CS 25.1302 Installed systems and equipment for use by the flight crew

Table of contents

1.Introduction

1.1. Background

1.2. Applicability

1.3. Definitions

1.4. Abbreviations

2.Relation between CS 25.1302 and other specifications, and assumptions

2.1. The relation of CS 25.1302 to other specifications

2.2. Flight crew member capabilities

3.Human factors certification

3.1. Overview

3.2. Certification steps and deliverables

3.2.1. Identification of the flight deck controls, information, systems and equipment that involve flight crew interaction

3.2.2. The intended function of the systems and equipment and the associated flight crew tasks

3.2.3. Determining the level of scrutiny

3.2.4. Determining the level of scrutiny — EASA’s familiarity with the project

3.2.5. Applicable human factors design requirements

3.2.6. Selecting the appropriate means of compliance

3.2.7. Certification programme

3.2.8. Other deliverables

3.3. Certification strategy and methodologies

3.3.1. Certification strategy

3.3.2. Methodological considerations applicable to human factors assessments

4.Design considerations and guidance

4.1. Overview

4.2. Controls

4.3. Presentation of information

4.4. System behaviour

4.5. Flight crew error management

4.6. Integration

5.Means of compliance

5.1. Overview

5.2. List of the means of compliance

5.3. Selecting the means of compliance

5.3.1. Credit from previous compliance certification processes

5.3.2. Representativeness of the test article

5.3.3. Presentation of the means of compliance

AMC 25.1302 Appendix 1: Related regulatory material and documents

1.Introduction

1.1. Background

Demonstrating compliance with the design requirements that relate to human abilities and limitations is subject to interpretation. Findings may vary depending on the novelty, complexity or integration of the system design. EASA considers that describing a structured approach to selecting and developing acceptable means of compliance is useful in supporting the standardisation of compliance demonstration practices.

1.2. Applicability

(a)This AMC provides acceptable means for demonstrating compliance with CS 25.1302 and complements the AMC of several other paragraphs in CS-25 (refer to paragraph 2, Table 1, of this AMC) that relate to the installed systems and equipment used by the flight crew for the operation of an aeroplane. In particular, this AMC addresses the design and approval of installed systems and equipment intended for use by the flight crew members from their normal seating positions on the flight deck.

(b)This AMC applies to flight crew interfaces and system behaviour for all the installed systems and equipment used by the flight crew while operating the aeroplane in normal, abnormal/malfunction and emergency conditions.

(c)This AMC does not apply to flight crew training, qualification or licensing requirements.

1.3. Definitions

For the purposes of this AMC, the following definitions apply.

Abnormal/malfunction or emergency operating conditions. For the purposes of this AMC, abnormal/malfunction or emergency operating conditions refer to conditions that require the flight crew to apply procedures different from the normal procedures included in the aeroplane flight manual (AFM).

Alert. A generic term used to describe a flight deck indication meant to attract the attention of and identify to the flight crew a non-normal operational or aeroplane system condition. Alerts are classified at levels or categories corresponding to Warning, Caution, and Advisory. Alert indications also include non-normal-range markings (e.g. exceedances on instruments and gauges).

Assessment. The process of finding and interpreting evidence to be used by the applicant in order to establish compliance with a specification. For the purposes of this AMC, this term may refer to a range of means of compliance, such as mock-ups, design reviews, laboratory reviews, analyses, evaluations and tests. Evaluations are intended to be conducted using partially representative test means, whereas tests make use of conformed test articles.

Automation. The autonomous execution of a task (or tasks) by aeroplane systems started by a high-level control action of the flight crew.

Catachresis. Applied to the area of tools, this term means the use of a tool for a function other than the one planned by the designer of the tool; for instance, the use of a circuit breaker as a switch.

Clutter. An excessive number and/or variety of symbols, colours or other information that may reduce access to the relevant information and increase interpretation time and the likelihood of interpretation error.

Conformity. Official verification that the flight deck / system / product conforms to the type design data.

Control device. A control device is a piece of equipment that allows the flight crew to interact with the virtual controls, typically used with a graphical user interface. Control devices may include the following:

keyboards, touchscreens, cursor-control devices (keypads, trackballs, pointing devices), knobs, voice-activated controls.

Cursor-control device. A control device for interacting with the virtual controls, typically used with a graphical user interface on an electro-optical display.

Design eye reference point. A point on the flight deck that provides a finite reference enabling the precise determination of geometric entities that define the layout of the flight deck.

Design feature. An attribute or a characteristic of a design.

Design item. A defined and bounded set of either (one or more) hardware elements or (one or more) software elements that are treated as a single entity for analytical purposes. A design item can be a system, a piece of equipment, a function, a component or a design feature.

Design philosophy. A high-level description of the human-centred design principles that guide the designer and aid in ensuring that a consistent, coherent user interface is presented to the flight crew.

Design-related human performance issue. A deficiency that results from the interaction between the flight crew and the system. It includes human errors, but also encompasses other kinds of shortcomings, such as hesitations, doubts, difficulties in finding information, suboptimal strategies, inappropriate levels of workload or any other observable item that cannot be considered to be a human error but still reveals a design-related concern.

Display. A device that transmits data or information from the aircraft to the crew.

Emergency condition. Refer to ‘Abnormal/malfunction or emergency operating conditions’ above.

Flight crew member. A licensed crew member charged with duties that are essential for the operation of an aircraft during a flight duty period.

Flight deck. The area of the aircraft where the flight crew works and where the primary flight controls and displays are located.

Flight deck controls. The interaction with a control means that the flight crew manipulates in order to operate, configure and manage the aircraft or its flight control surfaces, systems and other equipment.

This may include equipment on the flight deck such as:

control devices;

buttons;

switches;

knobs;

flight controls;

levers.

Human error. A deviation from what is considered correct in a given context, especially with the hindsight of the analysis of accidents, incidents or other events of interest. Types of human error include an inappropriate action, a difference from what is expected in a procedure, an incorrect decision, an incorrect keystroke or an omission. In the context of this acceptable means of compliance, human error is sometimes referred to as ‘crew error’ or ‘pilot error’.

Multifunction control. A control device that can be used for many functions, as opposed to a control device with a single dedicated function.

Operationally relevant behaviour. Behaviour that is meant to convey the net effect of the system logic, controls and displayed information of the equipment upon the awareness of the flight crew members or their perception of the operation of the system to the extent necessary for planning actions or operating the system. The intent is to distinguish such system behaviour from the functional logic within the system design, much of which the flight crew does not know or does not need to know, and which should be transparent to them.

Task analysis. A formal analytical method used to describe the nature and relationships of complex tasks involving a human operator.

1.4. Abbreviations

The following is a list of abbreviations used in this AMC.

AFM aeroplane flight manual

AMC acceptable means of compliance

ATC air traffic control

CS certification specification

ECL electronic checklist

FAA Federal Aviation Administration

FMS flight management system

HF human factors

HMI human–machine interface

ICAO International Civil Aviation Organization

QAK quick access key

TAWS terrain awareness and warning system

2.Relation between CS 25.1302 and other specifications, and assumptions

2.1. The relation of CS 25.1302 to other specifications

(a)This AMC provides dedicated acceptable means for demonstrating compliance with CS 25.1302. To help the applicant reach the objectives of CS 25.1302, some additional AMC related to other specifications associated with the installed systems and equipment that the flight crew uses to operate the aeroplane are also provided in paragraph 4. Table 1 below contains a list of these specifications related to the flight deck design and flight crew interfaces for which this AMC provides additional design guidance. Note that this AMC does not provide a comprehensive acceptable means of compliance for any of the specifications beyond CS 25.1302.

Table 1: Certification specifications relevant to this AMC

<table>

<tr><td>CS-25 Book 1 references</td><td>General topic</td><td>Referenced material in this AMC</td></tr> <tr><td>CS 25.771(a)</td><td>Unreasonable concentration or fatigue</td><td>Error (paragraph 4.5) Integration (paragraph 4.6) Controls (paragraph 4.2) System behaviour (paragraph 4.4)</td></tr> <tr><td>CS 25.771(c)</td><td>Controllable from either pilot seat</td><td>Controls (paragraph 4.2) Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.773</td><td>Pilot compartment view</td><td>Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.777(a)</td><td>Location of cockpit controls</td><td>Controls (paragraph 4.2) Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.777(b)</td><td>Direction of movement of cockpit controls</td><td>Controls (paragraph 4.2) Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.777(c)</td><td>Full and unrestricted movement</td><td>Controls (paragraph 4.2) Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.779</td><td>Motion and effect of flight deck controls</td><td>Controls (paragraph 4.2)</td></tr> <tr><td>CS 25.1301(a)</td><td>Intended function of installed systems</td><td>Error (paragraph 4.5) Integration (paragraph 4.6) Controls (paragraph 4.2) Presentation of information (paragraph 4.3) System behaviour (paragraph 4.4)</td></tr> <tr><td>CS 25.1303</td><td>Flight and navigation instruments</td><td>Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.1309(a)</td><td>Intended function of required equipment under all operating conditions</td><td>Controls (paragraph 4.2) Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.1309(c)</td><td>Unsafe system operating conditions and minimising crew errors that could create additional hazards</td><td>Presentation of information (paragraph 4.3) Errors (paragraph 4.5)</td></tr> <tr><td>CS 25.1321</td><td>Arrangement and visibility of instruments</td><td>Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.1322</td><td>Flight Crew Alerting</td><td>Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.1329</td><td>Flight Guidance System</td><td>System behaviour (paragraph 4.4)</td></tr> <tr><td>CS 25.1523</td><td>Minimum flight crew</td><td>Controls (paragraph 4.2) Integration (paragraph 4.6)</td></tr> <tr><td>CS 25.1543(b)</td><td>Visibility of instrument markings</td><td>Presentation of information (paragraph 4.3)</td></tr> <tr><td>CS 25.1555(a)</td><td>Control markings</td><td>Controls (paragraph 4.2)</td></tr> <tr><td>CS-25 Appendix D</td><td>Criteria for determining minimum flight crew</td><td>Integration (paragraph 4.6)</td></tr> </table>

(b)Where acceptable means of compliance in other AMC are provided for specific equipment and systems, those means are assumed to take precedence if a conflict exists with the means provided in this AMC.

2.2. Flight crew member capabilities

In order to demonstrate compliance with all the specifications referenced by this AMC, all the certification activities should be based on the assumption that the aeroplane will be operated by qualified flight crews who are trained in the use of the installed systems and equipment.

3.Human factors certification

3.1. Overview

(a)This paragraph provides an overview of the human factors (HF) certification process that is acceptable to demonstrate compliance with CS 25.1302. This includes a description of the recommended applicant activities, the communication between the applicant and EASA and the expected deliverables.

(b)Figure 1 illustrates the main steps in the HF certification process.

Figure 1: Methodological approach to the HF certification process

[Figure or form omitted from this preview — available in the Avioverse workspace library.]

3.2. Certification steps and deliverables

3.2.1. Identification of the flight deck controls, information, systems and equipment that involve flight crew interaction

(a)As an initial step, the applicant should consider all the design items used by the flight crew with the aim of identifying the controls, information, systems and equipment behaviours that involve flight crew interaction.

(b)In the event of a change to the (restricted/supplemental) type certificate, the scope of the functions to be analysed is limited to the design items affected by the change and its integration.

(c)The objective is to analyse and document the flight crew tasks to be performed, or how tasks might be changed or modified as a result of introducing new design items.

3.2.2. The intended function of the systems and equipment and the associated flight crew tasks

(a)CS 25.1301(a) requires that ‘each item of installed equipment must be of a kind and design appropriate to its intended function’. CS 25.1302 establishes the requirements to ensure that the design supports the flight crew members in performing their tasks. In order to demonstrate compliance with CS 25.1302, the intended function of a system or equipment and the tasks expected to be performed by the flight crew must be known.

(b)An applicant’s statement of the intended function should be sufficiently specific and detailed that it is possible to evaluate whether the system or equipment is appropriate for the intended function(s) and the associated flight crew tasks. For example, a statement that a new display system is intended to ‘enhance situational awareness’ should be further explained. A wide variety of different displays enhance situational awareness in different ways. Some examples are terrain awareness, vertical profiles and even primary flight displays. The applicant may need to provide more detailed descriptions for designs with greater levels of novelty, complexity or integration.

(c)The applicant should describe the intended function(s) and associated task(s) for:

(1)each design item and its integration;

(2)flight crew indications and controls for that system or equipment;

(3)the prominent characteristics of those indications and controls.

This type of information, describing the indications, controls and flight crew member procedures, is of the level typically provided in a pilot handbook or an operations manual.

(d)The applicant may evaluate whether the statement of the intended function(s) and the associated task(s) is sufficiently specific and detailed by using the following questions:

(1)Does each design item have a stated intent?

(2)Are the flight crew member tasks associated with the function(s) described?

(3)What assessments and actions is the flight crew expected to carry out, and what decisions does the flight crew need to make, based on the information provided by the system or equipment?

(4)What other information is assumed to be used in combination with the system or equipment?

(5)Will the installation or use of the system or equipment interfere with the ability of the flight crew to operate other flight deck systems or equipment?

(6)Are any assumptions made about the operational environment in which the system or equipment will be used?

(7)What assumptions are made about the attributes or abilities of the flight crew beyond those required in the regulations governing operations, training or qualification?

(e)The output of this step is a list of design items, including each of the associated intended functions related to the flight crew member tasks.

3.2.3. Determining the level of scrutiny

(a)The depth and extent of the HF investigation to be performed in order to demonstrate compliance with CS 25.1302 is driven by the level of scrutiny. The level of scrutiny is determined by analysing the design items using the criteria described in the following subparagraphs.

(1)Integration. The level of the systems’ integration refers to the extent to which there are interdependencies between the systems that affect the operation of the aeroplane by the flight crew. The applicant should describe the integration between systems because it may affect the means of compliance. Paragraph 4.6 also refers to integration. In the context of that paragraph, ‘integration’ defines how specific systems are integrated into the flight deck and how the level of integration may affect the means of compliance.

(2)Complexity. The level of complexity of the design item from the flight crew’s perspective is an important factor that may also affect the means of compliance. Complexity has multiple dimensions, for instance:

the amount, the accessibility and the level of integration of information that the flight crew has to use (e.g. the number of items of information on a display, the number of colours, the number of alerts or voice messages may be an indication of the complexity);

the number, the location and the design of the flight deck controls associated with each system and the logic associated with each of the controls;

the number of steps required to perform a task, and the complexity of the workflows.

(3)Novelty. The novelty of a design item is an important factor that may also affect the means of compliance. The applicant should characterise the degree of novelty on the basis of the answers to the following questions:

(i)Are any new functions introduced into the flight deck design?

(ii)Does the design introduce a new intended function for an existing or a new design item?

(iii)Are any new technologies introduced that affect the way the flight crew interacts with the systems?

(iv)Are any new design items introduced at the aeroplane level that affect flight crew tasks?

(v)Are any unusual procedures needed as a result of the introduction of a new design item?

(vi)Does the design item introduce a new way for the flight crew to interact with the system?

While answering the above questions, each negative response should be justified by the applicant identifying the reference product that has been considered. The reference product can be an avionics suite or an entire flight deck previously certified by the same applicant. The degree of novelty should be proportionate to the number of positive answers to the above questions.

(b)All the affected design items (refer to point 3.2.1) are expected to be scrutinised. If none of the criteria in point (a) above is met, the design item in question is a candidate for a low level of scrutiny.

The level of scrutiny performed by the applicant should be proportionate to the number of the above criteria that are met by each design item. The applicant should be aware that the impact of a complex design item might also be affected by its novelty and the extent of its integration with other elements of the flight deck. For example, a complex but not novel design item is likely to require a lower level of scrutiny than one that is both complex and novel. On the other hand, a function that is brand new and ‘unknown’ might trigger a high level of scrutiny even if the answers to the other questions are ‘no’. If there is no direct proportionality between the number of criteria and the level of scrutiny, the applicant should provide a rationale. The applicant is expected to include in the certification plan all the items that have been analysed alongside the associated level of scrutiny.

(c)The applicant may use a simpler approach for design items that have been assigned a low level of scrutiny.

3.2.4. Determining the level of scrutiny — EASA’s familiarity with the project

The assessment of the classifications of the level of scrutiny proposed by the applicant requires the EASA flight and HF experts to be familiar with the project, making use of the available material and tools.

3.2.5. Applicable human factors design requirements

(a)The applicant should identify the HF design requirements applicable to each design item for which compliance must be demonstrated. This may be accomplished by identifying the design characteristics of the design items that could adversely affect the performance of the flight crew, or that pertain to the avoidance and management of flight crew errors. Specific design considerations for the requirements that involve human performance are discussed in paragraph 4.

(b)The expected output of this step is a compliance matrix that links the design items and the HF design requirements that are deemed relevant and applicable so that a detailed assessment objective can be derived from each design item and HF design requirement pair. That objective will then have to be verified using the most appropriate means of compliance or a combination of means of compliance. GM2 25.1302 provides examples of this matrix.

3.2.6. Selecting the appropriate means of compliance

(a)The applicant should review paragraph 5.2 for guidance on the selection of the means of compliance, or multiple means of compliance, appropriate to the design. In general, it is expected that the level of scrutiny should increase with higher levels of novelty, complexity or integration of the design. It is also expected that the amount of effort dedicated to the demonstration of compliance should increase with higher levels of scrutiny (e.g. by using multiple means of compliance and/or multiple HF assessments on the same topic).

(b)The output of this step will consist of the list of means of compliance that will be used to verify the HF objectives.

3.2.7. Certification programme

The applicant should document the certification process, outputs and assessments described in the previous paragraphs. This may be done in a separate plan or incorporated into a higher-level certification programme.

3.2.8. Other deliverables

(a)A HF assessment programme should be produced for each assessment and should describe the experimental protocol (the number of scenarios, the number and profiles of the flight crew members, practical organisation of the assessment, etc.), the HF assessment objectives to be addressed, the expected crew member behaviours and the scenarios expected to be run. When required by the level of involvement, the HF assessment programme should be provided well in advance to EASA.

(b)A HF assessment report should be produced including at least the following information:

(1)a summary of:

(i)the configuration of the means used for the assessment;

(ii)the limitations/representativeness of the means used for the assessment;

(iii)the detailed HF assessment objectives;

(iv)the HF assessment protocol, including the number of sessions and number of flight crew members, type of flight crew members (test or operational pilots from the applicant, EASA pilots, customer pilots), a description of the scenarios, the organisation of the session (training, briefing, assessment, debriefing) and the observers;

(2)a description of the data gathered with the link to the HF objectives;

(3)in-depth analyses of the observed human performance issues;

(4)conclusions regarding the related HF assessment objectives;

(5)a description of the proposed way to mitigate the human performance issues (design change, improvements in procedures and/or training actions).

If EASA has retained the review of the assessment report as part of its level of involvement, then the applicant should deliver it after every HF assessment.

3.3. Certification strategy and methodologies

3.3.1. Certification strategy

(a)The HF assessment should follow an iterative process. Consequently, where appropriate, there may be several iterations of the same system-specific assessment, allowing the applicant to reassess the system if the previous HF test campaigns resulted in design, training or procedure changes.

(b)A HF certification strategy based on only one assessment aiming to demonstrate that the design assumptions are valid (i.e. one final exercise proposed for compliance demonstration at the very end of the process) is generally not sufficient.

(c)In order to allow for a sufficient number of design and assessment iterations, it is suggested that the applicant initiate the certification process as early as possible, starting from the early development phase. The certification process could include familiarisation sessions that would allow EASA to become familiar with the proposed design and participate in assessments that would possibly allow early credits to be granted. Potential issues may be identified early on by using this approach, thus reducing the risk of a late redesign of design items that may not be acceptable to EASA. Both parties may have an interest in EASA’s early involvement, as EASA is continuously gaining experience and confidence in the HF process and the compliance of the flight deck design. The representativeness of the systems and of the simulation means in the early stages of the development is not a key driver, and will not prevent EASA’s involvement as long as the representativeness issues do not compromise the validity of the data to be collected.

(d)If an applicant plans to use data provided by a supplier for compliance demonstration, the approach and the criteria for accepting that data will have to be shared and agreed with EASA as part of the HF certification plan.

3.3.2. Methodological considerations applicable to human factors assessments

Various means of compliance may be selected, as described in paragraph 5.

For the highest level of scrutiny, the scenario-based approach is likely to be the most appropriate methodology for some means of compliance.

The purpose of the following points is to provide guidelines on how to implement the scenario-based approach.

(a)The scenario-based approach is intended to substantiate the compliance of human–machine interfaces (HMIs). It is based on a methodology that involves a sample of various flight crew members who are representative of the future users, being exposed to representative operational conditions in a test bench or simulator, or in the aeroplane. The scenarios are designed to show compliance with selected certification specifications and to identify any potential deviations between the expected behaviour of the flight crew and the activities of the flight crew that are actually observed. The scenario designers can make use of triggering events or conditions (a system failure, an air traffic control (ATC) request, weather conditions, etc.) in order to build operational situations that are likely to trigger observable flight crew member errors, difficulties or misunderstandings. The scenarios need to be well consolidated before the HF test campaign begins. A dry-run session should be performed by the applicant before any HF test campaign in order to validate the operational relevance of the scenarios. This approach should be used for both system-and aeroplane-level assessments.

(b)System-level assessments focus on a specific design item and are intended to be carried out for an in-depth assessment of the related functional and operational aspects, including all the operational procedures. The representativeness of the test article is to be evaluated taking into account the scope of the assessment. Aeroplane-level assessments consider the scope of the full flight deck, and focus on integration and interdependence issues.

(c)The scenarios are expected to cover a subset of the detailed HF assessment objectives. The link between each scenario and the assessment objectives should be substantiated. This rationale should be described in the certification test plan or in any other relevant document.

(d)The criteria used to select the flight crew members involved in the HF assessments with certification credit should be appropriate for the scope of the tests to be conducted, and the flight crew member selection process should be recorded. The applicant should ensure that the test participants are representative of the future users.

(e)Due to interindividual variability, HF scenario-based assessments performed with a single crew member are not acceptable. The usually accepted number of flight crew members used for a given HF test campaign varies from three to five, including the EASA flight crew, if applicable. In the case of a flight crew composed of two members, with HF objectives focused on the duties of only one member, it is fully acceptable for the applicant to use the same pilot for flying or monitoring (the one who is not expected to produce any HF data) throughout the campaign.

(f)In addition to the assessment report, and in order to reduce the certification risk, it is recommended that the preliminary analyses resulting from recorded observations and comments be presented by the applicant to EASA soon after the simulator/flight sessions in order to allow expert discussions to take place.

(g)An initial briefing should be given to the flight crew at the beginning of each session to present the following general information:

(1)A detailed schedule describing the type and duration of the activities (the duration of the session, the organisation of briefings and debriefings, breaks, etc.);

(2)What is expected of the flight crew: it has to be clearly mentioned that the purpose of the assessment is to assess the design of the flight deck, not the performance of the pilot;

(3)The policy for simulator occupancy: how many people should be in the simulator relative to the number of people in the control room, and who they should be.

(4)The roles of the test subjects: if flight test pilots from the applicant participate in the assessment, they should be made aware that their role differs significantly from their typical expert pilot role in the development process. For the process to be valid without significant bias, they are expected to react and behave on the flight deck as operational pilots.

However, the flight crew that participates in the assessment should be neither:

briefed in advance about the details of the failures and events to be simulated (to avoid an obvious risk of experimental bias); nor asked before the assessment for their opinion about the scenarios to be implemented.

(h)The flight crew needs to be properly trained prior to every assessment so that, during the analysis, the ‘lack of training’ factor can be excluded to the maximum extent possible from the set of potential causes of any observed design-related human performance issue. Furthermore, for operational representativeness purposes, realistic flight crew task sharing, from normal to emergency workflows and checklists, should be respected during HF assessments. The applicant should make available any draft or final AFM, procedures and checklists sufficiently in advance of the assessment for the flight crew members to prepare themselves.

(i)When using simulation, the immersion feeling of the flight crew should be maximised in order to increase the validity of the data. This generally leads to recommendations about a sterile environment (with no outside noise or visual perturbation), no intervention by observers, no interruptions in the scenarios unless required by the nature of the objectives, realistic simulation of ATC communications, pilots wearing headsets, etc.

(j)The method used to collect HF data needs to take into account the following principles.

(1)Principles applicable to the collection of HF-related data

(i)In order to substantiate compliance with CS 25.1302, it is necessary to collect both objective and related subjective data.

(A)Objective data on flight crew performance and behaviour should be collected through direct observation. The observables should not be limited to human errors, but should also include pilot verbalisations in addition to behavioural indicators such as hesitation, suboptimal or unexpected strategies and catachresis. Psychophysiological data may be collected when relevant to confirm or complement data gathered through direct observation.

(B)Subjective data should be collected during the debriefing by the observer through an interactive dialogue with the observed flight crew. The debriefing should be led using a neutral and critical positioning from the observer. This subjective data is typically data that cannot be directly observed (e.g. pilot intention, pilot reasoning) and facilitate better understanding of the observed objective data from (A).

(ii)Other tools such as questionnaires and rating scales could be used as complementary means. However, it is never sufficient to rely solely on self-administered questionnaires because flight crews are not necessarily aware of all their errors or of deviations with respect to the intended use.

(2)The HF assessment should be video recorded (both ambient camera and displays). Records may be used by the applicant as a complementary observation means, and by EASA for verification purposes, when required.

(3)It is very important to conduct debriefings after the HF assessments. They allow the applicant’s HF observers to gather all the data necessary for the subsequent HF analyses.

(4)HF observers should respect the best practices with regard to observation and debriefing techniques.

(5)Debriefings should be based on non-directive or semi-directive interviewing techniques and should avoid the experimental biases that are well described in the literature in the field of social sciences (the expected answer contained in the question, non-neutral attitude of the interviewer, etc.).

(k)If HF-related concerns are raised that are not directly related to the objective of the assessment, they should nevertheless be recorded, adequately investigated and analysed in the assessment report.

(l)Every design-related human performance issue observed or reported by the flight crew should be analysed following the assessment. In the case of a human error, the analysis should provide at least the following information:

(1)the type of error,

(2)the observed operational consequences and any reduction in the safety margins,

(3)the description of the operational context at the time of observation,

(4)whether the error was detected and, if so, by whom, when and how,

(5)whether the error was recovered from and, if so, by whom, when and how,

(6)existing means of mitigation,

(7)possible effects of the representativeness of the test means on the validity of the data,

(8)the possible causes of the error.

(m)The analysis of design-related human performance issues has to be concluded by detailing the appropriate way forward, which is one of the following:

(1)no action required,

(2)an operational recommendation (for a procedural improvement or training action),

(3)a recommendation for a design improvement,

(4)a combination of items (2) and (3).

(n)Workload assessment is considered and addressed in different ways through several specifications within CS-25.

(1)The intent of CS 25.1523 is to evaluate the workload with the objective of determining the minimum flight crew.

(2)The intent of CS 25.1302 is to identify design-related human performance issues.

(3)As per CS 25.1302, the acceptability of workload levels is one parameter among many to be investigated in order to highlight potential usability problems. The CS 25.1302 evaluations should not be limited to workload alone. Workload ratings should complement other data from observations of flight crew behaviour or other types of data.

(4)The techniques used to collect data in the context of the CS 25.1302 evaluations could make use of workload rating scales, but in that case no direct conclusion should be made from the results about the compliance with CS 25.1302.

4.Design considerations and guidance

4.1. Overview

(a)This material provides the standard that should be applied in order to design a flight deck that is in line with the objectives of CS 25.1302. Not all the criteria can or should be met by all systems. The applicant should use its judgement and experience in determining which design standard should apply to each part of the design in each situation.

(b)The below subparagraphs relate to the specifications listed in CS 25.1302 as follows:

(1)paragraph 4.2 ‘controls’ mainly relates to CS 25.1302(a) and (b);

(2)paragraph 4.3 ‘presentation of information’ mainly relates to CS 25.1302(a) and (b);

(3)paragraph 4.4 ‘system behaviour’ mainly relates to CS 25.1302(c);

(4)paragraph 4.5 ‘flight crew error management’ mainly relates to CS 25.1302(d).

Additionally, specific considerations on integration are provided in paragraph 4.6.

4.2. Controls

(a)The applicant must show that the controls included in the proposed design comply with CS 25.1302(a) and (b) in addition to CS 25.777, CS 25.779, CS 25.1543 and CS 25.1555.

(b)Each function, method of operating a control and result of actuating a control must comply with the above specifications. Each control must be shown to be:

(1)clear,

(2)unambiguous,

(3)appropriate in resolution and precision,

(4)accessible,

(5)usable,

(6)able to make the flight crew members aware of the effects of their actions, including through the provision of adequate feedback.

(c)For each of the above specifications, consideration should be given to the following control characteristics for each control individually and in relation to other controls:

(1)the physical location of the control,

(2)the physical characteristics of the control (e.g. its shape, dimensions, surface texture, range of motion and colour),

(3)the equipment or system(s) that the control directly affects,

(4)how the control is labelled,

(5)the available settings of the control,

(6)the effect of each possible actuation or setting, as a function of the initial control setting or other conditions,

(7)whether there are other controls that can produce the same effect (or can affect the same target parameter) and the conditions under which this will happen,

(8)the location and nature of the feedback that shows that the control was actuated.

The following points provide additional guidance for the design of controls that comply with CS 25.1302.

(d)Clear and unambiguous presentation of control-related information

(1)Distinguishable and predictable controls (CS 25.1301(a), CS 25.1302)

(i)Each flight crew member should be able to identify and select the current function of the control with the speed and accuracy appropriate to the task. The function of a control should be readily apparent so that little or no familiarisation is required.

(ii)The applicant should evaluate the consequences of actuating each control and show that they are predictable and obvious to each flight crew member. This includes the control of multiple displays with a single device, and shared display areas that the flight crew may access with individual controls. The use of a single control should also be assessed.

(iii)Controls should be made distinguishable and/or predictable by differences in form, colour, location, motion, effect and/or labelling. For example, the use of colour alone as an identifying feature is usually not sufficient.

(2)Labelling (CS 25.1301(a)(2), CS 25.1302(a) and (b), CS 25.1543(b), CS 25.1555(a))

(i)For the general marking of controls, refer to CS 25.1555(a).

Labels should be readable from the flight crew’s normal seating positions in all lighting and environmental conditions. Labelling should include all the intended functions unless the function of the control is obvious. Labels of graphical controls accessed by a cursor-control device, such as a trackball, should be included on the graphical display. If menus lead to additional choices (submenus), the menu label should provide a reasonable description of the next submenu.

(ii)The applicant can label the controls with text or icons. The text and the icons should be shown to be distinct and meaningful for the function that they label. The applicant should use standard or unambiguous abbreviations, nomenclature or icons, consistent within a function and across the flight deck. The International Civil Aviation Organization (ICAO) Doc 8400 ‘Procedures for Air Navigation Services (PANS) — ICAO Abbreviations and Codes’ or SAE ARP4105C ‘Abbreviations, Acronyms, and Terms for Use on the Flight Deck’ provide standard abbreviations, and are an acceptable basis for selecting labels.

(iii)If an icon is used instead of a text label, the applicant should show that the flight crew requires only a brief exposure to the icon to determine the function of the control and how it operates. Based on design experience, the following guidelines for icons have been shown to lead to usable designs:

(A)the icon should be analogous to the object it represents;

(B)the icon should be generally used in aviation and well known to flight crews, or has been validated during a HF assessment;

(C)the icon should be based on established standards, if they exist, and on conventional meanings.

(3)Interactions of multiple controls (CS 25.1302(b)(3))

If multiple controls for one function are provided to the flight crew, the applicant should show that there is sufficient information to make the flight crew aware of which control is currently functioning. As an example, the flight crew needs to know which flight crew member’s input has priority when two cursor-control devices can access the same display. Designers should use caution in relation to dual controls that can affect the same parameter simultaneously.

(e)The accessibility of controls (CS 25.777(a), CS 25.777(c), CS 25.1302)

(1)Any control required for flight crew operation (in normal, abnormal/malfunction and emergency conditions) should be shown to be visible to and reachable and operable by a flight crew member with the stature specified in CS 25.777(c), and from the seated position with a seat belt and shoulder harness fastened. If the shoulder harness is lockable, the applicant should show that the pilots can reach and actuate high-priority controls needed for the safe operation of the aeroplane with the shoulder harnesses locked.

(2)Layering of information, as with menus or multiple displays, should not hinder the flight crew from identifying the location of the desired control. Evaluating the location and accessibility of a control requires the consideration of more than just the physical aspects of the control. Other location and accessibility considerations include where the control functions may be located within various menu layers, and how the flight crew navigates those layers to access the functions. Accessibility should be shown in conditions of system failures and of master minimum equipment list dispatch.

(3)The position and direction of motion of a control should be in accordance with CS 25.777.

(f)Use of controls

(1)Environmental factors affecting the controls (CS 25.1301(a) and CS 25.1302)

(i)If the use of gloves is anticipated, the flight deck design should allow their use with adequate precision as per CS 25.1302(b)(2) and (c)(2).

(ii)The sensitivity of the controls should provide sufficient precision (without being overly sensitive) to perform tasks even in adverse environments as defined for the aeroplane’s operational envelope as per CS 25.1302(c)(2) and (d). The analysis of the environmental factors as a means of compliance is necessary, but not sufficient, for new control types or technologies, or for novel use of controls that are themselves not new or novel.

(iii)The applicant should show that the controls required to regain control of the aeroplane or system and the controls required to continue operating the aeroplane in a safe manner are usable in situations of extreme lighting conditions and severe vibration levels and should not prevent the flight crew members from performing all their tasks with an acceptable level of performance and workload.

(2)Control display compatibility (CS 25.777 and CS 25.779)

CS 25.779 describes the direction of movement of the flight deck controls.

(i)To ensure that a control is unambiguous as per CS 25.1302(b)(1), the relationship and interaction between a control and its associated display or indications should be readily apparent, understandable and logical. For example, the applicant should specifically assess any rotary knob that has no obvious ‘increase’ or ‘decrease’ function with regard to the flight crew’s expectations and its consistency with the other controls on the flight deck. Chapter 5 of SAE ARP4102 provides acceptable means of compliance for controls used on the flight deck.

(ii)CS 25.777(a) requires each flight deck control to be located in such a way that it provides convenient operation and prevents confusion and inadvertent operation. The controls associated with a display should be located in such a way that they do not interfere with the performance of the flight crew’s tasks. Controls whose function is specific to a particular display surface should be mounted near the display or the function being controlled. Locating controls immediately below a display is generally preferable, as mounting controls immediately above a display has, in many cases, caused the flight crew member’s hand to obscure their view of the display when operating the controls. However, controls on the bezel of multifunction displays have been found to be acceptable.

(iii)Spatial separation between a control and its display may be necessary. This is the case when the control of a system is located with other controls for that same system, or when the control is one of several controls on a panel dedicated to controls for that multifunction display. When there is a large spatial separation between a control and its associated display, the applicant should show that the use of the control for the associated task(s) is acceptable and in accordance with CS 25.777(a) and CS 25.1302.

(iv)In general, the design and placement of controls should avoid the possibility that the visibility of information could be blocked. If the range of movement of a control temporarily blocks the flight crew’s view of information, the applicant should show that this information is either not necessary at that time or available in another accessible location (CS 25.1302(b)(2) requires information intended for use by the flight crew to be accessible and useable by the flight crew in a manner appropriate to the urgency, frequency and duration of the flight crew’s tasks).

(v)Annunciations/labels on electronic displays should be identical to the labels on the related switches and buttons located elsewhere on the flight deck. If display labels are not identical to those on the related controls, the applicant should show that the flight crew can quickly, easily and accurately identify the associated controls so that they can safely perform all the tasks associated with the intended function of the systems and equipment (CS 25.1302).

(3)Control display design

Controls of a variable nature that use a rotary motion should move clockwise from the OFF position, through an increasing range, to the full ON position.

(g)Adequacy of feedback (CS 25.771(a), CS 25.1301(a), CS 25.1302)

(1)Feedback from the operation of the controls is necessary to ensure that the flight crew members are aware of the effects of their actions. The meaning of the feedback should be clear and unambiguous. For example, the nature of the feedback should allow the flight crew to differentiate a commanded event from a system state. Additionally, feedback should be provided when a flight crew’s input is not accepted or not followed by the system (CS 25.1302(b)(1)). This feedback can be visual, auditory or tactile.

(2)To meet the objectives of CS 25.1302, the applicant should show that feedback in all forms is obvious and unambiguous to the flight crew when performing their tasks associated with the intended function of the system or equipment. Feedback, in an appropriate form, should be provided to inform the flight crew of any of the following:

(i)When a control has been activated (commanded state/value);

(ii)When the function is in process (given an extended processing time);

(iii)When the action associated with the control has been initiated (actual state/value if different from the commanded state);

(iv)When a control is used to move an actuator through its range of travel, the system or equipment should provide, if needed (e.g. fly-by-wire system), within the time required for the relevant task, operationally significant feedback on the actuator’s position within its range. Examples of information that could appear relative to an actuator’s range of travel include the target speed and the state of the valves of various systems.

(3)The type, duration and appropriateness of the feedback will depend upon the flight crew’s task and the specific information required for successful operation. As an example, the switch position alone is insufficient feedback if awareness of the actual system response, or the state of the system as a result of an action, is required in accordance with CS 25.1302(b)(3).

(4)Controls that may be used while the user is looking outside or at unrelated displays should provide tactile feedback. Keypads should provide tactile feedback for any key depression. In cases in which this is omitted, it should be replaced with appropriate visual or other feedback indicating that the system has received the inputs and is responding as expected.

(5)The system or equipment should provide appropriate visual feedback, not only for knob, switch and push-button positions, but also for graphical control methods such as pull-down menus and pop-up windows. The user interacting with a graphical control should receive a positive indication that a hierarchical menu item has been selected, a graphical button has been activated or another input has been accepted.

4.3. Presentation of information

(a)Introduction

(1)The presentation of information to the flight crew can be visual (for instance, on a display), auditory (a ‘talking’ checklist) or tactile (e.g. control feel). The presentation of information on the integrated flight deck, regardless of the medium used, should meet all of the requirements in paragraph 4.2 above, when relevant. For visual displays, this acceptable means of compliance addresses mainly display format issues and not display hardware characteristics. The following point provides design considerations to be considered when showing compliance with CS 25.1301(a), CS 25.1302 and CS 25.1543(b).

(2)The applicant should show that the proposed design, as specified in CS 25.1301, CS 25.771(a) and CS 25.771(b), provides information that is:

clear;

unambiguous;

appropriate in resolution and precision;

accessible;

usable;

able to provide adequate feedback for flight crew awareness.

(b)Clear and unambiguous presentation of information

(1)Qualitative and quantitative display formats (CS 25.1301(a) and CS 25.1302)

The applicant should show, as per CS 25.1302(b), that display formats include the type of information the flight crew needs for the task, specifically with regard to the required speed and precision of reading. For example, the information could be in the form of a text message, a numerical value or a graphical representation of state or rate information. State information identifies the specific value of a parameter at a particular time. Rate information indicates the rate of change of that parameter.

If the flight crew’s sole means of detecting abnormal values is by monitoring the values presented on the display, the system or equipment should offer qualitative display formats. Analogue displays of data are best for conveying rate and trend information. If this is not practicable, the applicant should show that the flight crew can perform the tasks for which the information is used. Digital presentations of information are better for tasks requiring precise values. CS 25.1322 should be referred to when an abnormal value is associated with a flight crew alert.

(2)Display readability (CS 25.1301(a)(1) and CS 25.1543(b))

Flight crew members, seated at their stations and using normal head movement, should be able to see and read display format features such as fonts, symbols, icons and markings. In some cases, cross-flight deck readability may be required to meet the intended function that both pilots must be able to access and read the display. Examples of situations where this might be needed are cases of display failures or when cross-checking flight instruments. Readability must be ensured in sunlight viewing conditions (as per CS 25.773(a)) and should also be maintained under other adverse conditions such as vibration. Figures and letters should subtend not less than the visual angles defined in SAE ARP4102-7 at the design eye reference point position of the flight crew member who normally uses the information.

(3)Colour (CS 25.1302)

The use of many different colours to convey meaning on displays should be avoided. However, if thoughtfully used, colour can be very effective in minimising the workload and response time associated with display interpretation. Colour can be used to group functions or data types in a logical way. A consistent colour philosophy across the flight deck is desirable.

The applicant should show that the chosen colour set is not likely to lead to confusion or misinterpretation due to differences in colour coordinates between the displays.

Improper colour coding increases the response times for display item recognition and selection, and increases the likelihood of errors, particularly in situations where the speed of performing a task is more important than the accuracy, so the compatibility of colours with the background should be verified in all the foreseeable lighting conditions. The use of red and amber for purposes other than alerting functions or potentially unsafe conditions is discouraged. Such use diminishes the attention-getting characteristics of true warnings and cautions.

The use of colour as the sole means of characterising an item of information is also discouraged. It may be acceptable, however, to indicate the criticality of the information in relation to the task. Colour, as a graphical attribute of an essential item of information, should be used in addition to other coding characteristics such as texture or differences in luminance. AMC 25-11 contains recommended colour sets for specific display features.

The applicant should show that the layering of information on a display does not add to confusion or clutter as a result of the colour standards and symbols used. Designs that require a flight crew to manually declutter such displays should also be avoided.

(4)Symbology, text and auditory messages (CS 25.1302)

Designs can base many elements of electronic display formats on established standards and conventional meanings. For example, ICAO Procedures for Air Navigation Services (PANS) – ICAO Abbreviations and Codes provides abbreviations, and is one standard that could be applied to the textual material used on the flight deck.

SAE ARP4102-7, Appendices A–C, and SAE ARP5289A are acceptable standards for avionics display symbols.

The position of a message or symbol within a display also conveys meaning to the flight crew. Without the consistent or repeatable location of a symbol in a specific area of the electronic display, interpretation errors and response times may increase.

The applicant should give careful attention to symbol priority (the priority of displaying one symbol overlaying another symbol by editing out the secondary symbol) to ensure that higher-priority symbols remain viewable.

New symbols (a new design or a new symbol for a function that historically had a different associated symbol) should be assessed for their distinguishability and for flight crew understanding and retention.

The applicant should show that displayed text and auditory messages are distinct and meaningful for the information presented. CS 25.1302 requires the information intended for use by the flight crew to (a) be provided in a clear and unambiguous format in a resolution and precision appropriate to the task and (b) convey the intended meaning. The equipment should display standard and/or unambiguous abbreviations and nomenclature, consistent within a function and across the flight deck.

(c)Accessibility and usability of information

(1)Accessibility of information (CS 25.1302)

(i)Information intended for the flight crew must be accessible and usable by the flight crew in a manner appropriate to the urgency, frequency and duration of their tasks, as per CS 25.1302(b)(2). The flight crew may, at certain times, need some information immediately, while other information may not be necessary during all phases of flight. The applicant should show that the flight crew can access and manage (configure) all the necessary information on the dedicated and multifunction displays for the given phase of flight. The applicant should show that any information required for continued safe flight and landing is accessible in the relevant degraded display modes following failures as defined by CS 25.1309. The applicant should specifically assess what information is necessary in those conditions, and how such information will be simultaneously displayed. The applicant should also show that supplemental information does not displace or otherwise interfere with the required information.

(ii)Analysis as the sole means of compliance is not sufficient for new or novel display management schemes. The applicant should use simulation of typical operational scenarios to validate the flight crew’s ability to manage the available information.

(2)Clutter (CS 25.1302)

(i)Display options that automatically hide information for the purpose of reducing visual clutter may hide necessary information from the flight crew. If the system or equipment uses automatic deselection of data to enhance the flight crew’s performance in certain emergency conditions, the applicant must show, as per CS 25.1302(a), that the system or equipment provides the information the flight crew needs. The use of part-time displays depends not only on the removal of clutter from the information but also on the availability and criticality of the display. Therefore, when designing such design items, the applicant should follow the guidance in AMC 25-11.

(ii)Because of the transient nature of the auditory information presentation, designers should be careful to avoid the potential for competing auditory presentations that may conflict with each other and hinder their interpretation. Prioritisation and timing may be useful to avoid this potential problem.

(iii)Information should be prioritised according to the criticality of the task. Lower-priority information should not mask higher-priority information, and higher-priority information should be available, readily detectable, easily distinguishable and usable.

(3)System response time

Long or variable response times between a control input and the system response can adversely affect the usability of the system. The applicant should show that the response to a control input, such as setting values, displaying parameters or moving a cursor symbol on a graphical display, is fast enough to allow the flight crew to complete the task at an acceptable level of performance. For actions that require a noticeable system processing time, the equipment should indicate that the system response is pending.

4.4. System behaviour

(a)Introduction

The demands of the flight crew’s tasks vary depending on the characteristics of the systems and equipment design. Systems differ in their responses to relevant flight crew inputs. The response can be direct and unique, as in mechanical systems, or it can vary as a function of an intervening subsystem (such as hydraulics or electrics). Some systems even automatically vary their responses to capture or maintain a desired aeroplane or system state.

(1)CS 25.1302(c) states that the installed systems and equipment must be designed so that the behaviour of the systems that is operationally relevant to the flight crew’s tasks is:

‘(1) predictable and unambiguous; and

(2)designed to enable the flight crew members to intervene in a manner that is appropriate to accomplish their tasks.’

(2)The requirement for operationally relevant system behaviour to be predictable and unambiguous will enable the flight crew members to know what the system is doing and what they did to enable/disable the behaviour. This distinguishes the system behaviour from the functional logic within the system design, much of which the flight crew does not know or does not need to know.

(3)If flight crew intervention is part of the intended function, or part of the abnormal/malfunction or emergency procedures for the system, the flight crew may need to take some action or change an input to the system. The system must be designed accordingly. The requirement for flight crew intervention capabilities recognises this reality.

(4)Improved technologies, which have increased safety and performance, have also introduced the need to ensure proper cooperation between the flight crew and the integrated, complex information and control systems. If the system behaviour is not understood or expected by the flight crew, confusion may result.

(5)Some automated systems involve tasks that require flight crew attention for effective and safe performance. Examples include flight management systems (FMSs) or flight guidance systems. Alternatively, systems designed to operate autonomously, in the sense that they require very limited or no human interaction, are referred to as ‘automatic systems’. Such systems are switched ‘on’ or ‘off’ or run automatically, and, when they operate in normal conditions, the guidance material of this paragraph is not applicable to them. Examples include full authority digital engine controls. Detailed specific guidance for automatic systems can be found in the relevant parts of CS-25.

(b)Allocation of functions between flight crew and automation The applicant should show that the allocation of functions is conducted in such a way that:

(1)the flight crew members are able to perform all the tasks allocated to them, considering normal, abnormal/malfunction and emergency operating conditions, within the bounds of an acceptable workload and without requiring undue concentration or causing undue fatigue (refer to CS 25.1523 and CS-25 Appendix D for workload evaluation);

(2)the systems enable the flight crew to understand the situation, and enable timely failure detection and flight crew intervention when appropriate.

(c)Functional behaviour of a system

(1)The functional behaviour of an automated system results from the interaction between the flight crew and the automated system, and is determined by:

(i)the functions of the system and the logic that governs its operation;

(ii)the user interface, which consists of the controls that communicate the flight crew’s inputs to the system, and the information that provides feedback to the flight crew on the behaviour of the system.

(2)The design should consider both the functions of the system and the user interface together. This will avoid a design in which the functional logic governing the behaviour of the system can have an unacceptable effect on the performance of the flight crew. Examples of system functional logic and behavioural issues that may be associated with errors and other difficulties for the flight crew are:

(i)the complexity of the flight crew’s interface for both control actuation and data entry, and the complexity of the corresponding system indications provided to the flight crew;

(ii)the flight crew having inadequate understanding and incorrect expectations of the behaviour of the system following mode selections and transitions;

(iii)the flight crew having inadequate understanding and incorrect expectations of what the system is preparing to do next and how it is behaving.

(3)Predictable and unambiguous system behaviour (CS 25.1302(c)(1))

The applicant should detail how it will show that the behaviour of the system or the system mode in the proposed design is predictable and unambiguous to the flight crew.

(i)System or system mode behaviour that is ambiguous or unpredictable to the flight crew has been found to cause or contribute to flight crew errors. It can also potentially degrade the flight crew members’ ability to perform their tasks in normal, abnormal/malfunction and emergency conditions. Certain design characteristics have been found to minimise flight crew errors and other flight crew performance problems.

(ii)The following design considerations are applicable to operationally relevant systems and to the modes of operation of the systems. (A) The system behaviour should be simple (e.g. the number of modes, or mode transitions).

(B)Mode annunciation should be clear and unambiguous. For example, a mode engagement or arming selection by the flight crew should result in annunciation, indication or display feedback that is adequate to provide awareness of the effect of their action. Additionally, any change in the mode as a result of the aeroplane changing from one operational mode (for instance, on an approach) to another should be clearly and unambiguously annunciated and communicated to the flight crew.

(C)Methods of mode arming, engagement and deselection should be accessible and usable. For example, the control action necessary to arm, engage, disarm or disengage a mode should not depend on the mode that is currently armed or engaged, on the setting of one or more other controls or on the state or status of that or another system.

(D)Uncommanded mode changes and reversions should have sufficient annunciation, indication or display information to provide awareness of any uncommanded changes of the engaged or armed mode of a system. ‘Uncommanded’ could refer to either (a) a mode change commanded not by the pilot but by the automation as part of its normal operation or (b) a mode change resulting from a malfunction.

(E)The current mode should remain identified and displayed at all times.

(4)Flight crew intervention (CS 25.1302(c)(2))

(i)The applicant should propose the means that they will use to show that the behaviour of the systems in the proposed design allows the flight crew to intervene in the operation of the systems without compromising safety. This should include descriptions of how they will determine that the functions and conditions in which intervention should be possible have been addressed.

(ii)The methods proposed by the applicant should describe how they would determine that each means of intervention is appropriate to the task.

(5)Controls for automated systems

Automated systems can perform various tasks selected by and under the supervision of the flight crew. Controls should be provided for managing the functionality of such a system or set of systems. The design of such ‘automation-specific’ controls should enable the flight crew to:

(i)safely prepare the system for the immediate task to be executed or the subsequent task to be executed; preparation of a new task (e.g. a new flight trajectory) should not interfere, or be confused, with the task being executed by the automated system;

(ii)activate the appropriate system function and clearly understand what is being controlled; for example, the flight crew must clearly understand that they can set either the vertical speed or the flight path angle when they operate a vertical speed indicator;

(iii)manually intervene in any system function, as required by the operational conditions, or revert to manual control; for example, manual intervention might be necessary if a system loses function, operates abnormally or fails.

(6)Displays for automated systems

Automated systems can perform various tasks with minimal flight crew intervention, but under the supervision of the flight crew. To ensure effective supervision and maintain flight crew awareness of the system state and system ‘intention’ (future states), displays should provide recognisable feedback on:

(i)the entries made by the flight crew into the system so that the flight crew can detect and correct errors;

(ii)the present state of the automated system or its mode of operation (i.e. what is it doing?);

(iii)the actions taken by the system to achieve or maintain a desired state (i.e. what is it trying to do?);

(iv)future states scheduled by the automation (i.e. what is it going to do next?);

(v)transitions between system states.

(7)Aspects of automated system designs that the applicant should consider

(i)Indications of the commanded and actual values should enable the flight crew to determine whether the automated systems will perform according to the flight crew’s expectations.

(ii)If the automated system nears its operational authority or is operating abnormally for the given conditions, or is unable to perform at the selected level, it should inform the flight crew, as appropriate for the task.

(iii)The automated system should support crew coordination and cooperation by ensuring that there is shared awareness of the system status and the flight crew’s inputs to the system.

(iv)The automated system should enable the crew to review and confirm the accuracy of the commands before they are activated. This is particularly important for automated systems because they can require complex input tasks.

4.5. Flight crew error management

(a)Meeting the objective of CS 25.1302(d)

(1)CS 25.1302(d) addresses the fact that flight crews will make errors, even when they are well trained, experienced and rested, and use well-designed systems.

CS 25.1302(d) addresses errors that are design related only. It is not intended to require consideration of errors resulting from acts of violence, sabotage or threats of violence.

(2)To meet the objective of CS 25.1302(d), the applicant should consider that the installed systems and equipment should:

(i)enable the flight crew to detect (see paragraph 4.5(b)) and recover from (see paragraph 4.5(c)) errors;

(ii)ensure that the effects of crew errors on the aeroplane functions or capabilities are evident to the flight crew and that continued safe flight and landing are possible (see paragraph 4.5(d));

(iii)prevent crew errors by using switch guards, interlocks, confirmation actions or similar means;

(iv)preclude the effects of errors through system logic and/or redundant, robust or fault-tolerant system designs (see paragraph 4.5(e)).

(3)The strategies described in (2) above:

(i)recognise and assume that flight crew errors cannot be entirely prevented, and that no validated methods exist to reliably predict either their probability or all the sequences of events with which they may be associated;

(ii)call for means of compliance that are methodical and complementary to, and separate and distinct from, aeroplane system analysis methods such as system safety assessments.

(4)When demonstrating compliance, the applicant should consider the flight crew’s tasks in all operating conditions, considering that many of the same design characteristics are relevant in each case. For example, under abnormal/malfunction or emergency conditions, the flying tasks (navigation, communication and monitoring) are generally still present, although they may be more difficult. So, the tasks associated with the abnormal/malfunction or emergency conditions should be considered as additive. The applicant should not expect the considered errors to be different from those in normal conditions, but any assessment should account for the change in the expected tasks.

(5)To demonstrate compliance with CS 25.1302(d), the applicant may employ any of the general types of means of compliance discussed in paragraph 5, individually or in combination. These means of compliance must be consistent with an approved certification plan as discussed in paragraph 3, and account for the objectives above and the considerations described below. When using some of these means of compliance, it may be helpful for some applicants to refer to other references related to understanding the occurrence of errors. A brief summary of those means of compliance, which are described in paragraph 5.3, and how they can be applied to address flight crew error considerations is provided below.

(i)Statement of similarity. A statement of similarity may be used to substantiate that the design has sufficient certification precedent to conclude that the ability of the flight crew to manage errors has not significantly changed. The applicant may also use in-service data to identify errors known to commonly occur for similar flight crew interfaces or system behaviour. As part of the compliance demonstration, the applicant should identify the steps taken in the new design to avoid or mitigate similar errors. However, the absence of in-service events related to a particular design item cannot be considered to be an acceptable means of demonstrating compliance with CS 25.1302.

(ii)Design descriptions. The applicant may structure design descriptions and rationales to show how various types of errors are considered in the design and addressed, mitigated or managed. The applicant can also use a description of how the design adheres to an established and valid design philosophy to substantiate that the design enables the flight crew to manage errors.

(iii)Calculations or engineering analyses. As one possible means of demonstrating compliance with CS 25.1302(d), an applicant may document the means of error management through the analysis of controls, indications, system behaviour and related flight crew tasks. This would need to be done in conjunction with an understanding of the potential error opportunities and the means available for the flight crew to manage those errors. In most cases, it is not considered feasible to predict the probability of flight crew errors with sufficient validity or precision to support a means of compliance. If an applicant chooses to use a quantitative approach, the validity of the approach should be established.

(iv)Assessments. For compliance purposes, assessments are intended to identify error possibilities that may be considered for mitigation in design or training. In any case, scenario objectives and assumptions should be clearly stated before running the evaluations or tests. In that way, any discrepancy in those expectations can be discussed and explained in the analysis of the results.

(6)As discussed further in paragraph 5, these evaluations or tests should use appropriate scenarios that reflect the intended functions and tasks, including the use of the systems and equipment in normal, abnormal/malfunction and emergency conditions. Scenarios should be designed to consider flight crew errors. If inappropriate scenarios are used or important conditions are not considered, incorrect conclusions can result. For example, if no errors occur during an assessment, this may only mean that the scenarios are too simple, incomplete or not fully representative. On the other hand, if some errors do occur, it may mean any of the following:

(i)the design, procedures or training should be modified;

(ii)the scenarios are unrealistically challenging;

(iii)insufficient training was delivered prior to the assessment.

(7)In such assessments, it is not considered feasible to establish criteria for the frequency of errors.

(b)Error detection

(1)The applicant should design equipment to provide information to the flight crew members so that they can become aware of an error. The applicant should show that this information is available to the flight crew, is adequately detectable and shows a clear relationship between the flight crew action and the error so that a recovery can be made in a timely manner.

(2)The information for error detection may take one of the following three basic forms.

(i)Indications provided to the flight crew during normal monitoring tasks

(A)As an example, if an incorrect knob was used, resulting in an unintended heading change, the change would be detected through the display of target values. The presentation of a temporary flight plan for the flight crew to review before accepting it would be another way of ensuring flight crew awareness of errors.

(B)Indications on instruments in the primary field of view that are used during normal operations may be adequate if the indications themselves contain information used on a regular basis and are provided in a readily accessible form. These may include mode annunciations and normal aeroplane state information such as the altitude or heading. Other locations for the information may be appropriate depending on the flight crew’s tasks and the importance of the information. An example is information located on the control display unit when the task involves dealing with a flight plan. Paragraph 4.3 ‘Presentation of information’ contains additional guidance to determine whether the information is adequately detectable.

(ii)Indications to the flight crew that provide information on an error or a resulting aeroplane system condition

(A)An alert that activates following a flight crew error may be sufficient to show that an error is detectable and that sufficient information is provided. The alert should directly relate to the error or be easily assessed by the flight crew as related to the error. Alerts should not be confusing and lead the flight crew to believe that there may be non-error causes of the annunciated condition.

(B)If a flight crew error is only one of several possible causes of an alert about a system, then the information that the alert provides is insufficient. If, on the other hand, additional information is available that would allow the flight crew to identify and correct the error, then the alert, in combination with the additional information, would be sufficient to comply with CS 25.1302(d) for that error. (C) An error that is detectable by the system or equipment should prompt an alert that a flight crew error has occurred, and sufficient information should be provided, such as in the case of a take-off configuration warning. On the other hand, an alert about the system state resulting from accidentally shutting down a hydraulic pump, for example, may not provide sufficient information to enable the flight crew to distinguish an error from a system fault. In this case, flight manual procedures may provide the error detection means as the flight crew performs the ‘loss of hydraulic system’ procedures.

(D)If the system or equipment can detect a flight crew error, the system or equipment could be designed to prevent flight crew errors. For example, if the system can detect an incorrect frequency entry by the flight crew, then the system should be able to disallow that entry and provide appropriate feedback to the flight crew. Examples are automated error checking and filters that prevent unallowable or illogical entries.

(iii)‘Global’ alerts

These cover a multitude of possible errors by annunciating external hazards, the envelope of the aeroplane or operational conditions. Examples include monitoring systems such as terrain awareness and warning systems (TAWSs) and traffic alert and collision avoidance systems (TCAS). An example is a TAWS alert resulting from turning in the wrong direction in a holding pattern in mountainous terrain.

(3)The applicant should consider the following when establishing whether the level or type of information available to the flight crew is adequately detectable and clearly related to the error.

(i)The effects of some errors are easily and reliably determined by the system because of its design. For those effects that cannot be sensed by the system, the design and arrangement of the information monitored and scanned by the flight crew can facilitate error detection.

An example is the alignment of engine speed indicator needles in the same direction during normal operations. In the event of an engine asymmetrical thrust linked to flight crew error, which manifested itself in a change in the rpm of one engine, the spatial misalignment of the needles could assist the flight crew in diagnosing the issue and identifying asymmetrical thrust lever position.

(ii)Aeroplane alerting and indication systems may not detect whether an action is erroneous because the systems and equipment cannot know the intent of the flight crew in many operational circumstances. In such case, error detection depends on the flight crew’s interpretation of the available information. Training, crew resource management and monitoring systems (such as TAWS and TCAS) are examples of ways to provide a redundant level of safety.

(4)The applicant may establish that information is available and clearly related to the error by using a design description when a precedent exists or when a reasonable case may be made that the content of the information is clearly related to the error that caused it.

In some cases, a flight crew assessment (see paragraph 5.3) may be needed to assess whether the information provided is adequately available and detectable.

(c)Error recovery

(1)When an error or its effects are detected, the next logical step is to ensure that the error can be reversed or that the effect of the error can be mitigated in some way so that the aeroplane is returned to a safe state.

(2)An acceptable means to establish that an error can be recovered from is to show that:

(i)controls and indications exist that can be used either to directly reverse an erroneous action so that the aeroplane or system is returned to the original state or to mitigate the effect so that the aeroplane or system is returned to a safe state;

(ii)those controls and indications can be expected to be used by the flight crew to accomplish the corrective actions in a timely manner.

(3)For simple or familiar types of system and equipment interfaces, or systems and equipment that are not novel, even if they are complex, a statement of similarity or a description of the design of the flight crew interfaces and the procedures associated with the indications may be an acceptable means of compliance.

(4)To establish that the flight crew can be expected to use those controls and indications to accomplish corrective actions in a timely manner, an assessment of the flight crew procedures in a simulated flight deck environment can be highly effective. This assessment should include an examination of the nomenclature used in alert messages, controls and other indications. It should also include the logical flow of procedural steps and the effects that executing the procedures have on other systems.

(d)Error effects

(1)Another means of satisfying the objective of error mitigation is to ensure that the effects of the error or the relevant effects on the state of the aeroplane:

(i)are evident to the flight crew;

(ii)do not have an adverse impact on safety.

(2)Piloted assessments in the aeroplane or in simulation may be relevant if flight crew performance issues are in question for determining whether a state following an error permits continued safe flight and landing. Assessments and/or analyses may be used to show that, following an error, information is available to the flight crew in an effective form and the aeroplane has the capability required to ensure continued safe flight and landing.

(e)Precluding errors or their effects

(1)For irreversible errors that have potential safety implications, means to prevent errors are recommended. Acceptable ways to prevent errors include switch guards, interlocks or confirmation actions. For example, generator drive controls on many aeroplanes have guards over the switches to prevent their inadvertent actuation because, once disengaged, the drives cannot be re-engaged while in flight or with the engine running. An example of confirmation action is the presentation of a flight plan modification in a temporary flight plan, where the flight crew will activate the flight plan through a confirmation action.

(2)Another way of avoiding flight crew error is to design systems and equipment to remove misleading or inaccurate information (e.g. sensor failures) from displays. An example is a system or equipment that removes the flight director bars from a primary flight display or removes the ‘own-ship’ position from an airport surface map display when the data driving the symbols is incorrect.

(3)The applicant should avoid applying an excessive number of protections for a given error. The excessive use of protections could have unintended safety consequences. It might hamper the flight crew’s ability to use judgement and take action in the interest of safety in situations that were not predicted by the applicant. If protections become a nuisance in daily operation, flight crews may use well-intentioned and inventive means to circumvent them. This could have further effects that were not anticipated by the operator or the designer.

4.6. Integration

(a)Introduction

(1)Many systems, such as FMSs, are integrated physically and functionally into the flight deck and may interact with other flight deck systems and equipment. It is important to consider a design not in isolation, but rather in the context of the overall flight deck. Integration considerations include the location of an installed display or control, how it interacts with other systems and equipment and whether there is internal consistency across functions within a multifunction display, as well as consistency with the other flight deck systems and equipment.

(2)Data from analyses, evaluations and tests and other data developed to establish compliance with each of the specifications in CS 25.1302(a) to (d) should address the integration of new design items. The generation of such data should include consideration of the following integration factors:

(i)consistency (see paragraph 4.6(b)),

(ii)consistency trade-offs (see paragraph 4.6(c)),

(iii)flight deck environment (see paragraph 4.6(d)),

(iv)integration-related workload and error (see paragraph 4.6(e)).

(b)Consistency

(1)If similar information is presented in multiple locations or modes (both visual and auditory, for example), the consistent presentation of the information is desirable.

If information cannot be presented consistently on the flight deck, the applicant should show that the differences do not increase the error rates or task times, which would lead to significant adverse operational consequences or an increase in the flight crew’s workload, and do not cause confusion among the flight crew.

(2)Consistency needs to be considered within a given system and across the flight deck. Inconsistencies may result in vulnerabilities that may lead to human performance issues, such as increased workload and errors, especially during stressful situations. For example, in some FMSs, the format for entering the latitude and longitude differs between the display pages. This may induce flight crew errors, or at least increase the flight crew’s workload. Additionally, errors may result if the latitude and longitude are displayed in a format that differs from the formats used on the most commonly used paper charts. For this reason, it is desirable to use formats that are consistent with other media whenever possible. One way in which the applicant can achieve consistency within a given system or equipment, as well as within the overall flight deck, is to adhere to a comprehensive flight deck design philosophy. The following are design attributes to consider in terms of their consistency within and across systems.

(i)Symbology, data entry conventions, formatting, colour philosophy, terminology and labelling.

(ii)Function and logic. For example, when two or more systems are active and perform the same function, they should operate consistently and use an interface in the same style.

(iii)Information of the same type. Information presented should be consistent with other information of the same type used on the flight deck. It is important that functions that convey the same information be consistent. One example is symbol sets. Traffic or terrain awareness systems should display consistent symbol sets if generated by separate installed systems or equipment.

(3)Another way to demonstrate consistency is to show that certain aspects of the design are consistent with accepted, published standards such as the labels and abbreviations recommended in ICAO Procedures for Air Navigation Services (PANS) – ICAO abbreviations and codes (Document 8400) or in SAE Abbreviations, acronyms, and terms for use on the flight deck (ARP4105C). The applicant might standardise the symbols used to depict navigation aids (very high frequency omnidirectional range, for example) by following the conventions recommended in SAE Electronic Aeronautical Symbols (ARP5289A). However, inappropriate standardisation, rigidly applied, can be a barrier to innovation and product improvement. Thus, the guidance in this paragraph promotes consistency rather than rigid standardisation.

(c)Consistency trade-offs

It is recognised that it is not always possible or desirable to provide a consistent flight crew interface. Despite conformance with the flight deck design philosophy, principles of consistency, etc., it is possible to have a negative impact on the flight crew’s workload. For example, all the auditory alerts may adhere to a flight deck alerting philosophy, but the number of alerts may be unacceptable. The use of a consistent format across the flight deck may not be appropriate when individual task requirements necessitate the presentation of data in two significantly different formats. An example is a weather radar display formatted to show a sector of the environment and a moving-map display showing a 360-degree view. In such cases, it should be demonstrated that the design of the interface is compatible with the requirements of the piloting task, and that it can be used individually and in combination with other interfaces without interference with either the system or the function. The following points should also be taken into account:

(1)The applicant should provide an analysis identifying each piece of information or data presented in multiple locations, and show that the data is presented in a consistent manner or, where that is not true, justify why that is not appropriate.

(2)Where information is inconsistent, that inconsistency should be obvious or annunciated, and should not contribute to errors in the interpretation of information.

(3)There should be a rationale for instances where the design of a system diverges from the flight deck design philosophy. The applicant should consider any impact on the workload and on errors as a result of such divergences.

(4)The applicant should describe what conclusion the flight crew is expected to draw and what action should be taken when information on the display conflicts with other information on the flight deck (either with or without a failure).

(d)Flight deck environment

(1)The flight deck systems and equipment are influenced by the physical characteristics of the aeroplane into which a system or equipment is integrated, as well as by the characteristics of the operational environment. The flight deck systems and equipment are subject to the effects from environmental factors such as turbulence, noise, ambient light, smoke and vibrations (such as those that may result from ice contamination or the loss of an engine fan blade). The design of the systems and equipment should recognise these effects on usability, workload and flight crew task performance. Turbulence and ambient light, for example, may affect the readability of a display. Flight deck noise may affect the audibility of aural alerts. The applicant should also consider the impact of the flight deck environment in abnormal situations, such as during a recovery from an unusual attitude or when regaining control of the aeroplane or system.

(2)The flight deck environment includes the layout or the physical arrangement of the controls and information displays. Layouts should take into account the flight crew requirements in terms of:

(i)access and reach (to the controls);

(ii)visibility and readability of the displays and labels;

(iii)the task-oriented location and grouping of HMI elements.

An example of poor physical integration would be a required piece of information that is obscured by a control in its normal operating position.

(e)Integration-related workload and error

(1)When integrating functions, systems and/or equipment, designers should be aware of the potential effects, both positive and negative, that integration can have on the workload of the flight crew and its subsequent impact on error management. Systems and equipment must be designed and assessed, both in isolation and in combination with other flight deck systems and equipment, to ensure that the flight crew is able to detect, reverse or recover from errors. This may be more challenging when integrating systems and equipment that employ higher levels of automation or have a high degree of interaction with and dependency on other flight deck systems and equipment.

(2)The applicant should show that the integrated design does not have an adverse impact on the workload or errors in the context of the entire flight regime. Examples of such impacts are an increase in the time necessary for the flight crew to:

(i)interpret a function;

(ii)make a decision; or

(iii)take appropriate action.

(3)Controls, particularly multifunction controls and/or novel types of control, may present the potential for misidentification and increased response times. Designs should generally avoid multifunction controls with hidden functions because they increase both the workload of the flight crew and the potential for error.

(4)Two examples of integrated design items that may or may not have an impact on errors and workload are as follows.

(i)Presenting the same information in two different formats. This may increase the workload, such as when altitude information is presented concurrently in both tape and round-dial formats. However, different formats may be suitable, depending on the design and the flight crew task. For example, an analogue display of engine rpm can facilitate a quick scan, whereas a digital numeric display can facilitate precise inputs. The applicant must comply with CS 25.1523 and show that the differences in the formats do not result in unacceptable levels of workload.

(ii)Presenting conflicting information. Increases in workload and error may result from two displays depicting conflicting altitude information on the flight deck concurrently, regardless of the formats. Systems may exhibit minor differences between each flight crew station, but all such differences should be assessed specifically to ensure that the potential for interpretation error is minimised, that a method exists for the flight crew to detect any incorrect information or that the effects of these errors can be precluded.

(5)The applicant should show that the proposed function will not inappropriately draw attention away from other flight deck information and tasks in a way that degrades the performance of the flight crew and decreases the overall level of safety. There are some cases in which it may be acceptable for the system design to increase the workload. For example, adding a display into the flight deck may increase the workload by virtue of the additional time the flight crew spends looking at it, but the safety benefit that the additional information provides may make it an acceptable trade-off.

(6)Since each new system or equipment integrated into the flight deck may have a positive or negative effect on crew workload, it should be assessed – in isolation and in combination with the other systems and equipment – for compliance with CS 25.1523. This is to ensure that the overall workload is acceptable (i.e. that the performance of flight tasks is not adversely impacted) and that the flight crew’s detection and interpretation of information does not lead to unacceptable response times. Special attention should be paid to items that are workload factors. They include the ‘accessibility, ease, and simplicity of operation of all necessary flight, power, and equipment controls’ (ref. Appendix D to CS-25).

5.Means of compliance

5.1. Overview

This paragraph provides information the applicant should consider when selecting the means of compliance. It discusses seven types of means of compliance and provides specific HF considerations.

Applicants should determine the means of compliance to be used in a given project on a case-by-case basis, taking into account the specific compliance issues. In any case, the nature of the HF objective to be assessed should drive the selection of the appropriate means of compliance.

Some certification projects may necessitate more than one means of demonstrating compliance with a particular CS. For example, when flight testing in a conforming aeroplane is not possible, a combination of a design review and a part-task evaluation may be proposed. In this context, part-task evaluation focuses only on specific subfunctions of the design item.

The uses and limitations of each type of means of compliance are provided in paragraph 5.3.

5.2. List of means of compliance The most common means of compliance that are used to demonstrate compliance with HF certification specifications are discussed in this paragraph and include the following:

(a)MC0: compliance statements,

(b)MC1: design review,

(c)MC2: calculations and analyses,

(d)MC4: laboratory tests,

(e)MC5: ground tests,

(f)MC6: flight tests,

(g)MC8: simulation.

Additional guidance can be found in paragraph 3.3.2 regarding the use of scenario-based methodology as part of the above-listed means of compliance.

5.3. Selecting the means of compliance

5.3.1. Credit from previous compliance certification processes

When determining the level of scrutiny applicable to each design item, the applicant should identify a reference product.

The reference product can also play a role in the compliance demonstration process if data from previous certification exercises is used. However, the following two dimensions should be taken into account when assessing the extent to which certification credits can be granted:

the reference product from which the applicant intends to claim compliance, the certification basis that was used to certify that reference product.

The applicant is then expected to gain more certification credits from the systems and equipment installed on one of its aeroplanes already certified under CS 25.1302.

Fewer certification credits can be requested when the equipment installed on an aeroplane was certified by the applicant under a HF regulatory material different from CS 25.1302. The acceptability of this approach will be evaluated on a case-by-case basis by assessing the compatibility of the reference regulatory material and the methods used at the time of the initial certification.

As a general principle, no certification credit can be claimed when the design item installed on an aeroplane is new to the applicant design organisation or when it was not certified by EASA.

5.3.2. Representativeness of the test article

MC4, MC5, MC6 and MC8 require the use of a test article (benches, mock-ups, the actual aeroplane or a simulator).

As explained in paragraph 3.3.1, in order to achieve its objectives, the HF assessment should be started in the early stages of the project and follow an iterative process. This iterative process may require the applicant to perform assessments in an early stage of the project when the design is still likely to change. On the other hand, test articles that are not fully representative of the final design can be available later on during the certification process and may be the only available ones on which to actually perform some assessments (e.g. a bench or a simulator may be the only means to assess the flight crew behaviour in the presence of failures that cannot be simulated in flight).

Therefore, the verification of the test article’s representativeness, with its deviations from the intended final standard, is a step of paramount importance for the HF assessment. These deviations should be evaluated taking into account the objectives of the assessment.

For example:

if a ground test is carried out to assess the controls’ reachability, specific attention should be paid to whether the flight deck geometry is representative of the design under certification, while the conformity of the avionics is not required;

if a simulator is used, the required functional and physical representativeness of the simulation (or degree of realism) will typically depend on the configurations, design items and crew tasks to be assessed.

As a general principle, as long as the deviations from the intended final standard are known and monitored and do not compromise the validity of the data to be collected, the lack of full representativeness should not prevent the use of a test article. In such cases, partial certification credits may still be granted, provided that the applicant can show that the deviations do not affect the test results.

5.3.3. Presentation of the means of compliance

(a)MC0 (compliance statement based on similarity)

<table>

<tr><td>Description</td></tr>

<tr><td>A statement of similarity is a declaration of (full or partial) compliance based on a description of the system or component to be approved compared with a description of a previously approved system or component, detailing the physical, logical and operational similarities relevant for the certification specification the applicant wishes to demonstrate compliance with.</td></tr> <tr><td>Use</td></tr>

<tr><td>A statement of similarity can be sufficient or used in combination with other means of compliance.</td></tr> <tr><td>Limitations</td></tr>

<tr><td>A statement of similarity, for the purpose of compliance demonstration, should be used with care. The flight deck should be assessed as a whole, not merely as a set of individual functions or systems and components. Two design items previously approved on separate programmes may be incompatible when combined in a single flight deck. In addition, changing one feature on the flight deck may necessitate corresponding changes in other features, to maintain consistency and prevent confusion.</td></tr> <tr><td>Example</td></tr>

<tr><td>If the window design in a new aeroplane is identical to that in an existing aeroplane, a statement of similarity may be an acceptable means of compliance with CS 25.773.</td></tr> </table>

(b)MC1 (design review)

The applicant may elect to substantiate that the design meets the objectives of a specific paragraph by describing the design. The applicant may use drawings, configuration descriptions and/or design philosophies to demonstrate compliance.

(1)Drawings

<table>

<tr><td>Description</td></tr>

<tr><td>Drawings depicting the physical arrangement of hardware or display graphics.</td></tr> <tr><td>Use</td></tr>

<tr><td>The applicant can use drawings for very simple certification programmes when the change to the flight deck is very simple and straightforward. Drawings can also be used to support the demonstration of compliance for more complex interfaces.</td></tr> <tr><td>Limitations</td></tr>

<tr><td>The use of drawings is limited to physical arrangements and graphical concerns.</td></tr> </table>

(2)Configuration description

<table>

<tr><td>Description</td></tr>

<tr><td>A configuration description is a description of the layout, general arrangement, direction of movement, etc., of a design item. It can also be a reference to documentation that provides such a description. It could be used to show the relative locations of flight instruments, groupings of control functions, the allocation of colour codes to displays and alerts, etc.</td></tr> <tr><td>Use</td></tr>

<tr><td>Configuration descriptions are generally less formalised than engineering drawings. They are developed to point out features of the design that support a finding of compliance. In some cases, such configuration descriptions may provide sufficient information for a demonstration of compliance. More often, however, they only provide important background information, while the demonstration of compliance requires the use of additional means, such as analysis or tests. The applicant will have already communicated how a system works with the configuration description, and any discussions or assumptions may have already been coordinated.</td></tr> <tr><td>Limitations</td></tr>

<tr><td>Configuration descriptions may provide sufficient information for a demonstration of compliance, but this should be limited to a specific certification specification.</td></tr> </table>

(3)Design philosophy

<table>

<tr><td>Description</td></tr>

<tr><td>A design philosophy approach can be used to demonstrate that an overall safety-centred philosophy, as detailed in the design specifications for the product/system/component or flight deck, has been applied.</td></tr> <tr><td>Use</td></tr>

<tr><td>It documents that the design qualifies to meet the objectives of a specific certification specification.</td></tr> <tr><td>Limitations</td></tr>

<tr><td>In most cases, this means of compliance will be insufficient as the sole means to demonstrate compliance.</td></tr> <tr><td>Example</td></tr>

<tr><td>The design philosophy may be used as a means of compliance when a new alert is added to the flight deck provided the new alert is consistent with the acceptable, existing alerting philosophy.</td></tr> </table>

(c)MC2 (calculations/analyses)

<table>

<tr><td>Description</td></tr>

<tr><td>Calculations or engineering analyses (i.e. ‘paper and pencil’ assessments) that do not require direct participant interaction with a physical representation of the system or equipment.</td></tr> <tr><td>Use</td></tr>

<tr><td>They provide a systematic analysis of specific or overall aspects of the human interface part of the product/system/component or flight deck.</td></tr> <tr><td>Limitations</td></tr>

<tr><td>The applicant should carefully consider the validity of the assessment technique if the analyses are not based on recognised industry standard methods. The applicant may be asked to validate any computational tools used in such analyses. If the analysis involves comparing measured characteristics with recommendations derived from pre-existing research (internal or public domain), the applicant may be asked to justify the applicability of the data to the project. While analyses are useful to start investigating the potential for design-related human errors, as well as the theoretical efficiency of the available means of protection, this demonstration should be complemented by observations through other means of compliance when required. Analysis cannot be used to assess complex cognitive issues.</td></tr> <tr><td>Example</td></tr>

<tr><td>An applicant may conduct a vision analysis to demonstrate that the flight crew has a clear and undistorted view out of the windshield. Similarly, an analysis may also demonstrate that flight, navigation and powerplant instruments are plainly visible from the flight crew stations. The applicant may need to validate the results of the analysis in a ground or flight test, or by using a means of simulation that is geometrically representative. The applicant may also conduct an analysis based on evidence collected during previous similar HF assessments.</td></tr> </table>

(d)MC4 (laboratory tests)

<table>

<tr><td>Description</td></tr>

<tr><td>This refers to an assessment made using a bench test representing the HMI. This can be conducted on an avionics bench when the purpose is to assess the information, or on a mock-up when the purpose is to assess the flight deck geometry.</td></tr> <tr><td>Bench or laboratory assessment</td></tr>

<tr><td>The applicant may conduct an assessment using devices emulating flight crew interfaces for a single system or a group of related systems. The applicant can use flight hardware, simulated systems or combinations of these.</td></tr> <tr><td>Example of a bench or laboratory assessment</td></tr>

<tr><td>A bench assessment for an integrated system may be conducted using an avionics suite installed in a mock-up of a flight deck, with the main displays and autopilot controls included. Such a tool may be valuable during development and for familiarising EASA with the system. However, in a highly integrated architecture, it may be difficult or impossible to assess how well the avionics system will fit into the overall flight deck without more complete simulation or use of the actual aeroplane.</td></tr> <tr><td>Mock-up evaluation</td></tr>

<tr><td>A mock-up is a full-scale, static representation of the physical configuration (form and fit). It does not include functional aspects of the flight deck and its installed systems and equipment. Mock-ups can be used as representations of the design, allowing participants to physically interact with the design. Three-dimensional representations of the design in a computer-aided design system, in conjunction with three-dimensional models of the flight deck occupants, have also been used as ‘virtual’ mock-ups for certain limited types of evaluations. Reachability, for example, can be addressed using either type of mock-up.</td></tr> <tr><td>Example of a mock-up evaluation</td></tr>

<tr><td>An analysis to demonstrate that the controls are arranged so that flight crew members from 1.58 m (5 ft 2 in) to 1.91 m (6 ft 3 in) in height can reach all controls. This analysis may use computer-generated data based on engineering drawings. The applicant may demonstrate the results of the analysis in the actual aeroplane.</td></tr> <tr><td>Limitations</td></tr>

<tr><td>Bench tests or mock-ups should not be used to assess complex cognitive issues.</td></tr> </table>

(e)MC5 (ground tests)

<table>

<tr><td>Description</td></tr>

<tr><td>An assessment conducted on a flight test article on the ground.</td></tr> <tr><td>Limitations</td></tr>

<tr><td>Ground tests should not be used to assess complex cognitive issues.</td></tr> <tr><td>Example</td></tr>

<tr><td>An example of a ground test is the assessment of the displays’ potential for reflections on the windshield and on the windows. Such an assessment involves covering the flight deck windows to simulate darkness and setting the flight deck lighting to the desired levels. This particular assessment may not be possible in a simulator because of differences in the light sources, display hardware and/or construction of the windows.</td></tr> </table>

(f)MC6 (flight tests) and MC8 (simulation)

The applicant may use a wide variety of part-task to full-installation representations of the product/system/component or flight deck for assessment purposes. The representation of the HMI does not necessarily conform to the final design. The paragraphs below address both system/component- and aeroplane-level evaluations that typically make up this group of means of compliance.

<table>

<tr><td>Description</td></tr>

<tr><td>As soon as the maturity of the design allows pilots to take part in the compliance demonstration, HF assessments are conducted in a dynamic operational context. Depending on the HF objectives to be addressed, and according to the HF test programme, those assessments can be conducted at either the system/component level or the aeroplane level. Both simulators and real aeroplanes can be used, but the selection of the MoC depends on the nature of the test objectives.</td></tr> <tr><td>Use</td></tr>

<tr><td>Traditionally, these types of activities are part of the design process. They allow applicants to continuously improve their designs thanks to the application of an iterative approach.</td></tr> </table>

(g)MC8 (simulation)

<table>

<tr><td>Simulator assessment</td></tr>

<tr><td>A simulator assessment uses devices that present an integrated emulation (using flight hardware, simulated systems or combinations of these) of the flight deck and the operational environment. These devices can also be ‘flown’, with response characteristics that replicate, to some extent, the responses of the aeroplane.</td></tr> </table>

(h)MC6 (flight tests)

<table>

<tr><td>In-flight assessment</td></tr>

<tr><td>Flight testing during certification is the final compliance demonstration of the design, and is conducted in a conforming aeroplane during flight. The aeroplane and its components (flight deck) are the most representative of the type design to be certified and will be the closest to real operations of the systems and equipment. In-flight testing is the most realistic testing environment, although it is limited to those tests that can be conducted safely. Flight testing can be used to validate and verify other assessments previously conducted during the development and certification programme. It is often best to use flight testing as the final confirmation of data collected using other means of compliance, including analyses and assessments. Flights tests carried out for areas of investigation outside the HF scope can be given partial credit for demonstrating compliance with CS 25.1302. However, the acceptability of this approach has to be assessed by EASA on a case-by-case basis. A prerequisite for acceptance by EASA is the respect of the basic HF methodical principles for data collection and processing. These flight tests should only be used to complement dedicated HF assessments.</td></tr> </table>

(i)MC6 versus MC8

The selection of the flight test as a means of assessment should not be exclusively motivated by the absence of any other available means, but should be duly justified, taking into account its inherent limitations.

For safety reasons, the actual testing on an aeroplane may be inappropriate for the malfunction assessment.

Flight testing does not normally allow the manipulation of the operational environment, which may be needed to apply the scenario-based approach.

HF in-flight scenarios may be challenging to replicate due to the difficulty in reproducing the operational context. For example, events related to ATC communications, weather, etc., which are expected to trigger a flight crew reaction to be tested, may not be repeatable. This may hamper the collection of homogeneous data and may adversely affect the validity of that data.

However, flight testing is deemed adequate when the operational and/or system/component representativeness is a key driver for the validity of HF data. For example, an in-flight assessment is typically more adequate when dealing with workload determination.

[Amdt 25/3]

The following is a list of certification specifications, acceptable means of compliance and other documents relevant to flight deck design and flight crew interfaces that may be useful when reviewing this AMC.

Related EASA certification specifications

<table>

<tr><td>CS-25 Book 1</td><td>General topic</td><td>CS-25 Book 2 (Acceptable Means of Compliance)</td></tr> <tr><td>CS 25.785(g)</td><td>Seats, berths, safety belts and harnesses</td><td>AMC 25.785(g)</td></tr> <tr><td>CS 25.1309(c)</td><td>Minimising flight crew errors that could create additional hazards</td><td>AMC 25.1309</td></tr> <tr><td>CS 25.1523</td><td>Minimum flight crew and workload</td><td>AMC 25.1523</td></tr> <tr><td>CS 25.1321</td><td>Arrangement and visibility</td><td></td></tr>

<tr><td>CS 25.1322</td><td>Flight crew alerting design principles</td><td>AMC 25.1322</td></tr> <tr><td>CS 25.1329</td><td>Autopilot, flight director, autothrust</td><td>AMC No 1 to CS 25.1329, AMC No 2 to CS 25.1329</td></tr> <tr><td></td><td>Electronic displays</td><td>AMC 25-11</td></tr>

<tr><td>CS 25.1543</td><td>Instrument markings – general</td><td>AMC 25.1543</td></tr> </table>

Other documents

The following is a list of other documents relevant to flight deck design and flight crew interfaces that may be useful when applying this AMC. Some are not aviation specific, such as International Standard ISO 9241-4, which nevertheless provides useful guidance. When using that document, the applicant should consider environmental factors such as the intended operational environment, turbulence and lighting, as well as cross-side reach.

SAE ARP4033, Pilot-System Integration, August 1995

SAE ARP5289A, Electronic Aeronautical Symbols, 2011

SAE ARP4102/7, Electronic Displays, 2007

SAE ARP4105C, Abbreviations, acronyms, and terms for use on the flight deck, 2020 ICAO Document 8400, Procedures for Air Navigation Services – ICAO abbreviations and codes, 9th edition, 2016 ICAO Document 9683 – AN/950, Human Factors Training Manual, 1st edition, 1998

ISO 9241-4, Ergonomic requirements for office work with visual display terminals (VDTs), 1998 Federal Aviation Administration (FAA) Human Factors Team report: The interfaces between flight crews and modern flight deck systems, 1996 DOT/FAA/RD-93/5, Human Factors for Flight Deck Certification Personnel, 1993

FAA AC 20-175, Controls for Flight Deck Systems, 2011

FAA AC 00-74, Avionics Human Factors Considerations for Design and Evaluation, 2019 DOT/FAA/TC-13/44, Human factors considerations in the design and evaluation of flight deck displays and controls, 2016

[Amdt 25/3]

1.Introduction

(a)Accidents most often result from a sequence or combination of different errors and safety-related events (e.g. equipment failures and weather conditions). Analyses show that the design of the flight deck and aircraft systems and equipment can influence the flight crew’s task performance and the occurrence and effects of some flight crew errors.

(b)Flight crews make a positive contribution to the safety of the aviation system because of their ability to continuously assess changing conditions and situations, analyse potential actions and make reasoned decisions. However, even well-trained, qualified, healthy, alert flight crews make errors. Some of these errors may be induced or influenced by the designs of the systems and equipment and their flight crew interfaces even when they are carefully designed. Most of these errors have no significant safety effects, or are detected and mitigated in the normal course of events. However, some of them may lead or contribute to the occurrence of unsafe conditions. Accident analyses have identified flight crew performance and errors as recurrent factors in the majority of accidents involving large aeroplanes.

(c)Some certification specifications are intended to improve safety by requiring the flight deck and its systems and equipment to be designed with certain capabilities and characteristics. The approval of flight deck systems with respect to design-related flight crew error has typically been addressed by referring to system-specific or general applicability certification specifications, such as CS 25.1301(a), CS 25.771(a) and CS 25.1523. CS 25.1302 and its AMC and GM address potential flight crew limitations and errors.

(d)CS 25.1302 provides specifications for addressing the design-related aspects of the avoidance and management of flight crew errors by taking the following approach.

(i)Firstly, CS 25.1302 provides means to address the design characteristics that are known to reduce or avoid flight crew errors and that address flight crew capabilities and limitations. CS 25.1302(a) to (c) are intended to reduce the design contribution to such errors by ensuring that the information and controls needed by the flight crew to perform the tasks associated with the intended function of installed systems and equipment are provided, and that they are provided in a usable form.

In addition, operationally relevant system and equipment behaviour must be understandable, predictable and supportive of the flight crew’s tasks. Guidance is provided in this paragraph on the avoidance of design-induced flight crew errors.

(ii)Secondly, CS 25.1302(d) addresses the fact that, since flight crew errors will occur, even with a well-trained and proficient flight crew operating well-designed systems, the design must support the management of those errors to mitigate any safety consequences. Paragraph 4.5 of AMC 25.1302 on flight crew error management provides the relevant guidance.

(e)EASA would like to draw attention to the fact that the implementation of the process used to show compliance with CS 25.1302 may require up to several years, depending on the characteristics of the project. However, supplemental type certificates may require much less time.

2.CS 25.1302: applicability and explanatory material

(a)CS-25 contains certification specifications for the design of specific flight deck systems and equipment (refer to AMC 25.1302, paragraph 2, Table 1). Some of these specifications are generally applicable (e.g. CS 25.1301(a), CS 25.1309(c), CS 25.771(a)), while others establish minimum flight crew requirements (e.g. CS 25.1523). CS 25.1302 complements the generally applicable specifications by adding more explicit objectives for the design attributes related to the avoidance and management of flight crew errors. Other ways to avoid and manage flight crew errors are regulated through the regulations governing the licensing and qualifications of flight crew and aeroplane operations. Taken together, these complementary approaches provide an adequate level of safety.

(b)The complementary approach is important. It is based upon the recognition that systems and equipment design, training/licensing/qualifications and operations/procedures each provide contributions to safety risk mitigation. An appropriate balance is needed between these aspects. There have been cases in the past where design characteristics known to contribute to flight crew errors were accepted based upon the rationale that training or procedures would mitigate that risk. We now know that this can often be an inappropriate approach. Similarly, due to unintended consequences, it would not be appropriate to require the systems and equipment design to provide total safety risk mitigation.

(c)A proper balance is needed between certification specifications in CS-25 and the regulations for training/licensing/qualifications and operations/procedures. CS 25.1302 and its AMC and GM were developed with the intent of achieving that appropriate balance.

(1)Introduction. The introductory sentence of CS 25.1302 states that ‘this paragraph applies to installed systems and equipment intended to be used by flight crew members when operating the aeroplane from their normally seated positions on the flight deck’.

(i)‘Intended to be used by flight crew members when operating the aeroplane from their normally seated positions on the flight deck’ means that the intended function of the installed system or equipment includes its use by the flight crew when operating the aeroplane. An example of such installed equipment would be a display that provides information enabling the flight crew to navigate. The term ‘flight crew’ is intended to include any or all individuals constituting the minimum crew as determined for compliance with CS 25.1523. The phrase ‘from their normally seated positions on the flight deck’ means that the flight crew members are seated at their normal duty stations for operating the aeroplane.

(ii)The phrase ‘from their normally seated positions on the flight deck’ means that the flight crew members are positioned at their normal duty stations on the flight deck. This phrase is intended to limit the scope of CS 25.1302 so that it does not address the systems or equipment that are/is not used by the flight crew members while performing their duties in operating the aeroplane in normal, abnormal/malfunction and emergency conditions. For example, CS 25.1302 is not intended to apply to design items such as certain circuit breakers or maintenance controls intended for use by the maintenance crew (or by the flight crew when not operating the aeroplane).

(iii)The phrase ‘Those installed systems and equipment must be shown […]’ in the first paragraph means that the applicant must provide sufficient evidence to support compliance determinations for each of the CS 25.1302 objectives. However, for simple design items or items similar to previously approved equipment and installations, the demonstrations, assessments or data needed to demonstrate compliance with CS 25.1302 are not expected to entail more extensive or onerous efforts than were necessary to demonstrate compliance with the CS 25.1302 certification specifications in the former aeroplane type certification basis.

(iv)The phrase ‘individually and in combination with other such systems and equipment’ means that the objectives of this paragraph must be met when a system or equipment is installed on the flight deck together with other systems or equipment. The installed system or equipment must not prevent other systems or equipment from complying with these objectives. For example, the applicant must not design a display so that the information it provides is inconsistent, or in conflict, with information provided by other installed systems or equipment.

(v)In addition, this paragraph presumes a qualified flight crew that is trained to use the installed system or equipment. This means that the design must meet these objectives for flight crew members who are allowed to operate the aeroplane in compliance with the qualification requirements of the applicable air operations regulation. If the applicant seeks a type design or supplemental type design approval before a training programme is accepted, the applicant should document any novel, complex or highly integrated design items and assumptions made during the design phase that have the potential to affect the training time or the flight crew procedures. CS 25.1302 and associated AMC and GM are written assuming that these design items and assumptions and any training programme to be conducted (proposed or in the process of being developed) will be coordinated with the appropriate operational approval organisation when assessing the adequacy of the design.

(vi)The objective of the system or equipment to be designed so that the flight crew can safely perform their tasks associated with the intended function of the system or equipment applies in normal, abnormal/malfunction and emergency conditions. The tasks intended to be performed under all the above conditions are generally those prescribed by the flight crew procedures. The phrase ‘safely perform their tasks’ is intended to describe one of the safety objectives of this certification specification. The objective is for the system or equipment design to enable the flight crew to perform their tasks with sufficient accuracy and in a timely manner, without unduly interfering with their other required tasks. The phrase ‘tasks associated with the intended function of the systems and equipment’ is intended to characterise either the tasks required to operate the system or equipment or the tasks for which the intended function of the system or equipment provides support.

(2)CS 25.1302(a). This requires the applicant to install the appropriate controls and provide the necessary information for any flight deck system or equipment identified in the first paragraph of CS 25.1302. The controls and the information displays must be sufficient to allow the flight crew to accomplish their tasks. Although this may seem obvious, this objective is included because a review of CS-25 on the subject of HF revealed that a specific objective for flight deck controls and information to meet the flight crew’s needs is necessary. This objective is not reflected in other parts of CS-25, so it is important to be explicit.

(3)CS 25.1302(b). This addresses the objective for flight deck controls and information that are/is necessary and appropriate for the flight crew to accomplish their tasks, as determined in (a) above. The intent is to ensure that the design of the controls and information devices makes them usable by the flight crew. This subparagraph seeks to reduce design-induced flight crew errors by imposing design objectives for flight deck information presentation and controls. Subparagraphs CS 25.1302(b)(1) through (3) specify these design objectives. The design objectives for information and controls are necessary to:

(i)properly support the flight crew in planning their tasks;

(ii)make available to the flight crew appropriate, effective means to carry out planned actions;

(iii)enable the flight crew to have appropriate feedback information about the effects of their actions on the aeroplane.

(4)CS 25.1302(b)(1). This specifically requires controls and information to be designed in a clear and unambiguous form, at a resolution and precision appropriate to the task.

(i)As applied to information, ‘clear and unambiguous’ means that the information can be perceived correctly (i.e. is legible) and can be comprehended in the context of the flight crew tasks associated with the intended functions of the system or equipment, such that the flight crew can perform all the associated tasks.

(ii)For controls, the objective of ‘clear and unambiguous’ presentation means that the flight crew must be able to use controls appropriately to achieve the intended functions of the system or equipment. The general intent is to foster the design of systems and equipment controls whose operation is intuitive, consistent with the effects on the parameters or states that they affect, and compatible with the operation of the other controls on the flight deck.

(iii)CS 25.1302(b)(1) also requires the information or control to be provided, or to operate, at a level of detail and accuracy appropriate for accomplishing the task. Insufficient resolution or precision would mean that the flight crew could not perform the task adequately. Conversely, excessive resolution has the potential to make a task too difficult because of poor readability or the implication that the task should be accomplished more precisely than is actually necessary.

(5)CS 25.1302(b)(2). This requires controls and information to be accessible and usable by the flight crew in a manner appropriate to the urgency, frequency and duration of their tasks. For example, controls that are used more frequently or urgently must be readily accessible or require fewer steps or actions to perform the task. Less accessible controls may be acceptable if they are needed less frequently or less urgently. Controls that are used less frequently or less urgently should not interfere with those used more urgently or more frequently. Similarly, tasks requiring a longer time for interaction should not interfere with the accessibility of information required for urgent or frequent tasks.

(6)CS 25.1302(b)(3). This requires that the controls and information make the flight crew aware of the effects of their actions on the aeroplane or systems, if that awareness is required for the safe operation of the aeroplane. The intent is for the flight crew to be aware of the system or aeroplane states resulting from flight crew actions, permitting them to detect and correct their own errors. Specific deficiencies of other certification specifications in addressing this objective are described below.

(i)CS 25.771(a) addresses this objective for controls, but it does not include criteria for the presentation of information.

(ii)CS 25.777(a) addresses controls, but only their location.

(iii)CS 25.777(b) and CS 25.779 address the direction of motion and actuation but they do not encompass some types of controls, such as cursor-control devices. These specifications also do not encompass the types of control interfaces that can be incorporated into displays via menus, for example, thus affecting their accessibility.

(iv)CS 25.1523 has a different context and purpose (determining the minimum flight crew), so it does not address the objective in a sufficiently general way.

(7)CS 25.1302(c). This requires installed systems and equipment to be designed so that their behaviour that is operationally relevant to flight crew tasks is:

(i)predictable and unambiguous;

(ii)designed to enable the flight crew to intervene in a manner appropriate to the task (and intended function).

The applicant should also consider that flight deck technologies involving integrated and complex information and control systems or equipment have increased safety and performance. However, they have also introduced the need to ensure proper interactions between the flight crew and the systems and equipment. In-service experience has shown that some systems and equipment behaviours (especially from automated systems) are excessively complex or dependent upon logical states or mode transitions that are not well understood or expected by the flight crew. Such design characteristics can confuse the flight crew and have been determined to contribute to incidents and accidents.

(8)CS 25.1302(c)(1). This requires the behaviour of a system or equipment to be such that a qualified flight crew knows what the system is doing and why it is doing it. It requires operationally relevant system behaviour to be ‘predictable and unambiguous’. This means that flight crew members must be able to retain enough information about what their action or a changing situation will cause the system or equipment to do under foreseeable circumstances, so that they can operate the system or equipment safely.

The behaviour of a system must be unambiguous because the actions of the flight crew may have different effects on the aeroplane, depending on its current state or operational circumstances.

(9)CS 25.1302(c)(2). This requires the design to be such that the flight crew will be able to take some action, or change or alter an input to the system or equipment, in a manner appropriate to the task.

(10)CS 25.1302(d). This addresses the reality that even well-trained, proficient flight crews using well-designed systems will make errors. It requires the systems and equipment to be designed in order to enable the flight crew to manage such errors. For the purpose of this CS, errors resulting from flight crew interaction with the systems and equipment are those errors that are in some way attributable, or related, to the design of the controls, the behaviour of the systems and equipment or the information presented. Examples of designs or information that could cause errors are indications and controls that are complex and inconsistent with each other or with other systems on the flight deck. Another example is a procedure that is inconsistent with the design of the system or equipment. Such errors are considered to be within the scope of this CS and the related AMC.

(i)A design that enables the flight crew to manage errors means that:

(A)the flight crew is able to detect and/or recover from errors resulting from their interaction with the systems and equipment;

(B)the effects of such flight crew errors on the aeroplane functions or capabilities is evident to the flight crew, and continued safe flight and landing is possible;

(C)flight crew errors are prevented by switch guards, interlocks, confirmation actions or other effective means;

(D)the effects of errors is precluded by system logic or redundant, robust or fault-tolerant system design.

(ii)The objective to manage errors applies to those errors that can reasonably be expected in service from qualified and trained flight crews. The term ‘reasonably expected in service’ refers to errors that have occurred in service with similar or comparable equipment. It also refers to errors that can be predicted to occur based on general experience and knowledge of human performance capabilities and limitations related to the use of the type of controls, information or system logic being assessed.

(iii)CS 25.1302(d) includes the following statement: ‘This sub-paragraph (d) does not apply to skill-related errors associated with the manual control of the aeroplane.’ This statement is intended to exclude errors resulting from the flight crew’s proficiency in the control of the flight path and attitude with the primary roll, pitch, yaw and thrust controls, and that are related to the design of the flight control systems. These issues are considered to be adequately addressed by other certification specifications, such as CS-25 subpart B and CS 25.671(a). It is not intended that the design should be required to compensate for deficiencies in flight crew training or experience. Compliance with the minimum flight crew requirements for the intended operation is assumed.

(iv)The CS 25.1302(d) objective is intended to exclude the management of errors resulting from flight crew decisions, acts or omissions that are not in good faith. It is intended to avoid imposing requirements on the design to accommodate errors committed with malicious or purely contrary intent. CS 25.1302(d) is not intended to require the applicant to consider errors resulting from acts of violence or threats of violence.

This ‘good faith’ exclusion is also intended to avoid imposing requirements on designs to accommodate errors due to a flight crew’s obvious disregard for safety. However, it is recognised that errors committed intentionally may still be in good faith, but could be influenced by the characteristics of the design under certain circumstances. An example is a poorly designed procedure that is not compatible with the controls or information provided to the flight crew.

Operational practicability should also be addressed, such as the need to avoid introducing error management features into the design that would inappropriately impede flight crew actions or decisions in normal, abnormal/malfunction and emergency conditions. For example, it is not intended to require so many guards or interlocks on the means to shut down an engine that the flight crew would be unable to do this reliably within the available time. Similarly, the intention is not to reduce the authority of or means for the flight crew to intervene or carry out an action when it is their responsibility to do so using their best judgement in good faith.

The compliance matrix developed by the applicant (refer to paragraph 3.2.5 of AMC 25.1302) should provide the essential information to understand the relationship between the following elements:

design items, applicable certification specifications, test objectives, means of compliance, deliverables.

The two matrices below are provided as examples only. The applicant might present the necessary information using other equivalent formats. An example with a design item entry is provided below.

<table>

<tr><td>Function</td><td>Sub-function</td><td>Focus</td><td>CS reference</td><td>CS description</td><td>Assessed dimension</td><td>Means of Compliance</td><td>Reference to the related deliverable</td></tr> <tr><td rowspan="5">Electronic checklist (ECL) function</td><td rowspan="5">Display electronic checklist (ECL)</td><td rowspan="5">Electronic checklist quick access keys (ECL QAKs)</td><td>CS 25.777(a)</td><td>Each cockpit control must be located to provide convenient operation and to prevent confusion and inadvertent operation.</td><td>Assess the ECL QAKs location for convenient operation and prevention of inadvertent operation.</td><td>MoC8 HF campaign #2 Scenario #4.</td><td>HF Test Report XXX123.</td></tr> <tr><td>CS25.777(c)</td><td>The controls must be located and arranged, with respect to the pilots’ seats, so that there is full and unrestricted movement of each control without interference from the cockpit structure or the clothing of the minimum flight crew (established under CS 25.1523) when any member of this flight crew from 1.58 m (5ft 2 inches) to 1.91 m (6ft 3 inches) in height, is seated with the seat belt and shoulder harness (if provided) fastened.</td><td>Assess accessibility to control the ECL QAKs.</td><td>MoC4 HF Reachability Analysis MoC5 HF Reachability and Accessibility Campaign.</td><td>HF Reachability and Accessibility Assessment Report XXX123.</td></tr> <tr><td>[…]</td><td>[…]</td><td>[…]</td><td>[…]</td><td>[…]</td></tr>

<tr><td>CS 25.1302(a)</td><td>(a) The controls and information necessary for the accomplishment of the tasks must be provided.</td><td>Assess that appropriate controls are provided in order to display ECL.</td><td>MoC1 ECL implementation description for XXXX.</td><td>ECL implementation description document for XXXX.</td></tr> <tr><td>CS 25.1302(b)(1)</td><td>(b)The controls and information required by paragraph (a), which are intended for use by the flight crew, must: (1) Be presented in a clear and unambiguous form, at resolution and with a precision appropriate to the flight crew task.</td><td>Assess the appropriateness of the ECL QAKs labels.</td><td>MoC8 HF campaign #4 Scenario #1.</td><td>HF Test Report XXX345.</td></tr> </table>

An example with a certification specification entry is provided below.

<table>

<tr><td>CS reference</td><td>CS description</td><td>Focus</td><td>Assessed dimension</td><td>Means of Compliance</td><td>Reference to the related deliverable</td></tr> <tr><td rowspan="2">CS 25.777(a)</td><td rowspan="2">(a) Each cockpit control must be located to provide convenient operation and to prevent confusion and inadvertent operation.</td><td>All flight deck controls.</td><td>Assess the locations of all flight deck controls for convenient operation and prevention of inadvertent operation.</td><td>MoC8 All HF simulator evaluations.</td><td>HF Test Reports XXX123 XXX456 XXX789.</td></tr> <tr><td>ECL QAKs</td><td>Assess the location of the ECL QAKs for convenient operation and prevention of inadvertent operation.</td><td>MoC8 HF campaign #2 Scenario #4.</td><td>HF Test Report XXX123.</td></tr> <tr><td rowspan="2">CS 25.777(c)</td><td rowspan="2">(c) The controls must be located and arranged, with respect to the pilots’ seats, so that there is full and unrestricted movement of each control without interference from the cockpit structure or the clothing of the minimum flight crew (established under CS 25.1523) when any member of this flight crew from 1.58 m (5ft 2 inches) to 1.91 m (6 ft 3 inches) in height, is seated with the seat belt and shoulder harness (if provided) fastened.</td><td>All flight deck controls.</td><td>Assess the accessibility of all flight deck controls.</td><td>MoC4 HF Reachability Analysis MoC5 HF Reachability and Accessibility Campaign.</td><td>HF Reachability and Accessibility Assessment Report XXX123.</td></tr> <tr><td>ECL QAKs.</td><td>Assess the accessibility to control the ECL QAKs.</td><td>MoC4 HF Reachability Analysis MoC5 HF Reachability and Accessibility Campaign.</td><td>HF Reachability and Accessibility Assessment Report XXX123.</td></tr> <tr><td>[…]</td><td>[…]</td><td></td><td></td><td></td><td></td></tr>

<tr><td>CS 25.1302(a)</td><td>(a)The controls and information necessary for the accomplishment of the tasks must be provided.</td><td></td><td></td><td></td><td></td></tr> <tr><td>CS 25.1302(b)(1)</td><td>(b)The controls and information required by paragraph (a), which are intended for use by the flight crew, must: (1) Be presented in a clear and unambiguous form, at resolution and with a precision appropriate to the flight crew task.</td><td></td><td></td><td></td><td></td></tr> </table>