U.S. Department of Transportation Advisory Circular Federal Aviation Administration Subject: FLIGHTCREW ALERTING Date: 12/13/2010 AC No: 25.1322-1 Initiated By: ANM-100 This advisory circular (AC) provides guidance for showing compliance with certain requirements of Title 14 of the Code of Federal Regulations (14 CFR), part 25, for the design approval of flightcrew-alerting functions.
AMBL Ali Bahrami Manager, Transport Airplane Directorate Aircraft Certification Service
Table of Contents Paragraph .................................................................................................................Page Number
1. Purpose4
2. Applicability4
3. Related Examples, Regulations, Documents, and Definitions4
4. Background5
5. Designing a Flightcrew-Alerting System5
a. General5
b. Flightcrew-Alerting Philosophy5
c. Design Considerations5
6. Alert Functional Elements7
a. Warning Alerts7
b. Time-Critical Warning Alerts7
c. Master Visual and Aural Alerts8
d. Caution Alerts8
e. Advisory Alerts8
7. Alerting System Reliability and Integrity9
8. Managing Alerts9
a. Rules and General Guidelines10
b. Multiple Aural Alerts10
c. Multiple Visual Alerts10
d. Alert Inhibits11
9. Clearing and Recalling Visual Alert Messages11
10. Interface or Integration with Other Systems (Checklist, Synoptics, Switches, Discrete
lamps)12
11. Color Standardization12
12. Minimizing the Effects of False and Nuisance Alerts14
13. Showing Compliance for Approval of a Flightcrew-Alerting System14
14. Integrating Flightcrew-Alerting System Elements into the Existing Fleet16
a. General16
b. Visual Alerts17
c. Aural Alerts17
d. Tactile Alerts17
15. Alerts for Head-Up Displays (HUDs)17
List of Appendices
Appendix 1 Examples for Including Visual Sy stem Elements in an Alerting SystemA1-1
Appendix 2 Examples for IncludingAural Syst em Elements in an Alerting Syste,A2-1
Appendix 3 RegulationsA3-1
Appendix 4 Related DocumentsA4-1
Appendix 5 DefinitionsA5-1
1. Purpose. This advisory circular (AC) provides guidance for showing compliance with certain requirements of Title 14, Code of Federal Regulations (14 CFR), part 25, for the design approval of flightcrew-alerting functions. This AC addresses the type of alert function elements that should be considered (including visual, aural, and tactile or haptic elements), alert management, interface or integration of alerts with other systems, and color standardization. The appendices to this AC also provide examples for including visual and aural system elements in an alerting system.
2. Applicability.
a. The guidance provided in this document is applicable to airplane manufacturers, modifiers, avionics manufacturers, Federal Aviation Administration (FAA) transport airplane type certification engineers, human factor specialists, test pilots and their designees.
b. This guidance is applicable to new airplanes. It may also be applicable to modified airplanes and to integrating flightcrew alerting system elements into existing airplanes. It applies to individual aircraft systems that provide flightcrew-alerting functions that may or may not be integrated with a central alerting system, as well as to systems whose primary function is alerting, such as a central alerting system.
c. Like all AC material, this AC is not, in itself, mandatory, and does not constitute a regulation. It describes an accep table means, but not the only means, for showing compliance with the requirements for transport category airplanes. The FAA will consider other methods of showing compliance that an applicant may elect to present. While these guidelines are not mandatory, we derived them from extensive FAA and industry experience in showing compliance with the relevant regulations. On the other hand, if we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC. We may require additional substantiation or design changes as a basis for finding compliance.
d. This material does not change, create any additional, authorize changes in, or permit deviations from, regulatory requirements.
e. The term “must” in this AC, is used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance described herein is used. While these guidelines are not mandatory, they are derived from FAA and industry experience in determining compliance with the pertinent regulations.
3. Related Examples, Regulations, Documents, and Definitions. Appendix 1 of this AC provides examples for including visual system elements in an alerting system. Appendix 2 of this AC provides examples for including aural system elements in an alerting system. Appendix 3 of this AC lists the airworthiness and operational regulations related to this AC. Appendix 4 of this AC lists related ACs and other documents that are provided for information purposes and are 4
not necessarily directly referenced in this AC. Appendix 5 provides definitions written to support the content of this AC and its associated rule.
4. Background.
a. While the flightcrew is ultimately responsible for the operation of the airplane, the provision of an alerting system that aids the flightcrew in identifying non-normal operational or airplane system conditions and in responding in an appropriate and timely manner is an essential feature of every flight deck design. In the past , airplanes were designed with discrete lights for the alerting function. Now the alerting function can be integrated with other systems, including electronic display systems, tactile warning systems, and aural warning or tone generating systems.
b. Regulations and advisory material for 14 CFR part 25 often provide references to an alert, such as a warning, to provide awareness of a non-normal condition that is relevant to the applied rule. Many of these rules were written without recognition of a consistent flight deck alerting philosophy, and may use the term “warning” and “alert” in a generic sense. This AC does not intend to conflict with or replace the intent of those rules. If there is a conflict with a rule, the rule takes precedence over the guidance material provided in this AC. Our intent is to standardize flightcrew-alerting terminology used in affected rules and guidance material and provide a means for applicants to show compliance with those rules.
5. Designing a Flightcrew-Alerting System.
a. General. The purpose of flightcrew alerts on airplanes is to attract the attention of the flightcrew, to inform them of specific non-normal airplane system conditions or certain nonnormal operational events that require their awareness, and, in modern alerting systems, to advise them of possible actions to address these conditions. The ability of an alert to accomplish its purpose depends on the design of the complete alert function. This includes the sensor and the sensed condition required to trigger an alert, how that information is subsequently processed, including the level of urgency and priority assigned, and the choice of alert presentation elements to express the assigned level of urgency. Conditions that do not require flightcrew awareness should not generate an alert.
b. Flightcrew-Alerting Philosophy. When developing a flightcrew-alerting system use a consistent philosophy for alerting conditions, urgency and prioritization, and presentation.
c. Design Considerations. Consider the following concepts and elements when designing an alerting system:
(1) Only non-normal airplane-system conditions and operational events that require flightcrew awareness to support flightcrew decision making and facilitate the appropriate flightcrew response should cause an alert. Ho wever, conditions that require an alert depend on the specific system and airplane design, and overall flight-deck philosophy. For example, the failure of a single sensor in a multi-sensor system may not necessarily result in an alert condition 5
that requires pilot awareness. However, for a sing le sensor system, such a failure should result in an alert condition that provides the flightcrew with the information needed to assure continued safe flight and landing.
(2) All alerts presented to the flightcrew, (for example, light, aural annunciation, engine-indication-and-crew-alerting system (EICAS) message, master caution) must provide the flightcrew with the information needed to identify the non-normal operational or airplane system condition and determine the corrective action, if any (§ 25.1322 (a)(1)). Appropriate flightcrew corrective actions are normally defined by airplane procedures (for example, in checklists) and are part of a flightcrew training curriculum or considered basic airmanship.
(3) Implement a consistent alerting philosophy as described in paragraph 5b of this AC.
(4) Include the appropriate combination of alerting system presentation elements, which typically include:
(a) Master visual alerts
(b) Visual alert information (includes failure flag indications)
(c) Master aural alerts
(d) Voice information
(e) Unique tones (unique sounds)
(f) Tactile or haptic information
(5) Use logic-based integrated alerting systems to ensure that alerting system elements are synchronized and provide the proper alert presentation format for each urgency level. For example, the onset of the master visual alert should normally occur simultaneously with the onset of the master aural alert.
(6) Present the alerts according to the urgency and prioritization philosophy outlined in paragraph 5b and described in detail in paragraph 8a of this AC.
(7) Visual alerts must conform to the color convention of § 25.1322(e). Paragraph 11 of this AC provides guidance on the color convention.
(8) If using aural alerts with multiple meanings, a corresponding visual, tactile, or haptic alert should be provided to resolve any potential uncertainty relating to the aural alert and clearly identify the specific alert condition.
(9) Alerting conditions. Establish how airplane system conditions or operational events that require an alert (for example, engine overheating, windshear, etc.), will be determined.
(10) Urgency and Prioritization. Establis h how the level of urgency (warning, caution and advisory) associated with each alerting condition will be prioritized and classified to meet 6
the requirements listed in § 25.1322(b) and § 25.1322(c)(1). If an alert’s urgency and prioritization is context-sensitive, state what information should be considered (for example, the priority associated with different alerting conditions may vary depending on the state of the airplane, phase of flight, system configuration, etc.).
(11) Presentation. Establish a c onsistent alert presentation scheme (for example, location of the alert on the flight deck, alert combinations [aural, visual, tactile], information presented in the alert message, and color and graphical coding standardization). Also, determine the format in which that alert will be presented (for example, structure and timing of alert messages) to support the alerting function’s purpose.
6. Alert Functional Elements. The functional elements used in the alerting and information functions for warning and caution alerts must provide timely attention-getting cues, resulting in immediate flightcrew awareness, through at least two different senses (§ 25.1322(c)(2)).
Functional elements used for advisory alerts do not require immediate flightcrew awareness and are normally provided through a single sense.
a. Warning Alerts. Several alert functional element combinations are used to comply with § 25.1322(c)(2) (two-senses requirement). The typical alert-element combinations for warning alerts (not including time-critical warning alerts) are shown below.
(1) Master visual alert, visual alert information, and master aural alert.
(2) Master visual alert, visual-alert information, and voice-alert information or unique alert tone.
Note 1: Voice-alert information may be preceded by a master aural alert.
Note 2: A tactile alert may be comb ined with a visual or aural alert to meet the § 25.1322 requirement for a combination of two senses.
b. Time-Critical Warning Alerts. Some warnings may be so time-critical for the safe operation of the airplane that general alerts such as a master visual alert and a master aural alert may not provide the flightcrew with immediate awareness of the specific alerting condition that is commensurate with the level of urgency of flightcrew response necessary. In such cases, warning elements dedicated to specific alerting conditions should be provided that give the flightcrew immediate awareness without further reference to other flight deck indications.
Examples of such time-critical warnings include reactive windshear and ground proximity. The alerting elements for time-critical warnings should include:
Unique voice information or unique tone, or both, for each alerting condition, and Unique visual alert information in each pilot’s primary field of view for each alerting condition.
Note: A unique tactile alert sensed by each pilot can also meet the § 25.1322(c)(2) requirement for one of the two senses.
c. Master Visual and Aural Alerts. A master visual alert and a master aural alert may not be warranted if other visual and aural means provide more timely attention-getting characteristics. If a master visual alert and/or a master aural alert are used, they should aid in the overall attention-getting characteristics and the desired flightcrew response and not distract the flightcrew from the time-critical condition. For example, unique visual alert information presented in each pilot’s primary field of view is acceptable in place of a master visual alert if it provides immediate awareness and sufficient attention-getting characteristics. However, an aural alert, su ch as an aural command to “pull up,” or another sensory cue, would still be required to meet § 25.1322(c)(2).
d. Caution Alerts.
(1) The alert elements used for caution are typically identical to those used for warnings, as both require immediate flightcrew awareness.
(2) Some caution alerts are related to conditions that are precursors to potential time-critical warning conditions. In these cases, the alerting system elements associated with the caution should be consistent with the elements for related time-critical warnings (described in paragraph 6b of this AC). For example, reactive windshear warnings, ground-proximity warnings, and caution alerts can develop into time-critical warning alerts.
e. Advisory Alerts.
(1) The alerting and informing functional elements for advisories must meet the applicable requirements of § 25.1322 and should include visual information. Advisory information should be located in an area where the flightcrew is expected to periodically scan for information.
(2) Advisory information does not require immediate flightcrew awareness. Therefore, it does not require alerting that uses a combination of two senses. In addition, a master visual or master aural alert is not typically used since immediate flightcrew awareness is not needed.
(3) Aural or visual information such as maintenance messages, information messages, and other status messages associated with conditions that do not require an alert may be presented to the flightcrew, but the presentation of this information should not interfere with the alerting function or its use.
7. Alerting System Reliability and Integrity.
a. The alerting system, considered alone and in relation to other systems, should meet the safety objectives of the relevant system safety standards (for example, § 25.901(b)(2), § 25.901(c), and § 25.1309(b)). The reliability and integrity of the alerting system should be commensurate with the safety objectives associated with the system function, or airplane function, for which the alert is provided.
b. When applying the § 25.1309(b) system safety analysis process to a particular system or function that has an associated flightcrew alert, assess both the failure of the system or function and a failure of its associated alert (§ 25.1309(d)(4)). This should include assessing the effect of a single (common or cascading mode) failure that could cause the failure of a system function and the failure of any associated alerting function. A failure is defined as: “An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended. This includes both loss of function an d malfunction.” Therefore, in conducting the safety analysis, both loss of functions and malfunctions should be considered.
c. Since the flightcrew-alerting function is often integrated with, or is common to, other systems, the impact of a failure or error in the alerting system must be assessed separately and in relation to other systems as required by § 25.1309(b). The cascading effects of a failure or error in the alerting function, and in the interfacing system, should be analyzed. Give special consideration to avoid alerting that, through misinterpretation, could increase the hazard to the airplane (§ 25.1309(c)). For exam ple, there should not be a foreseeable way that a fire warning for one engine could be misinterpreted as a fire on a different engine.
d. Assess the reliability of the alerting system by evaluating the reduction in the safety margin if the alerting system fails. The evaluation should address:
(1) Loss of the complete alerting function.
(2) A malfunction.
(3) Loss or malfunction of one alert in combination with the system condition for which the alert is necessary.
e. The integrity of the alerting system should be examined because it affects the flightcrew’s trust and response when assessing an alert. Since the individual assessment of a false or nuisance alert for a given system may lead to a specific consequence, the impact of frequent false or nuisance alerts increases the flightcrew’s workload, reduces the flightcrew’s confidence in the alerting system, and affects their reaction in case of a real alert. For example, if false or nuisance alerts are presented the flightcrew may ignore a real alert when it is presented.
8. Managing Alerts. Prioritize alerts so that the most urgent alert is presented first to the flightcrew.
a. Rules and General Guidelines.
(1) All flight deck alerts must be prioritized into warning, caution, and advisory categories (§ 25.1322(b)).
(2) To meet their intended function(s), alerts must be prioritized based upon urgency of flightcrew awareness and urgency of flightcrew response (§ 25.1301(a)). Normally, this means time-critical warnings are first, other warnings are second, cautions are third, and advisories are last (§ 25.1322(b)).
(3) Depending on the phase of flight, there may be a need to re-categorize certain alerts from a lower urgency level to a higher urgency level. Furthermore, prioritization within alert categories may be necessary. For example, when near threatening terrain, time-critical aural warnings must be prioritized before other warnings within the warning-alert category
(25.1322(c)(1)). AC 25-23, Airworthiness Criteria for the Installation Approval of a Terrain Awareness and Warning System (TAWS) for Part 25 Airplanes, also identifies situations where prioritization within alert categories is necessary.
(4) The prioritization scheme within each alert category, as well as the rationale, should be documented and evaluated, by following the guidance in paragraph 13, Showing Compliance For Approval Of A Flightcrew-Alerting System, of this AC.
(5) Documentation should include the results of analyses and tests that show that any delayed or inhibited alerts do not adversely impact safety.
b. Multiple Aural Alerts.
(1) Aural alerts should be prioritized so that only one aural alert is presented at a time.
If more than one aural alert needs to be presented at a time, each alert must be clearly distinguishable and intelligible by the flightcrew (§ 25.1322(a)(2)).
(2) When aural alerts are provided, an active aural alert should finish before another aural alert begins. However, active aural alerts must be interrupted by alerts from higher urgency levels if the delay to annunciate the higher-priority alert impacts the timely response of the flightcrew (§ 25.1301(a)). If the condition that triggered the interrupted alert is still active, that alert may be repeated once the higher-urgency alert is completed. If more than one aural alert requires immediate awareness and the interrupted alert(s) affects the safe operation of the airplane, an effective alternative means of presenting the alert to the flightcrew must be provided to meet the requirements of § 25.1322(a)(1) and (a)(2).
c. Multiple Visual Alerts.
(1) Since two or more visual alerts can occur at the same time, applicants must show that each alert and its relative priority are readily and easily detectable and intelligible by the flightcrew (§ 25.1322(a)(2)).
(2) When multiple alerts exist in a specific category (for example, multiple warning alerts or multiple caution alerts), a means for the flightcrew to determine the most recent or most 10
urgent alert must be provided (§ 25.1322(c)(1)). For example, the most recent or highest priority alert may be listed at the top of its own category. If the alert is time-critical and shares a dedicated display region it must have the highest alerting priority to satisfy its intended function (§ 25.1301(a)).
(3) Displays must either conform to the alert color convention or, in the case of certain monochromatic displays not capable of conforming to the color conventions, use other visual coding techniques per § 25.1322(e). Th is is necessary so the flightcrew can easily distinguish the alert urgency under all foreseeable operating conditions, including conditions where multiple alerts are provided (§ 25.1322(a)(2)).
d. Alert Inhibits.
(1) Alert inhibit functions must be designed to prevent the presentation of an alert that is inappropriate or unnecessary for a particular phase of operation (§ 25.1322(d)(1)). Alert inhibits can also be used to manage the prioritization of multiple alert conditions. Inhibiting an alert is not the same as clearing or suppressing an alert that is already displayed.
(2) Alert inhibits should be used in the following conditions:
(a) When an alert could cause a hazard if the flightcrew was distracted by or responded to the alert.
(b) When the alert provides unnecessary information or awareness of airplane conditions.
(c) When a number of consequential alerts may be combined into a single higher-level alert.
(3) Alerts can be inhibited automatically by the alerting system or manually by the flightcrew.
(4) For operational conditions not recognized by the alerting system, provide a means for the flightcrew to inhibit a potential alert that would be expected to occur as the result of the specific operation (for example, preventing a landing configuration alert for a different landing flap setting). For as long as the inhibit ex ists, there should be a clear and unmistakable indication that the flightcrew manually inhibited that alert.
9. Clearing and Recalling Visual Alert Messages. Clearing visual alert messages from the current warning, caution, and advisory display allows the flightcrew to remove a potential source of distraction and makes it easier for the flightcrew to detect subsequent alerts.
a. The following guidance should be applied for clearing and recalling or storing the visual alert messages:
(1) If a message can be cleared and the condition still exists, the system should provide the ability to recall any cleared visual alert message that has been acknowledged.
(2) Either through a positive indication on the display or through normal flightcrew procedures, a means should be provided to identify if alert messages are stored (or otherwise not in view).
b. The visual alert message must be removed from the display when the condition no longer exists (§25.1322(a)(3)).
10. Interface or Integration with Other Systems (Checklist, Synoptics, Switches, Discrete lamps).
a. The color of all visual alerting annunciations and indications must conform to the color convention in § 25.1322(e). Use consistent wording, position, color and other shared attributes (for example, graphic coding) for all alerting annunciations and indications.
b. Information displayed in the flight deck associated with the alert condition must facilitate the flightcrew’s ability to identify the alert (§ 25.1322(a)(1)(i)) and determine the appropriate actions, if any (§ 25.1322(1)(ii)).
c. Information conveyed by the alerting system should lead the flightcrew to the correct checklist procedure to facilitate the appropriate flightcrew action. Some flight deck alerting systems automatically display the correct checklist procedure or synoptic display when an alert is presented. Some alerts do not display an associated checklist procedure because the correct flightcrew action is covered by training or basic airmanship (for example, autopilot disconnect and time-critical warnings). In all cases, the airplane- or system-certification test program should verify that the alerts provide or direct the flightcrew to the correct procedures.
d. If multiple checklists can be displayed (for example, multiple checklists associated with multiple alerts), the flightcrew should be able to readily and easily choose the appropriate checklist and action for each alert. For example, the flightcrew must be able to easily distinguish which checklist has priority regarding what the flightcrew needs to do first to determine the appropriate actions, if any (§ 25.1322(a)(1)(ii)).
11. Color Standardization. The objective of color standardization is to maintain the effectiveness of visual alerts by enabling the flightcrew to readily distinguish between alert categories.
a. Visual alert indications must conform to the following color convention (§ 25.1322(e)):
(1) Red for warning-alert indications.
(2) Amber or yellow for caution-alert indications.
(3) Any color except red or green for advisory alert indications.