DESIGNING
COCKPITS TO
AVOID PILOT
TRAPS
David
EVANS
posted online by
http://alexpaterson.net/aviation/asw_pilottraps.htm
Last Updated: 31 May 2000
MASTER INDEX of articles written, posted online, or
recommended by Alex Paterson
INTRODUCTION
Most aircraft disasters are the result of inappropriate action or actions carried out by the pilots involved; a process euphemistically known as "pilot error". Whilst the term 'pilot error' is often seized upon by airline management, aircraft manufacturers and government aviation safety authorities to shift the blame for the disaster entirely onto the relevant aircrew (who are often dead), it is invariably a gross over simplification of a far more complex situation. 1
Aircraft disasters are usually the result of a chain of events culminating in the disaster itself. Many of the factors involved are insignificant in their own right, but when combined with other nominally insignificant factors they can result in a situation whereby the pilots involved become confused as to what is happening (a loss of situational awareness) and they begin to carry out inappropriate actions for the situation.
Poor cockpit design is often a significant causal factor as to why aircrew become confused and begin to mishandle the situation they find themselves in.
The following article by David Evans, Editor in Chief of Aviation Safety Week (ASW) discusses this issue.
Additional information not covered by David Evans' article can be found at:
- GOOD AIRCRAFT DESIGN by Alex Paterson
Alex Paterson (May 2000)
DESIGNING COCKPITS TO AVOID 'PILOT TRAPS'
By David Evans,
Aviation Safety
Week,
28 February 2000
Defense Daily, 4 April 2000
Avionics Magazine 4 April 2000
Original URLs:
- Aviation Safety Week (TBA)
- Defense Daily: http://www.defensedaily.com/reports/avionics/previous/0400/04safety.htm
- Avionics Magazine: http://www.aviationtoday.com/reports/avionics/previous/0400/04safety.htm
Any discussion of modern cockpit design is difficult to cover in just one swallow. However, the recent problem experienced by the crew of the Korean Air Lines (KAL) B747 that crashed Dec. 22, 1999 shortly after takeoff from Stansted Airport shows how rapidly a crew can lose control of an aircraft. The time elapsed from takeoff to loss of control was less than 40 seconds. In that particular case, a faulty Attitude Director Indicator (ADI), or the inertial navigation unit (INU) feeding it data, may be suspect. The captain of the previous crew, who flew the accident airplane from Tashkent to Stansted, noticed his faulty ADI, observed that the first officer's ADI agreed with the backup display, and transferred control to the first officer.
Two different crews; two completely different outcomes. The crash near Stansted clearly raises questions of crew training in the use of backup instruments. The UK's Air Accidents Investigation Branch (AAIB) is on the case (see ASW, Vol. 14, No 3). But perhaps another issue is relevant &endash; the design of the cockpit. Shortly after the Stansted crash we received a number of communications from pilots who opined that the back up attitude indicator (AI) should be located right next to the ADI so that a faulty reading is immediately apparent.
Given the ardent nature of the comments, we asked Alex Paterson to respond to this question: For all the thousands of hours devoted to cockpit design, do good designs result?
Paterson is a retired Australian airline pilot with some 7,000 mostly shorthaul hours of experience flying many different types of aircraft, from the relatively simple DC9 to the 'glass cockpit' B767. His extended response, paraphrased greatly here, reflects the insight borne of accumulated experience punctuated by the occasional hard lesson.
A modern cockpit should be more like an observation tower than a minefield. That is, it should be designed in such a way that pilots have a clear view of aircraft performance and system status, and it should not contain what might be called 'pilot traps.'
Traps are hereby defined as design features or aspects that tend to confuse pilots about an unfolding event, and which can distract them or sucker them into making inappropriate decisions. Traps can be subtle. For example, including speed deviation and localizer/glideslope information on the Attitude Director Indicator (ADI) may be encouraging pilots to focus their attention unduly on the ADI. Here is the root of an insidious pilot trap, as sound instrument flying technique involves the disciplined scanning of all flight instruments, not just focusing on one seemingly comprehensive display.
First, the philosophy of cockpit design: The systems (flight controls, avionics, etc.) need to be designed in such a way that they are as simple as possible commensurate with the task. The design must reflect both good ergonomics and a conscious effort to minimize 'pilot traps.' Ideally, pilots should receive feedback about aircraft behavior through at least two senses, if only for confidence-inspiring redundancy. Sight and sound are the primary senses, but tactile inputs (i.e., movement, feel and response) complement visual feedback.
At the same time, humans are poor at monitoring tasks, because monitoring (e.g., watching paint dry) is so monotonous that the mind tends to drift to more interesting topics. In contrast, a machine can be designed to stolidly monitor a parameter for its entire life (e.g., an alarm clock). Therefore, Paterson argues, cockpits should be designed to facilitate what machines and humans each do best:
- Let the machines (computers)
monitor aircraft systems and provide audio and visual alerts when
specified values are approached or exceeded. The increasing use of
computer-generated 'voices' to advise aircrews about problems is a
positive trend.
- Humans should make most of the
operating decisions, with computers monitoring their performance
and sounding alerts or alarms (as is the case with ground
proximity warning systems).
- Automation should not be taken
to the point where pilots lose basic airmanship skills and are
lulled into a false sense of security about the infallibility of
the 'machine.' Unfortunately, Paterson fears the crossover point
may already have been passed. "We can expect a spate of avoidable
airline disasters over the next 20 years associated with the
phenomenon of pilot disassociation," he predicts.
- Finally, Paterson believes that pilots' eyes and their mental concentration should be in one of two places during critical phases of flight such as takeoff and landing: on the flight instruments and/or out the windscreen. Systems and procedures that require pilots to take their eyes away from either of these two places are potential death traps. For example, in the moments before the KAL crash at Stansted, the first officer reportedly was switching radio frequencies and trying to establish communications with the new agency. It would have been infinitely preferable for the first officer to simply flick a switch to a departure frequency preselected on the ground prior to takeoff.
Some items requiring the pilot not flying (PNF) to momentarily take his eyes off the instruments are probably unavoidable. Retracting flaps and landing gear, for instance. However, the introduction of a host of distracting new items should be avoided. The requirement to continually reset the speed bug with each flap configuration in modern 'glass cockpit' aircraft is a case in point.
With these thoughts in mind, Paterson offers the following as basic elements of good cockpit design:
Engine fire warning and drill
An engine failure/fire is potentially the most acute emergency facing pilots, especially if it occurs during takeoff right at the moment of liftoff. Immediate action is critical. For this reason, engine fire handles should be located on the forward instrument panel, just above the engine instruments, within the peripheral vision of both pilots. The drill itself should be very simple: pull the fire handle and twist it to activate the fire extinguisher. Locating fire handles either in the overhead panel or on the center pedestal requires both pilots to take their eyes off their flight instruments and turn their heads, with the attendant risk of disorientation.
Standby horizon
The ADI is the central pivot, as it were, and all adjustments to flight attitude are made using this 'control' instrument. Everything else is a performance instrument (Power + Attitude = Performance). For this vital reason, aircraft are equipped with a backup attitude indicator (AI) which, in case of generator failure, is connected to battery power.
Because of its 'pivotal' importance, the standby AI should be located within the normal instrument scan of the captain so that a failure of the primary ADI will be noticed immediately. Such is the arrangement on the B767. The standby AI is located within the captain's normal instrument scan. This is not the case on most other aircraft. For example, on the MD11 the backup AI is located at the bottom right center of the instrument panel.
The twinning of the primary ADI and its backup should be a "sine qua non" of good cockpit design. Pilots suddenly forced to adjust their accustomed selective radial scan and totally fly off of a remote 'peanut gyro' already are halfway to an unrecoverable unusual attitude. If the airplane is on fire and smoke is rapidly filling the cockpit, the need for pairing of primary and backup ADI is all the more apparent. An anxious pilot, with restricted peripheral vision, should not have to try to peer through smoke goggles at the backup horizon located on the lower edge of the center instrument panel. For another thing, a failed ADI is always going to remain centrally in the pilot's natural instrument scan as a potential 'fatal distraction.'
Autothrottle
The throttle levers should physically move in response to power changes initiated by the autothrottle system. This feature provides tactile feedback to the pilot flying and better visual reinforcement to both pilots when their hands are not on the throttles. Paterson argues that pilots are more likely to notice a throttle lever moving than changes to numbers spinning up and down on a digitized engine instrument. The Airbus design features non-moving throttle levers. Airbus engineers declare that the non-moving lever is only intended to indicate the throttle setting commanded by the pilot. Paterson does not find this argument at all persuasive. He maintains that for want of electric motors to move the throttle levers an aircraft could be lost. Whatever the airplane is doing should be totally apparent to its master.
Airspeed bug
On approach and takeoff, the airspeed bug should automatically set itself to the new minimum airspeed whenever the flap configuration is changed. A 'bug,' just for the record, is a colored pointer which pilots set around the dial of their airspeed gauge as a reminder of important speeds &endash; such as initial takeoff climb out speed (V2) or minimum approach speed for landing (Vref). Presently, any bug change requires at least one pilot to dial up the new airspeed. The DC9 had such an automatic system, albeit analog, associated with the autothrottle. The approach speed 'bug' on the airspeed indicator, for example, received its signals from the angle of attack vane and was set automatically with each change of flap configuration. It was an elegantly simple system, Paterson maintains.
A modern digital equivalent could be designed to set the bug at the minimum Vref (maneuvering speed) for a particular flap configuration, with a knob allowing pilots to quickly dial in a "speed additive" above the minimum Vref speed (schedule).
Stabilizer trim
As with a moving autothrottle, a spinning stabilizer trim wheel provides pilots with an unmistakable alert as to a runaway stabilizer (especially on the B727/B737, which can spin pretty rapidly). A wheel also has the advantage of allowing pilots to physically grab hold of it in the event of a runaway trim situation. This arrangement at least gives them a few seconds to collect their thoughts and to remember just where the stabilizer trim cutout switch is located. Pilots often forget the location of seldom-used items in the initial confusion of an unexpected emergency. Finally, having secured the runaway trim, the aircraft can then be re-trimmed manually.
Paterson believes that the lack of a manual trim wheel on some modern jets is a serious design flaw. These jets include the DC9 and stretched descendants like the Alaska Airlines MD83 that crashed recently, and in which a runaway stabilizer trim situation is involved. The airplanes without trim wheels feature an aural alert, which emits a "barp" sound with each half-degree of stabilizer trim movement. Paterson believes a poorly trained pilot could misinterpret the sound, whereas a moving trim wheel moving against one's knee is obvious to just about anyone.
Checklists
Normal flight operations checklists are best served by a mechanical "shopping list" device located on top of the glareshield (i.e., above the autoflight mode control panel). The advantages are numerous:
- A mechanical checklist is easier to use. Pull it out, then up. No clicking one's way through an electronic menu.
- If necessary, items can be easily checked off out of sequence, which is normally not possible with an electronic checklist.
- The checklist is in a position where it can be seen easily while the pilot is looking out the windscreen (where the pilots' eyes should be aimed most of the time, anyway), and where it remains just within the peripheral vision of either pilot when flying on instruments. This feature is important when taxiing in congested terminal areas as well as when shooting an instrument approach.
- It is virtually impossible to take off or land without completing the checklist, as the uncompleted checklist remains within the pilots' line of vision until it is stowed out of sight when the last item has been checked off.
By contrast, electronic checklists generally are located at the bottom of the center instrument panel, requiring pilots to look down and into the cockpit at crucial times, such as during the approach to land. Indeed, the lower center-panel location can be dangerous even when the airplane is taxiing &endash; as evidenced by the case of a jet that collided with a truck in the terminal area partly due to the fact that the pilots were performing the checklist at night whilst taxiing to the gate.
Angle of attack instrument
All fixed-wing flying is closely related to angle of attack (AOA). Yet, surprisingly, there is no instrument in the cockpit providing this information directly, even though all airliners have an angle of attack vane located outside the airplane, and angle of attack information is fed to the computers and to the stick-shakers &endash; but not to the pilot. To be sure, angle of attack can be inferred indirectly from the airspeed indicator, but it is predicated on pilots having accurate knowledge of the weight of their aircraft (something most pilots know through feel and performance degradation is often incorrect). If nothing else, an angle of attack instrument would help tell pilots whether or not their aircraft is overloaded. There are many pilots who learned to fly by angle of attack in the military. Indeed, their initial reaction to the absence of an AOA indicator in an airliner cockpit is a mixture of amazement and dismay. These pilots believe that several fatal airline accidents could have been prevented if the pilots had just had accurate information about how hard they could pull back the yoke without stalling the airplane (or if the shuddering they were encountering was Mach buffeting at high altitude).
Of these items, the twinning of the critically essential primary ADI with its backup tops the list. Adding an angle of attack display comes a very close second. Everything else can be lumped under the heading of "fluff and flannel." One can hate, love, adjust to or learn to live with many of the foibles of cockpit design. Most of the annoyances aren't killers. And, as the saying goes, whatever doesn't kill you just makes you stronger.
Paterson's points about minimizing 'pilot traps' through better cockpit design touch on a larger question: who's driving the bus? Are designers giving pilots what they think the pilots should have, or what they need?
Paterson may be contacted directly via e-mail at apaterson@vision.net.au
B767-200
Shown above is a schematic of the instrument panel on the B767-200, which Paterson believes has the basic elements of good cockpit layout. However, he has added a number of significant improvements:
- Mechanical checklists, located on top of the glareshield above the Auto Flight System panel.
- Engine fire handles relocated to just above the engine instrument screen.
- A 'Speed Additive Knob' and indicator window have been incorporated into the Auto Flight System panel.
- An angle of attack (AOA) gauge has been added. It is located, as Paterson quipped, "in empty space just begging for its inclusion."
Source: Alex Paterson
__________________________
Copyright © Aviation Safety Week 2000
David Evans can be contacted at email: devans@phillips.com
RETURN
TO BEGINNING OF ARTICLE
FOOTNOTES:
1. Most aircraft crashes are incorrectly portrayed in the media as ACCIDENTS. By definition, an accident is "an unforeseen chance event resulting in injury". (Source: Macquarie Dictionary) The key word is 'unforeseen'. In modern aviation most 'chance events' have been 'foreseen' and procedures designed to manage these adverse sets of circumstances in a safe manner should have been put in place by airline management and the aircrew properly trained to carry out those procedures.
RELATED ARTICLES:
- GOOD AIRCRAFT DESIGN by Alex Paterson
- KAPTON: Why Aircraft Fall out of the Sky - expose of the dangers of Kapton wire insulation.
- KAPTON: 'Die by Wire' - transcript of Panorama TV documentary exposing the dangers of Kapton.
- KAPTON: 'Fire in the sky' - transcript of Ch 9 TV documentary exposing the dangers of Kapton.
- Korean Airlines (KAL) Safety Audit Report - A leaked internal safety audit into KAL.
- The Profession of Airline Pilot - by Alex Paterson
RELATED WEBSITES:
