The Human-Machine Interface: Reports from ASRS
CALLBACK is a NASA publication from their Aviation Safety Reporting System which takes anonymised ASRS reports and presents them in a “lessons learned” format. Every month, they focus on a different aspect of aviation safety,
One issue that they have focused on recently, which coincidentally fits in with some of the accidents that we have been looking at this year, is The Human-Machine Interface.
The human-machine interface is complex and the subject of much research and study within the aviation community. Interface design is continually being improved to minimize errors that occur, and sometimes originate, at these junctures. Nevertheless, missteps still happen. At an interface, information may be misinterpreted or not seen by the pilot or operator. Faulty or unreliable information may be displayed and ‘received’ as well. Mistakes in operational control inputs or programming can also occur where the pilot or operator communicates to the aircraft or machine something other than what is intended. Regardless of the origin or nature of an error, the human-machine interface may allow or provide an opportunity to trap the error and improve flight safety.
I hope that you will enjoy their selection of incidents related to the human-machine interface and what happens when communication breaks down between them.
Unseen, Unretrieved, or Unrecognized
This Dispatcher was informed of a hazardous situation that occurred during a commercial flight. A warning had been issued but was not ‘received’ by the responsible personnel.
Radioactive materials were incorrectly loaded in position X that should have been loaded [at position] Y or aft. Ramp called after the flight departed to seek after the fact approval. [I] advised the team and the Duty Officers of the situation. It was determined…based on the low exposure rate, a Transportation Index (TI) of 0.8, that the flight could continue and the crew would be advised on the ground at the destination. The flight was concluded without incident. The cause was due to the Ramp Agent missing the warnings he got from his software to not proceed. Ramp should be more aware of the special handling required by dangerous goods.
A Confusing Communication Interface
An Aviation Maintenance Technician (AMT) described this incorrect interface configuration noted by a B777 Captain. It had already generated multiple operational errors.
The Captain reported that the Controller Pilot Data Link Communications (CPDLC) ACCEPT and REJECT buttons were switched.… This caused 2 occasions of erroneous reject responses being sent to ATC. On arrival, the switches were confirmed [to be] in the wrong place (Illustrated Parts Catalog (IPC) 31-10-51-02), and [they were] switched back (Standard Wiring Practices Manual (SWPM) 20-84-13) [to their correct locations].… These switches can be inadvertently transposed.
Cognition, Selection, and Recognition
This CRJ200 flight crew discusses two unplanned, unexpected, automated descents and examines their causes.
From the Captain’s report:
I was the Pilot Monitoring (PM). We were leveling at four thousand feet and about 12 to 15 miles out on the ILS.… I was in green needles. ATC assigned a speed reduction [from] 210 to 170 knots and…cleared us for the visual approach. The Pilot Flying (PF) had the autopilot engaged. The aircraft suddenly began a descent and increased speed. I called for the PF to stop the descent. I felt automation was incorrect and stated, “My aircraft,” and disconnected the autopilot and corrected for a 300-to-400-foot altitude loss. At this point, I transferred controls back to the original PF and re-engaged the autopilot. Moments later the aircraft started a descent. Again, I called, “My aircraft,” disconnected the autopilot, and corrected back onto the glideslope and to 170 knots. ATC had advised us for a second or third time that they needed…170 [knots]. We were at 170 knots at his last request, but speed management was not my first priority when detecting and correcting for the unexpected descent. After stabilizing the aircraft, I noted the original PF’s…altimeter read 31.22.… It was determined that the original Pilot Flying was turning the baro knob instead of the NAV SELECT knob when transferring to green needles. In doing so, the aircraft thought we were higher and needed to descend to 4,000 feet. There were no traffic conflicts, and the PF had the correct altimeter settings prior to the approach.
From the First Officer’s report:
When changing the navigation source from FMS to LOC, I inadvertently spun the baro knob instead of the NAV SELECT knob.… We must look at what we are moving and verify [that] the input causes the desired results afterward. It would be wise to change the baro knob to one that has a different tactile feel than the NAV SELECT knob. The knobs are identical and close to each other on the…panel.
Faulty Information ‘Received’ and Believed
This air carrier pilot describes a Controlled Flight Toward Terrain (CFTT) event and digs down to a root cause.
We were cleared for the visual approach to [Runway] 28R from the arrival. I set the altitude to 6,000 for the FAF of ZIXIP. My original plan was to fly toward the FAF at 6,000 [feet], then turn base leg, then [turn] final just inside of [the FAF] to start my descent after being fully configured. I decided to turn earlier and mistakenly followed what I thought to be my glide slope; therefore, I believed myself to be too high and needing to descend for a stabilized approach. Turning base to final, we got an audible alert of “OBSTACLE,” for which I was searching outside but did not see. Then at the Captain’s prompt suggestion, I tried to level off but was not aggressive enough. The slow descent resulted in a “PULL UP” alert, and I was able to maintain altitude, but the Captain noted the radio altimeter…around 650 [feet] AGL. I was able to continue my turn from base to final stabilized and had no other incidents with the event.
[Factors included a] lack of situational awareness on my part and a last-minute decision to keep a tighter traffic pattern, which would require compressed time to configure the aircraft. Mainly, my mistake [was] in believing and following a false glide slope, which lead to my confusion. [I plan on] following the ILS profiles even in Visual Meteorological Conditions (VMC) for terrain and obstacle clearance [while] keeping my situational awareness outside…the cockpit more and remaining vigilant…in VMC.
An Unconventional Operational Interface
This CRJ700 First Officer manipulated an aircraft system at an inopportune time. Results were serious and surprised both Captain and First Officer during a critical phase of flight.
I was the PF. The right thrust reverser was inoperative and disabled by Maintenance; the left thrust reverser was available for use. After touching down and de-rotating, I deployed the left thrust reverser. When I attempted to move the thrust lever backward from idle reverse to increase reverse thrust, I found that the thrust lever would not move, and my hand position somehow felt different from usual. In that same moment, I realized that, instead of lifting the thrust reverser unlock lever, I had lifted the shutoff lock and moved the thrust lever into shutoff, shutting down the left engine. I called out the problem to the Captain and told him I would be using only brakes to stop the aircraft. There was plenty of runway remaining, and heavy braking was not required. We taxied to the gate using normal single engine taxi procedures.
After performing several thousand landings in this aircraft, I have a well-developed muscle memory for engaging reverse thrust. I also have a well-developed muscle memory for shutting down the left engine during taxi. With the right thrust reverser disabled, thrust reverser use required touching and moving only the left thrust lever instead of both thrust levers. I am fairly certain that this interaction with only the left thrust lever subconsciously triggered the muscle memory motions for a left engine shutdown instead of those for activating the thrust reverser(s), which usually involves moving both thrust levers. I had landed the same aircraft the day before with the same inoperative right thrust reverser and properly deployed only the left thrust reverser. I have no other explanation for how I managed to perform the motions for an engine shutdown instead. I will be much more aware of this possibility for inadvertent, incorrect hand motions possibly caused by muscle memory triggers when operating an aircraft with a deferred thrust reverser.
Information for Confirmation
Engine status was available via normal procedural interface, but neither Captain nor First Officer took note. Fortunately, a hazardous situation was resolved without damage or injury.
After deplaning the aircraft…[my] Captain was informed by the Captain of the next crew that the Number 2 Engine had been left running. Maintenance and weather delays caused our last leg of a 4-leg day to arrive…two hours late and within 30 minutes of timing out. In a rush to hand the aircraft over to the waiting crew, we ran the parking checklist, but we did not verify that the engine was shut down on the EICAS during the parking checklist. The Captain only visually confirmed that the start/stop selector was in the off position, and due to the thrust lever being positioned slightly advanced, the engine never shut down.
The Captain receiving the aircraft notified [my] Captain that the engine had been left running and shut it down. I was informed…the next morning.… Confirm what the Captain says during the checklist…instead of just accepting it.
Thank you to ASRS for allowing me to reprint their collection on the Human-Machine Interface and for putting out such a quality publication every month. The Aviation Safety Reporting System has an amazing collection of CALLBACK issues from 1994 to 2022.
Human-machine interface issues are a longstanding area of research that has always been informed by aviation. The 1992 crash of Air Inter 148, where a pilot interpreted a “-33” as a -3.3⁰ flight path angle whereas the computer took it as a 3300 ft/min descent rate, distinguished on the interface only by a small “V/S” lit up instead of “FPA”, made it into many textbooks on the subject.
Knowing this, issues like two knobs being too similar seem unsurprising. What did surprise me in the collection on this blog post was the issue of the button error, where the interface was mdchanically changed by maintenance, and the “muscle memory” issue. The general nature of such issues is long known, but I wouldn’t have expected them to come up in this context.
A ramp agent ignoring a software prompt, on the other hand, is very much expected.
For the “engine running” issue, it’s always a design challenge to give interface users enough cues to maintain situational awareness: something like this couldn’t hapoen in a small single-engine GA craft where the engine sits noisily right under the nose of the pilot, but having a less immediate experience (as in an airliner) creates issues such as shutting the wrong engine off in flight, or not shutting one off at all, and interface designers need to look for ways to bring that awareness back without getting in the way of operating the aircraft.