There is no debate whether modern avionics have substantially improved safety and operational efficiency, but functionality has increased, the role of input devices has quietly changed.
A recent cross-cutting study published in a Center for Air Transportation Systems Research (CATSR) internal report identified moded input devices as an important factor contributing to modern airliner accidents. The study determined that the moded input device sometimes either initiated the accident sequence of events or inhibited the flight crew in intervening in a timely manner.
The study, which has also been submitted and is being reviewed by the Institute of Electrical and Electronics Engineers’ (IEEE) Journal of Transactions on Human-Machine Systems, finds that as the sophistication of the automation has increased, some traditional input devices on the flight deck, such as throttle levers, yokes, and switches, have unobtrusively changed the way they work.
Moded Input Devices
Traditional cockpit input devices, such as the throttle lever, yoke or side-stick, rudder pedals and mode buttons and switches exhibit one consistent behavior. For example, push a button and you get the associated mode, or pull back on the yoke and you get the same speed protections all the time.
To accommodate the increased avionics functionality, these input devices have incrementally become more complex. In specific situations knobs and mode buttons and switches may be disabled; throttle levers, yokes, side-sticks and rudder pedals may yield different behaviors at different times. These input devices are said to be “moded” because the behavior commanded by these devices changes.
As a consequence, in the current design of modern airliner flight decks, none of these input devices have any visual indication that they are moded. Further, there is no visual, tactile, or aural indication that the input device is disabled, operating under alternate behavior or being over-ridden.
In some cases, a visual indication, such as a green LED indicating that the switch was active (i.e. not disabled), is available on the primary flight display (PFD), engine synoptic display (ESD) or flight mode annunciator (FMA). These visual indications require the flight crew to intentionally seek the information out and then interpret the visual cue based on memorized rules of label, color, or presence/absence of display.
Moded Input Devices in the Accident Event Sequence
During a runway excursion at Munich airport on November 3, 2011, the aircraft automation disabled the takeoff/go-around (TOGA) switch and altered the function of the rudder pedals at critical moments in the accident sequence.
The meteorological conditions at the airport at the time allowed Category I operations, but the captain of an arriving aircraft elected to conduct an ILS Category III (Autoland) approach. The airline’s standard operating procedures permit the use of a Category III landing under Category I conditions, but warn the flight crew to monitor for a Localizer signal disruption and to be prepared to perform a go-around.
To expedite departures at the airport, ATC cleared an aircraft to depart from a mid-runway intersection. The departing aircraft cleared the runway as the arriving aircraft crossed the threshold at the opposite end. Because the localizer antennae had been moved distant from the runway end to accommodate the A380, the departing aircraft disrupted the localizer signal as the arriving aircraft was at 50 feet above ground level over the runway centerline with Cat III Autoland engaged. In response to the localizer signal disruption, the automation banked the aircraft slightly to the left.
The first attempt by the flight crew to intervene was inhibited by a disabled switch. The pilot attempted to initiate a go-around by selecting the TOGA Switch as the left wheel made contact with the runway. However, by design, this switch is disabled when the wheels touch down. So, nothing happened. The absence of response to the (now-disabled) TOGA Switch momentarily confused the flight crew.
The pilots now had to intervene during the landing roll-out. Once the aircraft touched down, the crew attempted to steer the aircraft back onto the runway using the rudder pedals.
This second attempt to intervene was inhibited by an input device with different behaviors depending on the circumstance. In this case, because the autopilot was still engaged for the Autoland rollout, it generated rudder commands to follow the (disrupted) localizer signal sending the aircraft left of the runway. The autopilot commands overrode the rudder pedal inputs made by the pilots again, creating some confusion.
Eventually, when the combined flight crew rudder pedal inputs exceeded the force threshold of 48 pounds, the autopilot disengaged automatically. Due to the rudder pedal forces needed to disconnect the autopilot, the aircraft overcorrected, crossed the runway, and came to rest to the right of the runway.
There were no fatalities and only a few minor injuries from the evacuation.
The report identified three types of moded inputs that played a role in all of the accidents:
- Mode switches and knobs that are disabled in specific situations
- Throttle levers, yoke and side-sticks, and rudder pedals that exhibit different behaviors depending on the situation
- Throttle levers, yoke and side-sticks, and rudder pedals that can be over-ridden by the automation or by inputs from another crew member depending on the situation
None of these moded inputs are annunciated to the flight crew directly on the input device. In some circumstances, the disabled status or alternate response can be inferred from flight mode annunciation (FMA) displays.
Commonly identified by the report were throttle levers that appeared to be actively controlling thrust to maintain airspeed but were either in a dormant mode, which is a mode that set the thrust to an Idle setting, or did not hold a thrust setting manually set by the pilot. Side-stick controllers that usually offered automatic speed protection, but did not in rare but safety critical circumstances, were also found to be widespread.
A Difficult Design Problem
The problem with the moded behavior is that moded input devices require the flight crew to memorize the conditions for disabled or alternative behaviors. These conditions are rare events. A pilot may see these conditions only in training, if at all. Therefore, the memory is weak and the rules cannot be reliably, rapidly recalled from memory in a time-sensitive situation.
The study suggests avoiding turning any input device into a moded input device unless it is absolutely necessary. If a moded input device cannot be avoided, the design should incorporate a salient mode indicator. Any moded device in a design should require a written waiver from the program manager and regulatory authorities. This waiver would trigger a paperwork chain to make sure it is highlighted in the training materials and procedures.
The requirement for salient feedback on the moded device presents some design challenges. One example is an LED light indicating disabled or alternate behavior. First, the input devices are not in normal field-of-view of the pilot, so putting an LED on the input device would not work. Second, for an LED with green for normal and red for disabled or not normal, what is considered a green or red operation? Third, the LED would violate the dark cockpit design philosophy that calls for devices to light up only when a pilot action is needed.
It may not be practical to ban moded input devices. But designers, pilots and regulators need to be more aware of the issue and more diligent in the design, certification and training process.