AMC 25-1 On-board weight and balance systems

ED Decision 2020/024/R

Applicants for the certification of an on-board weight and balance system should take account of EUROCAE Document ED 263, ‘Minimum Operational Performance Standard for Onboard Weight and Balance Systems’, dated June 2019.

ED-263 defines standards for an advisory OBWBS (i.e. class II) that displays the measured gross weight and calculated centre of gravity for use by the flight crew as an independent means of verifying the conventional weight and balance information provided for the preparation of the dispatch of the aeroplane (e.g. the load sheet). These standards are intended to ensure that the system satisfactorily performs its intended function(s) under all the conditions normally encountered during routine operation of the aeroplane.

[Amdt 25/26]

AMC 25-11 Electronic Flight Deck Displays

ED Decision 2020/024/R

Chapter 1 Background

1.

What is the Purpose of this AMC?

 

2.

Who Does this AMC Apply to? 

 

3.

[RESERVED]

 

4.

General

 

 

 Table 1 – Topics covered by this AMC

 

 

 Table 2 – Topics outside of this AMC

 

5.

Definitions of Terms Used in this AMC

 

6.

Background

 

7. – 10.

[RESERVED]

 

Chapter 2 Electronic Display System Overview

11.

General

 

 

a. Design Philosophy

 

 

b. Human Performance Considerations

 

 

c. Addressing Intended Function in the Certification Programme

 

12. – 15.

[RESERVED]

 

Chapter 3 Electronic Display Hardware

16.

Display Hardware Characteristics

 

 

a. Visual Display Characteristics

 

 

b. Installation

 

 

c. Power Bus Transient

 

17. – 20.

[RESERVED]

 

Chapter 4 Safety Aspects of Electronic Display Systems

21.

General

 

 

a. Identification of Failure Conditions

 

 

b. Effects of Display Failure Conditions

 

 

c. Mitigation of Failure Conditions

 

 

d. Validation of the Classification of Failure Conditions and Their Effects

 

 

e. System Safety Guidelines

 

 

Table 3 – Example Safety Objectives for Attitude Failure Conditions

 

 

Table 4 – Example Safety Objectives for Airspeed Failure Conditions

 

 

Table 5 – Example Safety Objectives for Barometric Altitude Failure Conditions

 

 

Table 6 – Example Safety Objectives for Heading Failure Conditions

 

 

Table 7 – Example Safety Objectives for Certain Navigation and Communication Failure Conditions

 

 

Table 8 – Example Safety Objectives for Failure Conditions of Other Parameters

 

 

Table 9 – Example Safety Objectives for Engine Failure Conditions

 

 

Table 10 – Failure Conditions for Display Systems Used as Controls

 

22. – 30.

[RESERVED]

 

Chapter 5 Electronic Display Information Elements and Features

31.

Display Information Elements and Features

 

 

a. General

 

 

b. Consistency

 

 

c. Display Information Elements

 

 

 (1) Text

 

 

 (2) Labels

 

 

 (3) Symbols

 

 

 (4) Indications

 

 

 (a) Numeric Readouts

 

 

 (b) Scales, Dials, and Tapes

 

 

 (c) Other Graphical Depictions

 

 

 (5) Colour Coding

 

 

 Table 11 – Recommended Colours for Certain Functions

 

 

 Table 12 – Specified Colours for Certain Display Features

 

 

d. Dynamic (Graphic) Information Elements on a Display

 

 

e. Sharing Information on a Display

 

 

 (1) Overlays and Combined Information Elements

 

 

 (2) Time Sharing

 

 

 (3) Separating Information Visually

 

 

 (4) Clutter and De-Clutter

 

 

f. Annunciations and Indications

 

 

 (1) General

 

 

 (2) Location

 

 

 (3) Managing Messages and Prompts

 

 

 (4) Blinking

 

 

g. Use of Imaging

 

32. – 35.

[RESERVED]

 

Chapter 6 Organising Electronic Display Information Elements

36.

Organising Information Elements

 

 

a. General

 

 

b. Types and Arrangement of Display Information

 

 

 (1) Placement - General Information

 

 

 (2) Placement - Controls and Indications

 

 

 (3) Arrangement - Basic T Information

 

 

 (4) Arrangement - Powerplant Information

 

 

 (5) Arrangement - Other Information (For Example, Glideslope and Multi-Function Displays)

 

 

c. Managing Display Information

 

 

 (1) Window

 

 

 (2) Menu

 

 

 (3) Full-Time vs. Part-Time Display of Information

 

 

d. Managing Display Configuration

 

 

 (1) Normal Conditions

 

 

 (2) System Failure Conditions (Reconfiguration)

 

 

e. Methods of Reconfiguration

 

 

(1) Compacted Format

 

 

(2) Sensor Selection and Annunciation

 

37. – 40.

[RESERVED]

 

Chapter 7 Electronic Display System Control Devices

41.

General

 

 

a. Multi-function Control Labels

 

 

b. Multi-function Controls

 

 

 (1) “Hard” Controls

 

 

 (2) “Soft” Controls

 

 

c. Cursor Control Devices

 

 

d. Cursor Displays

 

42. – 45.

[RESERVED]

 

Chapter 8 Showing Compliance for Approval of Electronic Display Systems

46.

Compliance Considerations (Test and Compliance)

 

 

a. General

 

 

b. Means of Compliance

 

47. – 50.

[RESERVED]

 

Chapter 9 Continued Airworthiness and Maintenance

51.

Continued Airworthiness and Maintenance

 

 

a. General

 

 

b. Design for Maintainability

 

 

c. Maintenance of Display Characteristics

 

52. – 60.

[RESERVED]

 

List of Appendices

1

Primary Flight Information

 

 

1.1 Attitude

 

 

1.2 Continued Function of Primary Flight Information (Including Standby) in Conditions of Unusual Attitudes or in Rapid Manoeuvres

 

 

2.1 Airspeed and Altitude

 

 

2.2 Low and High Speed Awareness Cues

 

 

3. Vertical Speed

 

 

4. Flight Path Vector or Symbol

 

 

 

 

2

Powerplant Displays

 

 

1. General

 

 

2. Design Guidelines

 

 

 

 

3

Definitions

 

 

Figure A3-1 Primary Field of View

 

 

Figure A3-2 Display Format

 

 

 

 

4

Acronyms Used in This AMC

 

5

[RESERVED]

 

6

Head-Up Displays

 

 

1.0 Introduction

 

 

1.1 Purpose

 

 

1.2 Definition of Head-Up Display (HUD)

 

 

1.3 Other Resources

 

 

2.0 Unique Safety Characteristics

 

 

2.1 Aircraft and Systems Safety

 

 

2.2 Crew Safety

 

 

3.0 Design

 

 

3.1 Intended Function of HUDs

 

 

3.2 HUD Controls

 

 

3.3 Visibility and Field-of-View

 

 

4.0 HUD Eyebox Criteria

 

 

4.1 Design Eye Position

 

 

4.2 Design Eyebox

 

 

4.3 Conformal Display Accuracy

 

 

4.4 Symbol Positioning Alignment

 

 

4.5 Overlapping Symbols

 

 

4.6 Alignment

 

 

4.7 Visual Display Characteristics

 

 

5.0 Guidelines for Presenting Information

 

 

5.1 HUD and Head-Down Display (HDD) Compatibility

 

 

5.2 Indications and Alerts

 

 

5.3 Display Clutter

 

 

5.4 Display of Information

 

 

6.0 Dual HUDs

 

 

6.1 Operational Concept for Dual HUDs

 

 

6.2 Flight Crew Awareness of Other Instruments and Indications

 

 

6.3 Roles and Responsibilities

 

 

6.4 Reassessment

 

 

7.0 Flight Data Recording

 

 

8.0 Continued Airworthiness

 

7

Weather Displays

 

 

1.0 Introduction

 

 

1.1 Purpose

 

 

1.2 Examples

 

 

2.0 Key Characteristics

 

 

2.1 Unambiguous Meanings

 

 

2.2 Colour

 

 

2.3 Multiple Sources of Weather Information

 

 

3.0 On-Board Weather Radar Information

 

 

3.1 Background

 

 

3.2 Minimum Performance Standards

 

 

3.3 Hazard Detection

 

 

4.0 Predictive Windshear Information

 

 

4.1 General

 

 

4.2 Presentation Methods

 

 

4.3 Pilot Workload

 

 

4.4 Windshear Threat Symbol

 

 

4.5 Relative Position to the Aeroplane

 

 

4.6 Range

 

 

5.0 Safety Aspects

 

 

5.1 Functional Hazard Assessment (FHA)

 

 

5.2 Misleading Information

 

CHAPTER 1 BACKGROUND

1. What is the purpose of this AMC?

This AMC provides an Acceptable Means of Compliance for demonstrating compliance with certain Certification Specifications of CS-25, as well as general guidance for the design, installation, integration, and approval of electronic flight deck displays, components, and systems installed in large aeroplanes.

Appendix 1 to this AMC provides additional guidance for displaying primary flight information (required by CS 25.1303(b) and CS 25.1333(b)), and Appendix 2 to this AMC provides additional guidance for powerplant displays.

2. Who does this AMC apply to?

a. The acceptable means of compliance and guidance provided in this document is directed to aeroplane and avionics manufacturers, modifiers, and operators of large aeroplanes.

b. This material describes acceptable means, but not the only means, for demonstrating compliance with the applicable certification specifications. The Agency will consider other methods of demonstrating compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive Agency and industry experience in determining compliance with the relevant certification specifications. Applicants for a European Technical Standard Order (ETSO) approval should consider following this AMC when the ETSO does not provide adequate or appropriate specifications.

3.  [RESERVED]

4. General

This AMC applies to the design, integration, installation, and certification approval of electronic flight deck displays, components, and systems for large aeroplanes. As a minimum this includes:

             General airworthiness considerations,

             Display system and component characteristics,

             Safety and criticality aspects,

             Functional characteristics,

             Display information characteristics,

             Guidance to manage display information,

             Flight crew interface and interactivity, and

             Airworthiness approval (means of compliance) considerations.

Table 1, below, lists the topics included in this AMC. Table 2, below, lists the topics not included in this AMC.

Table 1: Topics Covered in this AMC

Topics

Electronic pilot displays – including single-function and multi-function displays.

Display features and functions that are intended for use by the pilot.

Display functions not intended for use by the pilot if they may interfere with the pilot’s flying duties.

Display aspects of Class III Electronic Flight Bag (installed equipment).

Controls associated with the electronic displays covered in this AMC. These controls include hard controls (physical buttons and knobs) and soft controls (virtual or programmable buttons and knobs, generally controlled through a cursor device or line select keys).

Electronic standby displays.

Head-Up Displays (HUD).

Table 2: Topics Outside this AMC

Topics

Display functions not intended for use by the pilot.

In flight entertainment displays.

Flight attendant displays.

Maintenance terminals, even if they are in the flight deck, but not intended for use by the pilots.

Head mounted displays used by pilots.

Displays in the flight crew rest area.

Handheld or laptop items (not installed equipment).

Class I and Class II Electronic Flight Bags.

Electromechanical instruments.

Auditory “displays” (for example, aural alerts), and tactile “displays” (for example, stick shaker).

Flight controls, throttles, and other (hard) controls not directly associated with the electronic displays.

In addition to this AMC, new AMC 25.1302 published in CS-25 Amendment 3, provides acceptable means of compliance with certification specifications associated with the design of flight crew interfaces such as displays, indications, and controls. AMC 25.1322 provides a means of compliance for flight crew alerting systems. The combination of these AMCs is intended to embody a variety of design characteristics and human-centred design techniques that have wide acceptance, are relevant, and can be reasonably applied to large aeroplane certification projects.

Other advisory material is used to establish guidance for specific functionality and characteristics provided by electronic displays. This AMC is not intended to replace or conflict with these existing AMCs but rather provides a top-level view of flight deck displays. Conflicts between this AMC and other advisory material will be resolved on a case-by-case basis in agreement with the Agency.

5.  Definitions of Terms Used in this AMC

a. For the purposes of this AMC, a “display system” includes not only the display hardware and software components but the entire set of avionic devices implemented to display information to the flight crew. Hardware and software components of other systems that affect displays, display functions, or display controls should take into account the display aspects of this AMC. For example, this AMC would be applicable to a display used when setting the barometric correction for the altimeter, even though the barometric set function may be part of another system.

b. For the purposes of this AMC, “foreseeable conditions” means the full environment in which the display or the display system is assumed to operate, given its intended function. This includes operating in normal, non-normal, and emergency conditions.

c. Definitions of technical terms used in this AMC can be found in Appendix 3 of this AMC. The acronyms used throughout this document are included in Appendix 4 of this AMC.

6.  Background

a. Electronic displays can present unique opportunities and challenges to the design and certification process. In many cases, the demonstration of compliance with Certification Specifications related to the latest flight deck display system capabilities has been subject to a great deal of interpretation by applicants and the Agency. At the time the first electronic displays were developed, they were direct replacements for the conventional electromechanical components. The initial release of AMC 25-11 established an Acceptable Means of Compliance for the approval of Cathode Ray Tube (CRT)-based electronic display systems used for guidance, control, or decision-making by the flight crews of large aeroplanes. This initial release was appropriate for CRTs, but additional specifications were needed to update AMC 25-11 to address new technologies. Additional appendices have been added to address Head-Up Displays (Appendix 6) and Weather Displays (Appendix 7).

b. The FAA and EASA have established a number of specifications intended to improve aviation safety by requiring that the flight deck design have certain capabilities and characteristics. The approval of flight deck displays and display systems has typically been addressed by invoking many specifications that are specific to certain systems, or to specifications with general applicability such as CS 25.1301(a), CS 25.771(a), and CS 25.1523. Thus, this AMC provides acceptable means of compliance and guidance related to these and other applicable airworthiness specifications.

7. - 10. [RESERVED]

CHAPTER 2 ELECTRONIC DISPLAY SYSTEM OVERVIEW

11.  General

The following paragraphs provide acceptable means of compliance and guidance that applies to the overall electronic display system. This chapter, together with Chapters 3 through 7 of this AMC, provides compliance objectives and design guidance. Chapter 8 provides general guidance on how to show compliance for approval of electronic display systems. The material in Chapters 2 through 9 and Appendices 1 and 2 of this AMC constitutes an overall method of compliance for the approval of an electronic display system.

a.  Design Philosophy.

The applicant should establish, document, and follow a design philosophy for the display system that supports the intended functions (CS 25.1301). The documented design philosophy may be included as part of a system description, certification programme, or other document that is submitted to the Agency during a certification project. The design philosophy should include a high level description of:

(1) General philosophy of information presentation – for example, is a “quiet, dark” flight deck philosophy used or is some other approach used?

(2) Colour philosophy on the electronic displays – the meaning and intended interpretation of different colours – for example, does magenta always represent a constraint?

(3) Information management philosophy – for example, when should the pilot take an action to retrieve information or is it brought up automatically? What is the intended interpretation of the location of the information?

(4) Interactivity philosophy - for example, when and why is pilot confirmation of actions requested? When is feedback provided?

(5) Redundancy management philosophy – for example, how are single and multiple display failures accommodated? How are power supply and data bus failures accommodated?

b.  Human Performance Considerations.

The applicant should establish and document the following human performance elements when developing a display system:

             Flight crew workload during normal and non-normal operations, including emergencies,

             Flight crew training time to become sufficiently familiar with using the display, and

             The potential for flight crew error.

A high workload or excessive training time may indicate a display design that is difficult to use, requires excessive concentration, or may be prone to flight crew errors. Compliance considerations are included in Chapter 8 of this AMC.

c. Addressing Intended Function in the Certification Programme

The certification programme should identify the appropriate CS-25 certification specifications. An important part of the certification programme will be the system description(s) and all intended functions, including attitude, altitude, airspeed, engine parameters, horizontal situation display, etc. To demonstrate compliance with CS 25.1301(a), an applicant must show that the design is appropriate for its intended function. The applicant’s description of intended function needs to be sufficiently specific and detailed for the Agency to be able to evaluate that the system is appropriate to its intended function. (CS 25.1302 and associated AMC provide additional information on intended function). General and/or ambiguous intended function descriptions are not acceptable (for example, a function described only as “situation awareness”). Some displays may be intended to be used for situation awareness, but that term needs to be clarified or qualified to explain what type of specific situation awareness will be provided. More detailed descriptions may be warranted for designs that are new, novel, highly integrated, or complex. Many modern displays have multiple functions and applicants should describe each intended function. A system description is one place to document the intended function(s).

Display systems and display components that are not intended for use by the flight crew (such as maintenance displays) should not interfere with the flying duties of the flight crew.

12 - 15. [RESERVED]

CHAPTER 3 ELECTRONIC DISPLAY HARDWARE

16. Display Hardware Characteristics

The following paragraphs provide general guidance and a means of compliance for electronic display hardware with respect to its basic visual, installation, and power bus transient handling characteristics. A more detailed set of display hardware characteristics can be found in the following SAE International (formerly the Society of Automotive Engineers) documents:

             For electronic displays – SAE Aerospace Standards (AS) 8034B, '''Minimum Performance Standard for Airborne Multipurpose Electronic Displays'''.

             For head up displays - SAE AS8055, “Minimum Performance Standard for Airborne Head Up Display (HUD)”.

             For liquid crystal displays (LCDs) – SAE Aerospace Recommended Practice (ARP) 4256A, “Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft”.

NOTE 1: For LCDs, the quantitative criterion in SAE ARP 4256A, paragraph 4.2.6., equation 5, is not considered a reliable predictor of acceptable specular reflectivity characteristics. Accordingly, this aspect of LCD performance should be specifically assessed via flight crew evaluation to establish that there are not internal or external reflections that can result in flight crew distraction or erroneous interpretation of displayed information.

NOTE 2: With regard to the criteria for malfunction indication in SAE ARP 4256A, paragraph 3.4, the Agency has determined that showing the fonts and symbols to be tolerant to the loss of a single column, line, or element is an acceptable alternative to providing a malfunction indication. Proposed designs that do not use fonts and symbols that are tolerant to these faults are acceptable if they meet the criteria in SAE ARP 4256A.

NOTE 3: The applicant should notify the Agency if any visual display characteristics do not meet the guidelines in the applicable SAE documents.

NOTE 4: The most recent revision of the referenced SAE documents should be considered. If there is a conflict between the guidance in an SAE document and AMC 25-11, follow the guidance in AMC 25-11.

a.  Visual Display Characteristics

The visual display characteristics of a flight deck display are directly linked to their optical characteristics. Display defects (for example, element defects or stroke tails) should not impair readability of the display or create erroneous interpretation. In addition to the information elements and features identified in Chapter 5 of this AMC, and the visual characteristics in SAE ARP 4256A, SAE AS 8034B, and 8055 described above, the display should meet the criteria for the following characteristics. These characteristics are independent of the proposed display technology.

(1) Physical Display Size. A display should be large enough to present information in a form that is usable (for example, readable or identifiable) to the flight crew from the flight crew stationin all foreseeable conditions, relative to the operational and lighting environment and in accordance with its intended function(s).

(2) Resolution and Line Width. The resolution and minimum line width should be sufficient to support all the displayed images such that the displayed information is visible and understandable without misinterpretation from the flight crew station in all foreseeable conditions, relative to the operational and lighting environment.

(3) Luminance. Information should be readable over a wide range of ambient illumination under all foreseeable conditions relative to the operating environment, including but not limited to:

             Direct sunlight on the display,

             Sunlight through a front window illuminating white shirts (reflections),

             Sun above the forward horizon and above a cloud deck in a flight crew member’s eyes, and

             Night and/or dark environment.

(a) For low ambient conditions, the display should be dimmable to levels allowing for the flight crew’s adaptation to the dark, such that outside vision and an acceptable presentation are maintained.

(b) Automatic luminance adjustment systems can be employed to decrease pilot workload and increase display life. Operation of these systems should be satisfactory over a wide range of ambient light conditions, including the extreme cases of a forward low sun and a quartering rearward sun shining directly on the display.

1. Some manual adjustment should be retained to provide for normal and non-normal operating differences so that the luminance variation is not distracting and does not interfere with the flight crew’s ability to perform their tasks.

2. Displays or layers of displays with uniformly filled areas conveying information such as weather radar imagery should be independently adjustable in luminance from overlaid symbology. The range of luminance control should allow detection of colour differences between adjacent small filled areas no larger than 5 milliradians in principal dimension; while at this setting, overlying map symbology, if present, should be discernible.

(c) Display luminance variation within the entire flight deck should be minimised so that displayed symbols, lines, or characters of equal luminance remain uniform under any luminance setting and under all foreseeable operating conditions.

(4) Contrast Ratio

(a) The display’s contrast ratio should be sufficient to ensure that the information is discernable under the whole ambient illumination range from the flight crew station under all foreseeable conditions relative to the operating environment.

(b) The contrast between all symbols, characters, lines, and their associated backgrounds should be sufficient to preclude confusion or ambiguity of any necessary information.

(5) Chromaticity

(a) The display chromaticity differences, in conjunction with luminance differences, should be sufficient to allow graphic symbols to be discriminated from each other, from their backgrounds (for example, external scene or image background) and background shaded areas, from the flight crew station, in all foreseeable conditions relative to the lighting environment. Raster or video fields (for example, non-vector graphics such as weather radar) should allow the image to be discriminated from overlaid symbols, and should allow the desired graphic symbols to be displayed. See SAE AS 8034A, sections 4.3.3 and 4.3.4, for additional guidance.

(b) The display should provide chromaticity stability over the foreseeable conditions relative to the range of operating temperatures, viewing envelope, image dynamics, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.

(6) Grey Scale

(a) The number of shades of gray and the difference between shades of gray that the display can provide should be adequate for all image content and its use, and should accommodate all viewing conditions.

(b) The display should provide sufficient gray scale stability over the foreseeable range of operating temperatures, viewing envelope, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.

(7) Display Response. The dynamic response of the display should be sufficient to present discernable and readable information that is not misleading, distracting, or confusing. The response time should be sufficient to ensure dynamic stability of colours, line widths, gray scale, and relative positioning of symbols. Undesirable display characteristics, such as smearing of moving images and loss of luminance, should be minimised so that information is still readable and identifiable under all foreseeable conditions, not distracting, and does not lead to misinterpretation of data.

(8) Display Refresh Rate. The display refresh rate should be sufficient to prevent flicker effects that result in misleading information or difficulty in reading or interpreting information. The display refresh rate should be sufficient to preclude the appearance of unacceptable flicker.

(9) [RESERVED]

(10) Display Defects. Display defects, such as element defects and stroke tails, resulting from hardware and graphical imaging causes should not impair readability of the displays or induce or cause erroneous interpretation. This is covered in more detail in SAE ARP 4256A, SAE AS 8034B, and 8055.

(11)  [RESERVED]

(12)  Flight Deck Viewing Envelope. The size of the viewing envelope should provide visibility of the flight deck displays over the flight crew’s normal range of head motion, and support cross-flight deck viewing if necessary; for example, when it is required that the captain be able to view and use the first officer’s primary flight information.

b.  Installation

(1) Flight deck display equipment and installation designs should be compatible with the overall flight deck design characteristics (such as flight deck size and shape, flight crew member position, position of windows, external luminance, etc.) as well as the aeroplane environment (such as temperature, altitude, electromagnetic interference, and vibration).

(2) European Organisation for Civil Aviation Electronics (EUROCAE) ED-14 Environmental Conditions and Test Procedures for Airborne Equipment, at the latest revision, provides information that may be used for an acceptable means of qualifying display equipment for use in the aeroplane environment.

(3) [RESERVED]

(4) The installation of the display equipment must not adversely affect its readability and the external scene visibility of the flight crew under all foreseeable conditions relative to the operating and lighting environment (CS 25.1321(a), CS 25.773(a)(1)).

(5) The installation of the display equipment must not cause glare or reflection, either on the displays or on the flight deck windows, that could interfere with the normal duties of the minimum flight crew (CS 25.773(a)(2)) under all foreseeable conditions.

(6) If the display system design is dependent on cross-flight deck viewing for its use, the installation should take into account the viewing angle limitations of the display units, the size of the displayed information, and the distance of the display from each flight crew member.

(7) When a display is used to align or overlay symbols with real-world external data (for example, HUD symbols), the display should be installed such that the positioning accuracy of these symbols is maintained during all phases of flight. Appendix 6 to this AMC and SAE ARP 5288, Transport Category Aeroplane Head Up Display (HUD) Systems, provides additional details regarding the symbol positioning accuracy for conformal symbology on an HUD.

(8) The display system components should not cause physical harm to the flight crew under foreseeable conditions relative to the operating environment (for example, turbulence or emergency egress, bird strike, hard landing, and emergency landing).

(9) The installed display must not visually obstruct other controls and instruments or prevent those controls and instruments from performing their intended function (CS 25.1301).

(10)  The display system must not be adversely susceptible to electromagnetic interference from other aeroplane systems (CS 25.1431) under all foreseeable conditions.

(11)  The display components should be installed in such a way that they retain mechanical integrity (secured in position) for all foreseeable conditions relative to the flight environment.

(12)  Liquid spill on or breakage of a display system component in the flight deck should not result in a hazard.

c. Power Bus Transient. EUROCAE document ED-14, at the latest revision, provides information that may be used for an acceptable means of qualifying display equipment such that the equipment performs its intended function when subjected to anomalous input power. SAE ARP 4256A, Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft, provides additional information for power transient recovery (specifically for the display unit).

(1) Flight deck displays and display systems should be insensitive to power transients caused by normal load switching operation of the aeroplane, in accordance with their intended function.

(2) The electronic attitude display should not be unusable or unstable for more than one second after electrical bus transients due to engine failure. Only displays on one side of the aeroplane should be affected by an engine failure. Recognisably valid pitch and roll data should be available within one second on the affected displays and any effects lasting beyond one second should not interfere with the ability to obtain quick glance valid attitude. For most aeroplanes an engine failure after take-off will simultaneously create a roll acceleration, new pitch attitude requirements, and an electrical transient. Attitude information is paramount; if there is an engine failure, transfer to standby attitude or transfer of control of the aeroplane to the other pilot cannot be reliably accomplished in a timely enough manner to prevent an unsafe condition. In testing this failure mode, experience has shown that switching the generator off at the control panel may not result in the longest electrical transient. One practical way to simulate this failure is with a fuel cut which will allow the generator output voltage and frequency to decrease until the bus control recognises the failure. Other engine failure conditions may be more critical (such as sub-idle stalls) which cannot be reasonably evaluated during flight test. Analysis should identify these failure modes and show that the preceding criteria are met.

(3) Non-normal bus transients (for example, generator failure) should not initiate a power up initialisation or cold start process.

(4) The display response to a short term power interrupt (<200 milliseconds) should be such that the intended function of the display is not adversely affected.

(5) Following in-flight long term power interrupts (>200 milliseconds), the display system should quickly return to operation in accordance with its intended function, and should continue to permit the safe control of the aeroplane in attitude, altitude, airspeed, and direction.

(6) The large electrical loads required to restart some engine types should not affect more than one pilot’s display during the start sequence.

17. – 20.  [RESERVED]

CHAPTER 4. SAFETY ASPECTS OF ELECTRONIC DISPLAY SYSTEMS

21.  General. This chapter provides additional guidance and interpretative material for applying CS 25.1309 and CS 25.1333(b) to the approval of display systems. Using electronic displays and integrated modular avionics allows designers to integrate systems to a much higher degree than was practical with previous flight deck components. Although operating the aeroplane may become easier as a result of the integration, evaluating the conditions in which the display system could fail and determining the severity of the resulting failure effects may become more complex. The evaluation of the failure conditions should identify the display function and include all causes that could affect that function’s display and display equipment. CS 25.1309 defines the basic safety specifications for the airworthiness approval of aeroplane systems

a.  Identification of Failure Conditions. One of the initial steps in establishing compliance with CS 25.1309 is identifying the failure conditions that are associated with a display or a display system. The following paragraphs provide material that may be useful in supporting this initial activity. The analysis of the failure condition should identify the impacted functionality, the effect on the aeroplane and/or its occupants, any considerations related to phase of flight, and identify any flight deck indication, flight crew action, or other relevant mitigation means.

(1) The type of display system failure conditions will depend, to a large extent, on the architecture (Integrated Modular Avionics, Federated System, Non-Federated System, etc.), design philosophy, and implementation of the system. Types of failure conditions include:

             Loss of function (system or display).

             Failure of display controls – loss of function or malfunction such that controls perform in an inappropriate manner, including erroneous display control.

             Malfunction (system or display) that leads to:

             Partial loss of data, or

             Erroneous display of data that is either:

             Detected by the system (for example, flagged or comparator alert), and/or easily detectable by the flight crew; or

             Difficult to detect by the flight crew or not detectable and assumed to be correct (for example, “Misleading display of ….”).

(2) When a flight deck design includes primary and standby displays, consider failure conditions involving the failure of standby displays in combination with the failure of primary displays. The flight crew may use standby instruments in two complementary roles following the failure of primary displays:

(a) Redundant display to cope with failure of main instruments, or

(b) Independent third source of information to resolve inconsistencies between primary instruments.

(3) When the display of erroneous information is caused by failure of other systems which interface with the display system, the effects of these failures may not be limited to the display system. Associated failure conditions may be dealt with at the aeroplane level or within the other systems’ safety assessment, as appropriate, in order to assess the cumulative effect.

b.  Effects of Display Failure Conditions. The effects of display system failure conditions on safe operations are highly dependent on pilot skills, flight deck procedures, phase of flight, type of operations being conducted, and instrument or visual meteorological conditions.

(1) Based on previous aeroplane certification programmes, paragraph 21e of this AMC shows examples of safety objectives for certain failure conditions. These safety objectives do not preclude the need for a safety assessment of the actual effects of these failures, which may be more or less severe depending on the design. Therefore, during the CS 25.1309 safety assessment process, the Agency will need to agree with the applicant’s hazard classifications for these failure conditions in order for the assessment to be considered valid.

(2) When assessing the effects that result from a display failure, consider the following, accounting for phases of flight when relevant:

             Effects on the flight crew’s ability to control the aeroplane in terms of attitude, speed, accelerations, and flight path, potentially resulting in:

             Controlled flight into terrain,

             Loss of control of the aeroplane during flight and/or during critical flight phases (approach, take-off, go-around, etc.),

             Inadequate performance capability for phase of flight, including:

             Loss of obstacle clearance capability, and

             Exceeding take-off or landing field length.

             Exceeding the flight envelope,

             Exceeding the structural integrity of the aeroplane, and

             Causing or contributing to pilot induced oscillations.

             Effects on the flight crew’s ability to control the engines, such as:

             Those effects resulting in shutting down a non-failed engine in response to the failure of a different engine, and

             Undetected, significant thrust loss.

             Effects on the flight crew’s management of the aeroplane systems.

             Effects on the flight crew’s performance, workload and ability to cope with adverse operating conditions.

             Effects on situation awareness; for example, the specific effects must be identified, such as situation awareness related to navigation or system status.

             Effects on automation if the display is used as a controlling device.

(3) When the display system is used as a control device for other aeroplane systems, consider the cumulative effect of a display system failure on all of the controlled systems.

c.  Mitigation of Failure Conditions

(1) When determining mitigation means for a failure condition consider the following:

             Protection against common mode failures.

             Fault isolation and reconfiguration.

             Redundancy (for example, heading information may be provided by an independent integrated standby and/or a magnetic direction indicator).

             Availability of, level of, timeliness of, and type of, alert provided to the flight crew.

             The flight phase and the aircraft configuration.

             The duration of the condition.

             The aircraft motion cues that may be used by the flight crew for recognition.

             Expected flight crew corrective action on detection of the failure, and/or operational procedures.

             In some flight phases, ability of the flight crew to control the aeroplane after a loss of primary attitude display on one side.

             The flight crew’s ability to turn off a display (for example, full bright display at night).

             Protections provided by other systems (for example, flight envelope protection or augmentation systems).

(2) The mitigation means should be described in the safety analysis/assessment document or by reference to another document (for example, a system description document). The continued performance of the mitigation means, in the presence of the failure conditions, should also be identified and assured.

(3) The safety assessment should include the rationale and coverage of any display system protection and monitoring philosophies used in the design. The safety assessment should also include an evaluation of each of the identified display system failure conditions and an analysis of the exposure to common mode/cause or cascade failures in accordance with AMC 25.1309. Additionally, the safety assessment should justify and describe any functional partitioning schemes employed to reduce the effect of integrated component failures or functional failures.

d.  Validation of the Classification of Failure Conditions and Their Effects.

There may be situations where the severity of the effect of the failure condition identified in the safety analysis needs to be confirmed. Laboratory, simulator, or flight test may be appropriate to accomplish the confirmation. The method of validating the failure condition classification will depend on the effect of the condition, assumptions made, and any associated risk. If flight crew action is expected to cope with the effect of a failure condition, the information available to the flight crew should be useable for detection of the failure condition and to initiate corrective action.

e.  System Safety Guidelines

(1) Experience from previous certification programmes has shown that a single failure due to a loss or malfunction of the display system, a sensor, or some other dependent system, which causes the misleading display of primary flight information, may have negative safety effects. It is recommended that the display system design and architecture implement monitoring of the primary flight information to reduce the probability of displaying misleading information.

(2) Experience from previous certification programmes has shown that the combined failure of both primary displays with the loss of the standby system can result in failure conditions with catastrophic effects.

(3) When an integrated standby display is used to provide a backup means of primary flight information, the safety analysis should substantiate that common cause failures have been adequately addressed in the design, including the design of software and complex hardware. In particular, the safety analysis should show that the independence between the primary instruments and the integrated standby instruments is not violated becausethe integrated standby display may interface with a large number of aeroplane components, including power supplies, pitot static ports, and other sensors.

(4) There should be a means to detect the loss of or erroneous display of primary flight information, either as a result of a display system failure or the failure of an associated sensor. When loss or malfunction of primary flight information is detected, the means used to indicate the lost or erroneous information should ensure that the erroneous information will not be used by the flight crew (for example, removal of the information from the display or placement of an “X” through the failed display).

(5) The means used to indicate the lost or erroneous information, when it is detected, should be independent of the failure mechanism. For example, the processor that originates the erroneous parameter should not be the same processor that annunciates or removes the erroneous parameter from the display. Common mode failures of identical processor types should be considered (for example, common mode failures may exist in a processor used to compute the display parameters and an identical processor used for monitoring and annunciating failures.)

(6) A catastrophic failure condition should not result from the failure of a single component, part, or element of a system. Failure containment should be provided by the system design to limit the propagation of the effects of any single failure and preclude catastrophic failure conditions. In addition, there should not be a common cause failure that could affect both the single component, part, or element and its failure containment provisions.

(7) For safety-critical display parameters, there should be a means to verify the correctness of sensor input data. Range, staleness, and validity checks should be used where possible.

(8) The latency period induced by the display system, particularly for alerts, should not be excessive and should take into account the criticality of the alert and the required crew response time to minimise propagation of the failure condition.

(9) For those systems that integrate windowing architecture into the display system, a means should be provided to control the information shown on the displays, such that the integrity of the display system as a whole will not be adversely impacted by anomalies in the functions being integrated. This means of controlling the display of information, called window manager in this AMC, should be developed to the software assurance level at least as high as the highest integrity function of any window. For example, a window manager should be level “A” if the information displayed in any window is level “A” (see AMC 20-115 Software Considerations for Airborne Systems and Equipment Certification). SAE ARP 4754A/EUROCAE ED-79A, Guidelines for development of civil aircraft and systems, provides a recommended practice for system development assurance.

(10)  System Safety Assessment Guidelines.The complete set of failure conditions to be considered in the display system safety analysis and the associated safety objective are established during the system safety assessment, and agreed upon by the applicant and the approving civil airworthiness agency. The safety assessment should consider the full set of display system intended functions as well as display system architecture and design philosophy (for example, failure modes, failure detection and annunciation, redundancy management, system and component independence and isolation). The system safety analysis is required by CS 25.1309, and indirectly by other specifications, including CS 25.901, CS 25.903, and CS 25.1333.

The following tables provide examples of failure conditions and associated safety objectives common to numerous display systems that are already certified. These tables are provided to identify a set of failure conditions that need to be considered; however, these are only examples. These examples do not replace the need for a system safety assessment and are not an exhaustive list of failure conditions. For these example failure conditions, additional functional capabilities or less operational mitigation may result in higher safety objectives, while reduced functional capability or increase operational mitigation may result in lower safety objectives.

1  Attitude (Pitch and Roll). The following table lists examples of safety objectives for attitude related failure conditions.

Table 3 Example Safety Objectives for Attitude Failure Conditions

Failure Condition

Safety Objective

Loss of all attitude displays, including standby display

Extremely Improbable

Loss of all primary attitude displays

Remote - Extremely Remote

Display of misleading attitude information on both primary displays

Extremely Improbable

Display of misleading attitude information on one primary display

Extremely Remote

Display of misleading attitude information on the standby display

Remote

Display of misleading attitude information on one primary display combined with a standby failure (loss of attitude or incorrect attitude)

Extremely Improbable

Notes

(1) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2) Consistent with the “Loss of all attitude display, including standby display” safety objective, since the flight crew may not be able to identify the correct display. Consideration will be given to the ability of the flight crew to control the aeroplane after a loss of attitude primary display on one side in some flight phases (for example, during take-off).

2  Airspeed. The following table lists examples of safety objectives for airspeed related failure conditions.

Table 4 Example Safety Objectives for Airspeed Failure Conditions

Failure Condition

Safety Objective

Loss of all airspeed displays, including standby display

Extremely Improbable

Loss of all primary airspeed displays

Remote - Extremely Remote

Display of misleading airspeed information on both primary displays, coupled with loss of stall warning or loss of over-speed warning

Extremely Improbable

Display of misleading airspeed information of the standby display (primary airspeed still available)

Remote

Display of misleading airspeed information on one primary display combined with a standby failure (loss of airspeed or incorrect airspeed)

Extremely Improbable

Notes

(1) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2) Consistent with the “Loss of all airspeed display, including standby display” safety objective, since the flight crew may not be able to separate out the correct display.

3  Barometric Altitude. The following table lists examples of safety objectives for barometric altitude related failure conditions.

Table 5 Example Safety Objectives for Barometric Altitude Failure Conditions

Failure Condition

Safety Objective

Loss of all barometric altitude displays, including standby display

Extremely Improbable

Loss of all barometric altitude primary displays

Remote - Extremely Remote

Display of misleading barometric altitude information on both primary displays

Extremely Improbable

Display of misleading barometric altitude information on the standby display (primary barometric altitude still available)

Remote

Display of misleading barometric altitude information on one primary display combined with a standby failure (loss of altitude or incorrect altitude)

Extremely Improbable

Notes

(1) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2) Consistent with the “Loss of all barometric altitude display, including standby display” safety objective since the flight crew may not be able to separate out the correct display. Consideration should be given that barometric setting function design is commensurate with the safety objectives identified for barometric altitude.

4  Heading. The following table lists examples of safety objectives for heading related failure conditions.

(aa) The standby heading may be provided by an independent integrated standby or the magnetic direction indicator.

(bb) The safety objectives listed below can be alleviated if it can be demonstrated that track information is available and correct.

Table 6 Example Safety Objectives for Heading Failure Conditions

Failure Condition

Safety Objective

Loss of heading on the flight deck on both pilots' primary displays

Remote

Loss of all heading displays on the flight deck

Extremely Improbable

Display of misleading heading information on both pilots' primary displays

Remote - Extremely Remote2)

Display of misleading heading information on one primary display combined with a standby failure (loss of heading or incorrect heading)

Remote – Extremely Remote2)

Notes

(1) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2) This assumes the availability of an independent, heading required by CS 25.1303(a)(3).

5  Navigation and Communication (Excluding Heading, Airspeed, and Clock Data). The following table lists examples of safety objectives for navigation and communication related failure conditions.

Table 7 Example Safety Objectives for Certain Navigation and Communication Failure Conditions

Failure Condition

Safety Objective

Loss of display of all navigation information

Remote

Non-restorable loss of display of all navigation information coupled with a total loss of communication functions

Extremely Improbable

Display of misleading navigation information simultaneously to both pilots

Remote – Extremely Remote

Loss of all communication functions

Remote

Note

(1) “All” means loss of all navigation information, excluding heading, airspeed, and clock data. If any or all of the latter information is also lost then a higher classification may be warranted.

6  Other Parameters (Typically Shown on Electronic Display Systems). The following table lists examples of safety objectives for failure conditions related to other parameters typically shown on electronic display systems.

Table 8 Example Safety Objectives for Failure Conditions of Other Parameters

Failure Condition

Safety Objective

Display of misleading flight path vector information to one pilot

Remote

Loss of all vertical speed displays

Remote

Display of misleading vertical speed information to both pilots

Remote

Loss of all slip/skid indication displays

Remote

Display of misleading slip/skid indication to both pilots

Remote

Display of misleading weather radar information

Remote

Total loss of flight crew alerting displays

Remote

Display of misleading flight crew alerting information

Remote

Display of misleading flight crew procedures

Remote – Extremely Improbable

Loss of the standby displays

Remote

Notes

(1) The safety objective may be more stringent depending on the use and on the phase of flight

(2) Applicable to the display part of the system only.

(3) See also AMC 25.1322.

(4) To be evaluated depending on the particular procedures and associated situations.

7  Engine. Table 9, below, lists examples of generally accepted safety objectives for engine related failure conditions. Appendix 2 of this AMC provides additional guidance for powerplant displays.

(aa)  The term “required engine indications” refers specifically to the engine thrust/power setting parameter (for example, engine pressure ratio, fan speed, or torque) and any other engine indications that may be required by the flight crew to maintain the engine within safe operating limits (for example, rotor speeds or exhaust gas temperature).

(bb) The information in Table 9 is based on the premise that the display failure occurs while operating in an autonomous engine control mode. Autonomous engine control modes, such as those provided by full authority digital engine controls, protect continued safe operation of the engine at any thrust lever setting. Hence, the flight deck indications and associated flight crew actions are not the primary means of protecting safe engine operation.

(cc)  Where the indications serve as the primary means of assuring continued safe engine operation, the hazard classification may be more severe. For example, under the table entry “Loss of one or more required engine indications on more than one engine,” the hazard classification would change to “Catastrophic” and the probability would change to “Extremely Improbable.”

(dd) Each of the general failure condition descriptions provided in Table 9 represents a set of more specific failure conditions. The hazard classifications and probabilities provided in Table 9 represent the most severe outcome typically associated with any failure condition within the set. If considered separately, some of the specific failure conditions within each set would likely have less severe hazard classifications and probabilities.

Table 9 Example Safety Objectives for Engine Failure Conditions

Failure Condition

Safety Objective

Loss of one or more required engine indications for a single engine

Remote

Misleading display of one or more required engine indications for a single engine

Remote

Loss of one or more required engine indications for more than one engine

Remote - Extremely Remote

Misleading display of any required engine indications for more than one engine

Extremely Remote - Extremely Improbable

Notes

(1) The worst anticipated outcomes associated with this class of failure may often be driven by consideration of the simultaneous loss of all required engine indications. In any case, those outcomes will typically include both a high speed take-off abort and loss of the backup means to assure safe engine operations. High speed aborts have typically been classified as “hazardous” by the Agency due to the associated impacts on both flight crew workload and safety margins. Since any number of single failures or errors can defeat the protections of a typical autonomous engine control, losing the ability to backup the control is considered a sufficiently large reduction in the safety margins to also warrant a “hazardous” classification. Hence the “Extremely Remote” design guideline was chosen.

(2) If the power setting parameter is indicating higher than actual during take-off, this can lead directly to a catastrophe, either due to a high speed runway overrun or impacting an obstacle after take-off. This classification has been debated and sustained by the Agency numerous times in the past. Hence the “Extremely Improbable” probability is listed.

8  Use of Display Systems as Controls. Hazard classifications and safety objectives are not provided for display systems used as controls because the failure conditions are dependant on the functions and systems being controlled or on alternative means of control. The use of display systems as controls is described in Chapter 7 of this AMC. The following table lists the failure conditions when display systems are used as controls.

Table 10 Failure Conditions for Display Systems Used as Controls

Failure Condition

Safety Objective

Total loss of capability to use the display system as a control

Depends on system being controlled.

Undetected erroneous input from the display system as a control

Depends on system being controlled.

22.– 30.  [RESERVED]

CHAPTER 5 ELECTRONIC DISPLAY INFORMATION ELEMENTS AND FEATURES

31. Display Information Elements and Features. This chapter provides guidance for the display of information elements including text, labels, symbols, graphics, and other depictions (such as schematics) in isolation and in combination. It covers the design and format of these information elements within a given display area. Chapter 6 of this AMC covers the integration of information across several display areas in the flight deck, including guidance on flight deck information location, display arrangement, windowing, redundancy management, and failure management.

a. General

(1) The following list provides objectives for each display information element, in accordance with its intended function:

             Each flight, navigation, and powerplant instrument for use by any pilot must be plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path (CS 25.1321(a)).

             The displayed information should be easily and clearly discernable, and have enough visual contrast for the pilot to see and interpret it. Overall, the display should allow the pilot to identify and discriminate the information without eyestrain. Refer to paragraph 16a(4) of this AMC for additional guidance regarding contrast ratio.

             For all display configurations, all foreseeable conditions relative to lighting should be considered. Foreseeable lighting considerations should include failure modes such as lighting and power system failure, the full range of flight deck lighting and display system lighting options, and the operational environment (for example, day and night operations). If a visual indicator is provided to indicate a malfunction of an instrument, it must be effective under all foreseeable lighting conditions (CS 25.1321(e)).

             Information elements (text, symbol, etc.) should be large enough for the pilot to see and interpret in all foreseeable conditions relative to the operating environment and from the flight crew station. If two or more pilots need to view the information, the information elements should also be discernable and interpretable over these viewing distances.

             The pilots should have a clear, unobstructed, and undistorted view of the displayed information.

             Information elements should be distinct and permit the pilots to immediately recognise the source of the information elements when there are multiple sources of the same kind of information. For example, if there are multiple sources for vertical guidance information, then each informational element should be distinct so the flight crew can immediately recognise the source of the vertical guidance.

(2) Factors to consider when designing and evaluating the viewability and readability of the displayed information include:

             Position of displayed information: Distance from the design eye position (DEP) is generally used. If cross-flight deck viewing of the information is needed, distance from the offside DEP, accounting for normal head movement, should be used. For displays not mounted on the front panel, the distance determination should include any expected movement away from the DEP by the flight crew.

             Vibrations: Readability should be maintained in adverse conditions, such as vibration. One possible cause of vibration is sustained engine imbalance. AMC 25-24, Sustained Engine Imbalance, provides readability guidance for that condition.

             Visual Angles: Account for both the position of the displayed information as well as font height. SAE ARP 4102/7, Electronic Displays, provides additional information on this subject.

             Readability of Display Information: The Illuminating Engineering Society classifies three main parameters that affect readability: luminance, size, and contrast. Size is the combination of font size and distance from the display.

b. Consistency. Display information should be presented so it is consistent with the flight deck design philosophy in terms of symbology, location, control, behaviour, size, shape, colour, labels, dynamics and alerts. Consistency also applies to the representation of information on multiple displays on the same flight deck. Display information representing the same thing on more than one display on the same flight deck should be consistent. Acronyms and labels should be used consistently, and messages/annunciations should contain text in a consistent way. Inconsistencies should be evaluated to ensure that they are not susceptible to confusion or errors, and do not adversely impact the intended function of the system(s) involved.

c. Display Information Elements

(1) Text.Text should be shown to be distinct and meaningful for the information presented. Messages should convey the meaning intended. Abbreviations and acronyms should be clear and consistent with established standards. For example, International Civil Aviation Organization (ICAO) document 8400, Procedures for Air Navigation Services ICAO Abbreviations and Codes, provides internationally recognised standard abbreviations and airport identifiers.

(a) Regardless of the font type, size, colour, and background, text should be readable in all foreseeable lighting and operating conditions from the flight crew station (CS 25.1321(a)). General guidelines for text are as follows:

             Standard grammatical use of upper and lower case letters is recommended for lengthy documentation and lengthy messages. Using this format is also helpful when the structure of the text is in sentence form.

             The use of only upper case letters for text labels is acceptable.

             Break lines of text only at spaces or other natural delimiters.

             Avoid abbreviations and acronyms where practical.

             SAE ARP 4102/7, Electronic Displays, provides guidelines on font sizes that are generally acceptable.

(b) The choice of font also affects readability. The following guidelines apply:

             To facilitate readability, the font chosen should be compatible with the display technology. For example, serif fonts may become distorted on some low pixel resolution displays. However, on displays where serif fonts have been found acceptable, they have been found to be useful for depicting full sentences or larger text strings.

             Sans serif fonts (for example, Futura or Helvetica) are recommended for displays viewed under extreme lighting conditions.

(2) Labels. Labels may be text or icons. The following paragraphs provide guidance on labelling items such as knobs, buttons, symbols, and menus. This guidance applies to labels that are on a display, label a display, or label a display control. CS 25.1555(a) requires that each flight deck control, other than controls whose function is obvious, must be plainly marked as to its function and method of operation. Controls whose functions are not obvious should be marked or identified so that a flight crew member with little or no familiarity with the aeroplane is able to rapidly, accurately, and consistently identify their functions.

(a) Text and icons should be shown to be distinct and meaningful for the function(s) they label. Standard or non-ambiguous symbols, abbreviations, and nomenclature should be used; for example, in order to be distinct from barometric altitude, any displayed altitude that is geometrically derived should be labelled “GSL.”

(b) If a control performs more than one function the labels should include all intended functions, unless the function of the control is obvious. Labels of graphical controls accessed via a cursor control device should be included on the graphical display.

(c) The following are guidelines and recommendations for labels:

             Data fields should be uniquely identified either with the unit of measurement or a descriptive label. However, some basic “T” instruments have been found to be acceptable without units of measurement.

             Labels should be consistent with related labels located elsewhere in the flight deck.

             When a control or indication occurs in multiple places (for example, a “Return” control on multiple pages of a flight management function), the label should be consistent across all occurrences.

(d) Labels should be placed such that:

             The spatial relationships between labels and the objects they reference are clear.

             Labels for display controls are on or adjacent to the controls they identify.

             Labels for display controls are not obstructed by the associated controls.

             Labels are oriented to facilitate readability. For example, the labels continuously maintain an upright orientation or align with an associated symbol such as a runway or airway.

             On multi-function displays, a label should be used to indicate the active function(s), unless its function is obvious. When the function is no longer active or being displayed, the label should be removed unless another means of showing availability of that function is used. For example, greying out an inactive menu button.

(e)  When using icons instead of text labels, only brief exposure to the icon should be needed in order for the flight crew to determine the function and method of operation of a control. The use of icons should not cause flight crew confusion.

(3) Symbols

(a) Electronic display symbol appearance and dynamics should be designed to enhance flight crew comprehension and retention, and minimise flight crew workload and errors in accordance with the intended function. The following list provides guidance for symbol appearance and dynamics:

             Symbols should be positioned with sufficient accuracy to avoid interpretation errors or significantly increase interpretation time.

             Each symbol used should be identifiable and distinguishable from other related symbols.

             The shape, dynamics, and other symbol characteristics representing the same function on more than one display on the same flight deck should be consistent.

             Symbol modifiers used to convey multiple levels of information should follow depiction rules clearly stated by the applicant. Symbol modifiers are changes to easily recognised baseline symbols such as colours, fill, and borders.

             Symbols that represent physical objects (for example, navigational aids and traffic) should not be misleading as to the object’s physical characteristics (including position, size, envelope, and orientation).

(b) Within the flight deck, avoid using the same symbol for different purposes, unless it can be shown that there is no potential for misinterpretation errors or increases in flight crew training times.

(c) It is recommended that standardised symbols be used. The symbols in the following SAE documents have been found to be acceptable for compliance with the regulations:

             SAE ARP 4102/7, Electronic Displays, Appendices A through C (for primary flight, navigation, and powerplant displays);

             SAE ARP 5289A, Electronic Aeronautical Symbols, (for depiction of navigation symbology); and

             SAE ARP 5288, Transport Category Aeroplane Head Up DisplayD) Systems, (for HUD symbology).

(4) Indications.The following paragraphs provide guidanceon numeric readouts, gauges, scales, tapes and graphical depictions such as schematics. Graphics related to interactivity are discussed in paragraph 31e of this chapter and Chapter 7 of this AMC. Graphics and display indications should:

             Be readily understood and compatible with other graphics and indications in the flight deck.

             Be identifiable and readily distinguishable.

             Follow the guidance for viewability presented in paragraphs 31a, 31b, 31c(1), and 31c(2) of this chapter.

(a) Numeric Readouts. Numeric readouts include displays that emulate rotating drum readouts where the numbers scroll, as well as displays where the digit locations stay fixed.

1  Data accuracy of the numeric readout should be sufficient for the intended function and to avoid inappropriate flight crew response. The number of significant digits should be appropriate to the data accuracy. Leading zeroes should not be displayed unless convention dictates otherwise (for example, heading and track). As the digits change or scroll, there should not be any confusing motion effects such that the apparent motion does not match the actual trend.

2  When a numeric readout is not associated with any scale, tape, or pointer, it may be difficult for pilots to determine the margin relative to targets or limits, or compare between numeric parameters. A scale, dial, or tape may be needed to accomplish the intended flight crew task.

3  For North, numeric readouts of heading should indicate 360, as opposed to 000.

(b) Scales, Dials, and Tapes. Scales, dials, and tapes with fixed and/or moving pointers have been shown to effectively improve flight crew interpretation of numeric data.

1  The displayed range should be sufficient to perform the intended function. If the entire operational range is not shown at any given time, the transition to the other portions of the range should not be distracting or confusing.

2  Scale resolution should be sufficient to perform the intended task. Scales may be used without an associated numeric readout if alone they provide sufficient accuracy for the intended function. When numeric readouts are used in conjunction with scales, they should be located close enough to the scale to ensure proper association, yet not detract from the interpretation of the graphic or the readout.

3  Delimiters, such as tick marks, should allow rapid interpretation without adding unnecessary clutter. Markings and labels should be positioned such that their meaning is clear yet they do not hinder interpretation. Pointers and indexes should not obscure the scales or delimiters such that they can no longer be interpreted. Pointers and indexes should be positioned with sufficient accuracy for their intended function. Accuracy includes effects due to data resolution, latency, graphical positioning, etc.

(c) Other Graphical Depictions. Depictions include schematics, synoptics, and other graphics such as attitude indications, moving maps, and vertical situation displays.

1  To avoid visual clutter, graphic elements should be included only if they add useful information content, reduce flight crew access or interpretation time, or decrease the probability of interpretation error.

2  To the extent it is practical and necessary, the graphic orientation and the flight crew’s frame of reference should be correlated. For example, left indications should be on the left side of the graphic and higher altitudes should be shown above lower altitudes.

3  If there are multiple depictions, such as “thumbnail” or overlaid depictions, the orientation (for example, heading up, track up, North up, etc.) should be the same for each depiction. This does not apply to other systems where the captain and first officer may select different presentations of the same information and are used exclusively by that flight crew member.

4  Graphics that include 3-Dimensional effects, such as raised buttons or the aeroplane flight path in a perspective view, should ensure that the symbol elements used to achieve these effects will not be incorrectly interpreted.

(5) Colour Coding

(a) If colour is used for coding at least one other distinctive coding parameter should be used (for example, size, shape, location, etc.). Normal aging of the eye can reduce the ability to sharply focus on red objects, or discriminate blue from green. For pilots with such a deficiency, display interpretation workload may be unacceptably increased unless symbology is coded in more dimensions than colour alone. However, the use of colour alone for coding information has been shown to be acceptable in some cases, such as weather radar and terrain depiction on the lateral view of the navigation display.

(b) To ensure correct information transfer, the consistent use and standardisation of colour is highly desirable. In order to avoid confusion or interpretation error, there should not be a change in how the colour is perceived over all foreseeable conditions. Colours used for one purpose in one information set should not be used for an incompatible purpose that could create a misunderstanding within another information set. In particular, consistent use and standardisation for red and amber or yellow, per CS 25.1322, is required to retain the effectiveness of flight crew alerts. A common application is the progression from green to amber to red, representing increasing degrees of threat, potential hazard, safety criticality, or need for flight crew awareness or response. Inconsistencies in the use of colour should be evaluated to ensure that they are not susceptible to confusion or errors, and do not adversely impact the intended function of the system(s) involved.

(c) If colour is used for coding it is considered good practice to use six colours or less for coding parameters. Each coded colour should have sufficient chrominance separation so it is identifiable and distinguishable in all foreseeable lighting and operating conditions and when used with other colours. Colours should be identifiable and distinguishable across the range of information element size, shape, and movement. The colours available for coding from an electronic display system should be carefully selected to maximise their chrominance separation. Colour combinations that are similar in luminance should be avoided (for example, Navy blue on black or yellow on white).

(d) Other graphic depictions such as terrain maps and synthetic vision presentations may use more than six colours and use colour blending techniques to represent colours in the outside world or to emphasize terrain features. These displays are often presented as background imagery and the colours used in the displays should not interfere with the flight crew interpretation of overlaid information parameters as addressed in paragraph 31c(5)(e)1 of this chapter.

(e) The following table depicts previously accepted colour coding and the functional meaning associated with each colour. The use of these colours is recommended for electronic display systems with colour displays. (Note: Some of these colours may be mandatory under CS-25).

Table 11 Recommended Colours for Certain Features

Feature

Colour

Warnings

Red

Flight envelope and system limits, exceedances

Red or Yellow/Amber as appropriate (see above)

Cautions, non-normal sources

Yellow/Amber

Scales, dials, tapes, and associated information elements

White

Earth

Tan/Brown

Sky

Blue/Cyan

Engaged Modes/Normal Conditions

Green

Instrument landing system deviation pointer

Magenta

Divisor lines, units and labels for inactive soft buttons

Light Gray

Note

(1) Use of the colour green for tape elements (for example airspeed and altitude) has also been found acceptable if the colour green does not adversely affect flight crew alerting.

(f) The following table depicts display features that should be allocated a colour from either Colour Set 1 or Colour Set 2.

Table 12 Recommended Colour Sets for Certain Display Features

Display Feature

Colour Set 1

Colour Set 2

Fixed reference symbols

White

Yellow

Current data, values

White

Green

Armed modes

White

Cyan

Selected data, values

Green

Cyan

Selected heading

Magenta

Cyan

Active route/flight plan

Magenta

White

Notes

(1) Use of the colour yellow for functions other than flight crew alerting should be limited and should not adversely affect flight crew alerting.

(2) In Colour Set 1, magenta is intended to be associated with those analogue parameters that constitute “fly to” or “keep centred” type information.

(g) Colour Pairs.For further information on this subject, see the FAA report No DOT/FAA/CT-03/05 HF-STD-001, Human Factors Design Standard (HFDS): For Acquisition of Commercial Off-the-Shelf Subsystems, Non-Developmental Items, and Developmental Systems.

(h) When background colour is used (for example, grey), it should not impair the use of the overlaid information elements. Labels, display-based controls, menus, symbols, and graphics should all remain identifiable and distinguishable. The use of background colour should conform to the overall flight deck philosophies for colour usage and information management. If texturing is used to create a background, it should not result in loss of readability of the symbols overlaid on it, nor should it increase visual clutter or pilot information access time. Transparency is a means of seeing a background information element through a foreground one – the use of transparency should be minimised because it may increase pilot interpretation time or errors.

(i) Requiring the flight crew to discriminate between shades of the same colour for distinct meaning is not recommended. The use of pure blue should not be used for important information because it has low luminance on many display technologies (for example, CRT and LCD).

(j) Any foreseeable change in symbol size should ensure correct colour interpretation; for example, the symbol needs to be sufficiently large so the pilot can interpret the correct colour.

d. Dynamic (Graphic) Information Elements on a Display

(1) General. The following paragraphs cover the motion of graphic information elements on a display, such as the indices on a tape display.Graphic objects that translate or rotate should do so smoothly without distracting or objectionable jitter, jerkiness, or ratcheting effects. Data update rates for information elements used in direct aeroplane or powerplant manual control tasks (such as attitude, engine parameters, etc.) equal to or greater than 15 Hertz have been found to be acceptable. Any lag introduced by the display system should be consistent with the aeroplane control task associated with that parameter. In particular, display system lag (including the sensor) for attitude which does not exceed a first order equivalent time constant of 100 milliseconds for aeroplanes with conventional control system response is generally acceptable.

(2) Movement of display information elements should not blur, shimmer, or produce unintended dynamic effects such that the image becomes distracting or difficult to interpret. Filtering or coasting of data intended to smooth the motion of display elements should not introduce significant positioning errors or create system lag that makes it difficult to perform the intended task.

(3) When a symbol reaches the limit of its allowed range of motion, the symbol should either slide from view, change visual characteristics, or be self-evident that further deflection is impossible.

(4) Dynamic information should not appreciably change shape or colour as it moves. Objects that change sizes (for example, as the map range changes) should not cause confusion as to their meaning and should remain consistent throughout their size range. At all sizes the objects should meet the guidance of this chapter as applicable (that is, the objects should be discernable, legible, identifiable, placed accurately, not distracting, etc.).

e. Sharing Information on a Display. There are three primary methods of sharing information on a given display. First, the information may be overlaid or combined, such as when traffic alert and collision avoidance system (TCAS) information is overlaid on a map display. Second, the information can be time shared so that the pilot toggles between functions, one at a time. Third, the information may be displayed in separate physical areas or windows that are concurrently displayed. Regardless of the method of information sharing, care should be taken to ensure that information that is out prioritised, but is needed, can be recovered, and that it will not be needed more quickly than it can be recovered.

(1) Overlays and Combined Information Elements. The following guidelines apply:

             When information is graphically overlaid over other information (for example, an aeroplane symbol over a waypoint symbol) in the same location on a display, the loss of information availability, information access times, and potential for confusion should be minimised.

             When information obscures other information it should be shown that the obscured information is either not needed when it is obscured or can be rapidly recovered. Needed information should not be obscured. This may be accomplished by protecting certain areas of the display.

             If information is integrated with other information on a display, the projection, the placement accuracy, the directional orientation and the display data ranges should all be consistent (for example, when traffic or weather is integrated with navigation information). When information elements temporarily obscure other information (for example, pop-up menus or windows), the resultant loss of information should not cause a hazard in accordance with the obscured information’s intended function.

(2) Time Sharing.The following guidelines apply:

             Guidance on Full-time vs. Part-time Displays (see paragraph 36c(3) of this AMC).

             Any information that should or must be continuously monitored by the flight crew should be displayed at all times (for example, attitude).

             Whether or not information may be time shared depends on how easily it can be retrieved in normal, non-normal, and emergency operations. Information for a given performance monitoring task may be time shared if the method of switching back and forth does not jeopardise the performance monitoring task.

             Generally, system information, planning, and other information not necessary for the pilot tasks can be time shared.

(3) Separating Information Visually.When different information elements are adjacent to each other on a display, the elements should be separated visually so the pilots can easily distinguish between them. Visual separation can be achieved with, for example, spacing, delimiters, or shading in accordance with the overall flight deck information management philosophy. Required information presented in reversionary or compacted display modes following a display failure should still be uncluttered and still allow acceptable information access time.

(4) Clutter and De-Clutter

(a) A cluttered display presents an excessive number or variety of symbols, colours, and/or other unnecessary information and, depending on the situation, may interfere with the flight task or operation. A cluttered display causes increased flight crew processing time for display interpretation, and may detract from the interpretation of information necessary to navigate and fly the aeroplane. Information should be displayed so that clutter is minimised.

(b) To enhance pilot performance a means should be considered to de-clutter the display. For example, an attitude indicator may automatically de-clutter when the aeroplane is at an unusual attitude to aid the pilot in recovery from the unusual attitude by removing unnecessary information and retaining information required for the flight crew to recover the aeroplane. Failure messages, flags, or comparative monitoring alerts related to the information required to be indicated by CS 25.1303 should not be removed from the main primary flight display by decluttering the display, as long as the associated indication is maintained on the primary flight display.

f. Annunciations and Indications

(1) General. Annunciations and indications include annunciator switches, messages, prompts, flags, and status or mode indications which are either on the flight deck display itself or control a flight deck display. Reference: CS 25.1322 and the associated AMC for information regarding specific annunciations and indications such as warning, caution, and advisory level alerts.

(a)  Annunciations and indications should be operationally relevant and limited to minimise the adverse effects on flight crew workload.

(b)  Annunciations and indications should be clear, unambiguous, timely, and consistent with the flight deck design philosophy. When an annunciation is provided for the status or mode of a system, it is recommended that the annunciation indicate the actual state of the system and not just the position or selection of a switch. Annunciations should only be indicated while the condition exists.

(2) Location.Annunciations and indications should be consistently located in a specific area of the electronic display. Annunciations that may require immediate flight crew awareness should be located in the flight crew’s forward/primary field of view.

(3) Managing Messages and Prompts

(a) The following general guidance applies to all messages and prompts:

             When messages are currently being displayed and there are additional messages in the queue that are not currently displayed, there should be an indication that the additional messages exist.

             Within levels of urgency, messages should be displayed in logical order. In many cases the order of occurrence of events has been found to be the most logical way to place the messages in order.

             See CS 25.1322 and AMC 25.1322 for information on warning, caution, and advisory alerts.

 (4) Blinking. Blinking information elements such as readouts or pointers are effective methods of annunciation. However, the use of blinking should be limited because it can be distracting and excessive use reduces the attention getting effectiveness. Blinking rates between 0.8 and 4.0 Hertz should be used, depending on the display technology and the compromise between urgency and distraction. If blinking of an information element can occur for more than approximately 10 seconds, a means to cancel the blinking should be provided.

g.  Use of Imaging. This paragraph provides guidance on the use of images which depict a specific portion of the aeroplane environment. These images may be static or continuously updated. Imaging includes weather radar returns, terrain depictions, forecast weather maps, video, enhanced vision displays, and synthetic vision displays. Images may be generated from databases or by sensors.

(1) Images should be of sufficient size and include sufficient detail to meet the intended function. The pilots should be able to readily distinguish the features depicted. Images should be oriented in such a way that their presentation is easily interpreted. All images, but especially dynamic images, should be located or controllable so they do not distract the pilots from required tasks. The source and intended function of the image and the level of operational approval for using the image should be provided to the pilots. This can be accomplished using the aeroplane flight manual, image location, adequate labelling, distinct texturing, or other means.

(2) Image distortion should not compromise image interpretation. Images meant to provide information about depth (for example, 3-Dimensional type perspective displays) should provide adequate depth information to meet the intended function.

(3) Dynamic images should meet the guidance in paragraph 31d of this chapter, above. The overall system lag time of a dynamic image relative to real time should not cause flight crew misinterpretation or lead to a potentially hazardous condition. Image failure, freezing, coasting or colour changes should not be misleading and should be considered during the safety analysis.

(4) When overlaying coded information elements over images, the information elements should be readily identifiable and distinguishable for all foreseeable conditions of the underlying image and range of motion. The information elements should not obscure necessary information contained in the image. The information should be depicted with the appropriate size, shape, and placement accuracy to avoid being misleading. They should retain and maintain their shape, size, and colour for all foreseeable conditions of the underlying image and range of motion.

(5) When fusing or overlaying multiple images, the resultant combined image should meet its intended function despite any differences in image quality, projection, data update rates, sensitivity to sunlight, data latency, or sensor alignment algorithms. When conforming an image to the outside world, such as on a HUD, the image should not obscure or significantly hinder the flight crew’s ability to detect real world objects. An independent brightness control of the image may help satisfy this guideline. Image elements that correlate or highlight real world objects should be sufficiently coincident to avoid interpretation error or significantly increase interpretation time.

32. – 35.  [RESERVED]

CHAPTER 6 ORGANISING ELECTRONIC DISPLAY INFORMATION ELEMENTS

36.  Organising Information Elements

a.  General. This chapter provides guidance for integrating information into the flight deck related to managing the location of information, arranging the display, windowing, configuring and reconfiguring the display, and selecting the sensors across the flight deck displays. The following paragraphs include guidance for various flight deck configurations from dedicated electronic displays for the attitude director indicator and the horizontal situation indicator to larger display sizes which use windowing techniques to display various functionalities on one display area. In some flight decks the primary flight information and the navigation display are examples of information that is displayed using windowing techniques. Chapter 5 of this AMC provides guidance for information elements including: text, labels, symbols, graphics, and other depictions (such as video) in isolation and combination.

b.  Types and Arrangement of Display Information. This paragraph provides guidance for the arrangement and location of categories of information. The categories of information include:

             Primary flight information including attitude, airspeed, altitude, and heading.

             Powerplant information which covers functions relating to propulsion.

             Other information.

(1) Placement - General Information. The position of a message or symbol within a display conveys meaning to the pilot. Without the consistent or repeatable location of a symbol in a specific area of the electronic display interpretation error and response times may increase. The following information should be placed in a consistent location under normal conditions:

             Primary flight information (see paragraph 36b(3) in this chapter and Appendix 1 of this AMC).

             Powerplant information (see paragraph 36b(4) in this chapter and Appendix 2 of this AMC).

             Flight crew alerts – each flight crew alert should be displayed in a specific location or a central flight crew alert area.

             Autopilot and flight director modes of operation.

             Lateral and vertical path deviation indicators.

             Radio altitude indications.

             Failure flags should be presented in the location of the information they reference or replace.

             Data labels for navigation, traffic, aeroplane system, and other information should be placed in a consistent position relative to the information they are labelling.

             Supporting data for other information, such as bugs and limit markings, should be consistently positioned relative to the information they support.

             Features on electronic moving map displays (for example, VORs, waypoints, etc.) relative to the current aeroplane position. In addition, the features should be placed on a constant scale for each range selected.

             Segment of flight information relative to similar information or other segments.

(2) Placement - Controls and Indications. When a control or indication occurs in multiple places (for example a “Return” control on multiple pages of a flight management function), the control or indication should be located consistently for all occurrences.

(3) Arrangement - Basic T Information

(a) CS 25.1321(b) includes specifications for the “Basic T” arrangement of certain information required by CS 25.1303(b).

(b) The following paragraphs provide guidance for the Basic T arrangement. This guidance applies to single and multiple display surfaces.

1  The Basic T information should be displayed continuously, directly in front of each flight crew member under normal (that is, no display system failure) conditions. CS 25.1321(b) requires that flight instruments required by CS 25.1303 must be grouped on the instrument panel and centred as nearly as practicable about the vertical plane of the pilot's forward vision.

2  The Basic T arrangement applies to the primary display of attitude, airspeed, altitude, and direction of flight. Depending on the flight deck design, there may be more than one indication of the Basic T information elements in front of a pilot. For example, heading information may appear on back-up displays, HUDs, and moving map displays. The primary airspeed, altitude, and direction indications are the respective display indications closest to the primary attitude indication.

3  The primary attitude indication should be centred about the plane of the flight crew’s forward vision. This should be measured from the DEP at the flight crew station. If located on the main instrument panel, the primary attitude indication must be in the top centre position (CS 25.1321(b)). The attitude indication should be placed so that the display is unobstructed under all flight conditions. Refer to SAE ARP 4102/7 for additional information.

4  The primary airspeed, altitude, and direction of flight indications should be located adjacent to the primary attitude indication. Information elements placed within, overlaid, or between these indications, such as lateral and vertical deviation, are acceptable when they are relevant to respective airspeed, altitude, or directional indications used for accomplishing the basic flying task, and are shown to not disrupt the normal crosscheck or decrease manual flying performance.

5  The instrument that most effectively indicates airspeed must be adjacent to and directly to the left of the primary attitude indication (CS 25.1321(b)). The centre of the airspeed indication should be aligned with the centre of the attitude indication. For airspeed indications, vertical deviations have been found acceptable up to 15 degrees below to 10 degrees above when measured from the direct horizontal position of the aeroplane waterline reference symbol. For tape type airspeed indications, the centre of the indication is defined as the centre of the current airspeed status reference.

6  Parameters related to the primary airspeed indication, such as reference speeds or a mach indication, should be displayed to the left of the primary attitude indication.

7  The instrument that most effectively indicates altitude must be located adjacent to and directly to the right of the primary attitude indication (CS 25.1321(b)). The centre of the altitude indication should be aligned with the centre of the attitude indication. For altitude indications, vertical deviations have been found acceptable up to 15 degrees below to 10 degrees above when measured from the direct horizontal position of the aeroplane waterline reference symbol. For tape type altitude indications, the centre of the indication is defined as the centre of the current altitude status reference.

8  Parameters related to the primary altitude indication, such as the barometric setting or the primary vertical speed indication, should be displayed to the right of the primary altitude indication.

9  The instrument that most effectively indicates direction of flight must be located adjacent to and directly below the primary attitude indication (CS 25.1321(b)). The centre of the direction of flight indication should be aligned with the centre of the attitude indication. The centre of the direction of flight indication is defined as the centre of the current direction of flight status reference.

10  Parameters related to the primary direction of flight indication, such as the reference (that is, magnetic or true) or the localiser deviation should be displayed below the primary attitude indication.

11  If applicants seek approval of alternative instrument arrangements by equivalent safety under Part 21A.21(c)2, the Agency will normally require well-founded research, or relevant service experience from military, foreign, or other sources to substantiate the applicants’ proposed compensating factors.

(4) Arrangement - Powerplant Information

(a) Required engine indications necessary to set and monitor engine thrust or power should be continuously displayed in the flight crew’s primary field of view, unless the applicant can demonstrate that this is not necessary (see the guidance in paragraph 36c(3) of this chapter and Appendix 2 of this AMC). The automatically selected display of powerplant information should not suppress other information that requires flight crew awareness.

(b) Powerplant information must be closely grouped (in accordance with § 25.1321) in an easily identifiable and logical arrangement which allows the flight crew to clearly and quickly identify the displayed information and associate it with the corresponding engine. Typically, it is considered to be acceptable to arrange parameters related to one powerplant in a vertical manner and, according to powerplant position, next to the parameters related to another powerplant in such a way that identical powerplant parameters are horizontally aligned. Generally, place parameter indications in order of importance with the most important one at the top. Typically, the top indication is the primary thrust setting parameter.

(5) Arrangement - Other Information (For Example, Glideslope and Multi-Function Displays)

(a) Glideslope or glidepath deviation scales should be located to the right side of the primary attitude indication. If glideslope deviation data is presented on both an electronic horizontal situation indicator and an electronic attitude direction indicator, the information should appear in the same relative location on each indicator.

(b) When the glideslope pointer is being driven by a RNAV (area navigation) system with VNAV (vertical navigation) or ILS (instrument landing system) look-alike functionality, the pointer should not be marked “GS” or “glideslope.”

(c) Navigation, weather, and vertical situation display informationis often displayed on multi-function displays. This information may be displayed on one or more physical electronic displays, or on several areas of one larger display. When this information is not required to be displayed continuously, it can be displayed part-time, but the displayed information should be easily recoverable to the flight crew when needed. For guidance on part-time displays see paragraph 36c(3) of this chapter.

(d) Other information should not be located where the primary flight information or required powerplant information is normally presented. See paragraphs 36b(1) and 36b(3) of this chapter for primary flight information guidance. See paragraphs 21e(10) and 36b(4) of this AMC for powerplant information guidance.

c.  Managing Display Information. The following paragraphs address managing and integrating the display of information throughout the flight deck. This includes the use of windows to present information and the use of menus to manage the display of information.

(1) Window. A window is a defined area which can be present on one or more physical displays. A window that contains a set of related information is commonly referred to as a format. Multiple windows may be presented on one physical display surface and may have different sizes. Guidelines for sharing information on a display, using separate windows, are as follows:

             The window(s) should have fixed size(s) and location(s).

             Separation between information elements within and across windows should be sufficient to allow the flight crew to readily distinguish separate functions or functional groups (for example, powerplant indication) and avoid any distractions or unintended interaction.

             Display of selectable information, such as a window on a display area, should not interfere with or affect the use of primary flight information.

             For additional information regarding the display of data on a given location, data blending, and data over-writing (see Aeronautical Radio, Inc (ARINC) Standard 661-5, Cockpit Display System Interfaces to User Systems).

(2) Menu

(a) A menu is a displayed list of items from which the flight crew can choose. Menus include drop-down and scrolling menus, line select keys on a multi-function display, and flight management system menu trees. An option is one of the selectable items in a menu. Selection is the action a user makes in choosing a menu option, and may be done by pointing (with a cursor control device or other mechanism), entering an associated option code, or activating a function key.

(b) The hierarchical structure and organisation of the menus should be designed to allow the flight crew to sequentially step through the available menus or options in a logical way that supports their tasks. The options provided on any particular menu should be logically related to each other. Menus should be displayed in consistent locations, either a fixed location or a consistent relative location, so that the flight crew knows where to find them. At all times the system should indicate the current position within the menu and menu hierarchy.

(c) The number of sub-menus should be designed to assure timely access to the desired option without over-reliance on memorisation of the menu structure. The presentation of items on the menu should allow clear distinction between items that select other menus and items that are the final selection.

(d) The number of steps required to choose the desired option should be consistent with the frequency, importance, and urgency of the flight crew’s task.

(e) Whena menu is displayed it should not obscure required information.

(3) Full-time vs. Part-time Display of Information.Some aeroplane parameters or status indications are required to be displayed by the specifications (for example, powerplant information required by CS 25.1305), yet they may only be necessary or required in certain phases of flight. If it is desired to inhibit some parameters from full-time display, a usability level and functionality equivalent to a full-time display should be demonstrated.

(a) When determining if information on a display can be part-time, consider the following criteria:

             Continuous display of the parameter is not required for safety of flight in all normal flight phases.

             The parameter is automatically displayed in flight phases where it is required, when its value indicates an abnormal condition, or when it would be relevant information during a failure condition.

             Display of the inhibited parameter can be manually selected by the flight crew without interfering with the display of other required information.

             If the parameter fails to be displayed when required, the failure effect and compounding effects must meet the specifications of all applicable specifications (for example, CS 25.1309).

             The automatic or requested display of the inhibited parameter should not create unacceptable clutter on the display. Also, simultaneous multiple "pop-ups" should not create unacceptable clutter on the display.

             If the presence of a new parameter is not sufficiently self-evident, suitable alerting or other annunciations should accompany the automatic presentation of the parameter.

(b) Pop-up Display of Information

1  Certain types of information, such as terrain and TCAS, are required by operating rules to be displayed, yet they are only necessary or required in certain phases of flight (similar to the part-time display of required aeroplane parameters, (see paragraph 36b(3) of this chapter)) or under specific conditions. One method commonly employed to display this information is called “automatic pop-up.” Automatic pop-ups may be in the form of an overlay, such as a TCAS overlay on the moving map, or in a separate window as a part of a display format. Pop-up window locations should not obscure required information.

2  Consider the following criteria for displaying automatic pop-up information:

             Information is automatically displayed when its value indicates a predetermined condition, or when the associated parameter reaches a predetermined value.

             Pop-up information should appropriately attract the flight crew’s attention while minimising task disruption.

             If the flight crew deselects the display of the automatic pop-up information, then another automatic pop-up should not occur until a new condition/event causes it.

             If an automatic pop-up condition is activated and the system is in the wrong configuration or mode to display the information, and the system configuration cannot be automatically changed, then an annunciation should be displayed in the colour associated with the nature of the alert, prompting the flight crew to make the necessary changes for the display of the information. This guidance differs from the part-time display of information required by CS-25 because the required information should be displayed regardless of the configuration.

             If a pop-up(s) or simultaneous multiple pop-ups occur and obscure information, it should be shown that the obscured information is not relevant or necessary for the current flight crew task. Additionally, the pop-ups should not cause a misleading presentation.

             If more than one automatic pop-up occurs simultaneously on one display area, for example a terrain and TCAS pop-up, then the system should prioritise the pop-up events based on their criticality. Pop-up display orientation should be in track-up or heading-up.

             Any information to a given system that is not continuously displayed, but the safety assessment determines it is necessary to be presented to the flight crew, should automatically pop-up or otherwise indicate that its display is required.

d.  Managing Display Configuration. The following paragraphs address managing the information presented by an electronic display system and its response to failure conditions and flight crew selections. The following paragraphs also provide guidance on the acceptability of display formats and their required physical location on the flight deck, both during normal flight and in failure modes. Manual and automatic system reconfiguration and source switching are also addressed.

(1) Normal Conditions. In normal conditions (that is, non-failure conditions) there may be a number of possible display configurations that may be selected manually or automatically. All possible display configurations available to the flight crew should be designed and evaluated for arrangement, visibility, and interference.

(2) System Failure Conditions (Reconfiguration). The following paragraphs provide guidance on manual and automatic display system reconfiguration in response to display system failures. Arrangement and visibility specifications also apply in failure conditions. Alternative display locations used in non-normal conditions should be evaluated by the Agency to determine if the alternative locations meet the criteria for acceptability.

(a) Moving display formats to different display locations on the flight deck or using redundant display paths to drive display information is acceptable to meet availability and integrity specifications.

(b) In an instrument panel configuration with a display unit for primary flight information positioned above a display unit for navigation information, it is acceptable to move the primary flight information to the lower display unit if the upper display unit fails.

(c) In an instrument panel configuration with a display unit for primary flight information positioned next to a display unit for navigation information, it is acceptable to move the primary flight information to the display unit directly adjacent to it if the preferred display unit fails. It is also acceptable to switch the navigation information to a centrally located auxiliary display (multi-function display).

(d) If several possibilities exist for relocating the failed display, a recommended flight crew procedure should be considered and documented in the aeroplane flight manual.

(e) It is acceptable to have manual or automatic switching capability (automatic switching is preferred) in case of system failure; however, CS 25.1333(b) requires that the equipment, systems, and installations must be designed so that sufficient information is available to assure control of the aeroplane’s airspeed, altitude, heading, and attitude by one of the pilots without additional flight crew action, after any single failure or combination of failures that is not assessed to be extremely improbable.

(f) The following means to reconfigure the displayed information are acceptable:

             Display unit reconfiguration. Moving a display format to a different location (for example, moving the primary flight information to the adjacent display unit) or the use of a compacted format may be acceptable.

             Source/graphic generator reconfiguration. The reconfiguration of graphic generator sources either manually or automatically to accommodate a failure may be acceptable. In the case where both the captain and first officer’s displays are driven by a single graphic generator source, there should be clear, cautionary alerting to the flight crew that the displayed information is from a single graphic generator source.

             In certain flight phases, manual reconfiguration may not satisfy the need for the pilot controlling the aeroplane to recover primary flight information without delay. Automatic reconfiguration might be necessary to ensure the timely availability of information that requires immediate flight crew member action.

             When automatic reconfiguration occurs (for example, display transfer), it should not adversely affect the performance of the flight crew and should not result in any trajectory deviation.

              When the display reconfiguration results in the switching of sources or display paths that is not annunciated and is not obvious to the flight crew, care should be taken that the flight crew is aware of the actual status of the systems when necessary, depending on flight deck philosophy.

e.  Methods of Reconfiguration

(1) Compacted Format

(a) The term "compacted format," as used in this AMC, refers to a reversionary display mode where selected display components of a multi-display configuration are combined in a single display format to provide higher priority information following a display failure. The “compacted format” may be automatically selected in case of a primary display failure, or it may be manually (automatic selection preferred) selected by the flight crew. Except for training purposes, the “compacted format” should not be selectable unless there is a display failure. The concepts and specifications of CS 25.1321, as discussed in paragraph 36(b)(3) of this chapter, still apply.

(b) The compacted display format should maintain the same display attributes (colour, symbol location, etc.) and include the same required information, as the primary formats it is replacing. The compacted format should ensure the proper operation of all the display functions it presents, including annunciation of navigation and guidance modes, if present. However, due to size constraints and to avoid clutter, it may be necessary to reduce the amount of display functions on the compacted format. For example, in some cases, the use of numeric readouts in place of graphical scales has been found to be acceptable. Failure flags and mode annunciations should, wherever possible, be displayed in a location common with the normal format.

(2) Sensor Selection and Annunciation

(a) Automatic switching of sensor data to the display system should be considered, especially with highly integrated display systems to address those cases where multiple failure conditions may occur at the same time and require immediate flight crew action. Manual switching may be acceptable.

(b) Independent attitude, direction, and air data sources are required for the captain and first officer’s displays of primary flight information (see CS 25.1333). If sources can be switched such that the captain and first officer are provided with single sensor information, each of them should receive a clear annunciation indicating the vulnerability to misleading information.

(c) If sensor information sources cannot be switched, then no annunciation is required.

(d) There should be a means of determining the source of the displayed navigation information and the active navigation mode. For approach operations the source of the displayed navigation information and the active navigation mode should be available on the primary flight display or immediately adjacent to the primary flight display.

(e) The selected source should be annunciated if multiple or different types of navigation sources (flight management system, instrument landing system, GNSS (global navigation satellite system) landing system, etc.) can be selected (manually or automatically).

(f) An alert should be given when the information presented to the flight crew is no longer meeting the required integrity level, in particular when there is a single sensor or loss of independence.

37. – 40.  [RESERVED]

CHAPTER 7 ELECTRONIC DISPLAY SYSTEM CONTROL DEVICES

41.  General. Each electronic display system control device has characteristics unique to its operation that need to be considered when designing the functions the display system controls, and the redundancy provided during failure modes. Despite the amount of redundancy that may be available to achieve a given task, the flight deck should still present a consistent user interface scheme for the primary displays and a compatible, if not consistent, user interface scheme for auxiliary displays throughout the flight deck.

a. Multi-function Control Labels. Multi-function controls should be labelled such that the pilot is able to:

             Rapidly, accurately, and consistently identify and select all functions of the control device.

             Quickly and reliably identify what item on the display is “active” as a result of cursor positioning, as well as what function will be performed if the item is selected using the selector buttons and/or changed using the multi-function control.

             Determine quickly and accurately the function of the control without extensive training or experience.

b.  Multi-function Controls. The installation guidelines below apply to control input devices that are dedicated to operating a specific function (for example, control knobs and wheels), as well as new control features (for example, a cursor control device (CCD)).

(1) “Hard” Controls

(a) Mechanical controlsused to set numeric data on a display should have adequate friction or tactile detents to allow a flight crew without extensive training or experience to set values (for example, setting an out-of-view heading bug to a displayed number) to a required level of accuracy within a time appropriate to the task.

(b) The input for display response gain to control should be optimised for gross motion as well as fine positioning tasks without overshoots. In accordance with CS 25.777(b), the direction of movement of the cockpit controls must meet the specifications of CS 25.779. Wherever practicable, the sense of motion involved in the operation of other controls must correspond to the sense of the effect of the operation on the aeroplane or on the part operated. Controls of a variable nature using a rotary motion must move clockwise from the off position, through an increasing range, to the full on position.

(2) “Soft” Controls

(a) There are two interactive types of soft control displays, one type affects aeroplane systems and the other type does not. Displays that utilize a graphical user interface (GUI) permit information within different display areas to be directly manipulated by the flight crew (for example, changing range, scrolling crew alert messages or electronic checklists, configuring windows, or layering information.) This level of display interaction affects only the presentation of display information and has a minimal effect on flight deck operations. The other level of display interaction provides a GUI to control aeroplane system operations (for example, utility controls on displays traditionally found in overhead panel functions, FMS operations, and graphical flight planning).

(b) The design of display systems that will be used as soft controls is dependent on the functions they control. Consider the following guidelines when designing these display systems:

1  The GUI and control device should be compatible with the aeroplane system they will control. The hardware and software design assurance levels and tests for the GUI and control device should be commensurate with the level of criticality of the aeroplane system they will control.

2  Redundant methods of controlling the system may lessen the criticality required of the display control. Particular attention should be paid to the interdependence of display controls (that is, vulnerability to common mode failures), and to the combined effects of the loss of control of multiple systems and functions.

3  The applicant should demonstrate that the failure of any display control does not unacceptably disrupt operation of the aeroplane (that is the allocation of flight crew member tasks) in normal, non-normal, and emergency conditions.

4  To show compliance with CS 25.777(a) and CS 25.1523, the applicant should show that the flight crew can conveniently access required and backup control functions in all expected flight scenarios, without impairing aeroplane control, flight crew task performance, and flight crew resource management.

5  Control system latency and gains can be important in the acceptability of a display control. Usability testing should therefore accurately replicate the latency and control gains that will be present in the actual aeroplane.

6  The final display response to control input should be fast enough to prevent undue concentration being required when the flight crew sets values or display parameters CS 25.771(a)). The initial indication of a response to a soft control input should take no longer than 250 milliseconds. If the initial response to a control input is not the same as the final expected response, a means of indicating the status of the pilot input should be made available to the flight crew.

7  To show compliance with CS 25.771(e) the applicant should show by test and/or demonstration in representative motion environment(s) (for example, turbulence) that the display control is acceptable for controlling all functions that the flight crew may access during these conditions.

c.  Cursor Control Devices

When the input device controls cursor activity on a display, it is called a cursor control device (CCD). The CCDs are used to position display cursors on selectable areas of the displays. These selectable areas are “soft controls” intended to perform the same functions as mechanical switches or other controls on conventional control panels. Typically, CCDs control several functions and are the means for directly selecting display elements. When designing CCDs, in addition to the guidance provided in paragraphs 41a, 41b, and 41d of this chapter, consider the guidance in the following paragraphs, which address design considerations unique to CCDs.

(1) The CCD design and installation should enable the flight crew to operate the CCD without exceptional skill during foreseeable flight conditions, both normal and adverse (for example, turbulence and vibrations). Certain selection techniques, such as double or triple clicks, should be avoided.

(2) The safety assessment should address reversion to alternate means of control following loss of the CCD. This includes an assessment on the impact of the failure on flight crew workload.

(3) The functionality of the CCD should be demonstrated with respect to the flight crew interface considerations outlined below:

(a) The ability of the flight crew to share tasks, following CCD failure, with appropriate workload and efficiency.

(b) The ability of the flight crew to use the CCD with accuracy and speed of selection required of the related tasks, under foreseeable operating conditions (for example, turbulence, engine imbalance, and vibration).

(c) Satisfactory flight crew task performance and CCD functionality, whether the CCD is operated with a dominant or non-dominant hand.

(d) Hand stability support position (for example, wrist rest).

(e) Ease of recovery from incorrect use.

d.  Cursor Displays

(1) The cursor symbol should be restricted from areas of primary flight information or where occlusion of display information by a cursor could result in misinterpretation by the flight crew. If a cursor symbol is allowed to enter a critical display information field, it should be demonstrated that the cursor symbol’s presence will not cause interference during any phase of flight or failure condition.

(2) Because the cursor is a directly controllable element on the display it has unique characteristics. Consider the following when designing a cursor display:

(a) Presentation of the cursor should be clear, unambiguous, and easily detectable in all foreseeable operating conditions.

(b) The failure mode of an uncontrollable and distracting display of the cursor should be evaluated.

(c) Because in most applications more than one flight crew member will be using one cursor, the applicant should establish an acceptable method for handling “duelling cursors” that is compatible with the overall flight deck philosophy (for example, “last person on display wins”). Acceptable methods should also be established for handling other possible scenarios, including the use of two cursors by two pilots.

(d) If more than one cursor is used on a display system, a means should be provided to distinguish between the cursors.

(e) If a cursor is allowed to fade from a display, some means should be employed for the flight crew to quickly locate it on the display system. Common examples of this are “blooming” or “growing” the cursor to attract the flight crew’s attention.

42. – 45. [RESERVED]

CHAPTER 8 SHOWING COMPLIANCE FOR APPROVAL OF ELECTRONIC DISPLAY SYSTEMS

46.  Compliance Considerations (Test and Compliance)

a.  General. This chapter provides guidance for demonstrating compliance to the specifications for the approval of electronic flight deck displays. Since so much of display system compliance is dependent on subjective evaluations, this chapter focuses on providing specific guidance that facilitates these types of evaluations.

b.  Means of Compliance

(1) The acceptable means of compliance for a display system depends on many factors and is determined on a case-by-case basis. For example, when the proposed display system technology is mature and well understood, means such as analogical reasoning documented as a Statement of Similarity may be sufficient. However, more rigorous and structured methods, such as analysis and flight test, are appropriate if the proposed display system design is deemed novel, complex, or highly integrated.

(2)  The acceptable means of compliance depends on other factors as well. These include the subjectivity of the acceptance criteria and the evaluation facilities of the applicant (for example, high-fidelity flight simulators) and the manner in which these facilities are used (for example, data collection).

(3) When subjective criteria are used to satisfy a means of compliance, the subjective data should be collected from multiple people (including pilots, engineers, and human factor specialists.)

(4) The following guidance describes means of compliance for electronic displays:

(a) System Descriptions

1  System descriptions may include system architecture, description of the layout and general arrangement of the flight deck, description of the intended function, flight crew interfaces, system interfaces, functionality, operational modes, mode transitions, and characteristics (for example dynamics of the display system), and applicable specifications addressed by this description. Layout drawings and/or engineering drawings may show the geometric arrangement of hardware or display graphics. Drawings typically are used in cases where showing compliance to the specifications can easily be reduced to simple geometry, arrangement, or the presence of a given feature on the drawing.

2  The following questions may be used to evaluate whether the description of intended function is sufficiently specific and detailed:

             Does each system, feature, and function have a stated intended function?

             What assessments, decisions, or actions are the flight crew members intended to make based on the display system?

             What other information is assumed to be used in combination with the display system?

             What is the assumed operational environment in which the equipment will be used? For example, the pilots’ tasks and operations within the flight deck, phase of flight, and flight procedures.

(b) Statement of Similarity. This is a substantiation to demonstrate compliance by a comparison to a previously approved display (system or function). The comparison details the physical, logical, and functional and operational similarities of the two systems. Substantiation data from previous installations should be provided for the comparison. This method of compliance should be used with care because the flight deck should be evaluated as a whole, rather than merely as a set of individual functions or systems. For example, display functions that have been previously approved on different programmes may be incompatible when applied to another flight deck. Also, changing one feature in a flight deck may necessitate corresponding changes in other features, in order to maintain consistency and prevent confusion (for example, use of colour).

(c) Calculation & Engineering Analyses. These include assumptions of relevant parameters and contexts, such as the operational environment, pilot population, and pilot training. Examples of calculations and engineering analyses include human performance modelling of optical detections, task times, and control forces. For analyses that are not based on advisory material or accepted industry standards, validation of calculations and engineering analyses using direct participant interaction with the display should be considered.

(d) Evaluation. This is an assessment of the design conducted by the applicant, who then provides a report of the results to the Agency. Evaluations typically use a display design model that is more representative of an actual system than drawings. Evaluations have two defining characteristics that distinguish them from tests: (1) the representation of the display design does not necessarily conform to the final documentation, and (2) the Agency may or may not be present. Evaluations may contribute to a finding of compliance, but they generally do not constitute a finding of compliance by themselves.

1  Evaluations may begin early in the certification programme. They may involve static assessments of the basic design and layout of the display, part-task evaluations and/or, full task evaluations in an operationally representative environment (environment may be simulated). A wide variety of development tools may be used for evaluations, from mock-ups to full installation representations of the actual product or flight deck.

2  In cases where human subjects (typically pilots) are used to gather data (subjective or objective), the applicant should fully document the process used to select subjects, the subjects’ experience, the type of data collected, and the method(s) used to collect the data. The resulting information should be provide to the Agency as early as possible to obtain agreement between the applicant and the Agency on the extent to which the evaluations are valid and relevant for certification credit. Additionally, credit will depend on the extent to which the equipment and facilities actually represent the flight deck configuration and realism of the flight crew tasks.

(e) Test. This means of compliance is conducted in a manner very similar to evaluations (see above), but is performed on conformed systems (or conformed items relevant to the test), in accordance with an approved test plan, and may be witnessed by the Agency. A test can be conducted on a test bench, in a simulator, and/or on the actual aeroplane, and is often more formal, structured, and rigorous than an evaluation.

1  Bench or simulator tests that are conducted to show compliance should be performed in an environment that adequately represents the aeroplane environment, for the purpose of those tests.

2  Flight tests should be used to validate and verify data collected from other means of compliance such as analyses, evaluations, and simulations. Per CS 25.1523, during the certification process, the flight crew workload assessments and failure classification validations should be addressed in a flight simulator or an actual aeroplane, although the assessments may be supported by appropriate analyses (see CS-25 Appendix D, for a description of the types of analyses).

47. – 50.  [RESERVED]

CHAPTER 9 CONTINUED AIRWORTHINESS AND MAINTENANCE

51.  Continued Airworthiness and Maintenance. The following paragraphs provide guidance for preparing instructions for the continued airworthiness of the display system and its components to show compliance with CS 25.1309 and CS 25.1529 (including Appendix H), which require preparing Instructions for Continued Airworthiness. The following guidance is not a definitive list, and other maintenance tasks may be developed as a result of the safety assessment, design reviews, manufacturer’s recommendations, and Maintenance Steering Group (MSG)-3 analyses that are conducted.

a.  General. Information on preparing the Instructions for Continued Airworthiness can be found in CS-25 Appendix H. In addition to those instructions, maintenance procedures should be considered for:

(1) Reversionary switches not used in normal operation. These switches should be checked during routine maintenance because, if a switch failure is not identified until the aeroplane is in flight, the switching or back up display/sensor may not be available when required. These failures may be addressed by a System Safety Assessment and should be addressed in the aeroplane’s maintenance programme (for example, MSG-3).

(2) Display cooling fans and filters integral with cooling ducting.

b.  Design for Maintainability. The display system should be designed to minimise maintenance error and maximise maintainability.

(1) The display mounting, connectors, and labelling, should allow quick, easy, safe, and correct access for identification, removal and replacement. Means should be provided (for example, using physically coded connectors) to prevent inappropriate connections of system elements.

(2) If the system has the capability of providing information on system faults (for example diagnostics) to maintenance personnel, it should be displayed in text instead of coded information.

(3) If the flight crew needs to provide information to the maintenance personnel (for example overheat warning), problems associated with the display system should be communicated to the maintenance personnel as appropriate, relative to the task and criticality of the information displayed.

(4) The display components should be designed so they can withstand cleaning without internal damage, scratching and/or crazing (cracking).

c.  Maintenance of Display Characteristics.

(1) Maintenance procedures may be used to ensure that the display characteristics remain within the levels presented and accepted at certification.

(2) Experience has shown that display quality may degrade with time and become difficult to use. Examples include lower brightness/contrast; distortion or discolouration of the screen (blooming effects); and areas of the screen that may not display information properly.

(3) Test methods and criteria may be established to determine if the display system remains within acceptable minimum levels. Display system manufacturers may alternatively provide “end of life” specifications for the displays which could be adopted by the aeroplane manufacturer.

52. – 60. [RESERVED]

[Amdt 25/11]

[Amdt 25/12]

[Amdt 25/17]

[Amdt 25/21]

[Amdt 25/26]

Appendix 1 – Primary Flight Information

ED Decision 2015/019/R

This appendix provides additional guidance for displaying primary flight information. Displaying primary flight information is required by CS 25.1303(b) and CS 25.1333(b). The specifications for arranging primary flight information are specified in CS 25.1321(b).

1.1  Attitude

Pitch attitude display scaling should be such that during normal manoeuvres (for example, approach or climb at high thrust-to-weight ratios) the horizon remains visible in the display with at least 5 degrees pitch margin available.

An accurate, easy, quick-glance interpretation of attitude should be possible for all unusual attitude situations and other “non-normal” manoeuvres sufficient to permit the pilot to recognise the unusual attitude and initiate an appropriate recovery within one second. Information to perform effective manual recovery from unusual attitudes using chevrons, pointers, and/or permanent ground-sky horizon on all attitude indications is recommended.

Both fixed aeroplane reference and fixed earth reference bank pointers (“ground and/or sky” pointers) are acceptable as a reference point for primary attitude information. A mix of these types in the same flight deck is not recommended.

There should be a means to determine the margin to stall and to display that information when necessary. For example, a pitch limit indication is acceptable.

There should be a means to identify an excessive bank angle condition prior to stall buffet.

Sideslip should be clearly indicated to the flight crew (for example, a split trapezoid on the attitude indicator) and an indication of excessive sideslip should be provided.

1.2 Continued Function of Primary Flight Information (Including Standby) in Conditions of Unusual Attitudes or in Rapid Manoeuvres

Primary flight information must continue to be displayed in conditions of unusual attitudes or in rapid manoeuvres (CS 25.1301). The pilot must also be able to rely on primary or standby instrument information for recovery in all attitudes and at the highest pitch, roll, and yaw rates that may be encountered (CS 25.1301).

In showing compliance with the specifications of CS 25.1301(a), CS 25.1309(a), CS 25.1309(b), and CS 25.1309(c), the analysis and test programme must consider the following conditions that might occur due to pilot action, system failures, or external events:

             Abnormal attitude (including the aeroplane becoming inverted);

             Excursion of any other flight parameter outside protected flight boundaries; or

             Flight conditions that may result in higher than normal pitch, roll, or yaw rates.

For each of the conditions identified above, primary flight displays and standby indicators must continue to provide useable attitude, altitude, airspeed and heading information and any other information that the pilot may require to recognise and execute recovery from the unusual attitude and/or arrest the higher than normal pitch, roll, or yaw rates (CS 25.1301).

2.1  Airspeed and Altitude

Airspeed and altitude displays should be able to convey to the flight crew a quick-glance sense of the present speed or altitude. Conventional round-dial moving pointer displays inherently give some of this sense that may be difficult to duplicate on moving scales. Scale length is one attribute related to this quick-glance capability. The minimum visible airspeed scale length found acceptable for moving scales has been 80 knots; since this minimum is dependent on other scale attributes and aeroplane operational speed range, variations from this should be verified for acceptability. A displayed altitude that is geometrically derived should be easily discernible from the primary altitude information, which is barometrically derived altitude. To ensure the pilot can easily discern the two, the label '''GSL''' should be used to label geometric height above mean sea level. See Section 5.4.4 of Appendix 6 for HUD-specific airspeed considerations.

Airspeed reference marks (bugs) on conventional airspeed indicators perform a useful function by providing a visual reminder of important airspeed parameters. Including bugs on electronic airspeed displays is encouraged. Computed airspeed/angle-of-attack bugs such as Vstall warning, V1, VR, V2, flap limit speeds, etc., displayed on the airspeed scale should be evaluated for accuracy. The design of an airspeed indicator should include the capability to incorporate a reference mark that will reflect the current target airspeed of the flight guidance system. This has been required in the past for some systems that have complex speed selection algorithms, in order to give the flight crew adequate information for system monitoring as required by CS 25.1309(c).

Scale units marking for air data displays incorporated into primary flight displays are not required (“knots,” “airspeed” for airspeed, “feet,” “altitude” for altimeters) as long as the content of the readout remains clear. For altimeters with the capability to display both English and Metric units, the scale and primary present value readout should remain scaled in English units with no units marking required; the Metric display should consist of a separate present value readout that does include units marking.

Airspeed scale markings such as stall warning, maximum operation speed/maximum operating mach number, or flap limits, should be displayed to provide the flight crew a quick-glance sense of speed relative to key targets or limits. The markings should be predominant enough to confer the quick-glance sense information, but not so predominant as to be distracting when operating normally near those speeds (for example, stabilised approach operating between stall warning and flap limit speeds).

If airspeed trend or acceleration cues are associated with the speed scale, vertically oriented moving scale airspeed indications should have higher numbers at the top so that increasing energy or speed results in upward motion of the cue. Speed, altitude, or vertical rate trend indicators should have appropriate hysteresis and damping to be useful and non-distracting, however, damping may result in erroneous airspeed when accelerating. In this case, it may be necessary to use acceleration data in the algorithms to compensate for the error. The evaluation should include turbulence expected in service.

For acceptable means of compliance and guidance material on instrument graduations and markings, refer to the latest ETSOs and list of approved deviations on the Agency’s webse (www.easa.europa.eu).

Altimeters present special design problems in that: (1) the ratio of total usable range to required resolution is a factor of 10 greater than for airspeed or attitude, and (2) the consequences of losing sense of context of altitude can be detrimental. The combination of altimeter scale length and markings, therefore, should be adequate to allow sufficient resolution for precise manual altitude tracking in level flight, as well as enough scale length and markings to reinforce the flight crew's sense of altitude and to allow sufficient look-ahead room to adequately predict and accomplish level-off. When providing low altitude awareness, it may be helpful to include radio altimeter information on the scale so that it is visually related to the ground position.

2.2 Low and High Speed Awareness Cues

CS 25.1541(a)(2) states: '''The aeroplane must contain – Any additional information, instrument markings, and placards required for the safe operation if there are unusual design, operating, or handling characteristics.''' The CS-25 certification specifications related to instrument systems and their markings were not developed with modern day electronic displays in mind; consequently, these electronic displays are considered an “unusual design characteristic” per CS 25.1541(a)(2), and may require additional marking to warrant safe operation. In particular, it is considered necessary to incorporate additional markings on electronic airspeed displays in the form of low and high speed awareness cues to provide pilots the same type of “quick glance” airspeed awareness that was an intrinsic feature of round dial instruments.

Low speed awareness cues should provide adequate visual cues to the pilot that the airspeed is below the reference operating speed for the aeroplane configuration (that is, weight, flap setting, landing gear position, etc.); similarly, high speed awareness cues should provide adequate visual cues to the pilot that the airspeed is approaching an established upper limit that may result in a hazardous operating condition. Consider the following guidance when developing airspeed awareness cues:

             Take into account all independent parameters that may affect the speed against which protection is being provided. This is most important in the low speed regime where all large aeroplanes have a wide range of stall speeds due to multiple flap/slat configurations and potentially large variations in gross weight.

             The cues should be readily distinguishable from other markings such as V-speeds and speed targets (bugs). The cues should indicate not only the boundary value of the speed limit, but must clearly distinguish between the normal speed range and the unsafe speed range beyond those limiting values (CS 25.1545). Since the moving scale display does not provide any inherent visual cue of the relationship of present airspeed to low or high airspeed limits, many electronic displays utilize an amber and red bar adjacent to the airspeed tape to provide this quick-glance low/high speed awareness. The preferred colours to be used are amber or yellow to indicate that the airspeed has decreased below a reference speed that provides adequate manoeuvre margin, changing to red at the stall warning speed. The speeds at which the low speed awareness bands start should be chosen as appropriate to the aeroplane configuration and operational flight regime. For example, low speed awareness cues for approach and landing should be shown starting at VREF with a tolerance of +0 and –5 knots. Some Agency approved systems use a pilot selectable operating speed “bug” at VREF supplemented by system-computed low speed cues that vary in colour as airspeed decreases below certain multiples of the appropriate stall speed (for example, white below 1.3VS, amber below 1.2 VS, and red below 1.1 VS). Consider the specific operating needs of other flight regimes when developing the criteria for the associated visual cue.

             Low speed awareness displays should be sensitive to load factor (g-sensitive) to enable the pilot to maintain adequate manoeuvre margins above stall warning in all phases of flight. The accuracy of this g-sensitivity function should be verified by flight tests. Flight tests should also be conducted in manoeuvring flight and expected levels of turbulence to evaluate proper functioning of any damping routines incorporated into the low speed awareness software; the level of damping should preclude nuisance/erratic movement of the low speed cues during operation in turbulence but not be so high that it inhibits adequate response to accurately reflect changes in margins to stall warning and stall during manoeuvring flight.

             High speed awareness should be provided to prevent inadvertent excursions beyond limit speeds. Symbology should be provided to permit easy identification of flap and landing gear speed limits. A visual cue should be incorporated to provide adequate awareness of proximity to VMO; this awareness has been provided by amber bands, similar to the previously discussed low speed cues, and instantaneous airspeed displays that turn amber (or flash amber digits) as the closure rate to VMO increases beyond a value that sill provides adequate time for pilot corrective action to be taken without exceeding the limit speed.

             The display requirements for airspeed awareness cues are in addition to other alerts associated with exceeding high and low speed limits, such as the stick shaker and aural overspeed warning.

3. Vertical Speed

The display range of vertical speed (or rate of climb) indications should be consistent with the climb/descent performance capabilities of the aeroplane. If the resolution advisory (RA) is integrated with the primary vertical speed indication, the range of vertical speed indication should be sufficient to display the red and green bands for all TCAS RA information.

4. Flight Path Vector or Symbol

The display of Flight Path Vector (FPV or velocity vector) or Flight Path Angle (FPA) cues on the primary flight display is not required, but may be included in many designs.

The FPV symbol can be especially useful on HUD applications. See Section 5.4.5 of Appendix 6 for HUD-specific FPV considerations.  .

The FPV or FPA indication may also be displayed on the HDD. In some HDD and most HUD applications, the FPV or FPA is the primary control and tracking cue for controlling the aeroplane during most phases of flight. Even though an FPV or FPA indication may be used as a primary flight control parameter, the attitude pitch and roll symbols (that is, waterline or boresight and pitch scale) which are still required primary indications by § 25.1303 must still be prominently displayed. In dynamic situations, such as during recovery from an unusual attitude, constant availability of attitude indications is required.

If the FPV/FPA is used as the primary means to control the aeroplane in pitch and roll, the FPV/FPA system design should allow pilots to control and manoeuvre the aeroplane with a level of safety that is at least equal to traditional designs based on attitude (CS 25.1333(b)).

There may be existing aeroplane designs where the HUD provides a FPV presentation and the HDD provides a FPA presentation. However, mixture of the two different presentations is not recommended due to possible misinterpretation by the flight crew. The designs that were accepted were found to have the following characteristics: correlation between the HUD FPV display and the primary flight display FPA display; consistent vertical axis presentation of FPV/FPA; and pilots’ ability to interpret and respond to the FPV and FPA similarly.

It should be easy and intuitive for the pilot to switch between FPV/FPA and attitude when necessary. The primary flight display of FPV/FPA symbology must not interfere with the display of attitude and there must always be attitude symbology at the top centre of the pilot's primary field of view, as required by CS 25.1321.

Aeroplane designs which display flight path symbology on the HUD and the HDD should use consistent symbol shapes (that is, the HUD FPV symbol looks like the HDD FPV).

In existing cases where an FPV is displayed head up and an FPA head down on an aeroplane, the symbols for each should not have the same shape. When different types of flight path indications may be displayed as head up and/or head down, the symbols should be easily distinguished to avoid any misinterpretation by the flight crew. A mixture of the two types of flight path indications is not recommended due to possible misinterpretation by the flight crew.

The normal FPV, the field-of-view limited FPV, and the caged FPV should each have a distinct appearance, so that the pilot is aware of the restricted motion or non-conformality.

Implementation of air mass-based FPV/FPA presentations should account for inherent limitations of air mass flight path computations.

Flight directors should provide some lateral movement to the lateral flight director guidance cue during bank commands.

To show compliance with CS 25.1301(a), CS 25.1303(b)(5), and CS 25.143(b), the FPV/FPA FD design must:

1.  Not have any characteristics that may lead to oscillatory control inputs;

2. Provide sufficiently effective and salient cues to support all expected manoeuvres in longitudinal, lateral, and directional axes, including recovery from unusual attitudes; and

3.  Not have any inconsistencies between cues provided on the HUD and HDD displays that may lead to pilot confusion or have adverse affects on pilot performance.

Performance and system safety requirements for flight guidance systems are found in the following documents:

Document Number

Title

AMC N°1 to CS 25.1329

Flight Guidance Systems

AC 120-28D

Criteria for Approval of Category III Weather Minima for Take-off, Landing, and Rollout

AC 120-29A

Criteria for Approval of Category I and Category II Weather Minima for Approach

[Amdt No: 25/11]

[Amdt No: 25/12]

[Amdt No: 25/17]

Appendix 2 – Powerplant Displays

ED Decision 2011/004/R

1.  General

At the time CS 25.1305 was adopted, flight deck powerplant displays were primarily a collection of dedicated, independent, full-time analogue “round dial” type instruments. Typically, there was one display for each required indication. Today, flight deck powerplant displays are primarily electronic displays integrated with other flight deck displays on a few relatively large electronic display spaces. Throughout this technological evolution, the Agency has used certification review items (CRIs) to assure that this new technology, with its increased potential for common faults and the challenges of effectively sharing display space, did not adversely impact the timely availability and independence of the powerplant information required to meet the intent of CS 25.1305. This AMC provides some of that guidance material.

To comply with one of the provisions of CS 25.1305, a display should provide all the instrument functionality of a full-time, dedicated analogue type instrument as intended when the specification was adopted (see AC 20-88A, Guidelines on the Marking of Aircraft). The design flexibility and conditional adaptability of modern displays were not envisioned when CS 25.1305 and CS 25.1549 were initially adopted. In addition, the capabilities of modern control systems to automate and complement flight crew functions were not envisioned. In some cases these system capabilities obviate the need for a dedicated full-time analogue type instrument.

When making a compliance finding, all uses of the affected displays should be taken into consideration, including:

(1) Flight deck indications to support the approved operating procedures (CS 25.1585),

(2) Indications as required by the powerplant system safety assessments (CS 25.1309), and

(3) Indications required in support of the instructions for continued airworthiness 25.1529).

For example:

Compliance with CS 25.1305(c)(3) for the engine N2 rotor was originally achieved by means of a dedicated, full time analogue instrument. This provided the continuous monitoring capability required to:

             Support engine starting (for example, typically used to identify fuel on point);

             Support power setting (for example, sometimes used as primary or back up parameter);

             “Give reasonable assurance that those engine operating limitations that adversely affect turbine rotor structural integrity will not be exceeded in service” as required by CS 25.903(d)(2);

             Provide the indication of normal, precautionary, and limit operating values required by CS 25.1549; as well as

             Support detection of unacceptable deterioration in the margin to operating limits and other abnormal engine operating conditions as required to comply with CS 25.901, CS 25.1309, etc.

As technology evolved full authority digital engine controls (FADECs) were introduced. The FADECs were designed with the ability to monitor and control engine N2 rotor speed as required to comply with CS 25.903(d)(2). Additionally, engine condition monitoring programmes were introduced and used to detect unacceptable engine deterioration. Flight deck technology evolved such that indications could be displayed automatically to cover abnormal engine operating conditions. The combination of these developments obviated the need for a full time analogue N2 rotor speed indication, in accordance with the guidance found in Chapter 6, paragraph 36c(3) of this AMC.

2. Design Guidelines

Safety-related engine limit exceedances should be indicated in a clear and unambiguous manner. Flight crew alerting is addressed in CS 25.1322.

If an indication of significant thrust loss is provided it should be presented in a clear and unambiguous manner.

In addition to the failure conditions listed in Chapter 4 of this AMC, the following design guidelines should be considered:

1.  For single failures leading to the non-recoverable loss of any indications on an engine, sufficient indications should remain to allow continued safe operation of the engine. (See CS 25.901(b)(2), CS 25.901(c), and CS 25.903(d)(2)).

2.  No single failure could prevent the continued safe operation of more than one engine or require immediate action by any flight crew member for continued safe operation. (See CS 25.901(c), CS 25.903(b), and CS 25.1309(b)).

3.  Engine indications needed during engine re-start should be readily available after an engine out event. (See CS 25.901(b)(2), CS 25.901(c), CS 25.903(d)(2), CS 25.903(e), CS 25.1301, CS 25.1305, CS 25.1309, and Chapter 6, paragraph 36c(3) of this AMC).

[Amdt 25/11]

Appendix 3 – Definitions

ED Decision 2011/004/R

Air Mass System - An air mass-based system that provides a heading/airspeed/vertical velocity derived flight path presentation. It depicts the flight path through an air mass, will not account for air mass disturbances such as wind drift and windshear and, therefore, cannot be relied on to show the flight path relative to the earth’s surface.

Alert – A generic term used to describe a flight deck indication meant to attract the attention of and identify to the flight crew a non-normal operational or aeroplane system condition. Warnings, Cautions, and Advisories are considered to be alerts.

Annunciation - A visual, auditory, or tactile stimulus used to attract a flight crew member’s attention.

Architecture - The manner in which the components of a display or display system are organised and integrated.

Basic T- The arrangement of primary flight information as required by CS 25.1321(b); including attitude, airspeed, altitude, and direction information.

Brightness - The perceived or subjective luminance. This should not be confused with luminance.

Bugs - A symbol used to mark or reference other information such as heading, altitude, etc.

Catastrophic -Failure conditions that result in multiple fatalities, usually with the loss of the aeroplane. (Note: In previous versions of CS 25.1309 and the associated advisory material a “catastrophic failure condition” was defined as a failure condition that would prevent continued safe flight and landing.)

Chrominance- The quality of a display image that includes both luminance and chromaticity and is a perceptual construct subjectively assessed by the human observer.

Chromaticity - Colourcharacteristic of a symbol or an image defined by its u’, v’ coordinates (See Commissions Internationale de L’Eclairage publication number 15.3, Colorimetry, 2004).

Clutter - Excessive number and/or variety of symbols, colours, or other information on a display that may reduce flight crew access or interpretation time, or decrease the probability of interpretation error.

Coasting Data - Data that is not updated for a defined period of time.

Coding- The use of assigning special meanings to some design element or characteristic (such as numbers, letters, symbols, auditory signals, colours, brightness, or variations in size) to represent information in a shorter or more convenient form.

Coding Characteristics - Readily identifiable attributes commonly associated with a design element that provide special meaning and differentiate the design elements from each other; for example size, shape, colour, motion, location, etc.

Colour Coding- The structured use of colour to convey specific information, call attention to information, or impose an organisational scheme on displayed information.

Command Information - Displayed information directing a control action.

Compact Mode- In display use, this most frequently refers to a single, condensed display presented in numeric format that is used during reversionary or failure conditions.

Conformal - Refers to displayed graphic information that is aligned and scaled with the outside view.

Contrast Ratio -

For HUD - Ratio of the luminance over the background scene (see SAE AS 8055).

For HDD - Ratio of the total foreground luminance to the total background luminance.

Criticality - Indication of the hazard level associated with a function, hardware, software, etc., considering abnormal behaviour (of this function, hardware, software) alone, in combination, or in combination with external events.

Design Eye Position - The position at each pilot's station from which a seated pilot achieves the required combination of outside visibility and instrument scan. The design eye position (DEP) is a single point selected by the applicant that meets the specifications of CS 25.773(d), CS 25.777(c), and CS 25.1321 for each pilot station. It is normally a point fixed in relation to the aircraft structure (neutral seat reference point) at which the midpoint of the pilot’s eyes should be located when seated at the normal position. The DEP is the principal dimensional reference point for the location of flight deck panels, controls, displays, and external vision.

Display Element – A basic component of a display, such as a circle, line, or dot.

Display Refresh Rate - The rate at which a display completely refreshes its image.

Display Resolution - Size of the minimum element that can be displayed, expressed by the total number of pixels or dots per inch (or millimetre) of the display surface.

Display Response Time - The time needed to change the information from one level of luminance to a different level of luminance. Display response time related to the intrinsic response me linked to the electro-optic effect used for the display and the way to address it).

Display Surface/Screen - The area of the display unit that provides an image.

Display System - The entire set of avionic devices implemented to display information to the flight crew. This is also known as an electronic display system.

Display Unit - Equipment that is located in the flight deck, in view of the flight crew, that is used to provide visual information. Examples include a colour head down display and a head up display projector and combiner.

Earth Referenced System -An inertial-based system which provides a display of flight path through space. In a descent, an earth-referenced system indicates the relationship between the flight path and the terrain and/or the artificial horizon.

Enhanced Flight Vision System (EFVS)- An electronic means to provide a display of the forward external scene topography (the natural or manmade features of a place or region, especially in a way to show their relative positions and elevation) through the use of imaging sensors such as millimetre wave radiometry, millimetre wave radar, and low light level image intensifying.

Enhanced Vision System (EVS) - An electronic means to provide a display of the forward external scene topography through the use of imaging sensors, such as forward looking infrared, millimetre wave radiometry, millimetre wave radar, and low light level image intensifying.

NOTE: An EFVS is an EVS that is intended to be used for instrument approaches under the provisions of 14 CFR 91.175 (l) and 91.175 (m), and must display the imagery with instrument flight information on a HUD.

Extremely Improbable -An extremely improbablefailure condition is so unlikely that it is not anticipated to occur during the entire operational life of all aeroplanes of one type.

Extremely Remote - An extremely remote failure condition is not anticipated to occur to each aeroplane during its total life, but may occur a few times when considering the total operational life of all aeroplanes of that type.

Eye Reference Position (ERP) - A single spatial position located at or near the centre of the HUD Eye Box. The HUD ERP is the primary geometrical reference point for the HUD.

Failure - An occurrence which affects the operation of a component, part, or element, such that it can no longer function as intended (this includes both loss of function and malfunction). NOTE: Errors may cause failures but are not considered to be failures.

Failure Condition - A condition having an effect on the aeroplane and/or its occupants, either direct or consequential, which is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events.

Field of View - The angular extent of the display that can be seen by either pilot with the pilot seated at either pilots station.

Flicker- An undesired, rapid temporal variation in the display luminance of a symbol, group of symbols, or a luminous field. It can cause discomfort for the viewer (such as headaches and irritation).

Flight Deck Design Philosophy- A high level description of the design principles that guide the designer and ensure a consistent and coherent interface is presented to the flight crew.

Flight Path Angle (FPA) so known as a Flight Path Symbol, Climb, Dive Angle, or “caged” (on the attitude indicator centreline) Flight Path Vector) - A dynamic symbol displayed on an attitude display that depicts the vertical angle relative to the artificial horizon, in the pitch axis, that the aeroplane is moving. A flight path angle is the vector resultant of the forward velocity and the vertical velocity. For most designs, the FPA is earth referenced, though some use air mass vectors. Motion of the FPA on the attitude display is in the vertical (pitch) axis only with no lateral motion.

Flight Path Vector (FPV) so known as Velocity Vector or Flight Path Marker) - A dynamic symbol displayed on an attitude display that depicts the vector resultant of real-time flight path angle (vertical axis) and lateral angle relative to aeroplane heading created by wind drift and slip/skid. For most designs, the FPV is earth referenced, though some use air mass vectors which cannot account for wind effects

Foreseeable Conditions - The full environment that the display or the display system is assumed to operate within, given its intended function. This includes operating in normal, non-normal, and emergency conditions.

Format (See Figure A3-2) - An image rendered on the whole display unit surface. A format is constructed from one or more windows (see ARINC Specification 661).

FPV/FPA-referenced Flight Director (FD) - A HUD or HDD flight director cue in which the pilot “flies” the FPV/FPA cue to the FD command in order to comply with flight guidance commands. This is different from attitude FD guidance where the pilot “flies” the aeroplane (that is, pitch, boresight) symbol to follow pitch and roll commands.

Full-time Display - A dedicated continuous information display.

Functional Hazard Assessment - A systematic, comprehensive examination of aeroplane and system function to identify potential Minor, Major, Hazardous, and Catastrophic failure conditions that may arise as a result of malfunctions or failures to function.

Grey Scale- The number of incremental luminance levels between full dark and full bright.

Hazard - Any condition that compromises the overall safety of the aeroplane or that significantly reduces the ability of the flight crew to cope with adverse operating conditions.

Hazardous – A hazardous failure condition reduces the operation of the aeroplane or the ability of the flight crew to operate in adverse conditions to the extent that there would be:

             A large reduction in safety margins or functional capabilities;

             Physical distress or excessive workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely; or

             Serious or fatal injury to a relatively small number of the occupants other than the flight crew.

Head Down Display (HDD) - A primary flight display located on the aeroplane’s main instrument panel directly in front of the pilot in the pilot’s primary field of view. The HDD is located below the windscreen and requires the flight crew to look below the glareshield in order to use the HDD to fly the aeroplane.

Head Mounted Display (HMD) – A special case of HUD mounted on the pilot’s head. Currently, there are not any HMDs used in CS-25 installations, but guidance will be provided in the future, as needed.

Head Up Display (HUD) - A display system that projects primary flight information (for example, attitude, air data, guidance, etc.) on a transparent screen (combiner) in the pilot’s forward field of view, between the pilot and the windshield. This allows the pilot to simultaneously use the flight information while looking along the forward path out the windshield, without scanning the head down displays. The flight information symbols should be presented as a virtual image focused at optical infinity. Attitude and flight path symbology needs to be conformal (that is, aligned and scaled) with the outside view.

HUD Design Eye Box - The three-dimensional area surrounding the design eye position, which defines the area, from which the HUD symbology and/or imagery are viewable.

Icon- A single, graphical symbol that represents a function or event.

Image Size - The viewing area (field) of the display surface.

             Direct View Display: The useful (or active) area of the display

(for example, units cm x cm).

             Head Up Display: The total field of view (units usually in degrees x degrees).

(Total field of view defines the maximum angular extent of the display that can be seen by either eye allowing head motion within the eyebox (see 8055).

Indication - Any visual information representing the status of graphical gauges, other graphical representations, numeric data messages, lights, symbols, synoptics, etc. to the flight crew.

Information Update Rate - The rate at which new data is displayed or updated.

Interaction- The ability to directly affect a display by utilizing a graphical user interface (GUI) that consists of a control device (for example, a trackball), cursor, and “soft” display control that is the cursor target.

Latency - Thetime taken by the display system to react to a triggered event coming from an input/output device, the symbol generator, the graphic processor, or the information source.

Layer - A layer is the highest level entity of the Display System that is known by a User Application.

Luminance - Visible light that is emitted from the display. Commonly-used units: foot-lamberts, cd/m2.

Major - A majorfailure condition reduces the operation of the aeroplane or the ability of the flight crew to operate in adverse conditions to the extent that there would be, for example:

             A significant reduction in safety margins or functional capabilities;

             Physical discomfort or a significant increase in flight crew workload

             Physical distress to passengers or cabin crew, possibly including injuries.

Menu - A list of display options available for selection.

Message - Acommunication that conveys an intended meaning such as an alerting or data link message.

Minor - A minor failure condition would not significantly reduce aeroplane safety and would involve crew actions well within their capabilities. Minor failure conditions may include:

             A slight reduction in safety margins or functional capabilities;

             A slight increase in crew workload (such as routine flight plan changes); or

             Some physical discomfort to passengers or cabin crew.

Misleading Information - Incorrect information that is not detected by the flight crew because it appears as correct and credible information under the given circumstances.

When incorrect information is automatically detected by a monitor resulting in an indication to the flight crew, or when the information is obviously incorrect, it is no longer considered misleading. The consequence of misleading information will depend on the nature of the information, and the given circumstances.

Mode - The functional state of a display and/or control system(s). A mode can be manually or automatically selected.

MSG-3- Maintenance Steering Group 3. A steering group sponsored by the Airline Transportation Association whose membership includes representatives from the aviation industry and aviation regulatory authorities.

Occlusion - Visual blocking of one symbol by another, sometimes called occulting.

Partitioning- A technique for providing isolation between functionally independent software components to contain and/or isolate faults and potentially reduce the effort of the software verification process.

Pixel- A display picture element which usually consists of three (red, green, blue) sub-pixels (also called dots on a cathode ray tube).

Pixel Defect - A pixel that appears to be in a permanently on or off-state.

Primary Flight Displays- The displays used to present primary flight information.

Primary Field of View (FOV) (See Figure A3-1) - Primary Field-of-View is based on the optimum vertical and horizontal visual fields from the design eye reference point that can be viewed with eye rotation only using foveal or central vision. The description below provides an example of how this may apply to head-down displays.

With the normal line-of-sight established at 15 degrees below the horizontal plane, the values for the vertical (relative to normal line-of-sight forward of the aircraft) are

+/-15 degrees optimum, with +40 degrees up and -20 degrees down maximum.

Figure A3-1 Primary Field of View

Primary Flight Information- The information whose presentation is required by CS 25.1303(b) and CS 25.1333(b), and arranged by CS 25.1321(b).

Primary Flight Instrument - Any display or instrument that serves as the flight crew’s primary reference of a specific parameter of primary flight information. For example, a centrally located attitude director indicator is a primary flight instrument because it is the flight crew’s primary reference for pitch, bank, and command steering information.

Prompt- A method of cueing the flight crew that some input or action is required.

Required Engine Indications- The information whose presentation is required by CS 25.1305.

Reversionary - The automatic or flight crew initiated (manual) relocation of display formats or windows following a display failure.

Shading - Shading is used as:

             A coding method for separating information, change in state, give emphasis, and depth information.

             A blending method between graphic elements (map displays, synthetic vision system).

Soft Control- Display element used to manipulate, select, or de-select information (for example, menus and soft keys).

Standby Display- A backup display that is used if a primary display malfunctions.

Status information - Information about the current condition of an aeroplane system and its surroundings.

Symbol - A symbol is a geometric form or alpha-numeric information used to represent the state of a parameter on a display. The symbol may be further defined by its location and motion on a display.

Synthetic Vision – A computer generated image of the external topography from the perspective of the flight deck. The image is derived from aircraft attitude, high-precision navigation solution, and terrain database terrain, obstacles, and relevant cultural features.

Synthetic Vision System – An electronic means to display a synthetic vision image of the external scene topography to the flight crew.

Texturing - A graphic, pictorial effect used to give a displayed object or graphic a specific “look” (metallic, grassy, cloudy, etc.). Texture is used:

             As a coding method for separating information, change in state, give emphasis, and depth information.

             As a blending method between graphic elements (map displays, synthetic vision system).

             To enhance similarity between a synthetic image and the real world image.

Time Sharing – Showing different information in the same display area at different times.

Transparency- A means of seeing a background information element through a foreground information element. Transparency can alter the colour perception of both the “front” element and the “back” element.

Viewing Angle – The angle between the normal line of sight (looking straight ahead) and the line from the eye to the object being viewed. The angle can be horizontal, vertical, or a composite of those two angles.

Window (See Figure A3-2) - A rectangular physical area of the display surface. A window consists of one or more layers (see ARINC Specification 661).

Figure A3-2 – Display Format

Windowing - The technique to create windows. Segmenting a single display area into two or more independent display areas or inserting a new display area onto an existing display.

[Amdt 25/11]

Appendix 4 – Acronyms Used in this AMC

ED Decision 2015/019/R

AC

(FAA) Advisory Circular

AMC

Acceptable Means of Compliance

ARAC

Aviation Rulemaking Advisory Committee

ARP

Aerospace Recommended Practices

AS

Aerospace Standard

CCD

Cursor Control Device

CFR

Code of Federal Regulations

CRT

Cathode Ray Tube

CS-AWO

EASA Certification Specifications for All Weather Operations

DEP

Design Eye Position

EASA

European Aviation Safety Agency

EFVS

Enhanced Flight Vision System

ERP

Eye Reference Position

ETSO

European Technical Standard Order

EUROCAE

European Organisation for Civil Aviation Equipment

EVS

Enhanced Vision System

FAA

Federal Aviation Administration

FADEC

Full Authority Digital Engine Controls

FD

Flight Director

FHA

Functional Hazard Assessment

FMS

Flight Management System

FOV

Field-of-View

FPA

Flight Path Angle

FPV

Flight Path Vector

GNSS

Global Navigation Satellite System

GUI

Graphical User Interface

HDD

Head-Down Display

HMD

Head-Mounted Display

HUD

Head-Up Display

ILS

Instrument Landing System

ICAO

International Civil Aviation Organization

JAA

Joint Aviation Authorities

LCD

Liquid Crystal Display

MSG-3

Maintenance Steering Group 3

PF

Pilot Flying

PNF 

Pilot Not Flying

RA

Resolution Advisory

RNAV

Area Navigation

SAE

SAE International (formerly Society of Automotive Engineers)

SVS

Synthetic Vision System

TAWS

Terrain Awareness and Warning System

TCAS

Traffic Alert and Collision Avoidance System

VFR

Visual Flight Rules

VNAV

Vertical Navigation

VOR

Very High Frequency Omnirange Stations

[Amdt 25/11]

[Amdt 25/17]

Appendix 6 – Head-Up Display

ED Decision 2015/019/R

Contents

No table of contents entries found.

1.0 Introduction

1.1 Purpose

This Appendix provides additional guidance related to the unique aspects, characteristics, and functions of Head-Up Displays (HUDs) for transport category aeroplanes. This Appendix also addresses issues related to the design, analysis, and testing of HUDs. It addresses HUDs that are designed for a variety of different operational concepts and functions. This guidance applies to HUDs that are intended to be used as a supplemental display in which the HUD contains the minimum information immediately required for the operational task associated with the intended function. It also applies to HUDs that are intended to be used effectively as primary flight displays. This Appendix addresses both the installation of a single HUD, typically used by the left-side pilot, as well as special considerations related to dual HUDs, one for each pilot. This Appendix does not provide the guidance for display of vision system (e.g. Enhanced Flight Vision Systems (EFVS) and Synthetic Vision Systems (SVS)) video on the HUD. The airworthiness requirements and means-of-compliance criteria for display of video on the HUD may be found in the Certification Review Items (CRIs) issued by the Agency until new CSs and AMCs are issued.

1.2 Definition of Head-Up Display (HUD)

An HUD is a display system that projects primary flight information (for example, attitude, air data, and guidance) on a transparent screen (combiner) in the pilot’s forward Field-of-View (FOV), between the pilot and the windshield. This allows the pilot to simultaneously use the flight information while looking along the forward path out of the windshield, without scanning the Head-Down Displays (HDDs). The flight information symbols should be presented as a virtual image focussed at optical infinity. Attitude and flight path symbology needs to be conformal (that is, aligned and scaled) with the outside view.

1.3 Other resources

For guidance associated with specific operations using HUDs, such as low-visibility approach and landing operations, see the relevant requirements and guidance material (e.g. EASA Certifications Specifications for All Weather Operations (CS-AWO), and FAA Advisory Circular (AC) 120-28D, Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout). In addition, Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 5288, Transport Category Aeroplane Head Up Display (HUD) Systems; SAE Aerospace Standard (AS) 8055, Minimum Performance Standard for Airborne Head Up Display (HUD); and SAE ARP5287, Optical Measurement Procedures for Airborne Head Up Display; provide guidance for designing and evaluating HUDs.

2.0 Unique safety considerations

2.1 Aeroplane and systems safety

2.1.1 Systems

Installing HUD systems in flight decks may introduce complex functional interrelationships among the flight crew members and other display and control systems. Consequently, a functional hazard assessment which requires a top-down approach from an aeroplane-level perspective should be developed in accordance with CS 25.1309. Developing a functional hazard assessment for a particular installation requires careful consideration of the role that the HUD plays within the flight deck in terms of integrity and availability of function, as well as the operational concept of the installation to be certified (e.g. dual-HUD versus single-HUD installation, and the type and amount of information displayed). Chapter 4 of this AMC provides material that may be useful in preparing the functional hazard assessment.

2.1.2 Aeroplane Flight Manual (AFM) procedures

All alleviating flight crew actions that are considered in the HUD safety analysis need to be validated for incorporation into the AFM procedures section or for inclusion in type-specific training.

2.1.3 Availability of primary flight information

Requirements for the availability of primary flight information are provided in CS 25.1333.

2.2 Crew safety

2.2.1 Prevention of head injury

HUD equipment introduces potential hazards that are not traditionally associated with head-down electronic flight deck displays. The HUD system must be designed and installed to prevent the possibility of pilot injury in the event of an accident or any other foreseeable circumstance such as turbulence, hard landing, or bird strike. An HUD combiner with a swing-arm deployment mechanism should be designed to avoid false detents and false latch indications between the fully stowed and deployed positions. A misstowed combiner could swing inadvertently into the path of the pilot’s head and cause injury. Additionally, the HUD installation, including the overhead unit and combiner, must comply with the occupant injury requirements of CS 25.785(d) and (k) and the retention requirements of CS 25.789(a).

2.2.2 Special considerations for dual-HUD installations

For dual-HUD installations, the applicant should address single events that could simultaneously incapacitate both pilots and, therefore, become safety-of-flight issues. Examples of such single events are flight or gust loads, a hard landing, or an emergency landing. The Agency may need to issue a Certification Review Item providing project-specific means of compliance if the installation geometry indicates that such events may produce occupant contact with the HUD installation.

2.2.3 Non-interference with emergency equipment

CS 25.803, CS 25.1411, and CS 25.1447 require that the HUD installation must not interfere with, or restrict the use of, other installed equipment such as emergency oxygen masks, headsets, or microphones. The installation of the HUD should not adversely affect the emergency egress provisions for the flight crew, or significantly interfere with flight crew access. The system should not hinder the flight crew’s movement while conducting any flight procedures.

3.0 Design

3.1 Intended function of HUDs

The applicant is responsible for identifying the intended function of the HUD. The description of the intended function should include the operational phases of flight and the concept of operation, including how, when, and for what purpose(s) the HUD is to be used. For example, the HUD may display situational information and/or guidance information, be a supplemental display of primary flight information in all phases of flight, display command guidance for manually flown approaches and/or for monitoring autopilot-coupled instrument approaches, display guidance for low-visibility take-off, and/or display enhanced vision imagery and synthetic vision video. See paragraph 11.c of this AMC for additional guidance.

3.1.1 General

In most applications, HUDs provide an indication of primary flight references, which allow the pilot to rapidly evaluate the aircraft attitude, energy status, and position during the phases of flight for which the HUD is designed. HUDs are usually designed to present information to enhance pilot performance in such phases of flight as during the transition between instrument and visual flight conditions with variable outside visibility conditions. While HUDs may be designed to display enhanced and synthetic visual imagery, particular means-of-compliance guidance for this purpose is not found in this Appendix but will be addressed by associated CRIs until new CSs and AMCs are issued.

3.1.2 Display of primary flight information

3.1.2.1 HUD as de facto primary flight display

If an HUD displays primary flight information, it is considered a de facto primary flight display while the pilot is using it, even if it is not the pilot’s sole display of this information. The pilot should be able to easily recognise the primary flight information — it should not be ambiguous or confusing when taking into account information displayed on other flight deck displays.

3.1.2.2 Applicable instrument requirements for HUD

Primary flight information displayed on the HUD should comply with all the requirements associated with such information in CS-25 (e.g. CS 25.1303(b) for flight and navigation instruments that must be visible from each pilot station, and CS 25.1333(b) for the operational requirements of those systems). CS 25.1321(b) specifies the requirements for arranging primary flight information. For specific guidance regarding the display of primary flight information, see the main body and Appendix 1 of this AMC.

3.1.3 Display of other flight information

Additional information may be related to the display of command guidance or specific flight parameter information needed for operating the aeroplane by reference to the HUD.

3.1.3.1 Command guidance

When the HUD is used to monitor the autopilot, it should display the following information:

             situation information based on independent raw data;

             autopilot operating mode;

             autopilot engage status; and

             autopilot disconnect warning (visual).

3.1.3.2 Flight parameter information

The HUD should also display additional flight parameter information, if required, to enable the pilot to operate the aeroplane during phases of flight for which the HUD is approved. This additional information may include:

             flight path indication;

             target airspeed references and speed limit indications;

             target altitude references and altitude awareness (e.g. decision height and minimum descent altitude) indications; or

             heading or course references.

3.2 HUD controls

3.2.1 Control placement

For compliance with CS 25.777, the flight crew must be able to see, identify, and reach the means of controlling the HUD, including its configuration and display modes, from the normal seated position. To comply with CS 25.777 and CS 25.1301, the position and movement of the HUD controls must not lead to inadvertent operation.

3.2.2 Control illumination

To comply with CS 25.1381, the HUD controls must be adequately illuminated for all normal ambient lighting conditions and must not create any objectionable reflections on the HUD or other flight instruments. Unless a fixed level of illumination is satisfactory under all lighting conditions, there should be a means to control its intensity.

3.2.3 Control integration

To the greatest extent practicable, HUD controls should be integrated with other associated flight deck controls to minimise the flight crew workload and error associated with HUD operation and to enhance flight crew awareness of HUD modes.

3.2.4 Ease of use

HUD controls, including the controls to change or select HUD modes, should be implemented to minimise flight crew workload for data selection or data entry, and allow the pilot to easily view and perform all mode control selections from the seated position.

3.3 Visibility and Field-of-View (FOV)

3.3.1 Field-of-View

The design of the HUD installation should provide adequate display FOV in order for the HUD to function as intended in all anticipated flight attitudes, aircraft configurations, and environmental conditions, such as crosswinds, for which it is approved. The AFM should specify all airworthiness and operational limitations related to these factors.

3.3.2 Impact on pilot compartment view

3.3.2.1 Interior view

Whether or not the combiner is deployed and the HUD is in use, it must not create additional significant obstructions to either pilot’s compartment view as required by CS 25.773. The HUD must also not restrict the view of any flight deck controls, indicators, or other flight instruments as required by CS 25.777 and CS 25.1321.

3.3.2.2 External view

The HUD should not significantly obscure the necessary pilot compartment view of the outside world for normal, non-normal, or emergency flight manoeuvres during any phase of flight for a pilot seated at the Design Eye Position (DEP). The HUD should not significantly affect the ability of any flight crew member to spot traffic, distinctly see approach lights, runways, signs, markings, or other aspects of the external visual scene. The combination of the windshield and the HUD must meet the requirements of CS 25.773(a)(1).

3.3.2.3 HUD optical performance

As far as practicable, the optical performance of the HUD should not cause distortions that degrade or detract from the flight crew’s view of external references or of other aircraft. The optical performance should not degrade or detract from the flight crew’s ability to safely perform any manoeuvres within the operating limits of the aeroplane, as required by CS 25.773. Where the windshield optically modifies the pilot’s view of the outside world, the motions and positions of conformal HUD symbols should be optically consistent (i.e. aligned and scaled) with the perceived outside view. To avoid distortions, the optical qualities of the HUD should be uniform across the entire FOV. When the pilot views the HUD with both eyes from any off-centre position within the design eyebox, optical non-uniformities should not produce perceivable differences in the binocular view. SAE ARP 5288, Transport Category Aeroplane Head Up Display (HUD) Systems, provides additional guidance.

3.3.3 Conformal symbols with limited HUD Field-of-View

The range of motion of conformal symbology can present certain challenges in rapidly changing and high-crosswind conditions. In certain cases, the motion of the guidance and the primary reference cue may be limited by the FOV. It should be shown that, in such cases, the guidance remains usable and that there is a positive indication that it is no longer conformal with the outside scene. It should also be shown that there is no interference between the indications of primary flight information and the flight guidance cues.

4.0 HUD design eyebox criteria

4.1 Design eye position

The FAA AC 25.773-1, Pilot Compartment View Design Considerations, defines DEP as a single point that meets the requirements of CS 25.773 and CS 25.777. For certification purposes, the DEP is the pilot’s normal seated position. Fixed markers or some other means should be provided at each pilot station to enable the pilots to position themselves in their seats at the DEP for an optimum combination of outside visibility and instrument scan. The HUD installation must comply with CS 25.773 and CS 25.1321. The HUD should be able to accommodate pilots, from 1 575 to 1 905 mm (5 ft 2 in to 6 ft 3 in) tall, while they are seated at the DEP with their shoulder harnesses and seat belts fastened, to comply with CS 25.777. The DEP should be centred within the minimum design eyebox dimensions found in paragraph 4.2.3 of this Appendix. Actual HUD eyeboxes are larger than these minimum dimensions and, if not centred around the DEP, they need only be large enough so that this minimum sub-volume is centred around the DEP.

4.2 Design eyebox

4.2.1 Display visibility requirements

The fundamental requirements for instrument arrangement and visibility in CS 25.773, CS 25.777, CS 25.1301, and CS 25.1321 apply to HUDs. Each flight instrument, including the flight information displayed on the HUD, must be plainly visible to the pilot at that pilot’s station with minimum practicable deviation from the normal position and forward line of vision. While seated at the DEP, the pilot must be able to see the flight information displayed on the HUD. The optical characteristics of the HUD, particularly the limits of its design eyebox, cause the pilot’s ability to fully view essential flight information to be more sensitive to the pilot’s eye position, as compared to HDDs. The HUD design eyebox is a three-dimensional volume, specified by the manufacturer, within which display visibility requirements are met. Thus, whenever the pilot’s eyes are within the design eyebox, the required flight information must be visible on the HUD. The size of the design eyebox and the layout of flight information on the HUD should be designed so that visibility of the displayed symbols is not unduly sensitive to pilot head movements in all expected flight conditions. In the event that the pilot’s view of displayed information is totally lost as a result of a head movement, the pilot should be able to regain the view of the display rapidly and without difficulty. The minimum monocular FOV required to display this required flight information should include the centre of the FOV and should be specified by the manufacturer. The HUD FOV should be designed by considering the intended operational environment and potential aeroplane configurations.

4.2.2 Design eyebox position

The HUD design eyebox should be laterally and vertically positioned around the respective pilot’s DEP. It should be large enough so that the required flight information is visible to the pilot at the minimum displacements from the DEP specified in paragraph 4.2.3 of this Appendix. The symbols should be laid out and positioned such that excessive eye movements are not required to scan elements of the display. The displayed symbols which are necessary to perform the required tasks should be visible to the pilot from the DEP. The DEP used for the evaluation of the eyebox location should be the same as that used for the basic flight deck in accordance with the FAA AC 25.773-1.

4.2.3 Design eyebox dimensions

The lateral and vertical dimensions of the design eyebox represent the total movement of a monocular viewing instrument with a 6.35 mm (0.25 in) entrance aperture (pupil). The longitudinal dimension of the design eyebox represents the total fore–aft movement over which the requirement of this specification is met (refer to SAE AS 8055). When the HUD is a primary flight display, when airworthiness approval is predicated on the use of the HUD, or when the pilot can be reasonably expected to operate primarily by reference to the HUD, dimensions larger than the minimums shown below may be necessary.

4.2.3.1 Lateral: 38.1 mm (1.5 in) left and right from the DEP (76.2 mm (3.0 in) wide).

4.2.3.2 Vertical: 25.4 mm (1.0 in) up and down from the DEP (50.8 mm (2.0 in) high).

4.2.3.3 Longitudinal: 50.8 mm (2.0 in) fore and aft from the DEP (101.6 mm (4.0 in) deep).

4.3 Conformal display accuracy

4.3.1 Symbol positioning

The accuracy of symbol positioning relative to the external references, or display accuracy, is a measure of the relative conformality of the HUD display with respect to the pilot’s view of the real world through the combiner and windshield from any eye position within the HUD design eyebox. The display accuracy is a monocular measurement. For a fixed field point, the display accuracy is numerically equal to the angular difference between the position of a real-world feature (as seen through the combiner and windshield) and the HUD projected symbology.

4.3.2 Error budget

The total error budget for the display accuracy of the HUD system (excluding sensor and windshield errors) includes installation errors, digitisation errors, electronic gain and offset errors, optical errors, combiner positioning errors, errors associated with the CRT and yoke (if applicable), misalignment errors, environmental conditions (e.g. temperature and vibration), and component variations.

4.3.2.1 Error sources

Optical errors are dependent upon both the head position and the field angle. Optical errors comprise three sources: uncompensated pupil and field errors originating in the optical system aberrations, image distortion errors, and manufacturing variations. Optical errors are statistically determined by sampling the HUD FOV and the design eyebox (see 4.2.10 of SAE AS8055 for a discussion of FOV and design eyebox sampling).

4.3.2.2 Total accuracy

The optical errors should represent at least 95.4 % (2 sigma) of all sampled points. The display accuracy errors are characterised in both the horizontal and vertical planes. The total display accuracy should be characterised as the root-sum square errors of these two component errors.

4.3.2.3 Allowable margin for display errors

All display errors should be minimised across the display FOV consistent with the intended function of the HUD. Table A6-1 shows the allowable display accuracy errors for a conformal HUD as measured from the HUD eye reference point:

Table A6-1 — Allowable display accuracy errors

Location on the HUD combiner

Error tolerance in milliradians (mrad)

At HUD bore sight

≤ 5.0 mrad

≤ 10° diameter

≤ 7.5 mrad (2 sigma)

≤ 30° diameter

≤ 10.0 mrad (2 sigma)

> 30° diameter

< 10 mrad + kr [(FOV)(in degrees) – 30)] (2 sigma) where kr = 0.2 mrad of error per degree of FOV

4.3.2.4 Maximum error

The HUD manufacturer should specify the maximum allowable installation error. In no case should the display accuracy error tolerances cause hazardously misleading data to be presented to the pilot viewing the HUD.

4.4 Symbol positioning alignment

The symbols intended for use in combination with other symbols and scales to convey meaning should be aligned and positioned precisely enough not to be misleading to the pilot.

4.5 Overlapping symbols

Symbols that share space with other symbols should not partially obscure or interfere with the appearance of other symbols in a way that misleads the pilot.

4.6 Alignment

4.6.1 Outside view

The HUD combiner should be properly aligned so that display elements such as attitude scales and flight path vector symbology are conformal (i.e. the position and motion are aligned and scaled). Proper combiner alignment is needed to match conformal display parameters as close as possible to the outside real world, depending on the intended function of those parameters.

4.6.2 Combiner

If the HUD combiner is stowable, means should be provided to ensure that it is in its fully deployed and aligned position before using the symbology for aircraft control. The HUD should alert the pilot if the position of the combiner causes normally conformal data to become misaligned in a manner that may result in the display of misleading information.

4.7 Visual display characteristics

The following paragraphs highlight some areas related to performance aspects that are specific to the HUD. SAE ARP5288, Transport Category Aeroplane Head Up Display (HUD) Systems and SAE AS8055, Minimum Performance Standard for Airborne Head Up Display (HUD), provide performance guidelines for an HUD. As stated in Chapter 3 of this AMC, the applicant should notify the Agency if any visual display characteristics do not meet the guidelines in SAE ARP5288 and AS8055.

4.7.1 Luminance

4.7.1.1 Background light conditions

The display luminance (brightness) should be satisfactory in the presence of dynamically changing background (ambient) lighting conditions (5 to 10 000 foot-Lambert (fL), as specified in SAE AS8055), so that the HUD data are visible.

4.7.1.2 Luminance control

The HUD should have adequate means to control luminance so that displayed data is always visible to the pilot. The HUD may have both manual and automatic luminance control capabilities. It is recommended that automatic control is provided in addition to the manual control. Manual control of the HUD brightness level should be available to the flight crew to set a reference level for automatic brightness control. If the HUD does not provide automatic control, a single manual setting should be satisfactory for the range of lighting conditions encountered during all foreseeable operational conditions and against expected external scenes. Readability of the displays should be satisfactory in all foreseeable operating and ambient lighting conditions. SAE ARP5288 and SAE AS8055 provide guidelines for contrast and luminance control.

4.7.2 Reflections

The HUD must be free of glare and reflections that could interfere with the normal duties of the minimum flight crew, as required by CS 25.773 and CS 25.1523.

4.7.3 Ghost images

A ghost image is an undesired image appearing at the image plane of an optical system. Reflected light may form an image near the plane of the primary image. This reflection may result in a false image of the object or an out-of-focus image of a bright source of light in the field of the optical system. The visibility of ghost images within the HUD of external surfaces should be minimised so as not to impair the flight crews ability to use the display.

4.7.4 Accuracy and stability

4.7.4.1 Sensitivity to aircraft manoeuvring

The system operation should not be adversely affected by aircraft manoeuvring or changes in attitude encountered in normal service.

4.7.4.2 Motion of symbols

The accuracy of positioning of symbols should be commensurate with their intended use. Motion of non-conformal symbols should be smooth, not sluggish or jerky, and consistent with aircraft control response. Symbols should be stable with no discernible flicker or jitter.

5.0 Guidelines for presenting information

5.1 HUD and HDD compatibility

5.1.1 General

If the content, arrangement, or format of the HUD is dissimilar to the HDD, it can lead to flight crew confusion, misinterpretation, and excessive cognitive workload. During transitions between the HUD and HDDs (whether required by navigation duties, failure conditions, unusual aeroplane attitudes, or other reasons), dissimilarities could make it more difficult for the flight crew to manually control the aeroplane or to monitor the automatic flight control system. Dissimilarities could also delay the accomplishment of time-critical tasks. Some differences may be unavoidable, such as the use of colour on the HDD and a single colour (i.e. monochrome) on the HUD. The guidelines listed below are intended to minimise the potential for confusion, undue workload, and delays in flight crew task performance.

5.1.2 Exceptions

Deviation from the guidelines below may be unavoidable due to conflict with other information display characteristics or requirements unique to HUDs. These deviations may relate to the minimisation of display clutter, minimisation of excessive symbol flashing, and the presentation of certain information conformal to the outside scene. Deviations from these guidelines require additional pilot evaluation.

5.1.3 Guidelines for HUD–HDD compatibility

5.1.3.1 Consistent displays and format

The content, arrangement, symbology, and format of the information on the HUD should be sufficiently compatible with the HDDs to preclude pilot confusion, misinterpretation, increased cognitive workload, or flight crew error (see paragraphs 31.b and 31.c(3) of this AMC). The layout and arrangement of HUD and HDD formats of the same information need to convey the same intended meanings (see paragraph 36.b of this AMC). For example, the relative locations of barometric altitude, airspeed, and attitude should be similar. Likewise, the acronyms and relative locations of flight guidance mode annunciations for thrust and lateral and vertical flight path should be similar.

5.1.3.2 Symbols

Table A6-2 provides the guidelines for symbols.

Table A6-2 — Symbol guidelines for HUD–HDD compatibility

Symbol characteristics

Guidelines

Shape and appearance

HUD symbols that have similar shape and appearance as HDD symbols should have the same meaning. It is not acceptable to use similar symbols for different meanings. Symbols that have the same meaning should have the same shape and appearance on the HUD and HDDs.

Special symbolic

features

Special display features or changes may be used to convey particular conditions, such as an overlaid ‘X’ to mean failure of a parameter, a box around a parameter to convey that its value changed, a solid line/shape changing to a dashed line/shape to convey that its motion is limited, and so on. To the extent that it is practical and meaningful, the same display features should be used on the HUD as on the HDDs.

Relative location

Information that relates to the symbols should appear in the same general location relative to other information.

5.1.3.3 Alphanumeric information

Alphanumeric (i.e. textual) information should have the same resolution, units, and labelling. For example, the command reference indication for vertical speed should be displayed in the same foot-per-minute increments and labelled with the same characters as on the HDDs. Likewise, the same terminology should be used for labels, modes, and alert messages on the HUD as on the HDDs. If the design has exceptions to this principle, then they should be justified by necessity or impracticality, and shown not to increase workload or the potential for flight crew confusion or flight crew error.

5.1.3.4 Analog scales or dials

Analog scales or dials should have the same range and dynamic operation. For example, a glideslope deviation scale displayed head-up should have the same displayed range as when it is displayed head-down, and the direction of movement should be consistent.

5.1.3.5 Flight guidance systems

Modes of flight guidance systems (e.g. autopilot, flight director, and autothrust) and state transitions (e.g. land 2 to land 3) should be displayed on the HUD. Except for the use of colour, the modes should be displayed using consistent methods (e.g. the method used head-down to indicate a flight director mode transitioning from armed to captured should also be used head-up).

5.1.3.6 Command information

When command information (e.g. flight director commands) is displayed on the HUD in addition to the HDDs, the HUD guidance cue and path deviation scaling (i.e. dots of lateral and vertical deviation) need to be consistent with that used on the HDDs. There may be cases when the other pilot is using the HDD of guidance and path deviations to monitor the flying pilot’s performance. Therefore, the HDD must have path deviation scaling that is sufficiently consistent with the HUD so as not to mislead the monitoring pilot.

5.1.3.7 Sensor sources

Sensor system sources for instrument flight information (e.g. attitude, direction, altitude, and airspeed) should be consistent between the HUD and the HDDs used by the same pilot.

5.1.4 Head-up to head-down transition

5.1.4.1 Transition scenarios

The applicant should identify conditions for which the pilot transitions between the HUD and the HDD and develop scenarios for evaluation (e.g. simulation or flight test). These scenarios should include systems’ failures and events leading to unusual attitudes. Transition capability should be shown for all foreseeable modes of upset.

5.1.4.2 Unambiguous information

While the HUD and HDD may display information (e.g. flight path, path deviation, or aircraft performance information) in a different manner, the meaning should be the same and any differences should not create confusion, misinterpretation, unacceptable delay, or otherwise hinder the pilot’s transition between the two displays. The pilot should be able to easily recognise and interpret information on the HUD. The information should not be ambiguous with similar information on other aircraft flight deck displays.

5.2 Indications and alerts

5.2.1 Monochrome attention-getting properties

To comply with CS 25.1322, and considering that most HUDs are predominantly monochrome devices, the HUD should emphasise the display of caution and warning information with the appropriate use of attention-getting properties such as flashing, outline boxes, brightness, size, and/or location to compensate for the lack of colour coding. For additional alerting guidance, see AMC 25.1322 ‘Flight Crew Alerting’. The applicant should develop and apply a consistent documented philosophy for each alert level. These attention-getting properties should be consistent with those used on the HDDs. For example, flashing icons on the HUD should indicate situations with the same level of urgency as flashing icons on the HDDs.

5.2.2 Time-critical alerts on the HUD

For some phases of flight, airworthiness approval may be predicated on the use of the HUD. In these phases of flight, it can be reasonably expected that the pilot operates primarily by using the HUD, so the objective is to not redirect attention of the Pilot Flying (PF) to another display when an immediate manoeuvre is required (e.g. resolution advisory or windshear). The applicant should provide in the HUD the guidance, warnings, and annunciations of certain systems, if installed, such as a Terrain Awareness and Warning System (TAWS), or a Traffic Alert and Collision Avoidance System (TCAS) and a windshear detection system. If the provision of TCAS or windshear guidance is not practical on the HUD, the applicant should provide compensating design features and pilot procedures (e.g. a combination of means such as control system protections and an unambiguous reversion message on the HUD) to ensure that the pilot has equivalent and effective visual information for immediate awareness and response to the respective alerts.

5.2.3 Additional resources

Additional guidance on indications and alerts is contained in AMC No 1 to CS 25.1329, Flight Guidance System, in AMC No 2 to CS 25.1329, Flight Testing of Flight Guidance Systems, in AMC 25.1322, Flight Crew Alerting, and in the associated rules.

5.3 Display clutter

This AMC addresses display clutter for traditional displays on the instrument panel. However, because the pilot must see through the HUD, special attention is needed to avoid display clutter that would otherwise unduly obscure the outside view.

5.4 Display of information

5.4.1 General

The HUD information display requirements depend on the intended function of the HUD. Specific guidance for displayed information is contained within the main body and Appendix 1 of this AMC. In addition, the following sections provide guidance related to unique characteristics of the HUD. As in the case of other flight deck displays, new and novel display formats may be subject to human factors evaluation of the pilot interface by an airworthiness authority.

5.4.2 Alternate formats for primary flight information

5.4.2.1 Phase of flight

There may be certain operations and phases of flight during which certain primary flight reference indications on the HUD do not need to have the analog cues for trend, deviation, and quick glance awareness that would normally be necessary. For example, during the precision approach phase, HUD formats have been accepted that provide a digital-only display of airspeed and altitude. Acceptance of these displays has been predicated on the availability of compensating features that provide clear and distinct warning to the flight crew when these and certain other parameters exceed well-defined tolerances around the nominal approach state (e.g. approach warning). These warnings have associated procedures that require a missed approach.

5.4.2.2 Digital displays

Formats with digital-only display of primary flight information (e.g. airspeed, altitude, attitude, and heading) should be demonstrated to provide at least one of the following:

             a satisfactory level of task performance;

             a satisfactory awareness of proximity to limit values like VS, VMO, and VFE; and

             a satisfactory means to avoid violating such limits.

5.4.2.3 Go-around and missed approach

If a different display format is used for go-around than that used for the approach, the format transition should occur automatically as a result of the normal go-around or missed approach procedure.

5.4.2.4 Minimise format changes

Changes in the display format and primary flight data arrangement should be minimised to prevent confusion and to enhance the flight crew’s ability to interpret vital data.

5.4.3 Aircraft control considerations

For those phases of flight where airworthiness approval is predicated on the use of the HUD, or when it can be reasonably expected that the flight crew will operate primarily by reference to the HUD, the HUD should adequately provide the following information and cues.

5.4.3.1 Flight state and position

The HUD should provide information to permit the pilot to instantly evaluate the aeroplane’s flight state and position. This information should be adequate for manually controlling the aeroplane and for monitoring the performance of the automatic flight control system. Using the HUD for manual control of the aeroplane and for monitoring the automatic flight control system should not require exceptional pilot skill, excessive workload, or excessive reference to other flight displays.

5.4.3.2 Attitude cues

Attitude cues should enable the pilot to instantly recognise unusual attitudes. Attitude cues should not hinder unusual attitude recovery. If the HUD is designed to provide guidance or information for recovery from upsets or unusual attitudes, recovery steering guidance commands should be distinct from, and not confused with, orientation symbology such as horizon pointers. This capability should be shown for all foreseeable modes of upset, including crew mishandling, autopilot failure (including ‘slow-overs’), and turbulence/gust encounters.

5.4.4 Airspeed considerations

5.4.4.1 Airspeed scale range

As with other electronic flight displays, the HUD airspeed indications may not typically show the entire range of airspeed. CS 25.1541(a)(2) states that ‘The aeroplane must contain- Any additional information, instrument markings, and placards required for the safe operation if there are unusual design, operating, or handling characteristics.’.

5.4.4.2 Low- and high-speed awareness cues

Low-speed awareness cues on the HUD should provide adequate visual cues to the pilot that the airspeed is below the reference operating speed for the aeroplane configuration (e.g. weight, flap setting, and landing gear position). Similarly, high-speed awareness cues should provide adequate visual cues to the pilot that the airspeed is approaching an established upper limit that may result in a hazardous operating condition.

5.4.4.3 Format of low- and high-speed awareness cues

The low- and high-speed awareness cues should be readily distinguishable from other markings such as V-speeds and speed targets (e.g. bugs). The cues should indicate the boundary value of speed limit, and they should also clearly distinguish between the normal speed range and the unsafe speed range beyond those limiting values. Cross-hatching or other similar coding techniques may be acceptable to delineate zones of different meaning.

5.4.5 Flight path considerations

5.4.5.1 General

The type of flight path information displayed (e.g. earth-referenced or air mass) may be dependent on the operational characteristics of a particular aeroplane and the phase of flight during which the flight path is to be displayed.

5.4.5.2 Velocity/flight path vector

An indication of the aeroplane’s velocity vector, or flight path vector, is considered essential to most HUD applications. Earth-referenced flight path display information provides an instantaneous indication of where the aeroplane is actually going. During an approach, this information can be used to indicate the aeroplane’s impact or touchdown point on the runway. The earth-referenced flight path shows the effects of wind on the motion of the aeroplane. The flight path vector can be used by the pilot to set a precise climb or dive angle relative to the conformal outside scene or relative to the HUD’s flight path (pitch) reference scale and horizon displays. In the lateral axis, the flight path symbols should indicate the aeroplane’s track relative to the bore sight.

5.4.5.3 Air-mass-derived flight path

Air-mass-derived flight path may be displayed as an alternative, but it does not show the effects of wind on the motion of the aeroplane. In this case, the lateral orientation of the flight path display represents the aeroplane’s sideslip, while the vertical position relative to the reference symbol represents the aeroplane’s angle of attack.

5.4.6 Attitude considerations

5.4.6.1 General

For all unusual attitude situations and command guidance display configurations, the displayed attitude information should enable the pilot to make accurate, easy, quick glance interpretation of the attitude situation.

5.4.6.2 Pitch

The pitch attitude display should be such that, during all manoeuvres, a horizon reference remains visible with enough margin to allow the pilot to recognise pitch and roll orientation. For HUDs that are capable of displaying the horizon conformally, the display of a non-conformal horizon reference should appear distinctly different than the display of a conformal horizon reference.

5.4.6.3 Display of unusual attitude conditions

Extreme attitude symbology and automatically decluttering the HUD at extreme attitudes has been found acceptable (i.e. extreme attitude symbology should not be visible during normal manoeuvring).

5.4.6.4 Unusual attitude recovery

When the HUD is not designed to be used for recovery from unusual attitude, the applicant should provide a satisfactory demonstration of the following.

5.4.6.4.1 Compensating features (e.g. characteristics of the aeroplane and the HUD system).

5.4.6.4.2 Immediate annunciation on the HUD to direct the pilot to use the head-down primary flight display for recovery.

5.4.6.4.3 Satisfactory demonstration of timely recognition and correct recovery manoeuvres.

5.4.6.5 Flight crew awareness of HUD modes

The same information concerning current HUD system mode, reference data, status state transitions, and alert information that is displayed to the pilot using the HUD should also be displayed to the other pilot. The display of this information for the other pilot should use consistent nomenclature to ensure unmistakable awareness of the HUD operation.

6.0 Dual HUDs

6.1 Operational concept for dual HUDs

The applicant should define the operational concept using dual HUDs. The operational concept should detail the tasks and responsibilities of both PF and Pilot Not Flying (PNF) with regard to using and monitoring HDDs and HUDs during all phases of flight. It should specifically address the simultaneous use of the HUD by both pilots during each phase of flight, as well as cross-flight-deck transfer of control.

6.2 Flight crew awareness of other instruments and indications

With single-HUD installations, the PF likely uses the HUD as a primary flight reference and the PNF monitors the head-down instruments and alerting systems for failures of systems, modes, and functions that are not displayed on the primary flight displays or on the HUD. However, in the case where both flight crew members simultaneously use HUDs, they should be able to maintain an equivalent level of awareness of key information that is not displayed on the HUD (e.g. powerplant indications, alerting messages, and aircraft configuration indications).

6.3 Roles and responsibilities

The applicant should define the operational concept to account for the expected roles and responsibilities of the PF and the PNF. The concept should also take into account the following considerations.

6.3.1 Impact on head-down vigilance

When both pilots of the flight crew use an HUD as the primary flight display, the visual head-down indications may not receive the same level of vigilance (as compared to a pilot using the head-down primary flight display).

6.3.2 Assurance of head-down scan

The applicant should explain how the scan of the head-down instruments is ensured during all phases of flight and, if not, what compensating design features help the flight crew maintain awareness of key information that is only displayed on the HDDs (e.g. powerplant indications, alerting messages, and aircraft configuration indication). The applicant should describe which pilot scans the head-down instrument indications and how often. For any case in which at least one pilot is not scanning the head-down instruments full-time, the design should have compensating design features that ensure an equivalent level of timeliness and awareness of the information provided by the head-down visual indications.

6.3.3 Alerts

The design should effectively compensate for any cautions and warnings that do not have visual indications on the HUD that are equivalent to the head-down primary flight display. The purpose of the compensating design features is to make the pilot using the HUD aware of the alerts so there are no additional delays in awareness and response time. The flight crew should be able to respond to alerts without any reduction in task performance or degraded safety.

6.4 Reassessment

The applicant should globally reassess the alerting functions to ensure that the flight crew is aware of alerts and responds to them in a timely manner. The reassessment should review the design and techniques, the alerting attention-getting properties (e.g. visual master warning, master caution, and aural alerts), and other alerts in the flight deck. The flight crew’s awareness of alerts might differ between single- and dual-HUD installations. With a dual-HUD installation, there may be periods when neither pilot is scanning the instrument panel. With a single-HUD configuration, the PNF refers only to the head-down instrument panel and may have responsibility for monitoring indications on that panel. With dual-HUD configurations, both pilots’ attention may be turned to their HUDs, and they might miss an alert that would otherwise be plainly visible to a pilot not using an HUD.

7.0 Flight data recording

Flight data recorders must record the minimum data parameters required by the applicable operational regulations. In addition, flight data recorders should also record other parameters regarding unique operating characteristics of HUDs in compliance with CS 25.1459(e). For example, they may include information such as the mode in which the HUD was operating, the status (e.g. in use or inoperative), and if the display declutter mode was operating.

8.0 Continued airworthiness

CS 25.1309, CS 25.1529 and Appendix H to CS-25 require instructions for the continued airworthiness of a display system and its components. The content of the instructions depends on the type of operation and the intended function of the HUD.

[Amdt 25/17]

Appendix 7 – Weather Displays

ED Decision 2015/019/R

1. Introduction

1.1 Purpose

This Appendix provides additional guidance for displaying weather information in the flight deck. Weather displays provide flight crew with additional tools to help make decisions based on weather information.

1.2 Examples

Sources of weather information may include but are not limited to on-board weather sensors, data-linked weather information, and pilot/air traffic reports. The information from these sources can be displayed in a variety of graphical or text formats. Because many sources of weather information exist, it is important that the applicant identify the source of the information, assess its intended function, and apply the guidance contained within this AMC.

2.0 Key characteristics

In addition to the general guidelines provided in the body of this AMC, the following guidelines should be considered when establishing the intended functions of weather displays.

2.1 Unambiguous meanings

The meaning of the presentations (e.g. display format, colours, labels, data formats, and interaction with other display parameters) should be clear and unambiguous. The flight crew should not misunderstand or misinterpret the weather information.

2.2 Colour

2.2.1 The use of colour should be appropriate to its task and use.

2.2.2 The use of colour must not adversely affect or degrade the attention-getting qualities of the information as required by CS 25.1322(f).

2.2.3 Colour conventions should be followed (such as the conventions established in ARINC 708A-3, Airborne Weather Radar with Forward Looking Windshield Detection Capability, and the FAA AC 20-149A, Installation Guidance for Domestic Flight Information Services-Broadcast).

2.2.4 The use of red and yellow must be in compliance with CS 25.1322(e) for flight crew alerts, or with CS 25.1322(f) for information other than flight crew alerts. Compliance can be demonstrated by using the guidance in AMC 25.1322, Flight Crew Alerting, and this AMC.

Note 1: The FAA AC 20-149A indicates an exclusion to the acceptability of RTCA/DO-267A, Minimum Aviation System Performance Standards (MASPS) for Flight Information Services-Broadcast (FIS-B) Data Link, Sections 2.0 and 3.0, for Part 25/CS-25 aeroplanes.

Note 2: Refer to paragraph 31.c(5) in Chapter 5 of this AMC for information on guidelines on colour progression.

2.3 Multiple sources of weather information

2.3.1 The weather display should enable the flight crew to quickly, accurately, and consistently differentiate among sources of the displayed weather information. Time-critical information should be immediately distinguishable from dated, non-time-critical information.

2.3.2 If more than one source of weather information is available, the source of the weather information should be indicated on the selector and the resulting display.

2.3.3 When simultaneously displaying information from multiple weather sources (e.g. weather radar and data link weather), the display should clearly and unambiguously indicate the source of that information. In other words, the flight crew should know the source of the symbol and whether it is coming from data-linked weather or real-time weather sources. These guidelines also apply to symbols (e.g. winds aloft and lightning) that have the same meaning but originate from different weather information sources.

2.3.4 If weather information is overlaid on an existing display, it should be easily distinguished from the existing display. It also should be consistent with the information it overlays in terms of position, orientation, range, and altitude.

2.3.5 When fusing or overlaying multiple weather sources, the resulting combined image should convey its intended meaning and meet its intended function, regardless of any differences in the sources in terms of image quality, projection, data update rates, data latency, or sensor alignment algorithms, for example.

2.3.6 If weather information is displayed on an HUD, the guidance of this AMC including its Appendix 6 should be followed.

2.3.7 When the source of the weather information source is not the on-board sensors, some means to identify its relevance (e.g. a time stamp or the age of the product) should be provided. Presenting the product age is particularly important when combining information from multiple weather products. In addition, the effective time of forecast weather should also be provided.

2.3.8 If a weather-looping (animation) display feature is provided, the system should provide the means to readily identify the total elapsed time of the image compilation so that the flight crew does not misinterpret the movement of the weather cells. 

2.3.9 For products that have the ability to present weather for varying altitudes (e.g. potential or reported icing, radar, and lightning strikes), information should be presented that allows the flight crew to distinguish or identify which altitude range applies to each feature.

2.3.10  Weather information may include a number of graphical and text information  features or sets of information (e.g. text and graphical Aviation Routine Weather Reports (METARs) and winds aloft). The display should provide a means to identify the meaning of each feature to ensure that the information is correctly used.

2.3.11  If the flight crew or system has the ability to turn a weather information source on or off, the flight crew should be able to easily determine if the source is on or off.

2.3.12  When weather information is presented on a vertical situation display, the lateral width of the weather swath (like that of the terrain swath) should be carefully considered to ensure that weather information that is relevant to the current phase of flight or flight path is displayed. An unsuitable lateral swath width could either mislead the flight crew to abort an operation for weather that poses no hazard, or fail to abort an operation when the weather does pose a hazard. If swath dimensions are automatically controlled, then careful consideration should be given to include only the area that would be relevant to the operation. Means may be provided for the flight crew to select the swath widths that they consider suitable for the phase of flight and prevailing weather conditions. The lateral width of the weather swath (like that of the terrain swath) should be made readily apparent to the flight crew (e.g. use the same swath as is used for the terrain, or display its boundaries on the plan view weather display). Generally, if the vertical situation displays terrain and weather at the same time, the choice of flight-path-centred or track/heading-centred swath should be consistent. If the weather overlay is designed to show a smaller vertical swath than is represented by the altitude scale, then the boundaries of this swath should be clearly depicted on the display.

2.3.12.1 Weather information displayed on a vertical situation display should be accurately depicted with respect to the scale factors of the display (i.e. vertical and horizontal).

2.3.12.2 Consideration should be given to making the width of the information on the weather display consistent with the width used by other systems, including the Terrain Awareness and Warning System (TAWS), if displayed. This should not be interpreted as a restriction precluding other means of presentation that can be demonstrated to be superior.

3.0 On-board weather radar information

3.1 Background

On-board weather radar provides forward-looking weather detection, including in some cases windshear and turbulence detection.

3.2 Minimum performance standards 

The display of on-board weather radar information should be in accordance with the applicable portions of RTCA/DO-220, Minimum Operational Performance Standards for Airborne Weather Radar with Forward-Looking Windshear Capability. TSO-C63d allows exceptions to the minimum performance standards of RTCA/DO-220 for Class A and B radar equipment.

3.3 Hazard detection 

The weather display echoes from precipitation and ground returns should be clear, automatic, timely, concise, and distinct so that the flight crew can easily interpret, analyse, and avoid hazards. The radar range, elevation, and azimuth indications should provide sufficient information for flight crews to safely avoid the hazard.

4.0 Predictive windshear information

4.1 General 

If provided, windshear information should be clear, automatic, timely, concise, and distinct so that the flight crew can easily interpret, detect, and minimise the threat of windshear activity.

4.2 Presentation methods 

When a windshear threat is detected, the corresponding display may be automatically presented or selected by the flight crew at an appropriate range to identify the windshear activity and minimise the windshear threat to the aeroplane.

4.3 Pilot workload

Pilot workload necessary for the presentation of windshear information should be minimised. When the flight deck is configured for normal operating procedures, it should not take more than one action to display the windshear information.

4.4 Windshear threat symbol

The size and location of the windshear threat symbol should allow the flight crew to recognise the dimension of the windshear and its position. The symbol should be presented in accordance with RTCA/DO-220.

4.5 Relative position to the aeroplane

The relative position and azimuth of the windshear threat with respect to the nose of the aeroplane should be displayed in an unambiguous manner.

4.6 Range

The range selected by the flight crew for the windshear display should allow the flight crew to distinguish the windshear event from other information. Amber radial lines may be used to extend from the left and right radial boundaries of the icon extending to the upper edge of the display.

5.0 Safety aspects

5.1 Functional Hazard Assessment (FHA)

Both the loss of weather information and the display of misleading weather information should be addressed in the FHA. In particular, the FHA should address failures of the display system that could result in the loss of the display and failures that could result in the presentation of misleading weather information.

5.2 Misleading information

The FHA should address the effects of displaying misleading information. In accordance with Chapter 4 of this AMC, the display of misleading weather radar includes information that would lead the flight crew to make a bad decision or introduce a potential hazard. Examples include but are not limited to storm cells displayed in the incorrect position, at the wrong intensity, or misregistered in the case of a combined (e.g. fused) image.

[Amdt 25/17]

AMC 25-13 Reduced and derated take-off thrust (power) procedures

ED Decision 2021/015/R

1 Purpose

This acceptable means of compliance (AMC) provides guidance for the certification and use of reduced thrust (power) for take-off and derated take-off thrust (power) on turbine powered transport category aeroplanes. It consolidates CS guidance concerning this subject and serves as a ready reference for those involved with aeroplane certification and operation. These procedures should be considered during aeroplane type certification and supplemental type certification activities when less than engine rated take-off thrust (power) is used for take-off.

2 Related Certification Specifications (CS)

The applicable regulations are CS 25.101, 25.1521 and 25.1581.

3 Background

Take-off operations conducted at thrust (power) settings less than the maximum take-off thrust (power) available may provide substantial benefits in terms of engine reliability, maintenance, and operating costs. These take-off operations generally fall into two categories; those with a specific derated thrust (power) level, and those using the reduced thrust (power) concept, which provides a lower thrust (power) level that may vary for different take-off operations. Both methods can be approved for use, provided certain limitations are observed. The subjects discussed herein do not pertain to in-flight thrust cutback procedures that may be employed for noise abatement purposes.

4 Definitions

Customarily, the terms ‘thrust’ and ‘power’ are used, respectively, in reference to turbojet and turboprop installations. For simplicity, only the term ‘thrust’ is used throughout this AMC. For turboprop installations, the term ‘power’ should be substituted. For purposes of this AMC the following definitions apply:

a. Take-off Thrust

(1) Rated take-off thrust, for a turbojet engine, is the approved engine thrust, within the operating limits, including associated time limits, established by the engine type certificate for use during take-off operations.

(2) Take-off thrust, for an aeroplane, is normally the engine rated take-off thrust, corrected for any installation losses and effects that is established for the aeroplane under CS-25. Some aeroplanes use a take-off thrust setting that is defined at a level that is less than that based on the engine rated take-off thrust. CS 25.1521 requires that the take-off thrust rating established for the aeroplane must not exceed the take-off thrust rating limits established for the engine under the engine type certificate. The value of the take-off thrust setting parameter is presented in the Aeroplane Flight Manual (AFM) and is considered a normal take-off operating limit.

b. Derated take-off thrust, for an aeroplane, is a take-off thrust less than the maximum take-off thrust, for which exists in the AFM a set of separate and independent, or clearly distinguishable, take-off limitations and performance data that complies with all the take-off requirements of CS-25. When operating with a derated take-off thrust, the value of the thrust setting parameter, which establishes thrust for take-off, is presented in the AFM and is considered a normal take-off operating limit.

c. Reduced take-off thrust, for an aeroplane, is a take-off thrust less than the take-off (or derated take-off) thrust. The aeroplane take-off performance and thrust setting are established by approved simple methods, such as adjustments, or by corrections to the take-off or derated take-off thrust setting and performance. When operating with a reduced take-off thrust, the thrust setting parameter, which establishes thrust for take-off, is not considered a take-off operating limit.

d. A ‘wet runway’ is one whose surface is covered by any visible dampness or water up to, and including, 3 mm deep within the intended area of use.

e. A ‘contaminated runway’ is a runway where a significant portion of the runway surface area (whether in isolated areas or not) within the length and width being used is covered by one or more of the following substances:

             compacted snow,

             dry snow more than 3 mm deep,

             heavy frost,

             ice,

             slush more than 3 mm deep,

             standing water more than 3 mm deep, and

             wet snow more than 3 mm deep.

For the definitions of the contaminants, refer to Section 4 of AMC 25.1591.

f. A ‘slippery wet runway’ is a wet runway where the surface friction characteristics on a significant portion of the runway have been determined to be degraded.

5 Reduced Thrust: (Acceptable Means of Compliance)

Under CS 25.101(c), 25.101(f), and 25.101(h), it is acceptable to establish and use a take-off thrust setting that is less than the take-off or derated take-off thrust if –

a. The reduced take-off thrust setting –

(1) Does not result in loss of systems or functions that are normally operative for take-off such as automatic spoilers, engine failure warning, configuration warning, systems dependent on engine bleed air, or any other required safety related system.

(2) Is based on an approved take-off thrust rating or derating for which complete aeroplane performance data is provided.

(3) Enables compliance with the applicable engine operating and aeroplane controllability requirements in the event that take-off thrust, or derated take-off thrust (if such is the performance basis), is applied at any point in the take-off path.

(4) Is at least 60% of the maximum take-off thrust (no derate) for the existing ambient conditions, with no further reduction below 60% resulting from Automatic Take-off Thrust Control System (ATTCS) credit. Consequently the amount of reduced thrust permitted is reduced when combined with the use of derated thrust so that the overall thrust reduction remains at least 60 % of the maximum take-off thrust. For reduced thrust operations, compliance with the applicable performance and handling requirements should be demonstrated as thoroughly as for an approved take-off rating.

(5) For turboprop installations, is predicated on an appropriate analysis of propeller efficiency variation at all applicable conditions and is limited to at least 75% take-off thrust.

(6) Enables compliance with CS-25 Appendix I in the event of an engine failure during take-off, for aeroplanes equipped with an ATTCS.

b. Relevant speeds (VEF, VMC, VR, and V2) used for reduced thrust take-offs are not less than those which will comply with the required airworthiness controllability criteria when using the take-off thrust (or derated take-off thrust, if such is the performance basis) for the ambient conditions, including the effects of an ATTCS. It should be noted, as stated in paragraph c. below, that in determining the take-off weight limits, credit can be given for an operable ATTCS.

c. The aeroplane complies with all applicable performance requirements, including the criteria in paragraphs a. and b. above, within the range of approved take-off weights, with the operating engines at the thrust available for the reduced thrust setting selected for take-off. However, the thrust settings used to show compliance with the take-off flight path requirements of CS 25.115 and the final take-off climb performance requirements of CS 25.121(c) should not be greater than that established by the initial thrust setting. In determining the take-off weight limits, credit can be given for an operable ATTCS.

d. Appropriate limitations, procedures, and performance information are established and are included in the AFM. The reduced thrust procedures must ensure that there is no significant increase in cockpit workload, and no significant change to take-off procedures.

e. A periodic take-off demonstration is conducted using the aeroplane’s take-off thrust setting without ATTCS, if fitted, and the event is logged in the aeroplane’s permanent records. An approved engine maintenance procedure or an approved engine condition-monitoring programme may be used to extend the time interval between take-off demonstrations.

f. The AFM states, as a limitation, that take-offs utilising reduced take-off thrust settings:

(1) Are not authorised on runways contaminated with standing water, snow, slush, or ice, and are not authorised on wet runways, including slippery wet runways, unless suitable performance accountability is made for the increased stopping distance on the wet surface.

(2) Are not authorised where items affecting performance cause significant increase in crew workload.

Examples of these are –

Inoperative Equipment: Inoperative engine gauges, reversers, anti-skid systems or engine systems resulting in the need for additional performance corrections.

Engine Intermix: Mixed engine configurations resulting in an increase in the normal number of power setting values.

Non-standard operations: Any situation requiring a non-standard take-off technique.

(3) Are not authorised unless the operator establishes a means to verify the availability of take-off or derated take-off thrust to ensure that engine deterioration does not exceed authorised limits.

(4) Are authorised for aeroplanes equipped with an ATTCS, whether operating or not.

g. The AFM states that –

(1) Application of reduced take-off thrust in service is always at the discretion of the pilot.

(2) When conducting a take-off using reduced take-off thrust, take-off thrust or derated take-off thrust if such is the performance basis may be selected at any time during the take-off operation.

h. Procedures for reliably determining and applying the value of the reduced take-off thrust setting and determining the associated required aeroplane performance are simple (such as the assumed temperature method). Additionally, the pilot is provided with information to enable him to obtain both the reduced take-off thrust and take-off thrust, or derated take-off thrust if such is the performance basis, for each ambient condition.

i. Training procedures are developed by the operator for the use of reduced take-off thrust.

6 Derated Thrust (Acceptable Means Of Compliance)

For approval of derated take-off thrust provisions, the limitations, procedures, and other information prescribed by CS 25.1581, as applicable for approval of a change in thrust, should be included as a separate Appendix in the AFM. The AFM limitations section should indicate that when operating with derated thrust, the thrust setting parameter should be considered a take-off operating limit. However, in-flight take-off thrust (based on the maximum take-off thrust specified in the basic AFM) may be used in showing compliance with the landing and approach climb requirements of CS 25.119 and 25.121(d), provided that the availability of take-off thrust upon demand is confirmed by using the thrust-verification checks specified in paragraph 5.e. above.

[Amdt No: 25/2]

[Amdt No: 25/13]

[Amdt No: 25/27]

AMC 25-19 Certification Maintenance Requirements

ED Decision 2018/005/R

1 PURPOSE

This Acceptable Means of Compliance (AMC) provides guidance on the selection, documentation and control of Certification Maintenance Requirements (CMRs). This AMC also provides a rational basis for coordinating the CMR selection process and the Maintenance Review Board (MRB) process if the latter is used. The applicant should ensure that the maintenance tasks and intervals identified in the system safety analyses to support compliance with CS 25.1309 and other system safety requirements (such as CS 25.671, CS 25.783, CS 25.901, and CS 25.933) are protected in service. For those aeroplanes whose initial maintenance programme is developed under a different process than the MRB process, the coordination and document aspects have to be adapted to the particular case. This AMC describes an acceptable means, but not the only means, for selecting, documenting and managing CMRs. Terms such as ‘shall’ and ‘must’ are used only in the sense of ensuring applicability of this acceptable means of compliance.

2 RELATED CERTIFICATION SPECIFICATIONS

a.  CS 25.671 Control Systems — General

b.  CS 25.783 Fuselage Doors

c.  CS 25.901 Powerplant — Installation

d.  CS 25.933 Reversing systems

e.  CS 25.1309 Equipment, systems and installations

f.  CS 25.1529 Instructions for Continued Airworthiness

3 RELATED DOCUMENTS

a. Airlines for America (A4A), MSG–3, Operator/Manufacturer Scheduled Maintenance Development Document.

b.  International Maintenance Review Board/Maintenance Type Board Process Standard (IMPS)

4 NOT USED

5 CERTIFICATION MAINTENANCE REQUIREMENTS (CMR) DEFINITION

A CMR is a required scheduled maintenance task, established during the design certification of the aeroplane systems as an airworthiness limitation of the type certificate (TC) or supplemental type certificate (STC). The CMRs are a subset of the Instructions for Continued Airworthiness (ICA) identified during the certification process. A CMR usually result from a formal, numerical analysis conducted to show compliance with the requirements applicable to catastrophic and hazardous failure conditions as defined in paragraph 6e, below. A CMR may also result from a qualitative, engineering judgment-based analysis.

a. The CMRs are required tasks, and associated intervals, developed to achieve compliance with CS 25.1309 and other requirements requiring safety analyses (such as CS 25.671, 25.783, 25.901, and 25.933). A CMR is usually intended to detect latent failures that would, in combination with one or more other specific failures or events, result in a Hazardous or Catastrophic Failure Condition. A CMR can also be used to establish a required task to detect an impending wear out of an item whose failure is associated with a hazardous or catastrophic failure condition. A CMR may also be used to detect a latent failure that would, in combination with one specific failure or event, result in a major failure condition, where the SSA identifies the need for a scheduled maintenance task.

b. CMRs are derived from a fundamentally different analysis process than the maintenance tasks and intervals that result from MSG–3 analysis associated with MRB activities (if the MRB process is used). Although both types of analysis may produce equivalent maintenance tasks and intervals, it is not always appropriate to address a Candidate Certification Maintenance Requirement (CCMR) with a Maintenance Review Board Report (MRBR) task.

c. CMRs verify that a certain failure has or has not occurred, indicate that corrective maintenance or repair is necessary if the item has failed, or identify the need to inspect for impending failures (e.g. wear out or leakage). Because the exposure time to a latent failure is a key element in the calculations used in a safety analysis, limiting the exposure time will have a significant effect on the resultant overall failure probability of the system. The intervals for CMR tasks interval should be designated in terms of flight hours, cycles, or calendar time, as appropriate.

d. The type certification process assumes that the aeroplane will be maintained in a condition or airworthiness equal to its certified condition. The process described in this AMC is not intended to establish routine maintenance tasks (e.g. greasing, fluid-level checks, etc.) that should be defined through the MSG–3 analysis process. Also, this process is not intended to establish CMRs for the purpose of providing supplemental margins of safety for concerns arising late in the type design approval process. Such concerns should be resolved by appropriate means, which are unlikely to include CMRs not established via normal safety analyses.

e. CMRs should not be confused with required structural inspection programmes, that are developed by the TC applicant to meet the inspection requirements for damage tolerance, as required by CS 25.571 or CS 25.1529, and Appendix H25.4 (Airworthiness Limitations Section). CMRs are to be developed and managed separately from any structural inspection programs.

6  OTHER DEFINITIONS

The following terms apply to the system design and analysis requirements of CS 25.1309(b) and (c), and to the guidance material provided in this AMC. (for a complete definition of these terms, refer to the applicable specifications and acceptable means of compliance, (e.g. CS and AMC 25.1309)).

a. Catastrophic. Refer to AMC 25.1309.

b. Compatible MRBR task. An MRBR task whose intent addresses the CCMR task intent and whose interval is equal to or lower than the interval that would otherwise be required by a CMR.

c.  Crew. The cabin crew, or flight crew, as applicable.

d.  Failure. Refer to AMC 25.1309.

e.  Failure Condition. Refer to AMC 25.1309.

f.  Failure Effect Category 5 task (FEC5). Refer to MSG-3, Operator/Manufacturer Scheduled Maintenance Development.

g.  Failure Effect Category 8 task (FEC8). Refer to MSG-3, Operator/Manufacturer Scheduled Maintenance Development.

h.  Hazardous. Refer to AMC 25.1309.

i.  Latent Failure. Refer to AMC 25.1309.

j.  Major. Refer to AMC 25.1309.

k.  Qualitative. Refer to AMC 25.1309.

l.  Quantitative. Refer to AMC 25.1309.

m.  Significant Latent Failure. A latent failure that would, in combination with one or more other specific failures or events, result in a hazardous or catastrophic failure condition.

n.  Task. Short description (e.g. descriptive title) of what is to be accomplished by a procedure. Example: ‘Operational check of the static inverter’.

o.  Wear out. A condition where a component is worn beyond a predetermined limit.

7  SYSTEM SAFETY ASSESSMENTS (SSA)

a. CS 25.1309(b) specifies required safety levels in qualitative terms, and a safety assessment must be conducted to show compliance. Various assessment techniques have been developed to help applicants and EASA in determining that a logical and acceptable inverse relationship exists between the probability and the severity of each Failure Condition. These techniques include the use of service experience data of similar, previously approved systems, and thorough qualitative and quantitative analyses.

b. In addition, difficulties have been experienced in assessing the acceptability of some designs, especially those of systems, or parts of systems, that are complex, that have a high degree of integration, that use new technology, or that perform safety-critical functions. These difficulties led to the selective use of rational analyses to estimate quantitative probabilities, and the development of related criteria based on historical data of accidents and hazardous incidents caused or contributed to by failures. These criteria, expressed as numerical probability ranges associated with the terms used in CS 25.1309(b), became commonly accepted for evaluating the quantitative analyses that are often used in such cases to support experienced engineering and operational judgement and to supplement qualitative analyses and tests.

NOTE: See AMC 25.1309 for a complete description of the inverse relationship between the probability and severity of Failure Conditions, and the various methods of showing compliance with CS 25.1309.

8  DESIGN CONSIDERATIONS RELATED TO SIGNIFICANT LATENT FAILURES

a.  The applicant should implement practical and reliable failure monitoring and flight crew indication systems to detect failures that would otherwise be significant latent failures. A reliable failure monitoring and flight crew indication system should utilise current state-of-the-art technology to minimise the probability of falsely detecting and indicating non-existent failures. Experience and judgement should be applied when determining whether or not a failure monitoring and flight crew indication system would be practical and reliable. Comparison with similar, previously approved systems is sometimes helpful.

b.  Supplemental design considerations are provided in Appendix 1 to this AMC.

9  OVERVIEW OF THE CERTIFICATION MAINTENANCE REQUIREMENTS DEVELOPMENT PROCESS

a. Figure 1 shows the development process of CMRs. The details of the process to be followed in defining, documenting, and handling CMRs are given in paragraphs 10 through 13.

Figure 1 — CMR development process

10  IDENTIFICATION OF CANDIDATE CMRs (CCMRs)

a.  The SSA should address all significant latent failures.

b.  Credit may be taken for correct flight crew performance of the periodic checks required to demonstrate compliance with CS 25.1309(b). Unless these flight crew actions are accepted as normal airmanship, they should be included in the approved Aeroplane Flight Manual procedures. Similarly, credit may be taken from self-initiated checks (e.g. power-up built-in tests). In both cases, these significant latent failures do not need a CCMR.

c.  Tasks that are candidates for selection as CMRs come from safety analyses (e.g. SSAs), which establish whether there is a need for tasks to be carried out periodically to comply with CS 25.1309, and other requirements (such as CS 25.671, CS 25.783, CS 25.901, and CS 25.933) requiring this type of analysis. The SSA should identify as CCMRs the maintenance tasks intended to detect significant latent failures. Tasks may also be selected from those intended to inspect for impending failures due to wear out.

d.  As the safety analysis may be qualitative or quantitative, some task intervals may be derived in a qualitative manner (e.g. engineering judgment and service experience). As per AMC 25.1309, numerical analysis supplements, but does not replace, qualitative engineering and operational judgment. Therefore, other tasks that are not derived from numerical analysis of significant latent failures, but are based on properly justified engineering judgment, can also be candidates for CMRs. The justification should include the logic leading to identification of CCMRs, and the data and experience base supporting the logic.

e.  In some situations, a Catastrophic or Hazardous Failure Condition might meet the quantitative probability objective, yet it might contain one or more components that, as per the quantitative analysis, do not require a periodic maintenance task to meet that objective (i.e. could be failed latent for the life of the aeroplane). In such cases, the SSA should include a qualitative assessment to determine whether a periodic maintenance task is needed.

 Unless otherwise substantiated, a CCMR should be identified to:

             reduce exposure to a single failure or event that would cause the failure condition,

             ensure the availability of backup or emergency systems, and

             ensure the availability of equipment/systems required to be installed as per CS-25.

f.  For failure conditions involving multiple significant latent failures, the SSA should identify a CCMR for each significant latent failure unless otherwise justified (e.g. one CCMR may cover multiple significant latent failures, or the significant latent failure could exist for the life of the aeroplane without compromising compliance with the safety objectives and paragraph 10.e considerations).

g.  For each identified CCMR, the applicant should indicate:

             the failure mode to be detected,

             the failure condition of concern,

             the intended maintenance task, and

             the task interval (the allowable value coming from the SSA or other relevant analysis).

11  SELECTION OF CMRs

a.  Each CCMR should be reviewed and a determination made as to whether or not it should be a CMR.

  Criteria and guidance are provided below for CMR selection or non-selection. The applicant may seek additional input from an advisory committee, as described in Appendix 2, before proposing CMRs to EASA for final review and approval.

b.  The applicant should provide sufficient information to enable an understanding of the Failure Conditions and the failure or event combinations that result in the CCMRs. CCMRs are evaluated in the context of the Failure Conditions in which they are involved, e.g. whether the significant latent failure is part of a dual failure, a triple failure, or more.

c.  The CMR designation should be applied in the case of catastrophic dual failures where one failure is latent. The CMR designation should also be applied to tasks that address wear out of a component involved in a Catastrophic Failure Condition that results from two failures.

d.  In all other cases, the CMR designation may not be necessary if there is a compatible MRBR task to accommodate the CCMR, provided that the applicant has the means in place to ensure that the CCMRs are protected in service. Appendix 3 provides examples of acceptable means of protection. Any means should be presented to EASA for acceptance.

These means of protection should address future evolutions of the compatible MRBR task proposed by the applicant or by the operator. In this respect, these means should ensure that in service:

             the compatible MRBR task would not be changed to the extent that the CCMR task intent is adversely affected, and

             the compatible MRBR task would not be escalated beyond the interval that would otherwise be required by a CMR.

The TC applicant should adequately describe the selected means of protection in the associated technical publication in order for the operator to be aware of the process to be followed if there are modifications to any compatible MRBR tasks that are included in the operator’s aeroplane maintenance program (AMP).

e.  The rationale for the disposition of each CCMR should be presented to EASA for acceptance.

f.  Since the MSG-3 logic may not consider a Failure Condition containing three or more failures, it is possible that a CCMR might not have any identified MRBR tasks. In this case, a CMR will be required.

g.  Where the SSA identifies the need for a scheduled maintenance task, the CMR designation may also be used to detect a latent failure that would, in combination with one specified failure or event, lead to a Major Failure Condition. This CMR designation may be necessary if no adequate scheduled maintenance task has been identified in any other Instructions for Continued Airworthiness.

h.  If the SSA does not specify an interval shorter than the life of the aeroplane, an interval may be established by considering the factors that influence the outcome of the Failure Condition, such as the nature of the fault, the system(s) affected, field experience, or task characteristics.

12 DOCUMENTATION AND HANDLING OF CMRs

a.  CMRs are considered functionally equal to airworthiness limitations, therefore they should be included in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness.

b.  The CMR data location should be referenced in the type certificate data sheet (TCDS). The latest version of the applicant’s CMR documentation should be controlled by a log of pages approved by EASA. In this way, changes to CMRs following certification will not require an amendment to the TCDS.

c. Since CMRs are based on statistical averages and reliability rates, an ‘exceptional short-term extension’ for CMR intervals may be made on one aeroplane for a specific period of time without jeopardising safety. Any exceptional short-term extensions to CMR intervals must be defined and fully explained in the applicant’s CMR documentation. The competent authority must concur with any exceptional short-term extension allowed by the applicant’s CMR documentation before it takes place, using procedures established with the competent authority in the operators’ manuals. The exceptional short-term extension process is applicable to CMR intervals. It should not be confused with the operator’s ‘short-term escalation’ program for normal maintenance tasks described in the operators’ manuals.

(1) The term ‘exceptional short-term extension’ is defined as an increase in a CMR interval that may be needed to cover an uncontrollable or unexpected situation. Any allowable increase must be defined either as a percent of the normal interval, or a stated number of flight hours, flight cycles, or calendar days. If no exceptional short-term extension is to be allowed for a given CMR, this restriction should be stated in the applicant’s CMR documentation.

(2) Repeated use of exceptional short-term extensions, either on the same aeroplane or on similar aeroplanes in an operator’s fleet, should not be used as a substitute for good management practices. Exceptional short-term extensions must not be used for the systematic escalation of CMR intervals.

(3) The applicant’s CMR documentation should state that the competent authority must approve, prior to its use, any desired exceptional short-term extension not explicitly listed in the CMR document.

13  POST-CERTIFICATION CHANGES TO CMRs (New, revised or deleted)

a. The introduction of a new CMR or any change to an existing CMR should be reviewed by the same entities that were involved in the process of CCMR/CMR determination (refer to paragraphs 10 and 11 of this AMC) at the time of initial certification. To allow operators to manage their own maintenance programs, it is important that they be afforded the same opportunity for participation that they were afforded during the initial certification of the aeroplane.

b. Any post-certification changes to CMRs must be approved by EASA which approved the type design.

c. Since the purpose of a CMR is to limit the time of exposure to a given significant latent failure, or a given wear out, as part of an engineering analysis of the overall system safety, instances of a CMR task repeatedly finding that no failure has occurred may not be sufficient justification for deleting the task or increasing the time between repetitive performances of the CMR task. In general, a CMR task change or interval escalation should only be made if experience with the aeroplane fleet in service worldwide indicates that certain assumptions regarding component failure rates made early during the engineering analysis were too conservative, and a re-calculation of the system’s reliability with revised failure rates of certain components reveals that the task or interval may be changed.

d. If later data provides a sufficient basis for the relaxation of a CMR (less restrictive actions to be performed), the change may be documented by a revision to the applicant’s CMR documentation and approved by EASA.

e. To address an unsafe condition, EASA may determine that the requirements of an existing CMR must be modified (more restrictive actions to be required) or a new CMR must be created. These modified requirements will be mandated by an Airworthiness Directive (AD) and the applicant’s CMR documentation will be revised to include the change.

f. New CMRs that are unrelated to in-service occurrences may be created and they should be documented and approved by EASA. New CMRs can arise in situations such as:

(1)  the certification of design changes, or

(2)  updates of the applicant’s certification compliance documentation. These may result from regulatory changes, actions required by an AD on similar systems or aeroplanes, awareness of additional Hazardous or Catastrophic Failure Conditions, revised failure rates, consideration of extended service goals, etc.

APPENDIX 1 SUPPLEMENTAL GUIDANCE FOR THE USE OF CMRs

1.  The TC/STC applicant should choose a system design that minimises the number of significant latent failures, with the ultimate goal that no such failures should exist, if this is practical. A practical and reliable failure monitoring and flight crew indication system should be considered as the first means to detect a significant latent failure. If the cost of adding practical and reliable failure monitoring and flight crew indication system is high, and the added maintenance cost of a CMR is low, the addition of a CMR may be the solution of choice for both the type certificate applicant and the operator, provided all applicable regulations are met. Substituting a CMR with an MRBR task does not necessarily reduce maintenance costs.

2. The decision to create a CMR may include a trade-off of the cost, weight, or complexity of providing mechanism or device that will expose the latent failure, versus the requirement for the operator to conduct a maintenance or inspection task at fixed intervals.

3. The following points should be considered in any decision to create a CMR in lieu of a design change.

a. What is the magnitude of the changes to the system and/or aeroplane needed to add a reliable failure monitoring and flight crew indication system that would expose the latent failure? What is the cost in added system complexity?

b. Is it possible to introduce a self-test on power-up?

c. Is the monitoring and flight crew indication system reliable? False warnings must be considered, as well as a lack of warnings.

d. Does the failure monitoring or flight crew indication system itself need a CMR due to its latent failure potential?

e. Is the CMR task reasonable, considering all aspects of the failure condition that the task is intended to address?

f. How long (or short) is the CMR task interval?

g. Is the proposed CMR task labour intensive or time consuming? Can it be done without having to ‘gain access’ and/or without workstands? Without test equipment? Can the CMR task be done without removing equipment from the aeroplane? Without having to re-adjust equipment? Without leak checks and/or engine runs?

h. Can a simple visual inspection be used instead of a complex one? Can a simple operational check suffice in lieu of a formal functional check against measured requirements?

i. Is there ‘added value’ to the proposed task (i.e. will the proposed task do more harm than good if the aeroplane must be continually inspected)?

j. Have all alternatives been evaluated?

APPENDIX 2 ROLE OF THE CERTIFICATION MAINTENANCE COORDINATION COMMITTEE (CMCC)

1.  The CMCC functions as an advisory committee for the applicant and proposes the disposition of each presented CCMR. EASA is the authority that ultimately approves CMRs as airworthiness limitations of the type certificate as per Part-21.

2. In order to grant aeroplane operators the opportunity to participate in the selection of CMRs, and to assess the CCMRs and the proposed MRBR tasks and intervals in an integrated process, the applicant should convene a CMCC as early as possible in the design phase of the aeroplane program, and at intervals as necessary. This CMCC should comprise TC/STC holder representatives (typically maintenance, design, and safety engineering personnel), operator representatives designated by the Industry Steering Committee (ISC) chairperson, EASA certification specialist(s), and the MRB chairperson(s). EASA certification specialist participation in the CMCC is necessary to provide regulatory guidance on the disposition of CCMRs.

3.  The CMCC should review CCMRs and their purposes, the Failure Conditions and their classifications, the intended tasks and their intervals, and other relevant factors. In addition, where multiple tasks result from a quantitative analysis, it may be possible to extend a given interval at the expense of one or more other intervals, in order to optimise the required maintenance activity. However, once a decision is made to create a CMR, then the CMR interval should be based solely on the results of the SSA or other relevant analysis. If the SSA does not specify an interval shorter than the life of the aeroplane, then the CMR interval may be proposed by the CMCC considering factors that influence the outcome of the failure condition, such as the failure mode(s) to be detected, the system(s) affected, field experience, or task characteristics.

4.  The CMCC should address all CCMRs. Alternatively, the applicant may coordinate with EASA to define a subset of CCMRs to be presented to the CMCC.

5.  The CMCC discusses compatible tasks (if any) that the MRB generates. The CMCC may select an MRBR task in lieu of a CMR in accordance with paragraph 11 of this AMC.

6.  The CMCC may request the ISC to review selected CMCC results (e.g. proposed revised MRBR tasks and/or intervals). Upon ISC review, the proposed revised MRBR tasks and/or intervals accepted by the ISC are reflected in the MRBR proposal, and the proposed revised MRBR tasks and/or intervals rejected by the ISC result in CMRs. Following consideration by the ISC, the applicant submits the CMRs to EASA for final review and approval.

APPENDIX 3 MEANS OF PROTECTION PROPOSED BY THE DESIGN APPROVAL HOLDER (DAH) AGAINST FUTURE EVOLUTIONS OF THE COMPATIBLE MRBR TASKS AND DERIVED TASKS OF THE OPERATOR’S AEROPLANE MAINTENANCE PROGRAM — EXAMPLES

1.  With reference to paragraph 11.c of this AMC, this Appendix provides examples to facilitate the implementation of the means to ensure that the CCMRs are protected in service.

2.  These examples describe acceptable means, but not the only means. Any means should be presented to EASA for acceptance.

EXAMPLE 1 — Traceability of CCMRs and MRBR tasks in the Airworthiness Limitations Section

a.  The CMR designation may not be necessary if there is a compatible MRBR task to accommodate the CCMR, provided that the design approval holder (DAH) shows direct traceability between the MRBR task and the accommodated CCMR in the airworthiness limitations section (ALS).

b.  The compatible MRBR task and its interval are not airworthiness limitations. The status of the compatible MRBR task with regard to the MRB process remains unchanged.

c.  Traceability between the CCMR and the compatible MRBR task should be provided in the ALS of the instructions for continued airworthiness to ensure that the CCMR is respected during in-service operation of the aeroplane and any future evolution of the maintenance program.

Table 1 illustrates one possible means for traceability.

CCMR task reference

CCMR interval

Compatible MRBR task reference

CCMR task #NN

60 months

MRBR task #XX

CCMR task #MM

10 000 flight hours

MRBR task #YY

Appendix 3 — Table 1

d.   If the DAH changes the compatible MRBR task to the extent that the intent of the corresponding CCMR task is adversely affected, this corresponding CCMR task is no longer accommodated. Therefore, the DAH could either propose a new compatible MRBR task, if one exists, or create a new CMR in line with the intent of the previously referenced CCMR limitation. These changes to the ALS require EASA approval.

e.  If the DAH escalates the interval of the compatible MRBR task beyond the corresponding CCMR limitation, this corresponding CCMR is no longer accommodated and the DAH needs to create a CMR in order to satisfy the corresponding CCMR limitation. Alternatively, the DAH could assess the feasibility of escalating the interval of the corresponding CCMR by re‑evaluating the system safety assumptions that lead to the CCMR at the time of initial certification. These changes to the ALS require EASA approval.

f.  Furthermore, the DAH shall describe in the ALS what the operator needs to observe when changing the operator’s aeroplane maintenance program (AMP). For tasks included in an AMP, which are based on compatible MRBR tasks, the following applies:

i. Should the operator propose to change the intent of a task, the operator should ask for the DAH’s confirmation that this change does not adversely affect the intent of the corresponding CCMR task. If the corresponding CCMR task is no longer accommodated, the operator needs to propose to include a mandatory task in the AMP in order to satisfy the intent of the referenced CCMR limitation. These changes to the AMP require the approval of the competent authority responsible for the oversight of the operator.

ii.  If the operator proposes to escalate the interval of a task, the corresponding CCMR limitation must not be exceeded.

EXAMPLE 2 — Uniquely identifying the compatible MRBR tasks

a.  The CMR designation may not be necessary if there is a compatible MRBR task to accommodate the CCMR, provided that the DAH uniquely identified each compatible MRBR task in the existing MRBR task listing. Table 2 illustrates one possible means for marking.

MRBR task reference

MRBR task description

Failure effect category (FEC)

Interval

Tracking

MRBR task #XX

Functional check of […]

FEC 8

60 months

 

MRBR task #YY

Detailed inspection of […]

-

72 months

EWIS

MRBR task #ZZ

Operational check of […]

FEC 8

10 000 flight hours

CCMR

Appendix 3 — Table 2

b.  The purpose of the marking and the policies to be observed for appropriate change control of the marked MRBR tasks should be stated in the MRB report.

c.  The status of the compatible MRBR task with regard to the MRB process remains unchanged.

d.  If the DAH changes the marked MRBR task to the extent that the intent of the corresponding CCMR task is adversely affected, the DAH needs to create a CMR to satisfy the intent of the initial CCMR task. This change to the ALS requires EASA approval.

e.  For future escalations of MRBR tasks, the DAH should have procedures in place to ensure that these escalations do not increase the interval of the marked MRBR task beyond the corresponding CCMR interval.

f.  However, should the DAH escalate the marked MRBR task beyond the CCMR interval, the DAH needs to create a CMR in order to satisfy the corresponding CCMR. This change to the ALS requires EASA approval. Alternatively, the DAH could assess the feasibility of escalation of the interval of the corresponding CCMR by re-evaluating the system safety assumptions that lead to the CCMR at the time of initial certification. This change to the CCMR interval requires EASA involvement in accordance with the process described in paragraph 11 of this AMC.

g.  Furthermore, the DAH shall describe in the MRBR what the operator needs to observe when changing the operator’s aeroplane maintenance program (AMP). For tasks included in the AMP, which are based on marked MRBR tasks, the following applies:

i.  If the operator proposes to change the intent of a task, the operator should ask for the DAH’s confirmation that this change does not adversely affect the intent of the corresponding CCMR task.

ii.  If the operator proposes to escalate the interval of a task, the operator should ask for the DAH’s confirmation that this escalation does not increase the interval beyond the corresponding CCMR interval. These changes to the AMP require the approval of the competent authority responsible for the oversight of the operator.

[Amdt 25/20]

[Amdt 25/21]

AMC 25-24 Sustained Engine Imbalance

ED Decision 2009/017/R

1.   PURPOSE

This AMC sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS-25 related to the aircraft design for sustained engine rotor imbalance conditions.

2.   RELATED CS PARAGRAPHS

a.   CS-25:

 CS 25.302 “Interaction of systems and structures”

 CS 25.571 “Damage tolerance and fatigue evaluation of structure”

 CS 25.629 “Aeroelastic stability requirements”

 CS 25.901 “Installation”

 CS 25.903 “Engines”

b.   CS-E:

CS-E 520 “Strength”

 CS-E 525 “Continued Rotation”

 CS-E 810 “Compressor and Turbine Blade Failure”

 CS-E 850 “Compressor, Fan and Turbine Shafts”

3. DEFINITIONS. Some new terms have been defined for the imbalance condition in order to present criteria in a precise and consistent manner. In addition, some terms are employed from other fields and may not be in general use as defined below. The following definitions apply in this AMC:

 a. Airborne Vibration Monitor (AVM). A device used for monitoring the operational engine vibration levels that are unrelated to the failure conditions considered by this AMC. 

 b. Design Service Goal (DSG). The design service goal is a period of time (in flight cycles/hours) established by the applicant at the time of design and/or certification and used in showing compliance with CS 25.571.

 c. Diversion Flight. The segment of the flight between the point where deviation from the planned route is initiated in order to land at an en route alternate airport and the point of such landing.

 d. Ground Vibration Test (GVT). Ground resonance tests of the aeroplane normally conducted in compliance with CS 25.629.

 e. Imbalance Design Fraction (IDF). The ratio of the design imbalance to the imbalance (including all collateral damage) resulting from release of  a single turbine, compressor, or fan blade at the maximum rotational speed to be approved, in accordance with CS-E 810.

 f. Low Pressure (LP) Rotor. The rotating system, which includes the low pressure turbine and compressor components and a connecting shaft. 

 g. Well Phase. The flight hours accumulated on an aeroplane or component before the failure event.

4. BACKGROUND

 a. Requirements. CS 25.901(c) requires the powerplant installation to comply with CS 25.1309. In addition, CS 25.903(c) requires means of stopping the rotation of an engine where continued rotation could jeopardise the safety of the aeroplane, and CS 25.903(d) requires that design precautions be taken to minimise the hazards to the aeroplane in the event of an engine rotor failure. CS-E 520(c)(2) requires that data shall be established and provided for the purpose of enabling each aircraft constructor to ascertain the forces that could be imposed on the aircraft structure and systems as a consequence of out-of-balance running and during any continued rotation with rotor unbalance after shutdown of the engine following the occurrence of blade failure, as demonstrated in compliance with CS-E 810, or a shaft, bearing or bearing support, if this results in higher loads.

 b. Blade Failure. The failure of a fan blade and the subsequent damage to other rotating parts of the fan and engine may induce significant structural loads and vibration throughout the airframe that may damage the nacelles, equipment necessary for continued safe flight and landing, engine mounts, and airframe primary structure. Also, the effect of flight deck vibration on displays and equipment is of significance to the crew’s ability to make critical decisions regarding the shut down of the damaged engine and their ability to carry out other operations during the remainder of the flight. The vibratory loads resulting from the failure of a fan blade have traditionally been regarded as insignificant relative to other portions of the design load spectrum for the aeroplane. However, the progression to larger fan diameters and fewer blades with larger chords has changed the significance of engine structural failures that result in an imbalanced rotating assembly. This condition is further exacerbated by the fact that fans will continue to windmill in the imbalance condition following engine shut down.

 c. Bearing/Bearing Support Failure. Service experience has shown that failures of bearings/bearing supports have also resulted in sustained high vibratory loads.

 d. Imbalance Conditions. There are two sustained imbalance conditions that may affect safe flight: the windmilling condition and a separate high power condition.

(1)   Windmilling Condition. The windmilling condition results after the engine is shut down but continues to rotate under aerodynamic forces. The windmilling imbalance condition results from bearing/bearing support failure or loss of a fan blade along with collateral damage. This condition may last until the aeroplane completes its diversion flight, which could be several hours.

(2) High Power Condition. The high power imbalance condition occurs immediately after blade failure but before the engine is shut down or otherwise spools down. This condition addresses losing less than a full fan blade which may not be sufficient to cause the engine to spool down on its own. This condition may last from several seconds to a few minutes.  In some cases it has hampered the crew's ability to read instruments that may have aided in determining which engine was damaged.

 e. The information provided in this AMC is derived from the recommendations in the report “Engine Windmilling Imbalance Loads - Final Report,” dated July 1, 1997, which is appended to this NPA for information.

 f. The criteria presented in this AMC are based on a statistical analysis of 25 years of service history of high by-pass ratio engines with fan diameters of 1.52 metres (60 inches) or greater. Although the study was limited to these larger engines, the criteria and methodology are also acceptable for use on smaller engines.

5.   EVALUATION OF THE WINDMILLING IMBALANCE CONDITIONS

 a. Objective. It should be shown by a combination of tests and analyses that after:

i)   partial or complete loss of an engine fan blade, or

ii)  after bearing/bearing support failure, or

iii)  any other failure condition that could result in higher induced vibrations

including collateral damage, the aeroplane is capable of continued safe flight and landing.

 b. Evaluation. The evaluation should show that during continued operation at windmilling engine rotational speeds, the induced vibrations will not cause damage that would jeopardise continued safe flight and landing. The degree of flight deck vibration10 An acceptable level of cockpit vibration in terms of vibration frequency, acceleration magnitude, exposure time and direction may be found in ISO 2631/1 “International Standard, Evaluation of Human Exposure to Whole-Body Vibration, Part I: General Requirements”, 1985. should not prevent the flight crew from operating the aeroplane in a safe manner. This includes the ability to read and accomplish checklist procedures.

This evaluation should consider:

(1) The damage to airframe primary structure including, but not limited to, engine mounts and flight control surfaces,

(2) The damage to nacelle components, and

(3) The effects on equipment necessary for continued safe flight and landing (including connectors) mounted on the engine or airframe.

 c. Blade Loss Imbalance Conditions

(1)   Windmilling Blade Loss Conditions.  The duration of the windmilling event should cover the expected diversion time of the aeroplane. An evaluation of service experience indicates that the probability of the combination of a 1.0 IDF and a 60 minute diversion is on the order of 10-7 to 10 -8 while the probability of the combination of a 1.0 IDF and a 180 minute diversion is 10-9 or less. Therefore, with an IDF of 1.0, it would not be necessary to consider diversion times greater than 180 minutes. In addition, the 180 minute diversion should be evaluated using nominal and realistic flight conditions and parameters. The following two separate conditions with an IDF of 1.0 are prescribed for application of the subsequent criteria which are developed consistent with the probability of occurrence:

(a)  A 60 minute diversion flight.

(b)  If the maximum diversion time established for the aeroplane exceeds 60 minutes, a diversion flight of a duration equal to the maximum diversion time, but not exceeding 180 minutes.

(2)   Aeroplane Flight Loads and Phases

(a)   Loads on the aeroplane components should be determined by dynamic analysis.  At the start of the windmill event, the aeroplane is assumed to be in level flight with a typical payload and realistic fuel loading. The speeds, altitudes, and flap configurations considered may be established according to the Aeroplane Flight Manual (AFM) procedures. The analysis should take into account unsteady aerodynamic characteristics and all significant structural degrees of freedom including rigid body modes. The vibration loads should be determined for the significant phases of the diversion profiles described in paragraphs 5c(1)(a) and (b) above. 

(b)   The significant phases are:

 The initial phase during which the pilot establishes a cruise condition;

 The cruise phase;

 The descent phase; and

 The approach to landing phase.

(c)   The flight phases may be further divided to account for variation in aerodynamic and other parameters. The calculated loads parameters should include the accelerations needed to define the vibration environment for the systems and flight deck evaluations. A range of windmilling frequencies to account for variation in engine damage and ambient temperature should be considered.

(3)   Strength Criteria

(a) The primary airframe structure should be designed to withstand the flight and windmilling vibration load combinations defined in paragraphs 1, 2, and 3 below.

 The peak vibration loads for the flight phases in paragraphs 5c(2)(b)1 and 3 above, combined with appropriate 1g flight loads. These loads should be considered limit loads, and a factor of safety of 1.375 should be applied to obtain ultimate load.

 The peak vibration loads for the approach to landing phase in paragraph 5c(2)(b)4 above, combined with appropriate loads resulting from a positive symmetrical balanced manoeuvring load factor of 1.15g. These loads should be considered as limit loads, and a factor of safety of 1.375 should be applied to obtain ultimate load.

 The vibration loads for the cruise phase in paragraph 5c(2)(b)2 above, combined with appropriate 1g flight loads and 70 percent of the flight manoeuvre loads up to the maximum likely operational speed of the aeroplane. These loads are considered to be ultimate loads.

 The vibration loads for the cruise phase in paragraph 5c(2)(b)2 above, combined with appropriate 1g flight loads and 40 percent of the limit gust velocity of CS 25.341 as specified at VC (design cruising speed) up to the maximum likely operational speed of the aeroplane. These loads are considered to be ultimate loads.

(b)   In selecting material strength properties for the static strength analyses, the requirements of CS 25.613 apply.

(4)   Assessment of Structural Endurance

(a)   Criteria for fatigue and damage tolerance evaluations of primary structure are summarised in Table 1 below. Both of the conditions described in paragraphs 5c(1)(a) and (b) above should be evaluated. Different levels of structural endurance capability are provided for these conditions. The criteria for the condition in paragraph 5c(1)(b) are set to ensure at least a 50 percent probability of preventing a structural component failure. The criteria for the condition in paragraph 5c(1)(a) are set to ensure at least a 95 percent probability of preventing a structural component failure. These criteria are consistent with the probability of occurrences for these events discussed in paragraph 5(c)(1) above.

(b)   For multiple load path and crack arrest “fail-safe” structure, either a fatigue analysis per paragraph 1 below, or damage tolerance analysis per paragraph 2 below, may be performed to demonstrate structural endurance capability. For all other structure, the structural endurance capability should be demonstrated using only the damage tolerance approach of paragraph 2 below. The definitions of multiple load path and crack arrest "fail-safe" structure are the same as defined for use in showing compliance with CS 25.571, "Damage tolerance and fatigue evaluation of structure."

 Fatigue Analysis. Where a fatigue analysis is used for substantiation of multiple load path “fail-safe” structure, the total fatigue damage accrued during the well phase and the windmilling phase should be considered. The analysis should be conducted considering the following:

(aa)   For the well phase, the fatigue damage should be calculated using an approved load spectrum (such as used in satisfying the requirements of CS 25.571) for the durations specified in Table 1. Average material properties may be used.

(bb)   For the windmilling phase, fatigue damage should be calculated for the diversion profiles using a diversion profile consistent with the AFM recommended operations, accounting for transient exposure to peak vibrations, as well as the more sustained exposures to vibrations. Average material properties may be used.

(cc)   For each component, the accumulated fatigue damage specified in Table 1 should be shown to be less than or equal to the fatigue damage to failure of the component.

 Damage Tolerance Analysis. Where a damage tolerance approach is used to establish the structural endurance, the aeroplane should be shown to have adequate residual strength during the specified diversion time. The extent of damage for residual strength should be established, considering growth from an initial flaw assumed present since the aeroplane was manufactured. Total flaw growth will be that occurring during the well phase, followed by growth during the windmilling phase. The analysis should be conducted considering the following:

(aa)   The size of the initial flaw should be equivalent to a manufacturing quality flaw associated with a 95 percent probability of existence with 95 percent confidence (95/95).

(bb)   For the well phase, crack growth should be calculated starting from the initial flaw defined in paragraph 5c(4)(b)2(aa) above, using an approved load spectrum (such as used in satisfying the requirements of CS 25.571) for the duration specified in Table 1.  Average material properties may be used.

(cc)   For the windmilling phase, crack growth should be calculated for the diversion profile starting from the crack length calculated in paragraph 5c(4)(b)2(bb) above. The diversion profile should be consistent with the AFM recommended operation accounting for transient exposure to peak vibrations as well as the more sustained exposures to vibrations.  Average material properties may be used.

(dd)   The residual strength for the structure with damage equal to the crack length calculated in paragraph 5c(4)(b)2(cc) above should be shown capable of sustaining the combined loading conditions defined in paragraph 5c(3)(a) above with a factor of safety of 1.0.

TABLE 1 - Fatigue and Damage Tolerance

 

Condition

Paragraph 5c(1)(a)

Paragraph 5c(1)(b)

 

Imbalance Design Fraction (IDF)

1.0

1.0

Diversion time

A 60-minute diversion

The maximum expected diversion6

Well phase

Damage for 1 DSG

Damage for 1 DSG

Fatigue Analysis1,2 (average material properties)

Windmilling phase

Damage due to 60 minute diversion under a 1.0 IDF imbalance condition.

Damage due to the maximum expected diversion time6 under a 1.0 IDF imbalance condition

 

 

Criteria

Demonstrate no failure7 under twice the total damage due to the well phase and the windmilling phase.

Demonstrate no failure7 under the total damage (unfactored) due to the well phase and the windmilling phase.

Well phase

Manufacturing quality flaw5 (MQF) grown for 1 DSG

Manufacturing quality flaw5 (MQF) grown for 1/2 DSG

Damage Tolerance1,2

(average material properties)

Windmilling phase3,4

Additional crack growth for 60 minute diversion with an IDF = 1.0

Additional crack growth for the maximum diversion6 with an IDF = 1.0

 

Criteria

Positive margin of safety with residual strength loads specified in 5c(3)(a) for the final crack length

Positive margin of safety with residual strength loads specified in 5c(3)(a) for the final crack length

Notes:

1 The analysis method that may be used is described in paragraph 5 (Evaluation of the Windmilling Imbalance Conditions) of this AMC.

2 Load spectrum to be used for the analysis is the same load spectrum qualified for use in showing compliance with CS 25.571, augmented with windmilling loads as appropriate.

3 Windmilling phase is to be demonstrated following application of the well phase spectrum loads.

4 The initial flaw for damage tolerance analysis of the windmilling phase need not be greater than the flaw size determined as the detectable flaw size plus growth under well phase spectrum loads for one inspection period for mandated inspections.

5 MQF is the manufacturing quality flaw associated with 95/95 probability of existence. (Reference - ‘Verification of Methods For Damage Tolerance Evaluation of Aircraft Structures to FAA Requirements’, Tom Swift FAA, 12th International Committee on Aeronautical Fatigue, 25 May 1983, Figures 42, and 43.)

6 Maximum diversion time for condition 5c(1)(b) is the maximum diversion time established for the aeroplane, but need not exceed 180 minutes. This condition should only be investigated if the diversion time established for the aeroplane exceeds 60 minutes.

7 The allowable cycles to failure may be used in the damage calculations.

(5)  Systems Integrity

(a)   It should be shown that systems required for continued safe flight and landing after a blade-out event will withstand the vibratory environment defined for the windmilling conditions and diversion times described above. For this evaluation, the aeroplane is assumed to be dispatched in its normal configuration and condition. Additional conditions associated with the Master Minimum Equipment List (MMEL) need not be considered in combination with the blade-out event.

(b)   The initial flight environmental conditions are assumed to be night, instrument meteorological conditions (IMC) en route to nearest alternate airport, and approach landing minimum of 300 feet and 3/4 mile or runway visual range (RVR) 4000m or better.

(6)   Flight crew Response. For the windmilling condition described above, the degree of flight deck vibration shall not inhibit the flight crew’s ability to continue to operate the aeroplane in a safe manner during all phases of flight.

d.  Bearing/Bearing Support Failure. To evaluate these conditions, the low pressure (LP) rotor system should be analysed with each bearing removed, one at a time, with the initial imbalance consistent with the airborne vibration monitor (AVM) advisory level. The analysis should include the maximum operating LP rotor speed (assumed bearing failure speed), spool down, and windmilling speed regions. The effect of gravity, inlet steady air load, and significant rotor to stator rubs and gaps should be included. If the analysis or experience indicates that secondary damage such as additional mass loss, secondary bearing overload, permanent shaft deformation, or other structural changes affecting the system dynamics occur during the event, the model should be revised to account for these additional effects. The objective of the analyses is to show that the loads and vibrations produced by the bearing/bearing support failure event are less than those produced by the blade loss event across the same frequency range.

An alternative means of compliance is to conduct an assessment of the design by analogy with previous engines to demonstrate this type of failure is unlikely to occur. Previous engines should be of similar design and have accumulated a significant amount of flight hours with no adverse service experience.

e. Other failure conditions. If any other engine structural failure conditions applicable to the specific engine design, e.g. failure of a shaft, could result in more severe induced vibrations than the blade loss or bearing/bearing support failure condition, they should be evaluated.

6.   ANALYSIS METHODOLOGY

a. Objective of the Methodology. The aeroplane response analysis for engine windmilling imbalance is a structural dynamic problem. The objective of the methodology is to develop acceptable analytical tools for conducting dynamic investigations of imbalance events. The goal of the windmilling analyses is to produce loads and accelerations suitable for structural, systems, and flight deck evaluations.

b. Scope of the Analysis. The analysis of the aeroplane and engine configuration should be sufficiently detailed to determine the windmilling loads and accelerations on the aeroplane. For aeroplane configurations where the windmilling loads and accelerations are shown not to be significant, the extent and depth of the analysis may be reduced accordingly.

c. Results of the Analysis. The windmilling analyses should provide loads and accelerations for all parts of the primary structure. The evaluation of equipment and human factors may require additional analyses or tests. For example, the analysis may need to produce floor vibration levels, and the human factors evaluation may require a test (or analysis) to subject the seat and the human subject to floor vibration.

7.   MATHEMATICAL MODELLING

a. Components of the Integrated Dynamic Model. Aeroplane dynamic responses should be calculated with a complete integrated airframe and propulsion analytical model. The model should provide representative connections at the engine-to-pylon interfaces, as well as all interfaces between components (e.g., inlet-to-engine and engine-to-thrust reverser). The model should be to a similar level of detail to that used for certification flutter and dynamic gust analyses, except that it should also be capable of representing asymmetric responses. The model should be representative of the aeroplane to the highest windmilling frequency expected. The model consists of the following components:

(1)   Airframe structural model,

(2)   Propulsion structural model (including the engine model representing the engine type-design),

(3)   Control system model,

(4)   Aerodynamic model, and

(5)   Forcing function and gyroscopic effects

The airframe and engine manufacturers should mutually agree upon the definition of the integrated structural model, based on test and experience.

b. Airframe Structural Model. An airframe structural model is necessary in order to calculate the response at any point on the airframe due to the rotating imbalance of a windmilling engine. The airframe structural model should include the mass, stiffness, and damping of the complete airframe. A lumped mass and finite element beam representation is considered adequate to model the airframe. This type of modelling represents each airframe component, such as fuselage, empennage, and wings, as distributed lumped masses rigidly connected to weightless beams that incorporate the stiffness properties of the component. A full aeroplane model capable of representing asymmetric responses is necessary for the windmilling imbalance analyses. Appropriate detail should be included to ensure fidelity of the model at windmilling frequencies. A more detailed finite element model of the airframe may also be acceptable. Structural damping used in the windmilling analysis may be based on Ground Vibration Test (GVT) measured damping.

c. Propulsion Structural Model

(1)   Engine manufacturers construct various types of dynamic models to determine loads and to perform dynamic analyses on the engine rotating components, its static structures and mounts. Dynamic engine models can range from a centreline two-dimensional (2D) model, to a centreline model with appropriate three-dimensional (3D) features such as mount and pylon, up to a full 3D finite element model (3D FEM). Any of these models can be run for either transient or steady state conditions.

(2)   Propulsion structural models typically include the engine and all major components of the propulsion system, such as the nacelle intake, fan cowl doors, thrust reverser, common nozzle assembly, all structural casings, frames, bearing housings, rotors, and a representative pylon. Gyroscopic effects are included. The models provide for representative connections at the engine-to-pylon interfaces as well as all interfaces between components (e.g., inlet-to-engine and engine-to-thrust reverser). The engine that is generating the imbalance forces should be modelled in this level of detail, while the undamaged engines that are operating normally need only to be modelled to represent their sympathetic response to the aeroplane windmilling condition.

(3)   Features modelled specifically for blade loss windmilling analysis typically include fan imbalance, component failure and wear, rubs (blade to casing, and intershaft), and resulting stiffness changes. Manufacturers whose engines fail the rotor support structure by design during the blade loss event should also evaluate the effect of the loss of support on engine structural response during windmilling. 

(4)   Features that should be modelled specifically for bearing/bearing support failure windmilling events include the effects of gravity, inlet steady air loads, rotor to stator structure friction and gaps, and rotor eccentricity. Secondary damage should be accounted for, such as additional mass loss, overload of other bearings, permanent shaft deformation, or other structural changes affecting the system dynamics, occurring during rundown from maximum LP rotor speed and subsequent windmilling.

d. Control System Model. The automatic flight control system should be included in the analysis unless it can be shown to have an insignificant effect on the aeroplane response due to engine imbalance.

e. Aerodynamic Model. The aerodynamic forces can have a significant effect on the structural response characteristics of the airframe. While analysis with no aerodynamic forces may be conservative at most frequencies, this is not always the case. Therefore, a validated aerodynamic model should be used. The use of unsteady three-dimensional panel theory methods for incompressible or compressible flow, as appropriate, is recommended for modelling of the windmilling event. Interaction between aerodynamic surfaces and main surface aerodynamic loading due to control surface deflection should be considered where significant. The level of detail of the aerodynamic model should be supported by tests or previous experience with applications to similar configurations. Main and control surface aerodynamic derivatives should be adjusted by weighting factors in the aeroelastic response solutions. The weighting factors for steady flow (k=0) are usually obtained by comparing wind tunnel test results with theoretical data.

f. Forcing Function and Gyroscopic Forces. Engine gyroscopic forces and imbalance forcing function inputs should be considered. The imbalance forcing function should be calibrated to the results of the test performed under CS-E 810.

8. VALIDATION.

a. Range of Validation. The analytical model should be valid to the highest windmilling frequency expected.

b.   Aeroplane Structural Dynamic Model. The measured ground vibration tests (GVT) normally conducted for compliance with CS 25.629 may be used to validate the analytical model throughout the windmilling range. These tests consist of a complete airframe and propulsion configuration subjected to vibratory forces imparted by electro-dynamic shakers. 

(1)   Although the forces applied in the ground vibration test are small compared to the windmilling forces, these tests yield reliable linear dynamic characteristics (structural modes) of the airframe and propulsion system combination. Furthermore, the windmilling forces are far less than would be required to induce non-linear behaviour of the structural material (i.e. yielding).  Therefore, a structural dynamic model that is validated by ground vibration test is considered appropriate for the windmilling analysis.

(2)   The ground vibration test of the aeroplane may not necessarily provide sufficient information to assure that the transfer of the windmilling imbalance loads from the engine is accounted for correctly. The load transfer characteristics of the engine to airframe interface via the pylon should be validated by test and analysis correlation. In particular, the effect of the point of application of the load on the dynamic characteristics of the integrated model should be investigated in the ground vibration test by using multiple shaker locations.

(3)   Structural damping values obtained in the ground vibration tests are considered conservative for application to windmilling dynamic response analysis. Application of higher values of damping consistent with the larger amplitudes associated with windmilling analysis should be justified.

c.   Aerodynamic Model. The dynamic behaviour of the whole aeroplane in air at the structural frequency range associated with windmilling is normally validated by the flight flutter tests performed under CS 25.629.

d.   Engine Model. The engine model covering the engine type-design will normally be validated by the Engine manufacturer under CS-E 520(c)(2) by correlation against blade-off test data obtained in showing compliance with CS-E 810. This is aimed at ensuring that the model accurately predicts initial blade release event loads, any rundown resonant response behaviour, frequencies, potential structural failure sequences, and general engine movements and displacements. In addition, if the Failure of a shaft, bearing or bearing support, results in higher forces being developed, such Failures and their resulting consequences should also be accurately represented.

9.  HIGH POWER IMBALANCE CONDITION.

An imbalance condition equivalent to 50 percent of one blade at cruise rotor speed considered to last for 20 seconds may be assumed unless it is shown that the engine will respond automatically and spool down in a shorter period. It should be shown that attitude, airspeed, and altimeter indications will withstand the vibratory environment of the high power condition and operate accurately in that environment. Adequate cues should be available to determine which engine is damaged. Strength and structural endurance need not be considered for this condition.

[Amdt 25/8]