MAN-MACHINE PROBLEMS
with special focus on aviation

Bjarne Fjeldsenden, Dept. of Psychology, 7491 Trondheim, NTNU, NORWAY
E-MAIL: BJARNE.FJELDSENDEN@SVT.NTNU.NO

Link to my aviation page

The material below was mostly collected- and partly presented in connection with a seminar14-15 of March 1997
at Department of Psychology, Norwegian University of Technology and Science (NTNU) in Trondheim Norway.

Revised June 2, 2000

                    GENERAL PROBLEMS

1: The importance of information from the environment in different forms.

2: What is the role of perception? To survive.

3: Which stimuli is difficult to make sense off, and which is easy?

4: Why is it difficult for a blind person to move around?

5: The similarity between blind mobility and to fly IFR.

6: How can information from instruments be transformed into an adequate cognitive model? A spatial model and VR?

                       How to build mental models
From Eric Hollnagels article: MODELLING THE ORDERLINESS OF HUMAN ACTION.

a: The essence of control is the ability to predict, and to predict correctly, which is tantamount to
having a correct understanding or model of the situation (p.4)

b: A model of cognition must therefor account for how cognition depends on the context rather
the input in a narrow sense (p.6).

c: Situated cognition (p.8) Cognition occur in a context.

d: We may have been lavishing to much effort on hypothetical models of the mind and not enough
on analysing the environment that the mind has been shaped to meet. (p. 10, reminds of Gibson)

e: «I believe one should start from practical problems, which at any one time will point us towards
some part of human life» (p.10)
 

Control modes:

1: Scrambled control mode: Next action is basically irrational or random

2: Opportunistic control mode: React to the salient feature of the current context. The context is not well understood.

3: Tactical control mode: Rulebased normal behavior.

4: Strategic control mode: A wider time horizon. Looks ahead at higher level goals.
 
 
 

From Alan Hutchins book (1995): Cognition in the Wild.

An influential book in the tradition of "situated cognition". Describes navigation of a big american battleship and of canoes between
islands hundred of kilometers apart in the Pacific. The methods and concepts are different but both find their way around.
 
 

From the Halden-project: Methods to build a cognitive model:
Elements which is the input to the model.

7.1: Registration of what the operator does.

7.2: A verbal protocol.

7.3: A camera which registers where the operator look at the control panel.

7.4: A re-run of the experiment together with the operator where he is asked to comment on his actions and behaviour in the test situation.

SHEL- Software- Hardware-Environment-Livewar
Man-machine comparisons

The computer has few and specific functions, man have many and general functions.

The computer has limited flexibility, man has great flexibility.

The computer is reliable and precise, man makes error and is less precise.

The computer has an objective memory, man has a subjective memory.

The computer needs a specific input, man understands many types of input.

The computer is not emotionally affected, in man emotions may affect execution.

The computer may suddenly collaps, stop functioning, in man the function gradually deteriorate..
 
 

Keywords that can contribute towards understanding and improvement.

1: Situational awareness:  Where you are, where you are going, the terrain under you, the meteorological
conditions, traffic around you, the status of the engine and the aeroplane.

Examples: a: Cali, Columbia b: Brønnøysund, Norway. c: Svalbard. Russian airliner. d: New Zealand Airlines
at the South Pole. «White out» e: The Korean 747 which was shot down. d and e also involved faulty values
in the flightcomputer (programming error)

2: Overload-simultan capacity-attention: How to cope: a: Have clear priorities (fly the aeroplane,
donít fly into the terrain, donít get into the flightpath of other planes, use the radio to get necessary information)

b: Work out contingency plans beforehand (use time in preparing the flight)

c: Donít fly into weather conditions that you canít cope with. Turn in time and donít be to eager to get «home».
d: Equipment (radios, and navigation aids) which work and are user-friendly.

e: Automate as many procedures as possible.

f: Use autopilot when available.

g: Relax.

3: Man and the system: The problem of automation and lack of transparency. Affordance and visibility.

a: The aeroplanes systems. Examples: a1: The Chinese 747 outside California. a2: The Airbus at Moscow
in «a go around mode»

a3: Flight modes are frequently mistaken. Strasbourg

b: The air trafic control system. b1: What cognitive models does the controller have? b2: Will 3-dimensional
displays improve the handling of aircrafts? And ease the workload?

c: Interaction between a and b. Does the pilot and the controller operate in «the same cognitive space»?

4: To be in the loop. a: The importance of transparency. Automation shall help the crew, not replace them.
How to get a smooth cooperation.

5: CRM: Cockpit Resource Management: a:  A cross-cultural perspective. Power distance.
b: A friendly atmosphere.  c: Well defined roles. d: Operating in the same cognitive space.
 
 

Accidents Direct Focus on Cockpit Automation:

Airbus official [senior VP of engineering Bernard Ziegler] acknowledged that man-machine interface has been a factor in one recent accident [Nagoya A300-600 crash] and two incidents [Interflug A310 at Moscow and Tarom A310-300 at Orly]."

- "Ziegler explained that Airbus never expected both the pilot and autopilot to be flying the aeroplane at the same time." (Moscow)

Philosophy of design: - The three manufacturers' approaches to FBW are also contrasted; where Airbus has a "hard" flight envelope, Boeing's 777 FBW system will allow the pilot to bypass the "soft" limits by applying additional force to the controls. (McDD's MD-11 system is similar to Boeing's.) [This is the "if I HAVE to bend the plane, LET ME BEND IT" approach. Past discussion of FBW on comp.risks has specifically mentioned the case where exceeding limits may be necessary to avoid a crash. --ckd]

- Ohio State University human factors researchers are focusing on "mode confusion" as a cause of problems. Apparently
the cockpit designers have never bothered to read Donald Norman's books

- Kenneth Smart, chief inspector of air accidents in Great Britain, says the Kegworth 737-400 crash (the "M1" crash) was due to badly designed "glass cockpit" engine displays. The second article, "Incidents Reveal Mode Confusion," discusses an MIT study that used anonymous Aviation Safety Reporting System (ASRS) data to find that 74% of 184 mode awareness incidents involved vertical navigation, while only 26% were related to horizontal navigation.

"Modern Cockpit Complexity Challenges Pilot Interfaces," suggests that the proliferation of modes, especially with automatic transitions from one mode to another, has caused safety problems and should be avoided.

«Mode Confusion Poses Safety Threat,"

Accidents and causes are viewed from four approaches: the senses, training and design, performance factors, and systems.

TOP LEVEL DESIGN PHILOSOPHY OF BOING

1. Designs should first eliminate failure opportunities; if failures cannot be prevented, they should be contained; if they
cannot be contained, they must be controlled.

2. If the aeroplane is structurally flyable, it must be controllable. Do not limit the control capabilities of the aeroplane
below its structural limits.

3. No single failure shall cause catastrophic results. Any combination of single failures and undetected (latent) failures
that could lead to catastrophic results shall be extremely improbable.

4. Dual load path structure should always have a discernible first failure. Flight Critical systems should always have
a discernible first failure.

5. Flight crews shall be notified of system failure conditions appropriate to the severity of the condition and the
criticality of response timing.

6. The limitations and error potential of the humans involved in producing, maintaining, and operating the aeroplane
shall be considered in all designs.

7. The aeroplane should not change any condition which might affect the flight path without informing the flight crew.
Primary flight and thrust controls shall incorporate tactile feedback to the flight crew.

8. Automation should be used as a tool to aid, NOT replace the pilot. Its actions should be clearly understandable
and manageable by the flight crew.
 
 

Notes from Air Crash Detective
Stephen Barlay. Coronet edition 1975.

About repeated overshoots in the chapter «The cause behind the cause behind the cause.»

Many investigators would say that no more than two landing attempts should not be tried due
to poorer performance after the two first ones.

Delays may also have a negative effect on the crew. Irritation and fatigue may be two factors.

Shut down of the wrong engine is a frequent/classic error.
 
 

Some theoretical points of view to discuss.

1: What is the similarity between blind mobility in connection with sensory aids and flying IFR? Both the blind and the pilot has to rely on «artificial information» to navigate in space. In aviation one has succeeded quit well because in the commercial area due to reliable instruments, efficient training and that it is much easier to navigate in the air than on the ground, which is much more cluttered with obstacles. VFR pilots without instrument training and bad weather has been the cause of many accidents. The principle of flying instrument is simple, but to maintain your course, altitude, attitude of the plane, to know where you are the whole time, monitor the motor instruments and talk to the ATC when necessary, requires some co-ordination and training. Approach and landing require even more of the pilot. Reduction of engine power, wheels out, flaps out, keep the glide path, change radio frequency etc.. What is fascinating is what the future may bring. Pre-processing is a keyword. The key question is how to deliver information in such a way that can easily be processed and reacted to to make navigation safe. Then the information has to be «natural» to the senses and the brain. VR displays may be the answer

Cali, Colombia 757 Crash 20.12.1996 (TERPs)

Cali, Colombia 757 Crash on Approach Following is NTSB factual press release followed by my analysis of the accident based on these authoritative facts. The Director General of Civil Aviation of Colombia has requested that the National Transportation Safety Board make the following information available to the news media. This information was released today by the Government of Colombia in connection with the investigation of the December 20, 1995, American Airlines flight 965 accident near Buga, Colombia.

The accident investigation is being conducted by the Colombian officials in accordance with the provisions of Annex 13 to the Convention on International Civil Aviation. Under those provisions, the U.S. team, led by Safety Board investigators, is participating fully in the investigation. The U.S. team includes advisors from the Federal Aviation Administration, American Airlines, Allied Pilots Association, and Boeing Commercial Aeroplane Company. The U.S. team participated fully in the development of the factual material contained in the attached Colombian press release.

Media inquiries about this investigation should continue to be directed to the Colombian civil aviation authorities.

On December 20, 1995, at about 2138 EST, American Airlines, Flight 965, a regularly scheduled passenger flight from Miami, FL to Cali, Columbia, with 156 passengers and 8 crewmembers aboard, crashed into mountainous terrain during a descent under instrument flight rules 38 miles north of Cali. Four passengers survived.

The flight had made initial radio contact with the Cali Approach Control while descending to flight level 200 (20,000 feet) about 63 miles north of the Cali VOR. The flight was subsequently cleared to the Cali VOR, to descend and maintain one five thousand feet. The barometric altimeter setting was reported as 30.02 Hg and the flight was told that no delay was expected for the approach. It was also told to report the Tulua VOR, an en route navigational aid for an instrument approach procedure and landing at Cali.

Reviewed data for parameters applicable to the investigation. Auditioned and transcribed the CVR tape, which was of good quality; the tape is 30 minutes and 36 seconds in duration . The data show: Extended discussion of a non-pertinent nature (flight attendant crew duty time) prior to descent No indication of descent checklist procedures No indication of an arrival (approach) procedures briefing No indication of any aircraft systems or powerplants malfunction No indication of any unusual meteorological event, i.e. turbulence, wind shear No indication of any external hostile force acting on the aircraft (subversion or terrorism) No indication of any out-of-service condition of any applicable ground based navigational aids My comment: Weather and aircraft OK

Radio communications were accomplished from the left seat of the cockpit without evidence of language difficulty by either the flightcrew or the ATC controller

Flight 965 was operating in a radar surveillance environment until a few minutes before the end of the flight when radar coverage was no longer available (due to high mountains?

Flight 965 was on autopilot-L-NAV mode, southbound in the Bogota flight information region (FIR) on a direct route from BUTAL to Tulua (ULQ)

Following a position report from the aeroplane at 63 DME, Cali Approach Control issued the following clearance, "cleared to Cali VOR, descend and maintain 15 thousand feet, altimeter 3002, no delay expected for approach, report Tulua VOR" The flightcrew replied, "OK, understood cleared direct to Cali VOR, report Tulua and altitude 15, that's fifteen thousand, 3002, is that all correct Sir?

Approach replied, "Affirmative" About two minutes later, Cali approach transmitted, "Okay Sir, the wind is calm, are you able to approach runway 19?

The flightcrew replied, "Ah, yes sir, we'll need a lower altitude right away though"

Approach replied, "Roger 965 is cleared to the VOR DME approach runway one niner, ROZO Number One arrival, report Tulua VOR"

The flightcrew readback was, "Cleared the VOR DME one niner ROZO one arrival, we'll report the VOR, thank you Sir"

Cali approach immediately clarified with, "Report Tulua", and the flightcrew immediately acknowledged, "Report Tulua"

The flightcrew referred to the cockpit chart package (approach publications) after ATC instructions to "Report Tulua"

Flightcrew discussion took place about the navigational aids to be used in the ROZO 1 Arrival, specifically their position relative to Tulua

About 30 seconds later the flightcrew requested, "Can American Airlines 965 go direct to ROZO and then do the ROZO arrival sir?"

Several radio transmissions then took place: Approach replied, "affirmative direct ROZO one and then runway one niner, the winds calm". The flightcrew replied, "all right, ROZO, the ROZO 1 to 19, thank you, American 965. And the controller stated, "Affirmative, report Tulua and twenty one miles, 5000 feet". The flightcrew acknowledged, "OK report Tulua, twenty one miles at 5000 feet, American 965"

DFDR information indicates that, at a point south of Tulua, while continuing descent, the flightcrew selected ULQ in the flight management system and the aircraft made a left turn of about 90 seconds to an easterly heading

Flightcrew discussion took place during this turn regarding a return to the centreline of the approach course, and then also to selection of a course direct to the ROZO radio beacon DFDR information indicates that, while continuing the descent, the autopilot mode was switched to HDG SEL and the aircraft entered a right turn to a south-westerly heading to the end of the recorded data

Nine seconds prior to end of the recordings, data indicates a ground proximity warning system (GPWS) "TERRAIN" mode warning, then "PULL-UP" warnings continue to the end of data

Data indicates the crew initiated a GPWS escape manoeuvre with increased engine power and aeroplane pitch attitude two seconds after the initial GPIs alert. The stick shaker activated during the GPIS escape manoeuvre During the GPWS manoeuvre, the flight spoilers, which had been extended during the descent, remained in the extended position to the end of the recorded data blockquote
COMMENTS ABOUT THE ACCIDENT AT CALI, COLUMBIA:

The instrument approach from the north at Cali, and its essentially identical terminal arrival procedure, proceed via a dogleg approach course. This approach course begins at Tulua VOR and proceeds down a canyon that just has room for standard instrument flight rules (IFR) terminal and approach procedural airspace. The majority of the instrument approach procedure can be flown at as low as 5,000 feet, msl, in a canyon with terrain rising steeply to 13,000 feet to the east, and over 6,000 feet to the west.

The non-radar services provided by the Cali ATC controller were completely correct and in accordance with accepted international standards. Further, the controller knew that it was essential that AAL 965 begin the approach at its mandated beginning: the Tulua VOR. This is evidenced by his repeated requests for a Tulua mandatory position report. Although it would have been helpful had the flightcrew had intimate familiarity with the terrain along the approach course, such knowledge was not essential to the safe use of the approach procedure. Instead, the crew should have been conditioned to know that an approach without an ATC-provided radar vector must be flown in its entirety. In this case, that meant starting the approach at Tulua VOR without exception.

However, pilots trained in the United States, and who generally fly in the United States have, as a group, been lulled into generally thinking in terms of instrument approaches in a radar-driven ATC environment. Plus, to move traffic, the FAA itself encourages shortcuts with a wink and an approving nod, so to speak. Air carrier simulator and ground school training deals with radar vectors to the approach's final approach course as a matter of routine. My comment: Different facilities and expectations in US and Colombia.

Further complicating the mix are the area nav systems on modern airline aircraft, which make it easy and tempting to always cut the corner, and go: direct, direct. This is fine in a radar enroute environment, but it killed the crew and passengers of AAL 965.

Imaginary TERPs containment areas prior to the final approach segment are routinely breached during non-radar operations within the United States. This is because of inadequate training and understanding by pilots, ATC controllers and, today, most of FAA's management, about the essential requirements to fly the entire instrument approach procedure with absolute compliance. Usually, the transgression is forgiven, because there are no rock walls in the area beyond the protected airspace. But, the rocks can exist, as they do north of Cali Airport. As the United States pushes forward with GPS approach procedures, we will see more approaches hugging the canyon walls, so to speak. Yet, the FAA seems oblivious to the problem.

Criticism of FAA ALPA's Charting and Instrument Procedures Committee (CHIPs) has been urging the FAA for over three years to publish first-rate, instructional and directive information about all the critical nuances of proper flying of the full instrument approach and IFR departure procedures. These efforts have gone nowhere with a unresponsive FAA. Further, the CHIPs Committee forced the FAA to issue a legal interpretation that, excepting a radar vector, an instrument approach must begin at the appropriate feeder fix or initial approach fix (IAF). But, the FAA refuses to publish this requirement in the Aeronautical Information Manual, much less widely disseminate comprehensive guidance to the aviation community. Because of lack of FAA leadership, it is probably a rare air carrier recurrent training program that addresses these IAF issues at all.

Further, the FAA, in a rush to develop 500 new GPS instrument approach procedures, is creating deadly gaps in these new instrument procedures by violating their own criteria. Instead of always tying the beginning and end points of these new instrument approach procedures to the published enroute airway structure, they are leaving deliberate gaps for pilots and air traffic controllers to try to work through. Also, this approach procedures are often designed to encourage shortcuts around required segments, because of lack of flexible design of individual approach procedures.

The FAA is now pointing the finger at American Airlines' training when, instead, they should be pointing the finger at themselves. Like the cancer that had grown in the ATC system that resulted in the TWA 514 crash at Dulles Airport on December 1, 1974, a similar FAA-induced infection can be seen in the recent crash at Cali.

The crew obviously lacked recent, good training on the essential requirement to begin the approach at the IAF. Instead, they took full "advantage" of their modern glass-cockpit, area nav system, and simply punched in the approach fix nearest the airport which, in this case, was a step-down fix in the final approach segment of the approach. This confusion and lack of essential understanding was compounded by this step-down fix (ROZO) being the name of the arrival procedure. Thus, the crew established a flight track that, although it converged with the instrument approach criteria's mandated protected airspace, it was outside of that minimal airspace, which resulted in the aeroplane literally scrapping the canyon wall.

In conclusion, I submit that more professional flight crews than not would have made a similar fatal mistake had they been in this situation. This can be directly laid at the door of an unresponsive, disjointed FAA.

What may be new developments

1: GPS linked to electronic maps which divert the plane away from high terrain.

2: VR displays where the pilots see on a screen «the same» they see with their eyes on a clear day. Lear Astronics
Corp in California is the lead member of a ALG consortium ALG = Autonomous Landing Guidance system.

3: What other information is needed for a safe flight?

a: Anti-collision radar.

b: Improved weather information.

c: Better air traffic control systems?

3-D Primary Flight Display with Terrain Information

An important world-wide aviation safety problem is still the controlled-flight-into-terrain or CFIT accident. Area navigation and onboard terrain elevation databases offer the potential for improved cockpit displays near terrain. This project has developed a prototype primary flight display format designed to re-enforce the pilot's model of both lateral and vertical navigation in near-terrain situations. This new display format is referred to as the Spatial Situation Indicator (SSI). Specific emphasis has been placed on the terminal phase of flight with terrain modeling in the vicinity of the departing and destination airport. The unique design incorporated perspective symbology which depicts a prediction of the aircraft's predicted position and terrain clearance information for up to 75 seconds ahead of the aircraft. Projection of the flight path is based on a "fast time" modeling technique described by Arthur Grunwald (1985). Traditional flight paths use the "tunnel-in-the-sky" approach which present no reference to the ground elevation e.g., Grunwald (1982). The technique developed for this research utilized roll stabilized vertical lines "whiskers" positioned at 15 second intervals out to 75 seconds. The figure illustrates the virtual "whiskers" and flight path. The whiskers are displayed in pairs of equal distant widths so that in steady level flight a perspective path is projected. The whiskers are color coded using green and yellow. The green lower portion extends from the predicted aircraft altitude at that interval to the terrain below. Its length therefore is a direct representation of the terrain clearance at that point in the aircraft's path given no changes in aircraft flight path. The display also incorporated a dynamically color coded terrain grid. The color coding is based upon aircraft predicted height and terrain spot elevations. The color coding uses dark green for safe terrain and dark red for dangerous terrain. The terrain grid is comprised of a triangular mesh with each triangle having sides of 2 nautical miles (NM). Man-made obstructions such as radio towers are also shown on the terrain grid. Information for building the terrain and obstruction files is obtained from the approach plates for each runway in the scenario. An experimental evaluation of the display is being conducted on-site at a major U.S. airline. Experimental participants are current glass cockpit flight instructors. Each experimental subject, after training to familiarize him/herself with the part-task aircraft simulator and interface, will fly three scenarios based on actual controlled flight into or toward terrain as described by Bateman (1991). Each experimental participant will use one of the three displays: the baseline cockpit display, the primary flight display, and this display with flight path predictor and ground terrain information. A total of eighteen pilots will participate, six with each display. Attention diverting tasks are implemented to match as closely as possible the scenarios as they are described by Bateman. ATC communications are implemented using simple voice communications without supporting electronic intercoms. The experimenter carries out the air traffic controller communications. The goal of the experiments is to measure how quickly pilots can detect dangerous terrain
 
 

Flying VFR, IFR and how to avoid accidents
Some common sense factors to be aware of.

What is the difference between VFR and IFR flying?
a: VFR you fly and land with reference to the ground, what you can see from the cockpit.
b: IFR you fly with reference to instruments and instructions from the traffic control unit.
The pilot has to rely on artificial information.

What are the most common causes of accidents in VFR flying?

1: Flying from VFR conditions into IMC conditions. How to avoid these accidents?

a: Make pilots more aware of the temptation to continue. Group pressure, hoping to get home, or in time to a meeting, economical reasons.

b: Be mentally prepared to cope with IMC conditions, icing included. Experience in VFR conditions how the plane behave and what is needed to control it.

c: Equip the planes with autopilot and GPS. Will reduce the mental load.

2: Flying into power lines. How to avoid these accidents?

a: Donít fly low if you have not checked thoroughly beforehand.

b: Donít fly low. Resist the temptation to impulsive flying.

3: Hazards manoeuvres. How to avoid these accidents?

a: Increased awareness of making certain manoeuvres in too low altitude.

b: Warn about the danger of boredom.

4: Mid-air collisions: How to avoid these accidents?

a: Donít fly close to other planes.

b: Maintain always radio contact with control unit or send blind telling where you are, your position.

c: Keep good look out.

d: Use landing lights in terminal areas and places where there are other aircrafts