On the Design of Flight-Deck Procedures - Intelligent Systems ...

solution involves “anchoring” a “man-made” waypoint at an arbitrary distance (100 miles typically) on abearing of 347 degrees from FL 11 . 12Guideline #8: The procedures designer must be mindful of the limitations and capabilities ofthe device he or she is designing a procedure for. Devices that are well designed for the humanuser require minimal procedurization. Less robust devices will require more thought on thepart of the designer, and will probably require more complex and lengthy procedures.Electronic checklist displays are highly demanding of compatibility between the procedure and display.The first generation of electronic checklists is currently installed in three air transport aircraft (A-310, A-320, and MD-11). With respect to procedural modifications, these systems are inflexible because thecustomer cannot easily modify the items which will appear on the electronic checklist display, or eventheir order of appearance. For example, one of the procedures in the electrical checklist system is quitecumbersome when performed at a low altitude. To combat this, one airline devised a procedure calledthe “mini checklist.”If engine failure occurs at low altitude and landing is imminent, the ECAM procedure, if sequentially followed,results in turning off various equipment, reactivating the hydraulic system, and then turning ON much of thesame equipment that was just turned OFF. To preclude this, and streamline the procedure, a good technique isto turn ON the green electronic pumps and the appropriate PTU shortly after engine failure in order to reactivatethe affected hydraulic system and eliminate much of the ECAM procedure. It is also a good technique to startthe APU to provide electrical backup. Commonly used terminology is to call for the “mini-checklist” whichconsists only of restoring the hydraulic system and starting the APU as noted above. (If an engine fails duringtakeoff, do not call for the “mini-checklist” until after calling for flaps up).The mini-checklist is a paper checklist which is kept in the cockpit. It lists several items for restoring thehydraulic system and starting the APU. The “mini-checklist,” therefore, is a form of adaptation inhuman-machine systems. A task is “tailored,” or modified, by the human operator to accommodate aconstraints imposed by inflexible devices (Woods and Cook, 1991). This adaptation is required becausethe modified procedure cannot be supported by the existing electronic checklist. The consequences ofsuch inflexibility are that the pilot is required to conduct a procedure (mini checklist) on top of anotherprocedure (ECAM), in order to execute the task. Note that both procedures discussed are performed in ahighly critical and workload-intensive situation -- restoring an essential system after an engine failure atlow altitude.6.1.4 Aircraft Systems and ProceduresA procedure that details how to operate a particular sub-system must be compatible (or correct) in termsof its procedural steps, actions, and flow. The following examples will show how much the proceduraldesigner must be attuned to the engineering aspect of the device (or sub-system). One company’s splitflapprocedure had to be re-written when it was found to be wrong. The problem was traced to the factthat system components that were powered by the standby power unit were different from the standardconfiguration for this model aircraft. The airline apparently did not keep a good record of its ownelectrical system specifications. Such problems, however, are not unique only to airlines. During SpaceShuttle Mission 49, the crew of the orbiter Endeavor tried to deploy a rescued satellite (Intelsat). Theprimary and backup deployment circuits would not send power to the cradle holding the satellite.“Investigation showed that the checklists used in Mission Control and on Endeavor were identical tothose on the other three NASA orbiters. But the problem occurred when circuitry for Endeavor's wiringwas engineered differently and the checklists were not changed to conform with the new orbiter'sdesign.” The problem was finally overcome with the help of engineers in Ground Control (AviationWeek and Space Technology , 1992a, p.79).Likewise, there may be wide differences in aircraft configurations within a given fleet. This sets thestage for the possibility of using an inappropriate procedure in some models. This is particularly true if11 One captain that we interviewed remarked that the 757 (and other glass aircraft equally so) is “a good 'to' airplane, but apoor 'from' airplane.”12 A similar incompatibility that requires a cumbersome procedure is the task of intercepting a jet airway in a 757/767FMS. The procedure requires some 6 steps and two mode changes.32