6
$\begingroup$

I have trouble wording this question, please bear with me.

Sullenberger recently stated that the pilots of the fatal MAX flights where likely under sensory overload caused by "multiple, compounded alerts". Which makes me wonder: As a general rule of thumb in modern commercial aviation, do we try to alert pilots of the cause of an issue (this or that part is out of order, e.g. we lost a hydraulic pump), or of the effect (we cannot move the control surface anymore)?

  • Only alerting of the cause might make them overlook effects.
  • Only alerting of effects might take away a chance to solve/remedy the issue.
  • Alerting of both might be the overload mentioned before.

Or is there another system in place, like filtering or at least ordering warnings by severity? I am a software architect by trade, and we always go with "display the error in the earliest possible step, and ignore the rest." The rational is: Do not distract me with the facts that my paint job is getting blisters and my tires are flat, if we already determined that the car is on fire.

$\endgroup$
5
$\begingroup$

John K's answer is great for older designs like the Boeing 737. You specifically mentioned the 737 MAX crashes, which (despite being quite a new design) still uses the old cockpit alert philosophy based on the 1960s design of the first 737. Things have however changed a bit since then.

Both Airbus and Boeing have developed systems that come a bit closer to what you call "effect-focused". They will still tell you the source of the problem, but also provide a solution and list important effects.

Airbus calls this the ECAM (Electronic Centralized Aircraft Monitor). Here is an example from an A380:

A380 ECAM
(Airbus A380 FCOM - Indicating/Recording - ECAM - System Description)

On the left you can see the Caution message in amber (in this example, a low pressure in the green and yellow hydraulic systems). The checklist directly below is what the pilots would go through as a result of this failure. This is equivalent to looking this checklist up in the paper QRH, but having it on screen is faster and you can't accidentally go through the wrong checklist. Below the checklist, there are some effects (in this case: the pilots should be aware that the slats will extend more slowly) and limitations (here maximum airspeed of 200 kt) shown. After working through the checklist, the screen on the right would be shown with more limitations for the different phases of flight.

Boeing uses a similar system called EICAS (Engine Indication and Crew Alerting System) on their newer designs (747 since the -400, 777 and 787; I think also 757/767 after avionics upgrade). The 737 (including the MAX) is not equipped with EICAS. Here is an example from the Boeing 777:

Boeing 777 EICAS
(Boeing 777 FCOMv2 10.50.4 - Flight Instruments, Displays - Electronic Checklist Displays)

You can see a similar caution message in amber at the top (for low hydraulic pressure in the center system). Below is a description of the problem and an interactive checklist to go through. At the bottom you find a list of inoperative items affected by this failure.

$\endgroup$
3
  • $\begingroup$ His question is about whether the message itself relates to the root event or the potential final result of the event. The newer ECAM and EICAS systems just present the QRH data along with the message electronically, which still doesn't really get into whether the message describes the potential final result. $\endgroup$
    – John K
    Oct 19 '20 at 12:46
  • $\begingroup$ @JohnK The caution/warning message is still about the root event, sure. But you can see some effects from this failure (like SLAT SLOW in the A380 example) under the checklists. These probably also appear in the QRH. I think this is exactly what OP wanted to know. $\endgroup$
    – Bianfable
    Oct 19 '20 at 12:56
  • $\begingroup$ Yes, whatever's on the display will be what is in the QRH and there is likely still a paper QRH on board as a backup. What the OP wanted to know is whether the warning itself referred to the precise failure parameter, or referred to the ramifications of the failure, is how I interpreted it. In any case, all the bases are covered I'd say. $\endgroup$
    – John K
    Oct 19 '20 at 17:14
9
$\begingroup$

They are source focused. They display precisely the condition that exists, not the follow-on effects.

WARNING indications that could be dangerous if not acted on right away are Red. Indications that must be taken into account with some action but are not an immediate danger are called CAUTIONS, and are Yellow. Indications that just indicate a status condition, like a loss of redundancy which does not degrade function but needs to be addressed on the ground, are Status messages, and are White.

Most indications are just exceedances of some parameter above or below a limit, like an idiot light on your car.

Examples:

"GEAR BAY OVERHEAT" would be a red WARNING that tells you that the temperature in the landing gear bay exceeded a certain temperature. Not necessarily that there is a fire.

"L ENG LOW OIL PRESS" would be a red WARNING that tells you the oil pressure dropped below x psi. Not that the engine is about to blow up from lack of lubrication.

"R SCAVENGE EJECTOR" would be a yellow CAUTION indicating that the output pressure of the scavenge pump in the right fuel tank is below X psi. As a Caution, it needs to be acted on in some way, but it's not a danger right now.

The protocol is, a message tells the pilot exactly what condition was exceeded or what failed. What to do about it is found in the Quick Reference Handbook that is usually stowed at the base of the center console where both pilots can reach it. It's a binder with a tall narrow page format, with all of the Caution and Warning messages cataloged by system, and a logic flow chart presentation for each with a procedure for each CAUTION and WARNING that is to be followed, that is meant to be easy to follow in a dark cockpit while under stress.

Only a small number of WARNING conditions expect the pilot to deal with the condition from memory. These are called "Memory Items" or "Immediate Action Items", and you're expected to be proficient and doing steps A B C D immediately from memory. The QRH is consulted later to perform an expanded procedure when safe to do so. There might be half a dozen or a dozen WARNINGs that have memory items that need to be performed as soon as the warning appears, and you have to have nailed down in your mind so your hands just fly around automatically when they happen.

For example, an engine fire on takeoff has a series of Memory Items, done as a standardized drill: thrust lever to idle (with a protocol where each crew cross checks and confirms the actions), thrust lever to fuel shutoff, Fuel and Hydraulic Shutoff button push, Fuel boost pump off, Fire Extinguisher Push if the fire indication hasn't gone out, and so on. For that sort of thing, you drill those sequences until you're blue in the face and can perform the steps without having to think about them, while under intense pressure and distraction.

Another one would be a depressurization event. After the crew gets their masks on and establishes communication with each other through the mask mics, you declare "emergency descent", slam the thrust levers to idle, pop flight spoilers fully out, dial the autopilot altitude select to 10000 ft, engage autopilot speed mode, causing the plane to pitch over to maintain the speed with the thrust removed, and dial the speed setting to maximum operating speed (Vmo). Those are the memory items. Once settled down in the descent with the autopilot holding the airplane in a shallow dive at redline speed (if you think something structurally is compromised after a "big bang", company procedures may advise staying at current airspeed in the dive instead of accelerating to Vmo), the non-flying pilot gets out the QRH and you go through the expanded depressurization procedure together.

Messages will generally be prioritized when multiple messages appear, and lesser importance ones filtered out when a lot of conditions are set. And a lot of messages are inhibited during the takeoff process because they can wait.

WARNING messages will often be accompanied by CAUTIONS, but multiple WARNINGS are unusual. Getting multiple WARNINGS in a situation where you are already surprised by seemingly nonsensical activity (like trim wheels spinning madly for no apparent reason) can push you toward brain lock unless you've trained yourself, or have the right instincts. Boeing thought that the trim wheel spinning madly for no reason could be dealt with using the Stab Trim Runaway procedure, but stab trim runaways don't generally include the trim running wildly, then stopping, then starting again, then stopping again.

At some point you have to just ignore all the data and just fly the plane. But that's pretty tough when the plane is trying to dive itself into the ground seemly possessed by a demon, in addition to all the garbage being presented as messages. It's not hard to imagine anybody going into brain lock with that kind of data explosion combined with bizarre behaviour.

$\endgroup$
7
  • $\begingroup$ Thank you for response and all the effort it must have taken. $\endgroup$ Oct 19 '20 at 1:44
  • $\begingroup$ For current guidance refer to AC 25.1322-1 Flightcrew Alerting. With the B787, the FAA applied Special Conditions to improve crew alerting. The result of the B787 certification was an update to 14 CFR §25.1322 and the creation of the AC. $\endgroup$
    – Gerry
    Oct 19 '20 at 2:24
  • $\begingroup$ No worries I was in the industry many years both on the flying side and product development/support side. Didn't take long to write. $\endgroup$
    – John K
    Oct 19 '20 at 4:14
  • 1
    $\begingroup$ Didn't you forget the very first, and most important, item (or three, actually) for depressurization? $\endgroup$
    – Jan Hudec
    Oct 19 '20 at 6:45
  • $\begingroup$ If you're talking about dialing 7700, calling the Mayday and announcing to the cabin, those aren't IAIs. $\endgroup$
    – John K
    Oct 19 '20 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.