(a) Access and reach (to controls).
(b) Visibility and readability of displays and labels.
(c) An example of poor physical integration that affects visibility and readability is a required traffic avoidance system obscured by thrust levers in their normal operating position.
(d) Task-oriented location and grouping of human-machine interaction elements.
e. Integration Related Workload and Error.
(1) When integrating functions and/or equipment, designers should be aware of the potential effects, both positive and negative, that integration can have on flightcrew workload and its subsequent impact on error management. Systems should be designed and evaluated, both in isolation and in combination with other flightdeck systems, to ensure the flightcrew is able to detect, reverse, or recover from errors, § 25.1302(d). This process may be challenging when integrating systems that employ different kinds of automated systems or have a high degree of interaction and dependency on other flightdeck systems.
(2) Applicants should show the integrated design does not adversely impact workload, errors, or safe flightcrew performance per § 25.1302 given the context of the entire flight regime.
Examples of such impacts would be increased time to:
(a) interpret a function,
(b) make a decision, or
(c) take appropriate actions.
(3) Because each new system integrated into the flightdeck may have a positive or negative effect on workload, each must be evaluated both in isolation and in combination with the other systems for compliance with § 25.1523. This is to ensure the overall workload is acceptable, i.e., that performance of flight tasks is not adversely impacted and the flightcrew’s detection and interpretation of information does not lead to unacceptable response times. Special attention should be paid to part 25 Appendix D and, specifically, compliance for items that the appendix lists as (b), workload factors. These include “accessibility, ease, and simplicity of operation of all necessary flight, power, and equipment controls.”
(4) Two examples of integrated design features that may or may not impact error and workload are as follows:
(a) Presenting the same information in two different formats. Presenting altitude information concurrently in tape and round-dial formats, for example, may increase workload.
Yet different formats may be suitable depending on the design and the flightcrew task. An analog display of engine revolutions-per-minute can facilitate a quick scan, whereas a digital numeric display can facilitate precise inputs. The applicant is responsible for demonstrating 45
compliance with § 25.1523 and showing that differences in the formats of information presented do not result in unacceptable workload levels.
(b) Presenting conflicting information. Systems may exhibit minor differences between each flight crewmember station, but all such differences should be evaluated specifically to ensure that the potential for interpretation error is minimized, or that a method exists for the flightcrew to detect incorrect information, or that the effects of these errors can be precluded such as a baro-altimeter that is set wrong.
Chapter 6. Means of Compliance.
6-1. Overview.
This chapter discusses considerations in selecting and applying means of compliance in addressing human performance issues. These means of compliance are generic and have been used in certification programs. The acceptable means of compliance to be used on any given project should be determined on a case-by-case basis, driven by the specific compliance issues.
The applicant should develop and propose a means of compliance acceptable to the FAA, part
21. Uses and limitations of each type of compliance means are provided in subchapter 6-4.
6-2. Selecting Means of Compliance.
a. The means of compliance discussed in subchapter 6-4 include:
(1) statements of similarity,
(2) design description,
(3) calculations/analysis,
(4) evaluations, and
(5) tests.
b. No generic method can determine the appropriate means of compliance for a specific project. The choice of an appropriate complian ce means, or combination of several different means, depends on a number of factors specific to a project.
c. Some certification projects may need more than one way of demonstrating compliance with a particular requirement. When it is not possible to flight test a conformed airplane, for example, a combination of design review and part-task simulation evaluation may be proposed.
d. Answering the following questions will aid in selecting the means of compliance.
(1) With which means of compliance will it be possible to gather the required certification data?
(2) Will a single means of compliance provide all of the data or will several means be used in series or in parallel?
(3) What level of fidelity of the facility (test apparatus) is required to collect the required data? (Fidelity means to represent the function and behavior of the installed system.)
(4) Who will be the participants?
(5) What level of training is required prior to acting as a participant?
(6) How will data from an evaluation be presented to show compliance?
(7) Will results of a demonstration be submitted for credit?
(8) If a test is required, what degree of conformity for the test will be needed?
6-3. Discussion and Agreement with the FAA on Compliance Demonstrations.
The applicant’s proposal for means of compliance should be coordinated with the FAA to ensure all aspects necessary for desired credit towards certification are achieved (refer to §§ 21.15 and
21.17). The proposal should include the planned scenarios, the necessary types of human performance issues to be explored, or the conditions under which the test will be conducted so it provides a realistic environment for the evaluation.
6-4. Description of Means of Compliance.
The general means of compliance acceptable for use in demonstrating compliance related to flightdeck design are described in the following paragraphs.
a. Statement of similarity.
(1) Description: a statement of similarity is a description of the system to be approved, and a description of a previously approved system, which details the physical, logical, and operational similarities of the two systems as they relate to compliance with the requirements.
(2) Deliverable: a statement of similarity should be part of the certification report.
(3) Participants: not applicable.
(4) Conformity: not applicable.
(5) Uses: it may be possible to substantiate the adequacy of a design by comparing it to previously certificated systems that have shown they are robust with respect to their lack of contribution to flightcrew error and/or are robust in their ability to allow flightcrews to manage the situation should an error occur. This process avoids unnecessary repetition of effort to justify the safety of such systems.
(6) Limitations: the applicant should be careful when using a statement of similarity to show compliance. The flightdeck should be evaluated as a whole, not as merely a set of individual functions or systems. Two functions or features previously approved on separate airplanes may be incompatible when combined on a single flightdeck. Also, changing one 48
feature in a flightdeck may necessitate corresponding changes in other features, to maintain consistency and prevent confusion.
(7) Example: if the cursor control device in a new airplane is identical in design to that in an existing airplane, a statement of similarity may be an acceptable way to show compliance with § 25.1555(a), if other relevant airplane characteristics are also similar (e.g. flight deck geometry, flightcrew interfaces using the cursor, vibration conditions, etc.).
b. Design description. The applicant may elect to show the design meets requirements of a specific rule by describing the design. App licants have traditionally used drawings, configuration descriptions, and/or design philosophy to show compliance. Selection of participants and conformity are not relevant to this means of compliance.
(1) Drawings.
(a) Description: these may be layout drawings or engineering drawings, or both, which depict the geometric arrangement of hardware or display graphics.
(b) Deliverable: the drawing, which may be part of a certification report.
(c) Uses: the applicant may use drawings for very simple certification programs when the change to the flightdeck may be very simple and straightforward. Drawings may also be used to support findings of compliance for more complex interfaces.
(d) Limitations: the use of drawings is limited to physical arrangements and graphical concerns.
(2) Configuration description.
(a) Description: a configuration description should be a description of the layout, general arrangement, direction of movement, etc., of the regulated item. It may also be a reference to documentation, giving such a description (for example from a different project with a similar layout). It should be used to show the relative locations of flight instruments, groupings of control functions, allocation of color codes to displays and alerts, etc.
(b) Deliverable: the deliverable is a text explanation and, if appropriate, visual display of the certification item, which explains the functional aspects of the flightcrew interface with the system.
(c) Uses: configuration descriptions are generally less formalized than engineering drawings. They are developed to point out feat ures of the design that support a finding of compliance. In some cases, such configuration descriptions may provide sufficient information for a finding of compliance. More often, however, they provide important background information, while final confirmation of compliance is found through other means, such as demonstrations or tests. The background information provided by configuration descriptions 49
may significantly reduce the complexity and/or risk associated with demonstrations or tests. The applicant will have already communicated how a system works with the configuration description and any discussions or assumptions may have already been coordinated.
(d) Limitations: configuration descriptions may provide enough information to allow a finding of compliance with a specific requirement. More often, though, they provide important background information, while final confirmation of compliance is found by other means, such as demonstrations or tests. Background information provided by configuration descriptions may significantly reduce the complexity and/or risk associated with the demonstrations or tests.
(3) Design philosophy.
(a) Description: an overall safety-centered philosophy as explained in detail in the design specifications for the product, system, or flightdeck can be used to demonstrate a design philosophy.
(b) Deliverable: a text description of the certification item and/or a text description of the functional aspects of the flightcrew interface with the system, including figures and drawings as appropriate, and their relationship to the overall design philosophy.
(c) Uses: a design philosophy documents the ability of a design to meet requirements of a specific rule.
(d) Limitations: in most cases, this means of compliance will not be sufficient as the sole means to demonstrate compliance.
(e) Example: design philosophy may be used as a means of compliance when a new alert is added to the flightdeck if the new alert is consistent with the acceptable existing alerting philosophy.
c. Calculation/analysis.
(1) Description: calculations or engineering analyses may be analytical assessments, which do not require direct participant interaction with a physical representation of the equipment.
(2) Deliverable: a report with detailed results and conclusions that includes a thorough analysis with its components, evaluation assumptions, and the basis for decision making.
(3) Participants: conducted by the applicant.
(4) Conformity: not applicable.
(5) Uses: provides a systematic evaluation of specific or overall aspects of the human interface part of the product, system, and flightdeck. May be specified by guidance material.
(6) Limitations: the applicant should carefully consider the validity of the assessment technique if the analyses are not based on advisory material or accepted industry standard methods. The FAA may ask the applicant to validate any computational tools used in such analyses. If analysis involves comparing meas ured characteristics to recommendations derived from pre-existing research, either internal or public domain, the FAA may ask the applicant to justify the applicability of data to the project.
(7) Example: an applicant may conduct a vision analysis to demonstrate the flightcrew has a clear and undistorted view out the windows. Similarly, an analysis may also demonstrate flight, navigation, and powerplant instruments are plainly visible from the flightcrew member station. The applicant may need to validate results of the analysis in ground or flight tests.
d. Evaluations. The applicant may use a wide variety of part-task to full-installation representations of the product/system or flightdeck for evaluations. All of these have two characteristics in common. First, the representation of the human interface and the system interface do not necessarily conform to the final documentation. Second, the certification official is generally not present. The table below addresses mock-ups, part-task simulations, full simulations, and in-flight evaluations that typically make up this group of compliance means. A mock-up is a full-scale, static representation of the physical configuration that includes fit and form. It does not include functional aspects of the flightdeck and its installed equipment.
(1) Description: evaluations are assessments of the design conducted by the applicant (or their agent), who then provides a report of the results to the FAA.
(2) Deliverable: a report, delivered to the FAA.
(3) Participants: applicant and possibly the FAA.
(4) Facilities: an evaluation may be conducted in a mock-up, on a bench, in a laboratory, simulator, or aircraft.
(5) Conformity: not required.
(6) Mock-up evaluation: the applicant may use mock-ups as representations of the design, allowing participants to physically interact with the design. Three-dimensional representations of the design in a computer aided design (CAD) system, in conjunction with three-dimensional models of the flightdeck occupants, have also been used as “virtual” mock-ups for certain limited types of evaluations. Reach assessments, for example, can use either type of mock-up.
(7) Example of a mock-up evaluation: one example might be an analysis to demonstrate that controls are arranged so flightcrew members from 1.58 m (5 ft., 2 inches) to 51
1.91 m (6 ft., 3 inches) in height can reach all the controls. This analysis should also consider differences in anatomy, such as functional arm reach, leg length, and other relevant body measurements. It may use computer generated data based on engineering drawings. The applicant may demonstrate results of the analysis in the actual aircraft.
(8) Bench or laboratory evaluation: the applicant may conduct an evaluation using devices that emulate the flightcrew interfaces for a single system or for a related group of systems. The applicant can use flight hardware, simulated systems, or combinations of them.
(9) Example of a bench or laboratory evaluation: a bench evaluation for an integrated system could be conducted with an avionics suite installed in a mock-up of a flightdeck, with the main displays and autopilot controllers included. Such a tool may be valuable during development and valuable for providing system familiarization to the FAA. In a highly integrated architecture, however, it may be difficult or impossible to assess how well the avionics system will fit into the overall flightdeck without more complete simulation or use of the actual airplane.
(10) Simulator evaluation: a simulator evaluation uses devices that present an integrated emulation of the flightdeck and the operational environment by using flight hardware, simulated systems, or combinations of them. The devices may also be “flown,” with response characteristics that replicate, to some extent, the responses of the airplane. The simulation of functional requirements and the physical fidelity of the requirements, or degree of realism, will typically depend on the configurations, functions, tasks, and equipment being evaluated.
(11) Aircraft evaluation: an evaluation conducted in the actual aircraft.
(12) These evaluation activities result in better designs that are more likely to comply with the applicable requirements.
(13) Limitations: evaluations are limited by the extent to which the facilities actually represent the flightdeck configuration and realistically represent flightcrew tasks. As flightdeck systems become more integrated, part-task evaluations may become less useful as a means of compliance, even though their utility as engineering tools may increase.
e. Tests. Tests are means of compliance conduc ted in a manner very similar to evaluations described above, with one significant difference. Tests require an actual conforming product/system and system interface. A test may be conducted on a bench, in a laboratory, in a simulator, or on an airplane.
(1) Description: tests are assessments of the design conducted with the FAA certifying official present.
(2) Deliverable: a report is delivered to the FAA.
(3) Participants: applicant and possibly the FAA.
(4) Facilities: a test may be conducted on a bench or in a laboratory, simulator, or an aircraft.
(5) Conformity: the product/system, flightdeck, and/or system interface being evaluated must be conformed to show compliance per part 21. A simulator must be conformed per § 60.13.
(6) Bench or laboratory test: this type of testing is usually confined to showing components perform as designed. Bench tests are usually not enough to stand alone as a means of compliance. They can, however, provide useful supporting data in combination with other means.
(7) Example of a bench or laboratory test: the applicant might show visibility of a display under the brightest of expected lighting conditions with a bench test, provided there is supporting analysis to define the expected lighting conditions. Such supporting information might include a geometric analysis to show potential directions from which the sun could shine on the display, with calculations of expected viewing angles. These conditions might then be reproduced in the laboratory.
(8) Conformity related to a bench or laboratory test: the part or system must be conformed to show compliance, per part 21.
(9) Simulator test: a simulator test uses devices that present an integrated emulation of the flightdeck and the operational environment by using flight hardware and software, simulated systems, or combinations of these. The devices may also be “flown,” with response characteristics that replicate the responses of the airplane. The applicant should determine the physical and functional fidelity requirements of the simulation as a function of the issue under evaluation.
(10) Simulator test conformity and fidelity issues: only conforming parts of the flightdeck may be used for simulator tests. Applicants may use a flightcrew training simulator to validate most of the normal and emergency procedures for the design, and any workload effects of the equipment on the flightcrew. If the flightdeck is fully conforming, and the avionics are driven by conforming hardware and software, then the applicant may conduct and use integrated avionics tests to show compliance. Not all aspects of the simulation must have a high level of fidelity for any given compliance issue (see § 60.11). Fidelity requirements can be assessed in consideration of the issue being evaluated.
(11) Airplane test: airplane tests may be conducted either on the ground or in flight.
(12) Example of an airplane test: an example of a ground test is an evaluation of the potential for reflections on displays. Such a test usually involves covering the flightdeck windows to simulate darkness and setting the flightdeck lighting to desired levels. This particular test may not be possible in a simulator because of differences in the light sources, 53
display hardware, and/or window construction. Flight testing during certification is the final demonstration of the design. These tests are conducted on a conforming airplane during flight.
The airplane and its components (flightdeck) are the most representative of the type design to be certified and will be the closest to real operations of the equipment. In-flight testing is the most realistic testing environment, although it is limited to those evaluations that can be conducted safely. Flight testing may be used to validate and verify other tests previously conducted during the development and certification program. It is often best to use flight testing as final confirmation of the data collected that used other means of compliance, including analyses and evaluations.
(13) Limitations of flight tests: flight tests may be limited by the extent to which flight conditions of particular interest such as weather, failure, or unusual attitudes can be found or produced, and then safely evaluated in flight. Also, note that flight testing on the airplane provides the least control over conditions of any of the means of compliance. The FAA and the applicant should thoroughly discuss how and when flight tests and their results will be used to show compliance.
Appendix A. Related Documents.
A-1. Additional Requirements.
The following is a list of requirements, means of compliance, and other documents relevant to flightdeck design and flightcrew interfaces which may be useful when reviewing this AC.
Table A-1. Part 25 Requirements.
Part 25 Requirements General topic § 25.771(a) Unreasonable concentration or fatigue § 25.771(c) Equipment controllable from either pilot seat § 25.773 Pilot compartment view § 25.777(a) Location of cockpit controls and inadvertent operation § 25.777(b) Direction of movement of cockpit controls § 25.777(c) Full and unrestricted movement of controls § 25.1301(a) Intended function of installed systems § 25.1302 Flightcrew error § 25.1303 Flight and navigation instruments § 25.1309(a) Intended function of required equipment under all operating conditions § 25.1309(c) Unsafe system operating conditions. System design to minimize flightcrew errors which could create additional hazards § 25.1321 Visibility of instruments § 25.1322 Warning, caution, and advisory lights § 25.1329 Autopilot, flight director, and autothrust § 25.1523 Minimum flightcrew and workload § 25.1543(b) Visibility of instrument markings § 25.1555(a) Control markings § 25.1549 Powerplant and auxiliary power unit instruments Part 25 Appendix D Criteria for determining minimum flightcrew A-2. Orders and Policy Related to this AC.
a. Policy Memo ANM-99-2, Guidance for Reviewing Certification Plans to Address Human Factors for Certification of Transport Airplane Flightdecks, dated 09/29/1999.
b. Policy Memo PS-ANM100-01-03A, Factors to Consider When Reviewing an Applicant’s Proposed Human Factors Methods of Compliance for Flightdeck Certification, dated 02/07/2003.
A-1
A-3. FAA Advisory Circulars Referenced in this AC.
AC Number AC Title 25-11A Electronic Flight Deck Displays 20-88A Marking of Aircraft Powerplant Instruments
25.1322 Flight Crew Alerting
25.1329-1B Approval of Flight Guidance Systems A-4. Other Documents.
The following is a list of other documents relevant to flightdeck design and flightcrew interfaces. Some contain special constraints and limitations, particularly those that are not aviation specific. For example, Internationa l Standard Organization (ISO) 9241-4 has much useful guidance that is not aviation specific. When using that document, applicants should consider environmental factors such as the intended operational environment, turbulence, and lighting as well as cross-flightdeck side reach.
a. SAE International.
(1) SAE ARP 4033, Pilot-System Integration, August 1995.
(2) SAE ARP 5289A, Electronic Aeronautical Symbols, August 2011.
(3) SAE ARP 4102/7, Electronic Displays, November 1998.
b. FAA.
(1) FAA Human Factors Team report on: The Interfaces Between Flightcrews and Modern Flightdeck Systems, 1996.
c. Department of Transportation (DOT).
(1) DOT/FAA/RD –93/5: Human Factors for Flightdeck Certification Personnel, 1993.
d. International Civil Aviation Organization (ICAO).
(1) ICAO 8400/5, Procedures for Air Navigation Services ICAO Abbreviations and Codes. Ed 8 - 2010.
(2) ICAO Human Factors Training Manual: DOC 9683 – AN/950, 1998.
(3) International Standards ISO 9241-4, Ergonomic Requirements for Office Work with Visual Display Terminals (VDTs), 1998.
A-2