ASPECTS OF AIRCRAFT DESIGN

THAT ENHANCE SAFETY

An aviation safety article

written by

Alex PATERSON

http://www.vision.net.au/~apaterson/aviation/aircraft_design.htm

Last Updated: 21 September 2007


MASTER INDEX of articles written, posted online, or recommended by Alex Paterson



INTRODUCTION

Most aircraft disasters are the result of inappropriate action or actions carried out by the pilots involved - a process euphemistically known as "pilot error". Whilst the term "pilot error" is often seized upon by airline management, aircraft manufacturers and government aviation safety authorities to shift the blame for the disaster entirely onto the relevant aircrew (who are usually dead), it is often a gross over simplification of a far more complex situation. 1

Aircraft disasters are invariably the result of a chain of events culminating in the disaster itself. Many of the factors involved are insignificant in their own right, but when combined with other nominally insignificant factors they can result in a chain of events in which the pilots involved become mentally overloaded and confused as to what is happening and they begin to carry out actions inappropriate for the situation at hand. 2

Poor aircraft system and cockpit design is often a significant causal factor as to why aircrew become confused and begin to mishandle the situation they find themselves in.

Investigations into aircraft crashes continually reinforce the fact that air safety is best served by having competent, well trained pilots operating relatively simple aircraft under the auspices of succinct Standard Operating Procedures (SOPs).

Unfortunately, aircraft manufacturers and the management of many airlines continue to ignore this fundamental truth. Attempts by some aircraft manufacturers, particularly Airbus, to automate their aircraft to the extent that they could be operated by inexperienced, poorly trained pilots are destined to fail. More disturbingly, the increased automation of the new generation of 'electric' jet has resulted in them becoming manifestly more complex than earlier jets and in the process have introduced a whole new raft of dangers associated with that complexity.

The following article briefly discusses some of the dangers inherent in poor aircraft design, euphemistically known in the aviation industry as "Pilot Traps".

'Pilot Traps' are hereby defined as cockpit or aircraft design features that tend to confuse pilots and 'sucker' them into making inappropriate decisions.

Readers are invited to agree with, disagree with, or seek clarification about any of the material listed below or make suggestions about any aspect of aircraft design they think should be included in any future updates of this article.

Alex Paterson (May 2000)


SITE INDEX

THE PHILOSOPHY OF GOOD AIRCRAFT DESIGN

SPECIFIC ASPECTS OF GOOD AIRCRAFT DESIGN


THE PHILOSOPHY OF GOOD AIRCRAFT DESIGN

Keep it short and simple. (KISS) Aircraft systems and procedures need to be designed in such a way that they are as simple as possible commensurate with the task required of them. The design must reflect both good ergonomics 3 and a conscious effort to minimize 'pilot traps.'

Air safety is best served by having competent, well trained pilots operating relatively simple aircraft under the auspices of succinct Standard Operating Procedures (SOP).

Airline safety is inextricably linked to the exercise of sound flight management and that is not possible unless pilots have a comprehensive understanding of their aircraft systems and performance and what is going on around them. In the initial confusion that always accompanies an unexpected inflight emergency, pilots are much more likely to remember how a system works and then how to safely manage the problem if the system itself is relatively simple. A complex system is far more likely to lead to an aircrew misinterpreting what is going on (i.e. a loss of situational awareness ) which in turn virtually ensures the aircrew will mishandle the situation confronting them. 4

Emergency drills should be kept as short and simple as possible. It is a fundamental truth that a two (2) step procedure presents twice as many chances to be mismanaged as a one (1) step procedure.

__________________________

Pilots' eyes and their mental concentration should be focussed on one of two places during critical phases of flight such as takeoff and landing or during an inflight emergency - those being on the flight instruments and/or out the cockpit window. Aircraft systems and procedures (both normal and abnormal) that require pilots to take their eyes away from either of these two places at critical stages of flight are potential death traps.

In the initial confusion associated with an unexpected inflight emergency, it is essential that both pilots confine their focus of attention to flying the aircraft, preferably up away from the ground. 5

This procedure requires both pilots to monitor their respective flight instruments, especially when in Instrument Meteorological Conditions (IMC). Once the aircraft's flight path has been stabilised (preferably going up), the attention of one pilot can then be diverted to address a specific task at hand, such as retracting the gear and flaps and/or dealing with the inflight emergency, whilst the other pilot continues to solely monitor the flight path of the aircraft. (i.e. one pilot continues to fly the aircraft) It is clear that under these circumstances there is very little opportunity for any meaningful crosschecking of an emergency drill in most two (2) crew cockpits, hence the need for either very simple aircraft systems and/or a flight engineer. 6

Some items requiring the pilot not flying (PNF) to momentarily take his/her eyes off the flight instruments are probably unavoidable. Retracting flaps and landing gear, for instance. However, the introduction of a host of distracting new items should be avoided. The requirement to continually reset the airspeed bug with each flap configuration change in modern 'glass cockpit' (EFIS) aircraft is a case in point. 7

Aircraft designers should be cognisant of this basic premise when designing cockpits. Most contemporary 'glass cockpits' fail to satisfactorily address this important issue with their Performance Data Computers (PDC), Navigation Computers and Crew Alert Systems (and their respective controls) all located down on the centre control panel between the pilots out of view of either the flight instruments or cockpit window.

 Return to 'Autothrottle' section of article.

__________________________

All aircrew actions must be monitored and/or crosschecked. Safe airline operation is predicated on all pilot actions, including emergency procedures, being monitored and/or crosschecked by the other pilot and/or the flight engineer. This is only really possible in a three (3) crew cockpit or a very simple, well designed two (2) crew cockpit.

NOTE: In the author's experience, the only two (2) crew jet cockpit that goes anywhere near to meeting the criterion of all aircrew actions being crosschecked and having aircrew continue to monitor their flight instruments during critical stages of flight, such as takeoff and landing, is the 40 year old DC9 cockpit and MD8x series aircraft. The current generation of two (2) crew Boeing and Airbus aircraft do not meet both these criterion, especially with respect to their engine fire drills.

__________________________

Feedback. Ideally, pilots should receive feedback about aircraft response and behaviour through at least two senses, if only for confidence-inspiring redundancy. Sight and sound are the primary senses, but tactile inputs and feedback (i.e. movement, feel and response of controls and the aircraft) complement visual feedback and as such are very important, especially in high workload situations in which diverting one's visual attention away from primary tasks such as monitoring flight instruments during an auto-land, is potentially dangerous.

NOTE: The current generation of Fly by Wire (FBW) Airbus aircraft are potentially very dangerous because they do not provide pilots with any tactile feedback associated with the operation of their primary flying controls or engine power levers.

For more on this subject see the auto-throttle and flying controls sections below.

__________________________

Aircraft should be designed to facilitate what machines and humans each do best:

Humans are poor at monitoring tasks because monitoring (e.g. watching paint dry) is so boringly monotonous the human mind tends to drift on to more interesting things. In contrast, a machine can be designed to stolidly monitor a single parameter for its entire life (e.g. an alarm clock).

__________________________

Machines (computers) should be used to monitor aircraft systems and pilot performance and provide audio and visual alerts whenever specified parameters are exceeded. The increasing use of computer-generated 'voices' to advise aircrews about problems or when pre-defined parameters are being exceeded is a positive trend. (e.g. Ground Proximity Warning System)

__________________________

Pilots should make all of the operating decisions pertaining to a flight. Humans have a remarkable capacity to swiftly assess and respond to rapidly changing circumstances. This is their forte. Except in clearly defined circumstances, such as an autoland procedure, computers should not have primary control over an aircraft at critical stages of flight such as takeoff and landing.

__________________________

Automation should not be taken to the point where pilots lose basic airmanship skills and are lulled into a false sense of security about the infallibility of the 'machine'. Unfortunately, many pilots (including the author) feel the crossover point may already have been passed and as such we can expect a spate of avoidable airline disasters over the next 20 to 30 years associated with the widespread loss of basic flying skills amongst the next generation of pilots and the attendant phenomenon of pilot disassociation. Pilots of Airbus 'Fly by Wire' aircraft are particularly susceptible to this insidious problem as the aircraft is normally flown almost entirely in the equivalent of Boeing's 'Control Wheel Steering' auto-pilot mode. 8

For more on this subject see the auto-throttle and flying controls sections below  .

__________________________

Computers are aids to pilots, not their replacement. At the present time there is no artificial man-made substitute to having properly trained, competent pilots in the cockpits of aircraft. All aircraft systems and computers should be designed as aids to pilots, not as their replacement. Attempts by some aircraft manufacturers and airlines to replace seasoned competent pilots with minimally trained aircraft 'technicians' flying overly complex 'automatic' aircraft is a dangerous practice and will inevitably result in avoidable aviation disasters. 9

RETURN TO SITE INDEX


SPECIFIC ASPECTS OF GOOD AIRCRAFT DESIGN:

The following items are listed in alphabetical order.

Airspeed bug

On approach and takeoff, the airspeed 'bug' should automatically re-set itself to the new minimum airspeed whenever the flap configuration is changed. A 'bug', just for the record, is a colored pointer which pilots set around the dial of their airspeed gauge as a reminder of important speeds &endash; such as initial takeoff climb out speed (V2) or minimum approach speed for landing (Vref). In current aircraft (May 2000), any flap configuration change requires at least one pilot to manually reset the airspeed 'bug' using figures obtained from their memory.

The 40 year old DC9 aircraft had such an automatic system, albeit analogue, associated with the autothrottle on approach to land. The approach speed 'bug' on the airspeed indicator, received its signals from the angle of attack vane and was set automatically with each change of flap configuration. It was an elegantly simple system.

A modern digital equivalent could be designed to set the bug at the minimum Vref (manoeuvring speed) for a particular flap configuration, with a knob allowing pilots to quickly dial in a "speed additive" over and above the minimum Vref speed schedule calculated by the aircraft computers. (see fig. 3 below  )

RETURN TO SITE INDEX

_____________________________

Angle of Attack Instrument

All fixed-wing flying is closely related to Angle of Attack (AoA). Surprisingly, there is no instrument in the cockpit providing this information directly to pilots, even though all airliners have an Angle of Attack vane located outside the airplane and angle of attack information is fed to the aircraft flight computers and anti-stall system (e.g. the stick-shakers). Whilst angle of attack can be inferred indirectly from the airspeed indicator, it is predicated on pilots having accurate knowledge of the weight of their aircraft, something that most pilots know through 'feel' and performance degradation is often incorrect. If nothing else, an angle of attack instrument would help pilots determine whether or not their aircraft is overloaded. There are many pilots who learned to fly by Angle of Attack (AoA) in the military and their initial reaction to the absence of an AoA indicator in an airliner cockpit is a mixture of amazement and dismay. These pilots believe that several fatal airline crashes could have been prevented if the pilots involved had just had accurate information about their angle of attack and how hard they could pull back the control column without stalling the airplane (or if the shuddering they were encountering was Mach buffeting at high altitude).

It is the author's opinion that an AoA instrument should be located next to or directly below the Airspeed Indicator. (see fig. 1 below  )

Apart from providing pilots with a direct indication of how close an aircraft is to the stall angle (stall protection), an Angle of Attack (AoA) instrument can also be used for many performance applications such as:

Source: Gary Williams (email: gww@pacific.net.sg)

RETURN TO SITE INDEX

_____________________________

Autospoiler

In theory, many automatic features such as autospoilers are an excellent aid to pilots. However, the problem with them is that they tend to deskill pilots about the system that has been made automatic and have the potential to fail and let pilots down at the worst possible time, and because they usually work so reliably most of the time their failure usually goes unnoticed in the heat of the moment. This is an insidious problem which defies easy answers (except perhaps to dispense with many of them) and for this reason many pilots (including the author) are somewhat sceptical of anything that has 'auto' in its name.

Operating spoilers manually on landing soon becomes a reflex action to any competent pilot (and a satisfying one at that). It is the author's personal opinion that autospoilers are more trouble than they are worth and can be potentially very dangerous when they don't automatically deploy, as American Airlines Flt 1420 crash at Little Rock on 1st June 1999 demonstrated.

NOTE: Many pilots may not agree with the author's opinion on this issue.

Be that as it may, autospoilers are here to stay whether pilots like them or not. To ensure their safe operation, the said system should:

RETURN TO SITE INDEX

_____________________________

Autothrottle

The throttle levers should physically move in response to power changes initiated by the autothrottle system. This feature provides both tactile feedback to the pilot flying (whose hands should be on the throttle levers during critical stages of flight anyway) as to what the engines are doing, as well as providing better visual reinforcement to both pilots when their hands are not on the throttles. Pilots are more likely to notice a throttle lever moving than changes to numbers spinning up and down on a digitized engine instrument. The Airbus design features non-moving throttle levers and as such does not meet this criteria.

NOTE: Airbus engineers claim that the non-moving throttle lever is only intended to indicate the throttle setting commanded by the pilot and that the engine instruments provide pilots with information as to what the engines are actually doing. This design philosophy completely goes against a basic premise of good airmanship whereby the eyes (and attention) of both pilots should be focussed on their flight instruments and/or looking out the cockpit windows at critical stages of flight such as takeoff and landing and should not be looking at engine instruments. For want of electric motors to move the throttle levers an aircraft could be lost. Whatever the airplane is doing should be intuitively apparent to its master at all times.

For more on this subject see  'Pilot Eyes' section above  and the  Flying Controls section below 

  Return to 'Feedback' section of article above 
  Return to 'Automation' section of article above 

RETURN TO SITE INDEX

_____________________________

Checklists - Normal

Normal flight operations checklists are best served by a mechanical "shopping list" device located on top of the glareshield. (i.e. above the autoflight mode control panel, refer to Fig. 3) The advantages are numerous:

By contrast, electronic checklists generally are located at the bottom of the center instrument panel, requiring pilots to look down into the cockpit at crucial times, such as during the approach to land. Indeed, the lower center-panel location can be dangerous even when the airplane is taxiing - as evidenced by the case of a jet that collided with a truck in the terminal area partly due to the fact that the pilots were performing the checklist at night whilst taxiing to the gate.

RETURN TO SITE INDEX

_____________________________

Checklists - Abnormal/Emergency

Emergency checklists (Recall items) are best carried out using dedicated, 'emergency' books (e.g. Red cover) located next to each flight crew station. The checklists should use large print designed to be read at night in poor light or a smoke filled cockpit. All emergency drills should be as simple as possible.

Abnormal items checklist (i.e. Reference items) should be listed by system in a separate book (e.g. Yellow cover) located at each crew station.

Performance Data should be located in a separate Quick Reference Handbook (QRH) and/or plasticised card.

The advantages of performing emergency/abnormal checklists from dedicated thin plasticised books include:

By contrast, contemporary electronic emergency checklists (EICAS) tend to 'fracture' pilots' focus of attention as they require pilots to look down into cockpit to read the EICAS checklist located on the centre Engine Instrument Panel then back up to the overhead panel to where most system switches are located. The process of looking down, then up has the potential to contribute to pilot misinterpretation and mis-selection of switches etc and also can lead to pilot disorientation and vertigo, especially when performed in cloud at night. 12

NOTE: Boeing's Quick Reference Handbook (QRH) is a confused mess as it contains emergency items, abnormal items, some performance data and some normal check lists. In the opinion of the author, it is a jack of all trades and a master of none.  

RETURN TO SITE INDEX

_____________________________

Electrical Fire and the case for a 'Virgin' Electrical Bus

Most jet transport aircraft are very poorly designed with regard to the protection, detection and effective handling of in-flight electrical fires, as the Swissair Flight 111 crash off Nova Scotia on 2nd September 1998 tragically demonstrated.

This situation is exacerbated by the widespread use in aircraft of a potentially dangerous electrical wire product called 'Kapton' 13 and the fact that the current generation of airline jet transport aircraft (i.e. Airbus A320, A330, A340 and Boeing B777, MD11) are virtually unflyable without electricity, unlike earlier generation jets such as the DC9 and B737.

VIRGIN ELECTRICAL BUS
Inflight electrical fire would be best handled by the installation in aircraft of a completely separate ('Virgin') standby electrical wiring system which would receive its power from the Aircraft Battery and/or Air Driven Generator (ADG) and which would be used in the case of an in-flight electrical fire to power essential aircraft items normally available under Standby Electrical power. (i.e. those items normally located on the Standby Electrical Bus, Hot Battery Bus and Battery Bus)

In normal operation, the Virgin Electrical wiring system would remain unpowered.

In the event of a suspected electrical fire, the aircrew would simply pull a suitably located (and ideally, illuminated) 'ELECTRICAL FIRE' Handle (a one item drill) which would do the following things:

Clearly the Virgin Bus proposal needs much design work to take into account numerous engineering considerations such as:

NOTE 1: As of December 2000, no jet transport aircraft currently in production complies with the US Federal Aviation Regulations (FAR 25) pertaining to electrical system redundancy in the event of an electrical fire or arc tracking event. 16

NOTE 2: As of December 2000, no jet transport has an effective strategy in place to deal with an inflight electrical fire as evidenced by the current Boeing B777 electrical fire drill which simply instructs the aircrew to "Remove Power" from the effected circuit without providing them with any instructions as to how they should actually identify the affected circuits or remove power from the same. As a minimum requirement, an aircraft electrical fire drill should instruct aircrew to configure the aircraft on Standby Electrical Power in order to remove as much electricity from the aircraft electrical system as possible. 17
COMMENT: In Australia we have a non alcoholic drink called 'Claytons' TM , which is advertised by its manufacturers as "the drink you have when you are not having a drink". In the author's opinion, the Boeing Electrical Fire drill is a 'Claytons' emergency drill - the drill you have when you don't have an effective strategy to deal with the situation.

CONCLUSION:
As mentioned earlier, the current generation of jet aircraft such as the Boeing B777, Airbus and MD11 cannot be effectively flown without electricity, unlike earlier generation jets such as the DC9. If a person had an electrical fire in their house, the first thing that person would do is disconnect the electrical power to the house by pulling the fuses, but this option is not available with aircraft like the B777 and Airbus. The aircraft industry as a whole - that is aircraft manufacturers, aviation regulators, airlines and pilots - have failed to adequately address the problem of inflight electrical fire and are simply burying their collective heads in the sand about the issue. The concept of a Virgin Electrical Bus is a significant step towards providing a solution to this complex problem.

For more on this issue see:

RETURN TO SITE INDEX

_____________________________

 

Engine Fire Warning and Drill

An engine fire is potentially the most acute inflight emergency facing pilots, particularly if it occurs during takeoff right at the moment of liftoff. Immediate action is often critical, especially if the fire warning is accompanied by a badly vibrating, disintegrating engine. For this reason, 'ENGINE FIRE' warning handles should be located on the forward instrument panel, just above the engine instruments, well within the peripheral vision of both pilots monitoring their flight instruments. (see Fig. 3)

The drill itself should be very simple - the manipulating pilot, on confirmation from the support pilot, should only be required to pull the illuminated fire handle to cutoff fuel to the engine (both at the engine and the tank) and twist it to activate the fire extinguisher. Pulling the fire handle should automatically silence the fire warning bell (if it hasn't already been silenced by the support pilot) and disconnect the auto-throttle.

Locating fire handles either in the overhead panel or on the center pedestal between the pilots requires both pilots to take their eyes off their flight instruments and turn their heads, with the attendant risk of both pilots developing spatial disorientation (vertigo) and leaving no-one monitoring the flight path of the aircraft whilst the drill is being carried out. This potentially dangerous situation is further exacerbated by the fact that current engine fire drill of most jet transport aircraft requires the pilot flying the aircraft to:

In other words, a four (4) item drill, presenting the aircrew with four (4) opportunities to get it wrong (i.e. four pilot traps), as opposed to the one (1) item drill proposed by the author.

NOTE: The DC9/MD80 series aircraft are a good example of well designed aircraft with regard to Engine Fire Warning and drill. The Engine Fire Handles are located on the forward instrument panel, just above the engine instruments and well within the peripheral vision of both pilots monitoring their respective flight instruments.  The drill itself is essentially a one item drill - the pilot flying places his hand on the illuminated red handle and on confirmation by the support pilot pulls it to cutoff the fuel at the engine (amongst other things) and then twists it to discharge the extinguisher.

RETURN TO SITE INDEX

_____________________________

Engine Failure Light

On most jet transport aircraft an engine failure is accompanied by a plethora of normally unrelated warning lights associated with the engine failure, such as Generator failure, Electrical Bus failure, Engine Hydraulic Pump failure, low Engine Oil Pressure, low Constant Speed Drive (CSD) oil pressure etc. In the confusion that often accompanies an inflight emergency, this cascade of warning lights has the potential to add to pilot confusion due to information overload. This confusion could be considerably reduced by the installation of specific 'ENGINE FAILURE' warning lights co-located with their respective 'Engine Fire' warning handles on the forward instrument panel, just above the engine instruments and well within the peripheral vision of both pilots monitoring their flight instruments. (see: Engine Fire Warning item above)

'ENGINE FAILURE' warning lights co-located with their respective 'Engine Fire' warning handles on the forward instrument panel provide an unambiguous means of identifying a badly vibrating and/or disintegrating engine that has not been accompanied by an engine fire warning, but which needs to be promptly secured by pulling the respective fire handle to prevent the disintegrating engine hurling debris into an adjacent engine or aircraft wing where the fuel tanks are located. 18

NOTE: Boeing have introduced such a light in their current generation of aircraft.

RETURN TO SITE INDEX

_____________________________

Flight Instrument Design - Analogue versus Digital

The advent of the modern 'glass cockpit' (i.e. EFIS) has certainly revolutionised the amount of information and way it is presented to pilots and much of this change is positive. That said, designers are at a risk of throwing out the baby with bath water with regards to some aspects of cockpit design. A case in point is the Airspeed Indicator.

Many 'glass cockpit' (EFIS) aircraft such as the B777 have dispensed with round analogue Airspeed and Altimeter gauges in preference for digital vertical 'tape' presentations as an integral part of the Primary Attitude Director Indicator (ADI). Whilst such an arrangement may be appropriate for an Altimeter, it is not appropriate for an Airspeed Indicator. Round analogue gauges arcing through 270 degrees provide an instantly noticeable 'picture' with regard to airspeed. This is especially important with regard a sudden decay in airspeed associated with windshear. The actual airspeed 'numbers' themselves are fairly irrelevant; it is the position of the airspeed indicator needle in relation to the orange datum 'bug' that is important.

The assertion by aircraft manufacturers that the presence of windshear is adequately covered by the Speed Trend Indicator now installed in EFIS cockpits entirely misses the point. To many pilots (including the author) a Speed Trend Indicator has become just another indicator requiring additional attention and interpretation and as such has the potential to distract pilots from monitoring the really important primary flight instruments such as the Attitude Indicator, Airspeed Indicator, Altimeter and the Course Indicator on the HSI. The Speed Trend Indicator is simply not needed on an aircraft with a large round Airspeed Indicator, as any speed decay is instantly noted out the corner of the eyes of a competent pilot as he/she scans the rest of the flight instruments.

The same applies to most engine instruments. In many cases the actual 'numbers' on the gauge are irrelevant; it is where the needle pointer is in relation to some datum point, be it an orange 'bug' on an airspeed gauge or a red line section on an oil pressure gauge, that is important. This information needs to be instantly noticeable and not require the reading and interpretation of digital numbers spinning up and down.

RETURN TO SITE INDEX

_____________________________

Flight Controls - Airbus sidestick versus conventional control column

The 1989 introduction of the Airbus A320 witnessed a novel departure from the design concepts of previous civilian jet transport aircraft. Whilst many airline people (including some pilots) were enamoured by the originality of the design, a significant number of pilots (including the author) were sceptical of the design and a decade of service has done nothing to allay that scepticism. The A320 sidestick control is a case in point.

With the introduction of the 'sidestick', Airbus dispensed with the conventional control column normally located between the legs of pilots, arguing that it obstructed pilots' view of the flight instrument panel. Whilst this is true of a poorly designed control column, such as those installed in Boeing B727 and B737 aircraft, a well designed control column does not obstruct pilots' view of the flight instrument panels. There are plenty of examples of aircraft currently flying in which the control column does not obstruct the view of the flight instrument panel, for example the B767, B777, DC9, MD 8x etc.

By dispensing with the conventional control column, Airbus have broken a number of design rules fundamental to aircraft safety and in the process introduced a series of design features which adversely affect aircraft safety.

  1. Pilot control sticks not ganged together. The Sidesticks are no longer physically ganged together meaning one pilot could be signalling the aircraft to descend whilst the other is attempting to climb the aircraft. To be sure, each pilots' control stick has an override button, but in the heat of an emergency this rarely used item can be easily forgotten about. Airbus' control override button idea fails to address the maxim that a two (2) item drill (of operating the control stick and pushing a rarely used button) presents twice the opportunity to go wrong as a one (1) item drill (of simply grabbing the control column and pulling it back). Grabbing a control column and pulling it back is an intuitive action, whereas locating and pushing a rarely used override button is not.

  2. Each pilot control stick is not in the view of the other. Each pilots' sidestick is not readily in view of the other pilot, making the actions of the manipulating pilot less obvious to the support pilot. This, coupled with the fact that the sidesticks are no longer physically ganged together, has serious implications in many situations such as the subtle incapacitation of the manipulating pilot or the training of an inexperienced pilot. Both these points were clearly a significant factor in an incident that occurred in an Ansett A320 on 12 Aug 1991 at Sydney Airport when the captain of the aircraft took over control of the aircraft from his first officer to conduct a go-around from low level to avoid a collision with an aircraft landing on a cross runway. In the subsequent investigation it was discovered that the first officer - whose hand was still lightly resting on his control stick - was inadvertently signalling the aircraft to descend whilst the captain was attempting to climb the aircraft. The aircraft passed within metres of each other. (Source: Bulletin Article dated 29th June 1993 and BASI report Ref No B/916/3032.) What is happening with the aircraft must be apparent to both pilots at all times.

  3. No tactile feedback when hand-flying. There is no tactile feedback to pilots via their respective control sticks as to what the autoflight computers are actually doing with the aircraft when it is being hand flown in 'normal law'. For those unfamiliar with Fly by Wire (FBW) Airbus aircraft, Airbus' Normal Law is the equivalent of Boeing's Control Wheel Steering mode. When the Airbus is being hand flown in 'normal law' the flight computers automatically make corrections to the flight controls if the aircraft deviates off the flight path commanded by the pilot (e.g. due to turbulence etc) without moving the sidestick if the aircraft. This is a serious design flaw as tactile feedback is an important sense for humans to maintain situational awareness as to what the aircraft is doing. (the same criticism applies to the Airbus auto-throttle system) In other words, there is very little 'feel' associated with hand flying an Airbus. This is an insidious situation because not only does it 'insulate' pilots from their aircraft and render them less aware as to what is happening with their aircraft, it also tends to de-skill them of their basic flying skills and lull them into a false sense of security about the infallibility of the 'machine' and sucker them into "blindly following the computer". 9
    What the aircraft is doing must be totally and intuitively apparent to its master at all times and it is clear that Airbus Industries has lost sight of this fundamental design rule pertaining to the safe operation of an aircraft.

  4. No tactile feedback with autopilot engaged. There is no tactile feedback to pilots through the sidestick as to what the autopilot is doing with the aircraft. This is a serious design flaw as tactile feedback is an important sense for humans to maintain situational awareness as to what the aircraft is doing, especially in high workload situations such as an autoland procedure. (the same criticism applies to the Airbus auto-throttle system) As mentioned above, what the aircraft is doing must be totally and intuitively apparent to its master at all times.

  5. No means of mechanical flight control backup. The sidestick makes it virtually impossible to design and build a mechanical means for pilots to have some form of direct control over the aircraft's flight control surfaces in the event of a total flight control computer failure in 'Fly by Wire' aircraft. (i.e. a mechanical flight control system circumventing the aircraft's flight control computers) In the event of a total flight control computer failure, A320 pilots are left with only the secondary effect of rudder and a stab trim in which to conduct an approach and landing, a wholly unsatisfactory state of affairs.

NOTE: The A320 is controlled by seven (7) flight control computers. As each computer fails or falls into disagreement with the majority, it is 'cauterized' by the remaining computers. Each computer failure is accompanied by subtle changes in the 'laws' under which the remaining computers continue to operate. In essence, the A320 presents pilots with seven (7) different aeroplanes depending on the level of computer degradation being experienced. Failure of A320 electric and hydraulic systems renders the aircraft unflyable. Juxtapose this situation with a 40 year old DC9 aircraft which has suffered a complete loss of electrics and hydraulics; - in manual reversion the aircraft still handles and feels virtually the same as a fully functioning aircraft and as such is fully controllable.

  Return to 'Feedback' section of article
  Return to 'Automation' section of article
  Return to 'Autothrottle' section of article

RETURN TO SITE INDEX

_____________________________

Performance Data Computer (PDC)

Performance Data Computers (PDC) certainly have a place in long haul jet aircraft because of the wide variation in weight and consequent change to performance attributes of long haul aircraft between takeoff and landing 12 or more hours later.

However, a PDC is of little use in a shorthaul jet because all the information that can be obtained from it, - such as 'bug' speeds, optimum cruise levels and descent points, - can be easily obtained from a plasticised card located in the each crew station pocket. Further, most performance information should be in the head of a competent short haul pilot anyway. The two things that would be of use to shorthaul pilots from a PDC (especially in remote areas such as the Pacific Basin and Africa) - namely the Point of No Return (PNR) and Critical Point (CP) - are not available despite the fact that all the information to perform such a calculation is available to the PDC!

Like much of the electronic 'gadgetry' being foisted upon pilots, the PDC tends to deskill pilots by encouraging them to dispense with 'ball park figures' in their head and blindly trust the computer instead. At the same time the existence of a PDC encourages pilots to bury their heads down in the cockpit tapping away on a computer when they could be better employed looking out the window for terrain, weather or other traffic and/or monitoring their flight instruments.

In summary, the PDC is an unneeded, potentially dangerous distraction to pilots in shorthaul aircraft. 9

RETURN TO SITE INDEX

_____________________________

Stabilizer Trim Wheel

As with a moving autothrottle, a spinning stabilizer trim wheel provides pilots with an unmistakable alert as to a runaway stabilizer (especially on the B727/B737, which can spin pretty rapidly). A wheel also has the advantage of allowing pilots to physically grab hold of it in the event of a runaway trim situation. This arrangement at least gives pilots a few seconds to collect their thoughts and remember just where the stabilizer trim cutout switch is located. (Pilots often forget the location of seldom-used items in the initial confusion of an unexpected emergency) Finally, having secured the runaway trim, the aircraft can then be re-trimmed manually.

The lack of a manual trim wheel on some modern jets is a serious design flaw. These jets include the DC9 and stretched descendants like the Alaska Airlines MD83 that crashed off the Californian coast on 31 January 2000, and in which a runaway stabilizer trim situation was involved. The airplanes without trim wheels feature an aural alert, which emits a "barp" sound with each half-degree of stabilizer trim movement. A poorly trained pilot could easily misinterpret the sound, whereas a moving trim wheel spinning against one's knee is intuitively obvious to just about anyone.

RETURN TO SITE INDEX

_____________________________

Standby Attitude Indicator

The Artificial Horizon or Attitude Director Indicator (ADI) is the central pivot, as it were, of instrument flying and all adjustments to flight attitude are made using this primary 'control' instrument. Everything else is a performance instrument (Power + Attitude = Performance). Because of its importance, most transport aircraft are equipped with a Standby (backup) Attitude Indicator (AI) which, in case of generator failure is connected to standby battery power.

Because of its 'pivotal' importance, the Standby AI should be located within the normal instrument scan of at least the captain so that a failure of the primary ADI will be noticed immediately. Such is the arrangement on the B767. (see Fig. 3) The standby AI is located just to the right of the captain's normal instrument scan. (although it is not located in the best position available; see Standby Instruments section below) This is not the case on most other aircraft. For example, on the MD11 the Standby AI is located at the bottom right center of the instrument panel well away from the normal instrument scan of either pilot.

The twinning of the primary ADI and its backup should be a "sine qua non" 19 of good cockpit design. Pilots suddenly forced to adjust their accustomed selective radial scan and fly totally off of a remote 'peanut gyro' are already halfway to an unrecoverable unusual attitude. If the airplane is on fire and smoke is rapidly filling the cockpit, the need for pairing of primary and backup ADI is all the more apparent. An anxious pilot, with restricted peripheral vision, should not have to try to peer through smoke goggles at the backup horizon located on the lower edge of the center instrument panel. For another thing, a failed ADI is always going to remain centrally in the pilot's natural instrument scan as a potential 'fatal distraction.'

RETURN TO SITE INDEX

_____________________________

Standby Flight Instruments

All transport aircraft should have at least one set of standby flight instruments located directly above, or next to, their primary counterparts on the Captain's flight instrument panel so that they fall within the normal instrument scan of the captain and any discrepancies can be instantly noticed. (see fig 1 below) This set of standby flight instruments should consist of a:

Fig. 1

Fig. 1

 

In the case of EFIS cockpits, it is "sine qua non" of good cockpit design that any failure of the Primary ADI must result in the ADI screen going blank so as not to become a 'fatal distraction' to pilots. Aircraft in which the ADI screen also incorporates the Primary Airspeed Indicator and Primary Altimeter (as vertical 'tapes' either side of the ADI presentation) should have their standby counterparts clustered around the edges of the screen as depicted in figure 2 so as to provide both confidence inspiring verification as to the reliability of the primary instruments as well as an easy means to transition from the primary instruments to their standby counterparts in event of a primary instrument failure.


Fig. 2

Each electronic screen should also have a clearly defined ON/OFF switch located on it to enable pilots to manually turn them OFF in the event of the screen providing suspect information. 21

RETURN TO SITE INDEX


Fig. 3

Improving on a Basically Good Cockpit Design

B767-200

 

Shown above is a schematic of the instrument panel on the B767-200, which the author believes has the basic elements of good cockpit layout. However, I have added a number of significant improvements:

Return to article at 'Airspeed Bug' section
Return to article at 'Checklists - Normal' section
Return to article at 'Engine Fire' Section
Return to article at 'Standby Attitude Indicator' section

RETURN TO SITE INDEX


 

CONCLUSION

There is an adage going back over century which states that "those who design machines rarely use them" and that would appear to be very true with regard to aircraft.

As can be gleaned from the preceding information, minimizing 'pilot traps' through better aircraft design touches on a much larger question: who's driving the bus? Are aircraft designers giving pilots what they need, or what they think the pilots should have? In the author's opinion, it is about time aircraft manufacturers started to listen to what airline pilots have to say about aircraft design and implement the design features airline pilots want instead of imposing upon them overly complicated, poorly thought out features designed by non-pilots.

Alex Paterson (June 2000) 


FOOTNOTES

1. Accidents: Most aircraft crashes are incorrectly portrayed in the media as "accidents". By definition, an accident is "an unforeseen chance event resulting in injury". (Source: Macquarie Dictionary) The key word is "unforeseen". In modern aviation most "chance events" have been "foreseen" and equipment and procedures designed to manage these adverse sets of circumstances in a safe manner should have been put in place by aircraft manufacturers and airline management and aircrew properly trained in the use of the said equipment and procedures.

See: EXTERNAL FACTORS CONTRIBUTING TO AIRCRAFT DISASTERS by Alex Paterson (incomplete)

Return to article

__________________________

2. Pilot confusion is known colloquially in the aviation industry as a "loss of situational awareness".

Return to article

__________________________

3. Ergonomics is defined as the science of matching humans to the machines they work with. Good ergonomics takes into account the strengths of human beings, such as their ability to instinctively assess and deal with a rapidly changing situation. Good ergonomic design recognises humans are fallible and are very poor at monitoring tasks (because monitoring is so boring) whereas a properly designed machine (such as a computer) can be excellent at monitoring tasks. By definition, sound ergonomics is predicated on matching the abilities of machines to its human operator in a manner which is intuitively obvious to the human mind. In other words, the machine should be intuitively simple for a human to operate.

Return to article

__________________________

4. So often, the last thing heard on the cockpit voice recorder (CVR) is "What's it doing now?"

Return to article

__________________________

5. The only exception to this 'rule' is an aircraft decompression and/or cockpit smoke, in which case the oxygen masks of both pilots must be donned immediately.

Return to article

__________________________

6. Flight Engineers: The next generation of four (4) engine long haul Very Large aircraft (600 passengers) will by necessity be relatively complex and as such should include a flight engineer as part of the cockpit crew.

See: 'The Case for a Flight Engineer in Long Haul Aircraft' by Alex Paterson (incomplete)

NOTE: Safe airline operation is predicated on all pilot actions, including emergency procedures, being monitored or crosschecked by either the support pilot and/or flight engineer. This is only possible in a three (3) crew cockpit or a very simple, well designed two (2) crew cockpit. In the author's experience, the only two (2) crew jet cockpit that goes anywhere near to meeting this criteria is the 40 year old DC9-30 cockpit. (and possibly the MD8x series) The current generation of two (2) crew Boeing and Airbus aircraft do not meet this criteria, especially in regard to inflight Engine Fire and inflight Electrical Fire.

Return to article

__________________________

7. 'Glass Cockpit' is a euphemism for Electronic Flight Instrument System (EFIS) cockpits which use computer screens to display information. Computer screens are increasingly being used in aircraft to replace mechanical analogue gauges because:

The main negative aspect of EFIS is that it is encouraging cockpit designers to provide too much information for pilots to assimilate associated with information overload. Aircraft designers should provide pilots with what pilots) say they need, and not what designers think pilots should have.

Return to article at 'Pilots Eyes' section
Return to article at 'Flight Instrument Design' section

__________________________

8. Automatic Devices: A little discussed aspect of automatic devices is that, apart from deskilling pilots, they invariably tend to degrade the actual experience of being a pilot. Most pilots (but not all) actually get significant enjoyment out of manually flying their aircraft and the response (feedback) they receive from an aircraft. It is the conviction of the author, that experience is 'raison d'etre' (reason for) human existence and denying humans the opportunity to experience things for no good reason is destructive to the spirit. If nothing else it is significant reason why so many pilots dislike Airbus aircraft. Airbus have completely lost sight of the dehumanising aspect of auto items and the deleterious aspects of that state of affairs, whereas Boeing would appear to have embraced the importance of allowing pilots to experience the magic of flying with the B777. As an A320 pilot once quipped to the author; "there is no magic flying an A320, when it's all said and done it is a rather empty experience." Any airline that ends up with a substantial percentage of its pilots with that attitude towards their aircraft is asking for trouble because a bored, complacent pilot is a dangerous pilot.

Return to article

__________________________

9. Blindly Following the Computer. For more on the dangers of blindly following the computer see:

Return to article at 'Computers are Aids to Pilots' section
Return to article at 'Checklists - Abnormal/Emergency' section
Return to article at 'No Tactile Feedback when hand flying' section
Return to article at 'Performance Data Computer' section

__________________________

10. Angle of Attack Gauge: The loss of AeroPeru Boeing 757 (flight 603) on 2nd October 1996 is a case in point. The pilots of this aircraft lost control of it whilst attempting to fly it at night using erroneous airdata information. The airspeed and altimeters were presenting incorrect data because the aircraft's static ports had been taped over by maintenance crew and no-one had noticed it prior to takeoff. There is little doubt that had this aircraft been fitted with an Angle of Attack (AoA) instrument, and the aircrew trained in its use, it would have provided confirmation for them to ignore the airdata instruments and trust their Attitude Director Indicators. As such, this incident was survivable.

Return to article

__________________________

11. Positive Verification Checks: A positive verbal verification check protocol whereby the support pilot checks that something has occurred and then makes an announcement to that effect (e.g. "spoilers deployed") has two (2) distinct advantages over a negative silent check in which the support pilot only makes a callout if something has not occurred. Those advantages are:

It is for these reasons that most airlines dispensed with silent checks nearly thirty (30) years ago and replaced them with the 'challenge and response' type check list.

Return to article

__________________________

12. EICAS - Engine Instrument and Crew Alert System. Aircraft manufacturers should consider splitting the functions of the EICAS screen into their separate functions, with the Engine Instrument screen remaining in its present position on the centre forward instrument panel and the Crew Alert System screen being moved to the bottom of the centre overhead panel just above the windscreen (i.e. in the same position as the DC9/MD8x Annunciator Panel). Such a location affords to two (2) distinct advantages:

Return to article

__________________________

13. For more on Kapton wire see:

Return to article

__________________________

14. Arc-Fault Circuit Interrupters (AFCI): There are significant design constraints facing the concept of AFCI circuit breakers for aircraft, not in the least being the likelihood of high frequency attenuation associated with the long lengths of wire in aircraft. Because of these design problems, most aviation electrical experts don't expect to see reliable AFCI circuit breakers in aircraft prior to 2005.

Return to article

__________________________

15. Ground-Fault Circuit Interrupter (GFCI) circuit breakers. GFCI are acknowledged by most electrical experts to be the best way to protect electrical wires, as well as provide some protection to electronic and electrical components themselves, something the current generation of thermal trip circuit breaker cannot provide. However, GFCI require the installation of individual neutral return wires, something which are not utilised in the current generation of jet transport aircraft due to the extra weight of such wires. The current generation of jet transport aircraft use the airframe as the return path of electrical current to save weight.

NOTE: It is worth noting that the use of a metal structure such as an airframe as a current return path is not permitted by electrical safety codes in any other situation except aircraft. These safety concerns are discussed in greater detail in footnote 5 of Aircraft Electrical Fire by Alex Paterson

Return to article

__________________________

16. FAR 25 states in part:

Source: FAR 25 - Electrical Systems and Equipment: http://www.faa.gov/avr/AFS/FARS/far-25.txt

Return to article

__________________________

17. B777 ELECTRICAL FIRE DRILL

SMOKE/FUMES/FIRE ELEC
Condition: A concentration of electrical smoke/fumes or fire is identified.

OXYGEN MASKS AND SMOKE GOGGLES ON
(If required)

CREW COMMUNICATIONS ESTABLISH
(If required)

If smoke/fumes or fire source can be determined:
ELECTRICAL POWER (affected equipment) REMOVE

If smoke/fumes or fire is persistent:
Plan to land at the nearest suitable airport.

Source: Boeing B777 Flight Manual

Return to article

__________________________

18. Engine Failure Light: Considerable thought needs to be put into deciding what parameters and circumstances should trigger the 'ENGINE FAILURE' warning light. It is the author's opinion that only circumstances requiring immediate action (or unambiguous confirmation) should trigger the engine failure warning light. These include:

Items such as low oil pressure, high oil temperature, loss of some thrust without severe vibration, mild engine over temperature, zone over temp associated with a bleed air leak, engine vibration exceeding set thresholds but without significant loss of thrust etc should not trigger the 'Engine Failure' light, but rather illuminate the MASTER CAUTION light and bring up the appropriate advice on the Engine Instrument and Crew Alert System (EICAS) instead.

Return to article

__________________________

19. 'sine qua non' Definition: (noun) something absolutely indispensable or essential . (Source: Websters Dictionary)

Return to article

__________________________

20. For more on the KAL B747 Stansted crash of 22 December 1999 see:

Return to article

__________________________

21. Some pilots carry a stick of Blu-tac in their Nav bags in order to stick a piece of paper over faulty instruments.

Return to article

__________________________

Copyright Alex Paterson (2000)


RELATED ARTICLES:


RELATED WEBSITES:

MASTER INDEX of articles written, posted online or recommended by Alex Paterson


ABOUT Alex PATERSON

Alex PATERSON is an Australian airline pilot. He writes articles and advises on issues pertaining to aviation, politics, sociology, the environment, sustainable farming, history, computers, natural health therapies, esoteric teachings and spirituality.

He can be contacted at:


Photograph of Alex Paterson


COPYRIGHT DETAILS

The document, 'Aspects of Good Aircraft Design' is the copyright of the author, Alex Paterson. All rights reserved by the author. Notwithstanding this, the document may be reproduced and disseminated without the express permission of the author so long as reference to the author is made, no alterations are made to the document and no money is charged for it.


Additional Keywords: A320, ADI, Airbus, aircraft accident, aircraft checklist, aircraft crash, aircraft disaster, aircraft design, aircraft electrical fire, aircraft safety, airline pilot, airline safety, angle of attack, autothrottle, aviation safety, Boeing, CAR 224, checklist, cockpit design, emergency, emergency checklist, engine fire handles, FAR 25, FAR25, flight safety, flightsafety, kapton, pilots dispute, pilot traps, RMI, stabilizer trim

RETURN TO THE BEGINNING