b. Engagement mode compatibility. It should not be possible to select incompatible FGS command or guidance functions, such as commanding speed through elevator and autothrust at the same time.
32—41 [RESERVED]
24 CHAPTER 4. CONTROLS, INDICATIONS, AND ALERTS
42. General.
a. Human-machine interface (HMI). The HMI with the FGS is crucial to ensuring safe, effective, and consistent FGS operation. The manner in which FGS information is depicted to the flightcrew is vital to flightcrew awareness and, therefore, to safe operation of the FGS.
b. Design of controls, indications, and alerts. These features must be designed to minimize flightcrew errors and confusion. See § 25.1329(i). Indications and alerts should be presented in a manner compatible with the procedures and assigned tasks of the flightcrew and provide the necessary information to perform those tasks. The indications must be grouped and presented in a logical and consistent manner and must be visible from each pilot’s station under all expected lighting conditions. See § 25.1329(i). The choice of colors, fonts, font size, location, orientation, movement, graphical layout, and other characteristics—such as steady or flashing— should all contribute to the effectiveness of the system. Controls, indications, and alerts should be implemented in a consistent manner.
c. Evaluation of information provided by FGS. It is recommended that the applicant evaluate the adequacy and effectiveness of the information provided by the FGS interface—that is the controls, indications, alerts, and displays—to ensure flightcrew awareness of FGS behavior and operation. See Chapter 9 of this AC for more discussion of appropriate analyses, which may include, for example, cognitive task analysis as a basis for evaluation.
43. FGS Controls.
a. General. The FGS controls must be designed and located to prevent crew errors, confusion, and inadvertent operation. See § 25.1329(i). They should be designed to provide convenience of operation to each crewmember. The function and direction of motion of each control must be readily apparent or plainly indicated on or adjacent to each control, if needed to prevent inappropriate use or confusion. See § 25.1329(f). Sections 25.777(b) and 25.779(a) provide requirements regarding direction of motion of flight deck controls. These requirements apply for FGS command reference controls that select target values, such as heading select or vertical speed. Section 25.781 also provides requirements for the shapes of the knobs.
b. Design considerations. The design of the FGS should address the following specific considerations:
(1) Differentiation of knob shape and position. Errors by the flightcrew have included confusing speed and heading knobs on the MSP.
(2) Design to support correct selection of target values. Use of a single control, such as concentric controls, for selecting multiple command reference targets has resulted in erroneous target value selection.
(3) Commonality across aircraft types. Use of uniform control design in different aircraft prevents negative transfer of learning with respect to operation of the controls. Using knowledge about the operation of the controls on one type of airplane has resulted in activation of the incorrect control when pilots move from that type of airplane to another type of airplane.
An example of this is confusion between the takeoff/go-around (TOGA) button and the autothrust disengagement button when transitioning between aircraft types with differing designs and locations for these controls.
(4) Positioning of controls and related indications. Individual FGS controls, flight mode annunciator (FMA), and related PFD information should be positioned so that, as much as reasonably practical, items of related function have similarly related positions.
Misinterpretation and confusion have occurred due to the inconsistent arrangement of FGS controls with the annunciations on the FMA.
(5) Inadvertent operation. The FGS controls must be located to discourage or avoid inadvertent operation, such as inadvertent engagement or disengagement. See § 25.777(a).
Further design aspects of the FGS controls, other than location of the controls, should also be used to discourage or avoid inadvertent operation. Examples include the shape of the control and the force required for operation.
44. FGS Mode Selection, Annunciation, and Indication.
a. Annunciation of engagement of the FGS. Engagement of the FGS functions must be suitably annunciated to each pilot. See § 25.1329(i). Guidance is provided in Chapter 3, Flight Guidance System Engagement, Disengagement, Indications, and Override, of this AC.
b. Description of FGS modes. The operator should be provided with appropriate descriptions of the FGS modes and their behaviors.
c. FGS mode annunciations. Mode annunciation must indicate the state of the system.
See § 25.1329(i). Mode annunciation should be presented in a manner compatible with flightcrew procedures/tasks and be consistent with the mode annunciation design for the specific aircraft type. That is, the mode annunciation should be compatible with other flight deck systems mode annunciations. Mode selector switch position or status is not acceptable as the sole means of mode annunciation. See § 25.1329(i). Modes and mode changes should be depicted in a manner that achieves flightcrew attention and awareness.
(1) Active and armed modes. The FGS mode annunciations must effectively and unambiguously indicate the active and armed modes of operation. See § 25.1329(i). The mode annunciation should convey explicitly, and as simply as possible, what the FGS is doing (for active modes), what it will be doing (for armed modes), and target information (such as selected speed, heading, and altitude) for satisfactory flightcrew awareness.
(2) Location. Mode annunciations should be located in the forward field of view.
For example, a suitable location is on the PFD. Engaged modes should be annunciated at different locations than armed modes to assist in mode recognition.
(3) Discriminators. Color, font type, font size, location, highlighting, and symbol flashing have historical precedent as good discriminators, when implemented appropriately. The fonts and font size should be chosen so that annunciation of FGS mode and status information is readable and understandable without eyestrain when viewed by the pilot seated at the design eye position. The use of graphical or symbolic (that is, non-textual) indications is acceptable.
Implementation of such discriminators should follow accepted guidelines, as described in applicable international standards (such as the current edition of AC 25-11, Electronic Flight Displays), and should be evaluated for their consistency and integration with the flight deck design.
(4) Color. Color should be used in a consistent manner and assure compatibility with the overall use of color on the flight deck. Specific colors should be used such that the FGS displays are consistent with other flight deck systems, such as a FMS. The use of monochrome displays is not precluded, provided that the aspects of flightcrew attention and awareness are satisfied. Engaged modes should be annunciated with different colors than armed modes to assist in mode recognition.
d. Mode changes.
(1) Operationally relevant mode changes. Mode changes that are operationally relevant—especially mode reversions and sustained speed protection—should be clearly and positively annunciated to ensure flightcrew awareness. Altitude capture is an example of an operationally relevant mode that should be annunciated because pilot actions during that brief time the mode is operational may have different effects on the airplane. Annunciation of sustained speed protection should be clear and distinct to ensure flightcrew awareness. The FGS submodes that are not operationally relevant (for example, submodes as the FGS transitions from instrument landing system Localizer (LOC) Capture to Localizer Track) need not be annunciated.
(2) Attention-getting features. The transition from an armed mode to an engaged mode should provide an additional attention-getting feature, such as boxing and flashing on an electronic display (see AC 25-11) for a suitable, but brief, period (for example, 10 seconds) to assist in flightcrew awareness. Aural notification of mode changes should be limited to special considerations.
(3) Use of alerts. In-service experience has shown that mode annunciation alone may be insufficient—unclear or not compelling enough—to communicate mode changes to the flightcrew, especially in high workload situations. Therefore, the safety consequences of the flightcrew not recognizing mode changes should be considered. If necessary, an appropriate alert should be used.
e. Failure to engage or arm. The failure of a mode to engage or arm when selected by the pilot should be apparent.
f. FGS mode display and indications. Mode information provided to the flightcrew should be sufficiently detailed, so that the consequences of the interaction between the FGS and the flightcrew can be determined unambiguously. The FGS interface should provide timely and
27 positive indication when the FGS deviates from the pilot’s direct commands (for example, a target altitude or speed setting) or from the pilot’s preprogrammed set of commands (for example, waypoint crossing). The interface should also provide clear indication when there is a difference or conflict between pilot-initiated commands. An example would be when a pilot engages positive vertical speed and then selects an altitude that is lower than the aircraft altitude.
The default action taken by the FGS should be made apparent.
45. FGS Alerting, Warning, Caution, Advisory, and Status.
a. General.
(1) Alerting provisions. Alerting information must follow the provisions of § 25.1322. The advisory material associated with § 25.1322 should be consulted. Alerts for FGS engagement and disengagement are described in Chapter 3 of this AC.
(2) Determination of FGS capability. There should be some method for the flightcrew to determine and monitor the availability or capability of the FGS (for example, prior to dispatch), where the intended operation is predicated on the use of the FGS. The method of monitoring provided should take account of the hazard resulting from the loss of the autopilot function for the intended operation.
b. Speed protection alerts.
(1) Alerts to crew. To assure crew awareness, an alert should be provided when a sustained speed protection condition is detected. This is in addition to any annunciations associated with mode reversions that occur as a consequence of invoking speed protection. (See Chapter 5, paragraph 57, Speed Protection, of this AC).
(2) Alert specifications.
(a) Low-speed protection. Low-speed protection alerts should include both an aural and a visual component.
(b) High-speed protection. High-speed protection alerts need include only a visual alert component because of existing high-speed aural alert requirements. However, giving an alert prior to that required aural alert is not precluded. See § 25.1303(c)(1) for overspeed alerting regulations.
(3) Consistency. Alerts for speed protection should be consistent with the protection provided and with the other alerts in the flight deck.
(4) Nuisance alerts. Care should be taken to set appropriate values for indicating speed protection that would not be considered a nuisance for the flightcrew.
c. Loss of autopilot approach mode. The loss of the Approach mode requires immediate flightcrew awareness. This may be accomplished through autopilot disengagement described in the current edition of AC 120-28. If the autopilot remains engaged and reverts to a nonapproach mode, an appropriate aural warning and/or visual alert should be provided.
d. Awareness of potential significant transient condition (“bark before bite”).
(1) General. There have been situations where an autopilot was engaged, operating normally, and controlling up to the limit of its authority for an extended period of time, and the flightcrew was unaware of the potential hazard. This service experience has shown that, without timely flightcrew awareness and action, such a situation can progress to a loss of control after autopilot disengagement, particularly in rare normal or non-normal conditions. However, with adequate flightcrew awareness and pilot action, loss of control may be prevented.
(2) Flightcrew alert(s). To help ensure flightcrew awareness and timely action, appropriate alert(s)—normally a caution or warning—should be provided to the flightcrew for conditions that could require exceptional piloting skill or alertness for manual control following autopilot disengagement (for example, significantly out-of-trim conditions). The number and type of alerts required should be determined by the unique situations that are being detected and by the crew procedures required to address those situations. Any alert should be clear and unambiguous and should be consistent and compatible with other flight deck alerts. Care should be taken to set appropriate thresholds for these alerts so that they are not considered a nuisance for the flightcrew.
(3) Situations to consider for an alert.
(a) Sustained lateral control command. If the autopilot is holding a sustained lateral control command, it could be indicative of an unusual operating condition for which the autopilot is compensating. Examples of such unusual operating conditions are asymmetric lift and/or drag due to asymmetric icing, fuel imbalance, or asymmetric thrust. In the worst case, the autopilot may be operating at or near its full authority in one direction. If the autopilot were to disengage while holding this lateral trim, the result would be that the airplane could undergo a rolling moment that could possibly take the pilot by surprise. Therefore, a timely alert should be considered to permit the crew to manually disengage the autopilot and take control prior to any automatic disengagement that might result from the condition.
(b) Sustained pitch command. If the autopilot is holding sustained pitch command, it could be indicative of an unusual operating condition (for example, inoperative automatic horizontal trim) for which the autopilot is compensating. If the autopilot were to disengage while holding this pitch command, the result would be that the airplane could undergo an abrupt change in pitch that could possibly take the pilot by surprise. Therefore, a timely alert should be considered to permit the crew to manually disengage the autopilot and take control prior to any automatic disengagement that might result from the condition.
(c) Bank and pitch angles. Most autopilots are designed with operational limits in both the pitch and roll axes, such that those predetermined limits will not be purposely exceeded. If the airplane exceeds those limits, it could be indicative of a situation that requires the pilot to intervene. Such a situation may not be covered by paragraphs 45.d(3)(a) or 45.d(3)(b) above. Therefore, a timely alert should bring this condition to the attention of the flightcrew and permit the crew to manually disengage the autopilot and take control prior to any automatic disengagement that might result.
(4) Automatic disengagement. It is preferable that the autopilot remains engaged during out-of-trim conditions. However, if there is an automatic disengagement feature due to excessive out-of-trim, an alert should be generated and should precede any automatic disengagement with sufficient margin to permit timely flightcrew recognition and manual disengagement. See also Chapter 3, paragraph 30, Override of the FGS, of this AC for related material.
Note 1: This paragraph is not intended to require alerting for all instances of automatic autopilot disengagement. It is intended only for conditions that would, if not addressed, lead to disengagement that could result in a significant transient (or greater) for which the pilot may be unprepared. The intent is to provide crew awareness that would allow the flightcrew to be prepared with hands on controls and take appropriate corrective action before the condition results in a potentially hazardous airplane configuration or state.
Note 2: This paragraph describes alerting requirements for conditions resulting in unintended out-of-trim operation. There are FGS functions that can intentionally produce out-of-trim conditions. Examples would be parallel rudder operation in align or engine failure compensation modes, pitch trim operation during the approach/landing to provide trim up/flare spring bias, and pitch trim operation for certain types of speed/Mach trim systems. It is not the intent of this paragraph to require alerts for functions producing intentional out-of-trim conditions. Other system indications (for example, mode and status annunciations) should be provided to make the crew aware of the operation of these functions, where appropriate.
46. FGS Considerations for HUDs.
a. General. HUDs have unique characteristics compared to flight displays installed on the instrument panel. Most of these HUD differences are addressed during HUD certification whether or not the HUD provides flight guidance functions. The intent of this chapter is to address how such HUD differences may affect FGS functions. (See SAE ARP5288 for further information on this subject. See paragraph 4.c of this AC for information on how to obtain SAE documents.)
b. Characteristics of HUD guidance.
(1) Supplemental use display system. If the HUD is designed as a supplemental use display system, it does not replace the requirement for standard head-down display (HDD) of flight instrument data. The HUD is intended for use during takeoff, climb, cruise, descent, approach, and landing under day, night, visual meteorological conditions (VMC), and instrument meteorological conditions (IMC) conditions. When it can be reasonably expected that the pilot will operate primarily by reference to the HUD, it should be shown that the HUD is satisfactory for manually controlling the airplane and for monitoring the performance of the FGS.
(2) External visual references. During takeoff and landing in certain light and visibility conditions, HUD symbology can be extremely dominant in comparison to external
30 visual references. When visual references are relatively dim, extremely active symbology dynamics and guidance cue gains can lead the pilot to make excessively strong corrections. It should be shown that—if HUD guidance cues are followed regardless of the appearance of external visual references—they do not cause the pilot to take unsafe actions.
(3) Interference and occlusion. It should be shown that there is no interference between the indications of primary flight information and the flight guidance cues. In takeoff, approach, and landing FGS modes, the flight guidance symbology should have occlusion priority. That is, the flight guidance symbology should not be obscured or covered by the primary flight information. The HUD guidance symbology should not excessively interfere with pilots’ forward view, ability to visually maneuver the airplane, acquire opposing traffic, and see the runway environment.
(4) Display criteria. Generally, the criteria for the mechanization of guidance displayed on the HUD should be no different than for guidance displayed on the HDD. See Chapter 5 of this AC.
(5) Conformal symbology. Unlike HDDs, HUDs are capable of displaying certain symbology conformal to the outside scene, including guidance cues. Consequently, the range of motion of this conformal symbology, including the guidance cues, can present certain challenges in rapidly changing and high crosswind conditions. In certain cases, the motion of the guidance and the primary reference cue may be limited by the field of view. It should be shown that, in such cases, the guidance remains usable and that there is a positive indication that it is no longer conformal with the outside scene.
(6) Low-visibility approach. The HUD guidance is often used in cases, like the low-visibility approach, where the pilot will need to reference both the information displayed on the HUD and outside references. Consequently, it should be shown that the location and presentation of the HUD information does not distract the pilot or obscure the pilot’s outside view. For example, it would be necessary for the pilot to track the guidance to the runway without having the view of runway references or hazards along the flightpath obscured by the HUD symbology.
(7) Clutter. The HUD display should present flight guidance information in a clear and unambiguous manner. Display clutter should be minimized. Some flight guidance data elements are essential or critical and should not be removed by any declutter function.
c. HUD/HDD compatibility.
(1) General. The HUD FGS symbology should be compatible and consistent with symbology on other FGS displays such as head down electronic flight instruments. The FGS-related display parameters should be consistent to avoid misinterpretation of similar information, but the display presentations need not be identical. The HUD and head-down PFD formats and data sources need to be compatible to ensure that the same FGS-related information presented on both displays have the same intended meaning.
(2) Consistency and compatibility. While not all information displayed on the HUD is directly related to the FGS, the pilot is likely to use most of the displayed information while using the HUD-displayed guidance and FGS annunciations. Therefore, when applicable, the
31 guidelines below for the presentation of FGS-related display information should be followed as much as possible. Certain deviations from these guidelines may be appropriate due to conflict with other information display characteristics or requirements unique to HUDs. These may include minimization of display clutter, minimization of excessive symbol flashing, and the presentation of certain information conformal to the outside scene.
(a) Symbology. Symbols should be the same format. For example, a triangle-shaped pointer head down should appear as a triangle pointer head up. However, some differences in HUD symbology, such as the FD “circle” versus head down FD “bars” or “wedge,” have been found acceptable.
(b) Location. Information (symbols) should appear in the same general location relative to other information.
(c) Alphanumeric data. Alphanumeric readouts should have the same resolution, units, and labeling. For example, the command reference indication for “vertical speed” should be displayed in the same foot-per-minute increments and be labeled with the same characters as the HDDs.
(d) Analog scales. Analog scales or dials should have the same range and dynamic operation. For example, a glideslope deviation scale displayed head up should have the same displayed range as the glideslope deviation scale displayed head down, and the direction of movement should be consistent.
(e) Display of FGS modes. The FGS modes and status state transitions should be displayed on the HUD using consistent methods, except for the use of color. That is, the method used head down to indicate a FD mode transitioning from armed to captured should also be used head up.
(f) Information sources. Information sources should be consistent between the HUDs and the HDDs used by the same pilot.
(g) Display of FGS command information. When FGS command information (for example, a FD command) is displayed on the HUD in addition to the HDDs, the HUD depiction and guidance cue deviation “scaling” needs to be consistent with that used on the HDDs. This is intended to provide comparable pilot performance and workload when using either HUDs or HDDs.
(h) Display for pilot monitoring (PM). The same information concerning current HUD system mode, reference data, status state transitions, and alert information that is displayed to the pilot flying (PF) on the HUD should also be displayed to the PM on the HDDs.
Consistent nomenclature should be used to ensure unambiguous awareness of the HUD operation.
d. Alerting issues.
(1) Alerts displayed on HUDs. Although HUDs are typically not intended to be classified as integrated caution and warning systems, they may display cautions, warnings, and
32 advisories as part of their FGS function. In this regard, HUDs should provide the equivalent alerting functionality as the head down PFD(s). Warnings that require continued flightcrew attention on the PFD also should be presented on the HUD (for example, TCAS, wind shear, and ground proximity warning (GPWS) annunciations). If master alerting indications are not provided within the peripheral field of view of the pilot while using the HUD, the HUD should provide annunciations that inform the pilot of caution and/or warning conditions.
(2) Monochrome HUDs. For monochrome HUDs, appropriate use of attentiongetting properties, such as flashing, outline boxes, brightness, size, and/or location are necessary to adequately compensate for the lack of color normally assigned to distinguish and call attention to cautions and warnings.
(3) Multicolor HUDs. For multicolor HUDs, the use of red, amber, or yellow for symbols not related to caution and warning functions should be avoided, so that the effectiveness of distinguishing characteristics of true cautions and warnings is not reduced.
(4) Single HUD installation. Single HUD installations rely on the fact that the pilot not flying will monitor the head down instruments and alerting systems for failures of systems, modes, and functions not associated with PFDs.
(5) Dual HUD installations. Dual HUD installations require special consideration for alerting systems. It should be assumed that both pilots will be head up simultaneously (full or part-time), especially when the HUD is being used as the primary flight reference or when the HUD is required equipment for the operation being conducted. If master alerting indications are not provided within the peripheral field of view of each pilot while using the HUD, then each HUD should provide annunciations that direct the pilot’s attention to head down alerting displays. The types of information that should trigger the HUD master alerting display are any cautions or warnings not already duplicated on the HUD from head down primary display as well as any caution level or warning level engine indications or system alerts.
Note: The objective is to avoid redirecting attention of the pilot flying to another display when an immediate maneuver is required (for example, TCAS resolution advisory, wind shear).
(6) GPWS/TCAS on HUD. If a GPWS, wind shear detection system, wind shear escape guidance system, or a TCAS is installed, then the guidance, warnings, and annunciations required to be a part of these systems and normally required to be in the pilot’s primary field of view should be displayed on the HUD.
e. Upset/unusual attitude recovery guidance.
(1) Guidance cues. Upsets due to wake turbulence or other environmental conditions may result in near instantaneous excursions in pitch and bank angles and a subsequent unusual attitude. If the HUD is designed to provide guidance for recovery from upsets or unusual attitudes, recovery steering guidance commands should be distinct from and not confused with orientation symbology such as horizon “pointers.” For example, a cue for left control wheel/stick input should not be confused with a cue indicating direction to the nearest horizon. Guidance should be removed if cues become invalid at extreme attitudes, such as zenith, nadir, overbanked
33 (for example, greater than 90 degrees bank angle), or inverted. For extreme attitudes, it is acceptable for the pilot to transition to the HDD, provided that the cues to transition from the HUD are clear and unambiguous.
(2) Orientation cues. If the HUD is designed to provide only orientation during upsets or unusual attitudes (that is, no guidance cues are provided), those orientation cues should be designed to prevent them from being mistaken as flight control input commands.
47—51 [RESERVED]
34 CHAPTER 5. PERFORMANCE OF FUNCTION
52. General.
a. Intended function. The FGS should provide guidance or control, as appropriate, for the intended function of the active mode(s) in a safe and predictable manner within the airplane’s normal flight envelope. There are special considerations when the FGS is operating at the limits of its performance capabilities or under significant environmental conditions. The following paragraphs provide criteria for acceptable means of compliance and interpretive material pertaining to these considerations.
b. Effect of system tolerances. Where system tolerances have a significant effect on autopilot authority limits, consideration should be given to the effect on autopilot performance.
Factors to be considered include, but are not limited to, tolerances of servo authority, servo clutch setting, “cam-out” settings, control friction, and sensor tolerances.
53. Normal Performance.
a. General. The FGS should be designed to provide guidance or control, as appropriate, for the intended function of the active mode(s) in a safe and predictable manner within the airplane’s normal flight envelope.
b. Conditions to consider. The design of the FGS should consider the normal conditions listed in Table 5-1 of this AC. This table does not fully define every condition that may be encountered during an airplane’s life and unequivocally categorize what can be considered to be a “normal condition.” Rather, the table is intended to give examples to be used during system development and testing. By the very nature of the phenomena involved, there will always be some subjectivity to these categorizations. Also, the same conditions may affect different airplane models in very different ways. These differences should be considered in determining how to characterize the severity of the conditions discussed in the table.