The ground station and the C2 link: what the design standards ask for

Know what Standard 922.11 requires of a control station, which operations it applies to, what the designer has to evaluate, and what the command and control link standard adds on the same interface.

• You know the difference between the remote pilot station and the aircraft: one is where the crew is, the other is where the risk is. Std 922.11
• You know the operation is BVLOS, because that is what both standards attach to. Std 922.11
• You know what a lost-link behaviour is, since everything in the second half of this lesson depends on the aircraft doing something predictable when the link goes. Std 922.09

Compliance with the control station standard is required for any RPAS that is to be used for a BVLOS operation — not for one class of aircraft or one kind of approval. Std 922.11

It travels with the detect, alert and avoid standard, which is the other one required across the same operations. When a question asks which pair of standards applies to all BVLOS operations, the answer is those two. Std 922.11 Std 922.10

During BVLOS the remote pilot station is the only means the operator has of getting situational awareness of the operation and of the state of the aircraft. That single sentence is the reason the standard exists. Std 922.11

The risks it addresses are human error: the simple kind, such as a typo when entering data into the system, and the interface-driven kind, where the crew misunderstands what an automated system is doing or is about to do. Depending on the design and the operation, the consequences run from insignificant to catastrophic. Std 922.11

No such standard can eliminate every error mechanism — more complex systems create new opportunities for confusion. What it can do is require designers to follow a process that minimises the number and the consequence of errors. Std 922.11

The designer is required to be mindful of the tasks performed by the operator and the information the operator needs during an operation, and the standard exists to ensure those considerations were taken into account in the design of the user interface. Std 922.11

The intent is that the operator has all the information and controls at the ground station required to accomplish the mission and to deal with any failure or emergency that arises — including the alerting that a crew alerting analysis would traditionally cover. Where the aircraft has environmental limitations, the analysis may show that sensors to detect hazardous conditions are needed, with alerts to the pilot; where regions of the flight envelope are specifically hazardous, the station's design should include alerts that let the pilot avoid them. Std 922.11

At minimum, the evaluations that show compliance should include: Std 922.11

• identification of the intended functions of the system and its components;
• some form of work analysis identifying the crew tasks associated with each intended function;
• evidence that the design follows human factors principles — labelled information and controls, feedback provided in a timely fashion when a control is used; and
• evidence of evaluation with representative users in a sufficiently representative operational environment. Std 922.11

The human machine interface work is expected to split the operation into discrete tasks — perform a pre-flight check, perform a take-off, recover from lost link — with procedure definitions and acceptable performance criteria, broken down far enough that the target user class can follow the steps. The Bedford Pilot Workload Rating Scale is recommended for evaluating workload, and where piloting tasks remain, the Cooper-Harper rating (or an equivalent) is used for handling qualities, with all piloting tasks expected to fall within 1 to 6 on that scale for the system to be considered acceptable. Std 922.11

The command and control link standard sets out how a designer shows compliance with its lost link portion: through a functional hazard analysis, a system safety assessment and component failure evaluation — the ARP-4761 methodology is the example given. Redundancy in key link systems is one route to robustness, and detailed analysis of key components is what allows single points of failure where the component's own reliability can be demonstrated. Std 922.09

Whatever lost-link behaviour is chosen — return to home, land at a designated location, or climbing to regain the link — the designer must document the behaviour and any pre-flight procedures it requires, and that information has to be present in the operating instructions so the operator configures the aircraft correctly before flight. Std 922.09

And the interface comes back: designers are strongly encouraged to design operator interfaces that minimise the possibility of error when programming C2 lost-link behaviour, and where the system allows flexibility, operators should be able to easily and clearly verify that the planned behaviour is the one intended. Where the control station standard applies, the usability assessments are assumed to happen as part of compliance with it. Std 922.09

Question	The answer
Which operations require 922.11?	All BVLOS operations Std 922.11
What is the ground station in BVLOS?	The only means of situational awareness of the operation and the aircraft Std 922.11
What risk does the standard target?	Human error — typos and interface-driven misunderstanding of automation Std 922.11
What must an evaluation show?	Intended functions, work analysis, human factors evidence, representative-user evaluation Std 922.11
How is lost-link compliance shown?	Functional hazard analysis, system safety assessment, component failure evaluation Std 922.09
What must the interface let the operator do?	Verify easily and clearly that the programmed lost-link behaviour is the intended one Std 922.09

• 922.11 applies to BVLOS, and so does 922.10 Std 922.11
• The operator has all information and controls needed for the mission, failures and emergencies Std 922.11
• The evaluation uses representative users in a representative environment Std 922.11
• Piloting tasks are expected to fall within 1 to 6 on the Cooper-Harper scale Std 922.11
• The lost-link behaviour is documented in the operating instructions Std 922.09

Symptom	Likely cause	What to do
A question asks which standards apply to all BVLOS operations	Two do	922.10 and 922.11 Std 922.11
The control station standard is assumed to be aircraft-specific	It is operation-specific	Apply it to any RPAS used BVLOS Std 922.11
The error the standard targets is answered as "equipment failure"	The standard names human error	Answer with the interface and the crew Std 922.11
A lost-link behaviour is chosen but not written down	Documentation is required	Put it in the operating instructions with the pre-flight procedures Std 922.09
The interface is treated as outside the C2 link standard	The standard reaches it	Design the interface to minimise programming error Std 922.09
An evaluation is offered with no users at all	Representative users are required	Evaluate with representative users in a representative environment Std 922.11

Practise: Control station design

Practise: Gcs c2 link means of compliance

• AC 922-001 s.922.09 — Command and Control Link Reliability and Lost Link Behaviour
• AC 922-001 s.922.10 — Detect, Alert and Avoid Systems
• AC 922-001 s.922.11 — Control Station Design