6 ms·

Metro Crash May Exemplify Paradox of Human-Machine Interaction

34 points by robg 17y ago

stcredzero 17y ago
So does the Air France crash. Speaking of which -- could GPS be used as yet another backup device for airspeed? It might have high latency, but it would be better than nothing.
- tokenadult 17y ago
  I think the intentional lack of resolution in civilian GPS is in part because it is not intended to be an air navigation back-up system.
  - LogicHoleFlaw 17y ago
    I was under the impression that the "degraded civilian" properties of GPS have been disabled for some years now.
    - lief79 17y ago
      Yes, but I believe they still reserve the right to restore them whenever they choose.
      - LogicHoleFlaw 17y ago
        From Wikipedia (http://en.wikipedia.org/wiki/GPS#Selective_availability http://en.wikipedia.org/wiki/GPS#Selective_availability): On 19 September 2007, the United States Department of Defense announced that future GPS III satellites will not be capable of implementing SA,[59] eventually making the policy permanent.[60]
        lief79 17y ago
        Thanks, I did not know that.
    - CWuestefeld 17y ago
      I believe that IFR-certified GPS systems have the added capability of factoring Differential GPS. This is an additional GPS beacon (aside from the satellites) originating from the airport you're landing at, which have a location that's very accurately known. High-price civilian GPS receivers are capable of this -- except you rarely have access to such a beacon. I mean, the restaurant I'm going to eat at isn't going to provide my little TomTom with a differential signal. With aviation, it's important enough that high-traffic airports provide the DGPS beacons.
      - cameldrv 17y ago
        This isn't true. IFR certified GPS units generally don't have Differential receivers. The main reason for this as far as I can tell is integrity. To be IFR certified, the receiver has to be able to tell when a satellite is giving bad data. In the older units, this was done with RAIM, which basically compares what is coming in from all of the satellites, and determines if all of the satellites are providing positioning that is relatively consistent. DGPS is a relatively simple system, and there's no way to check the DGPS signal for integrity. Without the ability to check for integrity, the additional accuracy is useless, as the design of instrument approaches is based on worst-case scenarios. Now newer IFR certified units do have WAAS, which is similar to DGPS, except the signal is transmitted from a satellite, and is based on measurements from a couple dozen ground stations, the correction interpolated in the unit. There has been a proposal to implement a system called LAAS for a number of years, which would be like DGPS, but would have the integrity checks that are required for aviation. However, it never really got off the ground. As it stands, with WAAS, you can be guided to 200 feet above the runway, but this is not as good as the old analog radio ILS, which, if setup in a sophisticated way, can take a plane all the way to the surface.
  - designtofly 17y ago
    Aircraft with Wide Area Augmentation System (WAAS) are certified to use GPS as a primary navigation source. [1] [2] [1] http://www8.garmin.com/support/faqs/faq.jsp?faq=221 http://www8.garmin.com/support/faqs/faq.jsp?faq=221 [2] http://en.wikipedia.org/wiki/Wide_Area_Augmentation_System http://en.wikipedia.org/wiki/Wide_Area_Augmentation_System
- troystribling 17y ago
  GPS coupled with a laser gyroscope can provide data at KHz frequencies.
- lutorm 17y ago
  GPS is used for all these things. It's even used for automated landing systems: http://www.freeflightsystems.com/gps_landing.htm http://www.freeflightsystems.com/gps_landing.htm
- designtofly 17y ago
  No, the GPS is not a reliable backup device. The issue is not latency. Aircraft GPS systems generally update faster than 1 Hz, which is plenty fast for most things. The real issue is that GPS gives you the ground speed, and not the airspeed. The wind speeds at 30,000 ft can exceed 200 knots [1]. Therefore, depending on the wind speeds and direction of travel, your airspeed and ground speed can be vastly different. Of course, it is theoretically possible to correct the GPS groundspeed using weather data (would have to be downloaded from external sources) to correct for upper winds, but this is not reliable over much of the surface of the world. [1] http://en.wikipedia.org/wiki/Jet_stream http://en.wikipedia.org/wiki/Jet_stream
  - lutorm 17y ago
    This is all true, but except for stall avoidance, when navigation or landing you care about ground speed. The old ILS doesn't know airspeed or ground speed.
- cameldrv 17y ago
  It is better than nothing, but the speed through the air is the most critical parameter for an airplane, and GPS measures speed over the ground. If a sensor goes out, the computer could assume that the wind is constant, and display an estimated airspeed, but the probe in this case iced over, in this case because of a thunderstorm. The wind is all over the place in a thunderstorm, and it wouldn't be very useful.
CarolynM 17y ago
The metro crash may also exemplify an ATO system with a single point of failure, or poor maintenance, or poor training, or many other things. I am disappointed that no articles I've read about this crash have discussed the actual systems beyond them containing track circuits.
wallflower 17y ago
One of the reasons why highways and thruways are relatively safe is because of an enforced social contract (e.g. if you speed, you may get ticketed and if you drive erratically, you may put your life and other people's lives in danger) With software, there is no such powerful peer contract. Software is not yet as good at self-healing (e.g. braking suddenly) if something unexpected happens. How do you handle a system exception safely and robustly at 65mph? Automated cars are a pipe dream. Automated auto-pilot for cars on highways (e.g. automated platoons of cars moving in lock-step until they reach their exit) a.k.a Intelligent Transportation Systems (ITS) will be persistently hobbled in adoption because failure of the interface between humans and machines is dangerous at highway speeds. Recent ITS research has focused on trying to academically prove MITM attacks cannot work for certain ITS systems. Also, most people like freedom to drive whenever, whereever they want.
- extension 17y ago
  Highways are "relatively" safe? Relative to juggling chainsaws, maybe. After disease, cars are the leading cause of death in just about any country wealthy enough to have cars. Drivers need all the help they can get from automation, even if it backfires now and then. The fact that any idiot who can spell his own name is allowed to hurtle through crowded streets with a two ton killing machine and no failsafes of any kind is clearly absurd.
  - pchristensen 17y ago
    After disease, cars are the leading cause of death in just about any country wealthy enough to have cars No, they're far down the list. Less than 2% of all deaths are from auto accidents, fewer than influenza and pneumonia and 20x less than cardiovascular diseases. http://www.the-eggman.com/writings/death_stats.html http://www.the-eggman.com/writings/death_stats.html
    - showerst 17y ago
      Everything above auto-accidents on your list is a disease, so technically he's right =P
omarish 17y ago
This touches a lot on why the UI of your application is crucial.
mgenzel 17y ago
On the topic of "The better you make the automation, the more difficult it is to guard against these catastrophic failures in the future, because the automation becomes more and more powerful, and you rely on it more and more." it's instructive to read the last story of Asimov's "I, Robot" called the "Evitable Conflict" in which the machines lead the Earth's progress.

34 points by robg 17y ago

So does the Air France crash. Speaking of which -- could GPS be used as yet another backup device for airspeed? It might have high latency, but it would be better than nothing.

tokenadult 17y ago
I think the intentional lack of resolution in civilian GPS is in part because it is not intended to be an air navigation back-up system.
- LogicHoleFlaw 17y ago
  I was under the impression that the "degraded civilian" properties of GPS have been disabled for some years now.
  - lief79 17y ago
    Yes, but I believe they still reserve the right to restore them whenever they choose.
    - LogicHoleFlaw 17y ago
      From Wikipedia (http://en.wikipedia.org/wiki/GPS#Selective_availability http://en.wikipedia.org/wiki/GPS#Selective_availability): On 19 September 2007, the United States Department of Defense announced that future GPS III satellites will not be capable of implementing SA,[59] eventually making the policy permanent.[60]
      - lief79 17y ago
        Thanks, I did not know that.
  - CWuestefeld 17y ago
    I believe that IFR-certified GPS systems have the added capability of factoring Differential GPS. This is an additional GPS beacon (aside from the satellites) originating from the airport you're landing at, which have a location that's very accurately known. High-price civilian GPS receivers are capable of this -- except you rarely have access to such a beacon. I mean, the restaurant I'm going to eat at isn't going to provide my little TomTom with a differential signal. With aviation, it's important enough that high-traffic airports provide the DGPS beacons.
    - cameldrv 17y ago
      This isn't true. IFR certified GPS units generally don't have Differential receivers. The main reason for this as far as I can tell is integrity. To be IFR certified, the receiver has to be able to tell when a satellite is giving bad data. In the older units, this was done with RAIM, which basically compares what is coming in from all of the satellites, and determines if all of the satellites are providing positioning that is relatively consistent. DGPS is a relatively simple system, and there's no way to check the DGPS signal for integrity. Without the ability to check for integrity, the additional accuracy is useless, as the design of instrument approaches is based on worst-case scenarios. Now newer IFR certified units do have WAAS, which is similar to DGPS, except the signal is transmitted from a satellite, and is based on measurements from a couple dozen ground stations, the correction interpolated in the unit. There has been a proposal to implement a system called LAAS for a number of years, which would be like DGPS, but would have the integrity checks that are required for aviation. However, it never really got off the ground. As it stands, with WAAS, you can be guided to 200 feet above the runway, but this is not as good as the old analog radio ILS, which, if setup in a sophisticated way, can take a plane all the way to the surface.
- designtofly 17y ago
  Aircraft with Wide Area Augmentation System (WAAS) are certified to use GPS as a primary navigation source. [1] [2] [1] http://www8.garmin.com/support/faqs/faq.jsp?faq=221 http://www8.garmin.com/support/faqs/faq.jsp?faq=221 [2] http://en.wikipedia.org/wiki/Wide_Area_Augmentation_System http://en.wikipedia.org/wiki/Wide_Area_Augmentation_System
troystribling 17y ago
GPS coupled with a laser gyroscope can provide data at KHz frequencies.
lutorm 17y ago
GPS is used for all these things. It's even used for automated landing systems: http://www.freeflightsystems.com/gps_landing.htm http://www.freeflightsystems.com/gps_landing.htm
designtofly 17y ago
No, the GPS is not a reliable backup device. The issue is not latency. Aircraft GPS systems generally update faster than 1 Hz, which is plenty fast for most things. The real issue is that GPS gives you the ground speed, and not the airspeed. The wind speeds at 30,000 ft can exceed 200 knots [1]. Therefore, depending on the wind speeds and direction of travel, your airspeed and ground speed can be vastly different. Of course, it is theoretically possible to correct the GPS groundspeed using weather data (would have to be downloaded from external sources) to correct for upper winds, but this is not reliable over much of the surface of the world. [1] http://en.wikipedia.org/wiki/Jet_stream http://en.wikipedia.org/wiki/Jet_stream
- lutorm 17y ago
  This is all true, but except for stall avoidance, when navigation or landing you care about ground speed. The old ILS doesn't know airspeed or ground speed.
cameldrv 17y ago
It is better than nothing, but the speed through the air is the most critical parameter for an airplane, and GPS measures speed over the ground. If a sensor goes out, the computer could assume that the wind is constant, and display an estimated airspeed, but the probe in this case iced over, in this case because of a thunderstorm. The wind is all over the place in a thunderstorm, and it wouldn't be very useful.

CarolynM 17y ago

The metro crash may also exemplify an ATO system with a single point of failure, or poor maintenance, or poor training, or many other things. I am disappointed that no articles I've read about this crash have discussed the actual systems beyond them containing track circuits.

wallflower 17y ago

One of the reasons why highways and thruways are relatively safe is because of an enforced social contract (e.g. if you speed, you may get ticketed and if you drive erratically, you may put your life and other people's lives in danger) With software, there is no such powerful peer contract. Software is not yet as good at self-healing (e.g. braking suddenly) if something unexpected happens. How do you handle a system exception safely and robustly at 65mph? Automated cars are a pipe dream. Automated auto-pilot for cars on highways (e.g. automated platoons of cars moving in lock-step until they reach their exit) a.k.a Intelligent Transportation Systems (ITS) will be persistently hobbled in adoption because failure of the interface between humans and machines is dangerous at highway speeds. Recent ITS research has focused on trying to academically prove MITM attacks cannot work for certain ITS systems. Also, most people like freedom to drive whenever, whereever they want.

extension 17y ago
Highways are "relatively" safe? Relative to juggling chainsaws, maybe. After disease, cars are the leading cause of death in just about any country wealthy enough to have cars. Drivers need all the help they can get from automation, even if it backfires now and then. The fact that any idiot who can spell his own name is allowed to hurtle through crowded streets with a two ton killing machine and no failsafes of any kind is clearly absurd.
- pchristensen 17y ago
  After disease, cars are the leading cause of death in just about any country wealthy enough to have cars No, they're far down the list. Less than 2% of all deaths are from auto accidents, fewer than influenza and pneumonia and 20x less than cardiovascular diseases. http://www.the-eggman.com/writings/death_stats.html http://www.the-eggman.com/writings/death_stats.html
  - showerst 17y ago
    Everything above auto-accidents on your list is a disease, so technically he's right =P

omarish 17y ago

This touches a lot on why the UI of your application is crucial.

mgenzel 17y ago

On the topic of "The better you make the automation, the more difficult it is to guard against these catastrophic failures in the future, because the automation becomes more and more powerful, and you rely on it more and more." it's instructive to read the last story of Asimov's "I, Robot" called the "Evitable Conflict" in which the machines lead the Earth's progress.