I N D U S T RY DESIGN DISPLAYS For Better Pilot Reaction

BY PAUL NOVA C E K

n an analog, or “steam gauge” knowledgeable pilots. Therefore, we that the designers are assuming that cockpit, flight and system infor- as designers are assuming what the the pilots will give to the . Imation is constantly presented to pilots need to know and when they Sometimes, a pilot may not give that the pilot. Very little information is need to know it. Pilots are becoming trust to the aircraft, so a pilot may needed to be accessed by the pilot— “system monitors,” which we humans want to see all the information and everything is right in front. Although don’t do very well. Many studies high- then make the judgment from the data sometimes this required a third crew light this phenomenon. If flight decks that is pulled from the instruments. member, there was a sense of being in are going to be “human-centered,” the For example, if a pushbutton switch greater control of the aircraft. Data was pilots’ strengths and limitations need position is not apparent, there may be presented to the pilot which was then to be addressed, both to provide the some confusion as to the condition of gathered and interpreted into valuable pilots with pertinent information while the system. The pilot would be information. So, in essence, the pilot automating mundane tasks. This caus- required to remember, from previous “pulled” data from the instruments. es a few problems that need to be training, what the dark position of the In the current generation of instru- addressed. switch indicates. mentation, data (and sometimes infor- A balance needs to be achieved mation) is “pushed” onto the crew. between too little information and too Quiet/Dark Philosophy Unfortunately, sometimes not enough, much information. There needs to be The quiet/dark design philosophy or misleading, information was just enough information available to states that information is not displayed “given” to the pilots. NASA’sAviation allow the pilots to make sound judg- until something goes wrong. A screen Safety Reporting System found that 70 ments, but not too much information or annunciator stays black until a sys- percent of all the incident reports cited that it taxes the capacity to absorb and tem condition warrants notifying the “information transfer” as a leading process that information. pilot. Much of the typical cockpit cause. First is the issue of the “pure condi- already adheres to this philosophy. An The nature of the data that is pushed tion” of the aircraft. If the crew does light stays dark until onto the flight crew is determined by not have access to conditions on a con- the pilot needs to be notified of an the cockpit designers with help from tinuous basis, there is an inherent trust abnormal condition.

A Citation annunciator panel in the dark, indicating a “normal” A Citation annunciator panel indicating the “non-normal” conditions for condition. various systems.

44 NEWS • OCTOBER 2003 A simple example is a warning on a problem that could easily be recti- annunciator that only illuminates dur- fied with proper and complete switch ing a failure condition. The annuncia- annunciation. tor is dark when everything is normal Legend switches have many distinct and then when the un-normal condi- advantages. Because of the nature of tion exists, lets the pilot know the the lighted legend either in the switch problem. Sounds simple, huh. But, or adjacent to the switch, the controlled then what do you call normal? system can provide feedback to the Philosophers have argued about what switch itself, instead of relying on is normal for thousands of years and if warning light or instrument indica- you ask five people what is normal, tions. Unfortunately, many installa- you’ll probably get five diff e r e n t The Boeing 767 EICAS display, showing only tions use the light to indicate the switch the engine parameters needed for the current answers. Luckily, in the technical flight phase. All unrelated scale numerals are position, requiring the pilot to discern world of designing a cockpit, we can removed to increase clarity. the state of the system by other panel pretty much agree on what is reason- philosophy that has been used to very indications. To aid in the proper feed- ably normal. So then the question good success are the Flight back, the light in the legend switch becomes, normal during what phase of Director/ annunciations on should indicate the acknowledgement flight? High turbine temperatures may the PFD. Only the modes selected are that the system is responding to the be normal during start-up, but not nor- annunciated. This may seem obvious, action, not just switch position. Many mal during cruise. So the indication but the careful design of these instru- problems have been encountered system must accommodate different ments adheres to a common design where an indicator light falsely noti- phases of flight. philosophy that should be carried fied the pilot that a system responded According to this quiet/dark philos- throughout the cockpit. correctly, when in fact it did not. ophy, if a pilot scans the instrument For instance, when a panel switch is panel and sees that all the annunciators Switch Positions used to activate multiple relays (nav are dark, the assumption is that every- This quiet/dark philosophy not only indicator switching), the indicator light thing is OK. This may seem obvious applies to system annunciations, but circuit should pass through a single for a typical annunciator light, such as also switch positions. Many attempts contact in each relay. Therefore, if four a red light for low oil pressure, but have been tried with varying degrees relays are controlled by one switch, when applied to avionics, there’s not a of success. It’s most difficult with and a single relay does not close, the clear cut method to apply. lighted pushbutton switches that need indicator light does not illuminate. Then there’s the question of an indi- an annunciator to convey the status of Thus the pilot knows that a failure has cation that is normal for the condi- the switch position or system status. occurred and needs to act accordingly. tions, but must still command a high L e t ’s take the quiet/dark cockpit level of alertness. For instance a GPS issues one at a time. An absence of an Indicator Colors waypoint alert: It’s perfectly normal to annunciation for a “normal” condition Colors play an important role in the receive an alert when approaching a could denote either OFF, ON or quiet/dark philosophy. An indication navigation fix, but it’s still vital infor- AUTO. can be “quiet” by just assuming a non- mation that must not go unheeded. This philosophy leads the pilot to important color. There are five colors Instruments of the Engine assume a certain amount of trust that available for use in alert systems: red, Indicating & Crew Advisory System, the system has not failed. Additionally, amber, green, cyan and white. The col- or EICAS, use the quiet/dark princi- if there is not an annunciation of the ors used in a cockpit are carefully con- ple. They only display the information “normal” switch position, the lamp or trolled and adhere to an industry stan- needed for the current task. For LED could be burned-out. Short of dard, which goes a long way in helping instance, during start-up the EICAS testing all the lights, the pilot does not pilots. Although, many cockpit and display only presents engine informa- really know the status of the system. display designers don’t adhere to the tion that is needed for the start-up task. The pilot is unaware if the system is industry standards, and lead pilots During other times, such as cruise, it continuously-ON or even intermittent- astray with a conflicting use of colors. presents more information that must ly-ON. Although this could be trained A red annunciator light or display be monitored. into the pilot or a synoptic page could indication is a warning and used strict- Another example of the quiet/dark be queried, this would be a Band-Aid Continued on following page

AVIONICS NEWS • OCTOBER 2003 45 DESIGN DISPLAYS Situation: Normal engine power-up for takeoff. Continued from page 45 ly for an emergency condition that must be addressed immediately. A warning alert is always associated Traditional with an emergency checklist item that must be committed to memory. The use of a red annunciation is highly reg- ulated and FAA AC 25-11 states: A

“Warning” should be generated when FIGURE 1 immediate recognition and corrective Displays of normal or compensatory action is required. engine power-up for EMACS takeoff; top-traditional An amber annunciation is caution- display, bottom-Engine ary, and needs to be addressed but not Monitoring and Control System (EMACS) dis - right away. An amber alert may play, designed for easy involve a checklist item or can be just reading. Courtesy NASA. a very high-level information mes- sage. Again, when certifying an air- craft, the FAA is adamant about the Situation: Incorrect sensor (EPR). Similar to the 1982 Air use of an amber caution message. FAA Florida accident at Washington National Airport. AC 25-11 states: A Caution should be generated when immediate crew awareness is required and subsequent Traditional crew action will be required. An amber alert does not imply an immediate impact on safety, but there may be possible aircraft damage or FIGURE 2 personal injury if an action is not Displays of incorrect taken. Operational procedures will sensor readings during engine power-up for possibly need to be modified to com- takeoff, similar to that plete the flight, and the pilot will need experienced during the EMACS 1982 Air Florida acci - to refer to the Flight Manual when a dent at Washington National Airport. Note caution message is displayed. the visual superiority of Think of it this way: if a red annun- EMACS to warn flight crews of hazard. ciation is not addressed, people may Courtesy NASA. die. If an amber annunciation is not addressed, the aircraft may be dam- green for system condition annuncia- initiated action and used for informa- aged. As for designing annunciators tion. tion only. For example, the switching for avionics, be extra careful when Industry guidelines generally accept of fuel tanks or Comm transmitters. considering the use of a red or amber that the color cyan (blue-green) be Unfortunately, this white annuncia- light. used for “automated reversions.” The tion may blend in with the panel label The three remaining colors, green, FAA AC 25-11 recommends that a illumination of a blue-white color, cyan and white, are basically just cyan message should be generated reducing the contrast that color pro- informational and don’t have any strict when crew awareness is required and vides. guidelines in their use. Of course, subsequent crew action may be green generally indicates a “good” or required. Generally a minor aircraft Other Quiet/Dark Issues “safe” condition but it must be bal- failure/malfunction that leads to a loss Another issue of information push- anced with another color. You cannot of redundancy, automatic reversion or ing is the human characteristic called have two switch positions that annun- degradation of a system. accommodation—the effect of ignor- ciate green for either position. White A white annunciation is generally ing recurrent situations. If the pilot is or amber is typically used opposite used as a “status” indication of a pilot- used to seeing a dark switch to indi-

46 AVIONICS NEWS • OCTOBER 2003 cate a normal condition, that same gram becomes a couple of days, graph” format. Each engine parameter dark switch could also be failed. This because of the advancements in train- was a separate vertical column on a confirmation bias, seeing what is ing methods and expense of a long common graph. The readings were expected, leads a pilot into a false class. Some foreign operators may not “normalized” so that, regardless of the sense of security. Unfortunately, as even have a class for a 30-year-old air- actual numerical value, the middle line cockpit designers, there’s not much craft, just a few days with an experi- of the display represented zero devia- we can do about this problem. enced pilot on a few charter flights. tion from a “normal” reading for that Fatigue is also a major issue with With this in mind, the cockpit phi- particular condition of flight. Just above long haul operations, and the losophy that was so carefully imple- or below that “normalized” line repre- quiet/dark philosophy is promoting mented into the initial training is lost. sented a caution level. Beyond the cau- complacency even further by saying, Therefore, the cockpit should be tion level represented a warning level. “We’ll let you know if anything is designed to clearly convey how it This display had several potential wrong.” One of the tools that pilots should be operated. Rather a life of its advantages. First, it enabled pilots to use to keep awake (besides caffeine) own, able to tell the pilot how to oper- detect even small deviations in engine is constantly checking switches to ate the aircraft in the proper and safe behavior easily, before they reached a verify positions. This keeps the pilot m a n n e r. Although the transitional caution level. Second, it allowed pilots in-the-loop as to the condition of the pilot will need assistance, this will be to scan all the instrument readings aircraft. only a brief period during the entire quickly and almost instantaneously Consideration must also be given to pilot-aircraft relationship. determine if all the parameters were the evolution and initial requirement within limits. Several behavioral stud- for the quiet/dark cockpit. The con- Normalized Displays ies had indicated, in fact, that a column cept was initially designed and adopt- The quiet/dark philosophy can be deviation graph format allowed a user ed by Airbus for use with third world taken one step further in the form of a to process up to 18 different elements in airlines and comparably trained “normalized” display. In the early the same amount of time it took to pilots. The concept forced the pilots to ‘90s, the NASA-Langley research process one, because the entire graph follow a strict procedure to avoid team pioneered the use of a display was perceived as a single item. trouble. This Airbus information theo- system that kept very quiet until a Some current helicopter displays use ry has gained much criticism over the parameter was out of limits. T h e this EMACS method to display engine years and has contributed to a few Engine Monitoring and Control parameters and provide a panel button accidents. Boeing, on the other hand, System (EMACS) display was based to “normalize” the readouts so a param- has been commended for implement- on the philosophy of providing infor- eter that is creeping away from the ing automation while still keeping the mation that is directly related to a norm is quickly recognized. pilot in control and in command of the pilot’s task. This display by exception As you can see, there are quite a bit . readout only showed the result if the of design issues related to a quiet/dark Training costs may get expensive system detected a difference between cockpit design philosophy. Some are over the life of an aircraft if an exces- the actual parameter value and the conflicting. But the important point sive amount of the training is devoted value predicted by a software engine when designing any cockpit is to pick a to nomenclature. Additionally, the ini- model. See Figure 1 and Figure 2. design philosophy and stick with it tial cockpit philosophy may get some- The research results showed that the throughout the entire cockpit. Retrofit what lost over the life span of an air- advanced display concept had shorter cockpits are especially venerable to craft. For example, the automation detection and response times. T h e mismatching cockpit philosophies and philosophy initially trained to new majority of the subject pilots preferred often cause a lot of confusion. pilots may not be carried on to the the advanced displays and thought The underlying issue here is that the extended life of an aircraft. During the they were operationally acceptable. cockpit displays need to provide a quick initial release of a new aircraft, there The EMACS display format indication to the pilots that all is well is an excitement over training and an assumed that the actual numerical and good for the current phase of flight. extremely comprehensive training value of any engine parameter was not This is accomplished with careful con- program is created, possibly covering as important as knowing whether the sideration to switch or status annuncia- an entire week or more. As the aircraft reading was normal or not. T h e tion and the control philosophy adopted matures, possibly over 30 years or EMACS display presented the engine by the original designers. ❑ more, that week-long training pro- readings in a “column deviation

AVIONICS NEWS • OCTOBER 2003 47