazard, safety criticality, or need for flight crew awareness or response. Inconsistencies in the use of colour should be evaluated to ensure that they are not susceptible to confusion or errors, and do not adversely impact the intended function of the system(s) involved.

(c)      If colour is used for coding it is considered good practice to use six colours or less for coding parameters. Each coded colour should have sufficient chrominance separation so it is identifiable and distinguishable in all foreseeable lighting and operating conditions and when used with other colours. Colours should be identifiable and distinguishable across the range of information element size, shape, and movement. The colours available for coding from an electronic display system should be carefully selected to maximise their chrominance separation. Colour combinations that are similar in luminance should be avoided (for example, Navy blue on black or yellow on white).

(d)     Other graphic depictions such as terrain maps and synthetic vision presentations may use more than six colours and use colour blending techniques to represent colours in the outside world or to emphasize terrain features. These displays are often presented as background imagery and the colours used in the displays should not interfere with the flight crew interpretation of overlaid information parameters as addressed in paragraph 31c(5)(e)1 of this chapter.

(e)     The following table depicts previously accepted colour coding and the functional meaning associated with each colour. The use of these colours is recommended for electronic display systems with colour displays. (Note: Some of these colours may be mandatory under CS-25).

Table 11 Recommended Colours for Certain Features

Note

(1)     Use of the colour green for tape elements (for example airspeed and altitude) has also been found acceptable if the colour green does not adversely affect flight crew alerting.

(f)      The following table depicts display features that should be allocated a colour from either Colour Set 1 or Colour Set 2.

Table 12 Recommended Colour Sets for Certain Display Features

Notes

(1)     Use of the colour yellow for functions other than flight crew alerting should be limited and should not adversely affect flight crew alerting.

(2)     In Colour Set 1, magenta is intended to be associated with those analogue parameters that constitute “fly to” or “keep centred” type information.

(g)     Colour Pairs.For further information on this subject, see the FAA report No DOT/FAA/CT-03/05 HF-STD-001, Human Factors Design Standard (HFDS): For Acquisition of Commercial Off-the-Shelf Subsystems, Non-Developmental Items, and Developmental Systems.

(h)     When background colour is used (for example, grey), it should not impair the use of the overlaid information elements. Labels, display-based controls, menus, symbols, and graphics should all remain identifiable and distinguishable. The use of background colour should conform to the overall flight deck philosophies for colour usage and information management. If texturing is used to create a background, it should not result in loss of readability of the symbols overlaid on it, nor should it increase visual clutter or pilot information access time. Transparency is a means of seeing a background information element through a foreground one – the use of transparency should be minimised because it may increase pilot interpretation time or errors.

(i)      Requiring the flight crew to discriminate between shades of the same colour for distinct meaning is not recommended. The use of pure blue should not be used for important information because it has low luminance on many display technologies (for example, CRT and LCD).

(j)      Any foreseeable change in symbol size should ensure correct colour interpretation; for example, the symbol needs to be sufficiently large so the pilot can interpret the correct colour.

d.       Dynamic (Graphic) Information Elements on a Display

(1)     General. The following paragraphs cover the motion of graphic information elements on a display, such as the indices on a tape display.Graphic objects that translate or rotate should do so smoothly without distracting or objectionable jitter, jerkiness, or ratcheting effects. Data update rates for information elements used in direct aeroplane or powerplant manual control tasks (such as attitude, engine parameters, etc.) equal to or greater than 15 Hertz have been found to be acceptable. Any lag introduced by the display system should be consistent with the aeroplane control task associated with that parameter. In particular, display system lag (including the sensor) for attitude which does not exceed a first order equivalent time constant of 100 milliseconds for aeroplanes with conventional control system response is generally acceptable.

(2)     Movement of display information elements should not blur, shimmer, or produce unintended dynamic effects such that the image becomes distracting or difficult to interpret. Filtering or coasting of data intended to smooth the motion of display elements should not introduce significant positioning errors or create system lag that makes it difficult to perform the intended task.

(3)     When a symbol reaches the limit of its allowed range of motion, the symbol should either slide from view, change visual characteristics, or be self-evident that further deflection is impossible.

(4)     Dynamic information should not appreciably change shape or colour as it moves. Objects that change sizes (for example, as the map range changes) should not cause confusion as to their meaning and should remain consistent throughout their size range. At all sizes the objects should meet the guidance of this chapter as applicable (that is, the objects should be discernable, legible, identifiable, placed accurately, not distracting, etc.).

e.       Sharing Information on a Display. There are three primary methods of sharing information on a given display. First, the information may be overlaid or combined, such as when traffic alert and collision avoidance system (TCAS) information is overlaid on a map display. Second, the information can be time shared so that the pilot toggles between functions, one at a time. Third, the information may be displayed in separate physical areas or windows that are concurrently displayed. Regardless of the method of information sharing, care should be taken to ensure that information that is out prioritised, but is needed, can be recovered, and that it will not be needed more quickly than it can be recovered.

(1)     Overlays and Combined Information Elements. The following guidelines apply:

—         When information is graphically overlaid over other information (for example, an aeroplane symbol over a waypoint symbol) in the same location on a display, the loss of information availability, information access times, and potential for confusion should be minimised.

—         When information obscures other information it should be shown that the obscured information is either not needed when it is obscured or can be rapidly recovered. Needed information should not be obscured. This may be accomplished by protecting certain areas of the display.

—         If information is integrated with other information on a display, the projection, the placement accuracy, the directional orientation and the display data ranges should all be consistent (for example, when traffic or weather is integrated with navigation information). When information elements temporarily obscure other information (for example, pop-up menus or windows), the resultant loss of information should not cause a hazard in accordance with the obscured information’s intended function.

(2)     Time Sharing.The following guidelines apply:

—         Guidance on Full-time vs. Part-time Displays (see paragraph 36c(3) of this AMC).

—         Any information that should or must be continuously monitored by the flight crew should be displayed at all times (for example, attitude).

—         Whether or not information may be time shared depends on how easily it can be retrieved in normal, non-normal, and emergency operations. Information for a given performance monitoring task may be time shared if the method of switching back and forth does not jeopardise the performance monitoring task.

—         Generally, system information, planning, and other information not necessary for the pilot tasks can be time shared.

(3)     Separating Information Visually.When different information elements are adjacent to each other on a display, the elements should be separated visually so the pilots can easily distinguish between them. Visual separation can be achieved with, for example, spacing, delimiters, or shading in accordance with the overall flight deck information management philosophy. Required information presented in reversionary or compacted display modes following a display failure should still be uncluttered and still allow acceptable information access time.

(4)     Clutter and De-Clutter

(a)     A cluttered display presents an excessive number or variety of symbols, colours, and/or other unnecessary information and, depending on the situation, may interfere with the flight task or operation. A cluttered display causes increased flight crew processing time for display interpretation, and may detract from the interpretation of information necessary to navigate and fly the aeroplane. Information should be displayed so that clutter is minimised.

(b)     To enhance pilot performance a means should be considered to de-clutter the display. For example, an attitude indicator may automatically de-clutter when the aeroplane is at an unusual attitude to aid the pilot in recovery from the unusual attitude by removing unnecessary information and retaining information required for the flight crew to recover the aeroplane. Failure messages, flags, or comparative monitoring alerts related to the information required to be indicated by CS 25.1303 should not be removed from the main primary flight display by decluttering the display, as long as the associated indication is maintained on the primary flight display.

f.       Annunciations and Indications

(1)     General. Annunciations and indications include annunciator switches, messages, prompts, flags, and status or mode indications which are either on the flight deck display itself or control a flight deck display. Reference: CS 25.1322 and the associated AMC for information regarding specific annunciations and indications such as warning, caution, and advisory level alerts.

(a)     Annunciations and indications should be operationally relevant and limited to minimise the adverse effects on flight crew workload.

(b)     Annunciations and indications should be clear, unambiguous, timely, and consistent with the flight deck design philosophy. When an annunciation is provided for the status or mode of a system, it is recommended that the annunciation indicate the actual state of the system and not just the position or selection of a switch. Annunciations should only be indicated while the condition exists.

(2)     Location.Annunciations and indications should be consistently located in a specific area of the electronic display. Annunciations that may require immediate flight crew awareness should be located in the flight crew’s forward/primary field of view.

(3)     Managing Messages and Prompts

(a)     The following general guidance applies to all messages and prompts:

—          When messages are currently being displayed and there are additional messages in the queue that are not currently displayed, there should be an indication that the additional messages exist.

—          Within levels of urgency, messages should be displayed in logical order. In many cases the order of occurrence of events has been found to be the most logical way to place the messages in order.

—          See CS 25.1322 and AMC 25.1322 for information on warning, caution, and advisory alerts.

 (4)    Blinking. Blinking information elements such as readouts or pointers are effective methods of annunciation. However, the use of blinking should be limited because it can be distracting and excessive use reduces the attention getting effectiveness. Blinking rates between 0.8 and 4.0 Hertz should be used, depending on the display technology and the compromise between urgency and distraction. If blinking of an information element can occur for more than approximately 10 seconds, a means to cancel the blinking should be provided.

g.       Use of Imaging. This paragraph provides guidance on the use of images which depict a specific portion of the aeroplane environment. These images may be static or continuously updated. Imaging includes weather radar returns, terrain depictions, forecast weather maps, video, enhanced vision displays, and synthetic vision displays. Images may be generated from databases or by sensors.

(1)     Images should be of sufficient size and include sufficient detail to meet the intended function. The pilots should be able to readily distinguish the features depicted. Images should be oriented in such a way that their presentation is easily interpreted. All images, but especially dynamic images, should be located or controllable so they do not distract the pilots from required tasks. The source and intended function of the image and the level of operational approval for using the image should be provided to the pilots. This can be accomplished using the aeroplane flight manual, image location, adequate labelling, distinct texturing, or other means.

(2)     Image distortion should not compromise image interpretation. Images meant to provide information about depth (for example, 3-Dimensional type perspective displays) should provide adequate depth information to meet the intended function.

(3)     Dynamic images should meet the guidance in paragraph 31d of this chapter, above. The overall system lag time of a dynamic image relative to real time should not cause flight crew misinterpretation or lead to a potentially hazardous condition. Image failure, freezing, coasting or colour changes should not be misleading and should be considered during the safety analysis.

(4)     When overlaying coded information elements over images, the information elements should be readily identifiable and distinguishable for all foreseeable conditions of the underlying image and range of motion. The information elements should not obscure necessary information contained in the image. The information should be depicted with the appropriate size, shape, and placement accuracy to avoid being misleading. They should retain and maintain their shape, size, and colour for all foreseeable conditions of the underlying image and range of motion.

(5)     When fusing or overlaying multiple images, the resultant combined image should meet its intended function despite any differences in image quality, projection, data update rates, sensitivity to sunlight, data latency, or sensor alignment algorithms. When conforming an image to the outside world, such as on a HUD, the image should not obscure or significantly hinder the flight crew’s ability to detect real world objects. An independent brightness control of the image may help satisfy this guideline. Image elements that correlate or highlight real world objects should be sufficiently coincident to avoid interpretation error or significantly increase interpretation time.

32. – 35.      [RESERVED]

CHAPTER 6 ORGANISING ELECTRONIC DISPLAY INFORMATION ELEMENTS

36.     Organising Information Elements

a.       General. This chapter provides guidance for integrating information into the flight deck related to managing the location of information, arranging the display, windowing, configuring and reconfiguring the display, and selecting the sensors across the flight deck displays. The following paragraphs include guidance for various flight deck configurations from dedicated electronic displays for the attitude director indicator and the horizontal situation indicator to larger display sizes which use windowing techniques to display various functionalities on one display area. In some flight decks the primary flight information and the navigation display are examples of information that is displayed using windowing techniques. Chapter 5 of this AMC provides guidance for information elements including: text, labels, symbols, graphics, and other depictions (such as video) in isolation and combination.

b.       Types and Arrangement of Display Information. This paragraph provides guidance for the arrangement and location of categories of information. The categories of information include:

—         Primary flight information including attitude, airspeed, altitude, and heading.

—         Powerplant information which covers functions relating to propulsion.

—         Other information.

(1)     Placement - General Information. The position of a message or symbol within a display conveys meaning to the pilot. Without the consistent or repeatable location of a symbol in a specific area of the electronic display interpretation error and response times may increase. The following information should be placed in a consistent location under normal conditions:

—         Primary flight information (see paragraph 36b(3) in this chapter and Appendix 1 of this AMC).

—         Powerplant information (see paragraph 36b(4) in this chapter and Appendix 2 of this AMC).

—         Flight crew alerts – each flight crew alert should be displayed in a specific location or a central flight crew alert area.

—         Autopilot and flight director modes of operation.

—         Lateral and vertical path deviation indicators.

—         Radio altitude indications.

—         Failure flags should be presented in the location of the information they reference or replace.

—         Data labels for navigation, traffic, aeroplane system, and other information should be placed in a consistent position relative to the information they are labelling.

—         Supporting data for other information, such as bugs and limit markings, should be consistently positioned relative to the information they support.

—         Features on electronic moving map displays (for example, VORs, waypoints, etc.) relative to the current aeroplane position. In addition, the features should be placed on a constant scale for each range selected.

—         Segment of flight information relative to similar information or other segments.

(2)     Placement - Controls and Indications. When a control or indication occurs in multiple places (for example a “Return” control on multiple pages of a flight management function), the control or indication should be located consistently for all occurrences.

(3)     Arrangement - Basic T Information

(a)     CS 25.1321(b) includes specifications for the “Basic T” arrangement of certain information required by CS 25.1303(b).

(b)     The following paragraphs provide guidance for the Basic T arrangement. This guidance applies to single and multiple display surfaces.

1        The Basic T information should be displayed continuously, directly in front of each flight crew member under normal (that is, no display system failure) conditions. CS 25.1321(b) requires that flight instruments required by CS 25.1303 must be grouped on the instrument panel and centred as nearly as practicable about the vertical plane of the pilot's forward vision.

2        The Basic T arrangement applies to the primary display of attitude, airspeed, altitude, and direction of flight. Depending on the flight deck design, there may be more than one indication of the Basic T information elements in front of a pilot. For example, heading information may appear on back-up displays, HUDs, and moving map displays. The primary airspeed, altitude, and direction indications are the respective display indications closest to the primary attitude indication.

3        The primary attitude indication should be centred about the plane of the flight crew’s forward vision. This should be measured from the DEP at the flight crew station. If located on the main instrument panel, the primary attitude indication must be in the top centre position (CS 25.1321(b)). The attitude indication should be placed so that the display is unobstructed under all flight conditions. Refer to SAE ARP 4102/7 for additional information.

4        The primary airspeed, altitude, and direction of flight indications should be located adjacent to the primary attitude indication. Information elements placed within, overlaid, or between these indications, such as lateral and vertical deviation, are acceptable when they are relevant to respective airspeed, altitude, or directional indications used for accomplishing the basic flying task, and are shown to not disrupt the normal crosscheck or decrease manual flying performance.

5        The instrument that most effectively indicates airspeed must be adjacent to and directly to the left of the primary attitude indication (CS 25.1321(b)). The centre of the airspeed indication should be aligned with the centre of the attitude indication. For airspeed indications, vertical deviations have been found acceptable up to 15 degrees below to 10 degrees above when measured from the direct horizontal position of the aeroplane waterline reference symbol. For tape type airspeed indications, the centre of the indication is defined as the centre of the current airspeed status reference.

6        Parameters related to the primary airspeed indication, such as reference speeds or a mach indication, should be displayed to the left of the primary attitude indication.

7        The instrument that most effectively indicates altitude must be located adjacent to and directly to the right of the primary attitude indication (CS 25.1321(b)). The centre of the altitude indication should be aligned with the centre of the attitude indication. For altitude indications, vertical deviations have been found acceptable up to 15 degrees below to 10 degrees above when measured from the direct horizontal position of the aeroplane waterline reference symbol. For tape type altitude indications, the centre of the indication is defined as the centre of the current altitude status reference.

8        Parameters related to the primary altitude indication, such as the barometric setting or the primary vertical speed indication, should be displayed to the right of the primary altitude indication.

9        The instrument that most effectively indicates direction of flight must be located adjacent to and directly below the primary attitude indication (CS 25.1321(b)). The centre of the direction of flight indication should be aligned with the centre of the attitude indication. The centre of the direction of flight indication is defined as the centre of the current direction of flight status reference.

10      Parameters related to the primary direction of flight indication, such as the reference (that is, magnetic or true) or the localiser deviation should be displayed below the primary attitude indication.

11      If applicants seek approval of alternative instrument arrangements by equivalent safety under Part 21A.21(c)2, the Agency will normally require well-founded research, or relevant service experience from military, foreign, or other sources to substantiate the applicants’ proposed compensating factors.

(4)     Arrangement - Powerplant Information

(a)     Required engine indications necessary to set and monitor engine thrust or power should be continuously displayed in the flight crew’s primary field of view, unless the applicant can demonstrate that this is not necessary (see the guidance in paragraph 36c(3) of this chapter and Appendix 2 of this AMC). The automatically selected display of powerplant information should not suppress other information that requires flight crew awareness.

(b)     Powerplant information must be closely grouped (in accordance with § 25.1321) in an easily identifiable and logical arrangement which allows the flight crew to clearly and quickly identify the displayed information and associate it with the corresponding engine. Typically, it is considered to be acceptable to arrange parameters related to one powerplant in a vertical manner and, according to powerplant position, next to the parameters related to another powerplant in such a way that identical powerplant parameters are horizontally aligned. Generally, place parameter indications in order of importance with the most important one at the top. Typically, the top indication is the primary thrust setting parameter.

(5)     Arrangement - Other Information (For Example, Glideslope and Multi-Function Displays)

(a)     Glideslope or glidepath deviation scales should be located to the right side of the primary attitude indication. If glideslope deviation data is presented on both an electronic horizontal situation indicator and an electronic attitude direction indicator, the information should appear in the same relative location on each indicator.

(b)     When the glideslope pointer is being driven by a RNAV (area navigation) system with VNAV (vertical navigation) or ILS (instrument landing system) look-alike functionality, the pointer should not be marked “GS” or “glideslope.”

(c)      Navigation, weather, and vertical situation display informationis often displayed on multi-function displays. This information may be displayed on one or more physical electronic displays, or on several areas of one larger display. When this information is not required to be displayed continuously, it can be displayed part-time, but the displayed information should be easily recoverable to the flight crew when needed. For guidance on part-time displays see paragraph 36c(3) of this chapter.

(d)     Other information should not be located where the primary flight information or required powerplant information is normally presented. See paragraphs 36b(1) and 36b(3) of this chapter for primary flight information guidance. See paragraphs 21e(10) and 36b(4) of this AMC for powerplant information guidance.

c.       Managing Display Information. The following paragraphs address managing and integrating the display of information throughout the flight deck. This includes the use of windows to present information and the use of menus to manage the display of information.

(1)     Window. A window is a defined area which can be present on one or more physical displays. A window that contains a set of related information is commonly referred to as a format. Multiple windows may be presented on one physical display surface and may have different sizes. Guidelines for sharing information on a display, using separate windows, are as follows:

—         The window(s) should have fixed size(s) and location(s).

—         Separation between information elements within and across windows should be sufficient to allow the flight crew to readily distinguish separate functions or functional groups (for example, powerplant indication) and avoid any distractions or unintended interaction.

—         Display of selectable information, such as a window on a display area, should not interfere with or affect the use of primary flight information.

—         For additional information regarding the display of data on a given location, data blending, and data over-writing (see Aeronautical Radio, Inc (ARINC) Standard 661-5, Cockpit Display System Interfaces to User Systems).

(2)     Menu

(a)     A menu is a displayed list of items from which the flight crew can choose. Menus include drop-down and scrolling menus, line select keys on a multi-function display, and flight management system menu trees. An option is one of the selectable items in a menu. Selection is the action a user makes in choosing a menu option, and may be done by pointing (with a cursor control device or other mechanism), entering an associated option code, or activating a function key.

(b)     The hierarchical structure and organisation of the menus should be designed to allow the flight crew to sequentially step through the available menus or options in a logical way that supports their tasks. The options provided on any particular menu should be logically related to each other. Menus should be displayed in consistent locations, either a fixed location or a consistent relative location, so that the flight crew knows where to find them. At all times the system should indicate the current position within the menu and menu hierarchy.

(c)      The number of sub-menus should be designed to assure timely access to the desired option without over-reliance on memorisation of the menu structure. The presentation of items on the menu should allow clear distinction between items that select other menus and items that are the final selection.

(d)     The number of steps required to choose the desired option should be consistent with the frequency, importance, and urgency of the flight crew’s task.

(e)     Whena menu is displayed it should not obscure required information.

(3)     Full-time vs. Part-time Display of Information.Some aeroplane parameters or status indications are required to be displayed by the specifications (for example, powerplant information required by CS 25.1305), yet they may only be necessary or required in certain phases of flight. If it is desired to inhibit some parameters from full-time display, a usability level and functionality equivalent to a full-time display should be demonstrated.

(a)     When determining if information on a display can be part-time, consider the following criteria:

—          Continuous display of the parameter is not required for safety of flight in all normal flight phases.

—          The parameter is automatically displayed in flight phases where it is required, when its value indicates an abnormal condition, or when it would be relevant information during a failure condition.

—          Display of the inhibited parameter can be manually selected by the flight crew without interfering with the display of other required information.

—          If the parameter fails to be displayed when required, the failure effect and compounding effects must meet the specifications of all applicable specifications (for example, CS 25.1309).

—          The automatic or requested display of the inhibited parameter should not create unacceptable clutter on the display. Also, simultaneous multiple "pop-ups" should not create unacceptable clutter on the display.

—          If the presence of a new parameter is not sufficiently self-evident, suitable alerting or other annunciations should accompany the automatic presentation of the parameter.

(b)     Pop-up Display of Information

1        Certain types of information, such as terrain and TCAS, are required by operating rules to be displayed, yet they are only necessary or required in certain phases of flight (similar to the part-time display of required aeroplane parameters, (see paragraph 36b(3) of this chapter)) or under specific conditions. One method commonly employed to display this information is called “automatic pop-up.” Automatic pop-ups may be in the form of an overlay, such as a TCAS overlay on the moving map, or in a separate window as a part of a display format. Pop-up window locations should not obscure required information.

2        Consider the following criteria for displaying automatic pop-up information:

—         Information is automatically displayed when its value indicates a predetermined condition, or when the associated parameter reaches a predetermined value.

—         Pop-up information should appropriately attract the flight crew’s attention while minimising task disruption.

—         If the flight crew deselects the display of the automatic pop-up information, then another automatic pop-up should not occur until a new condition/event causes it.

—         If an automatic pop-up condition is activated and the system is in the wrong configuration or mode to display the information, and the system configuration cannot be automatically changed, then an annunciation should be displayed in the colour associated with the nature of the alert, prompting the flight crew to make the necessary changes for the display of the information. This guidance differs from the part-time display of information required by CS-25 because the required information should be displayed regardless of the configuration.

—         If a pop-up(s) or simultaneous multiple pop-ups occur and obscure information, it should be shown that the obscured information is not relevant or necessary for the current flight crew task. Additionally, the pop-ups should not cause a misleading presentation.

—         If more than one automatic pop-up occurs simultaneously on one display area, for example a terrain and TCAS pop-up, then the system should prioritise the pop-up events based on their criticality. Pop-up display orientation should be in track-up or heading-up.

—         Any information to a given system that is not continuously displayed, but the safety assessment determines it is necessary to be presented to the flight crew, should automatically pop-up or otherwise indicate that its display is required.

d.       Managing Display Configuration. The following paragraphs address managing the information presented by an electronic display system and its response to failure conditions and flight crew selections. The following paragraphs also provide guidance on the acceptability of display formats and their required physical location on the flight deck, both during normal flight and in failure modes. Manual and automatic system reconfiguration and source switching are also addressed.

(1)     Normal Conditions. In normal conditions (that is, non-failure conditions) there may be a number of possible display configurations that may be selected manually or automatically. All possible display configurations available to the flight crew should be designed and evaluated for arrangement, visibility, and interference.

(2)     System Failure Conditions (Reconfiguration). The following paragraphs provide guidance on manual and automatic display system reconfiguration in response to display system failures. Arrangement and visibility specifications also apply in failure conditions. Alternative display locations used in non-normal conditions should be evaluated by the Agency to determine if the alternative locations meet the criteria for acceptability.

(a)     Moving display formats to different display locations on the flight deck or using redundant display paths to drive display information is acceptable to meet availability and integrity specifications.

(b)     In an instrument panel configuration with a display unit for primary flight information positioned above a display unit for navigation information, it is acceptable to move the primary flight information to the lower display unit if the upper display unit fails.

(c)      In an instrument panel configuration with a display unit for primary flight information positioned next to a display unit for navigation information, it is acceptable to move the primary flight information to the display unit directly adjacent to it if the preferred display unit fails. It is also acceptable to switch the navigation information to a centrally located auxiliary display (multi-function display).

(d)     If several possibilities exist for relocating the failed display, a recommended flight crew procedure should be considered and documented in the aeroplane flight manual.

(e)     It is acceptable to have manual or automatic switching capability (automatic switching is preferred) in case of system failure; however, CS 25.1333(b) requires that the equipment, systems, and installations must be designed so that sufficient information is available to assure control of the aeroplane’s airspeed, altitude, heading, and attitude by one of the pilots without additional flight crew action, after any single failure or combination of failures that is not assessed to be extremely improbable.

(f)      The following means to reconfigure the displayed information are acceptable:

—          Display unit reconfiguration. Moving a display format to a different location (for example, moving the primary flight information to the adjacent display unit) or the use of a compacted format may be acceptable.

—          Source/graphic generator reconfiguration. The reconfiguration of graphic generator sources either manually or automatically to accommodate a failure may be acceptable. In the case where both the captain and first officer’s displays are driven by a single graphic generator source, there should be clear, cautionary alerting to the flight crew that the displayed information is from a single graphic generator source.

—          In certain flight phases, manual reconfiguration may not satisfy the need for the pilot controlling the aeroplane to recover primary flight information without delay. Automatic reconfiguration might be necessary to ensure the timely availability of information that requires immediate flight crew member action.

—          When automatic reconfiguration occurs (for example, display transfer), it should not adversely affect the performance of the flight crew and should not result in any trajectory deviation.

—                   When the display reconfiguration results in the switching of sources or display paths that is not annunciated and is not obvious to the flight crew, care should be taken that the flight crew is aware of the actual status of the systems when necessary, depending on flight deck philosophy.

e.       Methods of Reconfiguration

(1)     Compacted Format

(a)     The term "compacted format," as used in this AMC, refers to a reversionary display mode where selected display components of a multi-display configuration are combined in a single display format to provide higher priority information following a display failure. The “compacted format” may be automatically selected in case of a primary display failure, or it may be manually (automatic selection preferred) selected by the flight crew. Except for training purposes, the “compacted format” should not be selectable unless there is a display failure. The concepts and specifications of CS 25.1321, as discussed in paragraph 36(b)(3) of this chapter, still apply.

(b)     The compacted display format should maintain the same display attributes (colour, symbol location, etc.) and include the same required information, as the primary formats it is replacing. The compacted format should ensure the proper operation of all the display functions it presents, including annunciation of navigation and guidance modes, if present. However, due to size constraints and to avoid clutter, it may be necessary to reduce the amount of display functions on the compacted format. For example, in some cases, the use of numeric readouts in place of graphical scales has been found to be acceptable. Failure flags and mode annunciations should, wherever possible, be displayed in a location common with the normal format.

(2)     Sensor Selection and Annunciation

(a)     Automatic switching of sensor data to the display system should be considered, especially with highly integrated display systems to address those cases where multiple failure conditions may occur at the same time and require immediate flight crew action. Manual switching may be acceptable.

(b)     Independent attitude, direction, and air data sources are required for the captain and first officer’s displays of primary flight information (see CS 25.1333). If sources can be switched such that the captain and first officer are provided with single sensor information, each of them should receive a clear annunciation indicating the vulnerability to misleading information.

(c)      If sensor information sources cannot be switched, then no annunciation is required.

(d)     There should be a means of determining the source of the displayed navigation information and the active navigation mode. For approach operations the source of the displayed navigation information and the active navigation mode should be available on the primary flight display or immediately adjacent to the primary flight display.

(e)     The selected source should be annunciated if multiple or different types of navigation sources (flight management system, instrument landing system, GNSS (global navigation satellite system) landing system, etc.) can be selected (manually or automatically).

(f)      An alert should be given when the information presented to the flight crew is no longer meeting the required integrity level, in particular when there is a single sensor or loss of independence.

37. – 40.      [RESERVED]

CHAPTER 7 ELECTRONIC DISPLAY SYSTEM CONTROL DEVICES

41.     General. Each electronic display system control device has characteristics unique to its operation that need to be considered when designing the functions the display system controls, and the redundancy provided during failure modes. Despite the amount of redundancy that may be available to achieve a given task, the flight deck should still present a consistent user interface scheme for the primary displays and a compatible, if not consistent, user interface scheme for auxiliary displays throughout the flight deck.

a.       Multi-function Control Labels. Multi-function controls should be labelled such that the pilot is able to:

—         Rapidly, accurately, and consistently identify and select all functions of the control device.

—         Quickly and reliably identify what item on the display is “active” as a result of cursor positioning, as well as what function will be performed if the item is selected using the selector buttons and/or changed using the multi-function control.

—         Determine quickly and accurately the function of the control without extensive training or experience.

b.       Multi-function Controls. The installation guidelines below apply to control input devices that are dedicated to operating a specific function (for example, control knobs and wheels), as well as new control features (for example, a cursor control device (CCD)).

(1)     “Hard” Controls

(a)     Mechanical controlsused to set numeric data on a display should have adequate friction or tactile detents to allow a flight crew without extensive training or experience to set values (for example, setting an out-of-view heading bug to a displayed number) to a required level of accuracy within a time appropriate to the task.

(b)     The input for display response gain to control should be optimised for gross motion as well as fine positioning tasks without overshoots. In accordance with CS 25.777(b), the direction of movement of the cockpit controls must meet the specifications of CS 25.779. Wherever practicable, the sense of motion involved in the operation of other controls must correspond to the sense of the effect of the operation on the aeroplane or on the part operated. Controls of a variable nature using a rotary motion must move clockwise from the off position, through an increasing range, to the full on position.

(2)     “Soft” Controls

(a)     There are two interactive types of soft control displays, one type affects aeroplane systems and the other type does not. Displays that utilize a graphical user interface (GUI) permit information within different display areas to be directly manipulated by the flight crew (for example, changing range, scrolling crew alert messages or electronic checklists, configuring windows, or layering information.) This level of display interaction affects only the presentation of display information and has a minimal effect on flight deck operations. The other level of display interaction provides a GUI to control aeroplane system operations (for example, utility controls on displays traditionally found in overhead panel functions, FMS operations, and graphical flight planning).

(b)     The design of display systems that will be used as soft controls is dependent on the functions they control. Consider the following guidelines when designing these display systems:

1        The GUI and control device should be compatible with the aeroplane system they will control. The hardware and software design assurance levels and tests for the GUI and control device should be commensurate with the level of criticality of the aeroplane system they will control.

2        Redundant methods of controlling the system may lessen the criticality required of the display control. Particular attention should be paid to the interdependence of display controls (that is, vulnerability to common mode failures), and to the combined effects of the loss of control of multiple systems and functions.

3        The applicant should demonstrate that the failure of any display control does not unacceptably disrupt operation of the aeroplane (that is the allocation of flight crew member tasks) in normal, non-normal, and emergency conditions.

4        To show compliance with CS 25.777(a) and CS 25.1523, the applicant should show that the flight crew can conveniently access required and backup control functions in all expected flight scenarios, without impairing aeroplane control, flight crew task performance, and flight crew resource management.

5        Control system latency and gains can be important in the acceptability of a display control. Usability testing should therefore accurately replicate the latency and control gains that will be present in the actual aeroplane.

6        The final display response to control input should be fast enough to prevent undue concentration being required when the flight crew sets values or display parameters CS 25.771(a)). The initial indication of a response to a soft control input should take no longer than 250 milliseconds. If the initial response to a control input is not the same as the final expected response, a means of indicating the status of the pilot input should be made available to the flight crew.

7        To show compliance with CS 25.771(e) the applicant should show by test and/or demonstration in representative motion environment(s) (for example, turbulence) that the display control is acceptable for controlling all functions that the flight crew may access during these conditions.

c.       Cursor Control Devices

When the input device controls cursor activity on a display, it is called a cursor control device (CCD). The CCDs are used to position display cursors on selectable areas of the displays. These selectable areas are “soft controls” intended to perform the same functions as mechanical switches or other controls on conventional control panels. Typically, CCDs control several functions and are the means for directly selecting display elements. When designing CCDs, in addition to the guidance provided in paragraphs 41a, 41b, and 41d of this chapter, consider the guidance in the following paragraphs, which address design considerations unique to CCDs.

(1)     The CCD design and installation should enable the flight crew to operate the CCD without exceptional skill during foreseeable flight conditions, both normal and adverse (for example, turbulence and vibrations). Certain selection techniques, such as double or triple clicks, should be avoided.

(2)     The safety assessment should address reversion to alternate means of control following loss of the CCD. This includes an assessment on the impact of the failure on flight crew workload.

(3)     The functionality of the CCD should be demonstrated with respect to the flight crew interface considerations outlined below:

(a)     The ability of the flight crew to share tasks, following CCD failure, with appropriate workload and efficiency.

(b)     The ability of the flight crew to use the CCD with accuracy and speed of selection required of the related tasks, under foreseeable operating conditions (for example, turbulence, engine imbalance, and vibration).

(c)      Satisfactory flight crew task performance and CCD functionality, whether the CCD is operated with a dominant or non-dominant hand.

(d)     Hand stability support position (for example, wrist rest).

(e)     Ease of recovery from incorrect use.

d.       Cursor Displays

(1)     The cursor symbol should be restricted from areas of primary flight information or where occlusion of display information by a cursor could result in misinterpretation by the flight crew. If a cursor symbol is allowed to enter a critical display information field, it should be demonstrated that the cursor symbol’s presence will not cause interference during any phase of flight or failure condition.

(2)     Because the cursor is a directly controllable element on the display it has unique characteristics. Consider the following when designing a cursor display:

(a)     Presentation of the cursor should be clear, unambiguous, and easily detectable in all foreseeable operating conditions.

(b)     The failure mode of an uncontrollable and distracting display of the cursor should be evaluated.

(c)      Because in most applications more than one flight crew member will be using one cursor, the applicant should establish an acceptable method for handling “duelling cursors” that is compatible with the overall flight deck philosophy (for example, “last person on display wins”). Acceptable methods should also be established for handling other possible scenarios, including the use of two cursors by two pilots.

(d)     If more than one cursor is used on a display system, a means should be provided to distinguish between the cursors.

(e)     If a cursor is allowed to fade from a display, some means should be employed for the flight crew to quickly locate it on the display system. Common examples of this are “blooming” or “growing” the cursor to attract the flight crew’s attention.

42. – 45.      [RESERVED]

CHAPTER 8 SHOWING COMPLIANCE FOR APPROVAL OF ELECTRONIC DISPLAY SYSTEMS

46.     Compliance Considerations (Test and Compliance)

a.       General. This chapter provides guidance for demonstrating compliance to the specifications for the approval of electronic flight deck displays. Since so much of display system compliance is dependent on subjective evaluations, this chapter focuses on providing specific guidance that facilitates these types of evaluations.

b.       Means of Compliance

(1)     The acceptable means of compliance for a display system depends on many factors and is determined on a case-by-case basis. For example, when the proposed display system technology is mature and well understood, means such as analogical reasoning documented as a Statement of Similarity may be sufficient. However, more rigorous and structured methods, such as analysis and flight test, are appropriate if the proposed display system design is deemed novel, complex, or highly integrated.

(2)     The acceptable means of compliance depends on other factors as well. These include the subjectivity of the acceptance criteria and the evaluation facilities of the applicant (for example, high-fidelity flight simulators) and the manner in which these facilities are used (for example, data collection).

(3)     When subjective criteria are used to satisfy a means of compliance, the subjective data should be collected from multiple people (including pilots, engineers, and human factor specialists.)

(4)     The following guidance describes means of compliance for electronic displays:

(a)     System Descriptions

1        System descriptions may include system architecture, description of the layout and general arrangement of the flight deck, description of the intended function, flight crew interfaces, system interfaces, functionality, operational modes, mode transitions, and characteristics (for example dynamics of the display system), and applicable specifications addressed by this description. Layout drawings and/or engineering drawings may show the geometric arrangement of hardware or display graphics. Drawings typically are used in cases where showing compliance to the specifications can easily be reduced to simple geometry, arrangement, or the presence of a given feature on the drawing.

2        The following questions may be used to evaluate whether the description of intended function is sufficiently specific and detailed:

—         Does each system, feature, and function have a stated intended function?

—         What assessments, decisions, or actions are the flight crew members intended to make based on the display system?

—         What other information is assumed to be used in combination with the display system?

—         What is the assumed operational environment in which the equipment will be used? For example, the pilots’ tasks and operations within the flight deck, phase of flight, and flight procedures.

(b)     Statement of Similarity. This is a substantiation to demonstrate compliance by a comparison to a previously approved display (system or function). The comparison details the physical, logical, and functional and operational similarities of the two systems. Substantiation data from previous installations should be provided for the comparison. This method of compliance should be used with care because the flight deck should be evaluated as a whole, rather than merely as a set of individual functions or systems. For example, display functions that have been previously approved on different programmes may be incompatible when applied to another flight deck. Also, changing one feature in a flight deck may necessitate corresponding changes in other features, in order to maintain consistency and prevent confusion (for example, use of colour).

(c)      Calculation & Engineering Analyses. These include assumptions of relevant parameters and contexts, such as the operational environment, pilot population, and pilot training. Examples of calculations and engineering analyses include human performance modelling of optical detections, task times, and control forces. For analyses that are not based on advisory material or accepted industry standards, validation of calculations and engineering analyses using direct participant interaction with the display should be considered.

(d)     Evaluation. This is an assessment of the design conducted by the applicant, who then provides a report of the results to the Agency. Evaluations typically use a display design model that is more representative of an actual system than drawings. Evaluations have two defining characteristics that distinguish them from tests: (1) the representation of the display design does not necessarily conform to the final documentation, and (2) the Agency may or may not be present. Evaluations may contribute to a finding of compliance, but they generally do not constitute a finding of compliance by themselves.

1        Evaluations may begin early in the certification programme. They may involve static assessments of the basic design and layout of the display, part-task evaluations and/or, full task evaluations in an operationally representative environment (environment may be simulated). A wide variety of development tools may be used for evaluations, from mock-ups to full installation representations of the actual product or flight deck.

2        In cases where human subjects (typically pilots) are used to gather data (subjective or objective), the applicant should fully document the process used to select subjects, the subjects’ experience, the type of data collected, and the method(s) used to collect the data. The resulting information should be provide to the Agency as early as possible to obtain agreement between the applicant and the Agency on the extent to which the evaluations are valid and relevant for certification credit. Additionally, credit will depend on the extent to which the equipment and facilities actually represent the flight deck configuration and realism of the flight crew tasks.

(e)     Test. This means of compliance is conducted in a manner very similar to evaluations (see above), but is performed on conformed systems (or conformed items relevant to the test), in accordance with an approved test plan, and may be witnessed by the Agency. A test can be conducted on a test bench, in a simulator, and/or on the actual aeroplane, and is often more formal, structured, and rigorous than an evaluation.

1        Bench or simulator tests that are conducted to show compliance should be performed in an environment that adequately represents the aeroplane environment, for the purpose of those tests.

2        Flight tests should be used to validate and verify data collected from other means of compliance such as analyses, evaluations, and simulations. Per CS 25.1523, during the certification process, the flight crew workload assessments and failure classification validations should be addressed in a flight simulator or an actual aeroplane, although the assessments may be supported by appropriate analyses (see CS-25 Appendix D, for a description of the types of analyses).

47. – 50.      [RESERVED]

CHAPTER 9 CONTINUED AIRWORTHINESS AND MAINTENANCE

51.     Continued Airworthiness and Maintenance. The following paragraphs provide guidance for preparing instructions for the continued airworthiness of the display system and its components to show compliance with CS 25.1309 and CS 25.1529 (including Appendix H), which require preparing Instructions for Continued Airworthiness. The following guidance is not a definitive list, and other maintenance tasks may be developed as a result of the safety assessment, design reviews, manufacturer’s recommendations, and Maintenance Steering Group (MSG)-3 analyses that are conducted.

a.       General. Information on preparing the Instructions for Continued Airworthiness can be found in CS-25 Appendix H. In addition to those instructions, maintenance procedures should be considered for:

(1)     Reversionary switches not used in normal operation. These switches should be checked during routine maintenance because, if a switch failure is not identified until the aeroplane is in flight, the switching or back up display/sensor may not be available when required. These failures may be addressed by a System Safety Assessment and should be addressed in the aeroplane’s maintenance programme (for example, MSG-3).

(2)     Display cooling fans and filters integral with cooling ducting.

b.       Design for Maintainability. The display system should be designed to minimise maintenance error and maximise maintainability.

(1)     The display mounting, connectors, and labelling, should allow quick, easy, safe, and correct access for identification, removal and replacement. Means should be provided (for example, using physically coded connectors) to prevent inappropriate connections of system elements.

(2)     If the system has the capability of providing information on system faults (for example diagnostics) to maintenance personnel, it should be displayed in text instead of coded information.

(3)     If the flight crew needs to provide information to the maintenance personnel (for example overheat warning), problems associated with the display system should be communicated to the maintenance personnel as appropriate, relative to the task and criticality of the information displayed.

(4)     The display components should be designed so they can withstand cleaning without internal damage, scratching and/or crazing (cracking).

c.       Maintenance of Display Characteristics.

(1)     Maintenance procedures may be used to ensure that the display characteristics remain within the levels presented and accepted at certification.

(2)     Experience has shown that display quality may degrade with time and become difficult to use. Examples include lower brightness/contrast; distortion or discolouration of the screen (blooming effects); and areas of the screen that may not display information properly.

(3)     Test methods and criteria may be established to determine if the display system remains within acceptable minimum levels. Display system manufacturers may alternatively provide “end of life” specifications for the displays which could be adopted by the aeroplane manufacturer.

52. – 60.      [RESERVED]

[Amdt 25/11]

[Amdt 25/12]

[Amdt 25/17]

[Amdt 25/21]

[Amdt 25/26]