Business & GA, Commercial

Safety in Avionics: Pilot Traps in the Cockpit

By David Evans | April 1, 2000
Send Feedback

A modern cockpit should be more like an observation tower than a minefield. That is, it should be designed in such a way that pilots have a clear view of aircraft performance and system status, and it should not contain what might be called "pilot traps."

Traps are hereby defined as design features or aspects that tend to confuse pilots about an unfolding event, and which can distract them or sucker them into making inappropriate decisions. Traps can be subtle.

For example, including speed deviation and localizer/glideslope information on the attitude director indicator (ADI) may encourage pilots to focus their attention unduly on the ADI. Here is the root of an insidious pilot trap, as sound instrument flying technique involves the disciplined scanning of all flight instruments, not just focusing on one seemingly comprehensive display.

For the thousands of hours devoted to cockpit design, do good designs result?

This question was posed to Alex Paterson, a retired Australian airline pilot with some 7,000 mostly short-haul hours of experience flying many different types of aircraft, from the relatively simple DC-9 to the "glass cockpit" B767.

His extended response, paraphrased greatly here, reflects the insight borne of accumulated experience punctuated by the occasional hard lesson.

First, the philosophy of cockpit design: The systems (flight controls, avionics, etc.) need to be designed in such a way that they are as simple as possible commensurate with the task. The design must reflect both good ergonomics and a conscious effort to minimize pilot traps. Ideally, pilots should receive feedback about aircraft behavior through at least two senses, if only for confidence-inspiring redundancy. Sight and sound are the primary senses, but tactile inputs (i.e., movement, feel and response) complement visual feedback.

At the same time, humans monitor tasks poorly, because monitoring (e.g., watching paint dry) is so monotonous that the mind tends to drift to more interesting topics. In contrast, a machine can be designed to stolidly monitor a parameter for its entire life (e.g., an alarm clock). Therefore, Paterson argues, cockpits should be designed to facilitate what machines and humans each do best:

  • Let the machines (computers) monitor aircraft systems and provide audio and visual alerts when specified values are approached or exceeded. The increasing use of computer-generated "voices" to advise aircrews about problems is a positive trend.

  • Humans should make most operating decisions, with computers monitoring their performance and sounding alerts or alarms (as is the case with ground proximity warning systems).

  • Automation should not be taken to the point where pilots lose basic airmanship skills and are lulled into a false sense of security about the infallibility of the "machine." Unfortunately, Paterson fears the crossover point may already have been passed. "We can expect a spate of avoidable airline disasters over the next 20 years associated with the phenomenon of pilot disassociation," he predicts.

  • Finally, Paterson believes that pilots’ eyes and their mental concentration should be in one of two places during critical phases of flight such as takeoff and landing: on the instruments and/or out the windscreen. Systems and procedures that require pilots to take their eyes away from either of these two places are potential death traps.

Some items requiring the pilot not flying (PNF) to momentarily take his eyes off the instruments are probably unavoidable; retracting flaps and landing gear, for instance. However, the introduction of a host of distracting new items should be avoided. The requirement to continually reset the speed bug with each flap configuration in modern "glass cockpit" aircraft is a case in point.

With these thoughts in mind, Paterson offers the following as basic elements of good cockpit design:

Engine fire warning and drill. An engine fire is potentially the most acute emergency facing pilots, especially if it occurs during takeoff right at the moment of liftoff. Immediate action is critical. For this reason, engine fire handles should be located on the forward instrument panel, just above the engine instruments, within the peripheral vision of both pilots. Locating fire handles either in the overhead panel or on the center pedestal requires both pilots to take their eyes off their flight instruments and turn their heads, with the attendant risk of disorientation.

Standby horizon. The ADI is the central pivot, as it were, and all adjustments to flight attitude are made using this "control" instrument. Everything else is a performance instrument (power + attitude = performance). For this vital reason, aircraft are equipped with a backup attitude indicator (AI) which, in case of generator failure, is connected to battery power.

Because of its "pivotal" importance, the standby AI should be located within the captain’s normal instrument scan so that a failure of the primary ADI will be noticed immediately. Such is the arrangement on the B767, but not on all other aircraft. For example, on the MD-11 the backup AI is located at the bottom center of the instrument panel.

The twinning of the primary ADI and its backup should be a sine qua non of good cockpit design. Pilots suddenly forced to adjust their accustomed selective radial scan to totally fly off of a remoted "peanut gyro" already are halfway to an unrecoverable attitude. If the airplane catches fire and smoke rapidly fills the cockpit, the need to pair the primary and backup ADI is all the more apparent. An anxious pilot, with restricted peripheral vision, should not have to try to peer through smoke goggles at the backup horizon located on the lower edge of the center instrument panel. Also, a failed ADI always will remain centrally in the pilot’s natural instrument scan as a potential "fatal distraction."

Autothrottle. The throttle levers should physically move in response to power changes initiated by the autothrottle system. This feature provides tactile feedback to the pilot flying and better visual reinforcement to both pilots when their hands are not on the throttles. Paterson argues that pilots are more likely to notice a throttle lever moving than changes to numbers spinning up and down on a digitized engine instrument. The Airbus design features non-moving throttle levers which, company engineers declare, are intended only to indicate the throttle setting commanded by the pilot. Paterson takes issue, maintaining that for want of electric motors to move the throttle levers, an aircraft could be lost. Whatever the airplane is doing should be totally apparent to its master.

Airspeed bug. On approach and takeoff, the airspeed bug should automatically set itself to the new minimum airspeed whenever the flap configuration is changed. A "bug," just for the record, is a colored pointer that pilots set around the dial of their airspeed gauge as a reminder of important speeds, such as initial takeoff climb out speed (V2) or minimum approach speed for landing (Vref).

Presently, any bug change requires at least one pilot to dial up the new airspeed. The DC-9 had such an automatic system, albeit analog, associated with the autothrottle. The approach speed bug on the airspeed indicator, for example, received its signals from the angle-of-attack vane and was set automatically with each change in flap configuration. It was an elegantly simple system, Paterson maintains.

A modern digital equivalent could be designed to set the bug at the minimum Vref (maneuvering speed) for a particular flap configuration, with a knob allowing pilots to quickly dial in a "speed additive" above the minimum Vref speed.

Stabilizer trim. As with a moving autothrottle, a spinning stabilizer trim wheel provides pilots with an appropriate alert as to a runaway stabilizer (especially on the B727 and B737, which can spin quite rapidly). A wheel also has the advantage of allowing pilots to physically grab something in the event of a runaway trim situation.

This arrangement at least gives them a few seconds to collect their thoughts and to remember just where the stabilizer trim cutout switch is located. In the initial confusion of an unexpected emergency, pilots often forget the location of seldom-used items. Finally, having secured the runaway trim, the aircraft can be re-trimmed manually.

Paterson believes that the lack of a manual trim wheel on some modern jets is a serious design flaw. These jets include the DC-9 and stretched descendants like the Alaska Airlines MD-83 that crashed recently–and in which a runaway stabilizer trim situation is involved.

The airplanes without trim wheels feature an aural alert, which emits a "barp" sound with each half-degree of stabilizer trim movement. Paterson believes a poorly trained pilot could misinterpret the sound, whereas a trim wheel moving against one’s knee appears obvious to just about anyone.

Checklists. Normal flight operations checklists are best served by a mechanical "shopping list" device located on top of the glareshield (i.e., above the autoflight mode control panel). The advantages are numerous:

  • A mechanical checklist is easier to use. Pull it out, then up. No clicking one’s way through an electronic menu.

  • If necessary, items easily can be checked off out of sequence, which is normally not possible with an electronic checklist.

  • The checklist is in a position where it can be seen easily while the pilot is looking out the windscreen (where the pilots’ eyes should be aimed most of the time, anyway), and where it remains just within the peripheral vision of either pilot when flying on instruments. This feature is important when taxiing in congested terminal areas, as well as when shooting an instrument approach.

  • It is virtually impossible to take off or land without completing the checklist, as the uncompleted checklist remains within the pilots’ line of vision until it is stowed out of sight or when the last item has been checked off.

By contrast, electronic checklists generally are located at the bottom of the center instrument panel, requiring pilots to look down and into the cockpit at crucial times, such as during the approach to land. Indeed, the lower center-panel location can be dangerous even when the airplane is taxiing. Take, for example, the jet that collided with a truck in the terminal area partly because the pilots were performing the checklist at night while taxiing to the gate.

Angle-of-attack instrument. All fixed-wing flying is closely related to angle-of-attack (AOA). Yet, surprisingly, there is no instrument in the cockpit providing this information directly, even though all airliners have an angle-of-attack vane outside the airplane, and angle-of-attack information is fed to the computers and to the stick-shakers–but not to the pilot. To be sure, angle-of-attack can be inferred indirectly from the airspeed indicator, but it is predicated on pilots having accurate knowledge of their aircraft’s weight–something most pilots know through feel and performance degradation is often incorrect.

If nothing else, an angle-of-attack instrument would help tell pilots whether or not their aircraft is overloaded. There are many pilots who learned to fly by angle-of-attack in the military. Indeed, their initial reaction to the absence of an AOA indicator in an airliner cockpit is a mixture of amazement and dismay. These pilots believe that several fatal airline accidents could have been prevented if the pilots just had accurate information about how hard they could pull back the yoke without stalling the airplane (or if the shuddering they were encountering was Mach buffeting at high altitude).

Of these items, the twinning of the critically essential primary ADI with its backup tops the list. Adding an angle-of-attack display comes a very close second. Everything else can be lumped under the heading of "fluff and flannel." One can hate, love, adjust to, or learn to live with many of the foibles of cockpit design. Most of the annoyances aren’t killers. And, as the saying goes, whatever doesn’t kill you just makes you stronger.

Paterson’s points about minimizing "pilot traps" through better cockpit design touch on a larger question: Are designers giving pilots what they think they should have, or what they need?

Paterson may be contacted directly via e-mail at [email protected].

Receive the latest avionics news right to your inbox