[Federal Register Volume 64, Number 193 (Wednesday, October 6, 1999)]
[Notices]
[Pages 54399-54410]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 99-26047]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
[Policy Statement Number ANM-99-2]
Guidance for Reviewing Certification Plans To Address Human
Factors for Certification of Transport Airplane Flight Decks
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Notice of policy statement; request for comments.
-----------------------------------------------------------------------
SUMMARY: This document announces an FAA general statement of policy
that is applicable to the type certification process of transport
category airplanes. This policy provides guidance to FAA Certification
Teams that will enable them to conduct an effective review of an
applicant's Human Factors Certification Plan or the human factors
components of a general Certification Plan, when one is submitted at
the beginning of a type certification (TC), supplemental type
certification (STC), or amended type certificate (ATC) project. This
guidance describes the sections of a Human Factors Certification Plan
and the information that should be included in each section. The
purpose of the plan is to facilitate the establishment early on of an
effective working relationship and agreement between the FAA and the
applicant about the means by which human factors issues will be
addressed during a certification project. This notice is to advise the
public of FAA policy and give all interested persons an opportunity to
review and comment on the policy statement.
DATES: Comments must be received on or before November 5, 1999.
ADDRESSES: Send all comments on this policy statement to the individual
identified under FOR FURTHER INFORMATION CONTACT.
FOR FURTHER INFORMATION CONTACT: Sharon Hecht, Federal Aviation
Administration, Transport Airplane Directorate, Transport Standards
Staff, Airplane & Flight Crew Interface Branch, ANM-111, 1601 Lind
Avenue SW., Renton, Washington 98055-4056; telephone (425) 227-2398;
facsimile (425) 227-1100; e-mail: 9-ANM-111-HUMAN [email protected]
SUPPLEMENTARY INFORMATION:
Comments Invited
Interested persons are invited to submit written comments on this
policy statement. Commenters should identify the Policy Statement
Number of this policy statement, and submit comments,
[[Page 54400]]
in duplicate, to the address specified above. All communications
received on or before the closing date for comments will be considered
by the Transport Standards Staff of the Transport Airplane Directorate.
Effect of General Statement of Policy
The general policy stated in this document is not intended to
establish a binding norm; it does not constitute a new regulation, and
the FAA would neither apply nor rely upon it as a regulation. The FAA
Aircraft Certification Offices (ACO) that certify transport category
airplanes and/or the flight deck systems installed on them should
attempt to follow this policy, when appropriate. However, in
determining compliance with certification standards, each FAA office
has the discretion not to apply these guidelines where it determines
that they are inappropriate.
Background
Recent aviation safety reports underscore the importance of
addressing issues related to human factors and flightcrew error in
system design and certification. Applicants have demonstrated the
effectiveness of using a ``Human Factors Certification Plan'' to
communicate their proposed approach to the identification and
resolution of human factors issues. This type of plan has been used as
a means by which the applicant and the FAA can establish an early and
formal written agreement on the certification basis, the methods of
compliance, and the schedules for completing the certification project.
This approach has helped FAA Certification Teams address issues as
early in the certification process as possible, thereby decreasing the
applicant's certification risk in cost or schedule.
An alternative approach to developing a stand-alone Human Factors
Certification Plan is for the applicant to address the human factors
issues as part of their general Certification Plan. Regardless of
whether it is a stand-alone document or not, the trend has been for
applicants to provide some specific information about their plans to
address human factors issues for the certification project.
Because of the proven effectiveness of this type of approach,
increasing numbers of applicants have asked for assistance from the FAA
in developing Human Factors Certification Plans. Given this trend, the
Transport Airplane Directorate has developed this policy to assist FAA
Certification Team members in working with applicants who are
attempting to develop Human Factors Certification Plans, as well as in
reviewing these plans after they have been submitted.
Objective of This Policy
The objective of this policy is to provide guidance for the FAA
Certification Team to use when reviewing the applicant's Human Factors
Certification Plan or the human factors components of the general
Certification Plan during a type certification (TC), supplemental type
certification (STC), or amended type certificate (ATC) project for
transport category airplanes. The policy is intended for use by all
members of the Certification Team, which may include the following:
Aircraft evaluation group inspectors,
Avionics engineers,
Certification Team project managers,
Flight test pilots and engineers,
Human factors specialists,
Propulsion engineers, and
Systems engineers.
While this policy is focused on providing guidance to these FAA
team members, it may be of use to the applicant, as well. If the
applicant develops a Certification Plan for a certification project,
the information in this policy statement can be used as a basis for
communicating the applicant's approach to addressing the human factors
aspects of the project.
This policy is one portion of an overall FAA strategy for the
development of policies related to human factors in the certification
of flight decks on transport category airplanes. Future policy
development will cover the following areas, related to showing
compliance with regulatory requirements associated with human factors:
Information on the recommended content of certification
plans.
Information on how to determine the adequacy of an
applicant's proposed methods of compliance.
Information on how to determine the adequacy of an
applicant's proposed test plans intended to support certification.
Information on how to determine pass-fail criteria for
analyses and tests performed to support certification.
Relevant reference material can be found in Appendix B of this
policy statement.
A checklist is included in Appendix D of this policy statement,
which can be used as part of certification plan review. It covers all
of the sections listed below.
General Statement of Policy--Guidance for Reviewing Certification
Plans To Address Human Factors for Certification of Transport
Airplane Flight Decks
The guidance provided in the following sections is intended to help
the Certification Team members review a Human Factors Certification
Plan submitted by an applicant. It is organized into nine sections,
which are consistent with those suggested for a Certification Plan in
FAA Advisory Circular (AC) 21-40, ``Application Guide for Obtaining a
Supplemental Type Certificate.'' Those sections are:
1. Introduction
2. System Description
3. Certification Requirements
4. Methods of Compliance
5. System Safety Assessments
6. Operational Considerations
7. Certification Documentation
8. Certification Schedule
9. Use of Designees and Identification of Individual DER/DAR
Guidance is provided in this general statement of policy concerning
the information that would be appropriate to include in each of these
sections for either a Human Factors Certification Plan or a general
Certification Plan. A sample (hypothetical) Human Factors Certification
Plan can be found in Appendix C of this general statement of policy.
Note: While Appendix C is included as part of this policy
statement document, the FAA also plans to provide it as a separate
web site on the Internet, where it can become a ``living document''
and be updated as new information, processes, and technology become
available.
1. Introduction
This section of the Certification Plan should provide a short
overview of the certification project, the certification program in
general, and the purpose of the Human Factors Certification Plan
specifically.
2. System Description
This section of the Certification Plan should describe the general
features of the flight deck, system, or component being presented as
part of a certification project. Because a human factors perspective of
the flight deck includes the systems, the users (flightcrew members),
and the ways in which they interact (e.g., crew procedures), this
section of the Human Factors Certification Plan may include general
descriptions of all three. The applicant can use this section to ensure
that the Certification Team and the applicant have a common
understanding of the basic design concepts as well as the
[[Page 54401]]
principles and operational assumptions that underlie the design of the
flightcrew interfaces.
For the purposes of this policy, the term ``flightcrew interface''
is intended to cover both the design of the systems (hardware,
software) and the tasks (physical, cognitive, perceptual, procedural)
the pilots will perform when using the systems in the context of their
overall responsibilities.
The applicant should give special attention to any new or unique
features or functions and how the flightcrew will use them.
Specifically, the following topic areas may be included:
2.a. Intended Function: The Human Factors Certification Plan should
provide information describing the intended functions of the major
flightcrew interfaces. For each, the applicant should identify the
following items, as appropriate, focusing on new or unique features
that affect the crew interface or the allocation of tasks between the
pilot(s) and the airplane systems:
The intended function of the system from the pilot's
perspective.
The role of the pilot relative to the system.
The procedures (e.g., type of approach procedures)
expected to be flown.
The assumed airplane capabilities (e.g., communication,
navigation, and surveillance).
2.b. Flight Deck Layout Drawings: Drawings of the flight deck
layout, even if they are only preliminary, can be very beneficial for
providing an understanding of the intended overall flight deck
arrangement (controls, displays, sample display screens, seating,
stowage, etc.). The applicant should be encouraged to provide scheduled
updates to the drawings, so that the Certification Team's knowledge of
the layout progresses as the design matures. Special attention should
be given to any of the following that are novel or unique:
Arrangements of the controls, displays, or other flight
deck features or equipment.
Controls, such as a cursor control device, or new
applications of existing control technologies.
Display hardware technology.
For the items identified above, sketches of the crew interfaces for
the specific systems can be helpful in providing an early understanding
of the features that may have certification issues. The applicant
should include with the drawings descriptions of interface, button,
knob function, anticipated system response, alerting mechanism, mode
annunciation, etc., so that the documentation adequately covers each
component or system that the pilot must interact with.
2.c. Underlying Principles for Automation Logic: For designs that
involve significant automation, the way the automation operates and
communicates that operation to the pilot can have significant effects
on safety. Key topics could include the following:
Operating modes.
Principles underlying mode transitions.
Mode annunciation scheme.
Automation engagement/disengagement principles.
Preliminary logic diagrams, if available.
2.d. Underlying Principles for Crew Procedures: Because the design
of the systems and the development of the associated procedures are
interrelated, it is useful to describe the underlying guidelines or
principles that form the basis for the crew procedures. Key topics
could include the following:
The expected use of memorized procedures with confirmation
checklists vs. read-and-do procedures/checklists.
Crew interactions during procedure/checklist
accomplishment.
Automated support for procedures/checklists, if available.
2.e. Assumed Pilot Characteristics: The applicant may choose to
include a description of the pilot group that the manufacturer expects
will use the flight deck design. This description could include
assumptions about the following:
Previous flying experience (e.g., ratings, flying hours).
Experience with similar or dissimilar flight deck designs
and features, including automation.
Expected training that the pilots will receive on this
flight deck design, or assumptions regarding expected training.
3. Certification Requirements
This section should list and describe the human factors-related
regulations and other requirements that are being addressed by the
applicant's Human Factors Certification Plan. This section also may
include the applicant's compliance checklist for these requirements.
The Certification Team should expect to see a matrix from the
applicant with all of the pertinent regulations listed, with specific
references to the detailed subparagraphs that will be covered by the
Human Factors Certification Plan.
Table 1, below, provides a partial list of regulations contained in
14 CFR part 25 that may be considered for inclusion in a Human Factors
Certification Plan. These regulations were selected for the list
because they typically require that the applicant carefully consider a
number of human factors issues when showing compliance with them.
Appendix B of this document also lists these regulations, along
with a brief discussion of some of the human factors issues that may
affect the chosen methods of compliance.
Note: While Appendix B is included as part of this policy
statement document, the FAA also plans to provide it as a separate
web site on the Internet, where it can become a ``living document''
and be updated as new information, processes, and technology become
available.
TABLE 1.--Selected Listing of Regulations in 14 CFR Part 25 Related to
Flightcrew Human Factors
------------------------------------------------------------------------
Requirement (In
some cases, the
content of the
subparagraphs has
been paraphrased for
FAR Section [Current Amdt. Level] clarity. Actual
Human Factors
Certification Plans
should use the exact
wording of the
regulations.)
------------------------------------------------------------------------
General Human Factors (HF) Requirements
------------------------------------------------------------------------
Sec. 25.771(a) [amdt. 25-4]...................... Each pilot
compartment and its
equipment must
allow the minimum
flightcrew to
perform their
duties without
unreasonable
concentration or
fatigue.
Sec. 25.771(e) [amt. 25-4]....................... Vibration and noise
characteristics of
cockpit equipment
may not interfere
with safe operation
of the airplane.
Sec. 25.773(a)(1) [amdt. 25-72].................. Each pilot
compartment must be
arranged to give
the pilots
sufficiently
extensive, clear,
and undistorted
view, to enable
them to safely
perform any
maneuvers within
the operating
limitations of the
airplane, including
takeoff, approach,
and landing.
Sec. 25.773(a)(2) [amt. 25-72]................... Each pilot
compartment must be
free of glare and
reflections that
could interfere
with the normal
duties of the
minimum flightcrew.
[[Page 54402]]
Sec. 25.777(a) [amdt. 25-46]..................... Each cockpit control
must be located to
provide convenient
operation and to
prevent confusion
and inadvertent
operation.
Sec. 25.777(c) [amt. 25-46]...................... The controls must be
located and
arranged, with
respect to the
pilot's seats, so
that there is full
and unrestricted
movement of each
control without
interference from
the cockpit
structure or the
clothing of the
minimum flightcrew
when any member of
this flightcrew,
from 5'2'' to 6'3''
in height, is
seated with the
seat belt and
shoulder harness
fastened.
Sec. 25.1301(a) [original amdt.]................. Each item of
installed equipment
must be of a kind
and design
appropriate to its
intended function.
Sec. 25.1309(b)(3) [amt. 25-41].................. * * * Systems,
controls, and
associated
monitoring and
warning means must
be designed to
minimize crew
errors that could
create additional
hazards.
Sec. 25.1321(a) [amdt. 25-41].................... * * * Each flight,
navigation, and
powerplant
instrument for use
by any pilot must
be plainly visible
to him from his
station with the
minimum practicable
deviation from his
normal position and
line of vision when
he is looking
forward along the
flight path.
Sec. 25.1321(e) [amt. 25-41]..................... If a visual
indicator is
provided to
indicate
malfunction of an
instrument, it must
be effective under
all probable
cockpit lighting
conditions.
Sec. 25.1523 [amdt. 25-3]........................ The minimum
flightcrew must be
established so that
it is sufficient
for safe operation,
considering (a) the
workload on
individual
crewmembers; (b)
the accessibility
and ease of
operation of
necessary controls
by the appropriate
crewmember; and (c)
the kind of
operation
authorized under
Sec. 25.1525. The
criteria used in
making the
determinations
required by this
section are set
forth in Appendix
D.
Sec. 25.1543(b) [amt. 25-72]..................... Each instrument
marking must be
clearly visible to
the appropriate
crewmember.
------------------------------------------------------------------------
System-Specific HF Requirements
------------------------------------------------------------------------
Sec. 25.785(g) [amdt. 25-88]..................... Each seat at a
flight deck station
must have a
restraint system *
* * that permits
the flight deck
occupant, when
seated with the
restraint system
fastened, to
perform all of the
occupant's
necessary flight
deck functions.
Sec. 25.785(l) [amt. 25-88]...................... The forward
observer's seat
must be shown to be
suitable for use in
conducting the
necessary enroute
inspections.
Sec. 25.1141(a) [amdt. 25-72].................... Powerplant controls:
Each control must
be located so that
it cannot be
inadvertently
operated by persons
entering, leaving,
or moving normally
in the cockpit.
Sec. 25.1357(d) [original amdt.]................. If the ability to
reset a circuit
breaker or replace
a fuse is essential
to safety in
flight, that
circuit breaker or
fuse must be
located and
identified so that
it can be readily
reset or replaced
in flight.
Sec. 25.1381(a)(2) [amdt. 25-72]................. The instrument
lights must be
installed so that
(ii) no
objectionable
reflections are
visible to the
pilot.
------------------------------------------------------------------------
Specific Crew Interface Requirements
------------------------------------------------------------------------
Sec. 25.773(b)(2)(i) [amt. 25-72]................ The first pilot must
have a window that
is openable * * *
and gives
sufficient
protection from the
elements against
impairment of the
pilot's vision.
Sec. 25.1322 [amdt. 25-38]....................... If warning, caution,
or advisory lights
are installed in
the cockpit, they
must, unless
otherwise approved
by the
Administrator, be:
(a) Red, for warning
lights (lights
indicating a hazard
which may require
immediate
corrective action);
(b) Amber, for
caution lights
(lights indicating
the possible need
for future
corrective action);
(c) Green for safe
operation lights;
and
(d) Any other color,
including white,
for lights not
described in
paragraphs (a)
through (c) of this
section, provided
the color differs
sufficiently from
the colors
prescribed in
paragraphs (a)
through (c) of this
section to avoid
possible confusion.
------------------------------------------------------------------------
4. Methods of Compliance
The Certification Team should request the detailed plans for
showing compliance as the plans evolve with the program. It is
recommended that coordination meetings with the applicant and
Certification Team be held several times during the certification
program to review the compliance checklist in detail and the associated
test plans, as they are developed. This will help all parties reach
agreement on how the tests, demonstrations, and other data-gathering
efforts will be sufficient to show compliance. Of special importance is
ensuring that the methods proposed by the applicant will provide enough
fidelity to identify human factors issues early enough to avoid
adversely affecting the certification schedule.
A suggested format for the compliance checklist is contained in FAA
Advisory Circular (AC) 21-40, ``Application Guide for Obtaining a
Supplemental Type Certificate,'' dated May 6, 1998. An example of a
checklist can be found in Appendix D of this policy statement.
Note: While Appendix D is included as part of this policy
statement document, the FAA also plans to provide it as a separate
web site on the Internet, where it can become a ``living document''
and be updated as new information, processes, and technology become
available.
In this section of the Human Factors Certification Plan, the
applicant should delineate the methods that will be used to demonstrate
compliance with the relevant regulations. The review and discussion of
the methods of compliance is an opportunity for the FAA and the
applicant to work together to identify potential human factors issues
early in the certification program.
The methods of compliance are not mutually exclusive. The applicant
may choose to include any or all of these methods of compliance in its
Human Factors Certification Plan. All of the methods of compliance
included in the Human Factors Certification Plan should be described in
enough detail to
[[Page 54403]]
give the Certification Team confidence that the results of the chosen
method will provide the necessary information for finding compliance.
Examples of methods to demonstrate compliance are as follows:
4.a. Drawings: Layout drawings and/or engineering drawings that
show the geometric arrangement of hardware or display graphics.
4.b. Configuration Description: A description of the layout,
arrangement, direction of movement, etc., or a reference to similar
documentation.
4.c. Statement of Similarity: A description of the system to be
approved and a previously approved system, which details their
physical, logical, and operational similarities, with respect to
compliance with the regulations.
4.d. Evaluations, Assessments, Analyses: Evaluations conducted by
the applicant or others (not the FAA or a designee), who provides a
report to the FAA. These include:
Engineering Evaluations or Analyses: These assessments
can involve a number of techniques, including such things as
procedure evaluations (complexity, number of steps, nomenclature,
etc); reach analysis via computer modeling; time-line analysis for
assessing task demands and workload; or other methods, depending on
the issue being considered.
Mock-up Evaluations: These types of evaluations use
physical mock-ups of the flight deck and/or components. They are
typically used for assessment of reach and clearance; thus, they
demand a high degree of geometric accuracy.
Part-Task Evaluations: These types of evaluations use
devices that emulate (using flight hardware, simulated systems, or
combinations) the crew interfaces for a single system or a related
group of systems. Typically, these evaluations are limited by the
extent to which acceptability may be affected by other flight deck
tasks.
Simulator Evaluations: These types of evaluations use
devices that present an integrated emulation (using flight hardware,
simulated systems, or combinations) of the flight deck and the
operational environment. They also can be ``flown,'' with response
characteristics that replicate, to some extent, the responses of the
airplane. Typically, these evaluations are limited by the extent to
which the simulation is a realistic, high fidelity representation of
the airplane, the flight deck, the external environment, and crew
operations. The types of pilots (test, instructor, airline) used in
the evaluations and the training they receive may significantly
affect the results and their utility.
In-Flight Evaluations: These types of evaluations use
the actual airplane. Typically, these evaluations are limited by the
extent to which the flight conditions of particular interest (e.g.,
weather, failures, unusual attitudes) can be located/generated and
then safely evaluated in flight. The types of pilots (test,
instructor, airline) used in the evaluations and the training they
receive may significantly affect the results and their utility.
4.e. Demonstrations: Similar to evaluations (described above), but
conducted by the applicant with participation by the FAA or its
designee. The applicant provides a report, requesting FAA concurrence
on the findings. Examples of demonstrations include:
Mock-up Demonstrations.
Part-Task Demonstration.
Simulator Demonstration.
4.f. Inspection: A review by the FAA or its designee, who will be
making the compliance finding.
4.g. Tests: Evaluations conducted by the FAA or a designee, which
may encompass:
Bench Tests: These are tests of components in a
laboratory environment. This type of testing is usually confined to
showing that the components perform as designed. Typical bench
testing may include measuring physical characteristics (e.g.,
forces, luminance, format) or logical/dynamic responses to inputs,
either from the user or from other systems (real or simulated).
Ground Tests: These are tests conducted in the actual
airplane, while it is stationary on the ground. In some cases,
specialized test equipment may be employed to allow the airplane
systems to behave as though the airplane was airborne.
Simulator Tests: (See simulator evaluations, above.)
Flight Tests: These are tests conducted in the actual
airplane. The on-ground portions of the test (e.g., preflight,
engine start, taxi) are typically considered flight test rather than
ground test.
The methods identified above cover a wide spectrum: from documents
that simply describe the product, to partial approximations, to methods
that replicate the actual airplane and its operation with great
accuracy. Features of the product being certified and the types of
human factors issues to be evaluated are key considerations when
selecting which method is to be used. The characteristics described
below can be used to help in coming to agreement regarding what
constitutes the minimum acceptable method(s) of compliance for any
individual requirement.
When a product needs to meet multiple requirements, some
requirements may demand more complex testing while others can be
handled using simple descriptive measures. It is important to note that
the following characteristics are only general principles. They are
intended to form the basis for discussions regarding acceptable methods
of compliance for a specific product with respect to a requirement.
4.h. Other Considerations:
Degree of Integration/Independence: If the product to
be approved is a stand-alone piece of equipment that does not
interact with other aspects of the crew interface, less integrated
methods of compliance may be acceptable. However, if the product is
tightly tied to other systems in the flight deck, either directly or
by the ways crews use them, it may be necessary to use methods that
allow the testing of those interactions.
Novelty/Past Experience: If the technology is mature
and well understood, less rigorous methods may be appropriate. More
rigorous methods may be called for if the technology is new, is used
in some new application, is new for the particular applicant, or is
unfamiliar to the certification personnel.
Complexity/Level of Automation: More complex and
automated systems typically require test methods that will reveal
how that complexity will manifest itself to the pilot, in normal and
backup or reversionary modes of operation.
Criticality: Systems that are central to the interface
design may require testing in the most realistic environments (high-
quality simulation or flight test), because any problems are likely
to have serious consequences.
Dynamics: If the control and display features of the
product are highly dynamic, the compliance methods should be capable
of replicating those dynamic conditions.
Level of Training Required: If the product is likely to
require a significant amount of training to operate, the interfaces
may need to be evaluated in an environment that replicates the full
spectrum of activities in which the pilot may be involved.
Subjectivity of Acceptance Criteria: Requirements that
have specific, objectively measurable criteria can often employ
simpler methods for demonstrating compliance. As the acceptance
criteria become more subjective, more integrated test methods are
needed, so that the evaluations take into account the aspects of the
integrated flight deck that may affect those evaluations.
The main objective is to carefully match the method to the product
and the underlying human factors issues. It is also important for the
Certification Team to recognize that several methods may be acceptable
for any given requirement and applicants should be allowed to select
among the acceptable methods, choosing the ones that best fit their
compliance strategy, schedule, and cost considerations.
5. System Safety Assessments
Typically, system safety assessments [i.e., Functional Hazard
Assessment (FHA), Failure Modes and Effects Analysis (FMEA), Fault Tree
Analysis, etc.] are accomplished by the applicant's engineering group
that is responsible for each system. However, for each assessment
planned, the
[[Page 54404]]
applicant should describe how any human factors elements will be
addressed (such as crew responses to failure conditions) and other
assumptions that must be made about crew behavior. These assumptions
should be reviewed by the full Certification Team to ensure that no
assumptions are being made that will require the flightcrew to
compensate for failures beyond their expected capabilities. These human
factors considerations can be documented in the individual system
safety assessments, or the applicant may elect to describe them in the
Human Factors Certification Plan, with references to the associated
system safety assessments.
6. Operational Considerations
The applicant may have specific goals associated with the
operational certification of the airplane or system that could
influence the design and its evaluation. In this section, the applicant
will typically describe how these operational considerations will be
integrated into the part 25 aspects of the certification project. It
would be useful to identify operational requirements that have been
factored into the type design. For example, the Traffic Alert and
Collision Avoidance System (TCAS) is mandated as a rule change in part
121 rather than in part 25.
This section of the Certification Plan also may include how the
operational certification, as captured in the following documents, will
influence the methods of compliance:
Airplane Flight Manual (AFM),
Master Minimum Equipment List (MMEL)
Flightcrew Operating Manual (FCOM), and
Quick Reference Handbook (QRH).
Shown below are two examples of how the operational and
airworthiness considerations may be interdependent:
Example 1. The applicant may desire MMEL dispatch relief for
certain systems. In order to ensure that the desired dispatch relief
will be approved, it may be advantageous to conduct certification
testing of those configurations (including the next most significant
failures), to ensure that they are acceptable for normal operations.
Example 2. In order to help ensure acceptance of the FCOM, it may
be advantageous to conduct certification testing using the procedures
and other relevant information that will be included in the FCOM. This
will enable the members of the Airplane Evaluation Group (AEG) to have
a high degree of confidence that there will be no human factors
problems associated with their use.
The AEG, Flight Standards Operations representatives, and Human
Factors Specialists on the Certification Team should be involved in the
review of this section of the Human Factors Certification Plan.
7. Certification Documentation
The Human Factors Certification Plan should indicate the types of
documentation that will be submitted to show compliance or otherwise
document the progress of the certification program. This section may
list the specific documentation (test report number, analysis report
number, etc.) that will be used to support compliance with the subject
regulation. They may also be indicated in the compliance matrix.
8. Certification Schedule
This section of a Human Factors Certification Plan should include
the major milestones of the certification program. This may include:
8.a. Certification Plan Submittals: The Certification Team should
expect periodic updates to the Human Factors Certification Plan as the
certification program progresses. The applicant should be encouraged to
submit the first Human Factors Certification Plan as soon as possible
after the start of the program. The applicant should be reassured that
draft, preliminary information is acceptable and appropriate, provided
that it is updated and finalized in a timely manner (as documented in
the schedule and agreed to jointly by the FAA and the applicant).
8.b. Flight Deck Reviews, Early Prototype Reviews, Simulator
Reviews, and Flight Test Demonstrations: The Human Factors
Certification Plan can document planned design reviews. Even in cases
where the reviews are not directly associated with finding compliance,
they can be very helpful in the following ways:
Providing the Certification Team with an accurate and
early understanding of the crew interface tradeoffs and design
proposals.
Allow the certification team to provide the applicant with
early feedback on any potential certification issues.
Support cooperative teaming between the applicant and the
certification team, in a manner consistent with the Certification
Process Improvement initiative.
8.c. Coordination meetings: Coordination meetings with other
certification authorities, or meetings with other FAA Aircraft
Certification Offices on components of the same certification project
or related projects, should be documented in the schedule.
The Certification Team can use the information in the schedule to
determine if sufficient coordination and resources are planned for the
certification program.
9. Use of Designees and Identification of Individual DER/DAR
This section should describe how the applicant will make use of
Designated Engineering Representatives (DER), Designated Airworthiness
Representatives (DAR), or other designees during the certification
program.
Appendix A--Partial List of Part 25 Regulations Related to Human
Factors Issues
The following list of regulations is divided into the following
three categories:
1. General Human Factors Requirements: Rules that deal with the
acceptability of the flight deck and crew interfaces across a
variety of systems/features.
2. Specific Human Factors Requirements: Rules that deal with the
acceptability of a specific feature or function in the flight deck.
3. Specific Crew Interface Requirements: Rules that mandate a
specific system feature, which must be implemented in an acceptable
manner.
This list is not intended to include all regulations associated
with flightcrew interfaces. However, these represent some of the
requirements for which demonstrating compliance can be problematic.
In some cases, where only subparagraphs are noted, they have been
paraphrased for clarity; the applicant should use the exact wording
of the regulation in all plans and compliance documents.
In many cases, there may be no precise standard of
acceptability. Therefore, it is in the applicant's best interest to
carefully consider and describe how they plan to come to agreement
with the FAA with respect to compliance. The highlighted words
identify the key issues that are central to finding compliance and
that could be addressed using various methods. Following each
regulatory requirement are notes intended to help the applicant
select an appropriate method of compliance. Typically, the
Certification Plan would only identify and generally describe the
methods to be used. Detailed descriptions of analyses and tests
would be documented separately (e.g., in test plans), subsequent to
an agreed-upon Certification Plan. However, the applicant should
sufficiently develop the plans to assure themselves and the FAA that
the selected methods are appropriate and adequate.
1. General Human Factors Requirements
Section 25.771(a) [at amdt. 25-4]:
Each pilot compartment and its equipment must allow the minimum
flightcrew to perform their duties without unreasonable
concentration or fatigue.
[[Page 54405]]
Discussion: The applicant should carefully consider the aspects
of the flightcrew interface that might require significant or
sustained mental or physical effort, or might otherwise result in
fatigue. Other factors affecting fatigue, such as noise and seat
comfort, also may need to be evaluated. Methods of compliance should
be selected based on the potential concentration demands and sources
of fatigue for the flightcrew. Comparisons to previously
certificated designs are often a useful method, although testing may
be warranted for new designs.
Section 25.771(e) [at amdt. 25-4]:
Vibration and noise characteristics cockpit equipment may not
interfere with safe operation of the airplane.
Discussion: When determining the method of compliance, the
applicant should carefully consider the types/magnitudes of the
vibration and noise that may be present under both normal and
abnormal conditions. Then, tasks that may be affected by vibration
(e.g., display legibility and the operation of controls) and noise
(e.g., communication and identification of aural alerts) should be
identified, as well as the methods that could be employed to
determine whether or not the vibration or noise will unacceptably
interfere with safe operation of the airplane.
Section 25.773(a)(1) [at amdt. 25-72]:
Each pilot compartment must be arranged to give the pilots
sufficiently extensive, clear, and undistorted view, to enable them
to safely perform any maneuvers within the operating limitations of
the airplane, including takeoff, approach, and landing.
Discussion: The applicant should carefully consider the method
of compliance described in FAA Advisory Circular (AC) 25.773-1,
``Pilot Compartment View for Transport Category Airplanes.''
Section 25.773(a)(2) [at amdt. 25-72]:
Each pilot compartment must be free of glare and reflections
that could interfere with the normal duties of the minimum
flightcrew.
Discussion: The applicant may be able to develop analytical
techniques that identify potential sources of glare and reflections,
as a means for reducing the risk of problems identified after the
major structural features have been committed. Mock-ups also may be
a useful means for early assessments. However, analysis results
typically must be verified in an environment with a high degree of
geometric and optical fidelity. Both internal (e.g., area and
instrument lighting) and external (e.g., shafting sunlight) sources
of reflections should be considered.
Section 25.777(a) [at amdt. 25-46]:
Each cockpit control must be located to provide convenient
operation and to prevent confusion and inadvertent operation.
Discussion: The applicant may choose to use physical mock-ups
for preliminary evaluations. Simulators, if available, provide a
more powerful evaluation environment, because they allow the
evaluation to take place in a flight scenario, which may influence
convenience and inadvertent operation. Simulator evaluations may
reduce the need for flight testing.
Section 25.777(c) [at amdt. 25-46]:
The controls must be located and arranged, with respect to the
pilot's seats, so that there is full and unrestricted movement of
each control without interference from the cockpit structure or the
clothing of the minimum flightcrew when any member of this
flightcrew, from 5'2'' to 6'3'' in height, is seated with the seat
belt and shoulder harness fastened.
Discussion: The applicant may choose to use analytical methods,
such as computer modeling of the flight deck and the pilots, for
early risk reduction and to supplement certification evaluations
using human subjects. Computer modeling allows for more control over
the dimensions of the pilot model and, thus, may allow the
assessment of otherwise unavailable combinations of body dimensions.
The applicant should carefully consider the advantages and
limitations of each of these methods.
Section 25.1301(a) [original amdt.]:
Each item of installed equipment must be of a kind and design
appropriate to its intended function.
Discussion: The applicant may wish to consider a number of
methods for showing compliance with this requirement, with respect
to human factors. For example, service experience may be an
effective means for assessing systems with well-understood,
successful crew interfaces, assuming that other factors, such as
changes in the operational environment, do not affect the relevance
of that experience. Various requirements analysis techniques can be
used to show that the information that the pilot needs to perform
key tasks is available, usable, and timely. Simulation may be used
to verify that properly trained pilots can adequately perform all
required tasks, using the controls and displays provided by the
design, in realistic scenarios and timelines. Finally, flight tests
can be used to investigate specific normal and abnormal operational
scenarios.
Section 25.1309(b)(3) [at amdt. 25-41]:
* * * Systems, controls, and associated monitoring and warning
means must be designed to minimize crew errors that could create
additional hazards.
Discussion: The applicant may wish to perform analyses of crew
procedures in response to system faults. This can be especially
important in cases where the applicant wishes to take certification
credit (e.g., in a Fault Tree Analysis) for correct pilot response
to a system failure. A crew procedure analysis could be supported by
performing qualitative evaluations that compare actual procedures to
procedure design philosophies, by developing measures of procedure
complexity, or by accomplishing other techniques that focus on
procedure characteristics that impact the likelihood of crew errors.
Simulation testing, including the use of untrained (in the new
design) line pilots, can be helpful in demonstrating that the design
is not prone to crew errors. Finally, evaluations by highly
experienced training and test pilots can be a valuable means of
gathering information on the susceptibility to crew errors.
Section 25.1321(a) [at amdt. 25-41]:
* * * Each flight, navigation, and powerplant instrument for use
by any pilot must be plainly visible to him from his station with
the minimum practicable deviation from his normal position and line
of vision when he is looking forward along the flight path.
Discussion: The applicant may wish to perform analyses of the
visual angles to each of the identified instruments. Final
assessments of the acceptability of the visibility of the
instruments may require a simulator with a high degree of geometric
fidelity and/or the airplane.
Section 25.1321(e) [at amdt. 25-41]:
If a visual indicator is provided to indicate malfunction of an
instrument, it must be effective under all probable cockpit lighting
conditions.
Discussion: Demonstrations and tests intended to show that these
indications of instrument malfunctions, along with other indications
and alerts, are visible under the expected lighting conditions will
typically employ the use of production quality hardware and careful
control of lighting conditions (e.g., dark, bright forward field,
shafting sunlight). Simulators and aircraft are often used, although
supporting data from laboratory testing also may be useful.
Section 25.1523 [at amdt. 25-3]:
The minimum flightcrew must be established so that it is
sufficient for safe operation, considering:
(a) the workload on individual crewmembers;
(b) the accessibility and ease of operation of necessary
controls by the appropriate crewmember; and
(c) the kind of operation authorized under Sec. 25.1525.
Discussion: (The factors considered in making the determinations
required by this section are set forth in Appendix D of this general
statement of policy.) The applicant may choose to use workload
analyses (such as time-line analysis) to evaluate certain workload
issues. Other evaluations of workload typically involve trained
pilots in either a high fidelity simulation or in actual airplanes.
There are a number of possible workload assessment techniques that
can be successfully employed. An efficient means for selecting test
conditions is to focus on those operational and/or failure scenarios
that are likely to result in the highest workload conditions.
Dispatch under the Minimum Equipment List (MEL) also should be
considered, in combination with other failures that are likely to
result in significantly increased workload. Since no objective
standard for workload is available, applicants may wish to compare
the workload in the new/modified airplane with that in a well-
understood, previously certificated airplane.
Section 25.1543(b) [at amdt. 25-72]:
Each instrument marking must be clearly visible to the
appropriate crewmember.
[[Page 54406]]
Discussion: The applicant may choose to use computer modeling to
provide preliminary analysis showing that there are no visual
obstructions between the pilot and the instrument markings. Where
head movement is necessary, such analyses also can be used to
measure its magnitude. Other analysis techniques can be used to
establish appropriate font sizes, based on research-based
requirements. Mock-ups also can be helpful in some cases. The data
collected in these analysis and assessments can be used to support
final verification in the flight deck, using subjects with vision
that is representative of the pilot population, in representative
lighting conditions.
2. Specific Human Factors Requirements
Section 25.785(g) [at amdt. 25-88]:
Each seat at a flight deck station must have a restraint system
. . . that permits the flight deck occupant, when seated with the
restraint system fastened, to perform all of the occupant's
necessary flight deck functions.
Discussion: The applicant may choose to develop a list of what
it considers to be necessary flight deck functions, under normal and
abnormal conditions. Methods similar to those used to show
compliance with Sec. 25.777 also may be appropriate for
demonstrating compliance with this paragraph, with the additional
consideration of movement constraints imposed by the full restraint
system.
Section 25.785(l) [at amdt. 25-88]:
The forward observer's seat must be shown to be suitable for use
in conducting the necessary enroute inspections.
Discussion: The applicant may choose to develop a set of
requirements (e.g., what must be seen and reached) based on the
expected tasks to be performed by an inspector. Computer-based
analysis and/or mock-ups can be used to develop supporting data;
evaluation of enroute inspection scenarios can be used to verify
that all required tasks can be performed. Since the geometric
relationship between the observer's seat and the rest of the flight
deck (including the pilots) is important, the evaluations often must
occur in the actual airplane.
Section 25.1141(a) [at amdt. 25-72]:
Each powerplant control must be located so that it cannot be
inadvertently operated by persons entering, leaving, or moving
normally in the cockpit.
Discussion: This type of assessment typically requires at least
a physical mock-up, due to limitations in the ability to adequately
model ``normal'' movement in the cockpit. Evaluations should be
designed to include cases in which the pilots must reach across the
area surrounding the powerplant controls and to look for places
where pilots will naturally place their hands and feet during
ingress and egress, and during cruise.
Section 25.1357(d) [original amdt.]:
If the ability to reset a circuit breaker or replace a fuse is
essential to safety during flight, that circuit breaker or fuse must
be located and identified so that it can be readily reset or
replaced in flight.
Discussion: The applicant may choose to use methods similar to
those employed for Sec. 25.777 to demonstrate the ability of the
pilot to reach the specific circuit protective device(s). The
applicant also should consider how to evaluate the ability of the
pilot to readily identify the device(s), whether they are installed
on a circuit breaker panel or controlled using an electronic device
(i.e., display screen on which the circuit breaker status can be
displayed and controlled).
Section 25.1381(a)(2) [at amdt. 25-72]:
The instrument lights must be installed so that * * * (ii) no
objectionable reflections are visible to the pilot.
Discussion: See the discussion of Sec. 25.773(a), above.
3. Specific Crew Interface Requirements
Section 25.773(b)(2)(i) [at amdt. 25-72]:
The first pilot must have a window that is openable * * * and
gives sufficient protection from the elements against impairment of
the pilot's vision.
Discussion: While the applicant may perform analyses to show
that the visual field through the openable window, due to the nature
of the task (landing the airplane by looking out the opened window),
it is likely that a flight test would be the most appropriate method
of compliance. Assessment of the forces required to open the window
under flight conditions may also be needed.
Section 25.1322 [at amdt. 25-38]:
If warning, caution, or advisory lights are installed in the
cockpit, they must, unless otherwise approved by the Administrator,
be:
(a) Red, for warning lights (lights indicating a hazard which
may require immediate corrective action);
(b) Amber, for caution lights (lights indicating the possible
need for future corrective action);
(c) Green for safe operation lights; and
(d) Any other color, including white, for lights not described
in paragraphs (a) through (c) of this section, provided the color
differs sufficiently from the colors prescribed in paragraphs (a)
through (c) of this section to avoid possible confusion.
Discussion: Compliance with this requirement is typically shown
by a description of each of the warning, caution, and advisory
lights. Evaluations may also be useful to verify the chromaticity
(e.g., red looks red, amber looks amber) and discriminability (i.e.,
colors can be distinguished reliably from each other) of the colors
being used, under the expected lighting levels. These evaluations
can be affected by the specific display technology being used, so
final evaluation with flight quality hardware is sometimes needed. A
description of a well-defined color coding philosophy that is
consistently applied across flight deck systems can be used to show
how the design avoids ``possible confusion.''
Appendix B--Related Documents
1. Williams, James H., ``Description of the FAA Avionics Certification
Process,'' FAA Document, April 23, 1997
This document is a high level explanation of the FAA approach to
certification of avionics. It addresses the major aspects of the
certification process including:
Design approvals under the Type Certificate (TC) or
Supplemental Type Certificate (STC) approval process;
Design approvals under the Technical Standard Order
(TSO) approval process;
Installation approvals for initial (new) avionics
following a TSO approval;
Installation approvals using the FAA Form 337 (``Major
Repair and Alteration: Airframe, Powerplant, Propeller, or
Appliance'') process.
This document will help the applicant become familiar with the
FAA process to certify avionics. The certification process is laid
out in a flowchart format. This document is available on the
Internet at http://www.faa.gov/avr/air/air100/100home.htm.
2. FAA Booklet, ``The FAA Type Certification Process,'' Aircraft
Certification Service, May 1996
The FAA's Aircraft Certification Service issued this document
for both internal use and industry guidance. It describes the
important steps in the process leading to issuance of a type
certificate. Discussion includes descriptions of roles,
responsibilities, and job functions of participants in the process,
and provides a listing of the ``best practices'' that the FAA can
follow to do its job well. It also describes the use of a
Certification Plan as a key communication tool during the
certification process.
3. FAA Order 8110.4A, ``Type Certification Process,'' March 2, 1995;
and
4. FAA Order 8110.5, ``Aircraft Certification Directorate Procedures,''
October 1, 1982
These Orders prescribe the responsibilities and procedures for
FAA aircraft certification engineering and manufacturing personnel
when accomplishing the evaluation and approval of aircraft type
design data and changes to approved type design data. These Orders
contain descriptions of Certification Plans and how FAA personnel
can use them during the certification process. These documents are
can be found on the Internet at:
http://www.mmac.jccbi.gov/afs/afs600/fdr/8110-4a.pdf
and
http://av-info.faa.gov/dst/8100-5.doc
5. Advisory Circular (AC) 21-40, ``Application Guide for Obtaining a
Supplemental Type Certificate,'' May 6, 1998
This advisory circular contains guidance for preparing a
Certification Plan for a supplemental type certification project.
Figure 2-4 of the AC suggests that applicants use a specific format
for the plan and provides a sample of it, which includes the
following nine sections:
1. Introduction
[[Page 54407]]
2. System description
3. Certification requirements
(a) Regulations
(b) Special requirements, unique or novel design aspects
(c) Compliance checklist
4. Methods of compliance
5. Functional hazard assessment
6. Operational considerations (if required)
7. Certification documentation
8. Certification schedule
9. Use of designees and identification of individual Designated
Engineering Representatives (DER)/Designated Airworthiness
Representatives (DAR)
These sections, and the material they contain, are appropriate
for any applicant's Certification Plan. They also could be applied
to the development of a Human Factors Certification Plan. This
document can be found on the Internet at http://www.faa.gov/avr/air/
acs/achome.htm.
6. Society of Aeronautical Engineers (SAE) Aerospace Recommended
Practice 4033, ``Pilot-System Integration,'' August 1995
This document provides a concept development guide to the human
engineering specialist and the aircraft systems designer for pilot-
system integration that will enhance safety, productivity, reduce
certification risk, and improve cost effectiveness. It addresses the
resulting processes of system development including aspects of
interface design and automation philosophy. (SAE publications are
available from SAE, 400 Commonwealth Drive, Warrendale, PA 15096-
0001; telephone (412) 776-4970; or e-mail at publications@sae.org.)
Appendix C--Sample Human Factors Certification Plan
This sample plan is intended to provide examples of the types of
information that could be included in the various sections. Keep the
following in mind while reviewing it:
It is based on a totally hypothetical certification
program, and no connection to any real system or certification
program is intended or implied.
There are placeholders where the drawings and other
figures could be inserted.
This sample plan should not be considered to be
comprehensive. The examples are intended to be illustrative, but do
not necessarily include all of the issues, even for the hypothetical
program.
The methods of compliance are intended to show the
methods that a hypothetical applicant might have chosen for the
project. It should not be construed as describing the acceptable
list of methods for any real program. These would have to be
discussed and agreed upon within the context of a specific program.
The Deliverable Products column in the compliance
matrix identifies what the hypothetical applicant will produce to
substantiate compliance. The titles of reports represent examples of
how an applicant might choose to package the information.
Finally, the sample plan is not intended to specify the
format of the report, but rather, to provide guidance on the
structure and content only.
[Hypothetical]--Human Factors Certification Plan for the Electronic
Approach Chart System (EACS)
1. Introduction
This project seeks a Supplemental Type Certificate for the
installation of an Electronic Approach Chart System (EACS) in Guerin
Model 522 airplanes. The intent of the EACS is to provide an
alternative to the use of paper approach charts. The EACS will be
installed so that it will be physically and functionally integrated
into the flight deck. System data will be loaded using existing on-
board data loading capabilities. The EACS will be certified as a
non-essential system. This Human Factors Certification Plan
identifies the human factors-related regulations and the methods of
compliance that will be used to show that all safety-related human
factors issues have been fully addressed.
2. System Description
a. Intended Function: The Electronic Approach Chart System uses
a panel-mounted Active Matrix Liquid Crystal Display (AMLCD) to
display approach charts for the pilots to use on the ground and in
flight. The key functions include the following:
(1) During the preflight preparation:
(a) The pilot will use the system to call up and review the
approach charts for the destination airport and selected alternates.
(b) The pilot will be able to ``mark'' the appropriate charts
for quick retrieval later in the flight.
(c) If initiated by the pilot, the system will be able to query
the Flight Management System (FMS) to pre-identify the appropriate
charts, based on the flight plan.
(2) During flight (normal operations):
(a) The pilot will quickly access the preselected approach
charts. Charts that were not preselected will also be accessible.
(b) The pilot will be able to manipulate the display of the
chart to show only the information relative to the planned route of
flight.
(c) The pilot will be able to select the appropriate approach
parameters (transition, approach navigation aids, minimums, etc)
using the EACS. Upon pilot initiation, the EACS will load these
selections into the other systems on the airplane [e.g., approach
navaids will be sent to the FMS for autotuning, decision height (DH)
will be sent to altitude alerting system and display system]. For a
complete list of EACS functions, see the EACS System Description
Document.
(3) During flight (non-normal operations, i.e., requiring an
emergency diversion): In addition to those functions available for
normal operations, the EACS provides the following functionality to
support emergency diversions.
(a) When the pilot selects the ALTERNATE AIRPORT function on the
FMS, the FMS automatically identifies the five nearest airports that
meet the landing requirements for the airplane. These airports will
be automatically transmitted to the EACS, which will preselect them
(mark them for quick retrieval).
(b) At the pilot's request, the EACS will display a listing of
the diversion airports and allow the pilot to quickly review the
approach charts and select the desired approach. As in normal
operations, this selection will be automatically transmitted to the
FMS and other using systems.
b. Flight Deck Layout Drawings:
(1) Figure 1 and Figure 2 are drawings showing the installation
location for the EACS displays, on an angled panel just outboard of
each pilot's main instrument panel and forward of the side console.
[Figures 1 and 2 would be shown here.]
(2) Figure 3 is a drawing of the EACS display unit with
integrated touch screen, function selection buttons, and brightness
control. [Figure 3 would be shown here.]
(3) Display formats are still in development and will be
provided according to the following schedule shown in Figure 4.
[Schedule would be shown here.]
c. Underlying Principles for Crew Procedures:
(1) Normal operations: The procedures for certain consistent
navigation functions are imbedded in the FMS software, which walks
the pilot through all necessary preflight and descent preparation
steps. This is accomplished using a sequence of prompts, followed by
a message when all required steps are completed. Wherever use of the
EACS is called for in these existing sequences of tasks, the FMS
software will be modified to include the appropriate prompts. Other
ad hoc uses for the EACS will be at the pilots' discretion, as is
the case with the other navigation and flight planning functions
within the FMS.
(2) Procedures for dealing with EACS and FMS failures: Any such
procedures will be driven by the following operational principles:
(a) The number of procedures and the number of steps in the
procedures should be minimized.
(b) All diagnosis of system problems are to be accomplished by
the system (i.e., there will be no crew procedures for diagnosing
problems).
(c) There will be no crew procedures that require the use of the
EACS circuit breaker.
(d) The pilots will not be required to learn alternative modes
of interaction (i.e., if the touch screen fails, the pilots will not
interact via a keyboard).
(e) If the FMS fails, the EACS should continue to operate
normally, except for those functions associated with EACS-FMS data
sharing. This continued operation should not be dependent on a pilot
procedure.
d. User Pilot Description: The initial certification of this
system will be in a transport category airplane and is expected to
be used in both Part 121 and Part 135 operations. As a result, this
program assumes that the pilot will have only the experience and
training required for Part 135 operations.
(1) It is assumed that, as minimum qualifications, the pilots
are multi-engine, instrument rated, commercial pilots. Minimum
expected flying hours: 500. No time in type is assumed (first
exposure to EACS may be during transition training).
(2) It is assumed that the pilots will have knowledge of
existing paper approach charts,
[[Page 54408]]
but no experience with electronic presentation of chart information.
(3) It is assumed that the pilots will receive sufficient
information/training to allow them to operate the FMS. Additional
information regarding the use of the EACS should be incorporated
into the FMS training material.
(4) The system should be simple and intuitive to operate, so
that the pilot can become proficient with either 30 minutes of
computer-based training, or with written material plus 30 minutes of
hands-on practice on the airplane (on the ground).
e. Description of the Operating Environment for the Airplane:
The following is a partial description of the operating environment
anticipated for the flight deck design:
(1) Expected operational rules under which the airplane will be
operated: Part 121, Part 135.
(2) Air Traffic Control (ATC) environment: The system must be
compatible with all currently planned FMS operations, including the
following:
(a) Full area navigation (RNAV) capability,
(b) Required time of arrival (RTA),
(c) Required Navigation Performance (RNP), using GPS as the
primary means of navigation.
(d) Aeronautical Telecommunications Network (ATN) Controller
Pilot Datalink Communications.
(3) Airport types, conditions, facilities: The system shall
support any airport types suitable for transport category airplanes.
(4) Geographic areas of operation and associated terrain and
weather issues: The system should support the display of any special
terrain feature currently available on paper charts. However, that
information may be displayed in a different way, appropriate for the
selected display device.
3. Compliance Matrix for Part 25 Regulations Related to Flightcrew
Human Factors
----------------------------------------------------------------------------------------------------------------
General human factors (HF) Method(s) of
Section [Amdt. Level] requirements compliance Deliverable product
----------------------------------------------------------------------------------------------------------------
Sec. 25.771(a) [at amdt. 25-4].... Each pilot compartment and Analysis, Simulator Workload Certification
its equipment must allow test, Flight test. Report.
the minimum flightcrew to
perform their duties
without unreasonable
concentration or fatigue.
Sec. 25.771(e) [at amdt. 25-4].... Vibration and noise Bench test............ Test report.
characteristics cockpit
equipment may not
interfere with safe
operation of the airplane.
Sec. 25.773(a)(1) [at amdt. 25-72] Each pilot compartment must Similarity............ Vision Certification
be arranged to give the Report.
pilots sufficiently
extensive, clear, and
undistorted view, to
enable them to safely
perform any maneuvers
within the operating
limitations of the
airplane, including
takeoff, approach, and
landing.
Sec. 25.773(a)(2) [at amdt. 25-72] Each pilot compartment must Ground test........... Lighting Certification
be free of glare and Report.
reflections that could
interfere with the normal
duties of the minimum
flightcrew.
Sec. 25.777(a) [at amdt. 25-46]... Each cockpit control must Simulator test,....... Flight Deck
be located to provide Flight test. Anthropometry
convenient operation and Certification Report.
to prevent confusion and
inadvertent operation.
Sec. 25.777(c) [at amdt. 25-46]... The controls must be Ground test........... Flight Deck
located and arranged, with Anthropometry
respect to the pilot's Certification Report.
seats, so that there is
full and unrestricted
movement of each control
without interference from
the cockpit structure or
the clothing of the
minimum flightcrew when
any member of this
flightcrew, from 5'2'' to
6'3'' in height, is seated
with the seat belt and
shoulder harness fastened.
Sec. 25.1301(a) [original amdt.]]. Each item of installed System description.... System Description
equipment must be of a Simulator Document.
kind and design demonstration Demonstration Report.
appropriate to its Flight test Flight Test Report.
intended function.
Sec. 25.1309(b)(3) [at amdt. 25- * * * Systems, controls, Hazard assessment..... Fault tree analyses.
41]. and associated monitoring Simulator Demonstration Report.
and warning means must be demonstration.
designed to minimize crew
errors that could create
additional hazards.
Sec. 25.1321(a) [at amdt. 25-41].. * * * Each flight, System description Installation drawings.
navigation, and powerplant Analysis. Vision Certification
instrument for use by any Flight test Report.
pilot must be plainly Flight Test report.
visible to him from his
station with the minimum
practicable deviation from
his normal position and
line of vision when he is
looking forward along the
flight path.
Sec. 25.1321(e) [at amdt. 25-41].. If a visual indicator is Similarity............ System description and
provided to indicate Ground test Statement of
malfunction of an Similarity.
instrument, it must be Flight Test report.
effective under all
probable cockpit lighting
conditions.
Sec. 25.1523 [at amdt. 25-3]...... The minimum flightcrew must Simulator test........ Demonstration report.
be established so that it Flight test Flight Test report.
is sufficient for safe
operation, considering:
(a) the workload on
individual crewmembers;
(b) the accessibility and
ease of operation of
necessary controls by the
appropriate crewmember;
and
(c) the kind of operation
authorized under Sec.
25.1525.
The criteria used in making
the determinations
required by this section
are set forth in Appendix
D.
Sec. 25.1543(b) [at amdt. 25-72].. Each instrument marking Analysis.............. Vision certification
must be clearly visible to Similator test report.
the appropriate crewmember. Demonstration report.
----------------------------------------------------------------------------------------------------------------
SYSTEM-SPECIFIC HF REQUIREMENTS
----------------------------------------------------------------------------------------------------------------
Sec. 25.1381(a)(2) [at amdt. 25- The instrument lights must Ground test........... Flight Test report.
72]. be installed so that (ii)
no objectionable
reflections are visible to
the pilot.
----------------------------------------------------------------------------------------------------------------
[[Page 54409]]
SPECIFIC CREW INTERFACE REQUIREMENTS
----------------------------------------------------------------------------------------------------------------
Sec. 25.773(b)(2)(i) [at amdt. 25- The first pilot must have a Ground test (to verify Flight Test report.
72]. window that is openable * no interference with
* * and gives sufficient window opening).
protection from the
elements against
impairment of the pilot's
vision.
Sec. 25.1322 [at amdt. 25-38]..... If warning, caution, or
advisory lights are
installed in the cockpit,
they must, unless
otherwise approved by the
Administrator, be--
(a) Red, for warning lights
(lights indicating a
hazard which may require
immediate corrective
action);
(b) Amber, for caution
lights (lights indicating
the possible need for
future corrective action);
(c) Green for safe
operation lights; and
(d) Any other color, Similarity............ System Description
including white, for Document.
lights not described in
paragraphs (a) through (c)
of this section, provided
the color differs
sufficiently from the
colors prescribed in
paragraphs (a) through (c)
of this section to avoid
possible confusion.
----------------------------------------------------------------------------------------------------------------
4. System Safety Assessments
Each Fault Tree that includes a pilot response to a failure
condition will include an assessment in accordance with AC 25.1309.
In addition, any specific design features intended to increase the
likelihood of correct pilot response will be noted in the system
safety assessment.
5. Operational Considerations
The EACS is intended to replace the routine use of paper charts
during all expected operations. It should be noted that design of
this system is predicated on the assumption that if the system
experiences a total failure, the pilots will revert to the use of
paper charts. Because of this and the need to minimize the training
burden, basic flight operations for the airplane will be unaffected
by the incorporation of this system (no change in airplane
capability or interaction with the airspace). Changes in pilot
activities will be restricted to the way in which approach chart
information is selected, accessed, and viewed. The following
documents are expected to be modified as a result of the
incorporation of EACS:
Master Minimum Equipment List (MMEL).
Flightcrew Operating Manual (FCOM).
Flightcrew Training Manual.
6. Certification Documentation
Several documents will be produced that are intended to
summarize the certain major human factors certification topics:
a. Workload-related issues [Sec. 25.771(a) and Sec. 25.1523]
will be covered in the Workload Certification Report. This will
contain procedure analysis, timeline analysis, Pilot Subjective
Evaluation results, and an overall summary of the workload
considerations, as described in 14 CFR part 25, Appendix D.
Note: Workload related data gathering during flight test is
expected to be conducted concurrently with other scheduled flight
tests (i.e., no dedicated workload test flights).
b. Internal and External Vision issues [Sec. 25.773(a)(1),
Sec. 25.1321(a), Sec. 25.1543(b), Sec. 25.785(l)] will be covered in
the Vision Certification Report. This report will contain internal
and external vision analyses, and a summary of pilot assessments.
c. Flight deck lighting issues [Sec. 25.773(a)(2),
Sec. 25.1321(e), Sec. 25.1381(a)(2)] will be covered in the Lighting
Certification Report. This report will include the results of
reflection measurements and pilot assessments from ground tests and
flight tests.
d. Issues associated with the physical arrangement of the flight
deck with respect to pilot reach, clearance, and interference
[Sec. 25.777(a) and (c)], will be covered in the Flight Deck
Anthropometry Certification Report.
Note: No computer modeling is planned. Testing will be done
using human subjects with representative body dimensions.
e. Other documentation cited in the compliance matrix will be
finalized as the testing plans develop. For most of the flight
testing, during which human factors certification tests will be
conducted concurrently with other planned testing, the human factors
results will be documented in the overall test report.
7. Certification Schedule
The following schedule (Figure 5) indicates the approximate
timing of the major human factors analysis/demonstration/test
activities, planned updates to the Human Factors Certification Plan,
and planned coordination meetings for the discussion of human
factors certification issues. This schedule will be refined and
adjusted as the certification program develops.
Figure 5.--Flight Crew Operations Certification Schedule
[Start Date: 8/1/1999; End Date: 4/15/2000]
----------------------------------------------------------------------------------------------------------------
1999 2000
Milestone ---------------------------------------------------
Quarter 3 Quarter 4 Quarter 1 Quarter 2
----------------------------------------------------------------------------------------------------------------
Initial FAA Project Concept Discussion Meeting.............. 6/1 ........... ........... ...........
Certification Plan Submittals............................... 8/1 ........... ........... ...........
Initial FAA Project Familiarization--draft drawings, etc.... 9/1 ........... ........... ...........
FAA Simulator Demonstrations................................ 9/15 ........... ........... ...........
FAA Simulator Demonstrations................................ ........... 10/10 ........... ...........
FAA Procedures Simulator Demos.............................. ........... 10/30 ........... ...........
Workload Compliance Demonstrations.......................... ........... 11/15 ........... ...........
List of Dispatch Conditions and Might Failures.............. ........... 11/15 ........... ...........
Flight Test Program......................................... ........... 12/15 ........... ...........
Certification Document Submittals........................... ........... ........... 1/5 ...........
Draft Crew Ops Cert Document................................ ........... ........... 3/1 ...........
Workload 8110 Cert Report................................... ........... ........... ........... 4/1
Final Crew Ops Cert. Document............................... ........... ........... ........... 4/15
----------------------------------------------------------------------------------------------------------------
[[Page 54410]]
8. Use of Designees and Identification of Individual DER/DAR
The applicant recommends that the majority of the findings of
compliance be delegated to the pilot DER. Final assessment of
compliance with Sec. 25.1523 should include FAA participation in
flight test involving specific high workload scenarios. The FAA
should also participate in ground testing for display legibility.
Appendix D--Quick Reference Guide for Reviewing Human Factors
Certification Plans
This form can be used when reviewing an applicant's
Certification Plan.
------------------------------------------------------------------------
Yes No N/A
------------------------------------------------------------------------
1. Introduction.................................
2. System description:
a. Intended function from pilot's perspective.
b. Flight deck layout drawings................
c. Underlying principles for crew procedures..
d. Assumed pilot characteristics..............
e. Description of the operating environment
for the airplane.............................
3. Certification requirements:
a. Regulations................................
b. Special requirements, unique or novel
design aspects...............................
c. Compliance checklist.......................
4. Methods of compliance........................
5. System safety assessment.....................
6. Operational considerations...................
7. Certification documentation..................
8. Certification schedule.......................
9. Use of designees and identification of
individual Designated Engineering
Representative (DER)/Designated Airworthiness
Representative (DAR)...........................
------------------------------------------------------------------------
Issued in Renton, Washington, on September 29, 1999.
Vi L. Lipski,
Acting Manager, Transport Airplane Directorate, Aircraft Certification
Service.
[FR Doc. 99-26047 Filed 10-5-99; 8:45 am]
BILLING CODE 4910-13-U
