Keywords

1 Introduction

Accidents most often result from a sequence or combination of errors and safety related events (e.g., equipment failure and weather conditions). Analyses show that the design of the flight deck and other systems can influence flight crew task performance and the occurrence and effects of some flight crew errors.

Approval of flight deck systems with respect to design-related flight crew error has typically been addressed by referring to system specific or general applicability requirements, such as CS 25.1301(a), CS 25.771(a), and CS 25.1523. However, little or no guidance exists to show how the applicant may address potential crew limitations and errors. The regulation CS25.1302/FAR25.1302 is focus on human errors. The rule text is:

§25.1302 Installed systems and equipment for use by the flightcrew.

This section applies to installed equipment intended for flight-crew members’ use in the operation of the aeroplane from their normally seated positions on the flight deck. This installed equipment must be shown, individually and in combination with other such equipment, to be designed so that qualified flight-crew members trained in its use can safely perform their tasks associated with its intended function by meeting the following requirements:

  1. (a)

    Flight deck controls must be installed to allow accomplishment of these tasks and information necessary to accomplish these tasks must be provided.

  2. (b)

    Flight deck controls and information intended for flight crew use must:

    1. (1)

      Be presented in a clear and unambiguous form, at resolution and precision appropriate to the task.

    2. (2)

      Be accessible and usable by the flight crew in a manner consistent with the urgency, frequency, and duration of their tasks, and

    3. (3)

      Enable flight crew awareness, if awareness is required for safe operation, of the effects on the aeroplane or systems resulting from flight crew actions.

  3. (c)

    Operationally-relevant behaviour of the installed equipment must be:

    1. (1)

      Predictable and unambiguous, and

    2. (2)

      Designed to enable the flight crew to intervene in a manner appropriate to the task.

  4. (d)

    To the extent practicable, installed equipment must enable the flight crew to manage errors resulting from the kinds of flight crew interactions with the equipment that can be reasonably expected in service, assuming the flight crew is acting in good faith. This sub-paragraph (d) does not apply to skill-related errors associated with manual control of the aeroplane.

Often, showing compliance with design requirements that relate to human abilities and limitations is subject to a great deal of interpretation. Findings may vary depending on the novelty, complexity, or degree of integration related to system design.

2 Certification Approach

The unique aspect of rule 25.1302 is that it considers the flight crew task as the guiding element for assuring safe operation of the aircraft. It is the task that defines what equipment needs to be used when, in what order, by whom and in what combination with other installed equipment. Note however that it is not the task that is being certificated, but the integrated combination of installed equipment that enables safe task execution in this particular flight deck design.

Flight crew high level task listing:

  • Aviate - control the aircraft’s path

    • Control aircraft to maintain flight (airspeed, altitude, attitude)

    • Monitor flight parameters (airspeed, altitude, attitude)

    • Configure aircraft flight surfaces

    • Configure flight guidance system (autopilot) for control of aircraft

    • Monitor flight guidance system (autopilot) control of aircraft

  • Navigate - direct the aircraft from its origin to its destination

    • Control aircraft direction in flight in accordance with flight plan

    • Control aircraft direction on the ground

    • Configure flight guidance system and/or FMS for navigation of aircraft

    • Monitor flight guidance system and/or FMS navigation of aircraft

  • Communicate - provide data and requests and receive instructions and information with ATC, company (dispatch, operations, maintenance, and ground crews), flight crew, and cabin crew

    • Configure communication system

    • Control (initiate and respond to) communications

    • Monitor communications

  • Manage flight and systems - plan and monitor flight, manage and monitor systems and resources

    • Develop and modify flight plan

    • Monitor flight path, fuel consumption, and ATC clearance compliance

    • Configure systems

    • Monitor systems

    • Manage systems (including faults)

    • Monitor fuel

    • Manage fuel

    • Monitor weather

    • Monitor traffic, terrain, and obstacles

    • Monitor for hazardous atmospheric conditions

    • Manage flight (prioritise and integrate resources and systems; develop and modify flight plan).

Note that there are discrete types of tasks (with a clear start and finish) and continuous tasks like monitoring and manual flight control. Manual flight requires continuous attention and needs to be listed as such. Other monitoring activities are performed most often only when there is time left. Such tasks can be noted on a separate list for later analysis (the timeline will otherwise be contaminated with non-actual or assumed activities instead of real activities).

The certification approach proposed to demonstrate compliance with the requirements in CS 25.1302 also provides the basis for the demonstration of compliance with the Human Factors requirements.

2.1 Identify Systems Versus Flight Crew Tasks

Perform their tasks is an important part of the 25.1302 rule. The flight crew tasks therefore need to be specified first as required by the missions flown by the Aircrft. These tasks are sequenced on a timeline with the systems used, for both the Captain and First officer while flying nominal and non-nominal flights, including emergency handling, information, response and feedback (awareness) requirements will be specified for each task.

The results of the 25.1523 task analysis will be reused where possible and detailed according to 25.1302 requirements.

2.2 Analyse Characteristics of Intended Functions and Associated Crew Tasks

Task accomplishment requires the use of installed systems according to associated crew procedures. Flight crew tasks characteristics therefore have to be defined and analysed with respect to their:

  • Urgency: urgent tasks need special access and simple actions

  • Frequency: an often used system need easy access and feedback

  • Duration: long tasks need protection against interruptions and errors.

2.3 Document Design Requirements and Human Performance Issues to Be Verified

AMC 25.1302 states that:

The applicant should identify design requirements applicable to each of the systems, components, and features for which means of demonstrating compliance must be selected. This can be accomplished in part by identifying design characteristics that can adversely affect flight crew performance, or that pertain to avoidance and management of flight crew errors……….

An initial list of requirements for each system will be drafted based on the earlier analysis of documents and information available. This list or matrix will, together with the flight crew task analysis timeline be used as input for a comprehensive flight deck review.

2.4 Perform Human Factors Flight Deck Audit

Initially a full human factors audit of the flight deck of the Aircraft will be undertaken. The objective of this audit will be to evaluate the basic ergonomic features of the system interfaces with respect to their stated intended function and their adequacy for addressing the high level crew tasks associated with operating a modern jet airliner. The tool used for the review will be CODEP (Cockpit Operability and Design Evaluation Procedure). This tool uses a task based approach that systematically addresses the accessibility of controls, the adequacy of presented information, the integration level of the flight deck etc.

The appropriate MOC for each system cannot be defined until the initial flight deck audit has been undertaken. The HF flight deck audit is, however, a key component in providing the scope and a framework for subsequently defining the appropriate certification MOC. The HF audit will be performed specifically to address the design issues within the scope of CS 25.1302.

For each system interface component, the degree of integration, complexity and novelty will also be assessed:

  • The level of systems integration is concerned with the extent to which there are interactions and/or dependencies between systems which may affect the crew’s operation of the aircraft.

  • The complexity of the system refers to aspects such as the number of information elements the flight crew has to use to perform a given flight task or the number of control modes on a particular multifunction control.

  • The novelty of systems on the flight deck may be based upon factors such as new methods of operation for established flight deck systems or unusual or additional operational procedures required as a result of the introduction of new technologies.

2.5 Produce Requirements Matrix with Proposed MOC List

The results of the flight deck audit will be used to produce the MOC list for the authority approval. to agree on the final insights and issues (if any) and approve the final test lists.

3 Means of Compliance Development

AMC 25.1302 requires that novel features may require extra scrutiny during the certification process whereas the process to approve less novel features may be somewhat less rigorous. However, until the formal human factors flight deck audit has been completed it will not be possible to specify a final list of the proposed method(s) to demonstrate the MOC applicable for each flight deck system/pilot interface.

Compliance may be established through by a combination of one or more generic methods: a statement of design similarity; the use of engineering drawings; calculation/formal analysis; evaluation and/or test.

  • A ‘statement of similarity’ is a description of the system and a description of a previously certificated system detailing the physical, logical, and operational similarities. By such structured comparison with an existing flight deck function/feature it may be possible demonstrate its adequacy with respect to avoiding, detecting and/or recovering from errors without unnecessary effort.

  • It may be possible to substantiate that a design meets the certification requirements simply by describing the design in the form of ‘engineering drawings’. It is likely, though, that using drawings will be limited to describing the physical arrangement of equipment or demonstrating compliance with very simple presentational issues (e.g. the colour of warning functions).

  • ‘Calculations’ or ‘formal analyses’ do not require interaction with an actual physical representation of the flight deck equipment. Formal error prediction techniques fall into this category.

  • ‘Evaluation’ as a technique for demonstrating compliance may encompass a wide range of structured assessments involving rapid prototypes of interfaces, part prototypes or the real thing. ‘Tests’ as a means of demonstrating compliance are in many ways conducted the same manner as evaluations but are undertaken on a conforming product or system with a complete system interface (e.g. in an approved simulator) or in the aircraft itself. These may need to be conducted by, or in the presence of the certification authority.

4 Conclusion

Recommendation on the means of compliance including statements of similarity, design description, calculations/analysis, evaluations and test were provided in terms of flight crew tasks. Researches and practice on the static evaluation, documental evaluation, sub-task evaluation as well as full-task evaluation were carried on in order to minimize the occurrence of human errors and the management of their effects. Documented matrix of MoC and a list of simulator/real aircraft test scenarios were planned for the verification of typical human errors relevant to flight deck performance. The method is verified in the design progress of a china-designed type to produce a successful program.