 |
A project to make businesses more aware of their customer experience, and how to fix it. By Mark Hurst. |
| About Mark Hurst | Mark's Gel Conference | New York Times Story on This Is Broken | Newsletter: Subscribe | RSS Feed |
Search this site:
Categories:
- Advertising
- Current Affairs
- Customer Service
- Fixed
- Food and Drink
- Just for Fun
- Misc
- Not broken
- Place
- Product Design
- Signs
- Travel
- Web/Tech
Previous: SF parking sign | Main | Next: frozen Thai seafood curry
September 7, 2005 10:48 AM
Broken: Same alarm used in two conditions
A sad review of the Cypriot plane crash a few weeks back:
At 10,000 feet, an alarm went off to warn the crew that the plane would not pressurize. Crew members mistakenly thought that the alarm horn was a warning to tell them that their controls were not set properly for takeoff, the officials said.The same horn is used for both conditions, although it will sound for takeoff configuration only while the plane is still on the ground.
Maybe there's a good reason for this, but I can't think of one... why would the same alarm be used for two very different conditions?
Link: Cockpit Confusion Found in Crash of Cypriot Plane - New York Times.
Not saying this isn't broken, because I do think alarms should be easy to understand, but don't flight crews have to pass a test to show they understand the meaning of each of the alarms? Or maybe their thinking was impaired at this point. I am just surprised that they wouldn't know the meaning of the alarm.
As a pilot in the Air Force we had to go through periodic altitude chamber training. Part of that was for us to take off our oxygen masks and take notice of our symptoms of oxygen starvation. That saved me once when I felt those symptoms and discovered that the cabin pressurization was not turned on. We donned our masks and fixed the problem. Better than an alarm (which we didn't have back then).
The thing about alarms is a problem. A horn goes off if you are about to land with the gear up but it also goes off whenever you pul the throttle back to idle. So after a while the only thing the alarm means to the pilot is that the power is reduced (as it should be for landing). And the fact that the rolly things under the plane are not there is ignored unless a sharp tower operator catches it.
I think that all pilots and co-pilots should speak the same language. That's just stupidity on the airline's part; to assign two pilots of different languages to the same flight.
I guess my car horn is broken since when it beeps it could mean I'm angry, I'm really angry, I'm going to run you off the road, I'm so angry or Hi.
/just kidding, it really does seem like there should be both an audible and visual cue to a problem and that it should be very obvious what the alarm/visual cue mean.
What else is broken is wanting me to register to look at a **** newspaper article! Will someone post Bug-Me-Not information and save the day?
Why don't they have spoken alarms? (Like the cars that say, "the door is ajar.") If language is an issue, record the alarms in multiple languages. Then for each flight set it up so that the current language is set during preflight.
It UI terms we say that the alarm was modal - what it meant depended on what mode the airplane was in at the time it went off. If on the ground, one thing, if in the air another.
Modal interfaces have been discussed at length. I personally think they are usually a bad idea. Certainly for something that very rarely happens and which could be life threatening, it is a design flaw to use a modal interface in such a situation.
So, broken.
And I agree with the comments that the pilot and copilot MUST be able to speak a common language. That they didn't was negligence by the airline. It should be illegal to do something like that. Also negligent was the maintenence crew not properly maintaining the airplane, so they'll get sued for both of those.
One other comment on the alarm design - note that Boeing has sinsce issued a technical note that on that plane people should mind there alarms and that "The company notice said there had been other instances of confusion over the horn by pilots." Since Boeing knew there was a problem already and did nothing to fix it, they will be found liable as well. Furthermore, the idea of overloading a low-oxygen alarm in such a way is INSANE. OBVIOUSLY, once that condition happens, the crew will be heavily impaired already and unable to remember obscure details of technical notes that were once issued. Damn this is a screw up! Furthermore, when the crew calls the flight control tower, they should do something OTHER than tell them how to turn OFF the low oxygen alarm. They should tell them to put on the oxygen masks! The guys in the tower were not low on oxygen, they were just incredibly incompetant.
This accident did NOT have to happen.
One last thing: the other mistake was that instead of hiring qualified pilots, the airline hired button pushing seat warmers to pretend to be pilots.
These guys just put the plane on autopilot for Athens as soon as it took off and then sat back and started daydreaming. Its crazy that pilots are putting planes on autopilot before they have even reached altitude. Autopilot for take off and landing should not be normally used by any qualified pilot. Unfortunately, this sort of fly by pushing buttons is very common in third world countries and has been the cause of a number of crashes in recent years.
can't... leave ... it alone....
OK, one more: to fix the problem, any autopilot program should disengage from ascent if the oxygen sensor goes off. If its possible to design it so, when autopilot is on, the oxygen warning should automatically cause the plane to descend to 8000 or 10000 feet, weather permitting.
J.Scott, you've obviously thought about this a lot. One quick question, how will the autopilot program know if weather permits decent, and since altitude is sensed by a barometer instead of what would essentially be echo location with a downward firing radar, depending on location, they might need to think about that height number.
Of course none of this matters since every company does cost/benefit analysis and in most cases it's cheaper to lose a plane and be sued then to retrofit a plane with safety devices etc. Same thing with auto recalls.
Master alarms are fairly common, wherein the theory is that any number of problem conditions result in the master alarm sounding which tells the operator/pilot/whoever to check ALL systems to find the source of the alarm.
The problem, of course, is that people get conditioned to expect the master alarm going off to mean what it meant the other 389 times the master alarm went off, and thus they aren't prepared the 390th time it goes off and is something completely different.
Most aircraft use a master alarm system, NASA spacecraft do the same, and--most alarming (no pun intended) to me--NUCLEAR POWER PLANTS.
Holy cow- somebody mark the calendar! (So far) There's NOT ONE 'not broken' remark on this whole thread!! Is everyone feeling okay...? ;D
User interface design and human factors engineering was literally invented to solve exactly this problem -- over complicated aircraft cockpits.
I refuse to give a newspaper a user name! No one ever refers to it, and subscribers to the actual paper don't use user names! Also, why the fudge do they want to know my gender and job!?!? I noticed that the people at the paper wanted my e-mail address as well, and they gave an explanation for why they needed it. I understand why they want my address. But there's no explanation for the other factors! What are the people at NYT drinking, and what are they doing with my information?!?!
SOMEONE GIVE ME BUG-ME-NOT INFORMATION!!!!
how on earth could the driver & his co-driver ('cos they were obviously NOT Pilots) confuse a TakeOff Alarm at 10,000 frickin' feet?????
... .. unless they were BaseJumping off the Sentinel ... ???
Kevin: Get Firefox.
http://www.mozilla.org/products/firefox/
Then get the BugMeNot extension.
http://roachfiend.com/archives/2005/02/07/bugmenot/
Then just right click on the username/password for one to pop in the blanks, hit submit, and you're on the story.
Joshua, yes, I don't know to what extent airplanes can detect weather. You mentioned downward radar, I don't know if even big planes have doppler radar. However, it could at least level off during the ascent when it hits the 10k alarm level. It would then be up to the pilots to force it upwards more. Part of the problem here is that, while the pilots lay passed out on the floor from oxygen deprivation and the oxygen alarm was blasting away, the plane continued to ascend in height on autopilot, worsening the situation. Even if there is really bad weather, that's gotta be better than the crew passed out as the plane runs out of fuel very slowly.
I can't imagine that there could be any casue for confusion with 1 alarm being used for these 2 scenarios.... If the alarm goes off when the plane is on the ground, then the pilots (unless they were morons) would know that their controls were not set properly for takeoff, and not anything to do with pressurisation. If the alarm goes off at 10,000 feet then they would know that it is a pressurisation issue, not a control take off setting issue.
Was this alarm anything to do with the crahs. I can onl imagine no - unless the pilots decided to speed to the ground in order to change their control settings to take off settings - in which case the ultimate casue of the crash is pilot idiocy, not alarm problems
This is a 'perfect storm' sort of failure in which there were 20 or so steps along the way to death and at every single step, the wrong decision was made.
Every one of those steps was at its core human error, and by multiple humans. The question is, how can we design the interface to reduce the chance of human error, or to prevent error from even happening in the first place. A lot of the screw up steps could not be avoided no matter what because they came from total stupidity and the sort of bad training you get outside of US flight schools (do not trust any pilot or mechanic not trained in the US). Mechanics set the valve wrong because they were incompetant, the flight crew didn't bother to do their legally mandated checks, they didn't speak the same language, they didn't know how to fly the plane, they had no idea what the alarms meant, and when they radioed in the alarms the crew on the ground told them how to locate the fuse for the alarm and physically yank it out of the wall.
Why didn't the pilots put on the oxygen masks when they dropped? Maybe oxygen masks should drop earlier. Planes *have* pressure gauges - they know when oxygen levels are at the point that people are passing out. When it gets to this point, planes on autopilot could lower their altitude unless the pilot appears to be conscious and in control, which could be determined from whether he is actually flying the plane.
Oh and I just realized there was a cover up. We now know that they were reporting this problem with the alarm to the ground and the ground gave them bad advise. When the airforce jets scrambled, and in the aftermath of the crash, the same people were saying "We have no idea what caused the crash. As far as we knew, everything was fine and then the plane went off course and there was no communication." When these guys said that, they were lying to cover up their mistakes. If they had told the truth at the time the fighters were scrambled, the fighter pilots or the control tower could have radioed the person who was reported trying to fly the plane at the end and explain to them how to lower the flight altitude, and how to put the oxygen masks on the pilots, and things of that nature. The ground people tried to CYA and now people are dead.
Pilots oxygen masks dont drop from the ceiling like the passangers do, they are sitting next to the seats. The pilots masks are similar to military pilots masks because they are of much better quality than the passangers get, they also have a built in mic.
Up until this point:
"A lot of the screw up steps could not be avoided no matter what because they came from total stupidity and the sort of bad training you get outside of US flight schools (do not trust any pilot or mechanic not trained in the US)."
J. Scott Sounded like he knew what he was talking about, but this statement shows his opinions to be nothing more than fringe rantings.
With any luck we can get an explanation that is reasoned and balanced (preferably without any conspiracy theories please 'effete marksman')
Red, pilots trained outside the US really are not as good. Ask any pilot if you don't believe me. You know, there is a reason why so many foreign pilots come to the US for flight training and it is not because it is less expensive! It is because US trained pilots are better, are in higher demand, and can get a higher salary.
But you disagree. That's fine. Given the known facts, explain to us how poor training and incompetance was not the primary cause of the crash.
Even second world trained pilots behave unsafely. For example, years ago I was on a long haul Air France flight. During the flight, the flight crew put the plane on autopilot, came back into the cabin, got drunk on champagne, and danced with the passengers. Fun yes, safe, no.
And it ain't just in cockpits, folks. My brother in law is a nuclear control-room operator and has worked at various power plants. He has a particularly scary story to tell about exactly this design defect in the control room at the plant at Toms River NJ. The same horn used for two different conditions -- one highly routine, and the other rare and critical.
This is just bad UI, folks. Even my home security system gives me distinct alarms for fire and breakin, even though the attention level demanded for each really isn't all that different!
J. Scott: Although it is true that many pilots in third world countries do not get good training, pilots in "second world" (if by that you mean "Europe") countries get training comparable to that of US pilots. On many long-haul flights (over 10 hours) there are two full crews, because law limits the number of hours a crewmember may fly in a day.
P.S. How the hell do you dance in the narrow aisle of an airplane.
J. Scott: Although it is true that many pilots in third world countries do not get good training, pilots in "second world" (if by that you mean "Europe") countries get training comparable to that of US pilots. On many long-haul flights (over 10 hours) there are two full crews, because law limits the number of hours a crewmember may fly in a day.
P.S. How the hell do you dance in the narrow aisle of an airplane?
P.P.S Sorry for the double post.
Cyprus is not exactly a third world country. It’s GNI (per capita) is within the range of that of Spain or New Zealand. I am not trying to defend Cyprus or bore you with this info; my point is that the failures that have led to this disaster are not solely related to the wealth or educational standards of the country. They happened because of corporate greed. Private airlines with their absurdly low prices trying to survive in a market with stiff competition are bound to lower their costs by hiring less competent people. This was a disaster waiting to happen and unfortunately it can happen again, even in a much wealthier country. I personally refuse to fly with airlines that are not national. I am not familiar with the safety standards in the USA, but I believe that private airlines in Europe are not monitored thoroughly. We have companies that offer flights for 5 or 10 euros. They have to cut their costs somewhere.
BTW, I don’t believe that isolated cases can give us a general idea about training standards in France. Let’s not forget that they build Concordes and Airbuses (which are much safer than boeings), they can’t be amateurs.
Comments on this entry are closed
Previous: SF parking sign | Main | Next: frozen Thai seafood curry
Cockpit alarms have ALWAYS been a problem. Too many alarms that sound alike. Too many false alarms. Too little difference between critical & non-critical alarms. I have heard of cases of pilots taping over an alarm horn because the excessive noise was annyoing.
Posted by: Gary Edstrom at September 7, 2005 11:15 AM