b. System Function Allocation.
(1) To meet the general requirements of § 25.1302, the applicant must show that functions of the proposed design are allocated so that:
(a) the flightcrew can be expected to complete their allocated tasks successfully in both normal and non-normal operational conditions, within the bounds of acceptable workload and without requiring undue concentration, exceptional skill or strength, or causing undue fatigue (see § 25.1523, part 25 Appendix D, and AC 25.1523 for workload evaluation).
Flightcrew population demographics should be considered (for example age and gender) when determining exceptional strength;
(b) the flightcrew’s interaction with the system enables them to understand the situation, and enables timely detection of failures and flightcrew intervention when appropriate;
and
(c) task sharing and distribution of tasks among flightcrew members and the system during normal and non-normal operations is considered.
c. System Functional Behavior.
(1) A system’s behavior results from the interaction between the flightcrew and the automated system. The system’s behavior should be determined by:
(a) the system’s functions and the logic that governs its operation; and
(b) the user interface, which consists of the controls and information displays that communicate the flightcrew’s inputs to the system and provide feedback on system behavior to the flightcrew.
(2) The design should consider both the system’s functions and the user interface together. This approach should avoid a design in which the functional logic that governs system behavior can have an unacceptable effect on flightcrew performance, see § 25.1302(c).
Examples of system functional logic and system behavior issues that may be associated with errors and other difficulties for the flightcrew include the following:
(a) Complexity of the flightcrew interface for both control actuation and data entry, and complexity of the corresponding system indications provided to the flightcrew.
(b) Inadequate understanding and inaccurate expectations of system behavior by the flightcrew following mode selections and transitions.
(c) Inadequate understanding and incorrect expectations by the flightcrew of what the system is preparing to do next and how it is behaving.
(3) The system or system mode behavior must be predictable and unambiguous, per § 25.1302(c)(1).
(a) Behavior that is ambiguous or unpredictable to the flightcrew can cause or contribute to flightcrew errors. It can also potentially degrade the flightcrew’s ability to perform their tasks in both normal and non-normal conditions. Certain design considerations have been found to minimize flightcrew errors and other flightcrew performance problems as discussed below.
(b) The following design considerations are applicable to operationally relevant system behavior and to the modes of operation of the systems:
1 The design should be simple.
2 Mode annunciation should be clear and unambiguous. As an example, a mode engagement or arming selection by the flightcrew should result in annunciation, indication, or display feedback adequate to make the flightcrew aware of the effects of their action.
Additionally, any change in the mode as a result of the aircraft’s changing from one operational mode (for instance, on an approach) to another should be clearly and unambiguously annunciated and fed back to the flightcrew.
3 Methods of mode arming, engagement and de-selection should be accessible and usable. For example, the flightcrew actions necessary to arm, engage, disarm, or disengage an autopilot mode should not be dependent on the mode the system is in. Requiring a different flightcrew action for each mode could contribute to errors. For specific guidance on flight guidance system modes, see AC 25.1329-1B, Approval of Flight Guidance Systems.
4 Uncommanded mode changes and reversions should have sufficient annunciation, indication, or display information to provide awareness of uncommanded changes of the engaged or armed mode of a system (§ 25.1302(b)(3)).
5 The current mode should remain identified and displayed at all times.
(c) Formal descriptions of modes typically define them as mutually exclusive, so that a system cannot be in more than one mode at a time. A map depiction can be in “north up” mode or “track up” mode, but not in both modes at the same time.
(4) Flightcrew Intervention - § 25.1302(c)(2).
(a) Applicants should propose how they will show their design will allow the flightcrew to intervene in the operation of the system without compromising safety. The means of showing compliance should include descriptions of how the intervention of functions and conditions is possible.
(b) If the means of showing compliance is by analysis, the applicant should describe it thoroughly. In a ddition, applicants’ proposed methods should describe how they would determine that each intervention means is appropriate to the task.
(5) Controls for Automated Systems.
(a) Automated systems can perform various tasks selected by and supervised by the flightcrew. Controls should be provided for managing functionalities of such a system or set of systems. The design of such “automation specific” controls per § 25.1302 should enable the flightcrew to do the following:
1 Safely prepare the system for the immediate task to be executed or the subsequent task to be executed. Preparation of a new task (for example, new flight trajectory) should not interfere with, or be confused with, the task currently being executed by the automated system.
2 Activate the appropriate system function and clearly understand what is being controlled and what the flightcrew expects. For example, the flightcrew must clearly understand they can set either vertical speed or flight path angle when they operate a vertical speed indicator.
3 Manually intervene in any system function, as required by operational conditions, or revert to manual control. For example, manual intervention might be necessary if a system loses functions, operates abnormally, or fails.
(6) Displays for Automated Systems.
(a) Automated systems may perform various tasks with minimal flightcrew interventions, but under supervision of the flightcrew. To ensure effective supervision and maintain flightcrew awareness of system state and system “intention” for safe operation (future states), displays should, per § 25.1302(b)(3,), provide recognizable feedback on the following:
1 Entries made by the flightcrew into the system, so the flightcrew can detect and correct errors.
2 The present state of the automated system or mode of operation (i.e., “What is it doing?”).
3 Actions taken by the system to achieve or maintain a desired state (i.e., “What is it trying to do?”).
4 Future states scheduled by the automated system (i.e., “What is it going to do next?”).
5 Transitions between system states.
(7) The applicant should consider the following aspects of automated system design:
(a) Indications of commanded and actual values should enable the flightcrew to determine whether the automated systems will perform according to their expectations, as stated in § 25.1302(c)(1).
(b) If the automated system nears its operating limit, or is operating abnormally, or can’t operate at a selected level, it must inform the flightcrew of its operating limitations, § 25.1309(c)(2).
(c) The automated system must, per § 25.1302(b)(3), support flightcrew coordination and cooperation by ensuring shared awareness of system status and flightcrew inputs to the system, if required for safe operation.
(d) The automated systems should enable the flightcrew to review and confirm the accuracy of commands constructed before they are activated. This is particularly important for automated systems, because they can require complex input tasks.
5-7. Flightcrew Error Management.
a. Showing compliance with § 25.1302(d).
(1) It is important to recognize flightcrews will make errors, even when they are well trained, experienced, rested, and are using well-designed systems. To address this reality, § 25.1302(d) states that— To the extent practicable, installed equipment must incorporate means to enable the flightcrew to manage errors resulting from the kinds of flightcrew interactions with the equipment that can be reasonably expected in service. This sub-parag raph (d) does not apply to any of the following:
(a) skill-related errors associated with manual control of the airplane;
(b) errors that result from decisions, actions, or omissions committed with malicious intent;
(c) errors arising from a flight crewmember’s reckless decisions, actions, or omissions reflecting a substantial disregard for safety; and
(d) errors resulting from acts or threats of violence, including actions taken under duress.
(2) To comply with the § 25.1302(d) requirement that a design enables the flightcrew to “manage errors,” to the extent practicable, the installed equipment design should meet the following criteria:
(a) Enable the flightcrew to detect (see subchapter 5-7b), and/or recover from errors (see subchapter 5-7c);
(b) Ensure effects of flightcrew errors on the airplane functions or capabilities are evident to the flightcrew and continued safe flight and landing is possible (see subchapter 5-7d);
(c) Discourage flightcrew errors by using switch guards, interlocks, confirmation actions, or similar means, and
(d) Preclude the effects of errors through system logic and/or redundant, robust, or fault tolerant system design (see subchapter 5-7e).
(3) The criteria in 5-7a.(2):
(a) Recognize and assume flightcrew errors cannot be entirely prevented, and that no validated methods exist to reliably predict either their probability or all the sequences of events with which they may be associated; and
(b) Call for means of compliance that are methodical and complementary to, and separate and distinct from, airplane system analysis methods such as system safety assessments.
(4) As discussed previously in subchapter 5-2, compliance with § 25.1302(d) is not intended to require consideration of errors resulting from acts of violence or threats of violence.
Additionally, the requirement is intended to require consideration of only those errors that are design-related.
(5) Errors from design-related problems are within the scope of this regulatory and advisory material. One example is a design that is incompatible with the procedure by which it is used. Other design examples are indicators an d controls that are complex and inconsistent with each other or other systems on the flightdeck.
(6) When demonstrating compliance, the applicant should evaluate flightcrew tasks in both normal and non-normal conditions, considering that many of the same design characteristics are relevant in either case (see §§ 25.1523, and 25.1585). For example, under non-normal conditions, the flying tasks required for normal conditions such as navigation, communication and monitoring, are generally still present, although they may be more difficult to carry out.
Therefore, tasks associated with the non-normal conditions should be considered additive. The applicant should not expect the possible errors considered to be different from those that would occur in normal conditions, but any evaluation should account for the change in expected tasks.
(7) To show compliance with § 25.1302(d), an applicant may employ any of the general types of methods of compliance discussed in Chapter 6 by itself or in combination.
These methods should be consistent with an approved certification plan as discussed in Chapter 4, and account for the objectives above and the considerations described below. When using some of these methods, it may be helpful for some applicants to refer to other related references 37
to understand error occurrence. A brief summary of those methods and how they can be applied to address flightcrew error considerations follows.
(a) Statement of similarity (subchapter 6-4): A statement of similarity may be used to show the design has sufficient certification precedent to allow the ACO to conclude the flightcrew’s ability to manage errors is not significantly changed. Applicants may also use service experience data to identify errors known to commonly occur for similar flightcrew interfaces or system behavior. As part of showing compliance, the applicant should identify steps taken in the new design to avoid or mitigate similar errors.
(b) Design descriptions (subchapter 6-4): Applicants may structure design descriptions and rationale to show how various types of errors are considered in the design and how they are addressed, mitigated, or managed. Applicants can also use a description of how the design adheres to an established and valid design philosophy to show the design enables flightcrews to manage errors.
(c) Calculation and engineering analysis (subchapter 6-4): As one means of showing compliance with § 25.1302(d), an applicant may document means of error management through analysis of controls, indications, system behavior, and related flightcrew tasks. The applicant should understand what potential errors can occur and ways the flightcrew can manage those errors in order to document error management. In most cases, the probability of flightcrew errors can’t be predicted. If an applicant choos es to use a quantitative approach, the validity of the approach should be established.
(d) Evaluations, demonstrations, and tests (subchapter 6-4): For compliance purposes, evaluations are intended to identify error possibilities that may be considered for mitigation in design or training. In any case, scenario objectives and assumptions should be clearly stated before running the evaluations, demonstrations, or tests. In that way, any discrepancy in those expectations can be discussed and explained in the analysis of the results.
(8) As discussed further in Chapter 6, these evaluations, demonstrations, or tests should use appropriate scenarios that reflect intended function and tasks, including use of the equipment in both normal and non-normal conditions. Scenarios should consider flightcrew errors. The use of inappropriate scenarios can re sult in incorrect conclusions. If no errors occur during an evaluation, it may only mean the scenarios are too simple, incomplete, or not fully representative. On the other hand, if some errors do occur, it may mean any of the following:
(a) The design, procedures or training should be modified;
(b) The scenarios are unrealistically challenging; or
(c) Not enough training occurred prior to the evaluation.
(9) In such evaluations, it is not feasible to establish criteria for error frequency.
b. Error Detection.
(1) Applicants should design equipment to provide information so the flightcrew can become aware of an error or a system/airplane state resulting from a system action. Applicants should show that this information is available to the flightcrew, is adequately detectable, and that it shows a clear relationship between flightcrew action and the error so recovery can be made in a timely manner, per § 25.1302(b)(2).
(2) Information for error detection may take three basic forms.
(a) Indications provided to the flightcrew during normal monitoring tasks.
1 As an example, if an incorrect knob was used, resulting in an unintended heading change, the change could be detected through the display of target values. Presentation of a temporary flight plan for flightcrew review before accepting it would be another way of providing an opportunity of detecting errors.
2 Indications on instruments in the primary field of view used during normal operation may be adequate if the indications themselves contain information used on a regular basis and are provided in a readily accessible form. These may include mode annunciations and normal airplane state information such as altitude or heading. Other locations for the information may be appropriate depending on the flightcrew’s tasks, such as on the control-display unit when the task involves dealing with a flight plan (see subchapter 5-5).
(b) Flightcrew indications that provide information of an error or a resulting airplane system condition. See § 25.1322 and AC 25.1322, Flight Crew Alerting, for flightcrew alerting requirements and guidance 1 An alert that could activate after a flightcrew error may be a sufficient means for the applicant to show that information about an error exists and that the error is adequately detectable, if the alert directly and appropriately relates to the error. If the content of the alert does not directly relate to the error, the indication may lead the flightcrew to believe there may be non-error causes for the annunciated condition.
2 If flightcrew error is only one of several possible causes for an alert about a system, then the information that the alert provides is insufficient. If, on the other hand, additional information is available that would allow the flightcrew to identify and correct the error, then the alert in combination with the additional information would be sufficient to comply with § 25.1302(d) for that error.
3 An error detectable by the system should provide an alert and provide sufficient information that a flightcrew error has occurred, such as in the case of a takeoff configuration warning. On the other hand, an alert about the system state resulting from accidentally shutting down a hydraulic pump, for example, may not provide sufficient information to the flightcrew to enable them to distinguish an error from a system fault. In this 39
case, flight manual procedures may provide the error detection means as the crew performs the “Loss of Hydraulic System” procedures.
4 If the system can detect pilo t error, the system could be designed to prevent pilot error. For example, if the system can detect an incorrect frequency entry by the pilot, then the system should be able to disallow that entry and provide appropriate feedback to the pilot. Examples are automated error checking and filters that prevent entry of unallowable or illogical entries.
(c) “Global” alerts cover a multitude of possible errors by annunciating external hazards, or the airplane envelope, or operational conditions. Examples include monitoring systems such as Terrain Awareness Warning System (TAWS) and Traffic Alert and Collision Avoidance System (TCAS). An example would be a TAWS alert resulting from turning the wrong direction in a holding pattern in mountainous terrain.
(3) The applicant should consider the following when establishing whether the information is available to the flightcrew, whether it is adequately detectable, and whether it is clearly related to the error:
(a) Effects of some errors are easily and reliably determined by the system because of its design, and some are not. For errors the system cannot sense or detect, the design and arrangement of the information monitored and scanned by the flightcrew can facilitate error detection. An example would be alignment of engine speed indicator needles in the same direction during normal operation. Failure of the needles to align in the same direction during normal operation would indicate a problem with one of the engines, since one engine would be going at a different speed than the other engine.
(b) Airplane alerting and indication systems may not detect whether an action is erroneous because systems cannot know flightcrew intent for many operational circumstances.
In such cases, reliance is often placed on the flightcrew’s ability to scan and observe indications that will change as a result of an action, such as selecting a new altitude or heading, or making a change to a flight plan in an FMS. When errors occur in the process of carrying out these kinds of tasks, detection depends on flightcrew interpretation of available information. Training, flightcrew resource management, and monitoring systems such as TAWS and TCAS are examples of ways to provide a redundant level of safety if any or all of the flightcrew members fail to detect certain errors.
(c) Some information, such as that provided by powerplant instruments, must be clearly indicated and readily available, as stated in § 25.1549. Guidance is provided in AC 20- 88A, Guidelines on the Marking of Aircraft Powerplant Instruments (displays).
(4) In some cases, (see part 6-4) piloted evaluations may be needed to assess whether the information provided is available and detectable since design descriptions related to error detection may not be adequate.
c. Error Recovery.
(1) Assuming the flightcrew detects errors or their effects, the next logical step is to ensure the error can be reversed, or the effect of the error can be mitigated in some way so the airplane remains in, or is returned to, a safe state.
(2) To establish in an acceptable means that an error can be recovered, you must show that:
(a) controls and indications exist that can be used either to reverse an erroneous action directly so that the airplane or system is returned to the original state, or to mitigate the error’s effect so that the airplane or system is returned to a safe state, and
(b) the flightcrew can be expected to use those controls and indications to accomplish the corrective actions in a timely manner.
(3) To establish the adequacy of controls and indications that facilitate error recovery, a statement of similarity or a design description of the system and flightcrew interface may be sufficient. For simple or familiar types of system interfaces, or systems that are not novel, even if complex, a statement of similarity or design description of the flightcrew interfaces and procedures associated with indications may be an acceptable means of compliance.
(4) To establish the flightcrew can be expected to use those controls and indications to accomplish corrective actions in a timely manner, evaluation of flightcrew procedures in a simulated flightdeck environment can be highly effective. This evaluation should include examination of nomenclature used in alert messages, controls, and other indications. It should also include the logical flow of procedural steps and the effects executing the procedures have on other systems.
d. Error Effects.
(1) Another means of mitigating the effects of errors is to ensure effects of the error or relevant effects on airplane state:
(a) are evident to the flightcrew, and
(b) do not adversely impact safety (do not prevent continued safe flight and landing).
(2) Piloted evaluations in the airplane or in simulation may be relevant if flightcrew performance issues are in question for determining whether a state following an error permits continued safe flight and landing. Evaluations and/or analyses should be used to show that, following an error, the flightcrew has the information in an effective form and has the airplane control capability necessary to continue safe flight and landing.
e. Precluding Errors and Error Effects.
(1) The design should provide a way to discourage irreversible errors that have potential safety implications. Acceptable ways to discourage errors include switch guards, interlocks, or multiple confirmation actions. As an example, generator drive controls on many airplanes have guards over the switches to discourage inadvertent actuation, because once the drives are disengaged, they cannot be re-engaged while in flight or with the engine running. An example of multiple confirmations would be the presentation of a temporary flight plan that the flightcrew can review before accepting.
(2) Another way of avoiding flightcrew error is to design systems to remove misleading or inaccurate information, which might result from sensor failures, or from inadequate displays. An example would be a syst em that removes flight director bars from a primary flight display or removes the “own-ship” position from an airport surface map display when the data driving the symbols is invalid.
(3) The applicant should avoid applying an excessive number of protections for a given error. Excessive use of protec tions could have unintended safety consequences. They might hamper the flightcrew members’ ability to use judgment and take actions in the best interest of safety in situations not predicted by the applicant. If protections become a nuisance in daily operation, flightcrews may circumvent them. This could have further effects not anticipated by the operator or by the designer.
5-8. Integration.
a. Introduction.
(1) Many systems, such as the Flight Management System, (FMS), are integrated physically and functionally into the flightdeck and will interact with other flightdeck systems. It is important to consider a design not just in isolation, but in the context of the overall flightdeck.
Integration issues include: where a display or control is installed, how it interacts with other systems, and whether there is internal consistency across functions within a multifunction display, as well as consistency with the rest of the flightdeck’s equipment.
(2) Section 25.1302 requires that “…installed equipment, individually and in combination with other such equipment, is designed so that qualified flightcrew members trained in its use can safely perform all tasks associated with the equipment’s function .… To comply with this integration requirement, all flightdeck equipment must be usable by the flightcrew to perform all tasks associated with the intended functions, in any combination reasonably expected in service. Flightdeck equipment includes interfaces to airplane systems the flightcrew interacts with, such as controls, displays, indications, and annunciations.
(3) Analyses, evaluations, tests, and other data developed to establish compliance with each of the specific requirements in § 25.1302(a) through (d) should address integration of new 42
or novel design features or equipment with previously approved features or equipment as well as with other new items. It should include consideration of the following integration factors:
(a) consistency,
(b) consistency trade-offs,
(c) flightdeck environment, and
(d) integration related workload and error.
b. Consistency.
(1) The applicant should consider consistency within a given system and across the flightdeck. Inconsistencies may result in vulnerabilities, such as increased workload and errors, especially during stressful situations. For example, in some FMS’s, the format for entering latitude and longitude differs across the display pages. This may induce flightcrew errors, or at least increase flightcrew workload. Additionally, errors may result if latitude and longitude are displayed in a format that differs from formats on the most commonly used paper charts.
Because of this, it is desirable to use formats consistent with other media whenever possible.
Although trade-offs exist, as discussed in the next paragraph, the following are design attributes to consider for consistency within and across systems:
(a) Symbology, data entry conventions, formatting, color philosophy, terminology, and labeling.
(b) Function and logic. For example, when two or more systems are active and performing the same function, they should operate consistently and use the same style interface.
(c) Information presented with other information of the same type used in the flightdeck. As an example, navigation sym bols used on other flightdeck systems or on commonly used paper charts could be used on electronic map displays.
(d) The operational environment. For example, it is important that an FMS should be consistent with the operational environment, so the order of the steps required to enter a clearance into the system is consistent with the order in which they are given by air traffic management.
(2) One way the applicant can achieve consistency within a given system, as well as within the overall flightdeck, is to adhere to a comprehensive flightdeck design philosophy.
Another way is to standardize aspects of the design by using accepted, published industry standards such as the labels and abbreviations recommended in ICAO 8400/5. The applicant might standardize symbols used to depict navigation aids, such as Very High Frequency Omnidirectional Range (VOR) beacons, by following the conventions recommended in SAE document ARP 5289. On the other hand, inappropriate standardization, rigidly applied, can be a barrier to innovation and product improvement. Standardization could also result in a standard to the lowest common denominator. Thus, guidance in this paragraph promotes consistency rather than rigid standardization.
c. Consistency Trade-offs.
(1) While strongly encouraged, the FAA recognizes it is not always possible to provide a consistent flightcrew interface. Despite conformance with a flightdeck design philosophy, principles of consistency, etc., it is possible to negatively impact flightcrew workload. As an example, all the auditory alerts in a design may adhere to a flightdeck alerting philosophy, but the number of alerts may be unacceptable. Consistent format across the flightdeck may not work when individual task requirements necessitate presentation of data in two significantly different formats. An example is a weather radar display formatted to show a sector of the environment, while a moving map display shows a 360 degree view. In such cases, the applicant should show that the interface design is compatible with the requirements of the piloting task and that it can be used individually and in combination with other interfaces without interference to either system or function. Additionally:
(a) The applicant should provide an analysis identifying each piece of information or data presented in multiple locations and show the data are presented in a consistent manner or, where that is not true, justify why that is not appropriate.
(b) Where information is inconsistent, the inconsistency should be obvious or annunciated, and should not contribute to errors in information interpretation.
(c) The applicant should provide a rationale for instances where a system’s design diverges from the flightdeck design philosophy. C onsider any impact on workload and errors as a result of this divergence.
(d) The applicant should describe what conclusion the flightcrew is expected to draw and what action should be taken when information on the display conflicts with other information on the flightdeck either with or without a failure.
d. Flightdeck Environment.
(1) The physical configuration of the airplane and its operating environment influence the integration and placement of the flightdeck system. The system is subject to influences on the flightdeck such as turbulence, noise, ambient light, smoke, and vibrations (e.g., as may result from ice or fan blade loss). System design should recognize the effect of such influences on usability, workload, and flightcrew task performance. Turbulence and ambient light, for example, may affect readability of a display. Flightdeck noise may affect audibility of aural alerts. The applicant should al so consider the impact of the flightdeck environment for nonnormal situations, such as recovering from an unusual attitude or regaining control of the airplane or system. Also refer to AC 25-11A for guidance on information display usability.
(2) The flightdeck environment includes the layout, or physical arrangement, of the controls and information displays. The layout should take into account the flightcrew requirements in terms of: