U.S. Department Advisory of Transportation Circular Federal Aviation Administration Subject: Installed Systems and Date: 5/3/2013 AC No: 25.1302-1 Equipment for Use by the Flightcrew Initiated By: ANM-111 This advisory circular (AC) provides guidance for the design and methods of compliance for installed equipment on transport airplanes intended for use by the flightcrew. The guidance provided by this AC is intended to minimize the occurrence of design-related errors by the flightcrew and to enable the flightcrew to detect and manage errors that do occur. This AC provides recommendations for the design and evaluation of controls, displays, system behavior, and system integration that are all part of human factors considerations.
Ali Bahrami Manager, Transport Airplane Directorate Aircraft Certification Service
Table of Contents Chapter Page Number Chapter 1. AC 25.1302 as an Acceptable Means of Compliance.
1-1. Purpose of this AC..
1-2. Applicability.
1-3. Organization of this AC._ 1 Chapter 2. Background. 3
2-1. Human Error. 3
2-2. Past Practice for Mitigating Human Error Through Design. 3 Chapter 3. Scope and Assumptions.
3-1. Relation of § 25.1302 to Other Requirements.
3-2. Covered Equipment.
3-3. Flightcrew Capabilities. _
3-4. Exceptions. 6
3-5. Additional Guidance for Other Requirements. 6 Chapter 4. Certification Planning.
4-1. Overview.
4-2. Scope of the Flightdeck Certification Program. 9
4-3. Applicable Requirements. 10
4-4. Selecting an Appropriate Means of Compliance. 10
4-5. Certification Plan._ 11 Chapter 5. Design Considerations and Guidance. 12
5-1. Overview. 12
5-2. Applicability of Material to § 25.1302. 13
5-3. Intended Function and Associated Flightcrew Tasks._ 20
5-4. Controls._ 21
5-5. Presentation of Information. 28
5-6. System Behavior._ 32
5-7. Flightcrew Error Management. 36
5-8. Integration. 42
Table of Contents (continued) Chapter Page Number Chapter 6. Means of Compliance._ 47
6-1. Overview. 47
6-2. Selecting Means of Compliance. 47
6-3. Discussion and Agreement with the FAA on Compliance Demonstrations. _ 48
6-4. Description of Means of Compliance.. _ 48 Appendices Appendix Page Number Appendix A. Related Documents. A-1 A-1. Additional Requirements. A-1 A-2. Orders and Policy Related to this AC. _ A-1 A-3. FAA Advisory Circulars Referenced in this AC._ A-2 A-4. Other Documents. A-2 Appendix B. Definitions. B-1 B-1. Acronyms. B-1 B-2. Terms and Definitions. _ _B-1
List of Tables Tables Page Number Table 1. Requirements Related to this AC. _____________________________________ 4 Table A-1. Part 25 Requirements. __________________________________________ A-1 Figure Figure Page Number Figure 1. Methodical Approach to Planning Certification for Design-Related Human Performance Issues.________________________________________________________ 8 iii
Chapter 1. AC 25.1302 as an Acceptable Means of Compliance.
1-1. Purpose of this AC.
This advisory circular (AC) describes an acceptable means of showing compliance with certain requirements of Title 14, Code of Federal Regulations (14 CFR) part 25. In particular, this AC addresses the design and approval of installed equipment intended for flight crewmembers to use from their normally seated positions on the flightdeck. It also provides recommendations for the design and evaluation of controls, displays, system behavior, and system integration, as well as design guidance for error management.
1-2. Applicability.
a. The guidance provided in this document is directed towards airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) transport airplane type certification engineers, human factors specialists, flight test pilots, flight test engineers, and their designees.
b. The guidance in this AC is neither mandatory nor regulatory in nature and does not constitute a requirement. You may follow alternate FAA-approved design recommendations.
Mandatory words such as “must” apply only to show compliance to a specific rule by use of a method prescribed in this AC without deviation.
c. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance.
d. This material does not change, create any additional, authorize changes in, or permit deviations from, regulatory requirements.
1-3. Organization of this AC.
a. This AC is intended to harmonize with European Aviation Safety Agency (EASA) Acceptable Means of Compliance (AMC) CS 25.1302.
b. Chapter 3, Scope and Assumptions, describes affected equipment, assumptions of flightcrew capability, and exceptions.
c. Chapter 4, Certification Planning, describes the activities for certification planning and the communication between the applicant and the FAA.
d. Chapter 5, Design Considerations and Guidance, identifies human-factors-related design issues applicants should address to show compliance with § 25.1302 and other relevant rules. If compliance to a specifi c rule is cited in a paragraph text, then applicants must address the cited rule.
e. Chapter 6, Means of Compliance, describes general means of compliance and how they may be used.
Chapter 2. Background.
2-1. Human Error.
a. Human error is generally characterized as a deviation from what is considered correct in some context, especially in the hindsight of analysis of accidents, incidents, or other events of interest. Some types of human error can be th e following: an inappropriate action, a difference from what is expected in a procedure, a mistaken decision, an incorrect keystroke, or an omission of some kind. Many other situations can also illustrate what we mean by the term “human error.”
b. Flightcrews make a positive contribution to the safety of the air transportation system because of their ability to assess continuously changing conditions and situations, analyze potential actions, and make reasoned decisions. However, even well trained, qualified, healthy, and alert flightcrew members make errors. Some errors may be influenced by the design of the systems the flightcrew uses to operate the airplane and by the flightcrew interfaces of those systems, even those that are carefully designed. Most of these errors have no significant safety effects, or are detected and/or mitigated in the normal course of events. Still, accident analyses have identified flightcrew performance and error as significant factors in a majority of accidents involving transport category airplanes.
c. Accidents result most often from a sequence or combination of errors and safety-related events. Analyses show that the design of the flightdeck and other systems can influence flightcrew task performance and the occurrence and effects of some flightcrew errors.
2-2. Past Practice for Mitigating Human Error Through Design.
a. Some current regulatory requirements intend to improve aviation safety by requiring the flightdeck and its equipment be designed with certain capabilities and characteristics. Approval of flightdeck systems with respect to design-related flightcrew error has typically been addressed by referring to system-specific or general applicability requirements, such as §§ 25.1301(a),
25.771(a), and 25.1523. But until now, little or no guidance has existed to show the applicant how they may address potential flightcrew limitations and design-related errors. Section 25.1302 and this guidance material have been developed for this purpose.
b. Often, showing compliance with design requirements that relate to human abilities and limitations is subject to interpretation. Findings may vary depending on the novelty, complexity, or degree of integration of the system design. The FAA considers the guidance described here as a structured approach to selecting and developing acceptable means of compliance that will be useful in aiding standardized certification practices.
Chapter 3. Scope and Assumptions.
3-1. Relation of § 25.1302 to Other Requirements.
This AC provides guidance for showing compliance with § 25.1302 as well as with several other requirements associated with all installed equipment the flightcrew uses in operating the airplane. Table 1 contains a lis t of requirements related to flightdeck design and flightcrew interfaces for which this AC provides guidance.
Table 1. Requirements Related to this AC.
Part 25 Requirements General topic Relevant material in this AC § 25.771(a) Pilot compartment - Unreasonable concentration or fatigue Flightcrew Error Management, subchapter 5-7.
Integration, subchapter 5-8.
Controls, subchapter 5-4.
System Behavior, subchapter
5-6.
§ 25.771(c) Pilot compartment - Equipment controllable from either pilot seat Controls, subchapter 5-4.
Integration, subchapter 5-8.
§ 25.773 Pilot compartment view Integration, subchapter 5-8.
§ 25.777(a) Cockpit controls - Location of cockpit controls Controls, subchapter 5-4.
Integration, subchapter 5-8.
§ 25.777(b) Cockpit controls - Direction of movement of cockpit controls Controls, subchapter 5-4.
Integration, subchapter 5-8.
§ 25.777(c) Cockpit controls - Full and unrestricted movement of controls Controls, subchapter 5-4.
Integration, subchapter 5-8.
§ 25.1301(a) Equipment function and installation - Intended function of installed systems Flightcrew Error Management, subchapter 5-7.
Integration, subchapter 5-8.
Controls, subchapter 5-4.
Presentation of Information, subchapter 5-5.
System Behavior, subchapter
5-6.
§ 25.1302 Installed systems and equipment for use by the flightcrew - Flightcrew error Flightcrew Error Management, subchapter 5-7.
Integration, subchapter 5-8.
Controls, subchapter 5-4 Presentation of Information, 4
Part 25 Requirements General topic Relevant material in this AC subchapter 5-5.
System Behavior, subchapter
5-6.
§ 25.1303 Flight and navigation instruments Integration, subchapter 5-8.
§ 25.1309(a) Equipment, systems, and installations - Intended function of required equipment under foreseeable operating conditions Controls, subchapter 5-4.
Integration, subchapter 5-8.
§ 25.1309(c) Provide warning for unsafe operation and enable crew to take corrective action.
System design for minimizing flightcrew errors which could create additional hazards Presentation of Information, subchapter 5-5.
Flightcrew Error Management, subchapter 5-7.
§ 25.1321 Instrument arrangement and visibility Integration, subchapter 5-8.
§ 25.1322 Flightcrew Alerting Integration, subchapter 5-8.
§ 25.1329 Flight guidance system - Autopilot, flight director, and autothrust System Behavior, subchapter 5-6.
§ 25.1523 Minimum flightcrew Controls, subchapter 5-4.
Integration, subchapter 5-8.
§ 25.1543(b) Instrument markings - Visibility Presentation of Information, subchapter 5-5.
§ 25.1549 Powerplant and auxiliary power unit instruments Flightcrew Error Management, subchapter 5-7.
§ 25.1555 (a) Control markings Controls, subchapter 5-4.
Part 25 Appendix D Criteria for determining minimum flightcrew Integration, subchapter 5-8.
3-2. Covered Equipment.
a. This material applies to flightcrew interfaces and system behavior for all installed systems and equipment used by the flightcrew on the flightdeck while operating the airplane in both normal and non-normal conditions. It applies to those airplane and equipment design considerations within the scope of part 25 for type certificate (TC) and supplemental type certificate (STC) projects. It does not apply to training, qualification, or licensing requirements for flightcrews. Similarly, it doe s not apply to procedures for flightcrews, except as required within part 25.
b. This material does not address systems or equipment used at times other than while flightcrews perform their duties in operating the airplane in normal and non-normal conditions.
For instance, actions performed on the ground that do not involve operation of the aircraft are not applicable, such as use of certain circuit breakers or maintenance controls intended for use by maintenance personnel or by the flightcrew when they are not operating the airplane.
3-3. Flightcrew Capabilities.
In showing compliance with the requirements referenced by this AC, the applicant may assume a qualified flightcrew is trained and checked in the use of the installed equipment. This compliance refers to a flightcrew allowed to fly the airplane because the flightcrew meets the requirements of the operating rules for transport category airplanes.
3-4. Exceptions.
To the extent practicable, installed equipment must incorporate means to enable the flightcrew to manage errors resulting from flightcrew interactions with the equipment that can be reasonably expected in service, per § 25.1302. This AC does not apply to the following, as referenced in § 25.1302(d):
(1) Skill-related errors associated with manual control of the airplane;
(2) Errors that result from decisions, actions, or omissions committed with malicious intent;
(3) Errors arising from a flight crewmember’s reckless decision, actions, or omissions reflecting a substantial disregard for safety; and
(4) Errors resulting from acts or threats of violence, including actions taken under duress.
3-5. Additional Guidance for Other Requirements.
Section 25.1302 is a generally applicable requirement for flightdeck systems and equipment.
Other part 25 requirements exist for specific equipment and systems. Where guidance is provided in other ACs for specific equipment and systems, that specific guidance is assumed to have precedence if a conflict exists with guidance provided here. Appendix A of this AC lists references to other related regulatory material and documents.
Chapter 4. Certification Planning.
4-1. Overview.
a. This chapter describes applicant activities, communications between the applicant and the FAA Aircraft Certification Office (ACO), and documentation needed for finding compliance when using the compliance means provided in this AC. Procedural requirements for issuance of type certificates under 14 CFR part 25 may be found in 14 CFR part 21.
b. Applicants can gain significant benefits by involving the FAA ACO in the earliest possible phases of application and design. This will enable timely agreements to be reached on potential design-related human factors issues and thereby reduce the applicant’s risk of investing in design features that may be found non-compliant.
c. Certain activities that typically take place during development of a new product, or a new flightdeck system or function, may occur before official certification data are submitted to show compliance with the requirements. The applicant may choose to discuss or share these activities with the FAA on an information-only basis.
d. When the FAA agrees, as part of the certification planning process, that a specific evaluation, analysis, or assessment of a human factors issue can become part of the demonstration to show the design complies with the requirements, that part of the evaluation, analysis, or assessment is given “certification credit.”
e. Figure 1 illustrates the methodical approach to planning certification for design-related human performance issues.
Figure 1. Methodical Approach to Planning Certification for Design-Related Human Performance Issues.
A. Systems, components & features
1. Evaluate systems, B. Systems, components, & components, & features features that vs. crew involve flightcrew tasks. interaction C. Intended
2. Identify functions & degrees of associated Criteria: relation novelty, flightcrew to intended complexity, tasks for function & and each system, associated flight Integration component, & crew tasks. feature Criteria: levels of novelty, complexity, applicability of requirements to 3. Determine applicable to each requirements D. List of integration. components, and systems, system, which aspects of features and feature requiring component, and the design usual or more require thorough means of substantiation compliance E. Documented matrix of means of
4. Select compliance for appropriate each combination Criteria: applicability means of of requirement systems, components of requirements to and features. compliance. component, and feature in D vs. system, Criteria: maturity, past certification experience, and degree of novelty, complexity, integration.