Research on Verification Technology of Human Factors in Aircraft Design and Manufacture and Its Future Development

: Through the study on compliance verification methods and process of human factors in aircraft design and manufacture , as well as analyzing the key problems in the human factors verification, suggestions on the research of verification technology of human factors were proposed as followings, mainly including strengthening the cooperation between the applicants and the bureau, integrating airworthiness clauses and human error management into the whole design process, making the early diagnosis and prediction of human errors, and strengthening the training of designers and test pilots.


Concept of compliance verification
Compliance verification adopts various verification means to prove whether verified objects meet the requirements of the airworthiness regulations and check the compliance between the verified objects and airworthiness regulations. Compliance verification runs through the whole process of civil aircraft development, through which the quality of aircraft development can be identified. Only the compliance verification is completed, can the aircraft obtain the civil aviation airworthiness certificate and be put into market operation.
Airworthiness verification of human factors includes evaluation, demonstration, and testing. Pilots usually need to conduct tests in testing facilities that can represent the real aircraft flight deck environment, including bench tests, simulator tests, on-board ground tests and flight tests.
The basis of airworthiness compliance verification is the basis of approval. There are two parties in the airworthiness approval, namely, the applicants and the civil aviation administration authority.
According to the determined approval basis and compliance methods, with following certain management procedures, the applicants shall show the compliance of the airworthiness standards to the civil aviation administration authority, who shall confirm the compliance.

Means of compliance verification
Common means of compliance verification are shown in Table 1. All the previous compliance verification means may be included Depending on the airworthiness regulations, every means of compliance can be used separately or in combination. Generally, regulations with broad jurisdiction often need to be verified by multiple means of compliance verification. The selection of means is based on the principle of meeting the regulations' requirements at the lowest cost. It is not that the more test, the better, but as few and simple as possible [1]. The characteristics of the approved products and the type of human problems to be evaluated are the focus and foundation to be considered when selecting the means. General characteristics to be considered include product integration/independence, novelty, complexity/automation, impact of flight safety, dynamics, and subjective degree of judgment criteria, etc. By comparing the design characteristics of the approved items, the characteristics and application scope of the various methods, it is helpful to find out the most matching method.

Compliance verification technology and implementation process
Different verification techniques can be used for different compliance means. This paper only states the most important evaluation and test techniques.
(1) Flight deck evaluation usually adopts the method of pilot subjective evaluation. During the research process, the flight deck evaluation compliance method research is carried out combined with the model development. The evaluation platform is an engineering prototype, and the evaluation is designed for the human factors of the engineering prototype (Fig.1). Secondly, determine the flight deck configuration of the engineering prototypes. Record the configuration status of the flight deck accurately, ensure that the evaluation object is controllable and traceable, and establish a special configuration management system to manage the status of the prototypes.
Thirdly, conduct the situational assessment for pilots. Before the assessment, the status of flight deck configuration, the content of the questionnaire and the method of filling the questionnaire should be explained to pilots elaborately. During the assessment on board, accompany the pilots entirely, and explained the problems during the evaluation process.
Fourthly, data collection and processing. Test data were processed after completing the assessment. The data consists of two parts, one is objective data evaluated by a 5-level scale, and the other part is the collection of subjective opinions. The objective evaluation grade can be obtained by sorting the statistical methods combined with the comprehensive evaluation algorithm. The collection of subjective opinions is conducted by the design team according to the pilot's opinions.
(2) Situational assessment for pilots relates with flight performance mainly by objective indicators which are proposed by collecting the pilots' eye movement, to explain the compliance of human factors. This study was carried out on a simulator (Fig.2).
Firstly, set the test task scenarios according to the predetermined verification targets, and conduct basic training for pilots.
Secondly, carry out simulator test, simulate the predetermined task scenarios, and collect pilots' eye movement and flight parameters at the same time.
Thirdly, data analysis. Establish the relationship between eye movement parameters and flight performance through eye movement data. On this basis, it is verified that the objective indicators of pilots in the given normal and abnormal tasks are within an acceptable range, thus indicating compliance. The test scenario is shown in Fig.3 [2]. Human factor verification work in parallel with the design process is shown in Table 2. Table 2 Human factor verification work in parallel with the design process

Stage Mainly Work
Before plan review 1.The novel and unique HMI and technologies are determined. 2.With reference to existing industrial standards, human factor requirements are obtained whose acceptability is verified during subsequent ground and flight tests.
Before design review 1.Detailed analysis of the design using the human model software to meet the requirements of operation accessibility for pilots within a certain height range. 2.Workload assessment at the initial stage of the design through qualitative and quantitative measurement techniques, including questionnaire survey, simulator, or flight test analysis. 3.Estimation of human errors using the methods of task analysis and human factor analysis.

Determination of the design concept related to human factors
Section AMC25.1302 regards the equipment and functions related to the pilot mission in the whole flight deck as an integrated and interactive human-machine system, takes the pilot's mission as the guidance, aims to support the pilots to complete the specified mission effectively and safely, and puts forward principled design requirements for the design of all equipment / systems related to human factors. All systems / equipment integrated into the flight deck should be unified, and appropriate principles and advanced design concepts are required to solve the possible conflicts between systems / equipment, which the reviewers and designers should focus on at the early stage of the project. Without the advanced and unified design concept, the human-machine interface of each system / equipment lacks the commonality in operation and use, which will bring trouble to the crew. Both Boeing and Airbus have mature flight deck design concepts. The design concept related to human factors of Boeing 777 series are shown in Table 3 [3]. Table 3 The design concept related to human factors of Boeing 777 series The pilots can control the aircraft, and their authority is higher than the computer. 2 Both the pilot and the first officer are responsible for flight safety. 3 Task priority: Safety> passenger comfort> efficiency.

4
The operation device / program design of the aircraft should consider the general type and be with continuity. 5 The system has fault-tolerant design. 6 Design level: single design, redundant design, automatic design.

7
The automation function can share the workload of pilots, but not replace pilots. 8 Operations and tasks are designed based on the basic human body parameters of the pilots under normal and abnormal operating conditions.

9
Conditions for introducing new technologies and functions: It can make flight operation clearer and more direct or can significantly improve efficiency.
There is no adverse impact on the human-machine interface.

Identification of design features related to human factors and process intervention
AMC25.1302 recommends that applicants invite airworthiness reviewers to intervene in human factor design as soon as possible, so as to reach a consensus on the potential human factors related to the design in time and reduce the risk of excessive investment in design features that are not necessarily accepted by the Bureau. The identification of design features related to human factors runs through the development process of the system / equipment. To ensure that the airworthiness requirements of human factors are implemented in the research and development of the system / equipment, human factor experts need to regularly evaluate the system / equipment in aspect of human factors.

Key points of human factors airworthiness review: novel design features
Boeing and Airbus, the two main manufacturers of civil aircraft, are cautious about using the new technology. Novel design features related to human factors are the key focus of the airworthiness review of human factors, which are also the important content that applicants need to describe in detail and verify. A variety of airworthiness verification methods are used in the design and development of human factors. For the mature traditional design features, verification with one or two methods may obtain the approval of the bureau. However, for novel designs, the bureau usually needs to pay full attention and conduct systematic verification [4]. The judgment of novel design features is the basis for the human factor airworthiness verification of novel designs. The identification of a novel design cannot be determined simply by whether it is a device or technology being used for the first time, but by answering the following questions: (1) Whether the operation modes/methods are changed.
(3) Whether the way of interaction between the crew and equipment is changed.
(4) Whether the flight mission and the responsibility of the crew are changed.

Suggestions for studying human factor verification technology in China
Airworthiness review and airworthiness verification of human factors in the civil aircraft design still be in the exploratory stage in our country. There may be a little deviation between the review party and the industry party in their understanding of the terms of human factor airworthiness, and it is inevitable that there will be small differences in the process of airworthiness review and airworthiness verification. The follow-up work can only be carried out after reaching a consensus on the key points of airworthiness review and verification of human factors.

Enhancing co-operation between applicants and the bureau
Considering the applicants' and the bureau's airworthiness experience with the new clauses and the characteristics of certification work in human factor clauses, the applicants and the bureau should reach a consensus on the requirements of Clause 25.1302, scope of certification, MOC and acceptable design requirements as soon as possible [5]. This facilitates early incorporation of airworthiness requirements into specific designs. In addition, as suggested by FAA, the bureau's early participation and the applicants' initiative to share design, analysis and simulator test data with the bureau can establish "credit score" for the later formal certification work and improve the efficiency of obtaining certification [6].

Integrating the airworthiness clause requirements into the design
AMC25.1302 puts forward new requirements for the existing design process and methods. The existing design process and method should embody the ergonomics design concept of "humancentered", rather than the traditional design concept of "technology centered". This integration process includes the early participation of ergonomics professionals, meeting users' needs in the design of human-machine interface, rapid prototyping, and early verification of simulation cabin [7,8]. This design process complies with the airworthiness concept and certification obtaining method of "pilot mission oriented" under the clause of AMC25 1302, contributing to fully consideration of matching degree between the design and pilots, and effectively supports pilots' operation performance and human error management.
With reference to the specific design requirements suggested by AC25.1302-1 (Chapter 5) for display, controller, system behavior and function distribution, and human error management, etc. The requirements of 25.1302 can be specifically "decomposed" into the design requirements and acceptable design indicators of each equipment and function [6,9]. At different design nodes, airworthiness requirements are implemented in specific design, analysis and testing. This is conducive to early detection and correction of non-conforming designs in the design stage (not in the airworthiness certification stage), to avoid serious design problems in the later stage [5,10]. In addition, the requirements of 25.1302 should be incorporated into the ergonomics enterprise standards for flight deck human-machine interface design, which is conducive to long-term guidance of design and consistent design of different aircraft types.
As the system integrator of the flight deck airborne equipment, the civil aircraft manufacturer should fully evaluate the ergonomic design of the equipment's human-machine interface in the supplier selection process and ensure that their design conforms to 25.1302. In this way, the interactive use of various airborne equipment and the conformity with 25.1302 in system integration design are guaranteed and the airworthiness risks are shared and reduced.

Integrating human error management into design
Formulate the design strategy and guiding principles for human error management (error detection, error prevention, error tolerance and recovery) of enterprises, and implement them in the specific requirements of flight deck human-machine interface design and enterprise standards [11]. Airbus has formulated guiding documents for human error management and established a series of design principles from the organizational management and design levels. In addition, the human error management concept should be fully reflected in the specific design. Such as, achieving error prevention and tolerance design through system logic design, redundancy design, system selfexamination and so on. Or helping pilots quickly find errors and recover from them by optimizing human-machine interface design.

Diagnosing and predicting of human errors at early stage at various design nodes
Make full use of effective human error diagnosis and prediction methods and tools, to minimize the potential errors caused by design at each design node in the design stage. Most of the existing human error diagnosis and prediction tools are based on the method of pilot mission analysis, which is consistent with "pilot mission oriented" of 25.1302, so it is helpful to check the implementation of airworthiness requirements at the design stage. Preliminary experimental results showed that the error detection developed based on 25.1302 showed higher predictive sensitivity than other methods [12].

Carrying out airworthiness certification work effectively
Full understanding of the assumptions and exceptions of AMC 25.1302 and selection of consideration in certification work will help determine the requirements and certification scope of the section about different device and function. These preset and exceptional conditions include, training and flight qualification of pilots, illegal or non-illegal errors, whether it is a technical error generated in manual control, airborne equipment used in flight operation or ground maintenance, etc. The factors considered in the certification include the novelty, integration, and complexity of the design of airborne equipment, whether the equipment is related to the pilot's mission, whether the equipment and functions affect the pilots' operation performance, flight safety and human error management, etc. Moreover, the consideration of this impact is not only for a single device and function, but also for the interaction among multiple devices and functions.
Carry out the work of analyzing pilots' operation performance and missions. This work is determined by the characteristics of AMC 25.1302 that the flight mission should be the guidance. It includes the analysis of general operation manual work and cognitive work. This analysis helps to fully understand the equipment and functions, flight mission and operation scenarios, to help determine the certification scope of airborne equipment and function which match the flight mission.
Choose appropriate MOC and certification evaluation methods. According to AC25.1302-1, the characteristics and application scope of various MOC, design characteristics (novelty degree, complexity, and integration) and impact of flight safety should be taken into consideration to select appropriate MOC [5]. Select or develop appropriate certification means and tools to evaluate pilots' performance and human error management. Combined with the existing subjective evaluation methods, the pilots' experience of actual airlines can be more objectively reflected, and certification results with sufficient validity and reliability can also be obtained [13].
Plan and arrange certification work reasonably. Prepare human factors certification plans (HFCP) in accordance with AC 25.1302-1 and the recommended workflow. The applicant and the Bureau should reach a consensus through consultation as soon as possible. For the test flight, the preliminary test of the simulation cabin should be carried out firstly and the scheme should be adjusted appropriately according to the results. Ergonomics professionals should participate in the whole certification process. FAA is currently compiling guidance documents on the responsibility of ergonomics professionals and the client system for airworthiness certification. In view of possibly large amount of certification work in 25. 1302, the workload can be effectively shared through the method of 'credit score of certifications' in the design process. In addition, certification of other relevant human factors in Part 25 can also share part of certification work in 25. 1302.

Carrying out research on human errors
The research should serve the model design and airworthiness. Firstly, study the technology of human error management and its application in flight deck design .Secondly, develop a series of methods and tools, including assist tools of design for human error prediction and analysis that can effectively figure out the hazards of human errors in the design stage, models and tools of accident analysis which can effectively analyze the causes of human errors, evaluation methods and tools for human error collection which can provide sufficient validity and credibility and are easy to use.

Strengthening the training for designers and test pilots
Pilots' human errors caused by the design are "designers' errors". Enhance designers' ergonomics knowledge can help them to apply the knowledge to the design, reducing "designers' errors" to the least during the design phase [26]. Strengthen the ergonomics training of test pilots, and provide the effective evaluation tools for ergonomics, thus obtaining a more objective and effective evaluation results.

Conclusions
Depending on the airworthiness regulations, every means of compliance can be used separately or in combination. Generally, regulations with broad jurisdiction often need to be verified by multiple means of compliance verification. Different verification techniques can be used for different compliance means.
Key issues in human factor airworthiness verification are as followings, determination of the design concept related to human factors, identification of design features related to human factors and process intervention, and novel design features.