Flight Deck Design and Ergonomics

Ergonomics is the study of fitting the task, the equipment and the working environment to the people who use them, instead of expecting people to adapt to poor design. On the flight deck it covers the seat and the view from it, the controls, the displays and alerts, and the checklists and manuals a pilot works with. In the SHELL model these are the Liveware-Hardware and Liveware-Software interfaces.

Design matters because a well-trained pilot can be led into error by a lever that looks like its neighbour, a display that hides the one indication that matters, or a checklist that invites automatic answers. Such design-induced errors have contributed to accidents, and certification rules now require flight decks to be assessed for how crews will actually use them.

Ergonomics and the pilot

The human-machine interface (HMI) is everything through which pilot and aircraft exchange information and commands: controls, switches, displays, aural alerts and the keyboards of the flight management system. The SHELL model, proposed by Elwyn Edwards in 1972, places the pilot at the centre; in its familiar diagram the edges of each component are drawn jagged, a reminder that the components must be carefully matched to one another. Hardware covers the flight deck, its displays and controls; software covers procedures, manuals, checklist layouts, symbology and computer programs.

For large aeroplanes, CS 25.1302 and 14 CFR 25.1302, Installed systems and equipment for use by the flightcrew, turn these principles into certification requirements: the crew must have the controls and information its tasks need, presented clearly and unambiguously, and the equipment must, as far as practicable, let the crew manage the errors that can reasonably be expected in service. Compliance is shown by analysis and in simulators: for the return to service of the Boeing 737 MAX, for example, the FAA reported focused evaluations in an engineering simulator flown by crews of Boeing and airline pilots.

The seat is the starting point. Its design considerations include lumbar support to keep the spine in its natural shape, absorption of vibration, long-term comfort, a fit to the range of pilot sizes, protection under g loads, and prevention of submarining under the lap strap during a sudden deceleration.

Anthropometry and the design eye position

Anthropometry is the measurement of human body dimensions. Flight deck designers use anthropometric data tables that normally cover the 5th to 95th percentile, 90 % of the relevant population. The tables contain three kinds of measurement: static (fixed dimensions such as seated height), dynamic (ranges of movement and reach) and contour (body shape). They set the adjustment range of the seat, the travel of the rudder pedals and the reach envelope within which controls are placed.

The whole geometry is built around the design eye position, also called the eye datum or eye reference point. From it the pilot can see the ground ahead over the nose on the approach, read the instruments and reach the controls. It is marked on the windscreen frame or centre post; on the Airbus A320 the seat is correctly adjusted when the pilot's eyes are in line with a red ball and a white light. A pilot sitting below the datum loses sight of the undershoot area; one sitting above it may lose the overshoot and find some instruments hard to read. Sitting at the same point on every flight also gives a consistent view of the runway and the visual attitude.

Eye height also affects perception. Pilots converting from a type with an eye height of about 3.5 m to one of about 8.7 m tend to taxi too fast at first, because the distant references move more slowly across the field of view.

Analogue and digital displays

Each type of display suits a different kind of information:

For small changes, such as a level-off or an inadvertent departure from the selected altitude, a combination of digital thousands and hundreds of feet with a single analogue pointer gives the best mental picture; a pure digital display has no trend cue.

Layout matters as much as format. The basic T of conventional instrument panels puts the attitude indicator, the most important instrument, in the centre, with the airspeed indicator, altimeter and direction indicator grouped around it, and glass primary flight displays keep the same arrangement (see attitude indicator). An ideal engine panel gives each engine a column and each parameter a row, with the columns aligned with their power levers, so that the odd one out stands out at once.

Conspicuity can decide an accident. At Kegworth in 1989 the Boeing 737-400's new engine instrument system replaced mechanical pointers with light-emitting diode (LED) displays. The vibration indicator of the damaged engine showed maximum for about three minutes, but neither pilot noticed it. Its pointer was a small LED segment, easily lost beside the adjacent oil quantity digits, and the crew's training had not drawn attention to the newer, more reliable vibration monitor. The AAIB found the LED displays less conspicuous than mechanical pointers and noted that the system appeared to have been introduced without a thorough evaluation with line pilots, which it recommended for future displays.

Control-display compatibility

Control-display compatibility means that a control moves in the direction the pilot expects and in the same sense as the change it produces on the display and in the aircraft: a knob turned clockwise increases the value it sets, a lever moved up raises its indication. Conventions extend this to controls without displays; a manually operated valve, for example, opens anticlockwise and closes clockwise. Other principles place controls according to their importance and frequency of use.

Colour and light follow conventions too. The Airbus A320 family uses a dark cockpit or "lights out" philosophy: with every system normal and ready for flight, the overhead pushbuttons are dark. Amber shows a failed system, red a failure that may require immediate action, green normal operation, blue the normal operation of a temporarily selected system, and white an abnormal switch position or a maintenance or test indication. Any light is therefore worth looking at.

Warnings should get attention without startling, tell the pilot what is wrong and, ideally, guide the corrective action. A single aural alert with a central warning panel and a caption naming the problem is the classic arrangement. Reliability matters: frequent false alarms, as with early GPWS installations, teach pilots to ignore real ones.

Shape coding and standardisation

Standardisation of controls and displays is the most important requirement of all, because it lets pilots move between types with the minimum of retraining and keeps habits correct from one aircraft to the next. Total standardisation is impossible, since it would stop new technology, but it should be the goal for similar types within a fleet.

Shape coding, or symbolism, gives controls a shape that suggests their function. The landing gear lever ends in a knob shaped like a wheel and the flap lever in one shaped like a flap cross-section, and for large aeroplanes CS 25.781 and 14 CFR 25.781 lay down the general shapes of cockpit control knobs. Controls for different functions should also look and feel different, so that one cannot be mistaken for another by touch.

Confidential reports show what happens when these principles fail. On one fleet of Fokker F27s the switches for water-methanol injection and for pitot heat were in exchanged positions on different aircraft, and a first officer switched on water-methanol instead of pitot heat. In another report a captain moving his hand from a radio selector on the pedestal to the heading knob on the glareshield caught the go-around button on the thrust lever with his knuckle. On Atlas Air flight 3591 in 2019 the NTSB concluded that light turbulence had probably moved the first officer's arm so that his wrist or watch contacted the go-around switch under the thrust lever while he held the speedbrake lever. The unexpected go-around mode was followed by the first officer's disoriented nose-down inputs and a dive into Trinity Bay, and the NTSB asked for a safety alert to Boeing 767 and 757 operators about the speedbrake lever and the go-around switch.

Checklist design

A checklist sits at the Liveware-Software interface, and its design shapes how well it traps errors. The most common checklist error is answering items automatically instead of diligently. Pilots may regard rapid dismissal as a sign of skill, but they then see what they expect to see rather than what is there. Other traps are external interruptions such as a radio call, and a thumb marker that slips while the grip is adjusted so that a line is missed.

Text design follows reading research. Mixed upper and lower case is read faster than capitals or italics, so long messages in capitals should be avoided, because the shape of the words, which helps reading, is lost. Colour helps to categorise information, but every colour must be tested under every expected lighting condition: red text on a white background can become invisible under red flight deck lighting. In the challenge-response method one pilot reads each item and the other checks the actual state before replying, which puts two people in the loop on every item.

Design-induced error and error-tolerant design

A design-induced error is one that a trained pilot is led into by the equipment. Look-alike controls side by side, inconsistent layouts, inconspicuous indications and system logic that crews are not told about all invite it. The Boeing 737 autothrottle that closed the thrust levers on Turkish Airlines TK1951 in 2009 took its height from the left radio altimeter only, a design point not described in the training material available to pilots (see radio altimeter). Human factors texts sum up the lesson with Murphy's law: if a system can be operated incorrectly, sooner or later it will be.

Error-tolerant design accepts that errors will happen and limits their consequences. EASA's design philosophy for future avionics and automation rests on three principles:

• Detectability: the system detects errors made by the crew.
• Tolerance: the system tolerates the error without dangerous consequences.
• Recoverability: the system supports recovery from the error.

Familiar examples are flight plan changes displayed as temporary, in yellow on the Airbus MCDU, until the crew inserts them, the EXEC key that activates a change on a Boeing FMS, and guards over switches that must not be moved by accident. Together with duplicated systems and cross-monitoring crews, such features turn a vulnerable system, where one error brings down the whole, into a protected one that survives it (see human error).

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.