•
•
•
•
•
•
•
• 12/08/2011 AC 20-175
g. Ensure that lighted controls intended for operation in a night vision imaging system (NVIS) lighting-modified cockpit meets (a) through (e) above, and are compatible with night vision goggles (NVG). For additional guidance see:
AC 27.1, Certification of Normal Category Rotorcraft, refer to miscellaneous guidance (MG) 16, AC 29.2, Certification of Transport Category Rotorcraft, MG 16, or RTCA, Inc. (RTCA) document (DO) RTCA/DO-275, Minimum Operating Performance Standards for Integrated Night Imaging System Equipment, dated October 12, 2001.
Note: NVIS lighting must allow color transmission to meet aircraft certification regulations (e.g., §§ 2X.1381, 2X.1555). For controls that do not need color discrimination, NVIS A lighting can be used. For controls where color discrimination is needed, then NVIS lighting must (§ 2X.1555) allow the pilot to easily discern the required colors (typically accomplished using NVIS white).
Make perceived color for reds, yellows (or ambers), and greens the same across the cockpit.
2-10. Preventing Inadvertent Operation of Controls.
a. Protect controls against inadvertent operation. This type of error can occur for various reasons, such as when a pilot accidentally bumps a control, or accidentally actuates one control when intending to actuate a different control.
b. Provide mitigation for inadvertent operation as appropriate. Consider these questions when designing and installing the control:
Are there any safety-critical consequences if the pilot is not aware of the inadvertent operation?
What will the pilot need to do to correct an inadvertent operation?
Is the control designed to support “eyes free" use (i.e., when the pilot is not looking at the control)?
Are there aspects of the design that will decrease the likelihood of inadvertent operation?
Are there aspects of the design that will increase the likelihood of the pilot detecting an inadvertent operation?
c. The following paragraphs provide multiple methods that reduce the likelihood of inadvertent operation of controls.
(1) Location & Orientation. Title 14 CFR 2x.777 requires controls to be located to prevent inadvertent operation. Locate, space, and orient controls so that the operator is not likely to strike or move them accidentally in the normal sequence of control movements. For example, switches located close to a frequently-used lever could be oriented so the axis of rotation for the switches is perpendicular to the axis of rotation for the lever.
(2) Physical Protection. Physical obstructions can be built into the design of a control to prevent accidental actuation of the control. Examples include: recessed controls, shielded controls, flip-covers, and guards. Make physical protections so they do not interfere with the visibility or operation of the protected device or adjacent controls. Physical protections should be appropriately durable to ensure continued airworthiness.
(3) Slippage Resistance. The physical design and materials used for controls can reduce the likelihood of finger and hand slippage (especially in the presence of vibration). For example, buttons can be designed with concave, textured, or tacky upper surfaces to prevent finger slippage.
(4) Hand Stabilization. Provide hand rests, armrests, or other physical structures as a stabilization point for the pilot’s hands and fingers when they are operating a control. This can be particularly useful for controls used in the presence of turbulence and other vibration, helping the pilot make more precise inputs.
(5) Logical Protection. Software-based controls and software-related controls may be disabled at times when actuation of the control would be considered inappropriate, based on logic within the software. Make disabled (inactive) controls clearly discernable from active controls.
(6) Complex Movements. The method of operation for a control can be designed so that complex movement is required to actuate it. For example, a rotary knob can be designed so that it can only be turned when it is also being pulled out. Double-click or push-and-hold methods are not recommended methods of protection.
(7) Tactile Cues. The surfaces of different controls can have different shapes and textures, supporting the pilot in distinguishing different controls when operating in a dark or otherwise “eyes free” environment. For example, most keyboards have a small ridge on the “J” and “F” keys, cuing the user to the proper placement of their index fingers. Similarly, 14 CFR 25.781 and 23.781 requires specific shapes for certain cockpit controls.
(8) Locked/Interlocked Controls. Locking mechanisms, interlocks, or the prior operation of a related control can prevent inadvertent operation. For example, a separate on/off control can activate/deactivate a critical control, or physically lock it in place.
(9) Sequential Movements. Controls can be designed with locks, detents, or other mechanisms to prevent the control from passing directly through a sequence of movements. This method is useful when strict sequential actuation is necessary.
(10) Motion Resistance. Controls can be designed with resistance (e.g., friction, spring, inertia) so that deliberate effort is required for actuation. When this method is employed, the level of resistance cannot exceed the minimum physical strength capabilities for the intended pilot population.
d. Any method of protecting a control from inadvertent operation should not preclude operation within the required pilot task time, or interfere with the normal operation of the system. If a control is inadvertently operated, multisensory information can assist pilots in detecting the error. Feedback can include one or more auditory cues, tactile cues, or visual cues.
As a general rule, the greater the consequence of an unintended operation, the greater the prevention method needed, and the more salient the cues that should be provided for detection.
2-11. Controls for Data Entry.
a. Numerous flight deck tasks require some form of data entry, such as entering the airport code or radio frequency. Some controls lead pilots to enter data through compact devices
(e.g., knobs that scroll through the alphabet), which might result in increased workload and headdown time. Controls for data entry must support the pilot when entering required data to support the intended function, per § 2X.1301. Show that the controls are acceptable for data entry speed, accuracy, error rates, and workload.
b. If data entry involves multiple steps, make sure that each step is clearly discernable.
For example, pilots should be aware that the first step is to construct a string of multiple characters and the second step is to enter the string into the system.
c. During data construction, ensure that automatically constructed data is clearly discernable from manually constructed data. Regardless of how the data was constructed, the system should allow pilots to readily determine the data that is entered into the system.
d. Data entry controls should allow pilots to easily recover from typical inputs errors, such as a simple keyboarding error or an incorrect auto fill.
e. Previously approved controls for data entry have used physical configurations and design features based on the following:
(1) Letter keys that are arranged in a QWERTY format (preferred) or alphabetically.
(2) Numeric keypads that are arranged in a 3x3 matrix with zero (0) at the bottom.
(3) Concentric knob assemblies that contain no more than two knobs per assembly.
(4) Cursors that are automatically placed in the first data entry field.
•
•
•
•
• 12/08/2011 AC 20-175
(5) Data entry fields that are large enough to show all of the entered data without scrolling.
(6) Partitioning of long data items into shorter sections for both data entry and feedback.
f. Time-outs (e.g., from interruptions in the pilot's data entry task) and related automated data entry features should be predictable and easily recognized by the pilot.
2-12. Continued Airworthiness.
a. Title 14 CFR 2X.1529 requires instructions for continued airworthiness of equipment.
Include any limitations or considerations for the conditions in which controls are operated, replaced, or serviced. For example:
How should controls be serviced to ensure continued compliance with 14 CFR 2X.671, requiring easy, smooth, positive operation?
Will controls need cleaning from skin oils and perspiration, in order for labels to be legible?
What type of interference may impede safe operation?
Is the control susceptible to failure if exposed to liquids (e.g., spilled coffee or soda)?
What maintenance or inspection should be conducted over a given time interval?
b. Design controls to minimize degradation (e.g., scratching, hazing) from operational use.
c. Define a reasonable maintenance and inspection interval for each control, along with verification tests that are conducted at each interval in the instructions for continued operational safety.
•
•
•
• 12/08/2011 AC 20-175
Chapter 3. Additional Guidance for Multifunction Controls
3-1. Multifunction Controls—General. This chapter provides additional guidance that is specific to multifunction controls. The general guidance in chapter 2 still applies to multifunction controls.
a. Unlike a dedicated control, which performs a single function, multifunction controls can control multiple functions. This is enabled primarily through the use of electronic displays as a means for control. This AC covers the following multifunction controls:
Cursor control devices, Touch screens, Menu-based controls, and Voice recognition and voice activated controls Note: This chapter focuses on the first three items, so that “multifunction controls” does not necessarily include voice operated controls, unless specifically noted. However, some of the multifunction controls guidance may still apply to voice operated controls, and/or to electronic displays that are part of the voice-recognition control system.
b. Through the use of electronic displays as a means for controls, multifunction controls can be reconfigured by the system software, which creates opportunities for unique humansystem interface strategies that are currently not possible with traditional dedicated knobs, switches, controls, and physical hardware. As a result, their introduction creates a fundamental change in the design characteristics of the pilot/system interface and the methods pilots use to perform different tasks.
c. Multifunction controls therefore provide unique opportunities and challenges to designers. For example, a large number of traditional controls can require a significant amount of dedicated area in the flight deck. With touch screens, cursor, and menu-based controls the dedicated area can often be reduced to the size of the electronic display. But, this space-saving advantage typically comes at a cost of accessibility and workload, as pilots might have to navigate multiple electronic pages or menu layers to access functions. What once required a simple button push at an easily memorized location might now require a sequence of multiple steps, with many steps needing visual attention.
d. If a multifunction control replaces the function of a conventional control, make a comparison between the two to determine if replacement results in changes in performance and safety, relative to well-understood devices. Show that multifunction controls do not result in unacceptable levels of workload, error rates, speed, and accuracy.
3-2. Multifunction Controls—Inadvertent Operation. Multifunction controls present unique challenges for preventing inadvertent operation. For example, the use of electronic displays as a means for controls might not provide for motion resistance, tactile feedback, or physical protection against operation. Paragraph 2-10c., in this AC, provides multiple methods that have been shown to reduce the likelihood of inadvertent operation of controls. The following paragraphs provide additional methods that might be applicable to multifunction controls.
a. Controls should clearly indicate which areas of the electronic display are active for control functionality. Ensure that pilots can readily identify areas of active control functionality.
Active areas should be sized and organized to permit accurate selection. Moving a finger or cursor to the intended active area should not inadvertently operate other active areas.
b. For controls functions that are accessible from multiple display pages or menus, place controls in a consistent display location, when appropriate. Inconsistent placement can disrupt pilot usage habits and lead to errors.
c. A confirmation step may be provided before activating a function, where appropriate, such as for safety critical functions. For example, when an approach has been activated in a flight management system (FMS), and the pilot changes the selected approach, the system might ask, “Are you sure you want to discontinue the current approach?” Consider the tradeoff between the need for confirmation steps and the increase in pilot workload.
d. Provide a means to reverse an incorrect activation or input, when appropriate. An example means is an “undo” or similar simple reversionary functionality in the system.
3-3. Multifunction Controls —Labeling. Labels for multifunction controls introduce different challenges than for traditional controls. For example, a multifunction control is not necessarily in a fixed location, and may need to be located by navigating through various pages or menus.
Correctly identifying a multifunction control can require additional workload, time, and visual attention compared to traditional, dedicated controls.
a. Indicate a control’s function in a manner that is readily discernable from the current state. For example, a button labeled “Track Up” should not represent the current display orientation of “Heading Up,” but should instead change the display orientation to “Track Up” when selected.
b. Ensure that pop-up text that describes a control’s function does not result in unacceptable distractions, interference, or clutter.
c. If a control activates several different functions based on sequential commands or selections, clearly label each of the functions.
3-4. Multifunction Controls —Cursor Control Devices (CCDs). CCDs provide a means for pilots to indirectly access controls on electronic displays. This is in contrast to touch screens, which allow pilots to directly access controls. Typical CCDs in the flight deck include trackballs, touch pads, and joysticks.
a. A key benefit of CCDs is their convenience; they are typically located on or close to the pilots' natural hand position, and often accompanied by a hand stabilizer or arm rest. This allows for convenient pilot inputs, particularly since hand and arm motion is minimized due to high device gain. However, CCDs can also lead to control errors, particularly when subject to vibration environments. Also CCD inputs are more likely to go unnoticed by other crew members because pilot inputs are typically accomplished with small finger motions on the CCD.
Consider effects on flightcrew coordination in the environment and use conditions of CCDs.
b. Ensure that the cursor symbol is readily discernable from other information, and readily located on the electronic displays. This is particularly important if a cursor symbol is allowed to fade from a display. Some methods to enhance quick location of the cursor are “blooming” or “growing” it to attract the flightcrew’s attention.
c. If more than one cursor is used on a display system, provide a means to distinguish between the cursors.
d. Do not allow the cursor symbol to creep or move without pilot input. Exceptions can include automatic cursor positioning, if it can be shown that it does not result in pilot confusion or unacceptable task completion time.
e. Restrict the cursor symbol from areas of flight critical information, so it does not interfere with legibility. If a cursor symbol is allowed to enter a critical display information field, show that the cursor presence is acceptable.
f. In multi-crew aircraft, most applications will allow more than one flightcrew member to use one cursor. Establish an acceptable method for handling simultaneous “dueling cursors” that is compatible with the overall flight deck philosophy. Establish acceptable methods for other possible scenarios, including the use of two cursors by two pilots.
3-5. Multifunction Controls—Touch Screens. Unlike CCDs, touch screens control systems provide direct access to controls on electronic displays. Because of this, the input device is physically part of the display area. Touch screens utilize different technologies, such as resistive, capacitive, infrared, acoustic, and strain gauge (force-transducer) types. The specific technology affects performance and failures, and is therefore important to consider. For example, not all technologies accommodate the use of gloves.
a. Touch screens can be susceptible to control errors in part because the electronic displays (on which pilot inputs occur) typically are smooth and flat. Their surface offers little tactile feedback for determining finger position and motion, which can result in a greater need for visual attention. Therefore, consider integrating an associated support for stabilizing the pilot's hand, and for providing a reference point when positioning fingers, if appropriate. Ensure 19
that touch screens do not result in unacceptable levels of workload, error rates, speed, and accuracy.
b. Ensure that touch screens resist scratching, hazing, or other damage that can occur through normal use. Demonstrate that the system will continue to provide acceptable performance after long-term use and exposure to skin oils, perspiration, environmental elements
(e.g., sun), impacts (e.g., clipboard), chemical cleaners that might be used in the flight deck, and any liquids that might be brought onboard by flightcrew members (e.g., coffee).
c. If a touch screen’s calibration can drift or degrade, provide touch screen calibration procedures and other maintenance-related items to ensure proper calibration and operation.
Include these procedures in the instructions for continued airworthiness, per § 2X.1529.
d. The location of the pilot’s finger touch, as sensed by the touch screen, should be predictable and obvious.
3-6. Multifunction Controls—Menus and Navigation. In menus, the layering of information should not hinder the pilot in identifying the location of the desired control. Location and accessibility are not only related to the physical location of the control function. They also include consideration of where the control functions are located within various menu layers, and how the pilot navigates through those layers to access functions.
a. For menu-based controls, ensure that the number and complexity of steps required to access and utilize a control is appropriate to the intended use of the control (e.g., frequently used controls and emergency controls should be available at top-level menus). The number of submenus should be designed to ensure timely access to the desired option without over-reliance on memorization of the menu structure.
b. Cockpit controls must be located and identified to provide convenient operation and to prevent confusion, per § 2X.777(a). Layer information on menus or hidden pages so it does not hinder the flightcrew in identifying the location of the desired control.
c. Fit top-level control menu pages (e.g., primary or “home” page) entirely on the display
(i.e., do not require scrolling).
d. Make top-level control menus readily accessible. This is typically accomplished by continuously displaying the menu or menu access control in a fixed location (e.g., “home” page).
e. Provide feedback from page navigation that is an unambiguous indication of the current location.
3-7. Multifunction Controls—Voice Recognition and Voice Activated. Voice recognition and voice activated control systems in aircraft pose special challenges. Recognition accuracy of voice commands is less than perfect, and its performance is affected by pilot characteristics as well as the ambient noise environment. This section provides basic guidance and human factors considerations for voice recognition and voice activated controls, but it does not 20
comprehensively address either.
a. Ensure that voice recognition and voice activated control systems consistently and accurately recognize and properly input verbal commands from pilots under expected flight and ambient noise conditions (see chapter 2, paragraph 2-2.k). Typical background aircraft noise, crew and passenger conversations, radio communication traffic, and sound from other sources should not impede the system.
b. Provide a simple and readily apparent means to deactivate the voice recognition or voice activated system.
c. Ensure that voice recognition and voice activated control systems do not interfere with normal pilot communication functions (e.g., air traffic control and other aircraft).
Appendix A Appendix A. Related Documents and Acronyms
1. References.
a. AC 25-11A, Electronic Flight Deck Displays.
b. AC 23-23, Standardization Guide for Integrated Cockpits in Part 23 Airplanes.
c. AC 23.1311-1B, Installation of Electronic Display in Part 23 Airplanes.
d. AC 27-1, Certification of Normal Category Rotorcraft.
e. AC 29-1, Certification of Transport Category Rotorcraft.
f. RTCA/DO-275, Minimum Operational Performance Standards for Integrated Night Vision Imaging System Equipment, October 2001.
g. SAE ARP4102, Flight Deck Panels, Controls, and Display, July 2007.
h. SAE ARP4102/7, Electronic Display, July 2007.
i. SAE ARP4105B, Abbreviations and Acronyms for Use on the Flight Deck, reaffirmed June 2004.
j. FAA Policy ANM-01-03A, Factors to Consider when Reviewing an Applicant’s Proposed Human Factors Methods of Compliance for Flight Deck Certification, in Part 25 Airplanes.
k. Human Factors Design Standard for Acquisition of Commercial-Off-The-Shelf Subsystems, Non-Developmental Items, and Developmental Systems. eds: V. Ahlstrom & K. Longo. May 2003. FAA Technical Center: Atlantic City, NJ. DOT/FAA/CT-03/05 HF-STD-001. http://www.hf.faa.gov/hfds.htm
l. International Civil Aviation Organization, Doc 8400, ICAO Abbreviations and Codes, Sixth Edition, 2004.
m. MIL-STD-1472F, Department of Defense Design Criteria Standard: Human Engineering, August 23, 1999.
2. How to Get Referenced Documents. You can get copies of FAA Advisory Circulars from our Regulatory and Guidance library (RGL) at www.airweb.faa.gov/rgl. On the RGL website, select “Advisory Circulars,” then select “By Number.” You can obtain a copy of Modification and Replacement Parts Association’s (MARPA) guidance on continued operational safety (COS) at www.pmaparts.org/gvt/COSGuidance.pdf.
A 1--
Appendix A
3. Acronyms.
AC Advisory circular AGL Above ground level ARP Aerospace Recommended Practice ASTC Amended supplemental type certificate ATC Amended type certificate CCD Curser control device CFR Code of Federal Regulations COS Continued operational safety DO Document DOT Department of Transportation EFB Electronic flight bag FAA Federal Aviation Administration FMS Flight management system ICAO International Civil Aviation Organization MARPA Modification and Replacement Parts Association MG Minimum guidance NVG Night vision goggles NVIS Night vision imaging system PED Portable electronic device RGL Regulatory Guidance Library RTCA RTCA Inc.
RTCA/DO RTCA Inc. Document SAE SAE International STBY Standby STC Supplemental type certificate TC Type certificate A-2
Appendix B Appendix B. Control-Function Matrix
1. Introduction.
a. This appendix provides a brief description of a “control-function matrix”. It is not required for compliance, but can be helpful as a method for development, and for sharing data with the FAA.
b. A control-function matrix primarily maps control devices (e.g., knob) to control functions (e.g., change radio frequency). The matrix also provides for an organization of controls-related attributes, such as those addressed in this AC. It is a tool sometimes used by applicants to organize their design and compliance effort.
2. Table B-1. Table B-1 provides an example template of a control-function matrix.
The columns in table B-1 are described as follows:
a. Control: List each control separately in the table. Include traditional dedicated controls (e.g., knobs) and multifunction controls (e.g., software menus, touch-screen buttons) in the list.
b. Function Description Section: Group information that describes a function performed by a control in the matrix. In the table B-1 example, the function, criticality, frequency of use, and operational conditions are addressed.
(1) Function: Each function provided by a control is listed next to the name of the control. If a control provides multiple functions, list each function on a separate row, since the supplemental information may be quite different for each function.
(2) Criticality for Safety: This column provides relevant information about the criticality of a function from a system safety analysis. Criticality information can be helpful when considering implications associated with the possible inadvertent operation of a control (e.g., critical controls may need additional degrees of protection against inadvertent operation).
(3) Expected Frequency of Use: This column describes the frequency with which a function will be activated, deactivated, or manipulated. This information describes the function provided by the control. Frequency information can be helpful when considering the level of familiarity the pilot can be expected to have with a control, relative to its accessibility and complexity of operation (e.g., frequently used controls that are at the edge of a pilot’s reach envelope may not be compliant with 14 CFR 2x.777).
(4) Operational and Use Conditions: This column describes any operational use conditions that can impact the use of the control for that particular function. Operational and use conditions include those described in chapter 2, paragraph 2-2 of this AC, as well as flight phase. The information therefore establishes context in which the controls will be operated (e.g., functions that are regularly performed during final approach and B-1