[Federal Register Volume 64, Number 193 (Wednesday, October 6, 1999)]
[Notices]
[Pages 54399-54410]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 99-26047]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration
[Policy Statement Number ANM-99-2]


Guidance for Reviewing Certification Plans To Address Human 
Factors for Certification of Transport Airplane Flight Decks

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Notice of policy statement; request for comments.

-----------------------------------------------------------------------

SUMMARY: This document announces an FAA general statement of policy 
that is applicable to the type certification process of transport 
category airplanes. This policy provides guidance to FAA Certification 
Teams that will enable them to conduct an effective review of an 
applicant's Human Factors Certification Plan or the human factors 
components of a general Certification Plan, when one is submitted at 
the beginning of a type certification (TC), supplemental type 
certification (STC), or amended type certificate (ATC) project. This 
guidance describes the sections of a Human Factors Certification Plan 
and the information that should be included in each section. The 
purpose of the plan is to facilitate the establishment early on of an 
effective working relationship and agreement between the FAA and the 
applicant about the means by which human factors issues will be 
addressed during a certification project. This notice is to advise the 
public of FAA policy and give all interested persons an opportunity to 
review and comment on the policy statement.

DATES: Comments must be received on or before November 5, 1999.

ADDRESSES: Send all comments on this policy statement to the individual 
identified under FOR FURTHER INFORMATION CONTACT.

FOR FURTHER INFORMATION CONTACT: Sharon Hecht, Federal Aviation 
Administration, Transport Airplane Directorate, Transport Standards 
Staff, Airplane & Flight Crew Interface Branch, ANM-111, 1601 Lind 
Avenue SW., Renton, Washington 98055-4056; telephone (425) 227-2398; 
facsimile (425) 227-1100; e-mail: 9-ANM-111-HUMAN [email protected].

SUPPLEMENTARY INFORMATION:

Comments Invited

    Interested persons are invited to submit written comments on this 
policy statement. Commenters should identify the Policy Statement 
Number of this policy statement, and submit comments,

[[Page 54400]]

in duplicate, to the address specified above. All communications 
received on or before the closing date for comments will be considered 
by the Transport Standards Staff of the Transport Airplane Directorate.

Effect of General Statement of Policy

    The general policy stated in this document is not intended to 
establish a binding norm; it does not constitute a new regulation, and 
the FAA would neither apply nor rely upon it as a regulation. The FAA 
Aircraft Certification Offices (ACO) that certify transport category 
airplanes and/or the flight deck systems installed on them should 
attempt to follow this policy, when appropriate. However, in 
determining compliance with certification standards, each FAA office 
has the discretion not to apply these guidelines where it determines 
that they are inappropriate.

Background

    Recent aviation safety reports underscore the importance of 
addressing issues related to human factors and flightcrew error in 
system design and certification. Applicants have demonstrated the 
effectiveness of using a ``Human Factors Certification Plan'' to 
communicate their proposed approach to the identification and 
resolution of human factors issues. This type of plan has been used as 
a means by which the applicant and the FAA can establish an early and 
formal written agreement on the certification basis, the methods of 
compliance, and the schedules for completing the certification project. 
This approach has helped FAA Certification Teams address issues as 
early in the certification process as possible, thereby decreasing the 
applicant's certification risk in cost or schedule.
    An alternative approach to developing a stand-alone Human Factors 
Certification Plan is for the applicant to address the human factors 
issues as part of their general Certification Plan. Regardless of 
whether it is a stand-alone document or not, the trend has been for 
applicants to provide some specific information about their plans to 
address human factors issues for the certification project.
    Because of the proven effectiveness of this type of approach, 
increasing numbers of applicants have asked for assistance from the FAA 
in developing Human Factors Certification Plans. Given this trend, the 
Transport Airplane Directorate has developed this policy to assist FAA 
Certification Team members in working with applicants who are 
attempting to develop Human Factors Certification Plans, as well as in 
reviewing these plans after they have been submitted.

Objective of This Policy

    The objective of this policy is to provide guidance for the FAA 
Certification Team to use when reviewing the applicant's Human Factors 
Certification Plan or the human factors components of the general 
Certification Plan during a type certification (TC), supplemental type 
certification (STC), or amended type certificate (ATC) project for 
transport category airplanes. The policy is intended for use by all 
members of the Certification Team, which may include the following:
     Aircraft evaluation group inspectors,
     Avionics engineers,
     Certification Team project managers,
     Flight test pilots and engineers,
     Human factors specialists,
     Propulsion engineers, and
     Systems engineers.
    While this policy is focused on providing guidance to these FAA 
team members, it may be of use to the applicant, as well. If the 
applicant develops a Certification Plan for a certification project, 
the information in this policy statement can be used as a basis for 
communicating the applicant's approach to addressing the human factors 
aspects of the project.
    This policy is one portion of an overall FAA strategy for the 
development of policies related to human factors in the certification 
of flight decks on transport category airplanes. Future policy 
development will cover the following areas, related to showing 
compliance with regulatory requirements associated with human factors:
     Information on the recommended content of certification 
plans.
     Information on how to determine the adequacy of an 
applicant's proposed methods of compliance.
     Information on how to determine the adequacy of an 
applicant's proposed test plans intended to support certification.
     Information on how to determine pass-fail criteria for 
analyses and tests performed to support certification.
    Relevant reference material can be found in Appendix B of this 
policy statement.
    A checklist is included in Appendix D of this policy statement, 
which can be used as part of certification plan review. It covers all 
of the sections listed below.

General Statement of Policy--Guidance for Reviewing Certification 
Plans To Address Human Factors for Certification of Transport 
Airplane Flight Decks

    The guidance provided in the following sections is intended to help 
the Certification Team members review a Human Factors Certification 
Plan submitted by an applicant. It is organized into nine sections, 
which are consistent with those suggested for a Certification Plan in 
FAA Advisory Circular (AC) 21-40, ``Application Guide for Obtaining a 
Supplemental Type Certificate.'' Those sections are:

1. Introduction
2. System Description
3. Certification Requirements
4. Methods of Compliance
5. System Safety Assessments
6. Operational Considerations
7. Certification Documentation
8. Certification Schedule
9. Use of Designees and Identification of Individual DER/DAR

    Guidance is provided in this general statement of policy concerning 
the information that would be appropriate to include in each of these 
sections for either a Human Factors Certification Plan or a general 
Certification Plan. A sample (hypothetical) Human Factors Certification 
Plan can be found in Appendix C of this general statement of policy.

    Note: While Appendix C is included as part of this policy 
statement document, the FAA also plans to provide it as a separate 
web site on the Internet, where it can become a ``living document'' 
and be updated as new information, processes, and technology become 
available.

1. Introduction

    This section of the Certification Plan should provide a short 
overview of the certification project, the certification program in 
general, and the purpose of the Human Factors Certification Plan 
specifically.

2. System Description

    This section of the Certification Plan should describe the general 
features of the flight deck, system, or component being presented as 
part of a certification project. Because a human factors perspective of 
the flight deck includes the systems, the users (flightcrew members), 
and the ways in which they interact (e.g., crew procedures), this 
section of the Human Factors Certification Plan may include general 
descriptions of all three. The applicant can use this section to ensure 
that the Certification Team and the applicant have a common 
understanding of the basic design concepts as well as the

[[Page 54401]]

principles and operational assumptions that underlie the design of the 
flightcrew interfaces.
    For the purposes of this policy, the term ``flightcrew interface'' 
is intended to cover both the design of the systems (hardware, 
software) and the tasks (physical, cognitive, perceptual, procedural) 
the pilots will perform when using the systems in the context of their 
overall responsibilities.
    The applicant should give special attention to any new or unique 
features or functions and how the flightcrew will use them. 
Specifically, the following topic areas may be included:
    2.a. Intended Function: The Human Factors Certification Plan should 
provide information describing the intended functions of the major 
flightcrew interfaces. For each, the applicant should identify the 
following items, as appropriate, focusing on new or unique features 
that affect the crew interface or the allocation of tasks between the 
pilot(s) and the airplane systems:
     The intended function of the system from the pilot's 
perspective.
     The role of the pilot relative to the system.
     The procedures (e.g., type of approach procedures) 
expected to be flown.
     The assumed airplane capabilities (e.g., communication, 
navigation, and surveillance).
    2.b. Flight Deck Layout Drawings: Drawings of the flight deck 
layout, even if they are only preliminary, can be very beneficial for 
providing an understanding of the intended overall flight deck 
arrangement (controls, displays, sample display screens, seating, 
stowage, etc.). The applicant should be encouraged to provide scheduled 
updates to the drawings, so that the Certification Team's knowledge of 
the layout progresses as the design matures. Special attention should 
be given to any of the following that are novel or unique:
     Arrangements of the controls, displays, or other flight 
deck features or equipment.
     Controls, such as a cursor control device, or new 
applications of existing control technologies.
     Display hardware technology.
    For the items identified above, sketches of the crew interfaces for 
the specific systems can be helpful in providing an early understanding 
of the features that may have certification issues. The applicant 
should include with the drawings descriptions of interface, button, 
knob function, anticipated system response, alerting mechanism, mode 
annunciation, etc., so that the documentation adequately covers each 
component or system that the pilot must interact with.
    2.c. Underlying Principles for Automation Logic: For designs that 
involve significant automation, the way the automation operates and 
communicates that operation to the pilot can have significant effects 
on safety. Key topics could include the following:
     Operating modes.
     Principles underlying mode transitions.
     Mode annunciation scheme.
     Automation engagement/disengagement principles.
     Preliminary logic diagrams, if available.
    2.d. Underlying Principles for Crew Procedures: Because the design 
of the systems and the development of the associated procedures are 
interrelated, it is useful to describe the underlying guidelines or 
principles that form the basis for the crew procedures. Key topics 
could include the following:
     The expected use of memorized procedures with confirmation 
checklists vs. read-and-do procedures/checklists.
     Crew interactions during procedure/checklist 
accomplishment.
     Automated support for procedures/checklists, if available.
    2.e. Assumed Pilot Characteristics: The applicant may choose to 
include a description of the pilot group that the manufacturer expects 
will use the flight deck design. This description could include 
assumptions about the following:
     Previous flying experience (e.g., ratings, flying hours).
     Experience with similar or dissimilar flight deck designs 
and features, including automation.
     Expected training that the pilots will receive on this 
flight deck design, or assumptions regarding expected training.

3. Certification Requirements

    This section should list and describe the human factors-related 
regulations and other requirements that are being addressed by the 
applicant's Human Factors Certification Plan. This section also may 
include the applicant's compliance checklist for these requirements.
    The Certification Team should expect to see a matrix from the 
applicant with all of the pertinent regulations listed, with specific 
references to the detailed subparagraphs that will be covered by the 
Human Factors Certification Plan.
    Table 1, below, provides a partial list of regulations contained in 
14 CFR part 25 that may be considered for inclusion in a Human Factors 
Certification Plan. These regulations were selected for the list 
because they typically require that the applicant carefully consider a 
number of human factors issues when showing compliance with them.
    Appendix B of this document also lists these regulations, along 
with a brief discussion of some of the human factors issues that may 
affect the chosen methods of compliance.

    Note: While Appendix B is included as part of this policy 
statement document, the FAA also plans to provide it as a separate 
web site on the Internet, where it can become a ``living document'' 
and be updated as new information, processes, and technology become 
available.

 TABLE 1.--Selected Listing of Regulations in 14 CFR Part 25 Related to
                        Flightcrew Human Factors
------------------------------------------------------------------------
                                                      Requirement  (In
                                                       some cases, the
                                                       content of the
                                                      subparagraphs has
                                                    been paraphrased for
        FAR Section  [Current Amdt. Level]             clarity. Actual
                                                        Human Factors
                                                     Certification Plans
                                                    should use the exact
                                                       wording of the
                                                        regulations.)
------------------------------------------------------------------------
                General Human Factors (HF) Requirements
------------------------------------------------------------------------
Sec.  25.771(a) [amdt. 25-4]......................  Each pilot
                                                     compartment and its
                                                     equipment must
                                                     allow the minimum
                                                     flightcrew to
                                                     perform their
                                                     duties without
                                                     unreasonable
                                                     concentration or
                                                     fatigue.
Sec.  25.771(e) [amt. 25-4].......................  Vibration and noise
                                                     characteristics of
                                                     cockpit equipment
                                                     may not interfere
                                                     with safe operation
                                                     of the airplane.
Sec.  25.773(a)(1) [amdt. 25-72]..................  Each pilot
                                                     compartment must be
                                                     arranged to give
                                                     the pilots
                                                     sufficiently
                                                     extensive, clear,
                                                     and undistorted
                                                     view, to enable
                                                     them to safely
                                                     perform any
                                                     maneuvers within
                                                     the operating
                                                     limitations of the
                                                     airplane, including
                                                     takeoff, approach,
                                                     and landing.
Sec.  25.773(a)(2) [amt. 25-72]...................  Each pilot
                                                     compartment must be
                                                     free of glare and
                                                     reflections that
                                                     could interfere
                                                     with the normal
                                                     duties of the
                                                     minimum flightcrew.

[[Page 54402]]

 
Sec.  25.777(a) [amdt. 25-46].....................  Each cockpit control
                                                     must be located to
                                                     provide convenient
                                                     operation and to
                                                     prevent confusion
                                                     and inadvertent
                                                     operation.
Sec.  25.777(c) [amt. 25-46]......................  The controls must be
                                                     located and
                                                     arranged, with
                                                     respect to the
                                                     pilot's seats, so
                                                     that there is full
                                                     and unrestricted
                                                     movement of each
                                                     control without
                                                     interference from
                                                     the cockpit
                                                     structure or the
                                                     clothing of the
                                                     minimum flightcrew
                                                     when any member of
                                                     this flightcrew,
                                                     from 5'2'' to 6'3''
                                                     in height, is
                                                     seated with the
                                                     seat belt and
                                                     shoulder harness
                                                     fastened.
Sec.  25.1301(a) [original amdt.].................  Each item of
                                                     installed equipment
                                                     must be of a kind
                                                     and design
                                                     appropriate to its
                                                     intended function.
Sec.  25.1309(b)(3) [amt. 25-41]..................  * * * Systems,
                                                     controls, and
                                                     associated
                                                     monitoring and
                                                     warning means must
                                                     be designed to
                                                     minimize crew
                                                     errors that could
                                                     create additional
                                                     hazards.
Sec.  25.1321(a) [amdt. 25-41]....................  * * * Each flight,
                                                     navigation, and
                                                     powerplant
                                                     instrument for use
                                                     by any pilot must
                                                     be plainly visible
                                                     to him from his
                                                     station with the
                                                     minimum practicable
                                                     deviation from his
                                                     normal position and
                                                     line of vision when
                                                     he is looking
                                                     forward along the
                                                     flight path.
Sec.  25.1321(e) [amt. 25-41].....................  If a visual
                                                     indicator is
                                                     provided to
                                                     indicate
                                                     malfunction of an
                                                     instrument, it must
                                                     be effective under
                                                     all probable
                                                     cockpit lighting
                                                     conditions.
Sec.  25.1523 [amdt. 25-3]........................  The minimum
                                                     flightcrew must be
                                                     established so that
                                                     it is sufficient
                                                     for safe operation,
                                                     considering (a) the
                                                     workload on
                                                     individual
                                                     crewmembers; (b)
                                                     the accessibility
                                                     and ease of
                                                     operation of
                                                     necessary controls
                                                     by the appropriate
                                                     crewmember; and (c)
                                                     the kind of
                                                     operation
                                                     authorized under
                                                     Sec.  25.1525. The
                                                     criteria used in
                                                     making the
                                                     determinations
                                                     required by this
                                                     section are set
                                                     forth in Appendix
                                                     D.
Sec.  25.1543(b) [amt. 25-72].....................  Each instrument
                                                     marking must be
                                                     clearly visible to
                                                     the appropriate
                                                     crewmember.
------------------------------------------------------------------------
                     System-Specific HF Requirements
------------------------------------------------------------------------
Sec.  25.785(g) [amdt. 25-88].....................  Each seat at a
                                                     flight deck station
                                                     must have a
                                                     restraint system *
                                                     * * that permits
                                                     the flight deck
                                                     occupant, when
                                                     seated with the
                                                     restraint system
                                                     fastened, to
                                                     perform all of the
                                                     occupant's
                                                     necessary flight
                                                     deck functions.
Sec.  25.785(l) [amt. 25-88]......................  The forward
                                                     observer's seat
                                                     must be shown to be
                                                     suitable for use in
                                                     conducting the
                                                     necessary enroute
                                                     inspections.
Sec.  25.1141(a) [amdt. 25-72]....................  Powerplant controls:
                                                     Each control must
                                                     be located so that
                                                     it cannot be
                                                     inadvertently
                                                     operated by persons
                                                     entering, leaving,
                                                     or moving normally
                                                     in the cockpit.
Sec.  25.1357(d) [original amdt.].................  If the ability to
                                                     reset a circuit
                                                     breaker or replace
                                                     a fuse is essential
                                                     to safety in
                                                     flight, that
                                                     circuit breaker or
                                                     fuse must be
                                                     located and
                                                     identified so that
                                                     it can be readily
                                                     reset or replaced
                                                     in flight.
Sec.  25.1381(a)(2) [amdt. 25-72].................  The instrument
                                                     lights must be
                                                     installed so that
                                                     (ii) no
                                                     objectionable
                                                     reflections are
                                                     visible to the
                                                     pilot.
------------------------------------------------------------------------
                  Specific Crew Interface Requirements
------------------------------------------------------------------------
Sec.  25.773(b)(2)(i) [amt. 25-72]................  The first pilot must
                                                     have a window that
                                                     is openable * * *
                                                     and gives
                                                     sufficient
                                                     protection from the
                                                     elements against
                                                     impairment of the
                                                     pilot's vision.
Sec.  25.1322 [amdt. 25-38].......................  If warning, caution,
                                                     or advisory lights
                                                     are installed in
                                                     the cockpit, they
                                                     must, unless
                                                     otherwise approved
                                                     by the
                                                     Administrator, be:
                                                    (a) Red, for warning
                                                     lights (lights
                                                     indicating a hazard
                                                     which may require
                                                     immediate
                                                     corrective action);
                                                    (b) Amber, for
                                                     caution lights
                                                     (lights indicating
                                                     the possible need
                                                     for future
                                                     corrective action);
                                                    (c) Green for safe
                                                     operation lights;
                                                     and
                                                    (d) Any other color,
                                                     including white,
                                                     for lights not
                                                     described in
                                                     paragraphs (a)
                                                     through (c) of this
                                                     section, provided
                                                     the color differs
                                                     sufficiently from
                                                     the colors
                                                     prescribed in
                                                     paragraphs (a)
                                                     through (c) of this
                                                     section to avoid
                                                     possible confusion.
------------------------------------------------------------------------

4. Methods of Compliance

    The Certification Team should request the detailed plans for 
showing compliance as the plans evolve with the program. It is 
recommended that coordination meetings with the applicant and 
Certification Team be held several times during the certification 
program to review the compliance checklist in detail and the associated 
test plans, as they are developed. This will help all parties reach 
agreement on how the tests, demonstrations, and other data-gathering 
efforts will be sufficient to show compliance. Of special importance is 
ensuring that the methods proposed by the applicant will provide enough 
fidelity to identify human factors issues early enough to avoid 
adversely affecting the certification schedule.
    A suggested format for the compliance checklist is contained in FAA 
Advisory Circular (AC) 21-40, ``Application Guide for Obtaining a 
Supplemental Type Certificate,'' dated May 6, 1998. An example of a 
checklist can be found in Appendix D of this policy statement.

    Note: While Appendix D is included as part of this policy 
statement document, the FAA also plans to provide it as a separate 
web site on the Internet, where it can become a ``living document'' 
and be updated as new information, processes, and technology become 
available.

    In this section of the Human Factors Certification Plan, the 
applicant should delineate the methods that will be used to demonstrate 
compliance with the relevant regulations. The review and discussion of 
the methods of compliance is an opportunity for the FAA and the 
applicant to work together to identify potential human factors issues 
early in the certification program.
    The methods of compliance are not mutually exclusive. The applicant 
may choose to include any or all of these methods of compliance in its 
Human Factors Certification Plan. All of the methods of compliance 
included in the Human Factors Certification Plan should be described in 
enough detail to

[[Page 54403]]

give the Certification Team confidence that the results of the chosen 
method will provide the necessary information for finding compliance. 
Examples of methods to demonstrate compliance are as follows:
    4.a. Drawings: Layout drawings and/or engineering drawings that 
show the geometric arrangement of hardware or display graphics.
    4.b. Configuration Description: A description of the layout, 
arrangement, direction of movement, etc., or a reference to similar 
documentation.
    4.c. Statement of Similarity: A description of the system to be 
approved and a previously approved system, which details their 
physical, logical, and operational similarities, with respect to 
compliance with the regulations.
    4.d. Evaluations, Assessments, Analyses: Evaluations conducted by 
the applicant or others (not the FAA or a designee), who provides a 
report to the FAA. These include:

     Engineering Evaluations or Analyses: These assessments 
can involve a number of techniques, including such things as 
procedure evaluations (complexity, number of steps, nomenclature, 
etc); reach analysis via computer modeling; time-line analysis for 
assessing task demands and workload; or other methods, depending on 
the issue being considered.
     Mock-up Evaluations: These types of evaluations use 
physical mock-ups of the flight deck and/or components. They are 
typically used for assessment of reach and clearance; thus, they 
demand a high degree of geometric accuracy.
     Part-Task Evaluations: These types of evaluations use 
devices that emulate (using flight hardware, simulated systems, or 
combinations) the crew interfaces for a single system or a related 
group of systems. Typically, these evaluations are limited by the 
extent to which acceptability may be affected by other flight deck 
tasks.
     Simulator Evaluations: These types of evaluations use 
devices that present an integrated emulation (using flight hardware, 
simulated systems, or combinations) of the flight deck and the 
operational environment. They also can be ``flown,'' with response 
characteristics that replicate, to some extent, the responses of the 
airplane. Typically, these evaluations are limited by the extent to 
which the simulation is a realistic, high fidelity representation of 
the airplane, the flight deck, the external environment, and crew 
operations. The types of pilots (test, instructor, airline) used in 
the evaluations and the training they receive may significantly 
affect the results and their utility.
     In-Flight Evaluations: These types of evaluations use 
the actual airplane. Typically, these evaluations are limited by the 
extent to which the flight conditions of particular interest (e.g., 
weather, failures, unusual attitudes) can be located/generated and 
then safely evaluated in flight. The types of pilots (test, 
instructor, airline) used in the evaluations and the training they 
receive may significantly affect the results and their utility.

    4.e. Demonstrations: Similar to evaluations (described above), but 
conducted by the applicant with participation by the FAA or its 
designee. The applicant provides a report, requesting FAA concurrence 
on the findings. Examples of demonstrations include:

     Mock-up Demonstrations.
     Part-Task Demonstration.
     Simulator Demonstration.

    4.f. Inspection: A review by the FAA or its designee, who will be 
making the compliance finding.
    4.g. Tests: Evaluations conducted by the FAA or a designee, which 
may encompass:

     Bench Tests: These are tests of components in a 
laboratory environment. This type of testing is usually confined to 
showing that the components perform as designed. Typical bench 
testing may include measuring physical characteristics (e.g., 
forces, luminance, format) or logical/dynamic responses to inputs, 
either from the user or from other systems (real or simulated).
     Ground Tests: These are tests conducted in the actual 
airplane, while it is stationary on the ground. In some cases, 
specialized test equipment may be employed to allow the airplane 
systems to behave as though the airplane was airborne.
     Simulator Tests: (See simulator evaluations, above.)
     Flight Tests: These are tests conducted in the actual 
airplane. The on-ground portions of the test (e.g., preflight, 
engine start, taxi) are typically considered flight test rather than 
ground test.

    The methods identified above cover a wide spectrum: from documents 
that simply describe the product, to partial approximations, to methods 
that replicate the actual airplane and its operation with great 
accuracy. Features of the product being certified and the types of 
human factors issues to be evaluated are key considerations when 
selecting which method is to be used. The characteristics described 
below can be used to help in coming to agreement regarding what 
constitutes the minimum acceptable method(s) of compliance for any 
individual requirement.
    When a product needs to meet multiple requirements, some 
requirements may demand more complex testing while others can be 
handled using simple descriptive measures. It is important to note that 
the following characteristics are only general principles. They are 
intended to form the basis for discussions regarding acceptable methods 
of compliance for a specific product with respect to a requirement.
    4.h. Other Considerations:

     Degree of Integration/Independence: If the product to 
be approved is a stand-alone piece of equipment that does not 
interact with other aspects of the crew interface, less integrated 
methods of compliance may be acceptable. However, if the product is 
tightly tied to other systems in the flight deck, either directly or 
by the ways crews use them, it may be necessary to use methods that 
allow the testing of those interactions.
     Novelty/Past Experience: If the technology is mature 
and well understood, less rigorous methods may be appropriate. More 
rigorous methods may be called for if the technology is new, is used 
in some new application, is new for the particular applicant, or is 
unfamiliar to the certification personnel.
     Complexity/Level of Automation: More complex and 
automated systems typically require test methods that will reveal 
how that complexity will manifest itself to the pilot, in normal and 
backup or reversionary modes of operation.
     Criticality: Systems that are central to the interface 
design may require testing in the most realistic environments (high-
quality simulation or flight test), because any problems are likely 
to have serious consequences.
     Dynamics: If the control and display features of the 
product are highly dynamic, the compliance methods should be capable 
of replicating those dynamic conditions.
     Level of Training Required: If the product is likely to 
require a significant amount of training to operate, the interfaces 
may need to be evaluated in an environment that replicates the full 
spectrum of activities in which the pilot may be involved.
     Subjectivity of Acceptance Criteria: Requirements that 
have specific, objectively measurable criteria can often employ 
simpler methods for demonstrating compliance. As the acceptance 
criteria become more subjective, more integrated test methods are 
needed, so that the evaluations take into account the aspects of the 
integrated flight deck that may affect those evaluations.

    The main objective is to carefully match the method to the product 
and the underlying human factors issues. It is also important for the 
Certification Team to recognize that several methods may be acceptable 
for any given requirement and applicants should be allowed to select 
among the acceptable methods, choosing the ones that best fit their 
compliance strategy, schedule, and cost considerations.

5. System Safety Assessments

    Typically, system safety assessments [i.e., Functional Hazard 
Assessment (FHA), Failure Modes and Effects Analysis (FMEA), Fault Tree 
Analysis, etc.] are accomplished by the applicant's engineering group 
that is responsible for each system. However, for each assessment 
planned, the

[[Page 54404]]

applicant should describe how any human factors elements will be 
addressed (such as crew responses to failure conditions) and other 
assumptions that must be made about crew behavior. These assumptions 
should be reviewed by the full Certification Team to ensure that no 
assumptions are being made that will require the flightcrew to 
compensate for failures beyond their expected capabilities. These human 
factors considerations can be documented in the individual system 
safety assessments, or the applicant may elect to describe them in the 
Human Factors Certification Plan, with references to the associated 
system safety assessments.

6. Operational Considerations

    The applicant may have specific goals associated with the 
operational certification of the airplane or system that could 
influence the design and its evaluation. In this section, the applicant 
will typically describe how these operational considerations will be 
integrated into the part 25 aspects of the certification project. It 
would be useful to identify operational requirements that have been 
factored into the type design. For example, the Traffic Alert and 
Collision Avoidance System (TCAS) is mandated as a rule change in part 
121 rather than in part 25.
    This section of the Certification Plan also may include how the 
operational certification, as captured in the following documents, will 
influence the methods of compliance:
     Airplane Flight Manual (AFM),
     Master Minimum Equipment List (MMEL)
     Flightcrew Operating Manual (FCOM), and
     Quick Reference Handbook (QRH).
    Shown below are two examples of how the operational and 
airworthiness considerations may be interdependent:
    Example 1. The applicant may desire MMEL dispatch relief for 
certain systems. In order to ensure that the desired dispatch relief 
will be approved, it may be advantageous to conduct certification 
testing of those configurations (including the next most significant 
failures), to ensure that they are acceptable for normal operations.
    Example 2. In order to help ensure acceptance of the FCOM, it may 
be advantageous to conduct certification testing using the procedures 
and other relevant information that will be included in the FCOM. This 
will enable the members of the Airplane Evaluation Group (AEG) to have 
a high degree of confidence that there will be no human factors 
problems associated with their use.
    The AEG, Flight Standards Operations representatives, and Human 
Factors Specialists on the Certification Team should be involved in the 
review of this section of the Human Factors Certification Plan.

7. Certification Documentation

    The Human Factors Certification Plan should indicate the types of 
documentation that will be submitted to show compliance or otherwise 
document the progress of the certification program. This section may 
list the specific documentation (test report number, analysis report 
number, etc.) that will be used to support compliance with the subject 
regulation. They may also be indicated in the compliance matrix.

8. Certification Schedule

    This section of a Human Factors Certification Plan should include 
the major milestones of the certification program. This may include:
    8.a. Certification Plan Submittals: The Certification Team should 
expect periodic updates to the Human Factors Certification Plan as the 
certification program progresses. The applicant should be encouraged to 
submit the first Human Factors Certification Plan as soon as possible 
after the start of the program. The applicant should be reassured that 
draft, preliminary information is acceptable and appropriate, provided 
that it is updated and finalized in a timely manner (as documented in 
the schedule and agreed to jointly by the FAA and the applicant).
    8.b. Flight Deck Reviews, Early Prototype Reviews, Simulator 
Reviews, and Flight Test Demonstrations: The Human Factors 
Certification Plan can document planned design reviews. Even in cases 
where the reviews are not directly associated with finding compliance, 
they can be very helpful in the following ways:
     Providing the Certification Team with an accurate and 
early understanding of the crew interface tradeoffs and design 
proposals.
     Allow the certification team to provide the applicant with 
early feedback on any potential certification issues.
     Support cooperative teaming between the applicant and the 
certification team, in a manner consistent with the Certification 
Process Improvement initiative.
    8.c. Coordination meetings: Coordination meetings with other 
certification authorities, or meetings with other FAA Aircraft 
Certification Offices on components of the same certification project 
or related projects, should be documented in the schedule.
    The Certification Team can use the information in the schedule to 
determine if sufficient coordination and resources are planned for the 
certification program.

9. Use of Designees and Identification of Individual DER/DAR

    This section should describe how the applicant will make use of 
Designated Engineering Representatives (DER), Designated Airworthiness 
Representatives (DAR), or other designees during the certification 
program.

Appendix A--Partial List of Part 25 Regulations Related to Human 
Factors Issues

    The following list of regulations is divided into the following 
three categories:
    1. General Human Factors Requirements: Rules that deal with the 
acceptability of the flight deck and crew interfaces across a 
variety of systems/features.
    2. Specific Human Factors Requirements: Rules that deal with the 
acceptability of a specific feature or function in the flight deck.
    3. Specific Crew Interface Requirements: Rules that mandate a 
specific system feature, which must be implemented in an acceptable 
manner.
    This list is not intended to include all regulations associated 
with flightcrew interfaces. However, these represent some of the 
requirements for which demonstrating compliance can be problematic. 
In some cases, where only subparagraphs are noted, they have been 
paraphrased for clarity; the applicant should use the exact wording 
of the regulation in all plans and compliance documents.
    In many cases, there may be no precise standard of 
acceptability. Therefore, it is in the applicant's best interest to 
carefully consider and describe how they plan to come to agreement 
with the FAA with respect to compliance. The highlighted words 
identify the key issues that are central to finding compliance and 
that could be addressed using various methods. Following each 
regulatory requirement are notes intended to help the applicant 
select an appropriate method of compliance. Typically, the 
Certification Plan would only identify and generally describe the 
methods to be used. Detailed descriptions of analyses and tests 
would be documented separately (e.g., in test plans), subsequent to 
an agreed-upon Certification Plan. However, the applicant should 
sufficiently develop the plans to assure themselves and the FAA that 
the selected methods are appropriate and adequate.

1. General Human Factors Requirements

 Section 25.771(a) [at amdt. 25-4]:

    Each pilot compartment and its equipment must allow the minimum 
flightcrew to perform their duties without unreasonable 
concentration or fatigue.

[[Page 54405]]

    Discussion: The applicant should carefully consider the aspects 
of the flightcrew interface that might require significant or 
sustained mental or physical effort, or might otherwise result in 
fatigue. Other factors affecting fatigue, such as noise and seat 
comfort, also may need to be evaluated. Methods of compliance should 
be selected based on the potential concentration demands and sources 
of fatigue for the flightcrew. Comparisons to previously 
certificated designs are often a useful method, although testing may 
be warranted for new designs.

 Section 25.771(e) [at amdt. 25-4]:

    Vibration and noise characteristics cockpit equipment may not 
interfere with safe operation of the airplane.
    Discussion: When determining the method of compliance, the 
applicant should carefully consider the types/magnitudes of the 
vibration and noise that may be present under both normal and 
abnormal conditions. Then, tasks that may be affected by vibration 
(e.g., display legibility and the operation of controls) and noise 
(e.g., communication and identification of aural alerts) should be 
identified, as well as the methods that could be employed to 
determine whether or not the vibration or noise will unacceptably 
interfere with safe operation of the airplane.

 Section 25.773(a)(1) [at amdt. 25-72]:

    Each pilot compartment must be arranged to give the pilots 
sufficiently extensive, clear, and undistorted view, to enable them 
to safely perform any maneuvers within the operating limitations of 
the airplane, including takeoff, approach, and landing.
    Discussion: The applicant should carefully consider the method 
of compliance described in FAA Advisory Circular (AC) 25.773-1, 
``Pilot Compartment View for Transport Category Airplanes.''

 Section 25.773(a)(2) [at amdt. 25-72]:

    Each pilot compartment must be free of glare and reflections 
that could interfere with the normal duties of the minimum 
flightcrew.
    Discussion: The applicant may be able to develop analytical 
techniques that identify potential sources of glare and reflections, 
as a means for reducing the risk of problems identified after the 
major structural features have been committed. Mock-ups also may be 
a useful means for early assessments. However, analysis results 
typically must be verified in an environment with a high degree of 
geometric and optical fidelity. Both internal (e.g., area and 
instrument lighting) and external (e.g., shafting sunlight) sources 
of reflections should be considered.

 Section 25.777(a) [at amdt. 25-46]:

    Each cockpit control must be located to provide convenient 
operation and to prevent confusion and inadvertent operation.
    Discussion: The applicant may choose to use physical mock-ups 
for preliminary evaluations. Simulators, if available, provide a 
more powerful evaluation environment, because they allow the 
evaluation to take place in a flight scenario, which may influence 
convenience and inadvertent operation. Simulator evaluations may 
reduce the need for flight testing.

 Section 25.777(c)  [at amdt. 25-46]:

    The controls must be located and arranged, with respect to the 
pilot's seats, so that there is full and unrestricted movement of 
each control without interference from the cockpit structure or the 
clothing of the minimum flightcrew when any member of this 
flightcrew, from 5'2'' to 6'3'' in height, is seated with the seat 
belt and shoulder harness fastened.
    Discussion: The applicant may choose to use analytical methods, 
such as computer modeling of the flight deck and the pilots, for 
early risk reduction and to supplement certification evaluations 
using human subjects. Computer modeling allows for more control over 
the dimensions of the pilot model and, thus, may allow the 
assessment of otherwise unavailable combinations of body dimensions. 
The applicant should carefully consider the advantages and 
limitations of each of these methods.

 Section 25.1301(a) [original amdt.]:

    Each item of installed equipment must be of a kind and design 
appropriate to its intended function.
    Discussion: The applicant may wish to consider a number of 
methods for showing compliance with this requirement, with respect 
to human factors. For example, service experience may be an 
effective means for assessing systems with well-understood, 
successful crew interfaces, assuming that other factors, such as 
changes in the operational environment, do not affect the relevance 
of that experience. Various requirements analysis techniques can be 
used to show that the information that the pilot needs to perform 
key tasks is available, usable, and timely. Simulation may be used 
to verify that properly trained pilots can adequately perform all 
required tasks, using the controls and displays provided by the 
design, in realistic scenarios and timelines. Finally, flight tests 
can be used to investigate specific normal and abnormal operational 
scenarios.

 Section 25.1309(b)(3) [at amdt. 25-41]:

    * * * Systems, controls, and associated monitoring and warning 
means must be designed to minimize crew errors that could create 
additional hazards.
    Discussion: The applicant may wish to perform analyses of crew 
procedures in response to system faults. This can be especially 
important in cases where the applicant wishes to take certification 
credit (e.g., in a Fault Tree Analysis) for correct pilot response 
to a system failure. A crew procedure analysis could be supported by 
performing qualitative evaluations that compare actual procedures to 
procedure design philosophies, by developing measures of procedure 
complexity, or by accomplishing other techniques that focus on 
procedure characteristics that impact the likelihood of crew errors. 
Simulation testing, including the use of untrained (in the new 
design) line pilots, can be helpful in demonstrating that the design 
is not prone to crew errors. Finally, evaluations by highly 
experienced training and test pilots can be a valuable means of 
gathering information on the susceptibility to crew errors.

 Section 25.1321(a) [at amdt. 25-41]:

    * * * Each flight, navigation, and powerplant instrument for use 
by any pilot must be plainly visible to him from his station with 
the minimum practicable deviation from his normal position and line 
of vision when he is looking forward along the flight path.
    Discussion: The applicant may wish to perform analyses of the 
visual angles to each of the identified instruments. Final 
assessments of the acceptability of the visibility of the 
instruments may require a simulator with a high degree of geometric 
fidelity and/or the airplane.

 Section 25.1321(e) [at amdt. 25-41]:

    If a visual indicator is provided to indicate malfunction of an 
instrument, it must be effective under all probable cockpit lighting 
conditions.
    Discussion: Demonstrations and tests intended to show that these 
indications of instrument malfunctions, along with other indications 
and alerts, are visible under the expected lighting conditions will 
typically employ the use of production quality hardware and careful 
control of lighting conditions (e.g., dark, bright forward field, 
shafting sunlight). Simulators and aircraft are often used, although 
supporting data from laboratory testing also may be useful.

 Section 25.1523 [at amdt. 25-3]:

    The minimum flightcrew must be established so that it is 
sufficient for safe operation, considering:
    (a) the workload on individual crewmembers;
    (b) the accessibility and ease of operation of necessary 
controls by the appropriate crewmember; and
    (c) the kind of operation authorized under Sec. 25.1525.
    Discussion: (The factors considered in making the determinations 
required by this section are set forth in Appendix D of this general 
statement of policy.) The applicant may choose to use workload 
analyses (such as time-line analysis) to evaluate certain workload 
issues. Other evaluations of workload typically involve trained 
pilots in either a high fidelity simulation or in actual airplanes. 
There are a number of possible workload assessment techniques that 
can be successfully employed. An efficient means for selecting test 
conditions is to focus on those operational and/or failure scenarios 
that are likely to result in the highest workload conditions. 
Dispatch under the Minimum Equipment List (MEL) also should be 
considered, in combination with other failures that are likely to 
result in significantly increased workload. Since no objective 
standard for workload is available, applicants may wish to compare 
the workload in the new/modified airplane with that in a well-
understood, previously certificated airplane.

 Section 25.1543(b) [at amdt. 25-72]:

    Each instrument marking must be clearly visible to the 
appropriate crewmember.

[[Page 54406]]

    Discussion: The applicant may choose to use computer modeling to 
provide preliminary analysis showing that there are no visual 
obstructions between the pilot and the instrument markings. Where 
head movement is necessary, such analyses also can be used to 
measure its magnitude. Other analysis techniques can be used to 
establish appropriate font sizes, based on research-based 
requirements. Mock-ups also can be helpful in some cases. The data 
collected in these analysis and assessments can be used to support 
final verification in the flight deck, using subjects with vision 
that is representative of the pilot population, in representative 
lighting conditions.

2. Specific Human Factors Requirements

 Section 25.785(g) [at amdt. 25-88]:

    Each seat at a flight deck station must have a restraint system 
. . . that permits the flight deck occupant, when seated with the 
restraint system fastened, to perform all of the occupant's 
necessary flight deck functions.
    Discussion: The applicant may choose to develop a list of what 
it considers to be necessary flight deck functions, under normal and 
abnormal conditions. Methods similar to those used to show 
compliance with Sec. 25.777 also may be appropriate for 
demonstrating compliance with this paragraph, with the additional 
consideration of movement constraints imposed by the full restraint 
system.

 Section 25.785(l) [at amdt. 25-88]:

    The forward observer's seat must be shown to be suitable for use 
in conducting the necessary enroute inspections.
    Discussion: The applicant may choose to develop a set of 
requirements (e.g., what must be seen and reached) based on the 
expected tasks to be performed by an inspector. Computer-based 
analysis and/or mock-ups can be used to develop supporting data; 
evaluation of enroute inspection scenarios can be used to verify 
that all required tasks can be performed. Since the geometric 
relationship between the observer's seat and the rest of the flight 
deck (including the pilots) is important, the evaluations often must 
occur in the actual airplane.

 Section 25.1141(a) [at amdt. 25-72]:

    Each powerplant control must be located so that it cannot be 
inadvertently operated by persons entering, leaving, or moving 
normally in the cockpit.
    Discussion: This type of assessment typically requires at least 
a physical mock-up, due to limitations in the ability to adequately 
model ``normal'' movement in the cockpit. Evaluations should be 
designed to include cases in which the pilots must reach across the 
area surrounding the powerplant controls and to look for places 
where pilots will naturally place their hands and feet during 
ingress and egress, and during cruise.

 Section 25.1357(d) [original amdt.]:

    If the ability to reset a circuit breaker or replace a fuse is 
essential to safety during flight, that circuit breaker or fuse must 
be located and identified so that it can be readily reset or 
replaced in flight.
    Discussion: The applicant may choose to use methods similar to 
those employed for Sec. 25.777 to demonstrate the ability of the 
pilot to reach the specific circuit protective device(s). The 
applicant also should consider how to evaluate the ability of the 
pilot to readily identify the device(s), whether they are installed 
on a circuit breaker panel or controlled using an electronic device 
(i.e., display screen on which the circuit breaker status can be 
displayed and controlled).

 Section 25.1381(a)(2) [at amdt. 25-72]:

    The instrument lights must be installed so that * * * (ii) no 
objectionable reflections are visible to the pilot.
    Discussion: See the discussion of Sec. 25.773(a), above.

3. Specific Crew Interface Requirements

 Section 25.773(b)(2)(i) [at amdt. 25-72]:

    The first pilot must have a window that is openable * * * and 
gives sufficient protection from the elements against impairment of 
the pilot's vision.
    Discussion: While the applicant may perform analyses to show 
that the visual field through the openable window, due to the nature 
of the task (landing the airplane by looking out the opened window), 
it is likely that a flight test would be the most appropriate method 
of compliance. Assessment of the forces required to open the window 
under flight conditions may also be needed.

 Section 25.1322 [at amdt. 25-38]:

    If warning, caution, or advisory lights are installed in the 
cockpit, they must, unless otherwise approved by the Administrator, 
be:
    (a) Red, for warning lights (lights indicating a hazard which 
may require immediate corrective action);
    (b) Amber, for caution lights (lights indicating the possible 
need for future corrective action);
    (c) Green for safe operation lights; and
    (d) Any other color, including white, for lights not described 
in paragraphs (a) through (c) of this section, provided the color 
differs sufficiently from the colors prescribed in paragraphs (a) 
through (c) of this section to avoid possible confusion.
    Discussion: Compliance with this requirement is typically shown 
by a description of each of the warning, caution, and advisory 
lights. Evaluations may also be useful to verify the chromaticity 
(e.g., red looks red, amber looks amber) and discriminability (i.e., 
colors can be distinguished reliably from each other) of the colors 
being used, under the expected lighting levels. These evaluations 
can be affected by the specific display technology being used, so 
final evaluation with flight quality hardware is sometimes needed. A 
description of a well-defined color coding philosophy that is 
consistently applied across flight deck systems can be used to show 
how the design avoids ``possible confusion.''

Appendix B--Related Documents

1. Williams, James H., ``Description of the FAA Avionics Certification 
Process,'' FAA Document, April 23, 1997

    This document is a high level explanation of the FAA approach to 
certification of avionics. It addresses the major aspects of the 
certification process including:
     Design approvals under the Type Certificate (TC) or 
Supplemental Type Certificate (STC) approval process;
     Design approvals under the Technical Standard Order 
(TSO) approval process;
     Installation approvals for initial (new) avionics 
following a TSO approval;
     Installation approvals using the FAA Form 337 (``Major 
Repair and Alteration: Airframe, Powerplant, Propeller, or 
Appliance'') process.
    This document will help the applicant become familiar with the 
FAA process to certify avionics. The certification process is laid 
out in a flowchart format. This document is available on the 
Internet at http://www.faa.gov/avr/air/air100/100home.htm.

2. FAA Booklet, ``The FAA Type Certification Process,'' Aircraft 
Certification Service, May 1996

    The FAA's Aircraft Certification Service issued this document 
for both internal use and industry guidance. It describes the 
important steps in the process leading to issuance of a type 
certificate. Discussion includes descriptions of roles, 
responsibilities, and job functions of participants in the process, 
and provides a listing of the ``best practices'' that the FAA can 
follow to do its job well. It also describes the use of a 
Certification Plan as a key communication tool during the 
certification process.

3. FAA Order 8110.4A, ``Type Certification Process,'' March 2, 1995; 
and

4. FAA Order 8110.5, ``Aircraft Certification Directorate Procedures,'' 
October 1, 1982

    These Orders prescribe the responsibilities and procedures for 
FAA aircraft certification engineering and manufacturing personnel 
when accomplishing the evaluation and approval of aircraft type 
design data and changes to approved type design data. These Orders 
contain descriptions of Certification Plans and how FAA personnel 
can use them during the certification process. These documents are 
can be found on the Internet at:

http://www.mmac.jccbi.gov/afs/afs600/fdr/8110-4a.pdf
    and
http://av-info.faa.gov/dst/8100-5.doc

5. Advisory Circular (AC) 21-40, ``Application Guide for Obtaining a 
Supplemental Type Certificate,'' May 6, 1998

    This advisory circular contains guidance for preparing a 
Certification Plan for a supplemental type certification project. 
Figure 2-4 of the AC suggests that applicants use a specific format 
for the plan and provides a sample of it, which includes the 
following nine sections:

1. Introduction

[[Page 54407]]

2. System description
3. Certification requirements
    (a) Regulations
    (b) Special requirements, unique or novel design aspects
    (c) Compliance checklist
4. Methods of compliance
5. Functional hazard assessment
6. Operational considerations (if required)
7. Certification documentation
8. Certification schedule
9. Use of designees and identification of individual Designated 
Engineering Representatives (DER)/Designated Airworthiness 
Representatives (DAR)

    These sections, and the material they contain, are appropriate 
for any applicant's Certification Plan. They also could be applied 
to the development of a Human Factors Certification Plan. This 
document can be found on the Internet at http://www.faa.gov/avr/air/
acs/achome.htm.

6. Society of Aeronautical Engineers (SAE) Aerospace Recommended 
Practice 4033, ``Pilot-System Integration,'' August 1995

    This document provides a concept development guide to the human 
engineering specialist and the aircraft systems designer for pilot-
system integration that will enhance safety, productivity, reduce 
certification risk, and improve cost effectiveness. It addresses the 
resulting processes of system development including aspects of 
interface design and automation philosophy. (SAE publications are 
available from SAE, 400 Commonwealth Drive, Warrendale, PA 15096-
0001; telephone (412) 776-4970; or e-mail at [email protected].)

Appendix C--Sample Human Factors Certification Plan

    This sample plan is intended to provide examples of the types of 
information that could be included in the various sections. Keep the 
following in mind while reviewing it:
     It is based on a totally hypothetical certification 
program, and no connection to any real system or certification 
program is intended or implied.
     There are placeholders where the drawings and other 
figures could be inserted.
     This sample plan should not be considered to be 
comprehensive. The examples are intended to be illustrative, but do 
not necessarily include all of the issues, even for the hypothetical 
program.
     The methods of compliance are intended to show the 
methods that a hypothetical applicant might have chosen for the 
project. It should not be construed as describing the acceptable 
list of methods for any real program. These would have to be 
discussed and agreed upon within the context of a specific program.
     The Deliverable Products column in the compliance 
matrix identifies what the hypothetical applicant will produce to 
substantiate compliance. The titles of reports represent examples of 
how an applicant might choose to package the information.
     Finally, the sample plan is not intended to specify the 
format of the report, but rather, to provide guidance on the 
structure and content only.

[Hypothetical]--Human Factors Certification Plan for the Electronic 
Approach Chart System (EACS)

1. Introduction

    This project seeks a Supplemental Type Certificate for the 
installation of an Electronic Approach Chart System (EACS) in Guerin 
Model 522 airplanes. The intent of the EACS is to provide an 
alternative to the use of paper approach charts. The EACS will be 
installed so that it will be physically and functionally integrated 
into the flight deck. System data will be loaded using existing on-
board data loading capabilities. The EACS will be certified as a 
non-essential system. This Human Factors Certification Plan 
identifies the human factors-related regulations and the methods of 
compliance that will be used to show that all safety-related human 
factors issues have been fully addressed.

2. System Description

    a. Intended Function: The Electronic Approach Chart System uses 
a panel-mounted Active Matrix Liquid Crystal Display (AMLCD) to 
display approach charts for the pilots to use on the ground and in 
flight. The key functions include the following:
    (1) During the preflight preparation:
    (a) The pilot will use the system to call up and review the 
approach charts for the destination airport and selected alternates.
    (b) The pilot will be able to ``mark'' the appropriate charts 
for quick retrieval later in the flight.
    (c) If initiated by the pilot, the system will be able to query 
the Flight Management System (FMS) to pre-identify the appropriate 
charts, based on the flight plan.
    (2) During flight (normal operations):
    (a) The pilot will quickly access the preselected approach 
charts. Charts that were not preselected will also be accessible.
    (b) The pilot will be able to manipulate the display of the 
chart to show only the information relative to the planned route of 
flight.
    (c) The pilot will be able to select the appropriate approach 
parameters (transition, approach navigation aids, minimums, etc) 
using the EACS. Upon pilot initiation, the EACS will load these 
selections into the other systems on the airplane [e.g., approach 
navaids will be sent to the FMS for autotuning, decision height (DH) 
will be sent to altitude alerting system and display system]. For a 
complete list of EACS functions, see the EACS System Description 
Document.
    (3) During flight (non-normal operations, i.e., requiring an 
emergency diversion): In addition to those functions available for 
normal operations, the EACS provides the following functionality to 
support emergency diversions.
    (a) When the pilot selects the ALTERNATE AIRPORT function on the 
FMS, the FMS automatically identifies the five nearest airports that 
meet the landing requirements for the airplane. These airports will 
be automatically transmitted to the EACS, which will preselect them 
(mark them for quick retrieval).
    (b) At the pilot's request, the EACS will display a listing of 
the diversion airports and allow the pilot to quickly review the 
approach charts and select the desired approach. As in normal 
operations, this selection will be automatically transmitted to the 
FMS and other using systems.
    b. Flight Deck Layout Drawings:
    (1) Figure 1 and Figure 2 are drawings showing the installation 
location for the EACS displays, on an angled panel just outboard of 
each pilot's main instrument panel and forward of the side console. 
[Figures 1 and 2 would be shown here.]
    (2) Figure 3 is a drawing of the EACS display unit with 
integrated touch screen, function selection buttons, and brightness 
control. [Figure 3 would be shown here.]
    (3) Display formats are still in development and will be 
provided according to the following schedule shown in Figure 4. 
[Schedule would be shown here.]
    c. Underlying Principles for Crew Procedures:
    (1) Normal operations: The procedures for certain consistent 
navigation functions are imbedded in the FMS software, which walks 
the pilot through all necessary preflight and descent preparation 
steps. This is accomplished using a sequence of prompts, followed by 
a message when all required steps are completed. Wherever use of the 
EACS is called for in these existing sequences of tasks, the FMS 
software will be modified to include the appropriate prompts. Other 
ad hoc uses for the EACS will be at the pilots' discretion, as is 
the case with the other navigation and flight planning functions 
within the FMS.
    (2) Procedures for dealing with EACS and FMS failures: Any such 
procedures will be driven by the following operational principles:
    (a) The number of procedures and the number of steps in the 
procedures should be minimized.
    (b) All diagnosis of system problems are to be accomplished by 
the system (i.e., there will be no crew procedures for diagnosing 
problems).
    (c) There will be no crew procedures that require the use of the 
EACS circuit breaker.
    (d) The pilots will not be required to learn alternative modes 
of interaction (i.e., if the touch screen fails, the pilots will not 
interact via a keyboard).
    (e) If the FMS fails, the EACS should continue to operate 
normally, except for those functions associated with EACS-FMS data 
sharing. This continued operation should not be dependent on a pilot 
procedure.
    d. User Pilot Description: The initial certification of this 
system will be in a transport category airplane and is expected to 
be used in both Part 121 and Part 135 operations. As a result, this 
program assumes that the pilot will have only the experience and 
training required for Part 135 operations.
    (1) It is assumed that, as minimum qualifications, the pilots 
are multi-engine, instrument rated, commercial pilots. Minimum 
expected flying hours: 500. No time in type is assumed (first 
exposure to EACS may be during transition training).
    (2) It is assumed that the pilots will have knowledge of 
existing paper approach charts,

[[Page 54408]]

but no experience with electronic presentation of chart information.
    (3) It is assumed that the pilots will receive sufficient 
information/training to allow them to operate the FMS. Additional 
information regarding the use of the EACS should be incorporated 
into the FMS training material.
    (4) The system should be simple and intuitive to operate, so 
that the pilot can become proficient with either 30 minutes of 
computer-based training, or with written material plus 30 minutes of 
hands-on practice on the airplane (on the ground).
    e. Description of the Operating Environment for the Airplane: 
The following is a partial description of the operating environment 
anticipated for the flight deck design:
    (1) Expected operational rules under which the airplane will be 
operated: Part 121, Part 135.
    (2) Air Traffic Control (ATC) environment: The system must be 
compatible with all currently planned FMS operations, including the 
following:
    (a) Full area navigation (RNAV) capability,
    (b) Required time of arrival (RTA),
    (c) Required Navigation Performance (RNP), using GPS as the 
primary means of navigation.
    (d) Aeronautical Telecommunications Network (ATN) Controller 
Pilot Datalink Communications.
    (3) Airport types, conditions, facilities: The system shall 
support any airport types suitable for transport category airplanes.
    (4) Geographic areas of operation and associated terrain and 
weather issues: The system should support the display of any special 
terrain feature currently available on paper charts. However, that 
information may be displayed in a different way, appropriate for the 
selected display device.

3. Compliance Matrix for Part 25 Regulations Related to Flightcrew 
Human Factors

----------------------------------------------------------------------------------------------------------------
                                      General human factors (HF)       Method(s) of
       Section [Amdt. Level]                 requirements               compliance          Deliverable product
----------------------------------------------------------------------------------------------------------------
Sec.  25.771(a) [at amdt. 25-4]....  Each pilot compartment and   Analysis, Simulator     Workload Certification
                                      its equipment must allow     test, Flight test.      Report.
                                      the minimum flightcrew to
                                      perform their duties
                                      without unreasonable
                                      concentration or fatigue.
Sec.  25.771(e) [at amdt. 25-4]....  Vibration and noise          Bench test............  Test report.
                                      characteristics cockpit
                                      equipment may not
                                      interfere with safe
                                      operation of the airplane.
Sec.  25.773(a)(1) [at amdt. 25-72]  Each pilot compartment must  Similarity............  Vision Certification
                                      be arranged to give the                              Report.
                                      pilots sufficiently
                                      extensive, clear, and
                                      undistorted view, to
                                      enable them to safely
                                      perform any maneuvers
                                      within the operating
                                      limitations of the
                                      airplane, including
                                      takeoff, approach, and
                                      landing.
Sec.  25.773(a)(2) [at amdt. 25-72]  Each pilot compartment must  Ground test...........  Lighting Certification
                                      be free of glare and                                 Report.
                                      reflections that could
                                      interfere with the normal
                                      duties of the minimum
                                      flightcrew.
Sec.  25.777(a) [at amdt. 25-46]...  Each cockpit control must    Simulator test,.......  Flight Deck
                                      be located to provide       Flight test.             Anthropometry
                                      convenient operation and                             Certification Report.
                                      to prevent confusion and
                                      inadvertent operation.
Sec.  25.777(c) [at amdt. 25-46]...  The controls must be         Ground test...........  Flight Deck
                                      located and arranged, with                           Anthropometry
                                      respect to the pilot's                               Certification Report.
                                      seats, so that there is
                                      full and unrestricted
                                      movement of each control
                                      without interference from
                                      the cockpit structure or
                                      the clothing of the
                                      minimum flightcrew when
                                      any member of this
                                      flightcrew, from 5'2'' to
                                      6'3'' in height, is seated
                                      with the seat belt and
                                      shoulder harness fastened.
Sec.  25.1301(a) [original amdt.]].  Each item of installed       System description....  System Description
                                      equipment must be of a      Simulator                Document.
                                      kind and design              demonstration          Demonstration Report.
                                      appropriate to its          Flight test             Flight Test Report.
                                      intended function.
Sec.  25.1309(b)(3) [at amdt. 25-    * * * Systems, controls,     Hazard assessment.....  Fault tree analyses.
 41].                                 and associated monitoring   Simulator               Demonstration Report.
                                      and warning means must be    demonstration.
                                      designed to minimize crew
                                      errors that could create
                                      additional hazards.
Sec.  25.1321(a) [at amdt. 25-41]..  * * * Each flight,           System description      Installation drawings.
                                      navigation, and powerplant   Analysis.              Vision Certification
                                      instrument for use by any   Flight test              Report.
                                      pilot must be plainly                               Flight Test report.
                                      visible to him from his
                                      station with the minimum
                                      practicable deviation from
                                      his normal position and
                                      line of vision when he is
                                      looking forward along the
                                      flight path.
Sec.  25.1321(e) [at amdt. 25-41]..  If a visual indicator is     Similarity............  System description and
                                      provided to indicate        Ground test              Statement of
                                      malfunction of an                                    Similarity.
                                      instrument, it must be                              Flight Test report.
                                      effective under all
                                      probable cockpit lighting
                                      conditions.
Sec.  25.1523 [at amdt. 25-3]......  The minimum flightcrew must  Simulator test........  Demonstration report.
                                      be established so that it   Flight test             Flight Test report.
                                      is sufficient for safe
                                      operation, considering:
                                     (a) the workload on
                                      individual crewmembers;
                                     (b) the accessibility and
                                      ease of operation of
                                      necessary controls by the
                                      appropriate crewmember;
                                      and
                                     (c) the kind of operation
                                      authorized under Sec.
                                      25.1525.
                                     The criteria used in making
                                      the determinations
                                      required by this section
                                      are set forth in Appendix
                                      D.
Sec.  25.1543(b) [at amdt. 25-72]..  Each instrument marking      Analysis..............  Vision certification
                                      must be clearly visible to  Similator test           report.
                                      the appropriate crewmember.                         Demonstration report.
----------------------------------------------------------------------------------------------------------------
                                         SYSTEM-SPECIFIC HF REQUIREMENTS
----------------------------------------------------------------------------------------------------------------
Sec.  25.1381(a)(2) [at amdt. 25-    The instrument lights must   Ground test...........  Flight Test report.
 72].                                 be installed so that (ii)
                                      no objectionable
                                      reflections are visible to
                                      the pilot.
----------------------------------------------------------------------------------------------------------------
 
[[Page 54409]]

 
                                      SPECIFIC CREW INTERFACE REQUIREMENTS
----------------------------------------------------------------------------------------------------------------
Sec.  25.773(b)(2)(i) [at amdt. 25-  The first pilot must have a  Ground test (to verify  Flight Test report.
 72].                                 window that is openable *    no interference with
                                      * * and gives sufficient     window opening).
                                      protection from the
                                      elements against
                                      impairment of the pilot's
                                      vision.
Sec.  25.1322 [at amdt. 25-38].....  If warning, caution, or
                                      advisory lights are
                                      installed in the cockpit,
                                      they must, unless
                                      otherwise approved by the
                                      Administrator, be--
                                     (a) Red, for warning lights
                                      (lights indicating a
                                      hazard which may require
                                      immediate corrective
                                      action);
                                     (b) Amber, for caution
                                      lights (lights indicating
                                      the possible need for
                                      future corrective action);
                                     (c) Green for safe
                                      operation lights; and
                                     (d) Any other color,         Similarity............  System Description
                                      including white, for                                 Document.
                                      lights not described in
                                      paragraphs (a) through (c)
                                      of this section, provided
                                      the color differs
                                      sufficiently from the
                                      colors prescribed in
                                      paragraphs (a) through (c)
                                      of this section to avoid
                                      possible confusion.
----------------------------------------------------------------------------------------------------------------

4. System Safety Assessments

    Each Fault Tree that includes a pilot response to a failure 
condition will include an assessment in accordance with AC 25.1309. 
In addition, any specific design features intended to increase the 
likelihood of correct pilot response will be noted in the system 
safety assessment.

5. Operational Considerations

    The EACS is intended to replace the routine use of paper charts 
during all expected operations. It should be noted that design of 
this system is predicated on the assumption that if the system 
experiences a total failure, the pilots will revert to the use of 
paper charts. Because of this and the need to minimize the training 
burden, basic flight operations for the airplane will be unaffected 
by the incorporation of this system (no change in airplane 
capability or interaction with the airspace). Changes in pilot 
activities will be restricted to the way in which approach chart 
information is selected, accessed, and viewed. The following 
documents are expected to be modified as a result of the 
incorporation of EACS:
     Master Minimum Equipment List (MMEL).
     Flightcrew Operating Manual (FCOM).
     Flightcrew Training Manual.

6. Certification Documentation

    Several documents will be produced that are intended to 
summarize the certain major human factors certification topics:
    a. Workload-related issues [Sec. 25.771(a) and Sec. 25.1523] 
will be covered in the Workload Certification Report. This will 
contain procedure analysis, timeline analysis, Pilot Subjective 
Evaluation results, and an overall summary of the workload 
considerations, as described in 14 CFR part 25, Appendix D.

    Note: Workload related data gathering during flight test is 
expected to be conducted concurrently with other scheduled flight 
tests (i.e., no dedicated workload test flights).

    b. Internal and External Vision issues [Sec. 25.773(a)(1), 
Sec. 25.1321(a), Sec. 25.1543(b), Sec. 25.785(l)] will be covered in 
the Vision Certification Report. This report will contain internal 
and external vision analyses, and a summary of pilot assessments.
    c. Flight deck lighting issues [Sec. 25.773(a)(2), 
Sec. 25.1321(e), Sec. 25.1381(a)(2)] will be covered in the Lighting 
Certification Report. This report will include the results of 
reflection measurements and pilot assessments from ground tests and 
flight tests.
    d. Issues associated with the physical arrangement of the flight 
deck with respect to pilot reach, clearance, and interference 
[Sec. 25.777(a) and (c)], will be covered in the Flight Deck 
Anthropometry Certification Report.

    Note: No computer modeling is planned. Testing will be done 
using human subjects with representative body dimensions.

    e. Other documentation cited in the compliance matrix will be 
finalized as the testing plans develop. For most of the flight 
testing, during which human factors certification tests will be 
conducted concurrently with other planned testing, the human factors 
results will be documented in the overall test report.

7. Certification Schedule

    The following schedule (Figure 5) indicates the approximate 
timing of the major human factors analysis/demonstration/test 
activities, planned updates to the Human Factors Certification Plan, 
and planned coordination meetings for the discussion of human 
factors certification issues. This schedule will be refined and 
adjusted as the certification program develops.

                            Figure 5.--Flight Crew Operations Certification Schedule
                                   [Start Date: 8/1/1999; End Date: 4/15/2000]
----------------------------------------------------------------------------------------------------------------
                                                                        1999                      2000
                          Milestone                          ---------------------------------------------------
                                                               Quarter 3    Quarter 4    Quarter 1    Quarter 2
----------------------------------------------------------------------------------------------------------------
Initial FAA Project Concept Discussion Meeting..............          6/1  ...........  ...........  ...........
Certification Plan Submittals...............................          8/1  ...........  ...........  ...........
Initial FAA Project Familiarization--draft drawings, etc....          9/1  ...........  ...........  ...........
FAA Simulator Demonstrations................................         9/15  ...........  ...........  ...........
FAA Simulator Demonstrations................................  ...........        10/10  ...........  ...........
FAA Procedures Simulator Demos..............................  ...........        10/30  ...........  ...........
Workload Compliance Demonstrations..........................  ...........        11/15  ...........  ...........
List of Dispatch Conditions and Might Failures..............  ...........        11/15  ...........  ...........
Flight Test Program.........................................  ...........        12/15  ...........  ...........
Certification Document Submittals...........................  ...........  ...........          1/5  ...........
Draft Crew Ops Cert Document................................  ...........  ...........          3/1  ...........
Workload 8110 Cert Report...................................  ...........  ...........  ...........          4/1
Final Crew Ops Cert. Document...............................  ...........  ...........  ...........         4/15
----------------------------------------------------------------------------------------------------------------


[[Page 54410]]

8. Use of Designees and Identification of Individual DER/DAR

    The applicant recommends that the majority of the findings of 
compliance be delegated to the pilot DER. Final assessment of 
compliance with Sec. 25.1523 should include FAA participation in 
flight test involving specific high workload scenarios. The FAA 
should also participate in ground testing for display legibility.

Appendix D--Quick Reference Guide for Reviewing Human Factors 
Certification Plans

    This form can be used when reviewing an applicant's 
Certification Plan.

------------------------------------------------------------------------
                                                    Yes     No      N/A
------------------------------------------------------------------------
1. Introduction.................................
2. System description:
  a. Intended function from pilot's perspective.
  b. Flight deck layout drawings................
  c. Underlying principles for crew procedures..
  d. Assumed pilot characteristics..............
  e. Description of the operating environment
   for the airplane.............................
3. Certification requirements:
  a. Regulations................................
  b. Special requirements, unique or novel
   design aspects...............................
  c. Compliance checklist.......................
4. Methods of compliance........................
5. System safety assessment.....................
6. Operational considerations...................
7. Certification documentation..................
8. Certification schedule.......................
9. Use of designees and identification of
 individual Designated Engineering
 Representative (DER)/Designated Airworthiness
 Representative (DAR)...........................
------------------------------------------------------------------------

    Issued in Renton, Washington, on September 29, 1999.
Vi L. Lipski,
Acting Manager, Transport Airplane Directorate, Aircraft Certification 
Service.
[FR Doc. 99-26047 Filed 10-5-99; 8:45 am]
BILLING CODE 4910-13-U