7 ms·

Amazing that someone would design in multiple steering wheels, only one of which is active, and no big indicator to make it super-obvious which one it is. Also

by tlb 9y ago

Amazing that someone would design in multiple steering wheels, only one of which is active, and no big indicator to make it super-obvious which one it is. Also amazing that there's a mode where moving a control sometimes controls all engines, sometimes just one.

Jtsummers 9y ago
Check out the recent O'Reilly book Tragic Design for more situations exactly like this. Poor UI design is remarkably common, even on controls that are essential for safe operations. http://www.tragicdesign.com http://www.tragicdesign.com
- csours 9y ago
  Also the classic Field Guide to Understanding Human Error. Amazon: https://www.amazon.com/Field-Guide-Understanding-Human-Error/dp/0754648265/ref=mt_paperback?_encoding=UTF8&me= https://www.amazon.com/Field-Guide-Understanding-Human-Error... Older PDF (paperback is well worth it, in my opinion): http://www.leonardo-in-flight.nl/PDF/FieldGuide%20to%20Human%20Error.PDF http://www.leonardo-in-flight.nl/PDF/FieldGuide%20to%20Human...
deleted 9y ago
[deleted]
oasisbob 9y ago
Having differential engine control isn't too surprising - it's just another way to maintain a course in addition to the rudder. Jetliners have gangable throttle controls for their engines, albeit with what is probably a much better interface.
- cyberferret 9y ago
  Airliners usually have a hardware clip to 'gangload' all throttles together, and the 'interface' of having two or more separate levers next to each other makes it obvious if you missed one while moving them, or notice that the clip is flipped so the levers now work independently instead of all as one. Then again, in high stress situations even totally obvious signs like this can be missed, as evidenced by the Qantas 747 crew on the famous runway overrun in Thailand some years ago. I believe in that case, a large contributing factor was when the captain went to pull the levers back over the rear detents for reverse thrust after landing on the wet runway, he only grabbed three of the levers, and left one engine running at just over idle speed.
digi_owl 9y ago
Happens more often than we like. I know of a ferry that a local warf built that had two bridges, and a combined throttle and rudder in each. The thing is that when moving from one bridge to the other, the crew had to flip a switch to indicate what direction was forward. And quite often they forgot. End result was a long history of damaged because ferry would ram the pier when the crew was actually attempting to move away from it.
- theyregreat 9y ago
  That is super dumb and dangerous. They should just flip the inputs on one end. EDIT (since some people obviously don’t understand the problem): ... so that each set of controls is always correct for the respective side on which it is located. No switch is necessary.
  - nicwolff 9y ago
    No, they just have a big button by each wheel marked "MAKE THIS THE BOW".
    - theyregreat 9y ago
      You’re bikeshedding on a switch versus a button, still an extra, unnecessary step to forget. Same problem. You failed. Try again.
    - LeifCarrotson 9y ago
      When would you ever not press that button?
  - scott_karana 9y ago
    Even better, make the stations operable from either side. Then the yokes always orient in reality, and it's just the frame of reference of the pilot that changes. Eg, if you're facing the dock, and push forward, you'll hit the dock. Take the other side and point your body to sea. Intuitive.
theyregreat 9y ago
Redundant affordances are needed: Controls that are active should be illuminated in a particular color, say red. Controls that are disabled should be extinguished, physically-locked or track active controls, and sound a warning when manipulated.
nostrademons 9y ago
I can imagine the requirements doc that led to that, where some Pentagon wonk was thinking "What happens if the helmsman is shot? If there's engine damage? If the helmsman is shot and there's engine damage?" and wrote all of those cases in, and completely forgot about the case where the bridge crew gets super confused because they triggered an edge case in the software and have no idea how to regain control of the ship.
- user5994461 9y ago
  Well, it's a warship. In their defense, they really have to plan for people dying and part of the ship being destroyed.
  - dx034 9y ago
    But if it leads to them not being able to steer through a busy area in peacetime where thousands of ships go through every day (many larger than this destroyer), this clearly failed. With this happening I'm not sure if they would've reacted better if they had suddenly been under enemy attack. Would they've been less confused then?
JshWright 9y ago
Decent odds you've flown on an airplane with a similar UX for primary flight controls. Airbus uses two "side stick" controllers that are on opposite sides of the cockpit. This was a contributing factor in the Air France 447 crash.
- inferiorhuman 9y ago
  > > Amazing that someone would design in multiple steering wheels, only one of which is active, and no big indicator to make it super-obvious which one it is. > Decent odds you've flown on an airplane with a similar UX for primary flight controls. Ah, well Airbus does a few things. 1.) A "dual input" warning is issued if there is an attempt at using both controls simultaneously. 2.) There are lights to indicate when your sidestick is active and when it is not.
  - cyberferret 9y ago
    I believe the warning can change depending on which of the 3 flight modes the aircraft is in at the time. Big contribution to AF447's demise was that the aircraft was in 'alternate flight' mode and the crew assumed it was still in 'normal flight' mode and made a lot of their judgement calls accordingly. For an industry that is so safety conscious, I believe this is a huge flaw in disaster control. To put it in context that most readers here can understand - lets say your everyday computer uses OS X as its operating system, but one day, with deadlines to meet, you have a huge crash, and the OS reverts to Windows, and you have to find the problem and remember the appropriate commands under intense pressure...
    - inferiorhuman 9y ago
      I'd argue it's more like getting dropped into single user mode. No friendly GUI, but the underlying systems are the same. The flaw with any sort of safety net is that you get used to it and forget the basics of aviation. The big problem was that the pilot-in-command simply forgot (or did not know) how to fly the plane. He overcorrected in reaction to turbulence and the rest is history. Normal law does not allow the pilot to set an angle of attack that would lead to a stall. In the alternate law modes this protection is not there and so when the PIC didn't adhere to the rule of "don't pull up while in a stall" there was no safety net to prevent him from exacerbating the situation. In fact he kept pulling back when the stall alarm went off. A better UI would not have solved the self-inflicted problems. From the findings sections in the wiki entry: - The pilots apparently did not notice that the aircraft had reached its maximum permissible altitude - The pilots did not read out the available data (vertical velocity, altitude, etc.) - the crew made inappropriate control inputs that destabilized the flight path; - the crew failed to follow appropriate procedure for loss of displayed airspeed information; - the crew lacked understanding of the approach to stall - the crew lacked practical training in manually handling the aircraft both at high altitude and in the event of anomalies of speed indication - the two co-pilots' task sharing was weakened both by incomprehension of the situation at the time of autopilot disconnection, and by poor management of the "startle effect", leaving them in an emotionally charged situation - the crew did not respond to the stall warning A better cockpit may have given the pilots a better chance of surviving but definitely wouldn't have guaranteed a better outcome. One only needs to look at Asiana to see that even Boeing, with their contrasting approach to UX, can't save pilots who lack basic airmanship. My understanding is that most long-haul pilots will fly a fairly small number of segments each month, and that most of those segments are going to involve a huge amount of time spent in the middle of nowhere with autopilot on. This leads to atrophying of skills needed to manually fly a plane. Conversely, one only need to look at Qantas' QF32 incident to see that good airmanship can absolutely make catastrophic failure survivable. Yes, there is a lot of information to process in an emergency... but the Qantas crew took that information and delegated appropriately. The Air France pilots lost their cool and fucked up.
mschuster91 9y ago
> Also amazing that there's a mode where moving a control sometimes controls all engines, sometimes just one. This is a fallback in case the primary rudder fails. You can still shift left or right, but you will take more time and it will be far less precise than using the rudder. This is also valid for aircraft, where not only the rudder can be compensated but also the elevator (aka up/down) by simultaneously modifying the power of all engines. You can see a list at https://en.wikipedia.org/wiki/Flight_with_disabled_controls https://en.wikipedia.org/wiki/Flight_with_disabled_controls.
- azernik 9y ago
  The UI issue being that ganged control should have been the default, but separate control was instead.
- dTal 9y ago
  The difference being that aircraft throttles are not modal and are always 1 throttle = 1 engine.
ams6110 9y ago
In my view, on screen UI instead of physical controls is a big factor. If the throttles had been levers it would be instantly discernable if one or both were being moved. This is also why I dislike touch screen controls in cars. I want levers and knobs that give tactile, physical feedback.
- mjevans 9y ago
  Agreed on this. The more important controls should be operable by a suited astronaut, and should also try to express the current 'feedback' of the system state.

by tlb 9y ago

Jtsummers 9y ago

Check out the recent O'Reilly book Tragic Design for more situations exactly like this. Poor UI design is remarkably common, even on controls that are essential for safe operations. http://www.tragicdesign.com http://www.tragicdesign.com

csours 9y ago
Also the classic Field Guide to Understanding Human Error. Amazon: https://www.amazon.com/Field-Guide-Understanding-Human-Error/dp/0754648265/ref=mt_paperback?_encoding=UTF8&me= https://www.amazon.com/Field-Guide-Understanding-Human-Error... Older PDF (paperback is well worth it, in my opinion): http://www.leonardo-in-flight.nl/PDF/FieldGuide%20to%20Human%20Error.PDF http://www.leonardo-in-flight.nl/PDF/FieldGuide%20to%20Human...

deleted 9y ago

[deleted]

oasisbob 9y ago

Having differential engine control isn't too surprising - it's just another way to maintain a course in addition to the rudder. Jetliners have gangable throttle controls for their engines, albeit with what is probably a much better interface.

cyberferret 9y ago
Airliners usually have a hardware clip to 'gangload' all throttles together, and the 'interface' of having two or more separate levers next to each other makes it obvious if you missed one while moving them, or notice that the clip is flipped so the levers now work independently instead of all as one. Then again, in high stress situations even totally obvious signs like this can be missed, as evidenced by the Qantas 747 crew on the famous runway overrun in Thailand some years ago. I believe in that case, a large contributing factor was when the captain went to pull the levers back over the rear detents for reverse thrust after landing on the wet runway, he only grabbed three of the levers, and left one engine running at just over idle speed.

digi_owl 9y ago

Happens more often than we like. I know of a ferry that a local warf built that had two bridges, and a combined throttle and rudder in each. The thing is that when moving from one bridge to the other, the crew had to flip a switch to indicate what direction was forward. And quite often they forgot. End result was a long history of damaged because ferry would ram the pier when the crew was actually attempting to move away from it.

theyregreat 9y ago
That is super dumb and dangerous. They should just flip the inputs on one end. EDIT (since some people obviously don’t understand the problem): ... so that each set of controls is always correct for the respective side on which it is located. No switch is necessary.
- nicwolff 9y ago
  No, they just have a big button by each wheel marked "MAKE THIS THE BOW".
  - theyregreat 9y ago
    You’re bikeshedding on a switch versus a button, still an extra, unnecessary step to forget. Same problem. You failed. Try again.
  - LeifCarrotson 9y ago
    When would you ever not press that button?
- scott_karana 9y ago
  Even better, make the stations operable from either side. Then the yokes always orient in reality, and it's just the frame of reference of the pilot that changes. Eg, if you're facing the dock, and push forward, you'll hit the dock. Take the other side and point your body to sea. Intuitive.

theyregreat 9y ago

Redundant affordances are needed: Controls that are active should be illuminated in a particular color, say red. Controls that are disabled should be extinguished, physically-locked or track active controls, and sound a warning when manipulated.

nostrademons 9y ago

I can imagine the requirements doc that led to that, where some Pentagon wonk was thinking "What happens if the helmsman is shot? If there's engine damage? If the helmsman is shot and there's engine damage?" and wrote all of those cases in, and completely forgot about the case where the bridge crew gets super confused because they triggered an edge case in the software and have no idea how to regain control of the ship.

user5994461 9y ago
Well, it's a warship. In their defense, they really have to plan for people dying and part of the ship being destroyed.
- dx034 9y ago
  But if it leads to them not being able to steer through a busy area in peacetime where thousands of ships go through every day (many larger than this destroyer), this clearly failed. With this happening I'm not sure if they would've reacted better if they had suddenly been under enemy attack. Would they've been less confused then?

JshWright 9y ago

Decent odds you've flown on an airplane with a similar UX for primary flight controls. Airbus uses two "side stick" controllers that are on opposite sides of the cockpit. This was a contributing factor in the Air France 447 crash.

inferiorhuman 9y ago
> > Amazing that someone would design in multiple steering wheels, only one of which is active, and no big indicator to make it super-obvious which one it is. > Decent odds you've flown on an airplane with a similar UX for primary flight controls. Ah, well Airbus does a few things. 1.) A "dual input" warning is issued if there is an attempt at using both controls simultaneously. 2.) There are lights to indicate when your sidestick is active and when it is not.
- cyberferret 9y ago
  I believe the warning can change depending on which of the 3 flight modes the aircraft is in at the time. Big contribution to AF447's demise was that the aircraft was in 'alternate flight' mode and the crew assumed it was still in 'normal flight' mode and made a lot of their judgement calls accordingly. For an industry that is so safety conscious, I believe this is a huge flaw in disaster control. To put it in context that most readers here can understand - lets say your everyday computer uses OS X as its operating system, but one day, with deadlines to meet, you have a huge crash, and the OS reverts to Windows, and you have to find the problem and remember the appropriate commands under intense pressure...
  - inferiorhuman 9y ago
    I'd argue it's more like getting dropped into single user mode. No friendly GUI, but the underlying systems are the same. The flaw with any sort of safety net is that you get used to it and forget the basics of aviation. The big problem was that the pilot-in-command simply forgot (or did not know) how to fly the plane. He overcorrected in reaction to turbulence and the rest is history. Normal law does not allow the pilot to set an angle of attack that would lead to a stall. In the alternate law modes this protection is not there and so when the PIC didn't adhere to the rule of "don't pull up while in a stall" there was no safety net to prevent him from exacerbating the situation. In fact he kept pulling back when the stall alarm went off. A better UI would not have solved the self-inflicted problems. From the findings sections in the wiki entry: - The pilots apparently did not notice that the aircraft had reached its maximum permissible altitude - The pilots did not read out the available data (vertical velocity, altitude, etc.) - the crew made inappropriate control inputs that destabilized the flight path; - the crew failed to follow appropriate procedure for loss of displayed airspeed information; - the crew lacked understanding of the approach to stall - the crew lacked practical training in manually handling the aircraft both at high altitude and in the event of anomalies of speed indication - the two co-pilots' task sharing was weakened both by incomprehension of the situation at the time of autopilot disconnection, and by poor management of the "startle effect", leaving them in an emotionally charged situation - the crew did not respond to the stall warning A better cockpit may have given the pilots a better chance of surviving but definitely wouldn't have guaranteed a better outcome. One only needs to look at Asiana to see that even Boeing, with their contrasting approach to UX, can't save pilots who lack basic airmanship. My understanding is that most long-haul pilots will fly a fairly small number of segments each month, and that most of those segments are going to involve a huge amount of time spent in the middle of nowhere with autopilot on. This leads to atrophying of skills needed to manually fly a plane. Conversely, one only need to look at Qantas' QF32 incident to see that good airmanship can absolutely make catastrophic failure survivable. Yes, there is a lot of information to process in an emergency... but the Qantas crew took that information and delegated appropriately. The Air France pilots lost their cool and fucked up.

mschuster91 9y ago

> Also amazing that there's a mode where moving a control sometimes controls all engines, sometimes just one. This is a fallback in case the primary rudder fails. You can still shift left or right, but you will take more time and it will be far less precise than using the rudder. This is also valid for aircraft, where not only the rudder can be compensated but also the elevator (aka up/down) by simultaneously modifying the power of all engines. You can see a list at https://en.wikipedia.org/wiki/Flight_with_disabled_controls https://en.wikipedia.org/wiki/Flight_with_disabled_controls.

azernik 9y ago
The UI issue being that ganged control should have been the default, but separate control was instead.
dTal 9y ago
The difference being that aircraft throttles are not modal and are always 1 throttle = 1 engine.

ams6110 9y ago

In my view, on screen UI instead of physical controls is a big factor. If the throttles had been levers it would be instantly discernable if one or both were being moved. This is also why I dislike touch screen controls in cars. I want levers and knobs that give tactile, physical feedback.

mjevans 9y ago
Agreed on this. The more important controls should be operable by a suited astronaut, and should also try to express the current 'feedback' of the system state.