To err is human (Cicero), but to really screw things up requires a computer (anonymous)
Last week the FAA released an Airworthiness Directive (2010-06-09) for the Boeing 777 aircraft to prevent inadvertent engagement of the autopilot during takeoff roll, which could result in a rejected takeoff and subsequent overrun.
According to the FAA there have been nine reported instances of this occurring since 1995. The problem occurs when the aircrew accidentally select the autopilot on the ground during the low speed roll phase.
Why the crew would do this is not exactly clear, but there does seem to be a consensus that it’s because pilots are mistaking the B 777 left autopilot switch on the Mode Control Panel (MCP) with the EPR (1) switch located in roughly the same spot on the MCP on earlier models (for example the 767).
So, the solution is pretty simple right? Just interlock the A/P to prevent inadvertent actuation during takeoff and disengage the A/P, if operating, prior to takeoff. Case closed.
But, there are a couple of deeper issues that come out of the incident. The first one being what level of hazard analysis was undertaken by Boeing when changing the MCP from previous layouts?
The likelihood of crew ’slip’ type errors when using an interface that is ‘almost but not quite’ the same is quite predictable. Anyone whose transitioned from a right hand to a left hand drive car has undoubtedly experienced these types of errors.
So when modifying the MCP switch locations was a human error analysis conducted by Boeing that looked at the interaction of ‘old pilot-old skills’ with the ‘new aircraft new MCP display’ layout? The answer I think is probably not, or at least not one that was effective.
The second issue is once again the recurring theme of ‘strong but silent’ automation, in this instance the aircraft transitioned to a mode of operation without the crew being aware. This of course led to both the crew and autopilot thinking they were flying the aircraft at the same time.
Now when human crew transfer control there’s a specific protocol that includes verbally confirming who’s flying the plane. Would it be too much to ask that the same be included into the interface design of future autopilots?
Less automation as prosthesis, and more automation as partner please.
1. The EPR switch is used to engage the auto-throttle to hold the referenced engine power displayed on the EICAS glass displays.