•
•
b. Controls can be made distinguishable or predictable by differences in attributes such as form, color, location, and labeling. For example, buttons, which are pushed, should be readily discernable from knobs, which are rotated. Control shapes that are easily determined with tactile senses can improve ease of operation, particularly during periods when pilot tasks require significant visual attention.
c. If color is used for coding task-essential information, use at least one other distinctive coding parameter (e.g., size, shape, label). Whenever possible, color coding should be consistent across all controls and displays. Consider the effect of flight deck lighting on the appearance of the label, and the use of colors throughout the flight deck (i.e., color philosophy).
2-8. Labeling of Controls.
a. Labels are the most common means used to identify and describe controls and other devices in the flight deck. They can be full text (e.g., “Standby”), abbreviated text (e.g., “STBY”), acronyms (e.g., “AGL” for “Above Ground Level”), as well as icons (e.g., for “On/Off”).
Note: While a limited number of control functions might have icons associated with them that pilots would likely know, most functions have no universally accepted icons.
b. Control labels must be visible, legible, and understandable for the population of pilots that will use the controls, per § 2X.1555(a).
c. Unless the control function and method of operation are obvious or indicated through other means (e.g., form, location), the control labeling scheme should clearly and unambiguously convey:
The current function performed by each control, The method for actuating the control when performing the current function.
d. Size control labels to be easily legible from the pilot’s normally seated position. SAE International, (SAE) Aerospace Standard (ARP) 4102/7, Electronic Displays, dated July 2007 provides guidelines on font sizes that are generally acceptable.
e. Use terms, icons, or abbreviations recommended in applicable FAA policy and other standards (e.g., International Civil Aviation Organization (ICAO), Document 8400, ICAO Abbreviations and Codes, Sixth Edition, date 2004 or SAE ARP 4105B, Abbreviations and Acronyms for Use on the Flight Deck, reaffirmed June 2004), for labels, when available.
Otherwise, use labels that are in general use in aviation.
f. For controls using icons in lieu of text labeling, substantiate that pilots, with the minimum expected training program, can adequately perform their duties at an acceptable level 11
of workload, as required by normal, non-normal, and emergency situations. If appropriate, consider incorporating icons in controls to complement rather than replace text labels (e.g., continuous text display, temporary “mouseover” display).
g. If multiple controls exist for the same function, clearly label all such controls.
Exceptions can include alternate controls that provide flexibility to accommodate a wide range of pilots. For example, experienced users might choose less-intuitive methods in order to gain a performance advantage such as speed. Double-clicking or push-and-hold are examples that are generally not recommended as a sole method of operation, but may be acceptable as a secondary method (e.g., for advanced users). Show that multiple controls for the same function are acceptable, and do not result in confusion or inadvertent operation.
h. If multiple controls exist (multi-crew aircraft) for the same function, show that there is sufficient information or other means available to make each crewmember aware of which control is currently functioning.
i. Use only one abbreviation and/or one icon for labeling a function. This is to prevent confusion when a label appears in multiple locations.
j. Ensure that the labels resist scratching, hazing, erasure, disfigurement, and other legibility degradation that might result from normal use.
2-9. Controls Lighting.
a. For controls with visual markings that are intended for use in low-light conditions, the markings must be lighted in some way that allows them to be easily read, for compliance with § 2X.1555(a) and § 2X.1381(a). This lighting might be from an external source (e.g., cockpit) or from an internal source (e.g., backlighting or luminous controls). Controls should be visible over a wide range of ambient light conditions (see paragraph 2- 2d).
b. Ensure that lighting of controls is consistent with flightcrew alerting such as warning, caution, and advisory lights (§ 2X.1322).
c. For low-light conditions, make lighted controls dimmable to brightness levels commensurate with other flight deck instrument lighting. This allows for the flightcrew’s adaptation to the dark, so controls are legible, and outside vision is maintained.
d. Ensure that lighting of controls from an internal source is not dimmable to brightness levels so low that the controls appear inactive.
e. Ensure that lighting of controls from an internal source does not produce light leaks, bright spots, or reflections from the windshield that can interfere with pilot vision or performance.
f. Automatic adjustment of lighted controls may be employed. Consider preference differences in multi-crew operations.
•
•
•
•
•
•
•
• 12/08/2011 AC 20-175
g. Ensure that lighted controls intended for operation in a night vision imaging system (NVIS) lighting-modified cockpit meets (a) through (e) above, and are compatible with night vision goggles (NVG). For additional guidance see:
AC 27.1, Certification of Normal Category Rotorcraft, refer to miscellaneous guidance (MG) 16, AC 29.2, Certification of Transport Category Rotorcraft, MG 16, or RTCA, Inc. (RTCA) document (DO) RTCA/DO-275, Minimum Operating Performance Standards for Integrated Night Imaging System Equipment, dated October 12, 2001.
Note: NVIS lighting must allow color transmission to meet aircraft certification regulations (e.g., §§ 2X.1381, 2X.1555). For controls that do not need color discrimination, NVIS A lighting can be used. For controls where color discrimination is needed, then NVIS lighting must (§ 2X.1555) allow the pilot to easily discern the required colors (typically accomplished using NVIS white).
Make perceived color for reds, yellows (or ambers), and greens the same across the cockpit.
2-10. Preventing Inadvertent Operation of Controls.
a. Protect controls against inadvertent operation. This type of error can occur for various reasons, such as when a pilot accidentally bumps a control, or accidentally actuates one control when intending to actuate a different control.
b. Provide mitigation for inadvertent operation as appropriate. Consider these questions when designing and installing the control:
Are there any safety-critical consequences if the pilot is not aware of the inadvertent operation?
What will the pilot need to do to correct an inadvertent operation?
Is the control designed to support “eyes free" use (i.e., when the pilot is not looking at the control)?
Are there aspects of the design that will decrease the likelihood of inadvertent operation?
Are there aspects of the design that will increase the likelihood of the pilot detecting an inadvertent operation?
c. The following paragraphs provide multiple methods that reduce the likelihood of inadvertent operation of controls.
(1) Location & Orientation. Title 14 CFR 2x.777 requires controls to be located to prevent inadvertent operation. Locate, space, and orient controls so that the operator is not likely to strike or move them accidentally in the normal sequence of control movements. For example, switches located close to a frequently-used lever could be oriented so the axis of rotation for the switches is perpendicular to the axis of rotation for the lever.
(2) Physical Protection. Physical obstructions can be built into the design of a control to prevent accidental actuation of the control. Examples include: recessed controls, shielded controls, flip-covers, and guards. Make physical protections so they do not interfere with the visibility or operation of the protected device or adjacent controls. Physical protections should be appropriately durable to ensure continued airworthiness.
(3) Slippage Resistance. The physical design and materials used for controls can reduce the likelihood of finger and hand slippage (especially in the presence of vibration). For example, buttons can be designed with concave, textured, or tacky upper surfaces to prevent finger slippage.
(4) Hand Stabilization. Provide hand rests, armrests, or other physical structures as a stabilization point for the pilot’s hands and fingers when they are operating a control. This can be particularly useful for controls used in the presence of turbulence and other vibration, helping the pilot make more precise inputs.
(5) Logical Protection. Software-based controls and software-related controls may be disabled at times when actuation of the control would be considered inappropriate, based on logic within the software. Make disabled (inactive) controls clearly discernable from active controls.
(6) Complex Movements. The method of operation for a control can be designed so that complex movement is required to actuate it. For example, a rotary knob can be designed so that it can only be turned when it is also being pulled out. Double-click or push-and-hold methods are not recommended methods of protection.
(7) Tactile Cues. The surfaces of different controls can have different shapes and textures, supporting the pilot in distinguishing different controls when operating in a dark or otherwise “eyes free” environment. For example, most keyboards have a small ridge on the “J” and “F” keys, cuing the user to the proper placement of their index fingers. Similarly, 14 CFR 25.781 and 23.781 requires specific shapes for certain cockpit controls.
(8) Locked/Interlocked Controls. Locking mechanisms, interlocks, or the prior operation of a related control can prevent inadvertent operation. For example, a separate on/off control can activate/deactivate a critical control, or physically lock it in place.
(9) Sequential Movements. Controls can be designed with locks, detents, or other mechanisms to prevent the control from passing directly through a sequence of movements. This method is useful when strict sequential actuation is necessary.
(10) Motion Resistance. Controls can be designed with resistance (e.g., friction, spring, inertia) so that deliberate effort is required for actuation. When this method is employed, the level of resistance cannot exceed the minimum physical strength capabilities for the intended pilot population.
d. Any method of protecting a control from inadvertent operation should not preclude operation within the required pilot task time, or interfere with the normal operation of the system. If a control is inadvertently operated, multisensory information can assist pilots in detecting the error. Feedback can include one or more auditory cues, tactile cues, or visual cues.
As a general rule, the greater the consequence of an unintended operation, the greater the prevention method needed, and the more salient the cues that should be provided for detection.
2-11. Controls for Data Entry.
a. Numerous flight deck tasks require some form of data entry, such as entering the airport code or radio frequency. Some controls lead pilots to enter data through compact devices
(e.g., knobs that scroll through the alphabet), which might result in increased workload and headdown time. Controls for data entry must support the pilot when entering required data to support the intended function, per § 2X.1301. Show that the controls are acceptable for data entry speed, accuracy, error rates, and workload.
b. If data entry involves multiple steps, make sure that each step is clearly discernable.
For example, pilots should be aware that the first step is to construct a string of multiple characters and the second step is to enter the string into the system.
c. During data construction, ensure that automatically constructed data is clearly discernable from manually constructed data. Regardless of how the data was constructed, the system should allow pilots to readily determine the data that is entered into the system.
d. Data entry controls should allow pilots to easily recover from typical inputs errors, such as a simple keyboarding error or an incorrect auto fill.
e. Previously approved controls for data entry have used physical configurations and design features based on the following:
(1) Letter keys that are arranged in a QWERTY format (preferred) or alphabetically.
(2) Numeric keypads that are arranged in a 3x3 matrix with zero (0) at the bottom.
(3) Concentric knob assemblies that contain no more than two knobs per assembly.
(4) Cursors that are automatically placed in the first data entry field.
•
•
•
•
• 12/08/2011 AC 20-175
(5) Data entry fields that are large enough to show all of the entered data without scrolling.
(6) Partitioning of long data items into shorter sections for both data entry and feedback.
f. Time-outs (e.g., from interruptions in the pilot's data entry task) and related automated data entry features should be predictable and easily recognized by the pilot.
2-12. Continued Airworthiness.
a. Title 14 CFR 2X.1529 requires instructions for continued airworthiness of equipment.
Include any limitations or considerations for the conditions in which controls are operated, replaced, or serviced. For example:
How should controls be serviced to ensure continued compliance with 14 CFR 2X.671, requiring easy, smooth, positive operation?
Will controls need cleaning from skin oils and perspiration, in order for labels to be legible?
What type of interference may impede safe operation?
Is the control susceptible to failure if exposed to liquids (e.g., spilled coffee or soda)?
What maintenance or inspection should be conducted over a given time interval?
b. Design controls to minimize degradation (e.g., scratching, hazing) from operational use.
c. Define a reasonable maintenance and inspection interval for each control, along with verification tests that are conducted at each interval in the instructions for continued operational safety.
•
•
•
• 12/08/2011 AC 20-175
Chapter 3. Additional Guidance for Multifunction Controls
3-1. Multifunction Controls—General. This chapter provides additional guidance that is specific to multifunction controls. The general guidance in chapter 2 still applies to multifunction controls.
a. Unlike a dedicated control, which performs a single function, multifunction controls can control multiple functions. This is enabled primarily through the use of electronic displays as a means for control. This AC covers the following multifunction controls:
Cursor control devices, Touch screens, Menu-based controls, and Voice recognition and voice activated controls Note: This chapter focuses on the first three items, so that “multifunction controls” does not necessarily include voice operated controls, unless specifically noted. However, some of the multifunction controls guidance may still apply to voice operated controls, and/or to electronic displays that are part of the voice-recognition control system.
b. Through the use of electronic displays as a means for controls, multifunction controls can be reconfigured by the system software, which creates opportunities for unique humansystem interface strategies that are currently not possible with traditional dedicated knobs, switches, controls, and physical hardware. As a result, their introduction creates a fundamental change in the design characteristics of the pilot/system interface and the methods pilots use to perform different tasks.
c. Multifunction controls therefore provide unique opportunities and challenges to designers. For example, a large number of traditional controls can require a significant amount of dedicated area in the flight deck. With touch screens, cursor, and menu-based controls the dedicated area can often be reduced to the size of the electronic display. But, this space-saving advantage typically comes at a cost of accessibility and workload, as pilots might have to navigate multiple electronic pages or menu layers to access functions. What once required a simple button push at an easily memorized location might now require a sequence of multiple steps, with many steps needing visual attention.
d. If a multifunction control replaces the function of a conventional control, make a comparison between the two to determine if replacement results in changes in performance and safety, relative to well-understood devices. Show that multifunction controls do not result in unacceptable levels of workload, error rates, speed, and accuracy.
3-2. Multifunction Controls—Inadvertent Operation. Multifunction controls present unique challenges for preventing inadvertent operation. For example, the use of electronic displays as a means for controls might not provide for motion resistance, tactile feedback, or physical protection against operation. Paragraph 2-10c., in this AC, provides multiple methods that have been shown to reduce the likelihood of inadvertent operation of controls. The following paragraphs provide additional methods that might be applicable to multifunction controls.
a. Controls should clearly indicate which areas of the electronic display are active for control functionality. Ensure that pilots can readily identify areas of active control functionality.
Active areas should be sized and organized to permit accurate selection. Moving a finger or cursor to the intended active area should not inadvertently operate other active areas.
b. For controls functions that are accessible from multiple display pages or menus, place controls in a consistent display location, when appropriate. Inconsistent placement can disrupt pilot usage habits and lead to errors.
c. A confirmation step may be provided before activating a function, where appropriate, such as for safety critical functions. For example, when an approach has been activated in a flight management system (FMS), and the pilot changes the selected approach, the system might ask, “Are you sure you want to discontinue the current approach?” Consider the tradeoff between the need for confirmation steps and the increase in pilot workload.
d. Provide a means to reverse an incorrect activation or input, when appropriate. An example means is an “undo” or similar simple reversionary functionality in the system.
3-3. Multifunction Controls —Labeling. Labels for multifunction controls introduce different challenges than for traditional controls. For example, a multifunction control is not necessarily in a fixed location, and may need to be located by navigating through various pages or menus.
Correctly identifying a multifunction control can require additional workload, time, and visual attention compared to traditional, dedicated controls.
a. Indicate a control’s function in a manner that is readily discernable from the current state. For example, a button labeled “Track Up” should not represent the current display orientation of “Heading Up,” but should instead change the display orientation to “Track Up” when selected.
b. Ensure that pop-up text that describes a control’s function does not result in unacceptable distractions, interference, or clutter.
c. If a control activates several different functions based on sequential commands or selections, clearly label each of the functions.
3-4. Multifunction Controls —Cursor Control Devices (CCDs). CCDs provide a means for pilots to indirectly access controls on electronic displays. This is in contrast to touch screens, which allow pilots to directly access controls. Typical CCDs in the flight deck include trackballs, touch pads, and joysticks.
a. A key benefit of CCDs is their convenience; they are typically located on or close to the pilots' natural hand position, and often accompanied by a hand stabilizer or arm rest. This allows for convenient pilot inputs, particularly since hand and arm motion is minimized due to high device gain. However, CCDs can also lead to control errors, particularly when subject to vibration environments. Also CCD inputs are more likely to go unnoticed by other crew members because pilot inputs are typically accomplished with small finger motions on the CCD.
Consider effects on flightcrew coordination in the environment and use conditions of CCDs.
b. Ensure that the cursor symbol is readily discernable from other information, and readily located on the electronic displays. This is particularly important if a cursor symbol is allowed to fade from a display. Some methods to enhance quick location of the cursor are “blooming” or “growing” it to attract the flightcrew’s attention.
c. If more than one cursor is used on a display system, provide a means to distinguish between the cursors.
d. Do not allow the cursor symbol to creep or move without pilot input. Exceptions can include automatic cursor positioning, if it can be shown that it does not result in pilot confusion or unacceptable task completion time.
e. Restrict the cursor symbol from areas of flight critical information, so it does not interfere with legibility. If a cursor symbol is allowed to enter a critical display information field, show that the cursor presence is acceptable.
f. In multi-crew aircraft, most applications will allow more than one flightcrew member to use one cursor. Establish an acceptable method for handling simultaneous “dueling cursors” that is compatible with the overall flight deck philosophy. Establish acceptable methods for other possible scenarios, including the use of two cursors by two pilots.
3-5. Multifunction Controls—Touch Screens. Unlike CCDs, touch screens control systems provide direct access to controls on electronic displays. Because of this, the input device is physically part of the display area. Touch screens utilize different technologies, such as resistive, capacitive, infrared, acoustic, and strain gauge (force-transducer) types. The specific technology affects performance and failures, and is therefore important to consider. For example, not all technologies accommodate the use of gloves.
a. Touch screens can be susceptible to control errors in part because the electronic displays (on which pilot inputs occur) typically are smooth and flat. Their surface offers little tactile feedback for determining finger position and motion, which can result in a greater need for visual attention. Therefore, consider integrating an associated support for stabilizing the pilot's hand, and for providing a reference point when positioning fingers, if appropriate. Ensure 19
that touch screens do not result in unacceptable levels of workload, error rates, speed, and accuracy.
b. Ensure that touch screens resist scratching, hazing, or other damage that can occur through normal use. Demonstrate that the system will continue to provide acceptable performance after long-term use and exposure to skin oils, perspiration, environmental elements
(e.g., sun), impacts (e.g., clipboard), chemical cleaners that might be used in the flight deck, and any liquids that might be brought onboard by flightcrew members (e.g., coffee).
c. If a touch screen’s calibration can drift or degrade, provide touch screen calibration procedures and other maintenance-related items to ensure proper calibration and operation.
Include these procedures in the instructions for continued airworthiness, per § 2X.1529.
d. The location of the pilot’s finger touch, as sensed by the touch screen, should be predictable and obvious.
3-6. Multifunction Controls—Menus and Navigation. In menus, the layering of information should not hinder the pilot in identifying the location of the desired control. Location and accessibility are not only related to the physical location of the control function. They also include consideration of where the control functions are located within various menu layers, and how the pilot navigates through those layers to access functions.
a. For menu-based controls, ensure that the number and complexity of steps required to access and utilize a control is appropriate to the intended use of the control (e.g., frequently used controls and emergency controls should be available at top-level menus). The number of submenus should be designed to ensure timely access to the desired option without over-reliance on memorization of the menu structure.
b. Cockpit controls must be located and identified to provide convenient operation and to prevent confusion, per § 2X.777(a). Layer information on menus or hidden pages so it does not hinder the flightcrew in identifying the location of the desired control.
c. Fit top-level control menu pages (e.g., primary or “home” page) entirely on the display
(i.e., do not require scrolling).
d. Make top-level control menus readily accessible. This is typically accomplished by continuously displaying the menu or menu access control in a fixed location (e.g., “home” page).
e. Provide feedback from page navigation that is an unambiguous indication of the current location.
3-7. Multifunction Controls—Voice Recognition and Voice Activated. Voice recognition and voice activated control systems in aircraft pose special challenges. Recognition accuracy of voice commands is less than perfect, and its performance is affected by pilot characteristics as well as the ambient noise environment. This section provides basic guidance and human factors considerations for voice recognition and voice activated controls, but it does not 20
comprehensively address either.
a. Ensure that voice recognition and voice activated control systems consistently and accurately recognize and properly input verbal commands from pilots under expected flight and ambient noise conditions (see chapter 2, paragraph 2-2.k). Typical background aircraft noise, crew and passenger conversations, radio communication traffic, and sound from other sources should not impede the system.
b. Provide a simple and readily apparent means to deactivate the voice recognition or voice activated system.
c. Ensure that voice recognition and voice activated control systems do not interfere with normal pilot communication functions (e.g., air traffic control and other aircraft).
Appendix A Appendix A. Related Documents and Acronyms
1. References.
a. AC 25-11A, Electronic Flight Deck Displays.
b. AC 23-23, Standardization Guide for Integrated Cockpits in Part 23 Airplanes.
c. AC 23.1311-1B, Installation of Electronic Display in Part 23 Airplanes.
d. AC 27-1, Certification of Normal Category Rotorcraft.
e. AC 29-1, Certification of Transport Category Rotorcraft.
f. RTCA/DO-275, Minimum Operational Performance Standards for Integrated Night Vision Imaging System Equipment, October 2001.
g. SAE ARP4102, Flight Deck Panels, Controls, and Display, July 2007.
h. SAE ARP4102/7, Electronic Display, July 2007.
i. SAE ARP4105B, Abbreviations and Acronyms for Use on the Flight Deck, reaffirmed June 2004.
j. FAA Policy ANM-01-03A, Factors to Consider when Reviewing an Applicant’s Proposed Human Factors Methods of Compliance for Flight Deck Certification, in Part 25 Airplanes.
k. Human Factors Design Standard for Acquisition of Commercial-Off-The-Shelf Subsystems, Non-Developmental Items, and Developmental Systems. eds: V. Ahlstrom & K. Longo. May 2003. FAA Technical Center: Atlantic City, NJ. DOT/FAA/CT-03/05 HF-STD-001. http://www.hf.faa.gov/hfds.htm
l. International Civil Aviation Organization, Doc 8400, ICAO Abbreviations and Codes, Sixth Edition, 2004.
m. MIL-STD-1472F, Department of Defense Design Criteria Standard: Human Engineering, August 23, 1999.
2. How to Get Referenced Documents. You can get copies of FAA Advisory Circulars from our Regulatory and Guidance library (RGL) at www.airweb.faa.gov/rgl. On the RGL website, select “Advisory Circulars,” then select “By Number.” You can obtain a copy of Modification and Replacement Parts Association’s (MARPA) guidance on continued operational safety (COS) at www.pmaparts.org/gvt/COSGuidance.pdf.
A 1--