(ii) Related Documents Document Title SAE- ARP 4155 Human Interface Design Methodology for Integrated Display Symbology SAE-ARP 4033 Pilot-System Integration SAE-ARP 4102 Flight Deck Panels, Controls, and Displays SAE-ARP 4102-7 Electronic Displays SAE-ARP 4927 Integration Procedures for the Introduction of New Systems to the Cockpit SAE-ARD 50019 Human Engineering Issues for Enhanced Vision Systems DOT/FAA/RD-93/5 Human Factors for Flight Deck Certification Personnel DOT/FAA/ AM-13/21 Multi-Function Displays: A Guide for Human Factors Evaluation
c. Scope.
(1) The objective of this MG is to provide guidance regarding the regulatory HF components that should be considered during a certification project for rotorcraft. While applicants are the main target audience, this guidance can be used by all FAA project team members including:
(i) Aircraft Evaluation Group (AEG) inspectors,
(ii) avionics engineers,
(iii) project managers,
(iv) flight test pilots and engineers,
(v) HF specialists and engineers,
(vi) propulsion engineers, and
(vii) systems engineers.
(2) This MG is general and high level, covering the HF aspects of certificating a rotorcraft or system installation on a new or previously-certificated transport category rotorcraft. It is intended to guide applicants and certification engineers on what they should consider regarding HF during project planning and execution..
Page MG 20 - 5
AC 29-2C, Chg 7 2/4/2016
d. System Description.
(1) General. Develop a system description with enough detail to provide for a common understanding of the design, function, and operation of the system.
Thoroughly detail any new or novel features, interfaces, controls, or other pilot-system interfaces that pilots will use.
(2) Intended Function (§ 29.1301).
(i) Describe the intended functions of the major pilot-system interfaces. In order to assess the potential hazards posed by the installation of a system, there must be a clear understanding of the function provided by the system and the declared intended function. Accomplish this by providing a detailed description of how the system supports the specified function(s). For example, describing a function or component, such as a display, as “for pilot situation awareness only” or, “for situational awareness only” is not adequate regardless of whether the function or component is required by the regulations. A better example for a non-required function might be “to increase terrain awareness.” Identify the following items, as appropriate, focusing on new or unique features that affect the crew interface or the allocation of tasks between the pilot(s) and the rotorcraft systems:
(A) The intended function of the system from the pilot’s perspective (coupling between the pilot and the system)..
(B) The role of the pilot relative to the system.
(C) The degree of integration or independence with other flight deck equipment.
(D) The novelty of the system or features of the system.
(E) The criticality of the system and alerting mechanism.
(F) Methods to reduce the occurrence and consequences of crew error when interacting with the system.
(G) The system features accessible to the pilot other than those normally considered needed for flight. For example, whether field loadable software, maintenance, and configuration functions are accessible by the pilot in flight and on the ground, or whether they are accessible only by maintenance personnel.
(ii) Use the following information to evaluate whether the intended functions and associated tasks are sufficiently detailed and specific:
(A) Whether each feature includes a statement of the intended function and a description of the task associated with this feature.
Page MG 20 -6
(B) Whether there are assessments, decisions, or actions required by the pilot for these intended functions.
(C) Whether other information is to be used in conjunction with these intended functions (for example, other cockpit systems), in combination with the system.
(D) Whether the operational environment in which these intended functions are to be used is adequately described (e.g., VFR, IFR, phase of flight).
(3) Cockpit layout (§§ 29.771, 29.773, 29.777, 29.1303, 29.1305, 29.1321,
29.1329, and Appendix B to part 29).
(i) Drawings of the cockpit layout showing positions of system components, even if preliminary, are beneficial for providing an understanding of the intended overall cockpit arrangement (controls, displays, sample display screens, seating, stowage, and so forth). Including measurements and dimensions of displays, their locations and locations of controls relative to the pilot’s central line of vision or the design eye position is also beneficial to both the applicant’s and certification authority teams. As the system design changes, keep the certification team updated so they are current on proposed changes. Give special attention to the following, especially if they are novel or unique:
(A) Arrangements of the controls, displays or other cockpit or flight deck features or equipment.
(B) Controls, such as cursor control devices, touchscreen displays, or new applications of existing control technology.
(C) Content, format, and function of the pilot interface on the display as generated by the systems software.
(D) Display hardware technology.
(E) Screen usage, alerting mechanisms, and mode annunciation.
(ii) Sketches of the crew interfaces for the specific systems or the items listed above can be helpful in providing an early understanding of the features that may face certification issues.
(4) Underlying principles for automation logic (§ 29.1309, § 29.1329, and Appendix B to part 29). Define the system’s automated functions design early in the process. The automation features should follow a design philosophy that supports the intended functions regarding the system behavior; modes of operation; and pilot interface with controls, displays, and alerts. For designs that involve significant automation, the way automation operates and communicates that operation to the pilot Page MG 20 - 7
- AC 29-2C, Chg 7 2/4/2016 can have significant effects on the crew interface. The system description should include, but not be limited to:
(i) Pilot actions to engage or disengage, or activate or deactivate modes and features.
(ii) Principles underlying mode transition.
(iii) Mode annunciation scheme.
(iv) Automation engagement or disengagement principles.
(v) Level of automation.
(vi) Logic diagrams and complexity of the logic, if available.
(vii) Failure modes, how they appear to pilots, and how pilots’ interaction with the system and rotorcraft changes.
(5) Operational considerations (§ 29.1523, Minimum flight crew; § 29.1525, Kinds of operations). Consider consulting the AEG inspector that is responsible for the make and model of rotorcraft on the system installation.
(i) Pilot characteristics (§ 29.1523). The FAA has not accepted certain designs, in past projects, that specifically relied on crew resource management or certain pilot characteristics to mitigate a system design flaw. Consider assessing the level of certification, skill, and knowledge a “nominal pilot” possesses in order to evaluate the pilot workload when interacting with the system and rotorcraft.
(ii) Identify the operations the system is designed to support. Although sometimes considered less complex than installations for operation under IFR, the HF evaluation of installations for operation under VFR should include the same rigor, as both present HF challenges to the pilot. For example, complex systems or systems that require the pilot to spend considerable time interfacing with a system’s functions and interactions with other rotorcraft systems will require the pilot to allocate attention from flying the rotorcraft. The results are increased workload with varying changes in the pilot’s ability to attend to flying the rotorcraft. The following are some considerati ons:
(A) For rotorcraft operating only under VFR, describe the operations the system is meant to support, taking into account day and night operations. For example, for installation of an electronic display systems (EDS) display suite that integrates with external GPS navigators, consider:
(1) The effect of the pilot-system interface on the pilot’s attention allocation and workload.
Page MG 20 -8
(2) How it affects the pilot’s external scan and “see and avoid” tasks (whether it requires extensive heads-down time) (B) For rotorcraft certificated to operate under IFR, describe the operations the system supports. For example, for installation of a new EDS suite and a WAAS GPS system that interfaces with the existing autopilot and one of the new operations is steep angle low speed approaches, consider how the system will support or change pilot workload.
(iii) System Operation procedures. Describe and evaluate the pilot procedures for both normal and abnormal conditions since the design of the system and use of procedures are interrelated. Additionally, development and presentation of procedures and limitations can affect pilot workload, particularly in abnormal conditions.
Identify and evaluate any expected pilot memory or “bold-face” items (procedures that the pilot must perform from memory prior to referencing a checklist or flight manual). In addition to the flight manual or flight manual supplement, system operations procedures may include:
(A) Quick reference handbook to accompany the flight manual.
(B) Abbreviated checklists to accompany the flight manual.
e. Certification Requirements. Identify the regulations in the certification basis for system or component installations that have HF implications. These can be identi fied either as part of the certification plan or a separate human factors certification plan. The certification plan should indicate the method of compliance for each regulation and contain sufficient detail to ensure human factors considerations are adequately addressed. The plan should also allow adequate time to accomplish all necessary testing agreed to by the applicant and the FAA/AUTHORITY.
(1) Address and evaluate the following in the certification plan:
(i) The intended use of the system does not require any exceptional skill or generate any unreasonable workload for the pilot.
(ii) The use of the display does not require unreasonable training requirements to demonstrate adequately that the pilot can understand and properly operate the system in all operational environments. Take into account whether or not the aircraft into which the system is being installed requires a type rating. Consider coordinating with the aircraft evaluation group early in the certification process.
(iii) Demonstration of the design characteristics of the display system support error avoidance and management (e.g., detection, recovery, etc.).
Page MG 20 - 9
AC 29-2C, Chg 7 2/4/2016
(iv) That the display system integration is consistent or compatible with other cockpit controls. In addition, that it displays and creates no added burden on the pilot with respect to the new display system or operation of other systems.
(v) If a failure occurs, it will not prevent the pilot from safely operating the rotorcraft.
(2) The manufacturers should provide design rationale for their decisions regarding new or unique features in a display. Evaluation pilots should verify that the data supports a conclusion that any new or unique features have no unsafe or misleading design characteristics.
(3) Several pilots and human factors representatives should conduct display and system interface evaluations, particularly when the applicant is installing a system for the first time in a particular category of helicopter. More than one test pilot should be used to ensure multiple data inputs. For systems that contain new or unique features, consider a greater number of evaluators. A reasonable amount of training time should be allowed to learn all required features of the display system. The evaluators should be familiar with the guidance contained in this advisory circular before performing the evaluation. Additional information helpful in developing evaluation plans can be found in GAMA Publication No. 10, Recommended Practices and Guidelines for Part 23 Cockpit/Flight Deck Design; DOT/FAA/AM-01/17, Human Factors Design Guidelines for Multifunction Displays; and section AC 29 MG 19 of this AC.
f. Methods of Compliance. The parts of the certification plan that address the HF portions of the regulations should describe the methods used to demonstrate compliance with sufficient detail to allow the certification authority to evaluate the appropriateness and adequacy of the proposed methods of compliance. It is important that the proposed methods of HF compliance are coordinated and discussed with the certification authority to identify HF issues early in the program to avoid certification schedule delays. Paragraph i. of this MG below, contains a sample compliance matrix for HF.
g. Discussion of selected part 29 regulations related to human factors and performance.
(1) For the purposes of brevity, the regulations discussed are not restated. For all compliance-related documents, the certification plan should use the exact wording of the regulation.
(i) This part of the guidance does not include all regulations associated with HF and flightcrew interfaces listed in the table in paragraph b. above. In addition, several of the regulations are written in general terms. In these cases, subjective data are often used to establish compliance.
Page MG 20 -10
(ii) Due to the subjective nature of many of the HF aspects of the regulations, the certification authorities encourage applicants to carefully consider and thoroughly describe the means they intend to use to demonstrate compliance with each regulation.
The applicant may choose to provide the detailed description of the means of compliance in subsequent submitted test plans. Use the information contained in the discussion for each regulation, presented in paragraph g.(2), to assess the appropriateness and adequacy of the chosen methods. The certification authority and the applicant should meet to discuss and reach agreement as to the acceptability of the proposed techniques prior to the collection of compliance demonstration data.
Demonstrate compliance through similarity and minimal testing for simple and straightforward applications that have little impact on pilot workload, system awareness, tasking, or performance.
(iii) More complex, integrated designs may require pilot evaluation under actual anticipated flight conditions after the performance of analytical and componentlevel bench evaluations. For these tests, it is critical the flight test pilots are objective regarding their performance using systems and controls. If using pilots other than test pilots, observers should be alert to possible differences between how the pilot performs and interfaces with a system and the pilot’s ratings. The test program should include sufficient simulation and flight testing to ensure::
(A) Reasonable training times and learning curves.
(B) Acceptable interpretation and operation error rates equivalent to or less than previously certificated comparable systems.
(C) The intended user (pilot) of the system does not require any exceptional skill, strength, or alertness to operate the system.
(D) Proper integration and compatibility with other controls or displays, or both, and with other equipment in the cockpit.
(iv) Typically, rotorcraft systems are designed, as a minimum, to prevent hazards to the rotorcraft if they malfunction or fail. Therefore, if a system failure occurs, the pilot should be able to continue safe operation of the rotorcraft. Pay particular attention to the hazards of presenting misleading information to the pilot in the event of a malfunction. Applicants are encouraged to conduct early analyses and evaluations of new systems to facilitate timely identification and resolution of HF related certification issues.
(2) The following is a partial listing of the HF-related regulations and associated discussion of each of those regulations with considerations for demonstration of compliance.
(i) Section 29.672.
Page MG 20 - 11
AC 29-2C, Chg 7 2/4/2016 (A) Section 29.672(a). Provide a warning signal that is distinguishable other cockpit alerts. If an audio signal is used, the pilot must be able to discriminate it from all other cockpit audio alerts.
(1) Conduct evaluations in the rotorcraft during both ground and flight operations with varying levels of background noise.
(2) Assess the discriminability of the visual and auditory alert in multiple alert scenarios, if applicable.
(3) Applications that employ voice technology should meet these same criteria.
(4) Conduct analysis, simulation or flight test to show that the system would not produce nuisance alerts when the rotorcraft is conducting normal flight operations.
(B) Section 29.672(b). Determination of exceptional pilot skill or strength is subjective. When evaluating for "exceptional pilot skill," evaluators should consider the complexity of the task in terms of the performance requirement (level of accuracy or precision), the number of steps, memory load, checklist use, time-to-perform, and if needed, training requirements. The test pilots involved in the program normally do these evaluations. For "exceptional pilot strength," it is also important to conduct evaluations considering the minimum strength capabilities of the pilot. Consider using pilots that represent a fifth percentile female as the low-end of the strength spectrum.
(1) There is guidance that may be useful to applicants in determining strength considerations in section 29.143 of this AC and the strength study in Human Force Exertions in Aircraft Control Locations, report no. AMRL-TR-71-119, February 1972. This study provides several examples of maximum force exertion from various locations of controls in the cockpit; however, there are always unique situations that can arise during the design of a new or modified cockpit.
(2) When new or unique situations arise, conduct evaluations early on to ensure that the strength required to activate the control does not fall outside the limitations of the pilot population.
(ii) Section 29.679. A number of accidents have occurred because pilots have tried to take off with either the manufacturer’s control lock or a substitute device in place. A couple of issues can cause this problem. One is whether the "unmistakable warning to the pilot” is, in fact, unmistakable. Another is the use of unapproved devices to lock the control system. Various approaches and devices developed to make it apparent that the control is locked. When evaluating a control lock system, consider several factors in finding compliance with the regulation.
Page MG 20 -12
(A) The lock and its warning, if separate from the lock, should be easily discernable during both day and night operations. Consider the color, location, shape, and accessibility of the device, ease of removal by a seated pilot, and legibility of any placards, etc.
(B) The system operation should be obvious. It should only be possible to install the lock such that the warning placard is properly displayed.
(C) When engaged, the lock design should limit the operation of the rotorcraft so that the pilot receives unmistakable warning in the cockpit before takeoff by an effective means such as:
(1) preventing the application of sufficient engine power to attempt takeoff,
(2) preventing or changing a method of grasping or holding a primary control such as the cyclic or collective, or
(3) use of an audio warning device that cannot be disengaged.
(D) For rotorcraft with separate locks for collective and cyclic, where one lock is removable independently of the other, each lock should independently meet these criteria.
(iii) Section 29.771. This regulation correlates with most of the other HF - related regulations, particularly in situations where a pilot may allocate attention to a particular system or task at the expense of flying the rotorcraft. Applicants should identify aspects of the pilot-rotorcraft interface that might require significant or sustained concentration or physical effort which can lead to distraction and fatigue. Many factors can affect concentration and fatigue, such as noise, vibration, seat comfort, excessive control forces, and poorly designed displays, controls, or pilot-system interfaces.
Methods of compliance should focus on evaluation procedures that examine potential concentration demands and sources of fatigue for the flight crew. Some issues that can contribute to unreasonable concentration or fatigue are:
(A) Pilot-system interface. Interface design can potentially result in a large concentration trap. Interfaces that require substantial heads-down time in rotorcraft without stability augmentation systems can lead to the rotorcraft deviating from the pilot’s intended flight path. The system’s ability to support the pilot regarding input , cross-check, error identification, and recovery contributes to the attention resources the pilot uses and resulting concentration. Evaluations on a bench or simulator where the system interface is accurately portrayed can help identify potential issues. Flight evaluation will also provide valuable information regarding the design and pilot’s ability to work with that design.
Page MG 20 - 13
AC 29-2C, Chg 7 2/4/2016 (B) Display design. A number of factors associated with display design can ultimately affect concentration and fatigue. Displays that are difficult to read or contain poorly organized information, or lack necessary information, result in greater demands on pilot attention and concentration. Conduct evaluations under operationally representative scenarios to assess the effectiveness and usability of the displays.
(C) Cockpit and system control design and function. The ease of identification, accessibility, and usability of cockpit controls can affect the level of pilot concentration. Conduct evaluations to ensure all cockpit controls are easy to identify, access, and operate as required in flight. New control interfaces, such as touch pads or voice-command, should be evaluated in as many operational environments as possible to assess the pilot’s ability to perform tasks requiring their use.
(D) Pilot seats. Poorly designed seats have the potential to create fatigue.
Evaluate seats to determine if they contribute a significant amount of fatigue. Conduct these assessments using test participants and gathering subjective data. Conduct assessments based upon the expected average length of flight time the pilot remains in the seat, for a typical flight for the rotorcraft under evaluation. Subjective comments should be solicited from test participants concerning muscle tension, “hotspots” (areas where harder body contact is experienced), and body soreness or discomfort. Lateral support in the seat pan and lumbar support in the seat back have been used to increase seat comfort.
(E) Cockpit environmental control. Consider sufficient heating and cooling ability along with adequate ability to defrost or defog windscreens.
(iv) Section 29.773(a)(1). There must be sufficient external vision to enable the pilot to safely fly and control the rotorcraft. The design must provide a level of safety that ensures adequate external vision to see and avoid traffic and other obstacles in the environment. Consider any optical distortions in the windshield or canopy, especially in the prime viewing areas, which may degrade external viewing. For additional information, section 29.773 of this AC.
(A) The capability to provide an adequate view of the external environment is essential for safe operation. Applicants should consider defining an eye reference point in the design that will account for the range of expected pilot physical dimensions.
Conduct evaluations with individuals that represent a range of different human physical dimensions. Consider seat adjustment capability as it accommodates the range of expected pilot physical dimensions. Give particular attention to the size and location of rotorcraft structures that may obstruct the external view. Section 29.773 of this AC contains a cockpit visibility diagram showing the horizontal and vertical obstruction limits applicable to pilot visibility.
(B) Reflections. There should be no compromise of vision outside the cockpit by reflections from either internal or external lighting sources. Assess reflections from instrument and panel lighting as to their effect on pilot external view.
Page MG 20 -14
Refer to section 29.773 of this AC for the area of the pilot compartment field of view that should be free from obstruction. Reflections appearing in this area should be blocked or otherwise diminished. Ensure that reflections do not affect outside visibility looking cross-cockpit. If possible, use full scale mockups to assess night lighting reflections to reduce program risk by identifying potential problem areas early. Assess the effect of cabin lighting on reflections in the pilot’s view area. Consider the use of curtains or other modifications to eliminate reflections from the aft cabin.
(C) Sunlight reflecting off instruments, display faces, and other cockpit structures will affect the pilot’s performance. Blocking or shading features may need to be included in the design. Additionally, check to ensure instruments, indicators, and displays are readable in all lighting conditions.
(D) Glare from instrument lighting can cause pilot performance issues.
Light balance and instrument lighting design should allow the pilot to illuminate all instruments and panels without having to adjust for glare. External lights can also create glare if the rotorcraft windows and windscreen scatter light entering the cockpit.
Assess for glare in both night and day environments. Assess the cockpit in all potential lighting conditions with sun at all angles including dawn or dusk conditions, with the sun near the horizon, higher sun angles (both in front, behind, and directly overhead of the rotorcraft), and during night conditions (both dark night and moonlit conditions). In addition, evaluate the effect various internal lighting selections and levels have on readability and usability of rotorcraft equipment and systems and the ability to see outside the cockpit.
(v) Section 29.777.
(A) Section 29.777(a). This regulatory provision addresses the usability of a control from a location and identification perspective. The location of a control can significantly affect the pilot’s ability to identify the control easily, the ease and convenience of operation of the control, confusion as to the control's operation, and an inadvertent operation of that control. Several techniques can aid in control identification and use. The size, shape, color, configuration, and method of operation can discriminate between controls and aid in control identification. Consider these other design related characteristics, relative to the control's location, when evaluating control identification and use. Unless its function and method of operation are obvious, a control must be labeled in accordance with § 29.1555. The suggested analyses and evaluation procedures described for showing compliance with § 29.671 are also applicable and recommended for this regulation.
(B) Section 29.777(b). This regulatory provision addresses the capability to operate a control through its full range of motion, considering potential interference from clothing and cockpit structures. This assessment can be accomplished simultaneously with the assessment for § 29.785(c) if the pilot is strapped into the seat wearing the lap belt and shoulder harness. Refer to section 29.777, paragraph b. of this AC. It is important to conduct evaluations using individuals representing a range of Page MG 20 - 15
AC 29-2C, Chg 7 2/4/2016 potential user physical dimensions and users wearing different apparel, such as long sleeved shirts, jackets, and gloves. Applicants may use analytical methods, such as computer modeling of the cockpit or flight deck and the pilots, for early problem identification and risk reduction. Regardless of the analytical models used, demonstrate compliance in either a high fidelity mockup, that accurately represents the actual rotorcraft, or in an actual rotorcraft. Although the regulation requires compliance for a certain range of pilot heights, consider also using individuals from a fifth percentile female and a 95th percentile male body stature. Consider using individuals that have a range of arm reach and seating statures within the selected population.
(vi) Section 29.785. This regulation is related to § 29.777(b). Section
29.785(c) requires that the restraint system allows crewmembers to perform "functions necessary for flight operations” while restrained by the safety belt and shoulder harness.
The discussion and suggested evaluation procedures for § 29.777(b) of this AC are applicable and should be used for finding compliance with this regulation as well, with the exception that evaluations must be conducted with crewmembers seated with safety belts and shoulder harnesses fastened. Additionally, evaluators should only assess the capability to perform functions necessary for flight operations. The certification plan should include a list of those cockpit functions necessary for flight operations, under normal and abnormal conditions. As in § 29.777(b) above, consider using individuals from a fifth percentile female and a 95th percentile male body size to assess compliance.
(vii) Section 29.1301. This regulation has broad implications and addresses a wide range of design and operational considerations. An important aspect of this regulation that can significantly affect the evaluation and finding of compliance is the interpretation of the "intended function" of a system. The system’s intended function is typically determined by assessing the design, functional capability, and operational use of the system. Applicants will generally provide this information for certification purposes. Applicants should work cooperatively with the certification authori ty so that the “intended function” of a system is accurate, reliable, realistic, and acceptable.
Therefore, it is important that the certification team assess the design, functional capability, and use of the system and compare that with the description of the intended function.
(A) Section 29.1301(a). The use of performance- based criteria should be used in determining that a system is of a kind and design appropriate to its intended function. Applicants should consider the complexity of the system in determining the test requirements. For concerns pertaining to the pilot-vehicle interface, the evaluation should investigate the capability of the pilot to perform related tasks adequately.
Performance measurements such as time-to-perform, number of inputs, accuracy, comprehension, awareness of system state and performance, and perceived workload may be collected to assess compliance. Evaluations should be conducted using operationally representative scenarios. Simulation may be used to verify that properly trained pilots can adequately perform all tasks using the system. Finally, flight tests can be used to investigate specific normal and abnormal operational scenarios.
Page MG 20 -16