The systems engineer makes many design decisions that affect cockpit crews. Since the earlier days much has been learned about the interfaces between crews, cockpits, and systems, and much of that has been incorporated into the B-777. With airplane design becoming increasingly complex, it becomes ever more important that systems engineers carefully consider the crew interface of their system and find ways to make that interface as simple as possible. Accomplishing this requires not only careful interface design, but—often more importantly—careful system design.
This section addresses some of the human factors that must be considered in cockpit design. The purpose of this section is to think about systems and the flight-crew interface: to take another look at what the interface objectives should be, as well as how systems may achieve objectives.
Human Factors and Cockpit Evolution Overview
The Human Factors organization deals with the physical and mental capabilities of the flight crew, specifically the interface between the crew and the aircraft’s hardware, software, and flight controls. On the physical side, this breaks down into reach, strength, dexterity, visual acuity, and hearing abilities.
Human factors
Reach
The design eye reference point is that point in the cockpit around which all design must conform. This reference point is positioned to give optimum view of the instruments and the best view over the nose of the aircraft, while allowing for the unimpeded operation of the controls.
Levers, pedals, seats, and any other adjustable controls must be designed with respect to the design eye reference point. The envelope that cockpit design must cater to is a 5 ft. 2 in. female and a 6 ft. 3 in. male; both must be able to adjust the seat and other controls so that he or she sits at the design eye reference point to fit the range of people required by the currently applicable FARs.
Strength
With today’s power-assisted controls, strength is not as important a factor as in the days of manual controls. These controls have brought the loads down to the point where their adjustment is now a matter of pilot preference, rather than a matter of pilot endurance. The Human Factors group sets the maximum load values for controls—both continuous and transient control inputs.
Some loads are set so that they are intentionally high, to prevent structural damage to the aircraft. The rudder pedal controls are such a case. If the rudder was so easy to move that a simple footfall would drastically displace the pedal, the aerodynamic force on the rudder could tear the vertical right off the airplane. For this reason, the rudder pedal loads can be as high as 200 lbs.
Dexterity
The limitations of pilot dexterity can take many forms, including the ability to push buttons under varying conditions. For the Flight Management System (FMS), most Human Factors people would say the buttons are too close together, and the keyboard layout leaves much to be desired. On the other hand, the keyboard has been around since the 1970s and many pilots say “leave it alone.” Yet, despite this “leave it alone” attitude, the FMS is high on pilots’ complaint lists for workload and head-down requirements. The Human Factors department prefers what has become the standard push-button switch in the cockpit. Earlier designs employed toggle switches and rotary switches. Spacing between switches is set by the structural requirements of the panel: i.e., a group of toggle switches usually requires more space than its push-button counterpart.
Another area where the dexterity of the crew should be considered is in the stability of the aircraft during flight. FARs set mandated aerodynamic stability requirements. Stability refers to the ability of the aircraft to return to its previous course of flight after a disturbance. Indirectly, these stability-related FARs set workload requirements for the crew. For example, an unstable aircraft requires much more work on behalf of the crew to keep it on course than a stable aircraft. In the quest for fuel conservation, the aerodynamic design of many of today’s aircraft will not pass these FARs without artificial augmentation. The Boeing/MD-11, for example, uses artificial augmentation to stabilize the pitch of the airplane. It accomplishes the required pitch stability through the use of the Longitudinal Stability Augmentation System (LSAS).
Subjective Assessment
The Cooper-Harper rating (see Fig. 7.8.1) is a means of measuring the fly ability of an aircraft. While this is an admittedly subjective measurement, it gets surprisingly good results on a consistent basis. For a systems engineer the Cooper-Harper rating increases the reliability requirements that have to be placed on a system. Stability refers to the ability of the aircraft to return to its previous course of flight after a disturbance.
Visual Acuity
Visual acuity deals with the crew’s ability to clearly see what is going on in the cockpit. Events that are on the edge of the visual field will not be noticed. If lines of angular field of vision are drawn, anything beyond 15 degrees will probably not be picked up for quite awhile. MIL-STD 1472D, Vertical and Horizontal Visual Field, has more information on visual acuity.
Character sizes on screen displays and panels must take into consideration the distance of the characters from the design eye reference point. The character size for the screens is set by the distance of the system display from the captain’s design eye reference point. Additionally, character sizes used in the cockpit vary based on the importance of the information, with three sizes being in use on the Boeing/MD-11.
The use of color can greatly enhance the ability to distinguish visual messages. However, many people are partially colorblind and do not know it, so this limits the extent that color can be used. For this reason, we also incorporate various shapes in the display to aid in visual distinction.
The ability of the pilot to have instant visual access to the displays is very important. Many advances have been made in the placement of controls so that they do not obscure the displays.
Hearing
Hearing addresses the ability of the crew to distinguish the various audio messages directed toward them, i.e., warning messages as distinguished from radio or intercom messages.
The Human Factors group may also look into what kinds of tones should be used in a warning to make them more noticeable, i.e., the use of a female voice, variations in the pitch of tones, or how syllables might be emphasized.
Workload Analysis
Workload is measured by use of the task-timeline analysis. This analysis compares the time taken to complete a task against the time available for the task. If all of the time available is taken to complete the task, then the workload is 100%. The mental workload is determined by obtaining pilot assessment after each event. (Mental capabilities are much more difficult to assess and codify due to fatigue, personal events, information overload, etc. Attempts to relate heart rate to mental workload have been made, but the results have been under evaluation for many years and are still inconclusive.)
Alerts
Mil-Std 882B, System Safety Programs Requirements, gives us a precedent with regard to designing safe systems:
- 1. Design system to eliminate (preclude) hazard.
- 2. Reduce associated hazard through design selection.
- 3. Control hazard through safety devices and features (reduce probability).
- 4. Provide warning devices.
- 5. Procedures and training; corrective action.
From this we could deduce that you have almost failed in your design if you need a warning to the crew. Often engineers say they must put in warnings “because the FARs require it.” In fact, these requirements apply in certain conditions, and you may find that if you go back to the basic design of your system and reevaluate it, you can find a way to design the system so that the condition doesn’t exist, and the alert is actually not needed. To put it another way, warnings are often used as a solution to a problem discovered late in a design, which might be better resolved by a more careful consideration of the entire design. For example, the most important “system” on the airplane is the structure, yet how many structural warnings are there? Because the basics of structure design were established long before we had effective monitoring and measuring devices, structural engineers have had to find ways to design without alerts, which might otherwise overwhelm the crew.
Aural Alerts
There are approximately 34 aural warnings on the planes, some of which are listed in Table 7.8.1.
Table 7.8.1
| Warning | Aural tone | Voice |
|---|---|---|
| Fire | Bell | “Engine 1 Fire” “Engine 2 Fire” “Engine 3 Fire” |
| Overspeed | Clacker | “Overspeed” “Slat Overspeed” |
| Landing gear | Tone | “Landing Gear” |
| Takeoff | Tone | “Flaps” “Slats” “Brakes” “Autospoilers” “Spoilers Extended” “Stabilizer” |
| Cabin low pressure | Tone | (Cabin Altitude) |
| Autopilot disconnect | Tone | “Autopilot” |
| Horizontal stabilizer in motion | Tone | “Stabilizer motion” |
| Altitude advisory | Tone | (Altitude) |
| Tire failure | N/A | “Tire failure” |
| Windshear | Tone | “Head Windshear” “Tail Windshear” |
| Minimums | N/A | “Minimums” |
| Approaching minimums | N/A | “Approaching minimums” |
| Radio altitude callouts | N/A | “2500” “1000” “500” “400” “300” “200” “100” and/or (50–10 ft) |
| Ground proximity | Whoop | “Too low” “Terrain” “Glide slope” “Pull up” “Sink rate” |
| Traffic alert and collision avoiding | N/A | • Monitor Vertical Speed (2 ×) • Climb (3 ×) • Climb, Crossing Climb (2 ×) • Descend (3 ×) • Descend, Crossing Descend (2 ×) • Reduce Climb (2 ×) • Reduce Descent (2 ×) • Increase Climb (2 ×) • Increase Descent (2 ×) • Climb, Climb Now (2 ×) • Descend, Descend Now (2 ×) • Clear of Conflict |
Remember, these warnings will often occur at a time that the pilot is busy trying to handle a problem resulting from the situation that he or she is being warned about. What are the chances that the pilot may misinterpret any one of these warnings? Voice explanations of the alerts are available as an option, but their use is controversial.
Information Overload
Pilots are not machines; they have difficulty handling the overload of information presented to them while they are busy flying the plane. Therefore, we must be selective in giving them information, i.e., give them what they need to know to fly the plane safely. And give them access to information that will allow efficient operation of the systems, but don’t ram it down their throats. If the information is maintenance-related, give them access to that information, but let the decision to look at it be in their hands.
Requirements for Alerts
We have learned a lot, then, about the types of alerts to use: gauges are good only for trend information unless they are frequently referred to; use master warnings or cautions with a clear message about the source of the problem. However, for this strategy to be effective we have to make sure our alerts are correct (in the early flights of the MD-11, before the alerts were debugged, so many alerts were coming up incorrectly that the only thing the crew could do was to ignore them).
No Alert
A mistake that is frequently made is to use too many alerts. No alerts should be given if the circumstance:
- • does not impact the immediate safety of flight,
- • does not require crew action,
- • is a future maintenance item, or
- • is a progressive alert (if one does not fix this, one will get another alert later).
If it is something that would affect dispatch, then we should put it on a list that the flight crew looks at before or after flight. Give the flight crew the choice. We say immediate “safety of flight” because we have often come up with alerts that warned of an impending problem (progressive alert). There is nothing the flight crew can do about this, and so there is no reason to bother them with it. In many cases, this is information maintenance should have, not the flight crew, and that’s who should be told about it.
Alert Required
On the other hand, alerts should be given:
- • when crew action is necessary, and
- • when immediate safety of flight is affected.
Maintenance Alerts
In general, maintenance alerts advise of a deteriorating system and should not be shown to the flight crew. In general, maintenance alerts:
- • should advise of deteriorating system,
- • should not be dispatch criteria,
- • should not be displayed except on Central Fault Display System (CFDS), and
- • if the circumstance does not affect the cockpit, then they are not subject to Minimum Equipment List (MEL) rules.
Remember, if you put up a message to the crew, then it becomes governed by the MEL; if you put it into the Central Fault Display System (CFDS), then other possibly more liberal criteria apply. (MEL is a list of equipment that does NOT have to be operational in order to fly the aircraft.)
Alert Information
Finally, the alerts that we find are necessary should have these characteristics:
- • communicate the severity of the problem,
- • use words that are meaningful to the crew,
- • state the basic problem,
- • lead crew immediately to the correct checklist system.
Conclusion
Today, the procedures are generally shorter and more direct, but we have also added complications to the systems that resulted in new procedures.
Simplicity has only truly been achieved when the checklists are reduced in both size and number. This requires that the systems themselves be simplified, which means that one needs to be very clever in designing the system, and of course the system must also be reliable and safe.
Leave a Reply