Human Factors Guidelines for Unmanned Aircraft System ... _Prelim_Guidelines... · WORKING DOCUMENT FOR COMMENT Human Factors Guidelines for Unmanned Aircraft System Ground Control

WORKING DOCUMENT FOR COMMENT

HumanFactorsGuidelinesforUnmannedAircraftSystemGroundControlStations.Aworkingdocumentaddressingtheuniquehumanfactors

considerationsassociatedwithbeyond-line-of-sightoperationofunmannedaircraftintheNationalAirspaceSystem.

PreliminaryGuidelines1.0ContractorReportpreparedforNASAUASintheNASProject

September2015

AlanHobbs,Ph.D.SanJoseStateUniversityResearch

Foundation/[email protected]

BethLyall,Ph.D.ResearchIntegrations,Inc.

[email protected]


Authors’note

ThisworkingdocumenthasbeenpreparedforNASA’sUnmannedAircraftSystems(UAS)IntegrationintheNationalAirspaceSystem(NAS)Project.ItcontainsapartiallistofpreliminaryhumanfactorsguidelinesforUASGroundControlStations(GCS)arrangedwithinanorganizingstructure.

TheUASindustryisexpandingrapidly,andmanyUSandinternationalagencies(includingRTCA,ICAO,JARUS,andtheFAA)areworkingtodevelopoperationalconceptsandstandards.Weaimtodevelophumanfactorsguidelinesthatwillbeofvaluetotheaforementionedorganizations.

ItisnotourintentiontolistallhumanfactorsguidelinesrelevanttotheGCS,asthiswouldinvolvereplicatingalargenumberofexistingguidelinesforUAS,cockpitdesign,andotherhumansysteminterfaces.Instead,thedraftguidelinescontainedinthisdocumentareintendedtosupplementtheexistinghumanfactorsliteraturebyfocusingontheuniqueaspectsofunmannedaviationandthecapabilitiesandcharacteristicsoftheGCStoenablepilotstooperateUASintheNAS.

Thisearlyversionofourworkingdocumentisbeingmadeavailableforinputandfeedback.Thedocumentwillberevisedandupdatedperiodicallyasinformationbecomesavailablefromresearch,readercomments,andoperationalexperience.Placeholders,denotedby“TBA”,indicatewherefuturematerialwillbeadded.

Thereadershouldnotethattheseguidelinesaddresscivilunmannedaircraftthatarecapableofoperatingbeyondvisualline-of-sightinallairspaceclassesoftheNAS.Wedonotaddressunmannedaircraftthatoperateentirelyatlowlevel,orarecontrolledbyvisualreferenceofthepilot.Furthermore,althoughourfocusisonUASoperationsintheUnitedStates,wehopethatourworkwillalsobeusefulinternationally.

Commentsorquestionscanbesenttousviatheemailaddressesonthetitlepageofthisdocument.

AlanHobbs,Ph.D.SanJoseStateUniversityResearch

Foundation/NASAAmesResearchCenter

BethLyall,Ph.D.ResearchIntegrations,Inc.


Contents

Summary......................................................................................................................................................2

Listofabbreviations....................................................................................................................................4

Introduction.................................................................................................................................................5

Scopeofthecurrentactivity....................................................................................................................6

FocusingguidelinesonthespecialchallengesofUASoperations...........................................................7

FAAassumptions.................................................................................................................................8

SpecialconsiderationsofUAS...........................................................................................................10

Overviewofexistingrelevantguidelines...............................................................................................16

Typesofguidelines................................................................................................................................17

Pilottasksthatmustbeperformedviatheinterface........................................................................18

Informationcontentofdisplays........................................................................................................19

Controlinputs....................................................................................................................................19

Propertiesoftheinterface................................................................................................................19

Generalguidelines.............................................................................................................................20

UASpilotresponsibilities.......................................................................................................................20

Guidelines..................................................................................................................................................23

Characteristicsandcapabilitiesoftheinterface....................................................................................23

Aviate.................................................................................................................................................23

Navigate.............................................................................................................................................33

Communicate....................................................................................................................................41

ManageSystemsandOperations......................................................................................................44

Generalguidelines.................................................................................................................................47

Summarylistofguidelines.....................................................................................................................57

Guidelinesorganizedbytype................................................................................................................69

Task-relatedguidelines......................................................................................................................69

Information-relatedguidelines..........................................................................................................73

Control-relatedguidelines.................................................................................................................76

Guidelinesrelatingtopropertiesoftheinterface.............................................................................77

Generalguidelines.............................................................................................................................80

Definitionsofterms...................................................................................................................................83


References.................................................................................................................................................84

Appendix-Selectedhumanfactorsregulations,guidance,andpolicy.....................................................88


2

Summary

Thispreliminaryreportpresentsastructurethatmaybeusedtoorganizehumanfactors

guidelinesfortheGroundControlStations(GCSs)ofunmannedaircraftthatarecapableof

operatingbeyondline-of-sightinallairspaceclassesoftheUnitedStatesNationalAirspace

System(NAS).Thedocumentcontainsapartiallistofdraftguidelines,aswellasplaceholdersto

indicatewherefutureguidelinesmaybeincluded.

Thousandsofhumanfactorsguidelinesandstandardsfortechnologicalsystemshavebeen

publishedbystandardsorganizations,regulatoryauthorities,theDepartmentofDefense,and

otheragencies.Incompilingthisdocument,theintentwasnottoreproduceorre-stateexisting

humanfactorsmaterial.Instead,thisdocumentfocusesontheuniqueissuesofcivilian

unmannedaviation,andcontainsguidelinesspecifictothissector.Asaresult,itshouldbeseen

asasupplementto,ratherthanareplacementfor,existingaviationhumanfactorsstandards

andguidancematerial.

Twoconstraintshavebeenusedtofocusthescopeofthisdocument.First,theassumptions

containedintheFAA(2013a)UASroadmaphavebeenusedtodefinetheresponsibilitiesthat

willbeassignedtothepilotofaUASoperatingintheNAS.Thisinturn,helpstodefinethetasks

thattheUASpilotmustperformviatheGCS,andtherebytherequiredfeaturesand

characteristicsoftheGCS.Second,thepointsofdifferencebetweenUASandconventional

aviationhavebeenusedtofurtherfocustheguidelinesontheconsiderationsthatmake

pilotingaUASsignificantlydifferenttopilotingaconventionalaircraft.

Fivebroadcategoriesofguidelinesareidentified.Theseare(1)performance-baseddescriptions

ofpilottasksthatmustbeaccomplishedviatheGCS,(2)informationcontentofdisplays,(3)

descriptionsofcontrolinputs,(4)propertiesoftheinterface,and(5)high-leveldesign

considerations.SomeoftheguidelinesinthisdocumenthavebeenadaptedfromexistingUAS

humanfactorsmaterialfromseveralsources,includingRTCApublicationsandStandardization

Agreements(STANAGs)publishedbytheNorthAtlanticTreatyOrganization(NATO).Theuseof

quotationmarksindicatesthatthewordingoftheguidelineremainsinitsoriginalform.In


3

othercases,guidelineshavebeendevelopedbasedonNASAresearchconductedunderthe

UASintheNASproject.Inafewplaces,existingaviationstandardsorgeneralhumanfactors

guidelineshavebeenquotedwhentheyhaveparticularrelevancetoUAS.

Throughoutthisdocument,guidelineshavebeenwrittenwiththewords“should”or“will”

exceptincaseswhereanexistingguidelineisquotedthatcontaineda“shall”statementinits

originalform.


4

Listofabbreviations

ADS-B AutomaticDependentSurveillance–BroadcastANSI AmericanNationalStandardsInstituteASTM ASTMInternational,formerlyAmericanSocietyforTestingandMaterialsATC AirTrafficControlC2 ControlandCommunicationsCCTV ClosedCircuitTelevisionCFR CodeofFederalRegulationsCOA CertificateofWaiverorAuthorizationCOTS CommercialOff-The-ShelfCPDL Controller-PilotDataLinkCTAF CommonTrafficAdvisoryFrequencyDAA DetectandAvoidDTED DigitalTerrainElevationDataFAA FederalAviationAdministrationGCS GroundControlStationHFES HumanFactorsandErgonomicsSocietyHMI Human-MachineInterfaceICAO InternationalCivilAviationOrganizationIFR InstrumentFlightRulesIMC InstrumentMeteorologicalConditionsJARUS JointAuthoritiesforRulemakingofUnmannedSystemsMOPS MinimumOperationalPerformanceStandardsms MillisecondNAS NationalAirspaceSystemNASA NationalAeronauticsandSpaceAdministrationNATO NorthAtlanticTreatyOrganizationPIC PilotinCommandRTCA RTCAInc.formerlyRadioTechnicalCommissionforAeronauticsSTANAG NATOStandardizationAgreementTBA ToBeAddedTCAS TrafficAlertandCollisionAvoidanceSystemUA UnmannedAircraftUAS UnmannedAircraftSystemUAV UnmannedAerialVehicleVHF VeryHighFrequency


5

Introduction

UnmannedAircraft(UAs)havegenerallyexperiencedahigheraccidentratethanconventionally

pilotedaircraft(Nullmeyer&Montijo,2009).Manyoftheseaccidentsappeartoreflectthe

uniquehumanchallengesassociatedwithpilotingaUA,incombinationwithGroundControl

Stations(GCS)thathavebeendesignedwithinsufficientregardforhumanfactorsprinciples

(Williams,2004).

Humanfactorsandhumanfactorsengineeringhavebeendefinedasfollows:“HumanFactorsis

abodyofknowledgeabouthumanabilities,humanlimitations,andotherhuman

characteristicsthatarerelevanttodesign.Humanfactorsengineeringistheapplicationof

humanfactorsinformationtothedesignoftools,machines,systems,tasks,jobs,and

environmentsforsafe,comfortable,andeffectivehumanuse”(Chapanis,1991).

TheGCSofunmannedaircraftsystems(UAS)rangefromcommercialoff-the-shelflaptops,to

sophisticatedpurpose-builtinterfaceshousedinsheltertrailersorcontrolfacilities.Although

someGCSpossessaviationinterfaces(suchassidestickcontrollers)mostalsoincludeinterfaces

basedonconsumerelectronicdevicessuchasscreen-baseddisplays,pull-downmenus,and

“point-and-click”inputdevices(Scheff,2012;Waraich,Mazzuchi,Sarkani&Rico,2013).

Widespreadproblemshavebeenidentifiedwithcontrolstationinterfaces.Examplesinclude

error-provokingcontrolplacement,non-intuitiveautomationinterfaces,arelianceontext

displays,andcomplicatedsequencesofmenuselectiontoperformminororroutinetasks

(Cooke,Pringle,Pedersen&Connor,2006).Someoftheseproblemsmayhavebeenprevented

hadanexistingregulationorcockpitdesignprinciplebeenapplied.Inothercases,thedesign

problemreflectedanemergingUASissuethatwasnotcoveredbyexistingregulatoryor

advisorymaterial.


6

TheNationalAeronauticsandSpaceAdministration(NASA)recognizesthathumanfactors

guidelinesfortheGCSwillbeakeyrequirementforsafeandreliableoperationofcivilianUAS

intheUnitedStatesNationalAirspaceSystem(NAS).AspartoftheNASAUASintheNAS

Project,theagencyisworkingwithkeystakeholderstodeveloprecommendationsforGCS

humanfactorsguidelineswithafocusonunmannedaircraftoperatingbeyondvisualline-of-

sight.

Thisdocumentcontainspreliminaryhumanfactorsguidelinesthathavebeendevelopedonthe

basisofdatafromsimulations,accidentandincidentanalysis,andtheliteratureonUAShuman

factors.ThedocumentalsodrawstogetherexistingUASguidelinespreviouslydevelopedby

NATO,RTCA,Access5,andotherorganizations.Guidelines,bydefinition,areadvisoryin

nature.Thereforewehaveusedtheterms“should”and“will”,exceptincaseswherewehave

quotedanexistingregulationorstandardwithoutmodification.

Scopeofthecurrentactivity

Thecompilationofhumanfactorsguidelineswasbasedonthefollowingintentions:

a) TheguidelineswillbedevelopedforUAScapableofoperatingbeyondlineofsight

withinallclassesofcivilianairspace.

b) Thefocuswillbetheengineeredsystem,comprisingtheGCS,anditsimmediate

environment.Whereappropriate,issuessuchasmaintenanceorgroundsupportarealso

considered.Personneltraining,crewqualifications,proceduredesignandphysicalsecurityof

theGCSarebeyondthescopeofthisdocument.

c) Thescopewillnotbelimitedtospecificdesigns,orarchitectures,butcoversasbroada

rangeofUASaspracticable.

d) Thecontrolormanagementofpayloadwillbeoutofscope,exceptwherepayload

considerationsmayaffectthesafetyofflight.


7

e) Allstagesofflightwillbewithinscope,fromflightplanningtopost-landing,including

contingencies(non-normalsituations)andin-flighthandover,asshowninFigure1.

Figure1.Stages-of-flightconsideredinthedevelopmentofguidelines.

FocusingguidelinesonthespecialchallengesofUASoperations

Alargenumberofhumanfactorsguidelinesandstandardsforhuman-machineinterfaceshave

beenpublishedbystandardsorganizations,NASA,theFAA,militaryagencies,andothers.A

comprehensivesetofguidelinesfortheGCScouldconceivablyincludere-statementsofallof

thispre-existingmaterial.Suchamassivedocumentwouldbeoflimiteduse.Notonlywould

mostofthematerialbeavailableelsewhere,butoriginalguidelineswouldbedifficulttolocate

amongallofthere-statedmaterial.

IncompilingguidelinesfortheGCS,wehavespecificallydecidednottoproducea

comprehensivesetofhumanfactorsguidelines,butinsteadtofocusonthespecialchallenges

thatwillberelevanttotheoperationofUASintheUnitedStatesNationalAirspaceSystem.

Therefore,thissetofguidelinesisintendedtosupplement,ratherthanreplace,existing

materialoncockpitdesign.

MostoftheguidelinesincludedinthisdocumentareUAS-specificanddealwithissuesthatare

notcoveredbyguidelinestypicallyusedintheaviationindustry.Inafewpartsofthisdocument

however,wehavechosentore-stategeneralhumanfactorsprinciplesthathaveparticular


8

applicabilitytoUAS,particularlywhenwehavefoundevidencethattheprinciplehasbeen

overlookedbythedesignersofexistingGCS.

Thecurrentefforthasbeenguidedbytwocomplementarydefiningconstraints.First,wehave

usedasetofassumptionspublishedbytheFAAtodefinethetypesofoperationsthatwillbe

permittedbyUASintheNAS.TheseassumptionsdeterminethecapabilitiesthatUASmust

possessandthetasksthatthepilotmustbeabletoperform.Second,wehaveidentifiedthe

specialchallengespresentedbyunmannedaviation,andfocusedoncompilingguidelines

relevanttotheseissues.Thesechallengesaresometimesreferredtoas“deltas”,meaningthe

additionalconsiderationsthatapplytoUASoperationsoverandabovethoseapplyingto

mannedaviation.Asummaryofthespecialchallengescanbefoundinafollowingsection.

Figure2.ControlandcommunicationresponsibilitiesofaUASpilotoperatingintheNAS.

FAAassumptions

TheFAA(2013a)roadmapforintegrationofUASintotheNationalAirspaceSystemincludesa

setofassumptionsthatwillguidehowcivilUASoperatingbeyondline-of-sightoftheflight

crewwillbeintegratedintotheNAS.TheseassumptionsarereproducedverbatiminTable1

below.Severaloftheassumptionsimplyspecificrequirementsthathelptodefinethenatureof


9

UASoperationsandtheroleofthepilot.Forexample,fromassumptionthreeitfollowsthatthe

pilotwillcomplywithInstrumentFlightRules(IFR)proceduresandwilloperatetheaircrafton

designatedairroutes.Assumptionsixmakesitclearthattherewillbearoleforapilotin

command,andthatthecontrolofmultipleUAsbyonepilotisnotenvisioned.Assumption

sevenrequiresthatthepilotwillhaveon-the-looporin-the-loopcontrolauthority.Thisinturn,

impliesthattheGCSmustkeepthepilotinformedofthestateoftheaircraftanditssystems.

Fromassumption13,itfollowsthatthepilotwillhavetheabilitytocommunicatewithAir

TrafficControl(ATC),andwillbecapableofcomplyingwithATCinstructionsaseffectivelyasa

pilotofamannedaircraft.Figure2(above)showsasimplifiedrepresentationoftheroleofthe

pilotinaUASoperatingasafullparticipantintheNAS.

Table1.AssumptionsfromFAAUASroadmap

1.UASoperatorscomplywithexisting,adapted,and/ornewoperatingrulesorproceduresasa

prerequisiteforNASintegration.

2.CivilUASoperatingintheNASobtainanappropriateairworthinesscertificatewhilepublic

usersretaintheirresponsibilitytodetermineairworthiness.

3.AllUASmustfileandflyanIFRflightplan.

4.AllUASareequippedwithADS-B(Out)andtransponderwithaltitude-encodingcapability.

ThisrequirementisindependentoftheFAA’srule-makingforADS-B(Out).

5.UASmeetperformanceandequipagerequirementsfortheenvironmentinwhichtheyare

operatingandadheretotherelevantprocedures.

6.EachUAShasaflightcrewappropriatetofulfilltheoperators’responsibilities,andincludesa

pilot-in-command(PIC).EachPICcontrolsonlyoneUA.*

7.Autonomousoperationsarenotpermitted.**ThePIChasfullcontrol,oroverrideauthority

toassumecontrolatalltimesduringnormalUASoperations.

8.CommunicationsspectrumisavailabletosupportUASoperations.


10

9.NonewclassesortypesofairspacearedesignatedorcreatedspecificallyforUASoperations.

10.FAApolicy,guidelines,andautomationsupportairtrafficdecision-makersonassigning

priorityforindividualflights(orflightsegments)andprovidingequitableaccesstoairspaceand

airtrafficservices.

11.AirtrafficseparationminimaincontrolledairspaceapplytoUA.

12.ATCisresponsibleforseparationservicesasrequiredbyairspaceclassandtypeofflight

planforbothmannedandunmannedaircraft.

13.TheUASPICcomplieswithallATCinstructionsandusesstandardphraseologyperFAA

Order(JO)7110.65andtheAeronauticalInformationManual(AIM).

14.ATChasnodirectlinktotheUAforflightcontrolpurposes.

*ThisrestrictiondoesnotprecludethepossibilityofaformationofUA(withmultiplepilots)or

a“swarm”(onepilotcontrollingagroupofUA)fromtransitingtheNASto/fromrestricted

airspace,providedtheformationorswarmisoperatingunderaCOA.

**Autonomousoperationsrefertoanysystemdesignthatprecludesanypersonfromaffecting

thenormaloperationsoftheaircraft.

FAA(2013a).IntegrationofCivilUnmannedAircraftSystems(UAS)intheNationalAirspace

System(NAS)Roadmap(pp33-334)

SpecialconsiderationsofUAS

Unmannedaviationsharesmanyofthesamehumanfactorsconsiderationsthatapplyin

mannedaviation;howeverthepointsofdifferencehaveimplicationsforGCSdesign(Kaliardos

&Lyall,2014).ThesespecialconsiderationsarelistedinTable2belowandaredescribedin

detailinthesectionsthatfollow.Theguidelinesinthisdocumentareintendedtoaddress

humanfactorschallengesthatexistwithintheproblemspacedefinedbytheseeightbroad

considerations.


11

Table2.SpecialconsiderationsofUASwithimplicationsforguidelinesdevelopment

A.Lossofnaturalsensing

B.Controlandcommunicationviaradiolink

C.Physicalcharacteristicsofthecontrolstation

D.In-flighttransferofcontrol

E.Uniqueflightcharacteristicsofunmannedaircraft

F.Flighttermination

G.Relianceonautomation

H.Widespreaduseofinterfacesbasedonconsumerproducts

A. Lossofnaturalsensing

Potentialforreducedawarenessofaircraftstate:Therichsensorycuesavailabletothepilotof

aconventionalaircraftincludevisual,auditory,proprioceptiveandolfactorysensations.The

absenceofthesecueswhenoperatingaUAScanmakeitmoredifficultforthepilottomaintain

anawarenessoftheaircraft’sstate.

Implicationsforerror-selfcorrection:Observationsofairlinepilotshaveindicatedthat“pilot

error”isarelativelyfrequentevent,yetmostoftheseerrorsarerapidlyidentifiedand

correctedbythecrewsthemselvesbeforeanyconsequencesoccur(ICAO,2002).TheUASpilot,

nolongerco-locatedwiththeiraircraft,mayhavemoredifficultyidentifyingandself-correcting

errors.

Collisionavoidanceandseparationassurance:Intheabsenceofanout-the-windowview,the

pilotmustrelyonalternativesourcesofinformation,andwillbeunabletocomplywithATC

visualclearancesintheusualway.Inthecruiseflightphase,aUASpilotlackinginformation

fromanout-the-windowviewmaybeinacomparablesituationtothepilotofaconventional

aircraftduringflightininstrumentmeteorologicalconditions(IMC).However,thecomparison


12

betweenconventionalinstrumentflyingandUASoperationsmaynotapplywhentheUAison

thegroundorinterminalairspace.Thesituationawarenessprovidedbyanout-the-window

viewmaybeparticularlycriticalduringtaxiingandtakeoff,andduringtheapproachandlanding

phases.IncollaborationwithRTCASpecialCommittee228,NASAisconductingstudiesto

definetherequirementsforUAStrafficdisplaystobeusedforself-separationandcollision

avoidance.

Fovealbottleneck:SomeUASdesignershaveattemptedtocompensateforthelackofrich

sensorycueswithtext-baseddisplaysintheGCS.However,thisrisksoverloadingthevisual

channelofthepilotbyrequiringthepilottoinvestthelimitedresourceoffovealvisionto

obtaininformationthatwouldbeavailabletoaconventionalpilotviaothersensorychannels,

includingperipheralvision.

Potentialforperceptualillusionsordistortionsrelatedtoon-boardcameras:Ifanon-board

cameraisusedtoassistwithpilotingtasks,thereisthepotentialforperceptualillusionsor

distortionsthatdonotoccurinconventionalaviation.Cameraviewscanproducemisleading

depthcues,someofwhichmayberelatedtothelackofbinocularcues.Misleadingcuesmay

beparticularlynoticeableduringtakeofforlanding.Ifamoveablecameralocatedonboarda

UAisnotalignedasexpectedbythepilot,ormovesunexpectedly,theremaybeanillusionof

yaw,orotherundesiredaircraftstate.

B. Controlandcommunicationviaradiolink

Controllatencies:Thetransmissionofradiosignals,andtheassociatedprocessing,may

introduceoperationallysignificantdelaysbetweenpilotcontrolinput,aircraftresponse

execution,anddisplayoftheresponsetothepilot.Theselatencieswillbeparticularly

noticeablewhenthelinkisviaageostationarysatellite,however,terrestrialradiosystemsmay

alsointroducesignificantlatencies.


13

Voicelatencies:Incontrolledairspace,mostcommunicationbetweenpilotsandATCoccurover

VHFradio.Allpilotsonthesamefrequencyareabletomonitortransmissionsduetothe“party

line”natureoftheradio.Thisprovidessituationawareness,andalsoenablespilotstotime

theirtransmissionstominimize“step-ons”,inwhichtwopeopleattempttotransmit

simultaneously.Inbusyairspace,itcanbecomechallengingtoidentifythebriefgapsinwhich

transmissionscanbemade.

Thenear-termcommunicationandcontrolarchitecturebeingdevelopedforUASoperationsin

theNASwillinvolveadigitalrelayofUASpilotvoicecommunicationsviaLbandorCband

radiosfromthegroundtotheUA,fromwherethemessagewillbeconvertedtoanalogueform,

andre-broadcastoverVHFradio.Thetransmissionsofotherpilotsandcontrollerswillbe

relayedtotheUASpilotusingthesamesystem.TherelayofUASvoicecommunicationsfrom

theGCSviatheUAwillintroduceadelaybetweenthecommunicationsoftheUASpilotwith

referencetootherpilotsonfrequency.Mostofthislatencywillbeduetoprocessingbefore

andaftersignaltransmission.InordertoseamlesslyintegrateUASintotheNAS,itwillbe

importantthatthelatencybetweenUASandnon-UASvoicecommunicationsdoesnotreacha

levelthatdisruptscommunication.

Linkmanagement:Inadditiontoflyingtheaircraft,thepilotmustmanageandmonitorthe

ControlandCommunications(C2)link.Thisrequiresthepilottobeawareofthecurrentstatus

ofthecontrollink,anticipatepotentialchangesinthequalityofthelinkastheflightprogresses,

anddiagnoseandrespondtoanychangesthatoccur.Thepilotmayberequiredtointeractwith

securityfeaturesdesignedtopreventunauthorizedpersonsfromtakingcontroloftheUAor

interferingwiththecontrollink.Intheeventofalinkinterruption,theUAmustbecapableof

continuedflightinaccordancewiththeexpectationsofthepilotandairtrafficcontrol.


14

C.Physicalcharacteristicsofthecontrolstation

Thegroundcontrolstation(GCS),locatedremotetotheaircraft,islikelytoincreasingly

resembleacontrolroomratherthanacockpit.Guidelinesmaycovernotonlythehuman-

machineinterface(HMI),butalsothephysicalenvironmentoftheGCS,includingnoiselevels,

accesscontrols,temperaturecontrol,andlighting.

Potentialtoadddisplays:TherelativespaciousnessoftheGCScomparedtoatraditional

cockpitenablesadditionalscreenstobeaddedeasilyandwithouttheforethoughtthatwould

beneededtoaddthemtoacockpit.Aproliferationofinformationdisplayscanaffectthepilot’s

performanceandinteractionwiththeGCS.Considerationwillneedtobegiventodetermining

whethertheadditionofadisplaytotheGCSshouldbeconsideredasignificantorminor

modificationforGCSdesignandcertificationpurposes.

AbilityofmaintenancepersonneltoaccessGCSduringflight:CurrentUASoperations

sometimesinvolvein-flighttroubleshootingsuchasdiagnosingandcorrectingconsolelock-ups,

softwareproblems,andproblemswithcableconnections.Incontrasttoconventionalaviation,

UASmaintenancepersonnelhavetheopportunitytogainaccesstothepilotstationduring

flightoperations,andmayhavehands-oninteractionswiththeGCSwhileaflightisunderway.

Asaresult,maintenanceerrorsmayhaveanimmediateoperationalimpact(Hobbs&Herwitz,

2008).

D.In-flighttransferofcontrol

ControlofaUAmaybetransferredduringflightoperationsbetweenpilotsatthesamecontrol

stationconsole,betweenconsolesatthesamecontrolstation,orbetweenphysicallyseparated

controlstations(Williams,2006).Thesehandoverscanbeatimeofparticularrisk,associated

withsystemmodeerrorsandcoordinationbreakdowns.Forexample,therehavebeencasesof

inadvertenttransferofcontrolbetweenGCSduetocontrolssetinerror.Thecontrolofalong-


15

enduranceaircraftmaybetransferredmultipletimesduringthecourseofasingleflight

(Tvaryanas,2006),witheachhandovercontributingtoacumulativelevelofrisk.

E.UniquecharacteristicsofUASflight

Comparedtomannedaircraft,unmannedaircraftaremorelikelytohaveunconventionalflight

characteristics.Theymayflyatlowerspeeds,climbanddescendmoreslowly,andbemore

likelytoloiteroveralocationthanflypoint-to-point.UASoperationsmayalsostartandend

withlaunchandrecoverysystemsratherthanconventionalrunways.

Extendedperiodsoflowworkload:AchallengeforthedesigneroftheGCSistomaintainpilot

engagementduringextendedperiodsoflowworkload,particularlywhenthepilot’sroleisto

performsupervisorycontrolofautomation(Cummings,Mastracchio,Thornburg,&Mkrtchyan,

2013).Inaddition,thepilotmustbepreparedforrapidincreasesinworkloadduring

emergenciesornon-normalsituations.

F.Flighttermination

Inanemergency,thepilotofaremotelypilotedaircraftmayberequiredtoperformanoff-

airportlanding,orotherwiseterminatetheflightbydestroyingtheaircraftbyacontrolled

impact,ditching,orothermethod.Althoughnolivesareatstakeonboardtheaircraft1,the

pilotisstillresponsibleforthesafetyofotherusersoftheNAS,andtheprotectionoflifeand

propertyontheground.TheGCSmustprovidetheinformationneededforpilotdecision-

makingandenablethepilottoissuethenecessarycommandstotheUA.Theriskof

inadvertentactivationoftheflightterminationsystemmustalsobeconsidered(Hobbs,2010).

1WeassumethatUASwillnotcarrypassengers.


16

G.Relianceonautomation

Manyconventionaltransportaircraftdesignsincorporatesophisticatedautomatedsystems,

howeverthepilotofaconventionalcivilianaircraftwillgenerallyhavetheabilitytoturn-offor

minimizetheuseoftheautomatedsystemsandexerthuman-in-the-loopmanualcontrolofthe

aircraft,evenifthisisviafly-by-wiresystems.MostcurrentdesignsofadvancedUAsrely

entirelyonautomatedsystemsforbasicflightcontrol,anddonotprovideoptionsforpilot

manualcontrol.Instead,theUASpilotisresponsibleforthesupervisorycontrolofthe

automation.ThereforemanualflightcontrolbecomeslessofanissuefortheUASpilot,making

automationmanagementissuesofcriticalimportance.

H.Widespreaduseofinterfacesbasedonconsumerproducts

Groundcontrolstations(GCS)increasinglyresembleofficeworkstations,withkeyboard,mouse

ortrackballinterfacedevices,anddisplaysbasedoncomputerscreens.Inmanycases,

interfaceshavenotbeendesignedinaccordwithaviationregulationsorstandards.Insome

cases,theinterfacesoperateonconsumercomputersoftware.Observedproblemshave

includedaheavyrelianceontextualinformation,complicatedsequencesofmenuselection

requiredtoperformtime-criticalorfrequenttasks,andscreendisplaysthatcanbeobscured

behindpop-upwindowsordialogboxes.AGCSthatcontainscontrolsanddisplayssourced

fromdiversecommercialoff-the-shelf(COTS)providersislikelytosufferfromalackof

consistencyandotherintegrationissues.Thismayresultinincreasedcrewtraining

requirements,reducedefficiency,andanincreasedpotentialforoperatorerrors.

Overviewofexistingrelevantguidelines

Arangeofexistingsourcesprovideguidanceandrequirementsthatmayberelevanttothe

designoftheGCS.AsshowninAppendix1,theseincludehumanfactorsmaterialfromtheFAA,


17

EASA,andDepartmentofDefense,aswellasgeneralstandardswithrelevancetoHMIdesign.

ThecurrentprojectisnotthefirsttoaddresshumanfactorsguidelinesforGCS.Intheearly

2000s,the“Access5”programmadeprogressindevelopinghumansystemintegration

guidanceforGCSfocusingonoperationsaboveFlightLevel430(Berson,Gershzohn,Wolf&

Schultz,2005).TheOfficeoftheUnderSecretaryofDefense(2012)releasedaGCShuman-

machineinterfacedevelopmentandstandardizationguideformilitaryUAS.Themostrecent

versionofMilitaryStandard1472G(HumanEngineering)includesabriefsectiononUAS

interfacedesign(DepartmentofDefense,2012).Materialtouchingonthehumanfactorsof

militaryGCShasalsobeenproducedbytheNorthAtlanticTreatyOrganization(NATO)in

StandardizationAgreements(2007,2009).OrganizationssuchasASTM(2007,2014),RTCA

(2007,2010,2013)andtheInternationalCivilAviationOrganization(ICAO,2011)arealso

addressingtheissuesofUASintegration.

Muchoftheprecedingworkdealtwithmilitaryapplications,orprovidedgeneral

comprehensivehumanfactorsguidelinesforsystemdesigners.Incontrast,thecurrentproject

hasanarrowerfocus,limitedtothespecialrequirementsofcivilianUASoperations.

Typesofguidelines

Severalareaswhereguidelinesmaybeusefulcanbeidentifiedbyaskingthequestionsshown

inFigure3.Theprocessleadstofivebroadtypesofguidelines,describedinfurtherdetailinthe

followingsections.


18

Figure3.Questionsabouthuman-systeminteractionthatleadtofivetypesofguidelines.

Pilottasksthatmustbeperformedviatheinterface

Certainguidelinesprovidedescriptionsofpilottasksthatthehumanoperatorshouldbeableto

performviatheinterface.Forexample,asaparticipantintheNAS,theUASpilotmaybe

requiredbyATCtodirecttheaircraftontoamagneticheading.ThereforetheGCSmust

providedisplaysandcontrolstosupportthistask.Ingeneral,aguidelinethattakestheformof

ataskstatementisaformofperformance-basedstandardthatdescribestheoutcomewithout

defininghowitwillbeachieved,althoughadesiredlevelofaccuracyorspeedmaybespecified.

Anadvantageoftaskstatementsisthattheytendtobeindependentofspecifictechnologiesor

WhatPICtasksare(1)uniquetoUASor(2)willpresentuniquechallengesforthePIC?

WhatinformationmusttheGCSprovidetothePICtoenabletaskperformance?

WhatinputsmustthePICmakeviatheGCStoperformassignedtasks?

Howshouldcontrolsanddisplayslook,feel&sound?Howshouldtheyoperate?

Whatbroadoradditionalprinciplesapplyacrosstheengineeredsystem?

PICtaskswithspecificsignificanceforUAS

Propertiesoftheinterface

Controlinputs

Informationcontentofdisplays

General-levelguidelines

QUESTION ANSWER


19

designsolutions,andarelikelytoremainrelevantand“future-proof,”evenastechnology

evolves.Inthisdocument,wefocusonpilottasksthatareuniquetoUASoperations,ortasks

thatpresentsignificantadditionalchallengesforUASpilotcomparedtothepilotofa

conventionalaircraft.


Theseguidelinesdealwiththeinformationthattheinterfaceisexpectedtoprovidetothepilot

viadisplays.Theseguidelinesdonotspecifytheformthattheinformationshouldtake.For

example,itmaybestatedthatthepilotshouldreceiveanalertifthecontrollinkislost,without

specifyingwhetherthealertshouldbecommunicatedusingauditory,visual,orhapticmeans,

orsomecombinationofthesemodes.Theseguidelineswilltypicallybeexpressedingeneral

terms,leavingtheHMIdesignerfreetocreateaninterfacethatmeetstheintentofthe

guideline.

Controlinputs

TheseareinputsthattheGCSmustbecapableofreceivingfromthepilot.Therequirement

mayspecifykeyattributesoftheinput,suchastimingandprecision,butwillremainagnostic

withrespecttothedeviceusedtomaketheinput.

Propertiesoftheinterface

ThepropertiesoftheHMIincludelayout,shape,physicalaccessibility,visibility,theuseofcolor

andthestructureofspecificcomputerinterfaces.Despiteawidespreaduseofelectronic

displays,menustructuresandpointandclickinputdevices,physicalergonomicsarestill

relevantforthedesignofgroundcontrolstations,asseveralanalysesofUASinterfaceshave


20

identifiedissuessuchascontrolsthatareoutofreachofthepilot,orcriticalcontrolsin

locationswheretheycanbeactivatedinadvertently.

Generalguidelines

Generaldesignguidelinesare“overarching”principlesthathavegeneralapplicabilitytothe

GCSandrelevancetomultipledisplaysandcontrols.Inmostcases,theseareagnosticwith

respecttotheformoftheinterface.Examplesaregeneraldesignprinciplesforhuman-machine

interfacesdealingwithissuessuchastheinternalconsistencyoftheinterface,theneedto

managedataoverload,andtheavoidanceofcompetingalarms(Endsley&Jones,2012;

Norman,1988;Shneiderman&Plaisant,2005).Somegeneralguidelinesrelatetotheoverall

functioningoftheGCS,includingcharacteristicsthatemergefromtheoperationofallsub-

systemstogether.Forexample,visualclutter,displaycompetitionforattentionandthe

prioritizationofinformation.

UASpilotresponsibilities

Figure4presentsahigh-levelmodeloftheresponsibilitiesoftheUASpilot,consistentwith

FAAassumptions,adaptedfromMutuel,WargoandDiFelici(2015).Themodelcanactasa

checklisttoensurethatallareasofhuman-systeminteractionareconsideredwhen

developingguidelinesforthehuman-machineinterface.Insomecases,broadareasof

responsibilityarecommontobothconventionalandunmannedaviation,yetmaypresent

specialchallengesfortheUASpilot.Theseincludemonitoringandcontrollingthestatusof

radiolinks,controlhand-offs,andflighttermination.


21

Figure4.ResponsibilitiesoftheUASpilot

Manage:The“Manage”categoryincludestheoverallplanning,decision-making,and

managementresponsibilitiesthatmustbeaccomplishedbythepilot,supportedbythehuman-

machineinterface.Foreaseofpresentation,managementresponsibilitiesareshownseparately

inFigure4,althoughtheyoverlapandcut-acrossotherresponsibilities.

Aviate:Theseresponsibilitiesincludetactical,orshort-term,controloftheairvehicleandits

ground-basedequipment,andthecontrollink.Inmostcases,thecontinuouscontrolfunctions

necessaryforthemaintenanceofstableflightareallocatedtoon-boardautomation,however

thepilotisstillrequiredtoprovidesupervisoryoversightandcontroltheconfigurationof

systems.Maneuverstoavoidcollisionswithotheraircraftorobjectsareincludedinthese

responsibilities.

Navigate:Thenavigationresponsibilitiesinvolvestrategic,orlonger-term,controloftheair

vehicleanditsground-basedequipment.Controllingandmonitoringthelocationandflight


22

pathoftheaircraftincludesensuringthattheaircraftnavigateswithrespecttoairspace

boundaries,terrainandotherconsiderations.Theself-separationresponsibilitymustbe

accomplishedintheabsenceofanout-the-windowview,necessitatingrelianceonatraffic

situationdisplayintheGCS.Thetwofinalresponsibilitieslistedunder“Navigate”arespecificto

unmannedaviation.Thepilotmustmaintainanawarenessoftheaircraft’spre-programmed

lostlinkmaneuver,andensurethatthemaneuverisupdatedasnecessaryastheflight

progresses.Finally,intheeventofaseriousin-flightanomaly,thepilotmayberequiredto

terminatetheflight,possiblybydirectingtheaircrafttoasuitablelocationforacontrolled

impactorditching,orbydeployingaparachutesystem.Ineithercase,thepilotmustminimize

risktopeopleandproperty.

Communicate:ThepilotincommandmustcommunicatewithATC,otherairspaceusers,other

membersoftheflightcreworsupportteam,andancillaryservicessuchasweatherbriefers.

CommunicationandcoordinationwithintheUASoperatingteamiscriticalandtheUAShuman-

systeminterfacemustbedesignedtoenableteamsituationawarenesstobeachieved.Ifthe

UAisoperatingfarfromtheGCS,pilot-ATCcommunicationsmayberelayedusingground

infrastructure,satellite,orair-to-airrelays.Relayshavethepotentialtointroducetimedelays,

withdisruptiveimplicationsforverbalcommunication.


23

Guidelines

Thissectioncontainstwobroadsetsofpreliminaryhumanfactorsguidelines.Guidelines

containedinthefirstsetrefertospecificcharacteristicsorcapabilitiesoftheinterface,andare

organizedusingthemodelofpilotresponsibilitiesshowninFigure4.Theletteratthe

beginningofeachguidelinecodeindicatesthetypeofguideline.Guidelineswithcodes

beginningwith“T_”specifypilottasksthatmustbefacilitatedbytheGCS.Guidelinesspecifying

theinformationcontentofdisplayshavecodesbeginningwith“I_”.Controlinputguidelines

havecodesbeginningwith“C_”,andguidelinesspecifyingpropertiesofdisplaysandcontrols

have“P_”codes.Thesecondsetofguidelinescomprisesconsiderationsthathavegeneral

applicabilitytotheGCS,possiblyacrossmultiplepilotresponsibilities.Theseguidelinesare

indicatedbya“G_”code.Thissetofguidelinesincludeshumanengineeringactivitiesthatthe

GCSdeveloperisexpectedtoaccomplishinordertoproduceaGCSthatcanbeoperatedsafely

andreliably,consideringhumancapabilitiesandlimitations.Placeholders,denotedby“TBA”

indicatewherefuturematerialistobeadded.

Characteristicsandcapabilitiesoftheinterface

Aviate

Thegoalof“Aviate”activitiesistoensurethatthebasicfunctionsoftheaircraftoperate

effectively.Theseresponsibilitiesincludetactical,orshort-term,controloftheairvehicle,the

controllink,andthecontrolstation.

Responsibility1.1:Monitorandcontrolaircraftsystems,includingautomationInmostcases,thecontinuouscontrolfunctionsnecessaryforthemaintenanceofstable

flightareallocatedtoon-boardautomation,howeverthepilotisstillrequiredtoprovide

supervisoryoversightandcontroltheconfigurationofsystems.Thismayincludemode

selectionsforautomatedsystems.Theinformationnecessarytoperformthesefunctions

willbeprovidedbythetelemetry(ordownlink)elementofthecontrollink


24

Pilottasksthatmustbeperformedusingtheinterface

T_1.1.1TheGCSshouldenablethepilottomonitorwhichentityhascontroloftheaircraftandtowhatextenttheentityhascontrol.(Access5(2006)

T_1.1.2Ifanon-boardcameraisusedforflightcontroltasks,theGCSshouldenablethepilottocenterthefieldofviewofthecamera.


TBA.

Controlinputs

TBA.

Propertiesofdisplaysandcontrols

P_1.1.1TheGCSshouldnotenablethepilottodisengageautomationinflightiftheaircraftwilldepartfromcontrolledflightasaresult.

P_1.1.2TheGCSshouldpreventmultipleoperatorsfromoperatingthesameapplication/proceduresatanyonetime.(NATO,2004)P_1.1.3TheGCSshouldprovidetheabilitytoallowotheroperatorstoviewthestatusofaircraftsystems.(NATO,2004)

Relatedspecialconsiderations

A.Lossofnaturalsensing; B.Controlandcommunicationviaradiolink

Responsibility1.2:MonitorconsumableresourcesConsumableresourcesontheUAcanbeexpectedtoreduceinquantityoverthecourseof

aflight.Dependinguponthedesignoftheaircraft,theseresourcesmayincludefuel,oil,

andbatterypower.TheGCSmustenablethepilottomonitorthestatusoftheseresources.

Manyaspectsofthisresponsibilitywillbethesameforunmannedandmannedaircraft.The

taskofmonitoringconsumableresourcesmayinvolveaspectsuniquetoUAS,including


25

unconventionalpropulsionsystemsandlongdurationflights.Additionally,thepilotmustbe

preparedforthepossibilitythatalostlinkproceduremayplaceadditionaldemandson

consumableresources,andthepilotmaybeunabletointervenewhiletheaircraftis

performingthelostlinkprocedure.


T_1.2.1TheGCSshouldenablethepilottomonitorthestatusofconsumableresources.Informationcontentofdisplays

I_1.2.1TheGCSshouldprovidethepilotwithinformationonthestatusofconsumableresources.

Controlinputs

TBA.



E.Uniqueflightcharacteristicsofunmannedaircraft

Responsibility1.3:MonitorandconfigurecontrolstationManagementoftheGCSwillrequirethepilotorothercrewmemberstomonitorand

configurethestatusoftheGCS,andidentifyandrespondtoabnormalconditions.Thismay

includemanagingtheperformanceofcomputersystemsandpowersupplies.Unique

considerationscouldincludetheneedtomanageuninterruptablepowersuppliesandair

conditioningrequiredforcomputersystems.IfasecondGCSisplannedtobeusedduring

theflight,orisavailableonstandby,thepilotmayalsoneedtomaintainanawarenessof

thestateofreadinessofthisGCS.



26

T_1.3.1TheGCSshouldenablethepilottoperformgroundstationperformancechecks.

T_1.3.2TheGCSshouldenablethepilottoperformapre-flightcheckonanalternatecontrolstation,orconfirmthatthischeckhasbeenperformed.(RTCA,2007)

T_1.3.3TheGCSshouldenablethepilottocheckthecontrolstationfordamageandfunction.

T_1.3.4TheGCSshouldenablethepilottomonitortheperformanceofGCSsupportservices,e.g.airconditioningandelectricalpower.


I_1.3.1TheGCSshouldprovidethepilotwithhealthandstatusinformationontheGCS.Controlinputs

TBA.


TBA.


C.PhysicalcharacteristicsoftheGCS

Responsibility1.4:Maneuvertoavoidimminenthazard–CollisionAvoidanceThisresponsibilityreferstotacticalmaneuverstoavoidcollisionswithproximateaircraftor

objects.Itincludesthetime-criticalCollisionAvoidanceelementofDetectandAvoid

(DAA)*.Inthecaseofcollisionavoidancewithotheraircraft,thehuman/machinesystem

mustdetectthepresenceofproximatetraffic,identifytrafficthatposesacollisionthreat,

determineandcarryoutanappropriateresponse,aswellascommunicatingwithATC.

Giventhespeedwithwhichacollisionavoidancemaneuvermustbemade,itislikelythat

communicationwithATCwillnotoccurpriortothecommencementofthemaneuver.

Giventheabsenceofanout-the-windowview,thedetectionandpresentationtotheUAS

pilotoftrafficorotherthreatsmustbeperformedbytechnology.Howeverthesubsequent


27

stepsmaybeassignedtoeitherautomationorthepilot,dependinguponsystemdesign.

Becausealost-linkconditionmaypreventthepilotfromperformingahuman-in-the-loop

roleduringcollisionavoidance,someUAsmaybecapableofexecutingautonomous

collisionavoidancemaneuvers.

CollisionavoidancecanbeseenasthefinalstageofDAAandwillonlybenecessarywhen

self-separationhasnotkepttheUAwell-clearofothertraffic.Self-separationrelatestothe

maintenanceofawell-cleardistancefromtraffic,andmayoccurwhiletheaircraftarestill

somedistancefromeachother.Guidelinesthatapplytotheself-separationelementsof

detectandavoid(andtheearlystepsofcollisionavoidance)canbefoundinsection2.3

“Self-Separation”.Itshouldalsobenotedthatbecausethisdocumentisfocusedonthe

uniquerequirementsofunmannedaviation,standardsformannedaviationthatwillalsobe

relevanttounmannedaviationarenotgenerallyreproducedhere.Formoreinformation

thereadercanrefertoexistingrequirementsforTrafficAlertandCollisionAvoidance

(TCAS)systems(RTCA,2008)andCockpitDisplaysofTrafficInformation(RTCA,2014).

*Theself-separationelementofDAAwillbecoveredunderthe“Navigate”responsibility.

TheGCSshouldenablethepilottoaccomplishthefollowingtasks

ThefollowingtasksmustbeaccomplishedbythepilotinsituationsthatrequiretheUAto

avoidacollision.

T_1.4.1TheGCSshouldenablethepilottoidentifythethreatofanimpendingcollisionoftheUAwithotheraircraft,terrain,orobjects.

T_1.4.2TheGCSshouldenablethepilottorecognizetheneedforaUAevasivemaneuvertoavoidanimpendingcollisionoftheUAwithotheraircraft,terrain,orobjects.

T_1.4.3TheGCSshouldenablethepilottodetermineanappropriatemaneuvertoavoidacollisionoftheUAwithotheraircraft,terrain,orobjects.T_1.4.4TheGCSshouldenablethepilottoexecuteaUAcollisionavoidancemaneuver.

T_1.4.5TheGCSshouldenablethepilottocommunicatewithATCaboutacollisionavoidance

maneuverandotherdeparturesfromtheassignedflightpath.

T_1.4.6TheGCSshouldenablethepilottoreturntheUAtotheassignedflightpathafter


28

maneuveringtoavoidacollision.

T_1.4.7IftheUAiscapableofmakinganautonomouscollisionavoidancemaneuver,theGCS

shouldenablethepilottomonitorthemaneuver.

T_1.4.8IftheUAexecutesanautonomouscollisionavoidancemaneuver,theGCSshouldenable

thepilottosmoothlyregaincontroloftheUAattheconclusionofthemaneuver.

InformationthatGCSmustprovideforthepilottoaccomplishthetasks

I_1.4.1TheGCSshouldprovideanalerttothepilotwhenthereisathreatoftheUAcollidingwithanotheraircraft,terrain,orobjects.ThealertmustbeprovidedintimeforthepilottoeffectivelyrespondtomaketheUAavoidthecollision.

I_1.4.2TheGCSshouldprovideinformationaboutterrainorground-basedobjectswithinproximityoftheprojectedUAflightpathandmaybecomeathreatforUAcollision.

I_1.4.3TheGCSshouldprovidethepilotwiththeinformationnecessarytodetectaircraft,obstructionsorpeoplewhiletheUAismovingontheground.Thisinformationmaybeprovidedthroughacameralocatedontheaircraft,orClosedCircuitTelevision(CCTV)cameraslocatedontheground.

I_1.4.4TheGCSshouldprovidethepilotwiththeinformationnecessarytodetectobstructionsthatmayaffectlaunchortakeoff.Thisinformationmaybeprovidedthroughacameralocatedontheaircraft,orCCTVcameraslocatedontheground.

I_1.4.5TheGCSshouldprovidethepilotwiththeinformationnecessarytodetectobstructionsthatmayaffectapproachandlanding.Thisinformationmaybeprovidedthroughacameralocatedontheaircraft,orCCTVcameraslocatedontheground.

I_1.4.6TheGCSshouldprovidethepilotinformationaboutthelikelihoodoftheUAcollidingwiththeupcomingthreatsothatthepilotwillbeabletomakeadecisionabouttheneedtotakeevasiveactiontoavoidacollision.

I_1.4.7TheGCSshouldprovidethepilotwithapredictionofthetimeavailableuntiltheUAwouldcollidewiththethreataircraft,object,orterrain.

I_1.4.8TheGCSshouldprovideinformationabouttheaircraftsurroundingtheUAandthecollisionthreattohelpinmakingadecisionaboutmaneuversthatwouldnotcauseadditionalrisksforcollision.

I_1.4.9TheGCSshouldprovideinformationaboutthecapabilitiesoftheUAformakingevasivemaneuversinthecurrentUAsituation.Thisinformationshouldincludeatleastthefollowing:

I_1.4.9aPossiblemaneuversthatcanbemadebytheUAinthecurrentsituation–e.g.climb,descend,turnwithinacertainradius.


29

I_1.4.9bTimefortheUAtoaccomplishthemaneuvers–e.g.howlonguntiltheUAreachesacertainturnradiusorclimbattitude.

I_1.4.10TheGCSshouldprovidethepilotwithinformationnecessarytoquicklyidentifythecurrentstate,mode,orsettingofallcontrolsthatareusedtosendflightcommandstotheUA.

I_1.4.11TheGCSshouldprovidethepilotwithinformationontheflightpaththathadbeenassignedtotheUApriortotheevasivemaneuver.

I_1.4.12TheGCSshouldprovideinformationaboutthenecessaryUAtrajectoryneededtoreturntotheassignedflightpath.ThisshouldincludethenecessaryUAheadingandaltitudechanges.

I_1.4.13Ifanautonomouscollisionavoidancemaneuveriscarriedout,theGCSshouldalertthepilotthatthemaneuverisunderway,andmustnotifythepilotwhenthemaneuverisconcluded.

Controlinputs

C_1.4.1TheGCSshouldprovideacontroltocancelthecollisionalertifitwillbeongoinganddistractthepilotinaccomplishingothertasks.

C_1.4.2FlightcontrolsshouldbeprovidedtoenablethepilottorapidlycommandtheUAtoexecuteaneffectivemaneuvertoavoidanimpendingcollision.ThecontrolsshouldbereadilyavailableatalltimesandmustbedesignedtoenablethepilottomakethecommandtotheUAinthetimeneededtoperformthecollisionavoidancemaneuver.Theflightcontrolsmustincludemeanstocontrol:

C_1.4.2aUAattitude.

C_1.4.2bUAheading.

C_1.4.2cUAspeedand/orthrust.Propertiesofdisplaysandcontrols

ThefollowingpropertiesareimportanttoconsiderwhendesigningtheGCSdisplaysand

controlsforthepilottoaccomplishcollisionavoidancemaneuvers.

P_1.4.1Informationandcontrolsshouldbereadilyaccessibleforthepilottorecognizeandaccomplishcollisionavoidancemaneuvers.

P_1.4.2Collisionavoidancealertsmustattractthepilot’sattentioninallexpectedlightingandoperatingconditions.

P_1.4.3Time-consumingorcomplicatedsequencesofactions(e.g.involvingmultiplelevelsofmenustructures)mustnotbenecessarytoaccomplishcollisionavoidancemaneuvers.

P_1.4.4Primaryflightcontrolsshouldbedesignedinamannerforthepilottoquicklyexecutecriticalcollisionavoidancemaneuversinallexpectedoperatingconditions.


30

RelatedSpecialUASConsiderations

A.Lossofnaturalsensing.

Responsibility1.5:ManagestatusofcontrollinksThecontrolandcommunications(C2)linkisanintegralpartoftheUAS.Thelinkmayutilize

acombinationoftechnologies,includingterrestrialradio(stand-aloneornetworked),

satelliteradio(geostationaryorlowearthorbit),air-to-airrelays,andground-based

communicationinfrastructure.Aswellasmanagingtheaircraft,theflightcrewofaUAS

operatingintheNASmustmaintainanawarenessofthestatusoftheC2link,andwill

requiretheabilitytomanagethelink.Linkmanagementwillbeparticularlycriticalduring

controlhandovers,lostlinkandlinkresumption,whenoperatingtowardsthelimitsofthe

signal,andduringfrequencychanges.Theuseoftheword“link”inthefollowingguidelines

includesuplinkanddownlink.


T_1.5.1TheGCSshouldenablethepilottoconfirmspectrumavailabilitybeforeselectinglink.

T_1.5.2TheGCSshouldenablethepilottoselecttheappropriatecommunicationmode(e.g.terrestrial/satellite,frequency).

T_1.5.3TheGCSshouldenablethepilottomaintainawarenessofselectedcommunicationmode.

T_1.5.4TheGCSshouldenablethepilottoconfirmthatcommunicationlinkiseffective,andestablishedwiththecorrectUA.

T_1.5.5TheGCSshouldenablethepilottoidentifyifmorethanonecontrolstationislinkedwiththeUA.

T_1.5.6TheGCSshouldenablethepilottomaintainawarenessoflinkstrength,orlinkabnormalities.

T_1.5.7TheGCSshouldenablethepilottomaintainawarenessoflinklatency,whererelevant.

T_1.5.8TheGCSshouldenablethepilottoanticipatelinkdegradationsordiminishedlinkstrength.


31

T_1.5.9TheGCSshouldenablethepilottomaintainanawarenessofthegeographiclimitsofthelinkandpotentialobstructionstosignal.

T_1.5.10TheGCSshouldenablethepilottomaintainawarenessofcrewactionsorcontrolinputsthatcouldinterruptordegradethelink.

T_1.5.11TheGCSshouldenablethepilottorespondtointerferencewiththesignal,(e.g.otherusersoffrequency,jammingattempts).

T_1.5.12TheGCSshouldenablethepilottochangethelinkduringflightoperationsasnecessary.

T_1.5.13TheGCSshouldenablethepilottoassesslinkstrengthandqualitybeforeswitchinglink.

T_1.5.14TheGCSshouldenablethepilottodefinethedurationofalossoflinkthatmustoccurbeforethelostlinkalertisactivated,ortheUAentersitslostlinkprocedure.

T_1.5.15TheGCSshouldenablethepilottomanageresumptionofthesignalafteralostlink.


I_1.5.1TheGCSshouldbecapableofprovidingthepilotwithpredictiveinformationonthequalityandstrengthofaC2linkbeforethelinkisactivelyusedtocontroltheUA.

I_1.5.2TheGCSshouldprovideinformationtoenablethepilottoidentifywhichC2linksettingsareactive(e.g.selectedfrequency,satellitevsterrestrial).

I_1.5.3TheGCSshouldprovidethepilotwithinformationtoconfirmthateffectivecontrolisestablishedwiththecorrectUA.

I_1.5.4TheGCSshouldprovidethepilotwithinformationonthegeographiclimitsofthelink.

I_1.5.5TheGCSshouldprovidethepilotwithinformationonspectrumactivityfromaspectrumanalyzer.

I_1.5.6TheGCSshouldalertthepilotwhentheUAisapproachinganareawherelinkislikelytobelost.

I_1.5.7TheGCSshouldalertthepilotwhenthelinkislost.

I_1.5.8TheUAwilltransmitapre-determinedtranspondercodewhenthelinkislost.

I_1.5.9TheGCSshouldprovideinformationtoenablethepilottomonitorthestrengthofthelink.

I_1.5.10TheGCSshouldalertthepilotwhenevertheC2linkexperiencesinterference,whetherresultingfromnaturalphenomena,payloadorotherequipmentassociatedwiththeUAS,orhumanactivities(suchasjammingorotherusersonfrequency).

I_1.5.11TheGCSshoulddisplaytothepilotthesourceofdownlinktransmissions.


32

(Access5,2006)

I_1.5.12Whererelevant,theGCSshouldprovidethepilotwithinformationonlinklatency,inmilliseconds.

I_1.5.13TheGCSshouldprovideinformationtoenablethepilottoanticipatelinkdegradationsordiminishedlinkstrength.Thisinformationmayincludelinkfootprint,includingareasthatmaybeaffectedbyterrainmasking.

I_1.5.14TheGCSshouldprovideinformationtoenablethepilottomanagelinksecurity.

I_1.5.15TheGCSshouldinformthepilotwhenalostlinkisresumed.

Controlinputs

C_1.5.1TheGCSshouldenablethepilottoselectthecommunicationmode(e.g.terrestrial/satellite,frequency,transmissionpower).

C_1.5.2TheGCSshouldprovideacontroltoenablethepilottorequestalinkstatusreport.

C_1.5.3Ifantennaselectionisperformedbythepilot,thentheGCSshouldsupportanexternalcommandtosettheantennausedforcommunication.

C_1.5.4TheGCSshouldenablethepilottosetthedurationofalinkoutagethatmustoccurbeforealostlinkresponseistriggered.


P_1.5.1“TheremustbeanalertfortheUAScrew,viaaclearanddistinctauralandvisualsignal,foranytotallossofthecommandandcontroldatalink”.(NATO,2009)

P_1.5.2Theauralwarningforlostcontrollinkshouldbeauniquesound,notalsousedtosignifyotherconditions.

P_1.5.3ThemaximumrangeoftheC2datalink(datalinkfootprint)forallaltitudesanddirectionsrelativetothesignalsourceshouldbepresentedvisuallytothepilot,overlaidonamapdisplay.

P_1.5.4AreaswheretheC2link(datalinkfootprint)arepredictedtobemaskedbyterrainshouldbedisplayedontheC2datalinkdisplay.

P_1.5.5Ifthedatalinkfootprintcanbesuppressed,itshouldbeautomaticallydisplayedwhentheUAisapproachingalocationwherealossoflinkislikely.

P_1.5.6TheC2datalinkfootprintshouldbeeasilydistinguishablefromotherfootprintsthatmaybepresentontheoperatormapdisplay.(NATO,2004).

P_1.5.7Ifthepayloadutilizesalinkseparatetotheaircraftcontrollink,anydisplayofpayload


33

linkqualityshouldbeseparateandclearlydistinguishablefromdisplaysfortheaircraftcontrollink.

P_1.5.8Ifanauralwarningisusedtoindicatelossofpayloadlink,thesoundshouldbedissimilartothatusedtoindicatelossofcontrollink.

P_1.5.9Securityfeaturesdesignedtopreventunapprovedaccess(logonandlogofffunctions)shouldnotresultininadvertentlockoutsofauthorizedpersonnel.

P_1.5.10TheGCS,incombinationwiththeotherelementsoftheUASshouldcomplywithcontrollinklatency(timefrominitiationofamaneuvertoameasurableresponsebytheUA)requirementsthatareestablishedatalevelsimilartomannedaircraft.(FAA,2013b)


B.Controlandcommunicationviaradiolink.

Navigate

Thenavigateresponsibilityinvolveslargelystrategic,orlonger-term,controloftheairvehicle

anditsground-basedequipment.

Responsibility2.1:Controlandmonitorlocationandflightpathofaircraft.Controllingandmonitoringthelocationandflightpathoftheaircraftincludesensuringthat

theaircraftkeepstoitsflightplan,takingintoaccountairspaceboundaries,terrainand

otherconsiderations.Thisresponsibilityincludesgroundtaxiingandcomplyingwithall

requirementsfornavigatingairporttaxiwaysandrunways.


T_2.1.1TheGCSshouldenablethepilottomonitorandcontrolthepositionoftheUAwhenonthegroundandintheair.T_2.1.2TheGCSshouldenablethepilottoensurethatboththerunwayandapproachpathareclearoftrafficbeforetaxiingontotheactiverunway.(FAA,2013b)

T_2.1.3“TheUASshallbecapableoftransitioningfromaninstrumentapproachproceduretoasafelanding,eitherbyvisualreferenceofaflightcrewmemberattheairportorbyothermeansacceptabletotheFAA”.(FAA,2013b)


34


I_2.1.1UApositioninairspace.TheGCSshouldprovidearepresentationoftheUAwithintheairspace.Thisinformationshouldprovide:

I_2.1.1aRepresentationofUAwithintheairspace.

I_2.1.1bHeadingofUA.

I_2.1.1cAltitudeofUA.

I_2.1.1dSpeedofUA.

I_2.1.1eAttitudeofUA.

I_2.1.1fPositionofUArelativetootheraircraft,terrain,andobstacles.

I_2.1.2ProgrammedflightplanandpredictedflightpathofUA.TheGCSshouldprovidearepresentationofthepredictedflightpathoftheUAbasedontheflightplanprogrammedintotheflightmanagementsystembasedontheassignedflightclearance.Thisinformationshouldinclude:

I_2.1.2aIndicationofUAcurrentpositionalongprogrammedflightpath.

I_2.1.2b.PredictedflightpathrelativetoUAandothertraffic,terrain,andobstacles.

I_2.1.2cDistancetowaypointsalongflightpath.

I_2.1.2dIndicationofpositioninflightpathwhennewcommandedaltitudewillbeattained.

I_2.1.2eIndicationofturningradiusandpathwhenmakingturnsalongflightpath.

Controlinputs

C_2.1.3TheGCSshouldenablethepilottomaneuvertheUA.Propertiesofdisplaysandcontrols

P_2.1.1ThemapdisplayshouldbeabletosupportavarietyofmaptypesincludingaeronauticalchartsandpresentationsofDigitalTerrainElevationData(DTED).

P_2.1.2Thepresentationscaleofthemapshouldbeselectable.Continuousscalingispreferredtodiscrete.(NATO,2004)

P_2.1.3Thepilotshouldbeabletoderivethescaleofthemapfromthedisplay.(NATO,2004)


35

P_2.1.4ThemapdisplayshouldenablethepilottocustomizetheAircraft’sInformationTrail.(NATO,2004)

P_2.1.5Themapdisplayshouldbeconfigurableto“Northup”or“Trackup”.

P_2.1.6Ifcontrolisviaaterrestrialradio,thelocationof(ordirectionto)thegroundtransmitter/receivershouldbeshownonthemap.P_2.1.7PrimaryflightcontrolsforcontrollingtheUA(heading,attitude,speed)shouldbeavailableatalltimesthroughdedicatedphysicalcontrols.Iftheuseofsoftware-basedcontrolscannotbeavoided,thenthecontrolsshouldbeimmediatelyaccessibleatthetoplevelofthecontrolinterface.(NATO,2009).

P_2.1.8Mapdisplaysshouldhavemeanstoselectthescaleofthemaptobepresented.Thescalespresentedonthemapsshouldbeevidenttothepilot.(NATO,2004)

P_2.1.9Thepilotshouldhavethemeanstocustomizetheinformationtrailforanaircraftshownonthetrafficdisplay.(NATO,2004)


A.Lossofnaturalsensing;C.Controlstationonground;G.Relianceonautomation.

Responsibility2.2:Remainclearofterrain,airspaceboundariesandweatherThisresponsibilitycoverstheactivitiesinvolvedinremainingclearofundesiredlocations

thatcanbeidentifiedduringflightplanningormaybecomeapparentduringthecourseofa

flight.Theselocationsmaybeundesiredduetoterrain,airspaceboundaries,weather,or

otheroperationalrestrictions.


T_2.2.1TheGCSshouldenablethepilottoensurethatboththerunwayandapproachpathareclearoftrafficbeforetaxiingontotheactiverunway.(FAA,2013b)

T_2.2.2TheGCSshouldenablethepilotto“observe”andcomplywithsignageandwarninglightsduringsurfaceoperations.


36

(FAA,2013b)

T_2.2.3TheGCSshouldenablethepilottomonitorweatherthathasthepotentialtoaffecttheflight.(RTCA,2007)

T_2.2.4TheGCSshouldenablethepilottoavoidweatherthathasthepotentialtoaffecttheflight.

T_2.2.5TheGCSshouldenablethepilottoavoidicingconditions.Informationcontentofdisplays

DisplayAirspaceCoordinationInformation

I_2.2.1“Theoperatorshouldbeabletodisplayflightcorridors,controlledairspaceandanyotherrelevantairspaceco-ordinationinformation”.(NATO,2004)

I_2.2.2TheGCSshoulddisplayweatherinformationtothepilot.

I_2.2.3TheGCSshouldprovidethepilotwithinformationonthelocationoficingconditions,especiallyiftheUAisnotcertificatedforflightinicingconditions.

I_2.2.4TheGCSshouldalertthepilotwhentheUAentersicingconditions.

I_2.2.5TheGCSshouldalertthepilotwhentheUAencounterssignificantairturbulence.

Controlinputs

TBA.


TBA.


A.Lossofnaturalsensing;E.UniquecharacteristicsofUASflight.

Responsibility2.3:Self-separatefromotheraircraftThisresponsibilityincludesthestrategicseparationassurancefunctionofDetectandAvoid

(DAA),inwhichtheUAremainswellclearofothertraffic*.TheNASAUASintheNAS


37

projectisdevelopingMinimumOperationalPerformanceStandards(MOPS)forthehuman-

machineinterface(HMI)ofDAASystems.ThismaterialwillfocusonUAS-specificissuesthat

arenotcoveredinRTCA(2014)“GuidelinesforCockpitDisplaysofTrafficInformation”,and

willbeincludedinaforthcomingstandardtobepublishedbyRTCAin2016.Thefinal

approvedRTCAguidelines,whenpublicallyreleased,willreplacethepreliminaryself-

separationguidelinesincludedbelow.

Forthepurposesofthisdocument,guidelinesthathavegeneralrelevancetonavigationare

containedinSection2.1“ControlandMonitorLocationandFlightpathofAircraft”.

GuidelinesthatrelatetocommunicationwithATCthatmustoccurtoaccomplishself-

separationarecontainedinSection2.0“Communication”.

*Notethatevasivemaneuversforimmediatecollisionavoidanceareincludedunder“1.4:

Maneuvertoavoidimminenthazard–CollisionAvoidance”.


T_2.3.1TheGCSshouldenablethepilottomonitoralltrafficintheairspacearoundtheUAtoidentifypotentialforupcomingwell-clearviolations.

T_2.3.2TheGCSshouldenablethepilottoquicklyidentifyanythreatofanaircraftviolatingthewell-clearairspaceoftheUA

T_2.3.3TheGCSshouldenablethepilottotrackthesurroundingtrafficflightpaths,assesstheriskofwell-clearviolations,andrecognizetheneedfortheUAtomaneuvertomaintainself-separationcriteria

T_2.3.4TheGCSshouldenablethepilottodeterminetheappropriatemaneuverfortheUAtomaketomaintainself-separation.

T_2.3.5TheGCSshouldenablethepilottocommandtheUAtoexecutetheevasivemaneuver

T_2.3.6TheGCSshouldenablethepilottocommunicatewithATCaboutmakingtheseparationmaneuveranddepartingfromtheassignedflightpath

T_2.3.7TheGCSshouldenablethepilottoreturntheUAtotheassignedflightpathaftermaneuveringforself-separation.



38

MaterialfromRTCASC-228MinimumOperationalPerformanceStandards(MOPS)forUnmannedAircraftDetectandAvoidtobeaddedhere.ThisMOPSiscurrentlyindraftform.

Controlinputs

MaterialfromRTCASC-228MinimumOperationalPerformanceStandards(MOPS)forUnmannedAircraftDetectandAvoidtobeaddedhere.

Guidelinesforpropertiesofdisplaysandcontrols

MaterialfromRTCASC-228MinimumOperationalPerformanceStandards(MOPS)forUnmannedAircraftDetectandAvoidtobeaddedhere.

RelatedSpecialUASConsiderations

A:Lossofnaturalsensing.

Responsibility2.4:EnsurethatlostlinkprocedureisappropriateThepilotmustmaintainanawarenessoftheaircraft’spre-programmedlostlinkmaneuver,

andensurethatthemaneuverisupdatedasnecessaryastheflightprogresses.Ifthelost

linkprocedurebecomes“stale”,theaircraftmayexecuteanunsafemaneuverintheevent

ofalostlink,suchasflyingtowardsterraininanattempttoreachawaypointprogrammed

earlierintheflight.


T_2.4.1TheGCSshouldenablethepilottoremainawareoftheaircraft’slostlinkprocedureastheflightprogresses.

T_2.4.2TheGCSshouldenablethepilottoupdatetheaircraft’slostlinkprocedureastheflightprogresses.


I_2.4.1TheGCSshouldprovidethepilotwithadisplayindicatingthefutureflightpathofthe


39

aircraftshouldalostlinkoccur.

I_2.4.2TheGCSshouldalertthepilotwhenevertheexecutionofalostlinkprocedurewouldcreateahazard(suchasdirectingtheaircrafttowardsterrain,orintonon-authorizedairspace).

Controlinputs

TBA.


P_2.4.1Theflightpaththatwouldbetakenbytheaircraftintheeventofalostlinkshouldbeclearlydistinguishablefromtheprogrammednormalflightpathoftheaircraft.

P_2.4.2Informationontheprogrammedlostlinkbehavioroftheaircraftshouldbereadilyavailabletothepilot,withouttheneedforcomplexinteractionswiththehuman-machineinterface.


B.Controlandcommunicationviaradiolink

Responsibility2.5:FlightterminationInanemergency,thepilotofanunmannedaircraftmayberequiredtodestroytheaircraft

byacontrolledimpact,ditching,orotherflightterminationmethod.SomeUASdesignswill

makeprovisionforanemergencyrecoverysystem,suchasaparachute.Humanfactors

considerationswillincludetheinformationpilotswillrequiretomakethisdifficultdecision

andexecutetheaction,aswellasmeasurestoprotectagainsttheinadvertentactivationof

theflightterminationsystem.


T_2.5.1TheGCSshouldenablethepilottodecidewhentoterminatetheflightviacontrolledimpact,ditchingorparachutedescent.

T_2.5.2TheGCSshouldenablethepilottoidentifyasuitablelocationforflighttermination.

T_2.5.3TheGCSshouldenablethepilottoterminatetheflightinapre-designatedarea.(RTCA,2007)

T_2.5.4TheGCSshouldenablethepilottousereal-timeinformationtoconfirmthatflight


40

terminationattheselectedlocationwillnotpresentunacceptablerisktopeopleorproperty.Informationcontentofdisplays

I_2.5.1TheGCSshouldprovidethepilotwithreal-timeimageryoftheselectedimpact,ditchingorparachutedescentsitetoconfirmthatasafeterminationcanbeaccomplished.

I_2.5.2TheGCSshouldprovideanalerttothepilottoindicatethattheflightterminationsystemisabouttobeactivated.

Controlinputs

TBA.


P_2.5.1WhentheUAisequippedwithaflightterminationsystem:

P_2.5.1a.Theuseofthesecontrolsshouldbeintuitiveandminimizethepossibilityofconfusionandsubsequentinadvertentoperation.

P_2.5.1b.TwodistinctanddissimilaractionsoftheUAScrewshouldberequiredtoinitiatetheflightterminationcommand.(NATO,2009)

Note:STANAG4671(NATO,2009)specifiesthatflightterminationcontrols“mustbearrangedandidentifiedsuchthattheyarereadilyavailableandaccessible”.Thistexthasbeendeletedfromthisdocumentasitisbelievedthatflightterminationcontrolsshouldnotbereadilyaccessible.STANAG4671didnotcontainrequirementfordissimilarcontrols.ThisrequirementisbasedontheexperiencecontainedinNASAproceduralrequirementsrelatedtotwo-faulttolerance).

P_2.5.2Beforethefinalstepinactivatingtheflightterminationsystemisreached,theGCSshouldprovideanauralandvisualalerttothepilotthatflightterminationisabouttobeactivated.

P_2.5.3Theauralalertwarningofimminentflightterminationshouldinvolveauniquesound.Thisshouldpreferablytaketheformofaverbalmessagesuchas“Flighttermination!”

P_2.5.4WhentheUAisequippedwithaflightterminationsystem,flightterminationcontrolsshouldbesafeguardedfrominterferencethatcouldleadtoinadvertentoperation.(NATO,2009).


F.Flighttermination


41

Communicate

ThePilotincommandmustcommunicatewithATC,otherairspaceusers,othermembersofthe

flightcreworsupportteam,andancillaryservicessuchasweatherbriefers.

Responsibility3.1:CommunicatewithATCandotherairspaceusersCommunicationwithATCistypicallyviaVHFvoicecommunicationstransmittedfromthe

UA,orinsomecases,controllerpilotdatalink(CPDL).IftheUAisoperatingbeyondradio

line-of-sightfromthegroundtransmitter,communicationsmayberelayedusingground

infrastructureorsatellite.Additionally,air-to-airrelaysbetweenUAsmaybeusedinsome

cases.Relayshavethepotentialtointroducetimedelaysintocommunications.Inaddition

tocommunicatingwithATC,thepilotmayberequiredtocommunicatewithotherairspace

users.Thisincludesdirectpilot-to-pilotcommunicationsaswellas“partyline”

communicationsthatthepilottomaintainawarenessofthelocationandintentionsof

otherusersoftheairspace.


T_3.1.1Whenoperatingnearanon-toweredairport,thepilotshouldbeabletoexchangeintentinformationwithotherairporttrafficthroughstandardcommunicationsontheairportcommontrafficadvisoryfrequency(CTAF).(FAA,2013b)

T_3.1.2TheUASpilotshouldbeabletoestablishanalternatecommunicationsmethodwithATCifthedurationofthecommunicationslossexceedsrequirementsfortheoperatingenvironment.(FAA,2013b)


I_3.1.1TheGCSshouldincludealternatemeansforthepilottocommunicatewithATCintheeventofalossofC2link.

I_3.1.2Currentsettingsofcommunicationcontrols.TheGCSshouldprovidethepilotwithinformationaboutthecurrentstate,mode,orsettingofthecontrolsusedforcommunicationwithATC.

Controlinputs


42

TBA.


P_3.1.1ThevoicecommunicationdelaybetweenthepilotandATCshouldhaveameanlessthanorequalto250ms.(FAA,2012)

P_3.1.2ThevoicecommunicationdelaybetweenthepilotandATCshouldbelessthanorequalto300ms.(99thpercentile).(FAA,2012)

P_3.1.3ThevoicecommunicationdelaybetweenthepilotandATCshouldbewithinamaximumof350ms.(FAA,2012)


B.Controlandcommunicationviaradiolink.

Responsibility3.2:CommunicatewithotherUASflightcrewandgroundsupportpersonnelGroundsupportpersonnel,externalobserversandothersupportpersonnelmaybelocated

remotefromtheGCS.Communicationandcoordinationwithintheoperatingteamwill

requirespecialattention,andthehumansysteminterfacemustbedesignedtoenable

teamsituationawarenesstobeachieved.SomecurrentUASoperatorsuseclosedcircuitTV

camerastoenablethepilottomonitortheaircraftduringpre-andpost-flightground

handling.WherecontroloftheUAwillbetransferredinflight,communicationmustoccur

betweenthegivingandreceivingpilots.Thismayinvolvevoice,ortextbased

communications.


T_3.2.1TheGCSshouldenabletheUAScrewmemberstocommunicatewitheachother(co-locatedornot)inordertoperformthenecessaryflighttasks.(FAA,2013b)

T_3.2.2TheGCSshouldenablethepilottoensurethatcommandssenttotheaircraftonthegrounddonotcreateasafetyhazardforgroundsupportpersonnel.


43


I_3.2.1TheGCSshouldprovidethepilotwithimageryoftheaircraftwheneverthepilothascontroloftheaircraftonthegroundandgroundsupportpersonnelareinteractingwiththeaircraft.

I_3.2.2TheGCSshouldprovidethepilotwithacommunicationlinkwithgroundsupportpersonnelwhiletheyareinteractingwiththeaircraft.

Controlinputs

TBA.


TBA


A.Lossofnaturalsensing;B.Controlandcommunicationviaradiolink;C.Physical

characteristicsofthecontrolstation

Responsibility3.3:CommunicatewithancillaryservicesAncillaryservicesincludeweatherbriefers,andotherpersonnelprovidingexternalsupport

totheUASoperation.


T_3.3.1TheGCSshouldenablethepilottocommunicatewithweatherinformationservicesandotherancillaryservices.


TBA

Controlinputs

TBA



44

TBA


TBA

ManageSystemsandOperations

Responsibility4.1:MakedecisionsinnormalconditionsPilottasksthatmustbeperformedusingtheinterface

TBA.


TBA.

Controlinputs

TBA.


TBA.


TBA.

Responsibility4.2:Recognizeandrespondtonon-normalconditionsPilottasksthatmustbeperformedusingtheinterface

TBA.



45

TBA.

Controlinputs

TBA.


TBA.


TBA.

Responsibility4.3:Planfornormalandnon-normalconditionsPilottasksthatmustbeperformedusingtheinterface

TBA.


TBA.

Controlinputs

TBA.


TBA.


TBA.


46

Responsibility4.4:TransfercontrolTheabilitytocompletelytransfercontrolbetweenorwithincontrolstationsisoneofthekeydifferencesbetweenUASoperationsandconventionalaviation.Handovershavebeenidentifiedasanareaofincreasedriskinarangeofindustrialandtransportsettings,includingaircraftmaintenance,medicine,andairtrafficcontrol.Handoversrequirespecialattentiontoensurethatthecrewofthe“receiving”and“giving”GCSpossessasharedunderstandingoftheoperationalsituationandthatcontrolsettingsarealignedbetweenthetwocontrolstations.


T_4.4.1TheGCSshouldenablecontroltobetransferredbetweenagivingandreceivingGCSinamannerthatisseamlessandtransparenttoATC.(FAA,2013b)

T_4.4.2TheGCSshouldenablecontinuityofpilotfunctiontobemaintainedduringthetransferofcontrolbetweenagivingandreceivingGCS.(FAA,2013b)

T_4.4.3“TheGCSshallenablethepilottoensurethatoperatingparametersareidenticalbeforeandafterhandover”.(NATO,2009)

T_4.4.4TheGCSshouldenablethepilottopassUAcontrol(handover)toanotherGCSandmonitorthestatusofthehandover.(NATO,2004)

T_4.4.5TheGCSshouldenablethepilottomonitorwhichentityhascontroloftheaircraftandtowhatextenttheentityhascontrol.(Access5,2006)

T_4.4.6TheGCSshouldenablethegivingandreceivingpilotstoconfirmthatcontrolsettingsareappropriateandconsistentbeforeahandoverisaccomplished.

T_4.4.7TheGCSshouldenablethereceivingpilottomonitorthestatusoftheUAbyreceivingtelemetryfromtheUAbeforeestablishingcontroloftheUA.

T_4.4.8TheGCSshouldfacilitateahandoverbriefingbetweenthegivingandreceivingpilots.

T_4.4.9TheGCSshouldprovidethereceivingpilotwithameansofconfirmingthatcontrolhasbeenestablishedwiththeUA.


I_4.4.1Thepilotshouldbepresentedwithinformationnecessarytoconfirmthatflight-criticalsettingsinthereceivingGCSareconsistentwithsettingsinthegivingGCS.

I_4.4.2TheGCSshouldprovidealevelofinvolvementindicatortothepilottoshowwhethertheGCShasbeensettoonlyreceivetelemetryfromtheUA,ortoreceivetelemetryandtransmitcommandstotheUA.


47

Controlinputs

C_4.4.1TheGCSshouldenablethepilottoselectthedesiredlevelofinvolvementwithaUA,rangingfrommonitoringtelemetrywithoutanactiveuplink,totelemetrywithfullcontrolviaanactiveuplink.

C_4.4.2Thereshouldbeameansforthegivingandreceivingpilotstocommunicatebefore,duringandafterthehandover.


P_4.4.1TheGCSshouldprovidesuitabledisplaystoenablebriefingstobeconductedbetweenaseatedpilotandastandingpilotduringcontrolhandovers.Thismayincludetheuseoflargescalesynopticdisplays.

P_4.4.2TheGCSshouldenablecontroltobetransferredtoanotherGCSwithoutanygapincontroloccurringduringthehandover.


D.In-flighttransferofcontrol.

Generalguidelines

Theguidelineslistedinthissectionarebroadprinciplesthathavegeneralapplicabilitytothe

GCS.Eventhoughtheymayappearelsewhereinthehumanfactorsliterature,theseguidelines

arelistedherebecausetheyhavespecialrelevancetoUASinlightofthehumanfactors

considerationslistedinTable2.

G_1UASdevelopersshouldfollowrecognizedhuman-centereddesignprocessesincludingthefollowing:

G_1a.DevelopafullsetofpilottasksandintendedoperationsforwhichtheGCSwillbeused.Thesewillhelpdriveensuringathoroughdesignthatprovidesallsystems,information,andcontrolsthatthepilotswillneed.

G_1b.Developanunderstandingofthepotentialsafetycriticalerrorsthatthepilotsmaymakewhenaccomplishingtheirtasks.Thesewillprovidethefoundationformakingtrade-offsindesigndecisionsbyfocusingondesignattributesthatwillmitigatecriticalerrorsasneeded.

G_1c.Developafullsetofinformationrequirementsforthetasksthepilotswillneedtoaccomplish.Theserequirementsshouldbedevelopedwithotherdesignrequirementsatthe


48

beginningofthesystemsengineeringprocess.Theywillhelpensurethattheappropriateinformationisprovidedtothepilotsandprovidethefoundationformakingdesigndecisions.

G_1d.Developafullsetofrequirementsforcontrolsthatthepilotwillneedtoaccomplishtheirtasks.Theserequirementsshouldbedevelopedwithotherdesignrequirementsatthebeginningofthesystemsengineeringprocess.Theywillhelpensurethatallthepilotcontrolsareplannedforasdesigndecisionsaremade.

G_1e.Documentalloftheresultsoftheseprocessessothattheycanbecontinuallyupdatedwhendesigndecisionsandtrade-offsaremadeduringthedesignprocess.Gooddocumentationwillalsohelpthehumanfactorsdesignprocessestobeintegratedwiththeothersystemsengineeringdevelopmentanddesignprocesses.

Supportingnotes:Manysafetystudieshaveconcludedthatdesign-relatedissuesthatleadto

accidentsorincidentsweretheresultofinadequateattentiontodevelopinganddocumenting

sounddesignrequirements,notpoordecisionsaboutdesigncharacteristics.Followingthe

processespresentedinthisguidelinewillhelpprovideafoundationtoensurethathuman

factors-relatedrequirementsaredevelopedanddocumentedasabasisforgoodhumanfactors

designdecisions.

Relatedspecialconsiderations:General

G_2Theuseofmulti-modefunctionsonflightcontrolsshouldbeminimized.Ifmodesareused,thesystemshouldclearlyindicatethecurrentmode,andotherpotentialmodesshouldbeindicated.Supportingnotes:Flight-criticalcontrolsthatcanperformdifferentfunctionsbasedonmode

selectionhavethepotentialtoprovokecontrolerrors.InsomeGCSforexample,asidestick

controllerwillcontroleitherpitchorspeed,dependingontheselectedmode.Evidencefrom

conventionalaviationindicatesthatmaintainingmodeawarenesscanbedifficultforpilots

undersomecircumstances,andtheresultingmodeconfusioncanleadtoaccidents.

Relatedspecialconsiderations:G.Relianceonautomation;H.Widespreaduseofinterfaces

basedonconsumerproducts.


49

G_3Ifchangingamodeselectionofanautomatedsystemhasasafetyconsequence,theactiontoselectthatmodeshouldbealerted,andadditionalprecautionsshouldbetakentopreventinadvertentselection.Supportingnotes:Flight-criticalcontrolsthatcanperformdifferentfunctionsbasedonmode

selectionhavethepotentialtoprovokecontrolerrors.TherehavebeencaseswheretheUAS

pilothasselectedamodeinflightthatrenderstheaircraftuncontrollable.TheGCSdesign

shouldmakeitdifficulttoperformsuchamodeselectionaction.



G_4Payloadcontrolsshouldbeseparatefromcontrolswithsafety-of-flightfunctions.Supportingnotes:SomeGCSdesignshaveinvolvedmulti-functioncontrolsthatcanbe

configuredtoeithercontrolasafety-of-flightfunctionoranon-criticalpayloadfunction.A

notableexamplewastheaccidenttoaMQ-9inwhichtheengineoftheaircraftwasshutdown

inadvertently.Althoughtheaccidentwasrelatedtomultiplecausalfactors,oneissuewasthat

asingleleverintheGCScouldbeconfiguredtoeithercontrolanenginesettingorcontrolan

irissettingonacamera(NTSB,2006).

Relatedspecialconsiderations:General

G_5Itshouldnotbepossibletoreconfigureasafety-of-flightcontroltoperformapayloadfunction.Supportingnotes:SomeGCSdesignshaveinvolvedmulti-functioncontrolsthatcanbe

configuredtoeithercontrolasafety-of-flightfunctionoranon-criticalpayloadfunction.The

widespreaduseofconsumersoftwareinterfacesinGCSmakeitpossibletorapidlyre-configure

controlstoperformfunctionsthatwerenotintendedbytheoriginaldesigners.

Relatedspecialconsiderations:H.Widespreaduseofinterfacesbasedonconsumerproducts.


50

G_6Activationofakeyorbuttonshouldprovidetactileorauditoryfeedbacktothepilot.(ANSI/HFES,2007)Supportingnotes:TBA



G_7ThereshouldbeaclearindicationtothepilotwhenacommandhasbeenreceivedbytheUAS.Supportingnotes:ThelocationoftheUASpilot,remotefromtheaircraft,canmakeit

challengingforthepilottomaintainanawarenessofsystemstateandbehavioroftheaircraft.

Intheabsenceofothersensorycues,itisparticularlyimportantthatthepilotreceivefeedback

thatacommandhasbeenreceivedandisbeingactedupon.

Relatedspecialconsiderations:A.Lossofnaturalsensing;B.ControlandCommunicationvia

radiolink;G.Relianceonautomation;H.Widespreaduseofinterfacesbasedonconsumer

products.

G_8AnyunrecognizedentrymadebythepilotattheGCSshouldcauseaninformativeerrormessagetobedisplayedandnotaffectthestatusoroperationofanysystem.(Access5,2006)Supportingnotes:Therichsensorycuesavailabletothepilotofaconventionalaircraftinclude

visual,auditory,proprioceptiveandolfactorysensations.Theabsenceofthesecueswhen

operatingaUAScanmakeitmoredifficultforthepilottomaintainanawarenessofthe

aircraft’sstate.Observationsofairlinepilotshaveindicatedthat“piloterror”isarelatively

frequentevent,yetmostoftheseerrorsarerapidlyidentifiedandcorrectedbythecrews

themselves(ICAO,2002).ThelocationoftheUASpilotremotefromtheaircraftmaymakepilot


51

errorself-correctionmoredifficult.



products.

G_9Flightcrewalerting.(QuotedverbatimfromCFR§25.1322)

G_9“(a)Flightcrewalertsmust:(1)Providetheflightcrewwiththeinformationneededto:(i)Identifynon-normaloperationorairplanesystemconditions,and(ii)Determinetheappropriateactions,ifany.(2)Bereadilyandeasilydetectableandintelligiblebytheflightcrewunderallforeseeableoperatingconditions,includingconditionswheremultiplealertsareprovided.(3)Beremovedwhenthealertingconditionnolongerexists.

G_9(b)Alertsmustconformtothefollowingprioritizationhierarchybasedontheurgencyofflightcrewawarenessandresponse.(1)Warning:Forconditionsthatrequireimmediateflightcrewawarenessandimmediateflightcrewresponse.(2)Caution:Forconditionsthatrequireimmediateflightcrewawarenessandsubsequentflightcrewresponse.(3)Advisory:Forconditionsthatrequireflightcrewawarenessandmayrequiresubsequentflightcrewresponse.

G_9(c)Warningandcautionalertsmust:(1)Beprioritizedwithineachcategory,whennecessary.(2)Providetimelyattention-gettingcuesthroughatleasttwodifferentsensesbyacombinationofaural,visual,ortactileindications.(3)Permiteachoccurrenceoftheattention-gettingcuesrequiredbyparagraph(c)(2)ofthissectiontobeacknowledgedandsuppressed,unlesstheyarerequiredtobecontinuous.

G_9(d)Thealertfunctionmustbedesignedtominimizetheeffectsoffalseandnuisancealerts.Inparticular,itmustbedesignedto:(1)Preventthepresentationofanalertthatisinappropriateorunnecessary.(2)Provideameanstosuppressanattention-gettingcomponentofanalertcausedbyafailureofthealertingfunctionthatinterfereswiththeflightcrew'sabilitytosafelyoperatetheairplane.Thismeansmustnotbereadilyavailabletotheflightcrewsothatitcouldbeoperatedinadvertentlyorbyhabitualreflexiveaction.Whenanalertissuppressed,theremustbeaclearandunmistakableannunciationtotheflightcrewthatthealerthasbeensuppressed.

G_9(e)Visualalertindicationsmust:(1)Conformtothefollowingcolorconvention:(i)Redforwarningalertindications.(ii)Amberoryellowforcautionalertindications.(iii)Anycolorexceptredorgreenforadvisoryalertindications.(2)Usevisualcodingtechniques,togetherwithotheralertingfunctionelementsontheflightdeck,todistinguishbetweenwarning,caution,andadvisoryalertindications,iftheyarepresentedonmonochromaticdisplaysthatarenotcapableofconformingtothecolorconventioninparagraph(e)(1)ofthissection.G_9(f)Useofthecolorsred,amber,andyellowontheflightdeckforfunctionsotherthanflightcrewalertingmustbelimitedandmustnotadverselyaffectflightcrewalerting”.


52

o Supportingnotes:Thepresentationofwarnings,cautionsandadvisoriesisanareawhere

currentGCSdesignshavebeenparticularlydeficient.Designshavetendedtopresent

informationintextualformat,whichrequiresthepilottoreceivetheinformationthroughthe

limitedchanneloffovealvision.Intheabsenceofadirecton-boardexperienceoftheaircraft’s

performance,theUASpilotisentirelyreliantonwarning,cautionandadvisoryalertsforcritical

informationonsystemstatus.

o TheaboverequirementsarequoteddirectlyfromCFRpart25duetotheirparticularrelevance

toGCSdesigns.

Relatedspecialconsiderations:A.Lossofnaturalsensing

G_10Systemsthatalertthepilottoacriticalanomalyshouldnotbesubjecttoasilentfailure.o Supportingnotes:TBA.

Relatedspecialconsiderations:G.Relianceonautomation.

G_11TheGCSshouldprovideaworkenvironmentthatmaintainspilotengagement,andminimizesthenegativeimpactofextendedperiodsoflowworkload.Supportingnotes:TheUASpilotmayexperienceextendedperiodsoflowworkload,particularly

whenthepilot’sroleislimitedtothesupervisorycontrolofautomation(Cummings,

Mastracchio,Thornburg,&Mkrtchyan,2013).Itiswell-establishedthathumanshavedifficulty

maintainingvigilanceontasksthatinvolvelongperiodsofmonotonousmonitoring.Thepilot

mayhavetomakearapidtransitionfromanunstimulatingperiodofmonitoringtoaperiodof

highworkloadandquickdecision-making.Controlstationstendtoberelativelyquiet,air

conditionedenvironmentswithlowlevelsofnoise.Theexperienceofsettingssuchasindustrial

controlroomsandlocomotivecabsindicatesthatsuchunstimulatingenvironmentscanmakeit


53

moredifficultforpersonneltoremainalert,especiallywhenfatigued.Controlstationsmustbe

designedtomaintainpilotengagementevenduringextendedperiodsofuneventfuloperation.

Thisguidelinedoesnotspecifyhowpilotengagementshouldbemaintained,orhowlossesof

vigilanceshouldbedetected.Itshouldbenotedthatthereisalonghistoryintherailroad

industryof“vigilancecontroldevices”or“deadman’shandles”designedtomaintainoperator

vigilance.Someroadvehiclesnowincludedevicesintendedtodetectsleepepisodesindrivers,

bymonitoringeyeclosuresordetectingreducedcontrolinputs.

Relatedspecialconsiderations:C;Controlstationonground;E.UniquecharacteristicsofUAS

flight

G_12TheGCSshouldprovideconsistencyofoperationforcommonfunctions.o Supportingnotes:TBA.

Relatedspecialconsiderations:G.Relianceonautomation.

G_13Thefunctionsneededtosafelycontroltheaircraftunderusualflightsituationsshouldbelocatedinthepilot'sprimaryfield-of-view.Supportingnotes:TBA.

Relatedspecialconsiderations:C.Physicalcharacteristicsofthecontrolstation;G.relianceon

automation.

G_14WarningsandcautionsshouldnotbeobscuredbyotherGCSdisplays.Supportingnotes:TBA.

Relatedspecialconsiderations:C.Physicalcharacteristicsofthecontrolstation;G.Relianceon


54

automation.

G_15“Part-timedisplay.Ifitisdesiredtoinhibitsomeparametersfromfull-timedisplay,anequivalentlevelofsafetytofull-timedisplayshouldbedemonstrated.Criteriatobeconsideredincludethefollowing:(a)Continuousdisplayoftheparameterisnotrequiredforsafetyofflightinallnormalflightphases.(b)Theparameterisautomaticallydisplayedinflightphaseswhereitisrequired.(c)Theinhibitedparameterisautomaticallydisplayedwhenitsvalueindicatesanabnormalcondition,orwhentheparameterreachesanabnormalvalue.(d)DisplayoftheinhibitedparametercanbemanuallyselectedbytheUAVcrewwithoutinterferingwiththedisplayofotherrequiredinformation.(e)Iftheparameterfailstobedisplayedwhenrequired,thefailureeffectandcompoundingeffectsmustmeettherequirementsofUSAR.1309.Theanalysisistoclearlydemonstratethatthedisplay(s)ofdataisconsistentwithsafeoperationunderallprobableoperatingconditions.(f)Theautomatic,orrequested,displayoftheinhibitedparametershouldnotcreateunacceptableclutteronthedisplay;simultaneousmultiple"pop-ups"mustbeconsidered.(g)Ifthepresenceofthenewparameterisnotsufficientlyself-evident,suitablealertingmustaccompanytheautomaticpresentation”.STANAG4671AMC.1722

Supportingnotes:ThismaterialistakenverbatimfromNATO(2009).



G_16Whereverpossible,textmessages,whetherindialogboxes,warningmessagesorotherscreendisplays,shouldbepresentedinplainlanguage,orusingstandardaviationterminology.Supportingnotes:SomeGCSinterfacesbasedontextualpresentationofinformationhaveused

unnecessarilycomplicatedorcounter-intuitivelanguage.




55

G_17ControlsintendedtobeoperatedbythepilotshouldbereachablefromaseatedpositionSupportingnotes:ThisprinciplehasbeenviolatedinsomecurrentGCSdesigns.

Relatedspecialconsiderations:C:Controlstationonground

G_18TheGCSshouldprovideabookresttoenablethepilottorefertodocumentswithoutriskthatthedocumentwillcomeintocontactwithakeyboardorotherflightcontrols.Supportingnotes:UASincidentshaveoccurredwherekeyboardcommandshavebeen

inadvertentlyactivatedbycontactwithdocumentsandothermaterials.

Relatedspecialconsiderations:C:Controlstationonground

G_19AppropriateprioritycontrolsshouldbeavailableforUASfunctionsthatrequireeitherquickaccessibilityorconstantavailability.Prioritycontroldevicescaninclude,butarenotlimitedto:(a)Touchpanels,(b)Buttons,(c)Switches,(d)Joysticks,(e)Keyboardshortcuts.(NATO,2004)

Supportingnotes:Pilotactionsthatmustbeperformedrapidlyrangefromsafety-critical

actionssuchascollisionavoidancemaneuverstolesscritical,butimportantroutineactions

suchasrespondingtoanATCrequestto“Ident”(Pestana,2008).SomeGCSdesignshave

requiredpilotstoperformcomplicatedsequencesofactionstoperformtime-criticalorroutine

actions.GuidelinescallingforGCStoenablepilotstorapidlyperformsuchactionsappearin

Access5(2006),NATO(2004)andNATO(2009).NATO(2009)states“Wheretheinterfacewith

UAVcrewisbasedona“pulldownmenus”architecture,thecontrolsthatnecessitateaprompt

reactionoftheUAVcrewmustbeaccessibleatthefirstlevelofthepulldownmenus,

otherwise,safetycriticalcontrolsintheUCSmusthavededicatedknobsorlevers”.




56

products.

G_20Ifadisplayscreenenablesthepilottomoveorrearrangedisplayorcontrolwindows,itshouldnotbepossibletoplaceawindowsoastoobscureprimaryflightcontrolsordisplays.Supportingnotes:Theuseofreconfigurableandmoveablescreenwindowsanddialogboxes

introducesthepossibilitythatcriticaldisplayscouldbeobscuredbehindless-criticalinterfaces.

Relatedspecialconsiderations:H.Widespreaduseofinterfacesbasedonconsumerproducts.


57

Summarylistofguidelines

Notethatinthefollowingsummarylist,thetypeofguidelinecanbeascertainedfromthefirstletterinthetitleasfollows:

T_Taskguidelines I_Informationcontent C_Controlinputs P_Propertiesoftheinterface G_GeneralguidelinesT_1.1.1TheGCSshouldenablethepilottomonitorwhichentityhascontroloftheaircraftandtowhatextenttheentityhascontrol.



P_1.1.2TheGCSshouldpreventmultipleoperatorsfromoperatingthesameapplication/proceduresatanyonetime.

P_1.1.3TheGCSshouldprovidetheabilitytoallowotheroperatorstoviewthestatusofaircraftsystems.

T_1.2.1TheGCSshouldenablethepilottomonitorthestatusofconsumableresources.

I_1.2.1TheGCSshouldprovidethepilotwithinformationonthestatusofconsumableresources.


T_1.3.2TheGCSshouldenablethepilottoperformapre-flightcheckonanalternatecontrolstation,orconfirmthatthischeckhasbeenperformed.



I_1.3.1TheGCSshouldprovidethepilotwithhealthandstatusinformationontheGCS.



T_1.4.3TheGCSshouldenablethepilottodetermineanappropriatemaneuvertoavoidacollisionoftheUAwithotheraircraft,terrain,orobjects.

T_1.4.4TheGCSshouldenablethepilottoexecuteaUAcollisionavoidancemaneuver.


58

T_1.4.5TheGCSshouldenablethepilottocommunicatewithATCaboutacollisionavoidancemaneuverandotherdeparturesfromtheassignedflightpath.

T_1.4.6TheGCSshouldenablethepilottoreturntheUAtotheassignedflightpathaftermaneuveringtoavoidacollision.

T_1.4.7IftheUAiscapableofmakinganautonomouscollisionavoidancemaneuver,theGCSshouldenablethepilottomonitorthemaneuver.

T_1.4.8IftheUAexecutesanautonomouscollisionavoidancemaneuver,theGCSshouldenablethepilottosmoothlyregaincontroloftheUAattheconclusionofthemaneuver.








I_1.4.8.TheGCSshouldprovideinformationabouttheaircraftsurroundingtheUAandthecollisionthreattohelpinmakingadecisionaboutmaneuversthatwouldnotcauseadditionalrisksforcollision.

I_1.4.9.TheGCSshouldprovideinformationaboutthecapabilitiesoftheUAformakingevasivemaneuversinthecurrentUAsituation.Thisinformationshouldincludeatleastthefollowing:

I_1.4.9aPossiblemaneuversthatcanbemadebytheUAinthecurrentsituation–e.g.climb,descend,turnwithinacertainradius.

I_1.4.9bTimefortheUAtoaccomplishthemaneuvers–e.g.howlonguntiltheUAreachesacertainturnradiusorclimbattitude.



59




C_1.4.1TheGCSshouldprovideacontroltocancelthecollisionalertifitwillbeongoinganddistractthepilotinaccomplishingothertasks.


C_1.4.2aUAattitude.

C_1.4.2bUAheading.

C_1.4.2cUAspeedand/orthrust.


P_1.4.2Collisionavoidancealertsmustattractthepilot’sattentioninallexpectedlightingandoperatingconditions.












60
























61





P_1.5.1“TheremustbeanalertfortheUAScrew,viaaclearanddistinctauralandvisualsignal,foranytotallossofthecommandandcontroldatalink”.





P_1.5.6TheC2datalinkfootprintshouldbeeasilydistinguishablefromotherfootprintsthatmaybepresentontheoperatormapdisplay.

P_1.5.7Ifthepayloadutilizesalinkseparatetotheaircraftcontrollink,anydisplayofpayloadlinkqualityshouldbeseparateandclearlydistinguishablefromdisplaysfortheaircraftcontrollink.

P_1.5.8Ifanauralwarningisusedtoindicatelossofpayloadlink,thesoundshouldbedissimilartothatusedtoindicatelossofcontrollink.


P_1.5.10TheGCS,incombinationwiththeotherelementsoftheUASshouldcomplywithcontrollinklatency(timefrominitiationofamaneuvertoameasurableresponsebytheUA)requirementsthatareestablishedatalevelsimilartomannedaircraft.

T_2.1.1TheGCSshouldenablethepilottomonitorandcontrolthepositionoftheUAwhenonthegroundandintheair.

T_2.1.2TheGCSshouldenablethepilottoensurethatboththerunwayandapproachpathareclearoftrafficbeforetaxiingontotheactiverunway.

T_2.1.3“TheUASshallbecapableoftransitioningfromaninstrumentapproachproceduretoasafelanding,eitherbyvisualreferenceofaflightcrewmemberattheairportorbyothermeansacceptabletotheFAA”.


62





I_2.1.1dSpeedofUA.





I_2.1.2bPredictedflightpathrelativetoUAandothertraffic,terrain,andobstacles.




C_2.1.3TheGCSshouldenablethepilottomaneuvertheUA.


P_2.1.2Thepresentationscaleofthemapshouldbeselectable.Continuousscalingispreferredtodiscrete.

P_2.1.3Thepilotshouldbeabletoderivethescaleofthemapfromthedisplay.

P_2.1.4ThemapdisplayshouldenablethepilottocustomizetheAircraft’sInformationTrail.

P_2.1.5Themapdisplayshouldbeconfigurableto“Northup”or“Trackup”.

P_2.1.6Ifcontrolisviaaterrestrialradio,thelocationof(ordirectionto)thegroundtransmitter/receivershouldbeshownonthemap.

P_2.1.7PrimaryflightcontrolsforcontrollingtheUA(heading,attitude,speed)shouldbeavailableatalltimesthroughdedicatedphysicalcontrols.Iftheuseofsoftware-basedcontrolscannotbeavoided,thenthecontrolsshouldbeimmediatelyaccessibleatthetoplevelofthecontrolinterface.

P_2.1.8Mapdisplaysshouldhavemeanstoselectthescaleofthemaptobepresented.Thescalespresentedonthemapsshouldbeevidenttothepilot.

P_2.1.9Thepilotshouldhavethemeanstocustomizetheinformationtrailforanaircraftshownonthetrafficdisplay.


63


T_2.2.2TheGCSshouldenablethepilotto“observe”andcomplywithsignageandwarninglightsduringsurfaceoperations.

T_2.2.3TheGCSshouldenablethepilottomonitorweatherthathasthepotentialtoaffecttheflight.


T_2.2.5TheGCSshouldenablethepilottoavoidicingconditions.

I_2.2.1“Theoperatorshouldbeabletodisplayflightcorridors,controlledairspaceandanyotherrelevantairspaceco-ordinationinformation”.












T_2.4.1TheGCSshouldenablethepilottoremainawareoftheaircraft’slostlinkprocedureastheflightprogresses.

T_2.4.2TheGCSshouldenablethepilottoupdatetheaircraft’slostlinkprocedureastheflightprogresses.

I_2.4.1TheGCSshouldprovidethepilotwithadisplayindicatingthefutureflightpathoftheaircraftshouldalostlinkoccur.



64





T_2.5.3TheGCSshouldenablethepilottoterminatetheflightinapre-designatedarea.

T_2.5.4TheGCSshouldenablethepilottousereal-timeinformationtoconfirmthatflightterminationattheselectedlocationwillnotpresentunacceptablerisktopeopleorproperty.




P_2.5.1aTheuseofthesecontrolsshouldbeintuitiveandminimizethepossibilityofconfusionandsubsequentinadvertentoperation.

P_2.5.1bTwodistinctanddissimilaractionsoftheUAScrewshouldberequiredtoinitiatetheflightterminationcommand.


P_2.5.3Theauralalertwarningofimminentflightterminationshouldinvolveauniquesound.Thisshouldpreferablytaketheformofaverbalmessagesuchas“Flighttermination!”

P_2.5.4WhentheUAisequippedwithaflightterminationsystem,flightterminationcontrolsshouldbesafeguardedfrominterferencethatcouldleadtoinadvertentoperation.

T_3.1.1Whenoperatingnearanon-toweredairport,thepilotshouldbeabletoexchangeintentinformationwithotherairporttrafficthroughstandardcommunicationsontheairportcommontrafficadvisoryfrequency(CTAF).

T_3.1.2TheUASpilotshouldbeabletoestablishanalternatecommunicationsmethodwithATCifthedurationofthecommunicationslossexceedsrequirementsfortheoperatingenvironment.



P_3.1.1ThevoicecommunicationdelaybetweenthepilotandATCshouldhaveameanlessthanorequalto250ms.


65

P_3.1.2ThevoicecommunicationdelaybetweenthepilotandATCshouldbelessthanorequalto300ms.(99thpercentile).

P_3.1.3ThevoicecommunicationdelaybetweenthepilotandATCshouldbewithinamaximumof350ms.

T_3.2.1TheGCSshouldenabletheUAScrewmemberstocommunicatewitheachother(co-locatedornot)inordertoperformthenecessaryflighttasks.





T_4.4.1TheGCSshouldenablecontroltobetransferredbetweenagivingandreceivingGCSinamannerthatisseamlessandtransparenttoATC.

T_4.4.2TheGCSshouldenablecontinuityofpilotfunctiontobemaintainedduringthetransferofcontrolbetweenagivingandreceivingGCS.

T_4.4.3“TheGCSshallenablethepilottoensurethatoperatingparametersareidenticalbeforeandafterhandover”.

T_4.4.4TheGCSshouldenablethepilottopassUAcontrol(handover)toanotherGCSandmonitorthestatusofthehandover.

T_4.4.5TheGCSshouldenablethepilottomonitorwhichentityhascontroloftheaircraftandtowhatextenttheentityhascontrol.








66








G_1c.Developafullsetofinformationrequirementsforthetasksthepilotswillneedtoaccomplish.Theserequirementsshouldbedevelopedwithotherdesignrequirementsatthebeginningofthesystemsengineeringprocess.Theywillhelpensurethattheappropriateinformationisprovidedtothepilotsandprovidethefoundationformakingdesigndecisions.



G_2Theuseofmulti-modefunctionsonflightcontrolsshouldbeminimized.Ifmodesareused,thesystemshouldclearlyindicatethecurrentmode,andotherpotentialmodesshouldbeindicated.

G_3Ifchangingamodeselectionofanautomatedsystemhasasafetyconsequence,theactiontoselectthatmodeshouldbealerted,andadditionalprecautionsshouldbetakentopreventinadvertentselection.

G_4Payloadcontrolsshouldbeseparatefromcontrolswithsafety-of-flightfunctions.

G_5Itshouldnotbepossibletoreconfigureasafety-of-flightcontroltoperformapayloadfunction.

G_6Activationofakeyorbuttonshouldprovidetactileorauditoryfeedbacktothepilot.

G_7ThereshouldbeaclearindicationtothepilotwhenacommandhasbeenreceivedbytheUAS.


67

G_8AnyunrecognizedentrymadebythepilotattheGCSshouldcauseaninformativeerrormessagetobedisplayedandnotaffectthestatusoroperationofanysystem.


G_9(a)Flightcrewalertsmust:(1)Providetheflightcrewwiththeinformationneededto:(i)Identifynon-normaloperationorairplanesystemconditions,and(ii)Determinetheappropriateactions,ifany.(2)Bereadilyandeasilydetectableandintelligiblebytheflightcrewunderallforeseeableoperatingconditions,includingconditionswheremultiplealertsareprovided.(3)Beremovedwhenthealertingconditionnolongerexists.




G_9(e)Visualalertindicationsmust:(1)Conformtothefollowingcolorconvention:(i)Redforwarningalertindications.(ii)Amberoryellowforcautionalertindications.(iii)Anycolorexceptredorgreenforadvisoryalertindications.(2)Usevisualcodingtechniques,togetherwithotheralertingfunctionelementsontheflightdeck,todistinguishbetweenwarning,caution,andadvisoryalertindications,iftheyarepresentedonmonochromaticdisplaysthatarenotcapableofconformingtothecolorconventioninparagraph(e)(1)ofthissection.

G_9(f)Useofthecolorsred,amber,andyellowontheflightdeckforfunctionsotherthanflightcrewalertingmustbelimitedandmustnotadverselyaffectflightcrewalerting.

G_10Systemsthatalertthepilottoacriticalanomalyshouldnotbesubjecttoasilentfailure.

G_11TheGCSshouldprovideaworkenvironmentthatmaintainspilotengagement,andminimizesthenegativeimpactofextendedperiodsoflowworkload.

G_12TheGCSshouldprovideconsistencyofoperationforcommonfunctions.


68

G_13Thefunctionsneededtosafelycontroltheaircraftunderusualflightsituationsshouldbelocatedinthepilot'sprimaryfield-of-view.

G_14WarningsandcautionsshouldnotbeobscuredbyotherGCSdisplays.

G_15“Part-timedisplay.Ifitisdesiredtoinhibitsomeparametersfromfull-timedisplay,anequivalentlevelofsafetytofull-timedisplayshouldbedemonstrated.Criteriatobeconsideredincludethefollowing:(a)Continuousdisplayoftheparameterisnotrequiredforsafetyofflightinallnormalflightphases.(b)Theparameterisautomaticallydisplayedinflightphaseswhereitisrequired.(c)Theinhibitedparameterisautomaticallydisplayedwhenitsvalueindicatesanabnormalcondition,orwhentheparameterreachesanabnormalvalue.(d)DisplayoftheinhibitedparametercanbemanuallyselectedbytheUAVcrewwithoutinterferingwiththedisplayofotherrequiredinformation.(e)Iftheparameterfailstobedisplayedwhenrequired,thefailureeffectandcompoundingeffectsmustmeettherequirementsofUSAR.1309.Theanalysisistoclearlydemonstratethatthedisplay(s)ofdataisconsistentwithsafeoperationunderallprobableoperatingconditions.(f)Theautomatic,orrequested,displayoftheinhibitedparametershouldnotcreateunacceptableclutteronthedisplay;simultaneousmultiple"pop-ups"mustbeconsidered.(g)Ifthepresenceofthenewparameterisnotsufficientlyself-evident,suitablealertingmustaccompanytheautomaticpresentation”.

G_16Whereverpossible,textmessages,whetherindialogboxes,warningmessagesorotherscreendisplays,shouldbepresentedinplainlanguage,orusingstandardaviationterminology.

G_17Controlsintendedtobeoperatedbythepilotshouldbereachablefromaseatedposition

G_18TheGCSshouldprovideabookresttoenablethepilottorefertodocumentswithoutriskthatthedocumentwillcomeintocontactwithakeyboardorotherflightcontrols.

G_19AppropriateprioritycontrolsshouldbeavailableforUASfunctionsthatrequireeitherquickaccessibilityorconstantavailability.Prioritycontroldevicescaninclude,butarenotlimitedto:(a)Touchpanels,(b)Buttons,(c)Switches,(d)Joysticks,(e)Keyboardshortcuts.

G_20Ifadisplayscreenenablesthepilottomoveorrearrangedisplayorcontrolwindows,itshouldnotbepossibletoplaceawindowsoastoobscureprimaryflightcontrolsordisplays.


69

Guidelinesorganizedbytype

Task-relatedguidelines



T_1.2.1TheGCSshouldenablethepilottomonitorthestatusofconsumableresources.


T_1.3.2TheGCSshouldenablethepilottoperformapre-flightcheckonanalternatecontrolstation,orconfirmthatthischeckhasbeenperformed.





T_1.4.3TheGCSshouldenablethepilottodetermineanappropriatemaneuvertoavoidacollisionoftheUAwithotheraircraft,terrain,orobjects.

T_1.4.4TheGCSshouldenablethepilottoexecuteaUAcollisionavoidancemaneuver.

T_1.4.5TheGCSshouldenablethepilottocommunicatewithATCaboutacollisionavoidancemaneuverandotherdeparturesfromtheassignedflightpath.

T_1.4.6TheGCSshouldenablethepilottoreturntheUAtotheassignedflightpathaftermaneuveringtoavoidacollision.

T_1.4.7IftheUAiscapableofmakinganautonomouscollisionavoidancemaneuver,theGCSshouldenablethepilottomonitorthemaneuver.

T_1.4.8IftheUAexecutesanautonomouscollisionavoidancemaneuver,theGCSshouldenablethepilottosmoothlyregaincontroloftheUAattheconclusionofthemaneuver.





70













T_2.1.1TheGCSshouldenablethepilottomonitorandcontrolthepositionoftheUAwhenonthegroundandintheair.


T_2.1.3"TheUASshallbecapableoftransitioningfromaninstrumentapproachproceduretoasafelanding,eitherbyvisualreferenceofaflightcrewmemberattheairportorbyothermeansacceptabletotheFAA".


T_2.2.2TheGCSshouldenablethepilotto"observe"andcomplywithsignageandwarninglightsduringsurfaceoperations.

T_2.2.3TheGCSshouldenablethepilottomonitorweatherthathasthepotentialtoaffecttheflight.


T_2.2.5TheGCSshouldenablethepilottoavoidicingconditions.


71








T_2.4.1TheGCSshouldenablethepilottoremainawareoftheaircraft'slostlinkprocedureastheflightprogresses.

T_2.4.2TheGCSshouldenablethepilottoupdatetheaircraft'slostlinkprocedureastheflightprogresses.



T_2.5.3TheGCSshouldenablethepilottoterminatetheflightinapre-designatedarea.

T_2.5.4TheGCSshouldenablethepilottousereal-timeinformationtoconfirmthatflightterminationattheselectedlocationwillnotpresentunacceptablerisktopeopleorproperty.

T_3.1.1Whenoperatingnearanon-toweredairport,thepilotshouldbeabletoexchangeintentinformationwithotherairporttrafficthroughstandardcommunicationsontheairportcommontrafficadvisoryfrequency(CTAF).

T_3.1.2TheUASpilotshouldbeabletoestablishanalternatecommunicationsmethodwithATCifthedurationofthecommunicationslossexceedsrequirementsfortheoperatingenvironment.

T_3.2.1TheGCSshouldenabletheUAScrewmemberstocommunicatewitheachother(co-locatedornot)inordertoperformthenecessaryflighttasks.




72

T_4.4.1TheGCSshouldenablecontroltobetransferredbetweenagivingandreceivingGCSinamannerthatisseamlessandtransparenttoATC.

T_4.4.2TheGCSshouldenablecontinuityofpilotfunctiontobemaintainedduringthetransferofcontrolbetweenagivingandreceivingGCS.

T_4.4.3"TheGCSshallenablethepilottoensurethatoperatingparametersareidenticalbeforeandafterhandover".

T_4.4.4TheGCSshouldenablethepilottopassUAcontrol(handover)toanotherGCSandmonitorthestatusofthehandover.







73

Information-relatedguidelinesI_1.2.1TheGCSshouldprovidethepilotwithinformationonthestatusofconsumableresources.

I_1.3.1TheGCSshouldprovidethepilotwithhealthandstatusinformationontheGCS.








I_1.4.8.TheGCSshouldprovideinformationabouttheaircraftsurroundingtheUAandthecollisionthreattohelpinmakingadecisionaboutmaneuversthatwouldnotcauseadditionalrisksforcollision.

I_1.4.9.TheGCSshouldprovideinformationaboutthecapabilitiesoftheUAformakingevasivemaneuversinthecurrentUAsituation.Thisinformationshouldincludeatleastthefollowing:

I_1.4.9a.PossiblemaneuversthatcanbemadebytheUAinthecurrentsituation-e.g.climb,descend,turnwithinacertainradius.

I_1.4.9b.TimefortheUAtoaccomplishthemaneuvers-e.g.howlonguntiltheUAreachesacertainturnradiusorclimbattitude.






74




















I_2.1.1dSpeedofUA.





I_2.1.2bPredictedflightpathrelativetoUAandothertraffic,terrain,andobstacles.



75



I_2.2.1"Theoperatorshouldbeabletodisplayflightcorridors,controlledairspaceandanyotherrelevantairspaceco-ordinationinformation".





I_2.4.1TheGCSshouldprovidethepilotwithadisplayindicatingthefutureflightpathoftheaircraftshouldalostlinkoccur.











76

Control-relatedguidelinesC_1.4.1TheGCSshouldprovideacontroltocancelthecollisionalertifitwillbeongoinganddistractthepilotinaccomplishingothertasks.


C_1.4.2aUAattitude.

C_1.4.2bUAheading.

C_1.4.2cUAspeedand/orthrust.





C_2.1.3TheGCSshouldenablethepilottomaneuvertheUA.




77

Guidelinesrelatingtopropertiesoftheinterface


P_1.1.2TheGCSshouldpreventmultipleoperatorsfromoperatingthesameapplication/proceduresatanyonetime.

P_1.1.3TheGCSshouldprovidetheabilitytoallowotheroperatorstoviewthestatusofaircraftsystems.


P_1.4.2Collisionavoidancealertsmustattractthepilot'sattentioninallexpectedlightingandoperatingconditions.



P_1.5.1"TheremustbeanalertfortheUAScrew,viaaclearanddistinctauralandvisualsignal,foranytotallossofthecommandandcontroldatalink".





P_1.5.6TheC2datalinkfootprintshouldbeeasilydistinguishablefromotherfootprintsthatmaybepresentontheoperatormapdisplay.

P_1.5.7Ifthepayloadutilizesalinkseparatetotheaircraftcontrollink,anydisplayofpayloadlinkqualityshouldbeseparateandclearlydistinguishablefromdisplaysfortheaircraftcontrollink.

P_1.5.8Ifanauralwarningisusedtoindicatelossofpayloadlink,thesoundshouldbedissimilarto


78

thatusedtoindicatelossofcontrollink.


P_1.5.10TheGCS,incombinationwiththeotherelementsoftheUASshouldcomplywithcontrollinklatency(timefrominitiationofamaneuvertoameasurableresponsebytheUA)requirementsthatareestablishedatalevelsimilartomannedaircraft.


P_2.1.2Thepresentationscaleofthemapshouldbeselectable.Continuousscalingispreferredtodiscrete.

P_2.1.3Thepilotshouldbeabletoderivethescaleofthemapfromthedisplay.

P_2.1.4ThemapdisplayshouldenablethepilottocustomizetheAircraft'sInformationTrail.

P_2.1.5Themapdisplayshouldbeconfigurableto"Northup"or"Trackup".

P_2.1.6Ifcontrolisviaaterrestrialradio,thelocationof(ordirectionto)thegroundtransmitter/receivershouldbeshownonthemap.

P_2.1.7PrimaryflightcontrolsforcontrollingtheUA(heading,attitude,speed)shouldbeavailableatalltimesthroughdedicatedphysicalcontrols.Iftheuseofsoftware-basedcontrolscannotbeavoided,thenthecontrolsshouldbeimmediatelyaccessibleatthetoplevelofthecontrolinterface.

P_2.1.8Mapdisplaysshouldhavemeanstoselectthescaleofthemaptobepresented.Thescalespresentedonthemapsshouldbeevidenttothepilot.

P_2.1.9Thepilotshouldhavethemeanstocustomizetheinformationtrailforanaircraftshownonthetrafficdisplay.




P_2.5.1aTheuseofthesecontrolsshouldbeintuitiveandminimizethepossibilityofconfusionandsubsequentinadvertentoperation.

P_2.5.1bTwodistinctanddissimilaractionsoftheUAScrewshouldberequiredtoinitiatethe


79

flightterminationcommand.


P_2.5.3Theauralalertwarningofimminentflightterminationshouldinvolveauniquesound.Thisshouldpreferablytaketheformofaverbalmessagesuchas"Flighttermination!"

P_2.5.4WhentheUAisequippedwithaflightterminationsystem,flightterminationcontrolsshouldbesafeguardedfrominterferencethatcouldleadtoinadvertentoperation.

P_3.1.1ThevoicecommunicationdelaybetweenthepilotandATCshouldhaveameanlessthanorequalto250ms.

P_3.1.2ThevoicecommunicationdelaybetweenthepilotandATCshouldbelessthanorequalto300ms.(99thpercentile).

P_3.1.3ThevoicecommunicationdelaybetweenthepilotandATCshouldbewithinamaximumof350ms.




80

Generalguidelines




G_1c.Developafullsetofinformationrequirementsforthetasksthepilotswillneedtoaccomplish.Theserequirementsshouldbedevelopedwithotherdesignrequirementsatthebeginningofthesystemsengineeringprocess.Theywillhelpensurethattheappropriateinformationisprovidedtothepilotsandprovidethefoundationformakingdesigndecisions.



G_2Theuseofmulti-modefunctionsonflightcontrolsshouldbeminimized.Ifmodesareused,thesystemshouldclearlyindicatethecurrentmode,andotherpotentialmodesshouldbeindicated.

G_3Ifchangingamodeselectionofanautomatedsystemhasasafetyconsequence,theactiontoselectthatmodeshouldbealerted,andadditionalprecautionsshouldbetakentopreventinadvertentselection.

G_4Payloadcontrolsshouldbeseparatefromcontrolswithsafety-of-flightfunctions.

G_5Itshouldnotbepossibletoreconfigureasafety-of-flightcontroltoperformapayloadfunction.

G_6Activationofakeyorbuttonshouldprovidetactileorauditoryfeedbacktothepilot.

G_7ThereshouldbeaclearindicationtothepilotwhenacommandhasbeenreceivedbytheUAS.

G_8AnyunrecognizedentrymadebythepilotattheGCSshouldcauseaninformativeerrormessagetobedisplayedandnotaffectthestatusoroperationofanysystem.



81

G_9“(a)Flightcrewalertsmust:(1)Providetheflightcrewwiththeinformationneededto:(i)Identifynon-normaloperationorairplanesystemconditions,and(ii)Determinetheappropriateactions,ifany.(2)Bereadilyandeasilydetectableandintelligiblebytheflightcrewunderallforeseeableoperatingconditions,includingconditionswheremultiplealertsareprovided.(3)Beremovedwhenthealertingconditionnolongerexists.




G_9(e)Visualalertindicationsmust:(1)Conformtothefollowingcolorconvention:(i)Redforwarningalertindications.(ii)Amberoryellowforcautionalertindications.(iii)Anycolorexceptredorgreenforadvisoryalertindications.(2)Usevisualcodingtechniques,togetherwithotheralertingfunctionelementsontheflightdeck,todistinguishbetweenwarning,caution,andadvisoryalertindications,iftheyarepresentedonmonochromaticdisplaysthatarenotcapableofconformingtothecolorconventioninparagraph(e)(1)ofthissection.

G_9(f)Useofthecolorsred,amber,andyellowontheflightdeckforfunctionsotherthanflightcrewalertingmustbelimitedandmustnotadverselyaffectflightcrewalerting”.

G_10Systemsthatalertthepilottoacriticalanomalyshouldnotbesubjecttoasilentfailure.

G_11TheGCSshouldprovideaworkenvironmentthatmaintainspilotengagement,andminimizesthenegativeimpactofextendedperiodsoflowworkload.

G_12TheGCSshouldprovideconsistencyofoperationforcommonfunctions.

G_13Thefunctionsneededtosafelycontroltheaircraftunderusualflightsituationsshouldbelocatedinthepilot'sprimaryfield-of-view.


82

G_14WarningsandcautionsshouldnotbeobscuredbyotherGCSdisplays.

G_15"Part-timedisplay.Ifitisdesiredtoinhibitsomeparametersfromfull-timedisplay,anequivalentlevelofsafetytofull-timedisplayshouldbedemonstrated.Criteriatobeconsideredincludethefollowing:(a)Continuousdisplayoftheparameterisnotrequiredforsafetyofflightinallnormalflightphases.(b)Theparameterisautomaticallydisplayedinflightphaseswhereitisrequired.(c)Theinhibitedparameterisautomaticallydisplayedwhenitsvalueindicatesanabnormalcondition,orwhentheparameterreachesanabnormalvalue.(d)DisplayoftheinhibitedparametercanbemanuallyselectedbytheUAVcrewwithoutinterferingwiththedisplayofotherrequiredinformation.(e)Iftheparameterfailstobedisplayedwhenrequired,thefailureeffectandcompoundingeffectsmustmeettherequirementsofUSAR.1309.Theanalysisistoclearlydemonstratethatthedisplay(s)ofdataisconsistentwithsafeoperationunderallprobableoperatingconditions.(f)Theautomatic,orrequested,displayoftheinhibitedparametershouldnotcreateunacceptableclutteronthedisplay;simultaneousmultiple"pop-ups"mustbeconsidered.(g)Ifthepresenceofthenewparameterisnotsufficientlyself-evident,suitablealertingmustaccompanytheautomaticpresentation".

G_16Whereverpossible,textmessages,whetherindialogboxes,warningmessagesorotherscreendisplays,shouldbepresentedinplainlanguage,orusingstandardaviationterminology.

G_17Controlsintendedtobeoperatedbythepilotshouldbereachablefromaseatedposition

G_18TheGCSshouldprovideabookresttoenablethepilottorefertodocumentswithoutriskthatthedocumentwillcomeintocontactwithakeyboardorotherflightcontrols.

G_19AppropriateprioritycontrolsshouldbeavailableforUASfunctionsthatrequireeitherquickaccessibilityorconstantavailability.Prioritycontroldevicescaninclude,butarenotlimitedto:(a)Touchpanels,(b)Buttons,(c)Switches,(d)Joysticks,(e)Keyboardshortcuts.

G_20Ifadisplayscreenenablesthepilottomoveorrearrangedisplayorcontrolwindows,itshouldnotbepossibletoplaceawindowsoastoobscureprimaryflightcontrolsordisplays.


83

Definitionsofterms

System:Anintegratedcollectionoffacilities,parts,equipment,tools,materials,software,personnel,and/ortechniqueswhichmakeanorganizedwholecapableofperformingorsupportingafunction(Stramler,1993).Engineeredsystem:Thenon-humancomponentsofthesystem,comprisingfacilities,parts,equipment,tools,materials&software.Humanfactors:Abodyofknowledgeabouthumanabilities,humanlimitations,andotherhumancharacteristicsthatarerelevanttodesign(Chapanis,1991).Humanfactorsengineering:Theapplicationofhumanfactorsinformationtothedesignoftools,machines,systems,tasks,jobs,andenvironmentsforsafe,comfortable,andeffectivehumanuseChapanis(1991).Humanfactorsguideline:Astatementdescribingacharacteristicoftheengineeredsystemwiththeintentionofpromotingsafeandeffectivehumanuse(AdaptedfromChapanis,1991).Humantask:Ataskdescriptioniscomposedofanactor,averbandanobject.Qualifyingphrasesmaybeincludedifneededforclarification.Informationcontentofdisplays:Informationthatmustbeprovidedbytheengineeredsystemtothehumantoenableatasktobeperformed.Therequirementmayspecifykeyattributesoftheinformation,suchasaccuracy,timing,andusability,butwillremainagnosticwithrespecttothemediumusedtotransmittheinformation.Controlinput:Inputsthattheengineeredsystemmustbecapableofreceivingfromthehuman.Therequirementmayspecifykeyattributesoftheinput,suchastimingandprecision,butwillremainagnosticwithrespecttothedeviceusedtomaketheinput.Propertyoftheinterface:Specificationsofdesiredphysicalorfunctionalpropertiesofcontrolsordisplays.Physicalpropertiesarecharacteristicsthataredirectlyobservable,suchasshapeandcolor.Functionalpropertiesrefertooperationalcharacteristicsoftheinterfacesuchastheorderinwhichinputsmustbemade,ortheabilitytoundoaninput.Generalguideline:Ahumanfactorsprinciplethatrelatestowhole-of-systemfunctioning,orthathasbroadapplicabilityacrosstheengineeredsystem.Human-centereddesignprocess:Anactivityperformedduringthedesignanddevelopmentphasetoensurethatthesystemwilloperatesafelyandeffectively,andwillbeconsistentwiththecapabilitiesandlimitationsofthehumanoperator.


84

References

Access5(2006).HSIGuidelinesOutlinefortheAirVehicleControlStation.HSI003Rev2.(UnpublishedDraft).Availableat:http://ntrs.larc.nasa.gov/

ANSI/HSES(2007).HumanFactorsEngineeringofComputerWorkstations.ANSI/HFES100-2007.SantaMonica,CA:HumanFactorsandErgonomicsSociety.

ASTMInternational(2007).StandardSpecificationforDesignandPerformanceofanAirborneSense-and-AvoidSystem.F2411–07.WestConshohocken,PA:Author.

ASTMInternational(2014).StandardSpecificationforDesignoftheCommandandControlSystemforSmallUnmannedAircraftSystems(sUAS).F3002−14.WestConshohocken,PA:Author.

Berson,B.,Gershzohn,G.,Wolf,R.,Schultz,M.(2005).Drafthumansystemsintegrationrequirementsandfunctionaldecomposition.TechnicalreportDFRC-239;HSI007.Availableathttp://ntrs.nasa.gov.

Chapanis,A.(1991).Tocommunicatethehumanfactorsmessage,youhavetoknowwhatthemessageisandhowtocommunicateit.HumanFactorsSocietyBulletin,Vol34,(11).

Cooke,N.J.,Pringle,H.L.,Pedersen,H.K.&Connor,O.(2006).(Eds.),Humanfactorsofremotelyoperatedvehicles.SanDiego:Elsevier.

Cummings,M.L.,Mastracchio,C.,Thornburg,K.M.,Mkrtchyan,A.(2013).Boredomanddistractioninmultipleunmannedvehiclesupervisorycontrol.InteractingwithComputers,25(1),34-47.

DepartmentofDefense.(2012).Designcriteriastandardhumanengineering.Militarystandard1472G.Washington,DC:Author.

Endsley,M.andJones,D.(2012).Designingforsituationawareness.BocaRaton,FL:TaylorandFrancis.

FederalAviationAdministration.(2012).NationalAirspaceSystemRequirementsDocument.NAS-RD-2012.Washington,DC:Author.

FederalAviationAdministration.(2013a).IntegrationofCivilUnmannedAircraftSystems(UAS)intheNationalAirspaceSystem(NAS)Roadmap.Washington,DC:Author.


85

FederalAviationAdministration.(2013b).IntegrationofUnmannedAircraftSystemsintotheNationalAirspaceSystem.ConceptLevelRequirements.Washington,DC:Author.

GeneralAviationManufacturersAssociation.(2004).Recommendedpracticesandguidelinesforanintegratedcockpit/Flightdeckina14CFRpart23CertificatedAirplane.Washington,DC:Author.

Hobbs,A.(2010).Unmannedaircraftsystems.InE.Salas&D.Maurino(Eds.).Humanfactorsinaviation,2ndedition(505-531).SanDiego:Elsevier.

Hobbs,A.andHerwitz,S.(2008).Maintenancechallengesforsmallunmannedaircraftsystems:Anintroductoryhandbook.Availableat:http://human-factors.arc.nasa.gov/

InternationalCivilAviationOrganization(2002).LOSALineOperationsSafetyAudit(LOSA).Doc9803,AN/761.Montreal:Author.

InternationalCivilAviationOrganization.(2011).UnmannedAircraftSystems.Circular328.Montreal:Author.

Kaliardos,B.andLyall,B.(2014).HumanFactorsofUnmannedAircraftSystemIntegrationintheNationalAirspaceSystem.InK.P.Valavanis,G.J.Vachtsevanos(eds.),HandbookofUnmannedAerialVehicles(pp2135-2158).Dordrecht,TheNetherlands:Springer.

Mutuel,L.H.,Wargo,C.A.&DiFelici,J.(2015,March).FunctionaldecompositionofUnmannedAircraftSystems(UAS)forCNScapabilitiesinNASintegration.IEEEAerospaceConference,BigSky,MT.

NationalTransportationSafetyBoard.(2006).AccidenttoPredatorB,NogalesArizona(NTSBreportCHI06MA121).Washington,DC:Author.

Norman,D.(1988).Thepsychologyofeverydaythings.NewYork:BasicBooks.

NorthAtlanticTreatyOrganization.(2004).StandardinterfacesofUAVcontrolsystems(UCS)forNATOUAVInteroperability.NATOStandardizationAgreement(STANAG)4568,Edition1.

NorthAtlanticTreatyOrganization.(2007).StandardinterfacesofUAVcontrolsystems(UCS)forNATOUAVInteroperability.NATOStandardizationAgreement(STANAG)4586,Edition2.Availableathttp://nso.nato.int/nso/

NorthAtlanticTreatyOrganization.(2009).Unmannedaerialvehiclesystemsairworthinessrequirements.NATOStandardizationAgreement(STANAG)4671.Availableathttp://nso.nato.int/nso/


86

Nullmeyer,R.,&Montijo,G.(2009).Traininginterventionstoreduceairforcepredatormishaps.Proceedingsofthe15thInternationalSymposiumonAviationPsychology,Dayton,OH.

OfficeoftheUnderSecretaryofDefense.(2012).Unmannedaircraftsystemsgroundcontrolstationhuman-machineinterface.DevelopmentandStandardizationGuide.Washington,DC:Author.

Pestana,M.(2008).NASAMQ-9Ikhanahumanfactors:Pilotperspective.PaperpresentedatNTSBForumontheSafetyofUnmannedAircraftSystems.Washington,DC.

RTCA.(2007).GuidanceMaterialandConsiderationsforUAS.DO-304.AppendixG.Washington,DC:Author.

RTCA.(2008).MinimumOperationalPerformanceStandardsforTrafficAlertandCollisionAvoidanceSystemsII(TCASII).DO-185B.Washington,DC:Author.

RTCA.(2010).OperationalServicesandEnvironmentalDefinitionforUAS.DO-320.Washington,DC:Author.

RTCA.(2013).OperationalandFunctionalRequirementsandSafetyObjectivesforUnmannedAircraftSystemStandards.DO-344.Washington,DC:Author.

RTCA.(2014).MinimumOperationalPerformanceStandards(MOPS)forAircraftSurveillanceApplications(ASA)System.DO-317B.Washington,DC:Author.Scheff,S.(2012).UASOperationintheNASGCScatalogandphaseofflightrequirements.ReportpreparedunderNASAcontract201020.Shneiderman,B.&Plaisant,C.(2005).Designingtheuserinterface:Strategiesforeffectivehuman-computerinteraction.Boston:Pearson.Stramler,J.H.(1993).Thedictionaryforhumanfactorsergonomics.BocaRaton,FL:CRCpress.Tvaryanas,A.P.(2006).Humanfactorsconsiderationsinmigrationofunmannedaircraftsystem(UAS)operatorcontrol(USAFPerformanceEnhancementResearchDivisionReportNo.HSW-PE-BR-TE-2006–0002).BrooksCity,TX:UnitedStatesAirForce.

Waraich,Q.Mazzuchi,T.Sarkani,S.&Rico,D.(2013).MinimizingHumanFactorsMishapsinUnmannedAircraftSystems.ErgonomicsinDesign,21,1,25-32.

Williams,K.W.(2004).Asummaryofunmannedaircraftaccident/incidentdata:HumanFactorsimplications.TechnicalReportNo.DOT/FAA/AM-04/24.Washington,DC:U.S.DepartmentofTransportation,FederalAviationAdministration,OfficeofAerospaceMedicine.


87

Williams,K.W.(2006).Humanfactorsimplicationsofunmannedaircraftaccidents:Flightcontrolproblems.InN.JCooke,H.L.Pringle,H.K.Pedersen,&O.Connor(Eds.),HumanFactorsofRemotelyOperatedVehicles(pp.105–116).SanDiego:Elsevier.

Yeh,M.,Jo,Y,Donovan,C.&Gabree,S.(2013).HumanFactorsConsiderationsintheDesignandEvaluationofFlightDeckDisplaysandControls.Washington,DC:FederalAviationAdministration.


88

Appendix-Selectedhumanfactorsregulations,guidance,andpolicyRegulationsandguidancematerialwithrelevancetocockpitdesign

Title14CodeofFederalRegulations(14CFR)

http://www.faa.gov/aircraft/air_cert/design_approvals/human_factors/hf-air/cfr/

FAAGuidanceandPolicy

http://www.faa.gov/aircraft/air_cert/design_approvals/human_factors/hf-air/policy/

EuropeanAviationSafetyAgency.CS25.1302&AMC25.1302.Certificationspecifications

forlargeaeroplanes.Installedsystemsandequipmentforusebytheflightcrew.

DepartmentofDefense.MIL-STD-1787B:Aircraftdisplaysymbology.

DepartmentofDefense.MIL-STD-411F:Aircrewstationalertingsystems.

HumanFactorsConsiderationsintheDesignandEvaluationofFlightDeckDisplaysand

Controls.Yeh,M.,Jo,Y,Donovan,C.&Gabree,S.(2013)

GAMAPublicationNo.10(2004).RecommendedpracticesandguidelinesforPart23

cockpit/flightdeckdesign.

DocumentsspecificallycoveringtheUASpilotinterface

NorthAtlanticTreatyOrganization.(2007).STANAG4586Edition2:Standardinterfacesof

UAVcontrolsystems(UCS)forNATOUAVInteroperability.

DepartmentofDefense.MIL-STD-1472G:Humanengineering.

Access5(2006).HSI003Revision2(Draft):HSIguidelinesoutlinefortheairvehiclecontrol

station.

NorthAtlanticTreatyOrganization.(2009).STANAG4671Edition1:Unmannedaerial

vehiclessystemsairworthinessrequirements.

OfficeoftheUnderSecretaryofDefense.(2012).Unmannedaircraftsystemsground

controlstationhuman-machineinterfacedevelopmentandstandardizationguide.


89

ExamplesofdocumentswithgeneralrelevancetoHMIdesign

FAA.(2012).HumanFactorsDesignStandard(HFDS).HF-STD-001.Availableat:

http://hf.tc.faa.gov/hfds/

DepartmentofDefense.MIL-HDBK-759C:Humanengineeringdesignguidelines.

ResearchIntegrations,Inc.(2012)HFYIDesignCoPilot[onlineapplicationanddatabase].

Availableathttp://www.designcopilot.com.

NationalAeronauticsandSpaceAdministration.(2010).Humanintegrationdesign

handbook(HIDH).

ANSI/HFESStandard100-2007.DesignofComputerWorkstations