Note: Green is usually used to indi cate “normal” conditions; therefore, it is not an appropriate color for an advisory alert. An advisory alert is used to indicate a “non-normal” condition.
b. A separate and distinct color should be used to distinguish between caution and advisory alerts. If a distinctive color is not used to distinguish between caution and advisory alerts, other distinctive coding techniques must be used to meet the general requirements of § 25.1322(a)(2) so that the flightcrew can readily and easily detect the difference between caution and advisory alerts.
c. The color displayed for the visual master warning alert must be the same color used for the associated warning alerts and the color displayed for the master caution alert must be the same color used for the associated caution alerts (§ 25.1322(e)(1)).
d. The colors red, amber, and yellow must be used consistently (§ 25.1322 (e)(1)). This includes alert color consistency among propulsion, flight, navigation, and other displays and indications used on the flight deck.
e. For monochromatic displays that are not capable of conforming to the color convention required by § 25.1322(e)(2), use display coding techniques (for example, shape, size, and position) so the flightcrew can clearly distinguish between warning, caution, and advisory alerts.
This requirement is similar to using selected color coding on multicolor displays that allows the flightcrew to easily distinguish between warning, caution, and advisory alerts (§ 25.1322(e)).
These coding techniques must also meet the general alerting requirement in § 25.1322(a)(2) so the alerts are readily and easily detectable and intelligible by the flightcrew under all foreseeable operating conditions, including conditions where multiple alerts are provided. The wide use of monochromatic displays on the flight deck with flightcrew alerting is normally discouraged, except when an increased safety benefit is demonstrated, for example, a HUD used as a primary flight display.
f. Section 25.1322(f) requires that the use of red, amber, or yellow for functions other than flightcrew alerting of non-normal conditions be limited and not adversely affect flightcrew alerting of non-normal conditions. Consistent use and standardization for red, amber, and yellow is required to retain the effectiveness of flightcrew alerts. It is important that the flightcrew does not become desensitized to the meaning and importance of color coding for alerts, which could increase the flightcrew’s processing time, add to their workload, and increase the potential for flightcrew confusion or errors.
g. Where red, amber and yellow are proposed for non-flightcrew alerting functions, substantiate that there is an operational need to use these colors to provide safety related awareness information. Examples of acceptable uses of red, amber, or yellow for non-alerting functions include:
Weather radar display (for areas of severe/hazardous weather conditions that should be avoided);
TAWS terrain display (for local terrain relative to the current altitude).
12. Minimizing the Effects of False and Nuisance Alerts. As much as possible, the alerting functions or system should be designed to avoid false alerts and nuisance alerts, while providing reliable alerts to the flightcrew when needed. The effects of nuisance and false alerts distract the flightcrew, increase their potential for errors, and increase their workload. Section 25.1322(d) requires that an alert function be designed to minimize the effects of false and nuisance alerts.
Specifically, a flightcrew alerting system must be designed to:
a. Prevent the presentation of an alert that is inappropriate or unnecessary.
b. Provide a means to suppress an attention-getting component of an alert caused by a failure of the alerting system that interferes with the flightcrew’s ability to safely operate the airplane. This means must not be readily availabl e to the flightcrew so that it can be operated inadvertently or by habitual, reflexive action.
c. Permit each occurrence of attention-getting cues for warning and caution alerts to be acknowledged and then suppressed, unless the alert is required to be continuous (§ 25.1322(c)).
Reaching forward and pressing a switch light is a common, acceptable means of suppressing the attention-getting components of an aural alert, a flashing master warning, or a caution light.
d. Remove the presentation of the alert when the condition no longer exists (§ 25.1322(a)(3)).
e. Pulling circuit breakers is not an acceptable primary means for the flightcrew to suppress a false alert.
13. Showing Compliance for Approval of a Flightcrew-Alerting System.
a. Certification evaluations may be different from project to project because of the complexity, degree of integration, and specifics of the proposed alerting function or system. We recommend developing a plan to establish how compliance with the rules will be shown and to document how issues will be identified, tracked, and resolved throughout the life cycle of the certification program. We also recommend including the FAA early in the developmental process to discuss the acceptability of any proposed flight-deck-design-and-alerting philosophy and the conditions that should be alerted to the flightcrew. Typically, a certification plan is used for this purpose. For addressing human factors and pilot interface issues, in addition to the guidance in this AC, follow the guidance in FAA Policy Memo ANM-99-2 (PS-ANM111-1999- 99-2), Guidance for Reviewing Certification Plans to Address Human Factors for Certification of Transport Airplane Flight Decks, dated 9/29/99 and FAA Policy Memo ANM-01-03A, Factors to Consider when Reviewing an Applicant’s Proposed Human Factors Methods of Compliance for Flight Deck Certification.
b. When following the guidance in this AC to comply with the rule, document any divergence from this AC, and provide the rationale for decisions regarding novel or unusual 14
features used in the design of the alerting system. This will facilitate the certification evaluation because it will enable the FAA to focus on areas where the proposed system diverges from the AC and has new or novel features.
c. In accordance with the certification plan, provide an evaluation of the alerting system. In this case an evaluation is an assessment of the alerting system conducted by an applicant, who then provides a report of the results to the FAA. Evaluations are different from tests because the representation of the alerting system does not necessarily conform to the final documentation and the FAA may or may not be present. Evaluations by the applicant may contribute to a finding of compliance, but they do not constitute a complete showing of compliance by themselves.
(1) The evaluation should include assessments of acceptable performance of the intended functions, including the human-machine interface, and acceptability of alerting system failure scenarios. The scenarios should reflect the expected operational use of the system.
Specific aspects that should be included during the evaluation(s) are:
(a) Visual, aural, and tactile/haptic aspects of the alert(s).
(b) Effectiveness of meeting intended function from the human/machine integration, including workload, the potential for flightcrew errors, and confusion.
(c) Normal and emergency inhibition-and-suppression logic and accessibility of related controls.
(d) Proper integration with other systems, including labeling. This may require testing each particular alert and verifying that the appropriate procedures are provided.
(e) Acceptability of operation during failure modes per § 25.1309.
(f) Compatibility with other displays and controls, including multiple warnings.
(g) Ensuring that the alerting system by itself does not issue nuisance alerts or interfere with other systems.
(h) Inhibiting alerts for specific phases of flight (for example, takeoff and landing) and for specific airplane configurations (for example, abnormal flaps and gear).
(2) The validation of the performance and integrity aspects will typically be accomplished by a combination of the following methods:
Analysis Laboratory test Simulation Flight test 15
(3) Evaluate the alerts in isolation and combination throughout the appropriate phases of flight and maneuvers, as well as representative environmental and operational conditions. The alerting function as a whole needs to be evaluated in a representative flight deck environment.
Representative simulators can be used to accomplish the evaluation of some human factors and workload studies. The level and fidelity of the simulator should be commensurate with the certification credit being sought. The simulator should represent the flight deck configuration and be validated by the FAA. The assessment of the alerts may be conducted in a laboratory, simulator, or the actual airplane. Certain elements of the alerting system may have to be validated in the actual airplane. The eval uation should be conducted by a representative population of pilots with various backgrounds and expertise.
(4) Evaluations should also verify the chromaticity (red looks red and amber looks amber) and discriminability (colors can be distinguished from each other) of the colors being used, under the expected lighting levels. Eval uations may also be useful to verify the discriminability of graphic coding used on monochromatic displays. These evaluations can be affected by the specific display technology being used, so a final evaluation with production representative hardware is sometimes needed.
14. Integrating Flightcrew-Alerting System Elements into the Existing Fleet.
a. General.
(1) This material provides recommendations to applicants on how to retrofit existing airplanes so they comply with § 25.1322 without major modifications to the current flightcrewalerting system.
(2) System upgrades to existing airplanes should be compatible with the original airplane’s flightcrew-alerting philosophy. The existing alerting system might not be able to facilitate the integration of additional systems and associated alerts due to limitations in the system inputs, incompatible technologies between the airplane and the system being added, or economic considerations.
(a) We discourage incorporating a new additional master visual function into the flightcrew-alerting system. If it is not feasible to include additional systems and associated alerts in the existing master visual function, an additional master visual function may be installed, provided that it does not delay the flightcrew’s response time for recognizing and responding to an alert.
(b) Where possible, new alerts should be integrated into the existing flightcrewalerting system. If these alerts cannot be integrated, individual annunciators or an additional alerting display system may be added.
(c) Not all alerts associated with failure flags need to be integrated into the central alerting system. However, for those alerts requiring immediate flightcrew awareness, the alert needs to meet the attention-getting requirements of § 25.1322(c)(2) as well as the other requirements in § 25.1322. Thus, a master visual or master aural alert may not be initiated, but 16
an attention-getting aural or tactile indication must still accompany an attention-getting visual failure flag to meet the attention-getting requirement of § 25.1322(a)(1), which requires attention-getting cues through at least two different senses for warning and caution alerts.
b. Visual Alerts. Following the guidance in paragraphs 5 and 6 of this AC, determine whether or not the added system features will require activation of an airplane master visual alert.
c. Aural Alerts.
(1) Using the guidance in this AC, determine if an added system will require activating an aural alert.
(2) The new aural alert should be integrated into the existing aural alerting system and functions. If this is not possible, a separate aural alerting system may be installed, provided that a prioritization scheme between existing aural alerts and the new aural alerts is developed so that each alert is recognized and can be acted upon in the time frame appropriate for the alerting situation. This may require a demonstration of any likely combination of simultaneous alerts.
After the new and existing alerts have been merged, follow the guidance in this AC for determining how to prioritize the alerts.
d. Tactile Alerts.
(1) Using the guidance in this AC, determine if an added system will require activating a tactile alert.
(2) If possible, incorporate the new tactile alert into the existing aural alerting system.
If this is not possible, a separate tactile alerting system may be installed, provided that the following elements are included:
(a) A prioritization scheme between existing tactile alerts and the new tactile alerts should be developed so that each alert is recognized and can be acted upon in the time frame appropriate for the alerting situation. After the new and existing alerts have been merged, follow the guidance in this AC for determining how to prioritize the alerts.
(b) A means to ensure that an individual alert can be understood and acted upon.
This may require a demonstration of any likely combination of simultaneous alerts.
15. Alerts for Head-Up Displays (HUDs).
a. HUDs have visual characteristics that merit special considerations for alerting. First, most HUDs are single-color (monochromatic) displays and are not capable of using different colors, such as red, amber, and yellow to signify alert information. Second, HUDs are located in the pilot’s forward field of view, separated from the instrument panel, and focused at optical infinity. As a result, many visual indications on the instrument panel are not visible to the pilot while viewing the HUD, and the timely detection of visual alerts displayed on the instrument panel may not be possible. Therefore, even though HUDs are not intended to be classified as 17
integrated caution and warning systems, they do need to display certain alerts, such as time-critical warnings, to perform their role as a primary flight display (PFD). Monochromatic HUDs are not required to use red and amber to signify warning and caution alerts, but do need to provide the equivalent alerting functionality (for example, attention-getting, clearly understandable, not confusing) as current head-down display (HDD) PFDs (§§ 25.1322(e)).
b. Alerting functions presented in the HUD should not adversely affect the flightcrew’s use of the HUD by obstructing the flightcrew’s outside view through the HUD.
c. Time-critical warnings that are displayed on the HDD PFD also need to be presented on the HUD to ensure equivalent timely pilot awareness and response (for example, ACAS II, windshear, and ground-proximity warning annunciations) (§ 25.1301(a)). Otherwise, the physical separation of the HUD and head-down fields of view and the difference in accommodation (that is, focal distance) would hinder timely pilot awareness of visual alerts displayed head-down.
d. While a pilot is using the HUD, if the master alerting indications are not visible or attention-getting, the HUD needs to display alerts that provide the pilot timely notification of caution conditions, warning conditions, or both.
e. Section 25.1322(e) requires visual alert indications on monochromatic displays to use coding techniques so the flightcrew can clearly distinguish between warning, caution, and advisory alerts. Since monochromatic HUDs are incapable of using red, amber, and advisory colors to distinguish among warning, caution, and advisory information, other visual display features (coding techniques) are necessary, such as shape, location, texture, along with the appropriate use of attention-getting properties such as flashing, outline boxes, brightness, and size. FAA Report No. DOT/FAA/RD-81/38, II, 1981, Aircraft Alerting Systems Standardization Study, Volume II, Aircraft Alerting Systems Design Guidelines, stresses the importance of preserving the distinguishing characteristics of caution and warning alerts. The use of these visual display features should be consistent within the set of flight deck displays, so to the intended meaning is clearly and unmistakably conveyed. For example, time-critical warnings might be boldly displayed in a particular central location on the HUD, while less critical alerts, if needed, would be displayed in a different manner.
f. For multi-color HUDs, the display of warning and caution alerts should be consistent with HDD PFD presentations.
g. Pilot flying and pilot monitoring roles should account for the use of HUDs to ensure timely awareness of certain alerts, especially because of field of view factors.
(1) For single-HUD installations, when the pilot flying is using the HUD, the other pilot should be responsible for monitoring the head-down instruments and alerting systems for system failures, modes, and functions that are not displayed on the PFDs.
(2) For dual-HUD installations there needs to be greater reliance on master alerting indications that are capable of directing each pilot’s attention to non-PFD alerts when both HUDs are in use. If master alerting indications do not provide sufficient attention to each pilot 18
while using the HUD, then each HUD should provide annunciations that direct the pilot’s attention to HDDs. The types of information th at should trigger the HUD master alerting display are any cautions or warnings not already duplicated on the HUD from the HDD.
Appendix 1 Appendix 1 Examples for Including Visual System Elements in an Alerting System This appendix includes detailed guidance and examples to help applicants with a means of compliance and design for visual system elements in an alerting system. They are based on the FAA’s experience with existing and proposed alerting systems that comply with § 25.1322. The extent to which this guidance and these examples are applied to a specific certification program will vary, depending on the types of alerts presented, and the level of integration associated with an alerting system. The visual elements of an alerting system typically include a master visual alert, visual information, and time-critical warning visual information.
1. Master Visual.
a. Location. Master visual alerts for warnings (master warning) and cautions (master caution) should be located in each pilot’s primary field of view. Appendix 5 of this AC includes a definition of pilot primary field of view.
b. Onset/Duration/Cancellation.
(1) The onset of a master visual alert should occur:
(a) In a timeframe appropriate for the alerting condition and the desired response.
(b) Simultaneously with the onset of its related master aural alert or unique tone, and its related visual alert information. Any delays between the onset of the master visual alert and its related master aural alert or unique tone, and its visual alert information should not cause flightcrew distraction or confusion.
(c) Simultaneously at each pilot’s station (warnings, cautions).
(2) The master visual alert should remain on until it is cancelled either manually by the flightcrew, or automatically when the alerting condition no longer exists.
(3) After the master visual alert is cancelled the alerting mechanisms should automatically reset to annunciate any subsequent fault condition.
c. Attention-Getting Visual Characteristics. In addition to color, steady state or flashing master visual alerts may be used, as long as the method employed provides positive attention-getting characteristics. If flashing is used, all master visual alerts should be synchronized to avoid any unnecessary distraction. AC 25-11A, Electronic Flight Deck Displays, provides additional guidance for using flashing alerts.
A1-1
Appendix 1
d. Brightness.
(1) Master visual alerts should be bright enough to attract the attention of the flightcrew in all ambient light conditions.
(2) Manual dimming should not be provided unless the minimum setting retains adequate attention-getting qualities when flying under all ambient light conditions.
e. Display and Indicator Size and Character Dimensions.
(1) Design all character types, sizes, fonts, and display backgrounds so that the alerts are legible and understandable at each pilot’s station. These elements should provide suitable attention-getting characteristics.
(2) We recommend that the alerts subtend at least 1 degree of visual angle.
f. Color.
(1) Standard color conventions must be followed for the master visual alerts (§ 25.1322 (d)):
Red for warning Amber or yellow for caution
(2) Master visual alerts for conditions other than warnings or cautions (for example, Air Traffic Control (ATC) Datalink alerts) must meet the requirements in § 25.1322(f) and follow the guidance in this AC. We recommend using a color other than red, amber, or yellow.
g. Test function. To comply with the safety requirements of § 25.1309, include provisions to test/verify the operability of the master visual alerts.
2. Visual Information.
a. Quantity and Location of Displays.
(1) To determine the quantity of displays that provide warning, caution, and advisory alerts, take into account the combination of ergonomic, operational, and reliability criteria, as well as any physical space constraints in the flight deck.
(2) The visual-alert information should be located so that both pilots are able to readily identify the alert condition.
(3) All warning and caution visual information linked to a master visual alert should be grouped together on a single dedicated display area. There may be a separate area for each pilot.
Advisory alerts should be presented on the same display area as warning and caution A1-2
Appendix 1 information. The intent is to provide an intuitive and consistent location for the display of information.
b. Format and Content.
(1) Use a consistent philosophy for the format and content of the visual information to clearly indicate both the alert meaning and condition. The objectives of the corresponding text message format and content are to direct the flightcrew to the correct checklist procedure, and to minimize the risk of flightcrew error.
(2) The alerting philosophy should describe the format and content for visual information. Use a consistent format and content that includes the following three elements:
The general heading of the alert (for example, HYD, FUEL) The specific subsystem or location (for example, L-R, 1-2) The nature of the condition (for example, FAIL, HOT, LOW)
(3) For any given message, the entire text should fit within the available space of a single page. This encourages short and conc ise messages. Additional lines may be used provided the alert message is understandable.
(4) If alerts are presented on a limited display area, use an overflow indication to inform the flightcrew that additional alerts may be called up for review. Use indications to show the number and urgency levels of the alerts stored in memory.
(5) A “collector message” can be used to resolve problems of insufficient display space, prioritization of multiple alert conditions, alert information overload, and display clutter. Use collector messages when the procedure or action is different for the multiple fault condition than the procedure or action for the individual messages being collected. For example, non-normal procedures for loss of a single hydraulic system are different than non-normal procedures for loss of two hydraulic systems. The messages that are “collected” (for example, loss of each individual hydraulic system) should be inhibited so the flightcrew will only respond to the correct non-normal procedure pertaining to the loss of more than one hydraulic system.
(6) An alphanumeric font should be of a sufficient thickness and size to be readable when the flightcrew are seated at the normal viewing distance from the screen.
Note 1: Minimum character height of 1/200 of viewing distance is acceptable (for example, a viewing distance of 36 inches requires a 0.18 inch character height on the screen) per DOD-CM-400-18-05, Department of Defense User Interface Specifications for the Defense Information Infrastructure, Defense Information Systems Agency, February 1998, p 12-1).
Note 2: Arial and sans serif fonts are accep table for visual alert text. The size of numbers and letters required to achieve acceptable readability depends on the A1-3
Appendix 1 display technology used. Str oke width between 10% and 15% of character height appears to be best for word recognition on text displays. Extensions of descending letters and ascending letters should be about 40% of letter height.
Note 3: Different fonts can be used to differentiate between new and previously acknowledged visual alert information.
c. Color. The presentation of visual alert information must use the following standard color conventions (§ 25.1322(e)):
Red for warning alerts Amber or yellow for caution alerts Any color except red, amber, yellow, or green for advisory alerts
(1) Red must be used for indicating non-normal operational or non-normal aircraft system conditions that require immediate flightcrew awareness and an immediate action or decision.
(2) Amber or yellow must be used for indicating non-normal operational or non-normal aircraft system conditions that require immediate flightcrew awareness and less urgent subsequent flightcrew response (compared to a warning alert).
(3) Advisories may use any color except red or green for indicating non-normal operational or non-normal system conditions that require flightcrew awareness and may require subsequent flightcrew response.
Note: Use of red, amber, or yellow not related to caution and warning alerting functions must be limited to prevent diminishing the attention-getting characteristics of true warnings and cautions (§ 25.1322(f)).
d. Luminance.
(1) The visual alert information should be bright enough so that both pilots are able to readily identify the alert condition in all ambient light conditions.
(2) The luminance of the visual alert information display may be adjusted automatically as ambient lighting conditions change inside the flight deck. A manual override control may be provided to enable the pilots to adjust display luminance.
3. Time-Critical Warning Visual Information.
a. Location. Time-critical warning visual information should appear in each pilot’s primary field of view. Appendix 5 of this AC includes a definition for pilot primary field of view.
A1-4
Appendix 1 Note: The primary flight display (PFD) is used as a practical and preferred display for displaying the time-critical warning alerts since the pilot constantly scans the PFD. Integrating time-critical information into the PFD depends on the exact nature of the warning. For exam ple, a dedicated location on the PFD may be used both as an attention-getting function and a visual information display by displaying alerts such as “WINDSHEAR,” “SINK RATE,” “PULL UP,” “TERRAIN AHEAD,” and “CLIMB, CLIMB.” In addition, graphic displays of target pitch attitudes for Airborne Alert and Collision Avoidance System (ACAS) II Resolution Advisories and Terrain may also be included.
b. Format.
(1) The corresponding visual and aural alert information should be consistent.
(2) Time-critical warning visual information may be presented as a text message (for example, “WINDSHEAR”). Certain time-critical warning information, including guidance, may be presented graphically (for example, graphics representing an ACAS II Resolution Advisory).
(3) Text messages and graphics for time-critical warning information must be red (§ 25.1322(e)(1)(i)). When displaying time-critic al warnings on monochromatic displays, other graphic coding means must be used (§ 25.1322(e)).
(4) The information must be removed when corrective actions (e.g. sink rate has been arrested, airplane climbed above terrain, etc.) have been taken, and the alerting condition no longer exists (§ 25.1322(a)(3).
c. Size. To immediately attract the attention of the flightcrew and to modify their habit pattern for responding to warnings that are not time-critical. We recommend that a display for time-critical warnings subtend at least 2 square degrees of visual angle.
4. Failure Flags. Failure flags indicate failures of displayed parameters or their data source.
Failure flags are typically associated with only single instrument displays. The same colors used for displaying flightcrew alerts are used for displaying failure flags. In the integrated environment of the flight deck it is appropriate to display instrument failure flags in a color consistent with the alerting system, as part of the alerting function (see paragraph 5b in the body of this AC).
A1-5