Keywords

1 Introduction

Controls are the primary means of interfacing with the system. The term “controls” is used here to refer to the hardware and software related to an input device, the label, and other components that address its intended function [1]. Conventional aircraft control devices consist of buttons, knobs, keyboards, and switches, but cursor control devices, such as a mouse, touchpad, trackball, or joystick are becoming more frequent. Each control device has unique characteristics that may affect the design of the functions being controlled. Consideration must be given to the appropriateness of a control to a particular application and/or system and its usability.

2 General Evaluation Principles

Flight deck controls must be installed to allow accomplishment of all the tasks required to safely perform the equipment’s intended function, and information must be provided to the flightcrew that is necessary to accomplish the defined tasks [2].

Flight deck controls and information intended for the flightcrew’s use must:

  • Be provided in a clear and unambiguous manner, at a resolution and precision appropriate to the task.

  • Be accessible and usable by the flightcrew in a manner consistent with the urgency, frequency, and duration of their tasks, and

  • Enable flightcrew awareness, if awareness is required for safe operation, of the effects on the airplane or systems resulting from flightcrew actions.

For each of these requirements, the proposed means of compliance should include consideration of the following control characteristics for each control individually and in relation to other controls [3]:

  • Physical location of the control.

  • Physical characteristics of the control (e.g., shape, dimensions, surface texture, range of motion, colour).

  • Equipment or system(s) that the control directly affects.

  • How the control is labelled.

  • Available control settings.

  • Effect of each possible actuation or setting, as a function of initial control setting or other conditions.

  • Whether there are other controls that can produce the same effect (or affect the same target parameter) and conditions under which this will happen.

  • Location and nature of control actuation feedback.

Controls shall be designed so as to minimize the risk of erroneous or inadvertent operation. The following criteria should be met:

  • Identification shall be facilitated by logical arrangement and coding of controls. (Differing shapes, sizes, colours, etc.)

  • Control position shall be readily discernible in all lighting conditions.

  • Differing types of control shall be limited to the minimum, sense of actuation standardized and related effect made as uniform as possible. Keyboards and rotary controls are preferred to thumb wheels and slew controls.

  • Where appropriate, detents shall be provided f o r each unit or increment of the control1ed parameter (e.g., degrees, KHz).

  • Safety devices (gate, balk, and override) shall be designed to prevent incorrect or premature selection.

  • Where damage to the aircraft can result from exceeding a placarded limitation, initial movement of a control (e.g., flap, landing gear) should excite the appropriate aural or visual alert.

Controls should be designed to maximize usability, minimize flight crew workload, and reduce pilot errors. The recommendations for manual control functions is shown in Table 1.

Table 1. Recommended manual controls
Full size table

3 Arrangement and Accessibility Evaluation Principles

3.1 Environment and Use Conditions

Consider a variety of environments, use conditions, and other factors that can impact flightcrew interaction with controls during aircraft operations that can be reasonably expected in service, including:

  • Appropriate representation of pilot population;

  • Bright and dark lighting conditions;

  • Use of gloves;

  • Turbulence and other vibrations;

  • Interruptions and delays in tasks;

  • Objects that may physically interfere with the motion of a control;

  • Incapacitation of one pilot (multi-crew aircraft);

  • Use of the non-dominant hand; and

  • Excessive ambient noise.

Since all possible environment and use conditions cannot be specifically addressed, develop a representative set that includes nominal and worst cases. These cases should cover the full environment in which the system is assumed to operate, given its intended function. This includes operating in normal, non-normal, and emergency conditions. The following paragraphs describe the above list of environment and use conditions in more detail.

Controls are designed with an assumption of a certain range of pilot attributes. These assumptions may include physical attributes, such as body size and proportion, and non-physical attributes, such as experience with a given type of controls.

Controls should be operable under foreseeable lighting conditions. Labels and other information related to a control’s function and method of operation should be readable over a wide range of ambient illumination, including, but not limited to:

  • Direct sunlight on the controls;

  • Indirect sunlight through a front window illuminating white clothing (reflections);

  • Sun above the forward horizon and above a cloud deck in a flightcrew member’s eyes; and

  • Night and/or dark environment.

3.2 Layout and Organization

Controls shall be located so that they are accessible to the crew member to whom they are assigned.

Controls for managing the information content of flight and navigation displays shall be located in a prime position for each pilot. It is desirable that both pilots be able to operate the controls of both pilots’ displays.

The controls of individual equipment which are functionally and directly related shall be grouped together. Controls for equipment not clearly related by function can be separated.

Controls which are likely to be operated simultaneously by both pilots shall be located and arranged so as to minimize the risk of physical interference.

Normal operation of controls shall not obscure the associated display from the pilot’s view.

For compliance with § 25.777, the flightcrew must be able to see, identify, and reach the means of controlling the HUD, including its configuration and display modes, from the normal seated position. To comply with §§ 25.777 and 25.1301, the position and movement of the HUD controls must not lead to inadvertent operation [6].

For compliance with § 25.777, the flightcrew must be able to see, identify, and reach the means of controlling the HUD, including its configuration and display modes, from the normal seated position. To comply with §§ 25.777 and 25.1301, the position and movement of the HUD controls must not lead to inadvertent operation.

The dimensions and location of the input device should be usable by the 5th through 95th percentile of the end user population, when appropriately clothed and equipped [7].

Pilots might wear gloves during operations, such as in cold weather. Design assumptions regarding skin contact (e.g., tactile feedback, system capacitive sensing), finger size (e.g., button spacing), and other finger characteristics alone might not adequately cover situations in which pilots wear gloves. Therefore, include gloved pilot operations in environment and use conditions. In cases where controls cannot be operated with gloves, clearly describe any limitations or methods for determining limitations, in the aircraft flight manual or flight manual supplement, as appropriate.

4 Operation and Usability Evaluation Principles

4.1 Movement of Controls

Control devices typically transform their movement and/or force to achieve a control’s function. Ensure that the interaction between a control and its related elements (e.g., aircraft systems, displays, indications, labels) are readily apparent, understandable, logical, and consistent with applicable cultural conventions and with similar controls in the same flight deck. Table 2 provides examples of conventional relationships between the movement of a control and its function.

Table 2. Examples of Conventional Relationships between Control Functions and Movements.
Full size table

4.2 Sensitivity and Gain of Controls

Since many controls transform their movement and force to achieve a function, the gain or sensitivity is a key design parameter. In particular, it strongly affects the trade-off between task speed and error. High gain values tend to favour pilot comfort and rapid inputs, but can also contribute to errors (e.g., overshoot, inadvertent activation). Low gain values tend to favor tasks that require precision, but can also be too slow for the task. Gain and sensitivity of the control typically need to be traded off to support the intended function. Give special consideration to variable-gain controls. Accurately replicate the response lag and control gain characteristics that will be present in the actual airplane, and show that gain and sensitivity of the control are acceptable for the intended function.

4.3 Feedback of Controls

Design the controls to provide feedback to the pilot when operated. Feedback from controls provides pilots with awareness of the effects of their inputs, including the following effects, as applicable:

  • Physical state of the control device (e.g., position, force);

  • State of data construction (e.g., text string);

  • State of activation or data entry (e.g., “enter”);

  • State of system processing;

  • State of system acceptance (e.g., error detection); and

  • State of system response (e.g., cursor position, display zoom, autopilot disconnect).

Feedback can be visual, aural, and/or tactile. If feedback/awareness is required for safe operation, it should be provided to inform the flightcrew of the following conditions:

  • State of activation or data entry;

  • State of system processing (for extended processing times); and

  • State of system response, if different from the commanded state.

Provide clear, unambiguous, and positive feedback to indicate the successful or unsuccessful actuation of a control action. Feedback within the control device (such as the tactile snap of a switch) without any other system effect should not be the sole means of detecting the actuation of a control.

The type, response time, duration, and appropriateness of feedback will depend upon the pilots’ task and the specific information required for successful operation.

The final display response to control input should be fast enough to prevent undue concentration being required when the flightcrew sets values or display parameters (§25.771(a)). The specific acceptable response times depend on the intended function.

Once a control device is activated, if processing time is extended it might be appropriate to display progress to provide the pilot with a sense of time remaining for completion.

If control device position is the primary means of indicating the status of a function (e.g., switch in the Up position indicates that the function is On), the control position should be obvious from any pilot seat.

When a control is used to move an actuator through its range of travel, the equipment should provide operationally significant feedback of the actuator’s position within its range.

Show that feedback is adequate in performance of the tasks associated with the intended function of the equipment.

4.4 Identifiable and Predictable Controls

Pilots must be able to identify and select the current function of the control with speed and accuracy appropriate to the task, per § 25.777(a). Make the function and method of operation of a control readily apparent (i.e., predictable and obvious), so that little or no familiarization is needed. Show that the intended pilot population can rapidly, accurately and consistently identify and execute all control functions, assuming qualified and trained pilots.

The applicant should evaluate consequences of control activation to show that the consequences are predictable and obvious to each flight crewmember. Such an assessment would include evaluation of the control of multiple displays with a single device and evaluation of shared display areas that flightcrew members access with individual controls. The use of a single control should also be evaluated.

Controls can be made distinguishable or predictable by differences in attributes such as form, colour, location, and labeling. For example, buttons, which are pushed, should be readily discernable from knobs, which are rotated. Control shapes that are easily determined with tactile senses can improve ease of operation, particularly during periods when pilot tasks require significant visual attention.

Colour coding as a sole distinguishing feature is usually not sufficient. This applies to physical controls as well as to controls that are part of an interactive graphical user interface.

The labeling design should avoid hidden functions such as clicking on empty space on a display to make something happen.

4.5 Labeling of Controls

Control labels must be visible, legible, and understandable for the population of pilots that will use the controls, per § 25.1555(a).

Unless the control function and method of operation are obvious or indicated through other means (e.g., form, location), the control labeling scheme should clearly and unambiguously convey:

  • The current function performed by each control,

  • The method for actuating the control when performing the current function.

Size control labels to be easily legible from the pilot’s normally seated position [8].

For controls using icons in lieu of text labeling, substantiate that pilots, with the minimum expected training program, can adequately perform their duties at an acceptable level of workload, as required by normal, non-normal, and emergency situations. If appropriate, consider incorporating icons in controls to complement rather than replace text labels (e.g., continuous text display, temporary “mouseover” display).

If multiple controls exist for the same function, clearly label all such controls. Exceptions can include alternate controls that provide flexibility to accommodate a wide range of pilots.

If multiple controls exist (multi-crew aircraft) for the same function, show that there is sufficient information or other means available to make each crewmember aware of which control is currently functioning.

Use only one abbreviation and/or one icon for labeling a function. This is to prevent confusion when a label appears in multiple locations.

Ensure that the labels resist scratching, hazing, erasure, disfigurement, and other legibility degradation that might result from normal use.

4.6 Controls Lighting

For controls with visual markings that are intended for use in low-light conditions, the markings must be lighted in some way that allows them to be easily read, for compliance with § 25.1555(a) and § 25.1381(a).

Ensure that lighting of controls is consistent with flightcrew alerting such as warning, caution, and advisory lights (§ 25.1322).

For low-light conditions, make lighted controls dimmable to brightness levels commensurate with other flight deck instrument lighting. This allows for the flightcrew’s adaptation to the dark, so controls are legible, and outside vision is maintained.

Ensure that lighting of controls from an internal source is not dimmable to brightness levels so low that the controls appear inactive.

Ensure that lighting of controls from an internal source does not produce light leaks, bright spots, or reflections from the windshield that can interfere with pilot vision or performance.

Automatic adjustment of lighted controls may be employed. Consider preference differences in multi-crew operations.

Ensure that lighted controls intended for operation in a night vision imaging system (NVIS) lighting-modified cockpit meets AC 20-175, 2-9.a through 2-9.e, and are compatible with night vision goggles (NVG).

4.7 Prevention Inadvertent Operation of Controls

Protect controls against inadvertent operation. This type of error can occur for various reasons, such as when a pilot accidentally bumps a control, or accidentally actuates one control when intending to actuate a different control.

Provide mitigation for inadvertent operation as appropriate. Consider these questions when designing and installing the control:

  • Are there any safety-critical consequences if the pilot is not aware of the inadvertent operation?

  • What will the pilot need to do to correct an inadvertent operation?

  • Is the control designed to support “eyes free” use (i.e., when the pilot is not looking at the control)?

  • Are there aspects of the design that will decrease the likelihood of inadvertent operation?

  • Are there aspects of the design that will increase the likelihood of the pilot detecting an inadvertent operation?

The following paragraphs provide multiple methods that reduce the likelihood of inadvertent operation of controls.

  • Location & Orientation. Title § 25.777 requires controls to be located to prevent inadvertent operation. Locate, space, and orient controls so that the operator is not likely to strike or move them accidentally in the normal sequence of control movements. For example, switches located close to a frequently-used lever could be oriented so the axis of rotation for the switches is perpendicular to the axis of rotation for the lever.

  • Physical Protection. Physical obstructions can be built into the design of a control to prevent accidental actuation of the control. Examples include: recessed controls, shielded controls, flip-covers, and guards. Make physical protections so they do not interfere with the visibility or operation of the protected device or adjacent controls. Physical protections should be appropriately durable to ensure continued airworthiness.

  • Slippage Resistance. The physical design and materials used for controls can reduce the likelihood of finger and hand slippage (especially in the presence of vibration). For example, buttons can be designed with concave, textured, or tacky upper surfaces to prevent finger slippage.

  • Hand Stabilization. Provide hand rests, armrests, or other physical structures as a stabilization point for the pilot’s hands and fingers when they are operating a control. This can be particularly useful for controls used in the presence of turbulence and other vibration, helping the pilot make more precise inputs.

  • Logical Protection. Software-based controls and software-related controls may be disabled at times when actuation of the control would be considered inappropriate, based on logic within the software. Make disabled (inactive) controls clearly discernable from active controls.

  • Complex Movements. The method of operation for a control can be designed so that complex movement is required to actuate it. For example, a rotary knob can be designed so that it can only be turned when it is also being pulled out. Double-click or push-and-hold methods are not recommended methods of protection.

  • Tactile Cues. The surfaces of different controls can have different shapes and textures, supporting the pilot in distinguishing different controls when operating in a dark or otherwise “eyes free” environment. For example, most keyboards have a small ridge on the “J” and “F” keys, cuing the user to the proper placement of their index fingers. Similarly, § 25.781 requires specific shapes for certain cockpit controls.

  • Locked/Interlocked Controls. Locking mechanisms, interlocks, or the prior operation of a related control can prevent inadvertent operation. For example, a separate on/off control can activate/deactivate a critical control, or physically lock it in place.

  • Sequential Movements. Controls can be designed with locks, detents, or other mechanisms to prevent the control from passing directly through a sequence of movements. This method is useful when strict sequential actuation is necessary.

  • Motion Resistance. Controls can be designed with resistance (e.g., friction, spring, inertia) so that deliberate effort is required for actuation. When this method is employed, the level of resistance cannot exceed the minimum physical strength capabilities for the intended pilot population.

Any method of protecting a control from inadvertent operation should not preclude operation within the required pilot task time, or interfere with the normal operation of the system. If a control is inadvertently operated, multisensory information can assist pilots in detecting the error. Feedback can include one or more auditory cues, tactile cues, or visual cues. As a general rule, the greater the consequence of an unintended operation, the greater the prevention method needed, and the more salient the cues that should be provided for detection.

5 Summary and Conclusions

The evaluation of flight deck controls should include a thorough examination of the control location and mechanization. The physical arrangement of the controls on multi-engine should be consistent with the physical location of the engines on the airplane as far as left to right sequence. They should also be examined in conjunction with their associated displays and warning indications when failures occur. Every effort should be made to provide clear unmistakable indications to prevent these situations from occurring. Also, marking and lighting of the engine controls needs to be clear and distinct to prevent any confusion to the pilot. Compliance testing identified in the human factors certification plans should begin with analysis of initial engineering studies and continue through mock-up, simulator and aircraft ground/flight test evaluations.