1 Introduction

Up to now the commercial aviation system is the safest transportation system in the world, and the accident rate is the lowest it has ever been. However, accident analyses have identified flight crew performance and error as significant factors in a majority of accidents involving transport category airplanes. Flight crews contribute positively to the safety of the air transportation system using their ability to assess complex situations and make reasoned decisions. However, even trained, qualified, checked, alert flight crew members can make errors. Human error is affected by a number of factors, including system design, training, operations, and pilots’ previous experiences. Human error is difficult to predict, and it cannot be prevented. An understanding of the causes of pilot error can minimize the likelihood of these occurrences and be used to create more error-resistant and error-tolerant systems. Some errors may be influenced by the design of airplane systems and their flight crew interfaces. A system that is error resistant makes it difficult to commit an error, e.g., through clear and simple designs. A system that is error tolerant provides the ability to mitigate the errors that are committed, e.g., by allowing the automated system to monitor flight crew actions or through the use of electronic checklists that provide a reminder of tasks to be completed [1].

Accidents often result from a sequence, or combination, of flight crew errors and safety related events. The design of the flight deck and other systems can influence flight crew task performance and may also affect the rate of occurrence and effects of flight crew errors. Human error is generally characterized as a deviation from what is considered correct in some context. In the hindsight of analysis of accidents, incidents, or other events of interest, these deviations might include: an inappropriate action, a difference from what is expected in a procedure, a mistaken decision, a slip of the fingers in typing, an omission of some kind, and many other examples. The regulation CS25.1302/FAR25.1302 is focus on human errors. The rule text is:

§25.1302 Installed systems and equipment for use by the flightcrew.

This section applies to installed systems and equipment intended for flightcrew members’ use in operating the airplane from their normally seated positions on the flight deck. The applicant must show that these systems and installed equipment, individually and in combination with other such systems and equipment, are designed so that qualified flightcrew members trained in their use can safely perform all of the tasks associated with the systems’ and equipment’s intended functions. Such installed equipment and systems must meet the following requirements:

(a) Flight deck controls must be installed to allow accomplishment of all the tasks required to safely perform the equipment’s intended function, and information must be provided to the flightcrew that is necessary to accomplish the defined tasks.

(b) Flight deck controls and information intended for the flightcrew’s use must:

(1) Be provided in a clear and unambiguous manner at a resolution and precision appropriate to the task;

(2) Be accessible and usable by the flightcrew in a manner consistent with the urgency, frequency, and duration of their tasks; and

(3) Enable flightcrew awareness, if awareness is required for safe operation, of the effects on the airplane or systems resulting from flightcrew actions.

(c) Operationally-relevant behavior of the installed equipment must be:

(1) Predictable and unambiguous; and

(2) Designed to enable the flightcrew to intervene in a manner appropriate to the task.

(d) To the extent practicable, installed equipment must incorporate means to enable the flightcrew to manage errors resulting from the kinds of flightcrew interactions with the equipment that can be reasonably expected in service. This paragraph does not apply to any of the following:

(1) Skill-related errors associated with manual control of the airplane;

(2) Errors that result from decisions, actions, or omissions committed with malicious intent;

(3) Errors arising from a crewmember’s reckless decisions, actions, or omissions reflecting a substantial disregard for safety; and

(4) Errors resulting from acts or threats of violence, including actions taken under duress.

[Doc. No. FAA-2010-1175, 78 FR 25846, May 3, 2013]

The unique aspect of rule 25.1302 is that it considers the flight crew task as the guiding element for assuring safe operation of the aircraft. It is the task that defines what equipment needs to be used when, in what order, by whom and in what combination with other installed equipment. Note however that it is not the task that is being certificated, but the integrated combination of installed equipment that enables safe task execution in this particular flight deck design.

2 Pilot Information Processing Model

A model of pilot information processing stages provides a framework for analyzing the different psychological processes used in interacting with flight deck systems and for carrying out a task analysis (See Fig. 1). The model depicts a series of processing stages or mental operations that typically (but not always) characterizes the flow of information as a pilot performs tasks in flight deck. Consider as an example the task of the pilot control airplane by using flight mode control panel (FMCP). The first thing is to get information by pilot’s senses. The information for the pilot may be speed and altitude indication on the (Primary Flight Display) PFD, or the order from the controller, or other information in the flight deck.

Fig. 1.
figure 1

Pilot information processing model [2]

Full size image

But sensation is not perception, and of this large array of sensory information only a smaller amount may be actually perceived by the pilot. Perception involves determining the meaning of the information, and such meaning is derived from past experience. This past experience is stored in pilot’s long term memory for understanding the situation. After perception, information processing follows decision or selection based on the pilot cognition. Next step, the pilot will response to the information input manipulating the FMCP. The airplane then response the input of control, and the corresponding status information will represent through the PFD and navigation display (ND) as the feedback loop.

The attention is a vital tool for much of information processing. It plays two qualitatively different roles [3]. In its first role as a filter of information that is sensed and perceived, attention selects certain elements for further processing, but blocks others, as represented by the smaller output from perception than input to it. Thus, the pilot may focus attention fully on the flight control. In the second role attention acts as a “fuel” that provides mental resources to the various information processing stages, as indicated by the dashed lines as shown in Fig. 1. Some stages demand more resources in some tasks than others.

In this pilot information processing model, flight deck (Human Machine Interface) HMI is the evaluation objects. The displays mainly refer to the information on the PFD, ND and EICAS, alerting, tactile etc. and the controls mainly refer to the button, switch on the overhead panels and console, levers, etc. An analysis and evaluation procedure based on pilot information processing model was carried on the civil aircraft flight deck interface design.

3 Flight Deck Analysis and Evaluation Procedure

There are 2 kinds of subject evaluation method were used for the human factor evaluation of the flight deck HMI. One is paper-pencil evaluation using modified Cooper-Harper Rating scale based on flight deck interface and description. The other method is flight deck walk through evaluation based on the typical scenario tasks.

3.1 Paper-Pencil Evaluation

The paper-pencil evaluation method is a traditional mean for static evaluation of the flight deck HMI. In the evaluation process, the flight deck HMI was shown to the pilots and human factor specialists by the flight deck layout drawing, flight deck HMI pictures, system description documents, synoptic page snap shot, control panel static mockup, etc. The system design engineer and flight deck team interpret the system displays, controls, alerting, system function briefing to the pilots and human factor specialists. By understanding the system design philosophy and the detail information, the modified Cooper-Harper Rating scale was used to give the scale for the displays, controls, alerting based on the flight deck HMI evaluation criteria. The flight deck HMI evaluation criteria were developed by the flight deck team on the basis of 25.1302. Here is example a checklist for the display information elements organization [4].

ORGANIZATION AND MANAGEMENT OF INFORMATION ELEMENTS

Formatting/Layout

  • Arrangement of information on the display

    • Page format, structure and organization (e.g., “Basic T”)

    • Consistent positioning or relative positioning of information on the display

    • Consistency with other flight deck displays

  • Consistency with user expectations and internal logic

  • Indication of active regions (controls) and off-screen material

  • Labels (e.g., for menus, scales, modes, and units)

    • Intuitiveness, location, orientation.

3.2 Walk Through Evaluation

The walk through evaluation is a task based dynamic evaluation on a specific platform with part or full flight deck system functions. Before evaluation test, the test scenarios were developed according to the system characteristic. Evaluate the flight deck systems as guided by the tasks required in the order as described by the mission time line/flight phase.

In accordance with the guidance found in AMC 25.1302/AC25.1032-1 the initial human factors evaluation of the flight deck will address the following aspects of each of the installed systems and its interface.

  • The control interfaces

  • Information Presentation

  • Multifunction interfaces

  • System behavior

For each system interface component, the degree of integration, complexity and novelty will also be assessed. Human performance issues and pilot’s comments were recorded.

Different platform plays its role in the human in-the-loop evaluation. A physical mock-up of the flight deck or display system may be used early in the display design, e.g., to address anthropometric considerations such as the reach and visibility of the display. Part-task evaluations that emulate display capabilities for a single system or a group of systems can be used to identify usability issues, e.g., in an office setting. Note that the results of these part-task evaluations may be somewhat limited because tasks are being performed in isolation. Simulator evaluations offer the opportunity to collect feedback through a high-fidelity integrated emulation of the flight deck and operational environment, but the results may be limited by the extent to which the simulator is able to accurately capture the operating environment.

The flight deck evaluation will also be used to assess the operational behavior of the installed equipment and perform an initial analysis of the flight decks error management facilities. The major impetus for the rule 25.1302 (d) was to promote error tolerant design of flight deck equipment. The flight deck interfaces (both individually and in combination with respect to their associated flight crew tasks), will be subject to initial evaluation to establish if they support the prevention of error; trapping error, or the mitigation of its consequences. The initial information analysis for error detection will take three basic forms:

  • Assessment of indications provided to the flight crew during normal monitoring tasks

  • Evaluation of crew alerts that provide interruptive information of an error or resulting aircraft system condition

  • Evaluation of ‘global’ alerts covering a multitude of possible errors by annunciating external hazards, aircraft envelope or other operational conditions.

When the system interface or operation procedure, which have potential hazard of crew error have been identified, the error prevention or error tolerant features will be considered in detail in the flight deck interface design, according to the error classification.

4 Conclusion

Flight crew error in system design and certification have great related to the flight safety. Human error is affected by a number of factors, including system design, training, operations, and pilots’ previous experiences. Human error is difficult to predict, and it cannot be prevented entirely; even experienced, well-trained pilots using well-designed systems will commit errors. Understanding of the causes of pilot error can minimize the likelihood of these occurrences and be used to create more error-resistant and error-tolerant systems.

An analysis and evaluation procedure based on human cognitive information processing model was introduced for civil aircraft flight deck interface design. In this procedure model, information including visual display elements, alerting, tactile etc. have been considered as input in the perception stage. Controls including push button, switch, lever etc. have been considered as output in the Response Execution stage. Two kinds of subject evaluation method were introduced.

The analysis and evaluation procedures mentioned above have been used in single aisle civil aircraft flight deck design in China.