Cocpit design requirements
Join Date: Oct 2003
Location: Chester, UK
Age: 63
Posts: 67
Likes: 0
Received 0 Likes
on
0 Posts
I would suggest that you take a look at some of the automatics that Garmin are certifying on their AFCS at the moment.
Also auto recovery systems for sudden depressurisation are becoming quite popular with more than one avionics company.
Also auto recovery systems for sudden depressurisation are becoming quite popular with more than one avionics company.
Moderator
I think that the flowchart for actions in general, for a heavily automated aircraft (which I'm sure your project would be) would not change a lot in the case of pilot incapacitation. You'll be adding the common sense actions required to get the aircraft to the quickest suitable landing site for mediacal assistance, but not while causing increased risk to the flight.
We fall back to the basic prime directive of safe flight, in its order of importance: Aviate - Navigate - Communicate. Do only as much as you can, assuring that aviating is always being done first. If half your crew resource is lost, a few things may be delayed, while the remaining crew member flies safely. The rest will fall in place. If an accident happens in the mean time, it was going to happen anyway. It will be less severe than if control of the aircraft was lost. Once you squawk 7700, you probably just took care of navigate and communicate all in one.
So, stepping aside from the "checklists" for a moment, I'd be concentrating on the aircraft design, if there is an option to embody provisions to minimize the impact of such an event.
If the tiltrotor is in any phase of flight where thrust is being directed anywhere other than directly horizontal, an accidental control input of any consequence is probably unrecoverable, but design the provision in to minimize the impact if you can.
If the aircraft is fly by wire, the design opportunity exists to allow one pilot to take control away from the other. Obviously, for the sake of crew harmony, this would be used only for emergency, but it's worth having. Two ways of accomplishing this: Big red "I've got it" button (but that requires an additional action), or more subtly, defining a "normal" control motion range, and an "emergency" motion range. Whoever moves their control into the emergency range last, has total control of the aircraft. So, if pilot A falls over the stick, and pushes it full travel, pilot B's instinctive reaction wil be to apply a whole lot of input to his stick to correct the situation. Pilot A's stick never got emergency authority, as it got in the range first. A's stick maintians control until B's stick goes into emergency range, then the computer realizes that A's input was for the wrong reasons, and B's is trying to return to controlled flight. This could be linked to the computer's knowledge of the aircraft attitude. B has total control until things change favourably.
The other thing my wish list would have built in, would be an "other" pilot controlled motor on the inertial reel of the shoulder harness, so it could be used at a suitable speed to winch an incapacitated pilot upright in the seat, harmlessly away from all the cockpit knobs. Car seatbelt "pre-tensioners" do this in harmony with airbags to some degree, but for different reasons.
Other than that, if the incapacitated pilot is not interfering with the safe operation of the aircraft, the flying pilot should be expected to continue to fly the aircraft safely (or he really should not be there). If the systems are so complex that he is having trouble coping with the workload, just give him more time. As I said, 7700 goes a long way in this regard, and if someone on board is incapaticitated, it just became a "medivac" flight, which has the highest priority in flight.
Back in the 80's I was a very inexperienced right seat pilot in a Piper Cheyenne, when the pilot suddenly took ill. Although he maintained conciousness, and was not in dire circumstances, he withdrew from flying for the remainder of the flight. I took my time, used the normal checklists, and there was no problem. Yes, if something had quit, the tension would have ramped up quickly, but we do what we can. This is not a safely threatening event, if pilots are well trained.
We fall back to the basic prime directive of safe flight, in its order of importance: Aviate - Navigate - Communicate. Do only as much as you can, assuring that aviating is always being done first. If half your crew resource is lost, a few things may be delayed, while the remaining crew member flies safely. The rest will fall in place. If an accident happens in the mean time, it was going to happen anyway. It will be less severe than if control of the aircraft was lost. Once you squawk 7700, you probably just took care of navigate and communicate all in one.
So, stepping aside from the "checklists" for a moment, I'd be concentrating on the aircraft design, if there is an option to embody provisions to minimize the impact of such an event.
If the tiltrotor is in any phase of flight where thrust is being directed anywhere other than directly horizontal, an accidental control input of any consequence is probably unrecoverable, but design the provision in to minimize the impact if you can.
If the aircraft is fly by wire, the design opportunity exists to allow one pilot to take control away from the other. Obviously, for the sake of crew harmony, this would be used only for emergency, but it's worth having. Two ways of accomplishing this: Big red "I've got it" button (but that requires an additional action), or more subtly, defining a "normal" control motion range, and an "emergency" motion range. Whoever moves their control into the emergency range last, has total control of the aircraft. So, if pilot A falls over the stick, and pushes it full travel, pilot B's instinctive reaction wil be to apply a whole lot of input to his stick to correct the situation. Pilot A's stick never got emergency authority, as it got in the range first. A's stick maintians control until B's stick goes into emergency range, then the computer realizes that A's input was for the wrong reasons, and B's is trying to return to controlled flight. This could be linked to the computer's knowledge of the aircraft attitude. B has total control until things change favourably.
The other thing my wish list would have built in, would be an "other" pilot controlled motor on the inertial reel of the shoulder harness, so it could be used at a suitable speed to winch an incapacitated pilot upright in the seat, harmlessly away from all the cockpit knobs. Car seatbelt "pre-tensioners" do this in harmony with airbags to some degree, but for different reasons.
Other than that, if the incapacitated pilot is not interfering with the safe operation of the aircraft, the flying pilot should be expected to continue to fly the aircraft safely (or he really should not be there). If the systems are so complex that he is having trouble coping with the workload, just give him more time. As I said, 7700 goes a long way in this regard, and if someone on board is incapaticitated, it just became a "medivac" flight, which has the highest priority in flight.
Back in the 80's I was a very inexperienced right seat pilot in a Piper Cheyenne, when the pilot suddenly took ill. Although he maintained conciousness, and was not in dire circumstances, he withdrew from flying for the remainder of the flight. I took my time, used the normal checklists, and there was no problem. Yes, if something had quit, the tension would have ramped up quickly, but we do what we can. This is not a safely threatening event, if pilots are well trained.
Thread Starter
Join Date: Mar 2004
Location: Oxfordshire
Age: 54
Posts: 470
Likes: 0
Received 0 Likes
on
0 Posts
It is a tiltrotor yes, but part of the requirements are for a conventional take off and landing.
Our outline plan for actions after the pilot has turned a funny colour is to have the thing broadcast a distress message, plot a course to the closest suitable airfield and head there asap.
The problems are overcoming the communication issue. It's easy enough to transmit a pre-recorded message, but we're not sure speech recognition is sufficiently mature to interpret instructions from air traffic about clearance, runway etc.
We don't want to rely on a ground controller to fly it like a UAV, as this would be costly to support for any purchaser. Plus the opportunity for terrorist takeover of course...
Our outline plan for actions after the pilot has turned a funny colour is to have the thing broadcast a distress message, plot a course to the closest suitable airfield and head there asap.
The problems are overcoming the communication issue. It's easy enough to transmit a pre-recorded message, but we're not sure speech recognition is sufficiently mature to interpret instructions from air traffic about clearance, runway etc.
We don't want to rely on a ground controller to fly it like a UAV, as this would be costly to support for any purchaser. Plus the opportunity for terrorist takeover of course...
Moderator
Is this a single pilot, or two pilot aircraft? I'm presuming that for the cost, and intended role of a tiltrotor aircraft, there would be two pilots. Assuming one pilot is left to fly, I don't see the need to design in that level of automation. (though I accept that this is just an exercise).
If this is a single pilot, turned UAV exercise, it's beyond my "pilot" mind....
If this is a single pilot, turned UAV exercise, it's beyond my "pilot" mind....
Thread Starter
Join Date: Mar 2004
Location: Oxfordshire
Age: 54
Posts: 470
Likes: 0
Received 0 Likes
on
0 Posts
It's being designed for single pilot ops. In some roles - military and SAR - two would be required, but otherwise it is intended to fly with only one - hence the clever avionics to cope when the only pilot can't fly.
It will already be fully autonomous from taxi off to taxi in, but it's a whole other ball game when trying to get certification for it to fly itself without a ground controller.
It will already be fully autonomous from taxi off to taxi in, but it's a whole other ball game when trying to get certification for it to fly itself without a ground controller.
Join Date: Aug 2007
Location: ENGLAND
Posts: 24
Likes: 0
Received 0 Likes
on
0 Posts
Why rule out remote "wifi" control of the ac? Understand the unauthorised access bit and wireless comms is not my expertise, but what about limiting the range of the transmission of the signals FROM the aircraft?
A ground station could reach the aircraft at long range, but if that remote station has to transmit back a randomly generated access code transmitted from the aircraft AND the range of the aircraft transmitter is only 50ft, then the station has to be near by - in other words another aircraft in close formation even if only to get initial remote control?????
Remember not a comms expert just a random browser!
A ground station could reach the aircraft at long range, but if that remote station has to transmit back a randomly generated access code transmitted from the aircraft AND the range of the aircraft transmitter is only 50ft, then the station has to be near by - in other words another aircraft in close formation even if only to get initial remote control?????
Remember not a comms expert just a random browser!
Thread Starter
Join Date: Mar 2004
Location: Oxfordshire
Age: 54
Posts: 470
Likes: 0
Received 0 Likes
on
0 Posts
We ruled out remote control as it would require a global network of operators standing by whenever the aircraft was flying with a single pilot.
Plus the aircraft already has autonomous everything, so it seemed sensible to use the equipment already fitted (and probably controlling the aircraft 90% of the time anyway).
Thanks for your interest though!
Pilot DAR: Really like your idea about the control column.
Genghis: The pilot over-ride is a slightly tricky one. We initially thought of a PIN number, but the lecturer reckons in the heat of a systems malfunction, the last thing the pilot needed was to try and bring to mind a PIN number! Far better to have a couple of manual over-ride switches or buttons, which would require simultaneous operation (perhaps).
Plus the aircraft already has autonomous everything, so it seemed sensible to use the equipment already fitted (and probably controlling the aircraft 90% of the time anyway).
Thanks for your interest though!
Pilot DAR: Really like your idea about the control column.
Genghis: The pilot over-ride is a slightly tricky one. We initially thought of a PIN number, but the lecturer reckons in the heat of a systems malfunction, the last thing the pilot needed was to try and bring to mind a PIN number! Far better to have a couple of manual over-ride switches or buttons, which would require simultaneous operation (perhaps).
Genghis: The pilot over-ride is a slightly tricky one. We initially thought of a PIN number, but the lecturer reckons in the heat of a systems malfunction, the last thing the pilot needed was to try and bring to mind a PIN number! Far better to have a couple of manual over-ride switches or buttons, which would require simultaneous operation (perhaps).
G
Thread Starter
Join Date: Mar 2004
Location: Oxfordshire
Age: 54
Posts: 470
Likes: 0
Received 0 Likes
on
0 Posts
Sure. Our concern with something that simple is the possibility of a passenger trying to over-ride it...
We have a guy working on the IVHM system who will devise the method for determining pilot incapacitation.
Having seen some of the guys near the end of a ten hour red eye, I wish him luck on working out who's alive and who's not!
We have a guy working on the IVHM system who will devise the method for determining pilot incapacitation.
Having seen some of the guys near the end of a ten hour red eye, I wish him luck on working out who's alive and who's not!
Sure. Our concern with something that simple is the possibility of a passenger trying to over-ride it...
PASSENGER NOTICE: If pilot is incapacitated, aircraft will land on its own. Do not touch controls.
There's a great temptation to make things overcomplicated - all that does is create extra opportunities for things to go wrong.
G
Join Date: May 2010
Location: Boston
Age: 73
Posts: 443
Likes: 0
Received 0 Likes
on
0 Posts
Alert or incapacitaded = drunk detector
glum writes:
This is similar to detecting drunk drivers and preventing them from starting the car. (Breathalyzers don't work 100% - think pre-bar balloon of breath)
A hypoxic pilot could in theory respond to a very simple challenge:
I .. must .... push ..... button .......... silence ............... damm "pilot gone" alarm.
There is a lot of research on the problem, one of the simpler method is one I implemented in college (way back when) for a project car:
Computer displays a random 4 digit number for 1 second, example 4125 then blanks display, wait 1 second then prompts driver.
Driver has 2 seconds to key in the number in reverse : 5214.
Very easy to do when sober - not so when over the limit.
Unless in on the secret highly unlikely a passenger would gues what to do.
(The testing was the best part of project... times are from memory and may be off a bit)
Sure. Our concern with something that simple is the possibility of a passenger trying to over-ride it...
We have a guy working on the IVHM system who will devise the method for determining pilot incapacitation.
Having seen some of the guys near the end of a ten hour red eye, I wish him luck on working out who's alive and who's not!
We have a guy working on the IVHM system who will devise the method for determining pilot incapacitation.
Having seen some of the guys near the end of a ten hour red eye, I wish him luck on working out who's alive and who's not!
A hypoxic pilot could in theory respond to a very simple challenge:
I .. must .... push ..... button .......... silence ............... damm "pilot gone" alarm.
There is a lot of research on the problem, one of the simpler method is one I implemented in college (way back when) for a project car:
Computer displays a random 4 digit number for 1 second, example 4125 then blanks display, wait 1 second then prompts driver.
Driver has 2 seconds to key in the number in reverse : 5214.
Very easy to do when sober - not so when over the limit.
Unless in on the secret highly unlikely a passenger would gues what to do.
(The testing was the best part of project... times are from memory and may be off a bit)
Thread Starter
Join Date: Mar 2004
Location: Oxfordshire
Age: 54
Posts: 470
Likes: 0
Received 0 Likes
on
0 Posts
Hmmm, interesting concept. Not sure a stressed pilot who's perhaps dealing with an engine failure would have the spare capacity to start reading and reciting numbers back though!
We have to assume a worst case scenario really, so something simple but not obvious to someone who didn't know the correct buttons / sequence.
We have to assume a worst case scenario really, so something simple but not obvious to someone who didn't know the correct buttons / sequence.
Join Date: May 2010
Location: Boston
Age: 73
Posts: 443
Likes: 0
Received 0 Likes
on
0 Posts
Glum writes:
Totally agree, most of the time the system could rely on a much simpler method of sounding an alert when no activity for a time (dependant of phase of flight, longer in cruise etc) that would be automatically cancelled by any reasonable action by pilot such control input, mode change on fligth director, cancelling an alarm etc.
This would also cover most of the busy with emergency cases, although most of those would probably generate sufficient activity to prevent the alarm in the first place.
It would also be a good idea to put in logic/HW so the programm could self check that it was indeed receiving control inputs to prevent making things worse in the case of multiple system failures.
I was thinking more of the case where there might be a few random non-logical inputs (given flight phase) by the pilot where the system would need to determine if the pilot was hanging by the straps and bumping a control or simply distracted by wrestling with a new flight roster program on a laptop.
Search for Minneapolis (SP?) overflight if you dont catch that last reference.
Hmmm, interesting concept. Not sure a stressed pilot who's perhaps dealing with an engine failure would have the spare capacity to start reading and reciting numbers back though!
This would also cover most of the busy with emergency cases, although most of those would probably generate sufficient activity to prevent the alarm in the first place.
It would also be a good idea to put in logic/HW so the programm could self check that it was indeed receiving control inputs to prevent making things worse in the case of multiple system failures.
I was thinking more of the case where there might be a few random non-logical inputs (given flight phase) by the pilot where the system would need to determine if the pilot was hanging by the straps and bumping a control or simply distracted by wrestling with a new flight roster program on a laptop.
Search for Minneapolis (SP?) overflight if you dont catch that last reference.
Thread Starter
Join Date: Mar 2004
Location: Oxfordshire
Age: 54
Posts: 470
Likes: 0
Received 0 Likes
on
0 Posts
Thanks for the inputs and reading suggestions.
We've gone for a simple two switch setup:
One Two-position gated switch, for Dual / single pilot ops, which will effectively switch the monitoring & takeover system off when two pilots are operating.
One guarded momentary switch, for use by the pilot if the system attempts to take over when he's fine. It'll be a simple system 'reset' he can use in case of system glitch. If the fault persists, then he has the option to switch the system off permanently as per dual pilot ops.
We've gone for a simple two switch setup:
One Two-position gated switch, for Dual / single pilot ops, which will effectively switch the monitoring & takeover system off when two pilots are operating.
One guarded momentary switch, for use by the pilot if the system attempts to take over when he's fine. It'll be a simple system 'reset' he can use in case of system glitch. If the fault persists, then he has the option to switch the system off permanently as per dual pilot ops.
Thread Starter
Join Date: Mar 2004
Location: Oxfordshire
Age: 54
Posts: 470
Likes: 0
Received 0 Likes
on
0 Posts
All opinions are valid!
The idea behind this layout is actually to make things more basic. 3 screens, two touch-screen controllers and an autopilot contoller.
I feel that the modern flight deck (A380 for example) is just a maze of buttons and screens, with huge potential for switch-pigs. Do pilots really want all those options? Do they need them?
Why show you stuff you don't need to know, and why not show stuff you really do?
I'm trying to work towards taking things back to VFR where possible - afterall, that's the most basic flying isn't it?
If we the avionic designers can give you the pilots enough SA that even flying in crappy weather at night is as easy as doing it on a sunny day, then I think we've achieved our goal.
If you still want to make flying hard, then buy a Pitts Special and have some fun!
The idea behind this layout is actually to make things more basic. 3 screens, two touch-screen controllers and an autopilot contoller.
I feel that the modern flight deck (A380 for example) is just a maze of buttons and screens, with huge potential for switch-pigs. Do pilots really want all those options? Do they need them?
Why show you stuff you don't need to know, and why not show stuff you really do?
I'm trying to work towards taking things back to VFR where possible - afterall, that's the most basic flying isn't it?
If we the avionic designers can give you the pilots enough SA that even flying in crappy weather at night is as easy as doing it on a sunny day, then I think we've achieved our goal.
If you still want to make flying hard, then buy a Pitts Special and have some fun!
Thread Starter
Join Date: Mar 2004
Location: Oxfordshire
Age: 54
Posts: 470
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by jambone
in this day and age it would be seen as 'criminal' and unsafe to not have computers doing most of the work for you
If our record was that bad, no-one would ever fly. Fact is that computers have made flying safer, and a fare paying passenger wants to reach their destination - it's just transport to them, not a fun part of the holiday.
We can still do better though, 2 confirmed CFIT events last year, and a possible further 7 pending investigation conclusions. This is where I fear the designers have got it wrong...
Thanks for the encouragement!
Join Date: Apr 2002
Location: Nirvana South
Posts: 734
Likes: 0
Received 0 Likes
on
0 Posts
"If we the avionic designers can give you the pilots enough SA that even flying in crappy weather at night is as easy as doing it on a sunny day, then I think we've achieved our goal."
Glum,
If that is your goal, then I would reconsider your lack of a HUD especially if single pilot. The increased SA from an EVS has, literally, to be seen to be believed. It also gives you an additional dispatch possibility with the main display failed - without a co-pilot I would question the usefulness of the No. 2 screen.
Glum,
If that is your goal, then I would reconsider your lack of a HUD especially if single pilot. The increased SA from an EVS has, literally, to be seen to be believed. It also gives you an additional dispatch possibility with the main display failed - without a co-pilot I would question the usefulness of the No. 2 screen.