additional scrutiny is required. Applicants shou ld evaluate whether statements of intended function(s) and associated task(s) are sufficiently specific and detailed by using the following questions:
(1) Does each feature and function have a stated intent?
(2) Are flightcrew tasks associated with the function described?
(3) What assessments, decisions, and actions are flightcrew members expected to make based on information provided by the system?
(4) What other information is assumed to be used in combination with the system?
(5) Will installation or use of the system interfere with the ability of the flightcrew to operate other flightdeck systems?
(6) Are there any assumptions made about the operational environment in which the equipment will be used?
(7) What assumptions are made about flightcrew attributes or abilities beyond those required in regulations governing flight operations, training, or qualification?
5-4. Controls.
a. For purposes of this AC, we define controls as devices the flightcrew manipulates in order to operate, configure, and manage the airplane and its flight control surfaces, systems, and other equipment.
(1) Controls may include such equipment in the flightdeck as:
(a) buttons,
(b) switches,
(c) knobs,
(d) keyboards,
(e) keypads,
(f) touch screens, and
(g) cursor control devices.
(2) Controls may include graphical user interfaces, such as pop-up windows and pulldown menus that provide control functions.
(3) Voice activated controls are also considered in this AC.
b. Applicants must show controls in the proposed design, as defined in §§ 25.777, 25.779,
25.781, 25.1543, and 25.1555 comply with § 25.1302(b).
(1) The proposed means of compliance should be sufficiently detailed to demonstrate that each function, method of control operation, and result of control actuation complies with the requirements. Controls must be shown to:
(a) be clear;
(b) be unambiguous;
(c) be appropriate in resolution and precision;
(d) be accessible;
(e) be usable; and
(f) enable flightcrew awareness, including providing adequate feedback.
(2) For each of these requirements, the proposed means of compliance should include consideration of the following control characteristics for each control individually and in relation to other controls:
(a) Physical location of the control.
(b) Physical characteristics of the control (e.g., shape, dimensions, surface texture, range of motion, color).
(c) Equipment or system(s) that the control directly affects.
(d) How the control is labeled.
(e) Available control settings.
(f) Effect of each possible actuation or setting, as a function of initial control setting or other conditions.
(g) Whether there are other controls that can produce the same effect (or affect the same target parameter) and conditions under which this will happen.
(h) Location and nature of control actuation feedback.
(3) The discussion below provides additional guidance for design of controls that comply with § 25.1302. It also provides industry accepted best practices.
c. Clear and Unambiguous Presentation of Control-Related Information (§ 25.1302(b)).
(1) Distinguishable and predictable controls.
(a) Each flight crewmember should be able to identify and select the current function of a control with the speed and accuracy appropriate to the task. The function of a control must be readily apparent so that little or no familiarization is required.
(b) The applicant should evaluate consequences of control activation to show that the consequences are predictable and obvious to each flight crewmember. Such an assessment would include evaluation of the control of multiple displays with a single device and evaluation of shared display areas that flightcrew members access with individual controls. The use of a single control should also be evaluated.
(c) For example, controls can be made distinguishable and predictable by the following differences:
1. Form.
2. Color.
3. Location.
4. Motion.
5. Effect.
6. Labeling.
(d) Color coding as a sole distinguishing feature is usually not sufficient. This applies to physical controls as well as to controls that are part of an interactive graphical user interface.
(2) Labeling - §§ 25.1301(a)(2), 25.1543(b), and 25.1555(a).
(a) For the requirements for general marking of controls, see § 25.1555(a). In addition, see guidance on labeling items such as knobs, buttons, symbols, and menus in AC 25- 11A, Electronic Flight Deck Displays, Chapter 5, paragraph (c)(2). Section 25.1302(a) and (b) requires that information necessary to accomplish defined tasks be provided precisely and clearly. It also requires the controls be acces sible and usable by the flightcrew in a way consistent with the urgency, frequency, and duration of the tasks. Labels should be readable from the flightcrew’s normally seated position in all lighting and environmental conditions, if intended for flightcrew use. If a control performs more than one function, labeling should 23
include all intended functions unless the function of the control is obvious. Labels of graphical controls accessed by a cursor device such as a trackball should be included on the graphical display. When menus lead to additional choi ces such as submenus, the menu label should provide a reasonable description of the next submenu.
(b) The applicant should use standard and/or non-ambiguous abbreviations, nomenclature, or icons to label controls. The labels should be consistent within a function and across the flightdeck. International Civ il Aviation Organization (ICAO) Document 8400, Abbreviations and Codes, Sixth Edition, 2004, provides standard abbreviations and is an acceptable basis for selecting labels.
(c) The labeling design should avoid hidden functions such as clicking on empty space on a display to make something happen.
(d) When using icons instead of text labeling, the applicant should show the flightcrew requires only brief exposure to the icon to determine the function of a control and how it operates. Based on experience, the following guide lines for icons have been shown to lead to usable designs.
1 The icon should be analogous to the object it represents.
2 The icon should be in general use in aviation and well known to flightcrews.
3 The icon should be based on established standards, when they exist, and conventional meanings.
(e) In all cases, the applicant should show the use of icons to be at least equivalent to text labels in terms of flightcrew task accomplishment speed and rate of errors made.
Alternatively, the applicant should show that icons not equivalent to text labels have no unacceptable effect on safety or flightcrew workload (e.g. incurred task times) and do not confuse the flightcrew.
(3) Interaction of multiple controls - § 25.1302(a).
(a) If multiple controls for the flightcrew are provided for a function, § 25.1302
(a) states the applicant should show sufficient information is available to the flightcrew to make them aware of which control is currently functioning. As an example, crewmembers need to know which flight crewmember’s input has priority when two cursor control devices can access the same display. Designers should use caution when dual controls can affect the same parameter simultaneously.
d. Accessibility of Controls - § 25.777(a), § 25.777(b) and § 25.1302.
(1) The applicant must show each flightcrew member in the minimum flightcrew, as defined by § 25.1523, has access to and can operate all necessary controls. Accessibility is one 24
factor in determining whether controls support the intended function of equipment used by the flightcrew. Any control required for flight crewmember operation in the event of incapacitation of other flightcrew member(s), in both normal and non-normal conditions, must be shown to be viewable, reachable, and operable by flightcrew members with the stature specified in § 25.777(c), from the seated position with shoulder restraints on. If shoulder restraints are lockable, this may be shown with shoulder restraints unlocked unless the controls need to be accessed with the restraint locked (e.g., a hard landing or aircraft upset).
(2) Section 25.777(c) requires the location and arrangement of each flightdeck control permit full and unrestricted movement of that control without interference from the flightdeck structure or the flightcrew’s clothing.
(3) The layering of information, as with menus or multiple displays, should not hinder the flightcrew in identifying the location of the desired control. Section 25.1302(b) requires information intended for flightcrew use must be provided in a clear and unambiguous form, be accessible, and enable flightcrew awareness. Evaluating location and accessibility requires consideration of more than just the physical aspects of the control function. Location and accessibility also include consideration of where the control functions may be located within various menu layers and how the flight crewmember navigates through those layers to access functions. Accessibility should be shown in conditions of system failures, flightcrew incapacitation, and minimum equipment list dispatch.
(4) Control position and direction of motion must be oriented according to the standards in § 25.777.
e. Use of Controls.
(1) Environmental issues affecting controls - § 25.1301(a) and § 25.1302.
(a) Turbulence or vibration within the aircraft’s approved operational envelope and extremes in lighting levels should not prevent the flightcrew from performing all their tasks at an acceptable level of performance and workload.
(b) If the use of gloves is anticipated, the design should account for the effect of their use on the size and precision of controls per §§ 25.1302(b)(2) and (c)(2).
(c) Sensitivity of controls should afford precision sufficient (without being overly sensitive) to perform tasks even in adverse environments as defined for the airplane’s operational envelope per §§ 25.1302(c)(2) and (d). Analysis of environmental issues as a means of compliance is not sufficient for new control types or technologies or for novel use of controls that are themselves not new or novel. Tests are required for new control types or technologies, or novel uses of existing controls to determine if they function properly in adverse environments.
(d) The applicant should show the controls required to regain airplane or system control and to continue operating the airplane in a safe manner are identifiable and usable in all environmental conditions, to include dense smoke in the flightdeck and severe vibrations. An example of the latter condition would be after a fan blade loss.
(2) Control-display compatibility - § 25.777(b) states the direction of movement of cockpit controls must meet the requirements of § 25.779. Wherever practicable, the sense of motion involved in the operation of other controls must correspond to the sense of the effect of the operation upon the airplane or upon the part operated. Controls of a variable nature using a rotary motion must move clockwise from the off position, through an increasing range, to the full on position.
(a) To ensure that a control is unambiguous per § 25.1302(b)(1), the relationship and interaction between a control and its associated display or indications should be readily apparent, understandable, and logical. A control input is often required in response to information on a display or to change a parameter setting on a display. The applicant should specifically assess any input device or control that has no obvious “increase” or “decrease” function with regard to flightcrew expectations and its consistency with other controls on the flightdeck. The SAE International (SAE) pub lication ARP 4102, paragraph 5.3, is an acceptable means of compliance for controls used in flightdeck equipment.
(b) Section 25.777(a) requires each cockpit control must be located to provide convenient operation and to prevent confusion and inadvertent operation. Controls associated with a display, per §§ 25.777(a), 25.1302 (a) and (b)(2), must be located so they do not interfere with the performance of the flightcrew task. Controls whose function is specific to a particular display surface should be mounted near the display or function being controlled. Locating controls immediately below a display is generally preferable. Mounting controls immediately above a display has, in many cases, caused the flight crewmember’s hand, when operating the controls, to obscure the view of the display.
(c) Spatial separation between a control and its display may be necessary. This is the case when a system’s control is located with others for that same system, or when it is one of several controls on a panel dedicated to controls for that multifunction display. When there is large spatial separation between a control and its associated display, the applicant should show that use of the control for the associated task(s) is acceptable, in accordance with §§ 25.777(a) and 25.1302.
(d) In general, control design and placement should avoid the possibility that visibility of information could be blocked. If range of control movement temporarily blocks the flightcrew’s view of information, the applicant should show this information is either not necessary at that time, or is available in another accessible location (§ 25.1302 (b)). Section
25.1302(b)(2) requires information intended for use by the flightcrew be accessible and useable by the flightcrew in a manner consistent with the urgency, frequency, and duration of the flightcrew’s tasks.
(e) Annunciations/labels on electronic displays should be identical to labels on related switches and buttons located elsewhere on the flightdeck. If display labels are not identical to related controls, the applicant should show flightcrew members can quickly, easily, and accurately identify associated controls so they can safely perform all the tasks associated with the systems’ and equipment’s’ intended function (§ 25.1302).
f. Adequacy of Feedback - §§ 25.771(a), 25.1301(a) and 25.1302.
(1) Feedback for control operation is necessary to let the flightcrew know the effects of their actions. Each control should provide f eedback to the flight crewmember for menu selections, data entries, control actions, or other inputs if awareness is required for safe operation. If the flightcrew input is not accepte d by the system, the input failure should be clearly and unambiguously indicated, § 25.1302(b)(1). Such feedback can be visual, auditory, or tactile.
(2) Section 25.1302(b)(3) requires that if feedback/awareness is required for safe operation, it should be provided to inform the flightcrew of the following conditions:
(a) a control has been activated (commanded state/value);
(b) the function is in process (given an extended processing time);
(c) the action associated with the control has been initiated (the actual state of operation or control value from the operation if it is different from the commanded state); and
(d) The equipment should provide, within the time required for the relevant task, operationally significant feedback of the actuator’s position within its range when a control is used to move an actuator through its range of travel. If awareness is required for safe operation, then feedback and awareness must be provided, § 25.1302(b)(3). Examples of information that could appear relative to an actuator’s range of travel include trim system positions, and the state of various systems valves.
(3) The type, duration, and appropriateness of feedback will depend on the flightcrew’s task and the specific information required for successful operation. As an example, switch position alone is insufficient feedback if the flightcrew must be aware, per § 25.1302(b)(3), of the actual system response or the state of the system as a result of an action that is required.
(4) Keypads should provide tactile feedback for any key depression. In cases when this is omitted, tactile feedback should be replaced with appropriate visual or other feedback that indicates that the system has received the inputs and is responding as expected.
(5) Equipment should provide appropriate visual feedback not only for knob, switch, and pushbutton position, but also for graphical control methods such as pull-down menus and pop-up windows. The user interacting with a gra phical control should receive positive indication that a hierarchical menu item has been selected, a graphical button has been activated, or other input has been accepted.
(6) To meet the requirements of § 25.1302, the applicant should show that all forms of feedback are obvious and unambiguous to the flightcrew in their performance of all the tasks associated with the intended functions of the equipment.
5-5. Presentation of Information.
a. Introduction.
(1) Applicants should use this AC as a guide to show that information displayed in the proposed design complies with § 25.1302(b). Refer to AC 25-11A for information presentations on electronic displays. The proposed means should be of sufficient detail to show the function, method of control operation, and results comply with the requirements in § 25.1301 and that the results of the presented information are:
(a) clear,
(b) unambiguous,
(c) appropriate in resolution and precision,
(d) accessible,
(e) usable, and
(f) able to provide adequate feedback for flightcrew awareness.
(2) Presentation of information to the flightcrew can be visual (for instance, on an LCD), auditory (a “talking” checklist), or tactile (for example, the “feel” of the control).
Information presented on the integrated flightdeck, regardless of the medium used, must meet all of the requirements in § 25.1302 as stated above. For visual displays, this AC addresses mainly display format issues and not display hardware characteristics. The following provides design considerations for requirements found in §§ 25.1301(a), 25.1302, and 25.1543(b).
b. Clear and Unambiguous Presentation of Information.
(1) Qualitative and quantitative display formats - §§ 25.1301(a) and 25.1302.
(a) Applicants should show, per § 25.1302(b), that display formats include the type of information the flightcrew needs for the task, specifically with regard to the speed and precision of reading required. The information can be in the form of a text message, numerical value, or a graphical representation of state or rate information. State information identifies the specific value of a parameter at a particular time. Rate information indicates the rate of change of that parameter.
(b) If the flightcrew’s only way to determine non-normal values is by monitoring display values presented on the display, the equipment should offer qualitative display formats.
Qualitative display formats convey rate and trend information better than quantitative (e.g.
digital) presentations. If a qualitative displa y is not practical, the applicant should show the flightcrew can perform the tasks for which the information is used. Quantitative presentation of 28
information is better for tasks requiring precise values. Refer to § 25.1322 and AC 25.1322 when a non-normal value is associated with a flightcrew alert.
(c) Digital readouts or present value indices incorporated into qualitative displays should not make the scale markings or graduations unusable as they pass the present value index.
Scale markings should be clear throughout all values presented in the readout.
(2) Characters, fonts, lines, and scale markings - §§ 25.1301(a)(2) and 25.1543(b).
The applicable flightcrew members, seated at their stations and using normal head movement, must be able to see and read display format features such as fonts, symbols, icons, and markings so they can safely perform their tasks. In some cases, cross-flight-deck readability may be required to meet the intended function (§ 25.1301(a)) that both pilots must be able to access and read the display. Examples of situations where this might be need ed are cases of display failure or when cross checking flight instruments. Readability must be maintained in sunlight viewing conditions per § 25.773(a) and under other adverse conditions such as vibration and turbulence.
Figures and letters should not extend below the visual angles defined in SAE ARP 4102-7 at the design eye position of the flight crewmember who normally uses the information.
(3) Color - § 25.1302.
(a) Avoid using many different colors to convey meaning on displays. If thoughtfully used, however, color can be very effective in minimizing display interpretation workload and response time. Color can be used to group logical electronic display functions or data types. A common color philosophy across the flightdeck is desirable, although deviations may be approved with acceptable justification. Information for color coding on flightdeck electronic displays is provided in AC 25-11A, Electronic Flight Control Displays.
(b) For visual alerts on multicolor displays, the colors red, amber, and yellow should be used consistently throughout the flight deck to maintain the effectiveness of an alert.
The applicant must limit the use of red, yellow, and amber for functions other than flightcrew alerting, so that misuse does not adversely affect flightcrew alerting per § 25.1322(f). Extensive use of red, yellow, and amber diminishes the attention-getting characteristics of warnings and cautions. This includes alert color consiste ncy among propulsion, flight, navigation, and other displays and indications used on the flight deck.
(c) Applicants should show the chosen color set is not susceptible to confusion or misinterpretation due to differences in color usage between displays. Improper color coding increases response times for display item recognition and selection, and increases likelihood of errors in situations where the speed of performing a task is more important than accuracy.
(d) Color, when used for task essential information, should be in addition to other coding characteristics, such as texture or differences in luminance to present information. AC 25-11A, Electronic Flight Control Displays, contains recommended color sets for specific display features.
(e) To meet the requirements in § 25.1302(b) applicants should show that layering information on a display does not add to confusion and clutter as a result of the color standards and symbols used. Avoid designs requiring flightcrew members to manually reduce the clutter of such displays.
(4) Symbology, text, and auditory messages
(a) Designs can base many elements of electronic display formats on established standards and conventional meanings. ICAO 8400 provides abbreviations and is one standard that could be applied to flightdeck text. SAE ARP 4102-7, Appendix A-C, and SAE ARP 5289 are acceptable standards for avionics display symbols.
(b) The position of a message or symbol within a display also conveys meaning to the flightcrew member. Without the consistent or repeatable location of a symbol in a specific area of the electronic display, interpretation errors and response times may increase.
(c) Applicants should give careful attention to symbol priority when displaying one symbol overlaying another symbol by editing out the secondary symbol, to ensure higher priority symbols remain viewable.
(d) New symbols, a new design, or a new symbol for a function historically associated with another symbol, should be tested for flightcrew comprehension, retention, and ability to distinguish from other symbols.
(e) The applicant should show display text and auditory messages are distinct and meaningful for the information presented. Section 25.1302 requires information intended for the flightcrew must be provided in a clear and unambiguous format in a resolution and precision appropriate to the task and that the information conveys the intended meaning. Equipment should display standard and/or non-ambiguous abbreviations and nomenclature, which should be consistent within a function and across the flightdeck.
c. Accessibility and Usability of Information.
(1) Accessibility of information - § 25.1302.
(a) Information intended for the flightcrew must be accessible and useable by the flightcrew in a manner consistent with the urgency, frequency, and duration of their tasks, per § 25.1302(b)(2). The flightcrew may, at certain times, need some information immediately.
Other information may not be necessary during all phases of flight. The applicant should show the flightcrew can access and manage (configure) all necessary information on the dedicated and multifunction displays for the phase of flight. The applicant should show any information required for continued safe flight and landing is accessible in the relevant degraded display modes following failures, as defined by § 25.1309(d)(1), (2), (3), and (4). The applicant must show, per § 25.1302(b), that supplemental information does not displace or otherwise interfere with required information.
(b) Analysis is not sufficient as the sole means of compliance for new or novel display management schemes. The applicant should use simulation or flight test of typical operational scenarios to validate the flightcrew’s ability to manage available information.
(2) Clutter - § 25.1302.
(a) Clutter is defined as the presentation of information in a way that distracts flightcrew members from their primary task(s). Visual or auditory clutter is undesirable. To reduce flight crewmember’s interpretation time, equipment should present information simply and in a well-ordered way. Applicants should show that an information delivery method, whether visual or auditory, presents the information the flight crewmember actually needs to perform the task at hand. The flightcrew can use their own discretion to limit the amount of information presented at any point in time. For instance, a design might allow the flightcrew to program a system so it displays the most important information all the time, and less important information on request. When a design allows flightcrew selection of additional information, the basic display modes should remain uncluttered.
(b) Display options that automatically hide information for the purpose of reducing visual clutter may hide needed information from the flight crewmember. If equipment uses automatic de-selection of data to enhance the flight crewmember’s performance in certain emergency conditions, the applicant must show, per § 25.1302(a), that it provides the information the flight crewmember needs. The use of part-time displays depends not only on the removal of clutter from the information, but also on the availability and criticality of the display.
Therefore, when designing such features, the applicant should follow the guidance in AC 25- 11A, Electronic Flight Control Displays.
(c) Because auditory information presentation is transient, designers should be careful to avoid the potential for competing auditory presentations that may conflict with each other and hinder interpretation. Prioritization and timing may be useful for avoiding this potential problem.
(d) Prioritize information according to task criticality. Lower priority information should not mask higher priority information. Higher priority information should be available, readily detectable, easily distinguishable, and usable per § 25.1302(b). For information on alerting priority, see § 25.1322 and AC 25.1322, Flight Crew Alerting.
(3) System response to control input - § 25.1302. Long or variable response times between control input and system response can adversely affect system usability. The applicant must show, per § 25.1302(a), that response to control input, such as setting values, displaying parameters, or moving a cursor symbol on a graphical display, is fast enough to allow the flightcrew to complete the task in an acceptable amount of time. For actions requiring noticeable system processing time, equipment must indicate system response is pending if awareness is required for safe operation, as stated in § 25.1302(b)(3).
5-6. System Behavior.
a. Introduction.
(1) As described in subchapter 5-2, § 25.1302(c) states installed equipment must be designed so that behavior of the equipment operationally relevant to the flightcrew’s tasks is:
(a) predictable and unambiguous, and
(b) designed to enable the flightcrew to intervene in a manner appropriate to the task and intended function.
(2) The requirement for operationally relevant system behavior to be predictable and unambiguous will enable a qualified flightcrew to know what the system is doing and why. This means a flightcrew should have enough information about what the system will do under foreseeable circumstances as a result of their action or a changing situation that they can operate the system safely, § 25.1302(b)(c). This requirement distinguishes system behavior from the functional logic within the system design, much of which the flightcrew does not know or need to know.
(3) If flightcrew intervention is part of the intended function, or part of non-normal procedures for the system, the flight crewmember may need to take some action, or change an input to the system. The system must be designed accordingly, per § 25.1302(c). The requirement for flightcrew intervention capabilities recognizes this reality.
(4) Improved technologies, which increased safety and performance, have also introduced the need to ensure proper cooperation between the flightcrew and the integrated, complex information and control systems in the airplane they operate. If system behavior is not understood or expected by the flightcrew, confusion may result.
(5) Some automated systems involve tasks that require flightcrew attention for effective and safe performance. Examples include the FMS or flight guidance systems.
Alternatively, systems designed to operate autonomously, in the sense that they require very limited or no human interaction, are referred to as “automatic systems.” Such systems are switched “on” or “off” or run automatically, and are not covered by § 25.1302(c). Examples include Full Authority Digital Engine Controls (FADEC) and yaw dampers. Specific detailed guidance for automatic systems can be found in relevant paragraphs of part 25.
(6) Service experience shows automated system behavior that is excessively complex or dependent on logical states or mode transitions the flightcrew does not understand or expect can lead to flightcrew confusion. Design characteristics such as these have been determined to contribute to incidents and accidents.
(7) Subchapter 5-6 provides guidance material for showing compliance with these design considerations for requirements found in §§ 25.1302(c), 25.1301(a), 25.1309(c), or any other relevant sections of part 25.