49 C.F.R. Appendix E to Part 236—Human-Machine Interface (HMI) Design
Title 49 - Transportation
(a) What is the purpose of this appendix? The purpose of this appendix is to provide HMI design criteria which will minimize negative safety effects by causing designers to consider human factors in the development of HMIs. (b) What is meant by “designer” and “operator”? As used in this section, “designer” means anyone who specifies requirements for—or designs a system or subsystem, or both, for—a product subject to subpart H of this part, and “operator” means any human who is intended to receive information from, provide information to, or perform repairs or maintenance on a signal or train control product subject to subpart H of this part. (c) What kinds of human factors issues must designers consider with regard to the general function of a system?—(1) Reduced situational awareness and over-reliance. HMI design must give an operator active functions to perform, feedback on the results of the operator's actions, and information on the automatic functions of the system as well as its performance. The operator must be “in-the-loop.” Designers shall consider at minimum the following methods of maintaining an active role for human operators: (i) The system must require an operator to initiate action to operate the train and require an operator to remain “in-the-loop” for at least 30 minutes at a time; (ii) The system must provide timely feedback to an operator regarding the system's automated actions, the reasons for such actions, and the effects of the operator's manual actions on the system; (iii) The system must warn operators in advance when they require an operator to take action; and (iv) HMI design must equalize an operator's workload. (2) Expectation of predictability and consistency in product behavior and communications. HMI design must accommodate an operator's expectation of logical and consistent relationships between actions and results. Similar objects must behave consistently when an operator performs the same action upon them. (3) Limited memory and ability to process information. (i) HMI design must minimize an operator's information processing load. To minimize information processing load, the designer shall: (A) Present integrated information that directly supports the variety and types of decisions that an operator makes; (B) Provide information in a format or representation that minimizes the time required to understand and act; and (C) Conduct utility tests of decision aids to establish clear benefits such as processing time saved or improved quality of decisions. (ii) HMI design must minimize the load on an operator's memory. (A) To minimize short-term memory load, the designer shall integrate data or information from multiple sources into a single format or representation (“chunking”) and design so that three or fewer “chunks” of information need to be remembered at any one time. (B) To minimize long-term memory load, the designer shall design to support recognition memory, design memory aids to minimize the amount of information that must be recalled from unaided memory when making critical decisions, and promote active processing of the information. (4) Miscellaneous Human Factors Concerns. System designers shall: (i) Design systems that anticipate possible user errors and include capabilities to catch errors before they propagate through the system; (ii) Conduct cognitive task analyses prior to designing the system to better understand the information processing requirements of operators when making critical decisions; and (iii) Present information that accurately represents or predicts system states. (d) What kinds of HMI design elements must a designer incorporate in the development of on-board train displays and controls?—(1) Location of displays and controls. Designers shall: (i) Locate displays as close as possible to the controls that affect them; (ii) Locate displays and controls based on an operator's position; (iii) Arrange controls to minimize the need for the operator to change position; (iv) Arrange controls according to their expected order of use; (v) Group similar controls together; (vi) Design for high stimulus-response compatibility (geometric and conceptual); (vii) Design safety-critical controls to require more than one positive action to activate (e.g., auto stick shift requires two movements to go into reverse); and (viii) Design controls to allow easy recovery from error. (2) Information management. HMI design must: (i) Display information in a manner which emphasizes its relative importance; (ii) Comply with the ANSI/HFS 100–1988 standard; (iii) Design for display luminance of the foreground or background of at least 35 cd/m2 (the displays should be capable of a minimum contrast 3:1 with 7:1 preferred, and controls should be provided to adjust the brightness level and contrast level); (iv) Design the interface to display only the information necessary to the user; (v) Where text is needed, using short, simple sentences or phrases with wording that an operator will understand; (vi) Use complete words where possible; where abbreviations are necessary, choose a commonly accepted abbreviation or consistent method and select commonly used terms and words that the operator will understand; (vii) Adopt a consistent format for all display screens by placing each design element in a consistent and specified location; (viii) Display critical information in the center of the operator's field of view by placing items that need to be found quickly in the upper left hand corner and items which are not time-critical in the lower right hand corner of the field of view; (ix) Group items that belong together; (x) Design all visual displays to meet human performance criteria under monochrome conditions and add color only if it will help the user in performing a task, and use color coding as a redundant coding technique; (xi) Limit the number of colors over a group of displays to no more than seven; (xii) Design warnings to match the level of risk or danger with the alerting nature of the signal; (xiii) With respect to information entry, avoid full QWERTY keyboards for data entry; and (xiv) Use digital communications for safety-critical messages between the locomotive engineer and the dispatcher. (e) What kinds of HMI design elements must a designer consider with respect to problem management? (1) HMI design must enhance an operator's situation awareness. An operator must have access to: (i) Knowledge of the operator's train location relative to relevant entities; (ii) Knowledge of the type and importance of relevant entities; (iii) Understanding of the evolution of the situation over time; (iv) Knowledge of the roles and responsibilities of relevant entities; and (v) Knowledge of expected actions of relevant entities. (2) HMI design must support response selection and scheduling. (3) HMI design must support contingency planning. [70 FR 11107, Mar. 7, 2005]
Title 49: Transportation
PART 236—RULES, STANDARDS, AND INSTRUCTIONS GOVERNING THE INSTALLATION, INSPECTION, MAINTENANCE, AND REPAIR OF SIGNAL AND TRAIN CONTROL SYSTEMS, DEVICES, AND APPLIANCES
Subpart H—Standards for Processor-Based Signal and Train Control Systems
Appendix E to Part 236—Human-Machine Interface (HMI) Design
