The Human-Machine Interface, Human Factors in Aviation, NASA
By definition, aviation involves humans operating aircraft, and every aspect or function of modern aviation employs a human-machine interface in some manner or form.
Whether between pilots and their aircraft or otherwise, the human-machine interface is a bi-directional communication conduit between human and machine. Each must communicate effectively with the other to realize safe and efficient flight operations.
The human-machine interface is complex and the subject of much research and study within the aviation community. Interface design is continually being improved to minimize errors that occur, and sometimes originate, at these junctures.
Nevertheless, missteps still happen. At an interface, information may be misinterpreted or not seen by the pilot or operator. Faulty or unreliable information may be displayed and ‘received’ as well. Mistakes in operational control inputs or programming can also occur, where the pilot or operator communicates to the aircraft or machine something other than what is intended. Regardless of the origin or nature of an error, the human-machine interface may allow or provide an opportunity to trap the error and improve flight safety.
Here, CALLBACK, NASA’s ASRS (Aviation Safety Reporting System) shares an informal look at Human Factors in aviation, focusing on the human-machine interface. Examine the interfaces in each narrative, when errors may have originated and how they are advanced, and the significance each interface holds in the chain of events.
Unseen, Unretrieved, or Unrecognized
This Dispatcher was informed of a hazardous situation that occurred during a commercial flight. A warning had been issued but was not ‘received’ by the responsible personnel.
■ Radioactive materials were incorrectly loaded in position X that should have been loaded [at position] Y or aft. Ramp called after the flight departed to seek after the fact approval. [I] advised the team and the Duty Officers of the situation. It was determined…based on the low exposure rate, a Transportation Index (TI) of 0.8, that the flight could continue and the crew would be advised on the ground at the destination. The flight was concluded without incident. The cause was due to the Ramp Agent missing the warnings he got from his software to not proceed. Ramp should be more aware of the special handling required by dangerous goods.
A Confusing Communication Interface
An Aviation Maintenance Technician (AMT) described this incorrect interface configuration noted by a B777 Captain. It had already generated multiple operational errors.
■ The Captain reported that the Controller Pilot Data Link Communications (CPDLC) ACCEPT and REJECT buttons were switched.… This caused 2 occasions of erroneous reject responses being sent to ATC. On arrival, the switches were confirmed [to be] in the wrong place (Illustrated Parts Catalog (IPC) 31-10-51-02), and [they were] switched back (Standard Wiring Practices Manual (SWPM) 20-84-13) [to their correct locations].… These switches can be inadvertently transposed.
Cognition, Selection, and Recognition
This CRJ200 flight crew discusses two unplanned, unexpected, automated descents and examines their causes.
From the Captain’s report:
■ I was the Pilot Monitoring (PM). We were leveling at four thousand feet and about 12 to 15 miles out on the ILS.… I was in green needles. ATC assigned a speed reduction [from] 210 to 170 knots and…cleared us for the visual approach. The Pilot Flying (PF) had the autopilot engaged. The aircraft suddenly began a descent and increased speed. I called for the PF to stop the descent. I felt automation was incorrect and stated, “My aircraft,” and disconnected the autopilot and corrected for a 300-to-400-foot altitude loss. At this point, I transferred controls back to the original PF and re-engaged the autopilot. Moments later the aircraft started a descent. Again, I called, “My aircraft,” disconnected the autopilot, and corrected back onto the glideslope and to 170 knots. ATC had advised us for a second or third time that they needed…170 [knots]. We were at 170 knots at his last request, but speed management was not my first priority when detecting and correcting for the unexpected descent. After stabilizing the aircraft, I noted the original PF’s…altimeter read 31.22.… It was determined that the original Pilot Flying was turning the baro knob instead of the NAV SELECT knob when transferring to green needles. In doing so, the aircraft thought we were higher and needed to descend to 4,000 feet. There were no traffic conflicts, and the PF had the correct altimeter settings prior to the approach.
From the First Officer’s report:
■ When changing the navigation source from FMS to LOC, I inadvertently spun the baro knob instead of the NAV SELECT knob.… We must look at what we are moving and verify [that] the input causes the desired results afterward. It would be wise to change the baro knob to one that has a different tactile feel than the NAV SELECT knob. The knobs are identical and close to each other on the…panel.
Faulty Information “Received” and Believed
This air carrier pilot describes a Controlled Flight Toward Terrain (CFTT) event and digs down to a root cause.
■ We were cleared for the visual approach to [Runway] 28R from the arrival. I set the altitude to 6,000 for the FAF of ZIXIP. My original plan was to fly toward the FAF at 6,000 [feet], then turn base leg, then [turn] final just inside of [the FAF] to start my descent after being fully configured. I decided to turn earlier and mistakenly followed what I thought to be my glide slope; therefore, I believed myself to be too high and needing to descend for a stabilized approach. Turning base to final, we got an audible alert of “OBSTACLE,” for which I was searching outside but did not see. Then at the Captain’s prompt suggestion, I tried to level off but was not aggressive enough. The slow descent resulted in a “PULL UP” alert, and I was able to maintain altitude, but the Captain noted the radio altimeter…around 650 [feet] AGL. I was able to continue my turn from base to final stabilized and had no other incidents with the event.
[Factors included a] lack of situational awareness on my part and a last-minute decision to keep a tighter traffic pattern, which would require compressed time to configure the aircraft. Mainly, my mistake [was] in believing and following a false glide slope, which lead to my confusion. [I plan on] following the ILS profiles even in Visual Meteorological Conditions (VMC) for terrain and obstacle clearance [while] keeping my situational awareness outside…the cockpit more and remaining vigilant…in VMC.
An Unconventional Operational Interface
This CRJ700 First Officer manipulated an aircraft system at an inopportune time. Results were serious and surprised both Captain and First Officer during a critical phase of flight.
■ I was the PF. The right thrust reverser was inoperative and disabled by Maintenance; the left thrust reverser was available for use. After touching down and de-rotating, I deployed the left thrust reverser. When I attempted to move the thrust lever backward from idle reverse to increase reverse thrust, I found that the thrust lever would not move, and my hand position somehow felt different from usual. In that same moment, I realized that, instead of lifting the thrust reverser unlock lever, I had lifted the shutoff lock and moved the thrust lever into shutoff, shutting down the left engine. I called out the problem to the Captain and told him I would be using only brakes to stop the aircraft. There was plenty of runway remaining, and heavy braking was not required. We taxied to the gate using normal single engine taxi procedures.
After performing several thousand landings in this aircraft, I have a well-developed muscle memory for engaging reverse thrust. I also have a well-developed muscle memory for shutting down the left engine during taxi. With the right thrust reverser disabled, thrust reverser use required touching and moving only the left thrust lever instead of both thrust levers. I am fairly certain that this interaction with only the left thrust lever subconsciously triggered the muscle memory motions for a left engine shutdown instead of those for activating the thrust reverser(s), which usually involves moving both thrust levers. I had landed the same aircraft the day before with the same inoperative right thrust reverser and properly deployed only the left thrust reverser. I have no other explanation for how I managed to perform the motions for an engine shutdown instead. I will be much more aware of this possibility for inadvertent, incorrect hand motions possibly caused by muscle memory triggers when operating an aircraft with a deferred thrust reverser.
Information for Confirmation
Engine status was available via normal procedural interface, but neither Captain nor First Officer took note. Fortunately, a hazardous situation was resolved without damage or injury.
■ After deplaning the aircraft…[my] Captain was informed by the Captain of the next crew that the Number 2 Engine had been left running. Maintenance and weather delays caused our last leg of a 4-leg day to arrive…two hours late and within 30 minutes of timing out. In a rush to hand the aircraft over to the waiting crew, we ran the parking checklist, but we did not verify that the engine was shut down on the EICAS during the parking checklist. The Captain only visually confirmed that the start/stop selector was in the off position, and due to the thrust lever being positioned slightly advanced, the engine never shut down.
The Captain receiving the aircraft notified [my] Captain that the engine had been left running and shut it down. I was informed…the next morning.… Confirm what the Captain says during the checklist…instead of just accepting it.
Source for content and featured image: CALLBACK, A Monthly Safety Newsletter from The Office of the NASA Aviation Safety Reporting System,
Issue 505, NASA Aviation Safety Reporting System, February 2022: “The Human-Machine Interface.”
Circumstances can crop up anywhere at any time if proper and safe sequence and procedures are not planned and followed. We encourage you to learn and use the TapRooT® System to find and fix problems.
TapRooT® has a team of investigators and instructors with years of extensive training ready to offer assistance worldwide. We also offer ongoing support to our clients through free newsletters and root cause tip videos, the root cause analysis blog, and our annual Global TapRooT® Summit.
Register for one of our courses. We offer a basic 2-day course and an advanced 5-day course. Contact us or call 865.539.2139 about having a course at your site or for further root cause analysis opportunities. We’re here to find solutions for you.
Contact us to discuss training your employees on-site. You may also call us at 865.539.2139 to speak to an instructor, schedule an executive briefing, or book on-site training for your team.
