A new way to crash a plane – mode confusion

Computerized ‘fly by air’ commercial aircraft have created a new type of pilot error: mode confusion.

From Lectures in Aviation Safety, G.F. MARSTERS, PhD., P.Eng.:

The first full authority fly-by-wire civil aircraft, introduced into commercial service by Airbus Industrie, has precipitated myriad new safety issues, primarily related to the way in which the pilot interacts with the aircraft. As new, much larger, and much more fully automated aircraft are planned, these human factors safety issues take on increased urgency. As a result of these complex interactions between the human operator and the machine a new accident “cause” denoted “mode confusion” has emerged, as it becomes apparent that pilots often do not fully understand the logic systems that were introduced to reduce pilot workload and propensity for error. Since about two thirds of all accidents are attributable to human error, reducing the opportunity for such errors is an essential step. Regardless of the level of complexity, the pilot must still ultimately control the aircraft, and to do that, it is essential to have a full appreciation for the way in which the automated systems function and interact. There have been several recent accidents where it is clear that the pilots were unsure of what the aircraft systems were doing, and as a result, took incorrect corrective actions. The accident at Nagoya, Japan is an example of this. In this case, the pilots engaged in actions that contradicted the logic of the autopilot. Not realizing the effects of their efforts, they were unable to take the correct actions, and ultimately lost control of the aircraft. This was a clear case of “mode confusion”.

Mode confusion has caused many accidents in the aviation, nuclear and petrochemical industries.

A similar everyday experience is drivers’ reaction to antilock braking. Ever hit the brakes on a slippery stretch and felt a moment of panic when the brake pedal began chattering? Some drivers unfamiliar with the feel of ABS react by taking their foot of the brake, thinking they’ve pushed too hard and broken something. This very simple form of mode confusion has been the cause of many traffic accidents.

To prevent mode confusion:

  • System users need to have a greater understanding of the logic and automation in the system, and how it can behave in off-nominal situations. (For example, drivers should get used to their antilock brakes.)
  • System designers need to ensure that system interfaces provide cues that notify or remind users about automated actions and states.
  • Importantly, interfaces should not provide feedback that could be misinterpretted during critical moments. (The pulsing of the ABS should not be transmitted back to the driver through the brake pedal, as the notification that ABS is engaged is not useful to the driver.)
  • There should be defence-in-depth within the automation to identify and react to user misoperation in response to automation.

Mode confusion will become a greater challenge as more and more systems (even in daily life) develop greater levels of complexity, automation and intelligence. Mode confusion can also occur when complex, automated systems interact in unexpected ways.

The greatest threat occurs when personnel are required to perform both active tasks (doing something to the system to control it) and supervisory tasks (monitoring the system’s automated behaviour). System designers and users must be aware of this risk when dealing with system components that are automated but autonomous (and thus able to interact to create greater complexity).

Leave a comment

You must be logged in to post a comment.