Man-machine interface and anomalies
Lyman / Nats, you appear to be associating the majority of the interface problems with the machine.
To paraphrase Jens Rasmussen: –
“The problem in the design interface is not to match the technology with the user’s mental model, but to create an interface which generates and maintains an effective and safe mental model”.
Note that the requirement is to create an interface, not just design the automation; thus there is need of close relationship between the automation, the human, and the situation.
Attempting to meet just one pilot’s wish list with automation may only satisfy one pilot. This is similar to designing a fix for the most recent accident; you fix ‘the cause’, whereas there could have been many contributing factors, any of which can reoccur in other circumstances – situations, people.
The alternative is to design automation which helps the operator form a mental model (a construct of awareness and interpretation of the real world, together with knowledge and knowhow) and thus may benefit a wide range of pilots in various situations. For the operator this requires knowledge of the automation’s objectives, capabilities, and the limiting situations – a need for training, education, and understanding.
Perhaps these requirements identify a weakness in training, but also in the human attitudes to automation. Many posts stated what the automation ‘must give them’, but an interface has to be two-way, and is of particular value where the pilot extracts information from the machine and applies it.
Modern society has a need for instant gratification, solutions without thought (Google, SOPs); this is not the purpose of automation in aviation, excepting perhaps a few fully automatic operations. The pilot has to think, create a mental model, understand the situation, and decide on the automation’s role in that situation – risk assessment, decision making, action, and checking.
Switch it off.
Re “… the human ability to switch it off …”; this requires discipline, knowledge, and again risk assessment – do you know when to switch it off, and will you. Humans are biased in risk, action, and belief - ‘that they know better’ (macho attitude). Training should help control these behaviors, but occasionally in stressful or surprising situations human performance is insufficient and automation is allowed to continue too far.
Where such a need to switch off is recognized, it is an indication of poor situation awareness. This is not to say that automation has or has not contributed to this, but the human must to maintain control of these aspects as well as controlling their own thinking processes – part of the interface.
“… if we get p----d off with it then …”; then this is the loss of control of your thinking, discipline, CRM.
“The concept of human error: is it useful for the design of safe systems?” Jens Rasmussen.
To paraphrase Jens Rasmussen: –
“The problem in the design interface is not to match the technology with the user’s mental model, but to create an interface which generates and maintains an effective and safe mental model”.
Note that the requirement is to create an interface, not just design the automation; thus there is need of close relationship between the automation, the human, and the situation.
Attempting to meet just one pilot’s wish list with automation may only satisfy one pilot. This is similar to designing a fix for the most recent accident; you fix ‘the cause’, whereas there could have been many contributing factors, any of which can reoccur in other circumstances – situations, people.
The alternative is to design automation which helps the operator form a mental model (a construct of awareness and interpretation of the real world, together with knowledge and knowhow) and thus may benefit a wide range of pilots in various situations. For the operator this requires knowledge of the automation’s objectives, capabilities, and the limiting situations – a need for training, education, and understanding.
Perhaps these requirements identify a weakness in training, but also in the human attitudes to automation. Many posts stated what the automation ‘must give them’, but an interface has to be two-way, and is of particular value where the pilot extracts information from the machine and applies it.
Modern society has a need for instant gratification, solutions without thought (Google, SOPs); this is not the purpose of automation in aviation, excepting perhaps a few fully automatic operations. The pilot has to think, create a mental model, understand the situation, and decide on the automation’s role in that situation – risk assessment, decision making, action, and checking.
Switch it off.
Re “… the human ability to switch it off …”; this requires discipline, knowledge, and again risk assessment – do you know when to switch it off, and will you. Humans are biased in risk, action, and belief - ‘that they know better’ (macho attitude). Training should help control these behaviors, but occasionally in stressful or surprising situations human performance is insufficient and automation is allowed to continue too far.
Where such a need to switch off is recognized, it is an indication of poor situation awareness. This is not to say that automation has or has not contributed to this, but the human must to maintain control of these aspects as well as controlling their own thinking processes – part of the interface.
“… if we get p----d off with it then …”; then this is the loss of control of your thinking, discipline, CRM.
“The concept of human error: is it useful for the design of safe systems?” Jens Rasmussen.
Join Date: Dec 2010
Location: Middle America
Age: 84
Posts: 1,167
Likes: 0
Received 0 Likes
on
0 Posts
Fun & Entertaining
safetypee,
Good post, I was beginning to think along your lines, it is a two way street. One thing that struck me was Nats post in which he said: (The bold is mine)
Well, interestingly, boredom can and often does lead to curiosity as to how the automatics work and do they work correctly? Here is an example of what can happen when fun and curiosity goes too far. BTW, this was a highly experienced crew.
Curious Crew Nearly Crashes DC-10
Have you ever flown a DC-10 at 39,000 feet with 115 passengers on board and been tempted to experiment with autothrottle system - just to see what would happen? In late 1973, a pair of curious National Airlines personnel, a captain and flight engineer did and their actions nearly cost everyone on board their lives.
On November 3, 1973, National Airlines Flight 27 was operating as a scheduled passenger flight between Miami and San Francisco. At about 4:40 p.m., while the aircraft was cruising at 39,000 feet 65 miles southwest of Albuquerque, the No. 3 engine fan assembly disintegrated and its fragments penetrated the fuselage, the Nos. 1 and 2 engine nacelles (which contain those engines), and the right wing area. The resultant damage caused decompression of the aircraft cabin and the loss of certain electrical and hydraulic services.
You want to try it and see?
However, it is clear that the captain and flight engineer's irresponsible actions were to blame. They were experimenting with the autothrottle system, which supplied the instruments that measure the rotational speed of each engine's fan and low pressure compressor. The cockpit voice recording contains the following conversation just prior to the number 3 engine exploding:
Flight Engineer: "Wonder, wonder if you pull the N1 tach will that, -- autothrottle respond to N1?"
Captain: "Gee, I don't know."
Flight Engineer: "You want to try it and see?"
Captain William Brookes, who had been a National Airlines pilot since 1946 and who should have known better responds, "Yeah, let's see here."
Flight Engineer: "You're on speed right now though."
Captain: "Yeah."
Flight Engineer: "You know what I mean if your annunciated speed - if you got, ---"
Captain: "Still got 'em."
Flight Engineer: "Well - - haven't got it -"
Captain: "There it is."
Flight Engineer: "I guess it does."
Captain: "Yeah, I guess it does - right on the nose."
[At the instant he says the word "nose" there is the sound of the number 3 engine exploding followed by ratcheting sounds.]
Captain: "[expletive deleted] what was that?"
By playing with the autothrottle controls - in what amounted to an in-flight failure-analysis test of the autothrottle system - the crew managed to produce a condition where the engines were pushed to higher rotation speeds than they were designed for. According to audio analysis of the CVR tape, all three engines surged (#1 to 105%, #2 to 107% and number 3, which failed, to 110%).
There are many things to consider when considering the human attitudes to automation, "fun" and curiosity/entertaining are but two consideration to keep in mind.
Good post, I was beginning to think along your lines, it is a two way street. One thing that struck me was Nats post in which he said: (The bold is mine)
All of the qualified pilots on here - could just as easily fly a fully automated flight from A to B or indeed, fly it manually, as that is what they were trained to do and that is what they have been doing all of their flying lives, `till FMGS came along - and now they get to play with something on those long flights, its fun, for everything that the pilot has just worked out with a pencil, why, there it is in computor LEDs, it is also entertaining to see how accurate the box of tricks can be, and as mentioned before, if it does not behave, then switch it off and fly the aircraft - just as we are trained to do.
Curious Crew Nearly Crashes DC-10
Have you ever flown a DC-10 at 39,000 feet with 115 passengers on board and been tempted to experiment with autothrottle system - just to see what would happen? In late 1973, a pair of curious National Airlines personnel, a captain and flight engineer did and their actions nearly cost everyone on board their lives.
On November 3, 1973, National Airlines Flight 27 was operating as a scheduled passenger flight between Miami and San Francisco. At about 4:40 p.m., while the aircraft was cruising at 39,000 feet 65 miles southwest of Albuquerque, the No. 3 engine fan assembly disintegrated and its fragments penetrated the fuselage, the Nos. 1 and 2 engine nacelles (which contain those engines), and the right wing area. The resultant damage caused decompression of the aircraft cabin and the loss of certain electrical and hydraulic services.
You want to try it and see?
However, it is clear that the captain and flight engineer's irresponsible actions were to blame. They were experimenting with the autothrottle system, which supplied the instruments that measure the rotational speed of each engine's fan and low pressure compressor. The cockpit voice recording contains the following conversation just prior to the number 3 engine exploding:
Flight Engineer: "Wonder, wonder if you pull the N1 tach will that, -- autothrottle respond to N1?"
Captain: "Gee, I don't know."
Flight Engineer: "You want to try it and see?"
Captain William Brookes, who had been a National Airlines pilot since 1946 and who should have known better responds, "Yeah, let's see here."
Flight Engineer: "You're on speed right now though."
Captain: "Yeah."
Flight Engineer: "You know what I mean if your annunciated speed - if you got, ---"
Captain: "Still got 'em."
Flight Engineer: "Well - - haven't got it -"
Captain: "There it is."
Flight Engineer: "I guess it does."
Captain: "Yeah, I guess it does - right on the nose."
[At the instant he says the word "nose" there is the sound of the number 3 engine exploding followed by ratcheting sounds.]
Captain: "[expletive deleted] what was that?"
By playing with the autothrottle controls - in what amounted to an in-flight failure-analysis test of the autothrottle system - the crew managed to produce a condition where the engines were pushed to higher rotation speeds than they were designed for. According to audio analysis of the CVR tape, all three engines surged (#1 to 105%, #2 to 107% and number 3, which failed, to 110%).
There are many things to consider when considering the human attitudes to automation, "fun" and curiosity/entertaining are but two consideration to keep in mind.
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
Hi safetypee.
Fluid, Additive, Synergistic, and Timely. Call it FAST. Aviation brooks no timeouts. Thinking is time consuming, one reason why auto is superior in rote and program over human abstraction. Assessment is a pedestrian way to address not 'risk' but risk management. Auto or no auto, without a highly developed intuiton, pilots can create, rather than minimize, risk. Here I use the word to stand in for the ideal pilot, experienced, highly trained, and confident.
447 had interface problems. I don't fault the system, nor do I fault the pilots, per se. There may never be a satisfactory conclusion, but the advances have begun.
"First, do no harm." None of the more obvious blunders are outside the realm of human error. Autopilot is not a computer, it is a system of servos, acting on behalf of. Understanding the Flight control logic is incumbent upon the crew, not vice versa. What new issues? I called the interface a "partnership" for a reason. Since the beginning, pilots of renown are the ones at one with the machine.
Lack of AoA indication, Difficulty in seeing the partner's SS, Faulty probes, not being fluent in other than Normal Law; these are not interface issues, but instead, bonehead mistakes in design, programming, cockpit layout, and poor training. When plugging the dike, eleven holes exceeds the available plugs by one, and one open hole is enough, let alone several.
The successful pilot will master the machine, but has degraded chance for success with inexcusable lapses in design, training, consistency, etc.
Fluid, Additive, Synergistic, and Timely. Call it FAST. Aviation brooks no timeouts. Thinking is time consuming, one reason why auto is superior in rote and program over human abstraction. Assessment is a pedestrian way to address not 'risk' but risk management. Auto or no auto, without a highly developed intuiton, pilots can create, rather than minimize, risk. Here I use the word to stand in for the ideal pilot, experienced, highly trained, and confident.
447 had interface problems. I don't fault the system, nor do I fault the pilots, per se. There may never be a satisfactory conclusion, but the advances have begun.
"First, do no harm." None of the more obvious blunders are outside the realm of human error. Autopilot is not a computer, it is a system of servos, acting on behalf of. Understanding the Flight control logic is incumbent upon the crew, not vice versa. What new issues? I called the interface a "partnership" for a reason. Since the beginning, pilots of renown are the ones at one with the machine.
Lack of AoA indication, Difficulty in seeing the partner's SS, Faulty probes, not being fluent in other than Normal Law; these are not interface issues, but instead, bonehead mistakes in design, programming, cockpit layout, and poor training. When plugging the dike, eleven holes exceeds the available plugs by one, and one open hole is enough, let alone several.
The successful pilot will master the machine, but has degraded chance for success with inexcusable lapses in design, training, consistency, etc.
Thread Starter
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 875
Likes: 0
Received 0 Likes
on
0 Posts
Testability
They were simply trying to learn. 
I am "addicted to test". I saved* my life or avoided accidents in several opportunities applying stimuli to check the response of the UUT (unit under test).
Sometimes, to test you could destroy it.
In 1993 to diagnose a hidden failure (very difficult to pinpoint) i capsized a car. Just testing.
No consequences, fortunately. Under controlled conditions (test environment)
Did you know the Pinnacle 3701 stall and the subsequent Darwin award?
I am "addicted to test". I saved* my life or avoided accidents in several opportunities applying stimuli to check the response of the UUT (unit under test).
Sometimes, to test you could destroy it.
In 1993 to diagnose a hidden failure (very difficult to pinpoint) i capsized a car. Just testing.
No consequences, fortunately. Under controlled conditions (test environment)Did you know the Pinnacle 3701 stall and the subsequent Darwin award?
Join Date: Jan 2012
Location: Not far from the edge of the Milky Way Galaxy in the Orion Arm.
Posts: 510
Likes: 0
Received 0 Likes
on
0 Posts
Not wishing to add to an apparently nicely concluded topic, I have to defend one or two misunderstandings (sorry).
Safetypee,
Sorry, if you mis-understand - this does not indicate a loss of control of one`s thinking. the interactive process on modern ECAM procedures, works very well.
The situation of the AF-330 over the Atlantic, was so severe, that is; if you were to go through the ECAM procedures, on that night, (which is what they would have started to do . . ) then you would have ground to a halt in a state of catatonic awe, as nothing was holding any logic at all. I assume safety pee does not regularly fly ECAM and glass cockpit/fly-by-wire?
Once again, then, if, the system is OBVOUSLY behaving non-sensically and absurd - then the pilot would disengage what he considered relevant, in order to "TAKE CONTROL OF THE AIRCRAFT" before the non-operational system does any damage to the flight.
In the case of AF - 330 / Atlantic, had they have done the above “… if we get p----d off with it then …”; and disengaged autopilot, reset thrust and disengaged a/t then - we, that is you and me, and everyone else on this post - would not be having this conversation - nor would there be > 300 passengers in the equation.
In an unforeseeable situation or an anomaly - such as being surrounded by weather on all sides of the worst kind out of radar range, and the system having gone beserk due to incorrect processing of ADIRS inputs - then sometimes that is all there is to do -
Far from being loss of control of one`s (or my) thinking - on the contrary old chap, the mere thought, that, "ooops, lets not die huh?" seems to me to be a totally in control and a healthy one and affording the most apt discipline, as >300 passengers would no doubt agree with me - had they have had the opportunity to do so.
We, or at least, I, do not take action or apply thinking without reason.
This is not some pseudo-important jolly fun topic on an aviation website, just for fun. Some pilots have posted on here to give an honest and in depth opinion - based on life saving flight safety. If you want to judge then find a flower show or some other topic to go and research and leave the professionals to their own profession - you Geek!
Also, Turbine-D, turbine-d, well, probably expected of non-aircrew. My point which you criticised was not to be taken literally. We do not "play" with the system, what I was trying to say was that the automated system holds far less importance than the professionals who fly them. Airlines, during their selection and recruitment process, test for pilots that would have that tendency - maybe they then become engineers.
We are fully aware of the example you have shown us, which is why we do not do it. Also, we have ample opportunity to `practice` with all the avionics kit, in flight school - again and again and again, so we have got any inkling of curiosity out of our system. Sorry, if that was not made apparent.
[U]CONCLUSION then?
It is strikingly obvious that "pilotless" air transport passenger aircraft will be a long time coming, unless, at least, at least, someone is driving it from the ground. Even then it will be a most risky leap into stupidity and disaster, as no system can evaluate with the same depth, range, clarity, foresight and value to human life as that of the cerebral system of the Airline Pilot.
Safetypee,
“… if we get p----d off with it then …”; then this is the loss of control of your thinking, discipline, CRM.
The situation of the AF-330 over the Atlantic, was so severe, that is; if you were to go through the ECAM procedures, on that night, (which is what they would have started to do . . ) then you would have ground to a halt in a state of catatonic awe, as nothing was holding any logic at all. I assume safety pee does not regularly fly ECAM and glass cockpit/fly-by-wire?
Once again, then, if, the system is OBVOUSLY behaving non-sensically and absurd - then the pilot would disengage what he considered relevant, in order to "TAKE CONTROL OF THE AIRCRAFT" before the non-operational system does any damage to the flight.
In the case of AF - 330 / Atlantic, had they have done the above “… if we get p----d off with it then …”; and disengaged autopilot, reset thrust and disengaged a/t then - we, that is you and me, and everyone else on this post - would not be having this conversation - nor would there be > 300 passengers in the equation.
In an unforeseeable situation or an anomaly - such as being surrounded by weather on all sides of the worst kind out of radar range, and the system having gone beserk due to incorrect processing of ADIRS inputs - then sometimes that is all there is to do -
then this is the loss of control of your thinking, discipline, CRM.
We, or at least, I, do not take action or apply thinking without reason.
This is not some pseudo-important jolly fun topic on an aviation website, just for fun. Some pilots have posted on here to give an honest and in depth opinion - based on life saving flight safety. If you want to judge then find a flower show or some other topic to go and research and leave the professionals to their own profession - you Geek!
Also, Turbine-D, turbine-d, well, probably expected of non-aircrew. My point which you criticised was not to be taken literally. We do not "play" with the system, what I was trying to say was that the automated system holds far less importance than the professionals who fly them. Airlines, during their selection and recruitment process, test for pilots that would have that tendency - maybe they then become engineers.
We are fully aware of the example you have shown us, which is why we do not do it. Also, we have ample opportunity to `practice` with all the avionics kit, in flight school - again and again and again, so we have got any inkling of curiosity out of our system. Sorry, if that was not made apparent.
[U]CONCLUSION then?
It is strikingly obvious that "pilotless" air transport passenger aircraft will be a long time coming, unless, at least, at least, someone is driving it from the ground. Even then it will be a most risky leap into stupidity and disaster, as no system can evaluate with the same depth, range, clarity, foresight and value to human life as that of the cerebral system of the Airline Pilot.
Last edited by Natstrackalpha; 19th Apr 2012 at 14:39.
Nats, perhaps not a misunderstanding, but different points of view.
The details of AF447 are elsewhere.
The A330 technology did not fail; it behaved exactly as designed and certificated. If there are issues in these areas – yet to be established, then perhaps the problems are in the design / certification process, or the continued airworthiness process for an ‘in-service’ aircraft. The key to understanding AF447 is in the differences with the previous events and what exactly we (the industry) knew or assumed before the event.
Occasionally the industry encounters situations beyond the limits of certification; these are where the industry depends, either consciously or not, on the human rescuing the situation. We celebrate many notable successes. Unfortunately we suffer failures because some situations are beyond human capability; this hurts our pride, beliefs, and our professional standards.
The skill of a designer/certification engineer is to foresee these extreme situations and interactions. The greatest difficulty is in the assumptions to be made about human performance.
Aircraft certification is probabilistic, which to date has served the industry very well. Modern complex technology is now stretching probabilistic assessment and testing to its limits, but it’s still workable.
For the human however, this method has never been successful - excepting the probability of ‘1’ – Murphy ’s Law. Humans are not rational, we suffer bias and the effects of environment; yet within these constraints most designs can produce a satisfactory interface between technology, the human, and the situation.
Our training in the use of this interface has to consider all aspects; not just practicing pushing the buttons, but exercising the thinking processes, which in part forms and understands the situation, and thus selects action options to maintain control of that situation.
The details of AF447 are elsewhere.
The A330 technology did not fail; it behaved exactly as designed and certificated. If there are issues in these areas – yet to be established, then perhaps the problems are in the design / certification process, or the continued airworthiness process for an ‘in-service’ aircraft. The key to understanding AF447 is in the differences with the previous events and what exactly we (the industry) knew or assumed before the event.
Occasionally the industry encounters situations beyond the limits of certification; these are where the industry depends, either consciously or not, on the human rescuing the situation. We celebrate many notable successes. Unfortunately we suffer failures because some situations are beyond human capability; this hurts our pride, beliefs, and our professional standards.
The skill of a designer/certification engineer is to foresee these extreme situations and interactions. The greatest difficulty is in the assumptions to be made about human performance.
Aircraft certification is probabilistic, which to date has served the industry very well. Modern complex technology is now stretching probabilistic assessment and testing to its limits, but it’s still workable.
For the human however, this method has never been successful - excepting the probability of ‘1’ – Murphy ’s Law. Humans are not rational, we suffer bias and the effects of environment; yet within these constraints most designs can produce a satisfactory interface between technology, the human, and the situation.
Our training in the use of this interface has to consider all aspects; not just practicing pushing the buttons, but exercising the thinking processes, which in part forms and understands the situation, and thus selects action options to maintain control of that situation.
Join Date: Jun 2011
Location: Devonshire
Age: 96
Posts: 297
Likes: 0
Received 0 Likes
on
0 Posts
Safe T.P.
Before we go back to the 1947 C54 trans-Atlantic flight, which was all fully automatic from one runway to another, but not from Terminal to Terminal...
You mentioned Murphy's Law. Now Simulators are available, perhaps early as well as again later on, during a type's life, a few untrained or semi trained Murphys should be used, just to see just how easy it may be to make any ( or many !) mistakes. ( These may be designed-out.)
The Hermes 4 had a Variation Setting Control for who ever was navigating to adjust, to allow for local Magnetic Variation. On a course by the first operator of the type, we were told that they had been instructed ( from above) " we want all our Captains to have the most accurate information... They will fly True Courses..."
The Variation Setting was calibrated in tens of degrees with a " X10 " engraved above, in white letters in a black background. I do not know just how many flights were performed satisfactorily, before one aircraft landed in the desert. ( I am sure that somebody said that " this had never happened before...")
(Some RAF bombers had had a Variation Setting Control necessarily used on their Air Position Indicators. I never saw one fitted to a civil aircraft.)
The French BEA conducted the investigation.
The Variation Setting ability, but not the knob, was removed and the " X10 " had been painted over by the time I flew the type for some years.
Before we go back to the 1947 C54 trans-Atlantic flight, which was all fully automatic from one runway to another, but not from Terminal to Terminal...
You mentioned Murphy's Law. Now Simulators are available, perhaps early as well as again later on, during a type's life, a few untrained or semi trained Murphys should be used, just to see just how easy it may be to make any ( or many !) mistakes. ( These may be designed-out.)
The Hermes 4 had a Variation Setting Control for who ever was navigating to adjust, to allow for local Magnetic Variation. On a course by the first operator of the type, we were told that they had been instructed ( from above) " we want all our Captains to have the most accurate information... They will fly True Courses..."
The Variation Setting was calibrated in tens of degrees with a " X10 " engraved above, in white letters in a black background. I do not know just how many flights were performed satisfactorily, before one aircraft landed in the desert. ( I am sure that somebody said that " this had never happened before...")
(Some RAF bombers had had a Variation Setting Control necessarily used on their Air Position Indicators. I never saw one fitted to a civil aircraft.)
The French BEA conducted the investigation.
The Variation Setting ability, but not the knob, was removed and the " X10 " had been painted over by the time I flew the type for some years.
Linktrained; simulators – interesting.
Unfortunately Murphy (the errant human) does not come prepackaged and labeled. Human performance varies according to the machine and situation.
Simulators are representative ‘machines’ and may have Murphy inducing qualities not found in the original aircraft.
However, simulations can be very valuable in detecting system interface problems, but with increasing technological complexity it may not be possible to evaluate all combinations of situation and human behavior. Hence the ‘stopping rule’ in aviation is based on probability – which the human does not conform to.
Furthermore, the ability to detect aircraft problems in simulation depends on the evaluator’s choice of ‘foreseeable’ scenarios and range of human behaviors; much as the designer has too.
Simulators are of great value, but as with other technological advancements it depends on how they are used (choice of situations), knowing their capabilities and limits, and on the people involved; … like any other interface involving human activity.
In science we might expect the most important wording to be ‘eureka’ (I understand); actually it is “I didn’t expect that”. In aviation’s experiments - incidents and accidents – we hear ‘I didn’t think that s/he would do that’.
Current certification guidance on human behavior – error management – is in CS 25 AMC 25.1302.
Guidance for CRT displays is in AMC 25.11, Alerting Systems in AMC 25.1322, in the same document.
Unfortunately Murphy (the errant human) does not come prepackaged and labeled. Human performance varies according to the machine and situation.
Simulators are representative ‘machines’ and may have Murphy inducing qualities not found in the original aircraft.
However, simulations can be very valuable in detecting system interface problems, but with increasing technological complexity it may not be possible to evaluate all combinations of situation and human behavior. Hence the ‘stopping rule’ in aviation is based on probability – which the human does not conform to.
Furthermore, the ability to detect aircraft problems in simulation depends on the evaluator’s choice of ‘foreseeable’ scenarios and range of human behaviors; much as the designer has too.
Simulators are of great value, but as with other technological advancements it depends on how they are used (choice of situations), knowing their capabilities and limits, and on the people involved; … like any other interface involving human activity.
In science we might expect the most important wording to be ‘eureka’ (I understand); actually it is “I didn’t expect that”. In aviation’s experiments - incidents and accidents – we hear ‘I didn’t think that s/he would do that’.
Current certification guidance on human behavior – error management – is in CS 25 AMC 25.1302.
Guidance for CRT displays is in AMC 25.11, Alerting Systems in AMC 25.1322, in the same document.
Join Date: Jun 2011
Location: Devonshire
Age: 96
Posts: 297
Likes: 0
Received 0 Likes
on
0 Posts
Murphys
Safetypee,
Hi,
Thank you for your detailed reply. It would have needed many Murphys to have spotted the " X 10 " on the Hermes Variation Setting Control, and it did happen at night... Those of us who knew, sympathised with the crew in question and were glad that this one combination of circumstances had been done by somebody else, FIRST.
And this had been modified before we flew the aircraft. It was some time more before we had the flagstaff bracket removed, liable to harm either pilots head, if hit.
It was a mistake ready to happen one day !
(Perhaps it was just as well that "above" had not continued, by insisting on TAS on all instrument panels.)
Hi,
Thank you for your detailed reply. It would have needed many Murphys to have spotted the " X 10 " on the Hermes Variation Setting Control, and it did happen at night... Those of us who knew, sympathised with the crew in question and were glad that this one combination of circumstances had been done by somebody else, FIRST.
And this had been modified before we flew the aircraft. It was some time more before we had the flagstaff bracket removed, liable to harm either pilots head, if hit.
It was a mistake ready to happen one day !
(Perhaps it was just as well that "above" had not continued, by insisting on TAS on all instrument panels.)
Join Date: Mar 2000
Location: canada
Posts: 147
Likes: 0
Received 0 Likes
on
0 Posts
Will we ever know what really happened??
YES. We do know what happened. The airworthy A330 airplane was flown into a CB with supercooled water in it. The SC water froze over the 3 pitot tubes simultaneously, causing a loss of critical systems. The surprised crew (who were also dealing with numerous fault warnings and turbulence) inadvertently mishandled the controls causing a high altitude stall from which they did not recover. Simple. I don't see why so many will not or cannot understand that.
Join Date: Jun 2011
Location: Devonshire
Age: 96
Posts: 297
Likes: 0
Received 0 Likes
on
0 Posts
Thermostat
Hi
You could have added that the PF may have lacked experience of HAVING to Hand-fly at high altitude and high Mach. ( Not normally allowed under RVSM, where Autopilot is mandatory.)
Jacques Roysay covered aspects of Stall Warning in Cruise at High Mach Number and High Altitude in AB's Safety First in Jan 2011.
An afterthought : there must be some combination of times and areas or routes where this strict rule could be relaxed by agreement with ATC. Watching radar traces of some cruising (civil ?) aircraft occasionally zigzagging along an otherwise empty airspace area, where we might have requested a "Direct to..." two or more check points further on, towards our destination. Even then, in the 1960s+, every mile saved was worthwhile in fuel and flight time.
Hi
You could have added that the PF may have lacked experience of HAVING to Hand-fly at high altitude and high Mach. ( Not normally allowed under RVSM, where Autopilot is mandatory.)
Jacques Roysay covered aspects of Stall Warning in Cruise at High Mach Number and High Altitude in AB's Safety First in Jan 2011.
An afterthought : there must be some combination of times and areas or routes where this strict rule could be relaxed by agreement with ATC. Watching radar traces of some cruising (civil ?) aircraft occasionally zigzagging along an otherwise empty airspace area, where we might have requested a "Direct to..." two or more check points further on, towards our destination. Even then, in the 1960s+, every mile saved was worthwhile in fuel and flight time.
Join Date: Jul 2009
Location: DFW
Age: 61
Posts: 221
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by thermostat
Will we ever know what really happened??
YES. We do know what happened. The airworthy A330 airplane was flown into a CB with supercooled water in it. The SC water froze over the 3 pitot tubes simultaneously, causing a loss of critical systems. The surprised crew (who were also dealing with numerous fault warnings and turbulence) inadvertently mishandled the controls causing a high altitude stall from which they did not recover. Simple. I don't see why so many will not or cannot understand that.
*
YES. We do know what happened. The airworthy A330 airplane was flown into a CB with supercooled water in it. The SC water froze over the 3 pitot tubes simultaneously, causing a loss of critical systems. The surprised crew (who were also dealing with numerous fault warnings and turbulence) inadvertently mishandled the controls causing a high altitude stall from which they did not recover. Simple. I don't see why so many will not or cannot understand that.
*
Edit: more commentary.
FAR 25.207 says, in part:"Once initiated, stall warning must continue until the angle of attack is reduced to approximately that at which stall warning began."
According to the BEA AF447 interim rpts, the stall warning did NOT "continue until the angle of attack is reduced to approximately that at which stall warning began." The stall warning ceased when the artificial intelligence stepped in and determined that it wasn't correct because the programmers had assumed that any A/S below 60KIAS was not possible in the air. The pilots were dealing with an inconsistent machine, it was sending mixed signals which added to the confusion.
Just this one fact ( which happens to be in line with the thread topic) makes this far more than just an accident where the flight crew "mishandled the controls".
Regarding the man/machine interface issue, the machine must be consistent and the interface must be accurate and consistent. In the AF447 case, the machine was inconsistent, the interface was inaccurate, and the men were unable to determine reality from illusion and perception. Had the stall Warning continued as required by the FAR (I understand that the A330 wasn't FAR certified, just accepted) the crew might have eventually recognized and accepted its validity.
Last edited by TTex600; 25th Apr 2012 at 05:59.
thermostat. This is not an AF 447 thread. Most of what you state either contradicts the currently accepted facts – location, ice-crystals; or is unsubstantiated speculation.
In terms of man-machine interface there is reasonable understanding of the environment and of the machines reaction to it; what is unknown (unknowable) are the factors and thought processes contributing to the crew’s behavior. The latter point, as discussed previously, is the most difficult aspect of the interface to predict and control.
Linktrained’s point ‘… every mile saved was worthwhile in fuel and flight time …’, is very relevant. Humans are goal driven, and as much as technology improves, the human finds new, unexpected, ways of interpreting the interface (Murphy skills). Thus with modern WXR, crews choose to interpret radar colours literally – green is ‘go’ - 'let's cut the corner'. However, this depends on the situation (machine–situation interface), thus at high level and particularly near Cbs with icing potential, green may be best level of detection for ice and ice crystals, i.e. a weakness of technology.
Training – education and knowledge can restrict some of these weaknesses, but not always.
In terms of man-machine interface there is reasonable understanding of the environment and of the machines reaction to it; what is unknown (unknowable) are the factors and thought processes contributing to the crew’s behavior. The latter point, as discussed previously, is the most difficult aspect of the interface to predict and control.
Linktrained’s point ‘… every mile saved was worthwhile in fuel and flight time …’, is very relevant. Humans are goal driven, and as much as technology improves, the human finds new, unexpected, ways of interpreting the interface (Murphy skills). Thus with modern WXR, crews choose to interpret radar colours literally – green is ‘go’ - 'let's cut the corner'. However, this depends on the situation (machine–situation interface), thus at high level and particularly near Cbs with icing potential, green may be best level of detection for ice and ice crystals, i.e. a weakness of technology.
Training – education and knowledge can restrict some of these weaknesses, but not always.
Join Date: Jun 2011
Location: Devonshire
Age: 96
Posts: 297
Likes: 0
Received 0 Likes
on
0 Posts
Miles saved ?
Safetypee
Hi
We were to do a series of flights between Kano and Jeddah. A course (c) of 072 or 252 degrees usually gave us a single heading flight for many hours (boring for the A/P, which did not complain), joining a sensible base leg at Jeddah or an excessively long Finals at Kano. A following year a different route was prepared which was 117nm. longer. Any NDBs were unreliable. We used the shorter route and Astro as before.
Any fuel saved enroute should be valued at destination price as it reduces the next uplift.
(Subsequent checking with the Air Mileage Handbook showed that the direct route was 3 NM. shorter than G.C.! It had been measured very accurately between the Standard Latitudes of a Lambert's Projection. Nobody had noticed!)
Hi
We were to do a series of flights between Kano and Jeddah. A course (c) of 072 or 252 degrees usually gave us a single heading flight for many hours (boring for the A/P, which did not complain), joining a sensible base leg at Jeddah or an excessively long Finals at Kano. A following year a different route was prepared which was 117nm. longer. Any NDBs were unreliable. We used the shorter route and Astro as before.
Any fuel saved enroute should be valued at destination price as it reduces the next uplift.
(Subsequent checking with the Air Mileage Handbook showed that the direct route was 3 NM. shorter than G.C.! It had been measured very accurately between the Standard Latitudes of a Lambert's Projection. Nobody had noticed!)
Join Date: Jan 2012
Location: Not far from the edge of the Milky Way Galaxy in the Orion Arm.
Posts: 510
Likes: 0
Received 0 Likes
on
0 Posts
Fly-by-wire - Boeing v Airbus
Somebody mentioned this today and I think it is worth a thought. Before I start - I like Airbus, I do not dislike Boeing. Had I have trained on Boeings I would have said the converse. BOTH AIRCRAFT ARE FLY BY WIRE IN THIS POST.============================= ================================= HERE IS AN AIRBUS There is a theory that Airbus, brilliant in design, was designed by engineers with perhaps engineers in mind. It is a `system/machine` with monitoring facilities and certain self correcting abilities (protections). To fly it you move the sidestick to your desired aircraft attitude, like a climbing turn say, and at the point where you release the stick, then the attitude will stay there (yet the sidestick will return to the middle/central/neutral position)(provided it is within normal parameters, there are other limits - I won`t bore you with them now or it turns into a groundschool on Airbus) apart from the Flight Controls page on the System Display page, there is no other indication of the position of the flying control surfaces, outside on the airframe.=================== The throttles, are moved to a detent and, if the autothrust (if engaged) changes a power setting then it will do this but the thrust levers will remain in the detent. So we have (in any changing situation with the aeroplane) A sidestick that is centralised and not moving. A thrust lever that is in it`s detent and also stationary.=========================== =================================== HERE IS A BOEING The theory is that it was designed by pilots (as well as engineers) with pilots in mind. It takes `stick and rudder` principles and puts them into a fly-by-wire aircraft. It may have protections, I don`t know anything about Boeings. =========When the Control column / Yoke is moved then the yoke can be seen to move, if the yoke is left in an position it can be instantly seen to be in that position, if the pilot wants to centralise the controls, then s/he would simply centralise the control column/yoke. Not only this but whatever the pilot on the left is doing is replicated by the control column of the pilot on the right - so control column right = same thing both sides of the flightdeck. The throttles are on the central pedestal, they move to the desired thrust position. They move (I believe) in accordance with any power changes from the autothrust system. As power increases thrust levers move forward, etc, etc. So, at all times the pilots can see at a mere glance what the aircraft is doing - instantly, s/he does not have to look at the FMA, to interpret what is happening, in other words it is obvious what is happening, to the position of the flying control surfaces outside, on the airframe. When the proverbial hits the fan then - that is two major concepts taken care of in an instant - ATT and PWR.
EASA have posted an automation survey to support planning of future policy, see: - EASA Cockpit Automation Survey
The introduction pre-supposes advantages of automation; the questions on problems focus on the man-machine interface.
An earlier view of EASA policy is in EASA Safety Conference: Staying in Control - Loss-of-Control (LoC) Prevention & Recovery
Go To: Presentations (ZIP file), Tuesday 4th October, 2nd session, “EASA Automation Policy_Michel Masson.pdf”
Also the presentation “Crew Resource Management_Jean Pariés.pdf” has relevant information.
17 theme issues are identified (slides 7 & 8); they are all from the operator perspective (I want).
The mitigating activities (by the regulator) involve design specification, particularly CS25.1302, training, and operation, but the significant human issues are on slides 15 & 17.
The CRM presentation also identifies similar issues – Anticipation, understanding, and ability.
The overall view suggests that the solutions are to come from ‘indeterminate’ design guidelines (CS.25.1302) and human factors training to improve the human. There appears little to control the situation in which the human and machine operate, and which often contains dominant influences.
The referenced EASA Safety Bulletin on Flight Deck Automation Policy is available from http://www.ukfsc.co.uk/files/EASA%20...Nov%202010.pdf
And the automation Cockpit Guidelines (OGHFA) from SKYbrary - Automated Cockpit Guidelines (OGHFA BN)
And if little of this is of interest, at least view the picture on slide 22 of the CRM presentation !
The introduction pre-supposes advantages of automation; the questions on problems focus on the man-machine interface.
An earlier view of EASA policy is in EASA Safety Conference: Staying in Control - Loss-of-Control (LoC) Prevention & Recovery
Go To: Presentations (ZIP file), Tuesday 4th October, 2nd session, “EASA Automation Policy_Michel Masson.pdf”
Also the presentation “Crew Resource Management_Jean Pariés.pdf” has relevant information.
17 theme issues are identified (slides 7 & 8); they are all from the operator perspective (I want).
The mitigating activities (by the regulator) involve design specification, particularly CS25.1302, training, and operation, but the significant human issues are on slides 15 & 17.
- Cognitive flying skills.
- Understanding the situation.
- Task vs capability.
- Anticipating situations.
- Surprise, workload, distraction.
- Use of FD vs instrument flying.
- Judging time available.
The CRM presentation also identifies similar issues – Anticipation, understanding, and ability.
The overall view suggests that the solutions are to come from ‘indeterminate’ design guidelines (CS.25.1302) and human factors training to improve the human. There appears little to control the situation in which the human and machine operate, and which often contains dominant influences.
The referenced EASA Safety Bulletin on Flight Deck Automation Policy is available from http://www.ukfsc.co.uk/files/EASA%20...Nov%202010.pdf
And the automation Cockpit Guidelines (OGHFA) from SKYbrary - Automated Cockpit Guidelines (OGHFA BN)
And if little of this is of interest, at least view the picture on slide 22 of the CRM presentation !
Join Date: Jun 2011
Location: Devonshire
Age: 96
Posts: 297
Likes: 0
Received 0 Likes
on
0 Posts
Stalling
In 1915 Frederick Lindemann a 29 year old physicist whose earlier work had included glass and radiation, joined the staff at the Royal Aircraft Factory at Farnborough (where Col. Cody had demonstrated flying some years earlier).
A lot of would-be pilots for the Royal Flying Corps and the Royal Naval Air Service were killed whilst learning to fly, by first stalling and then getting into a "Tail-spin". Lindemann developed his own theories. (He may have visited some injured pilots to hear that " Once in a spin I pulled back as hard as I could on the Joystick - so that I would not hit the ground. But it didn't do any good...")
Lindemann learned to fly in 1916, just to try out his theories. Aged about thirty he would have been ten years older than most people learning to fly.
His ideas WORKED - and have been taught to would-be pilots ever since... Saving countless lives...
( Health and Safety would have been appalled at the risk he took.)
Later as "The Prof" he was to be Churchill's Scientific Advisor and become Lord Cherwell. Perhaps he was not always right.
A lot of would-be pilots for the Royal Flying Corps and the Royal Naval Air Service were killed whilst learning to fly, by first stalling and then getting into a "Tail-spin". Lindemann developed his own theories. (He may have visited some injured pilots to hear that " Once in a spin I pulled back as hard as I could on the Joystick - so that I would not hit the ground. But it didn't do any good...")
Lindemann learned to fly in 1916, just to try out his theories. Aged about thirty he would have been ten years older than most people learning to fly.
His ideas WORKED - and have been taught to would-be pilots ever since... Saving countless lives...
( Health and Safety would have been appalled at the risk he took.)
Later as "The Prof" he was to be Churchill's Scientific Advisor and become Lord Cherwell. Perhaps he was not always right.
Join Date: Jun 2011
Location: Devonshire
Age: 96
Posts: 297
Likes: 0
Received 0 Likes
on
0 Posts
Wings
I had been to Croydon Aerodrome and seen the giant Hannibal HP42 and Argosy Airliners in about 1935. But my wood-workings skills would only allow me to make a Monoplane. A flat piece of wood for the wings, set at a slight angle to the fuselage and a tail plane ought to do the trick... But it crashed. A Grown-up told me that the top of the wing needed to be specially shaped, not flat, to give my aeroplane LIFT... That more lift came from above the wing than from below it. It seemed odd to me... But he WAS a Grow-up... And he had been a pilot in the R.F.C... I humoured him... One day I will find out, I expect !
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
I learned from an old Navy pilot. His brand of heresy never left me. An aircraft in flight is not lifted by the upper surface, it is pushed, from beneath. The upper surface is not relevant to flight, except to say that it provides a place for the underside to rest against.
"Nature abhors a Vacuum". Captain Jim said that was because there is no such thing as a vacuum And Nature does not recognize that which is not.
The nature of flight has to do with creating differences in ambient pressures, not in establishing a "vacuum". Although, strictly speaking, the pressure is not relevant either, just as any inclined plane will lift an object.
","
"Camber produces drag, and with greater drag on the upper surface, the lower surface is in dynamic "tripping over" the upper, and creates an angle of "Up"."
"Nature abhors a Vacuum". Captain Jim said that was because there is no such thing as a vacuum And Nature does not recognize that which is not.
The nature of flight has to do with creating differences in ambient pressures, not in establishing a "vacuum". Although, strictly speaking, the pressure is not relevant either, just as any inclined plane will lift an object.
","
"Camber produces drag, and with greater drag on the upper surface, the lower surface is in dynamic "tripping over" the upper, and creates an angle of "Up"."