The computer in the cockpit
Why partial automation can be more dangerous than none at all
ONE WAY to tell who made the aircraft you are boarding is to steal a glimpse of the cockpit. A traditional control yoke in front of the pilots suggests a Boeing; a joystick beside each seat, an Airbus. Pilots argue about which system is better; neither is considered safer than the other. Each exemplifies a different approach to a problem that manufacturers of not just aircraft but also cars, trains and ships must grapple with as long as human operators handle increasingly automated machines.
The challenge of what engineers call the “human-machine interface” has tragically gained attention after the crash of an Ethiopian Airlines Boeing 737 MAX 8 on March 10th. Eyewitnesses reported that shortly after departing Addis Ababa, the aircraft climbed and dived repeatedly. Similarities were drawn with a fatal crash in Indonesia in October last year. That time, the pilots of a Lion Air MAX 8 struggled, also soon after take-off, with an automated safety system that erroneously tried to prevent the aircraft from stalling by lowering its nose.
本月 10 日埃塞俄比亚航空公司的一架波音 737 MAX 8 坠毁后，工程师们所说的“人机界面”难题以悲剧性的方式受到了关注。目击者报告称，飞机离开亚的斯亚贝巴后不久反复爬升又俯冲，与印尼去年 10 月发生的致命事故相似。当时，也是在起飞后不久，狮航一架波音 737 MAX 8 客机的驾驶员无法控制自动安全系统，该系统错误地试图压低机头来防止飞机失速。
Although authorities around the world have grounded the model, Boeing insists that it is airworthy. The company is updating the MAX’s automated flight-control software to make it easier for pilots to assume manual control. Boeing and Airbus both pack their planes with computers that do most of the flying. Each, though, espouses a different philosophy on how a pilot reacts to them, says Mudassir Lone of Cranfield University in Britain. Boeings are designed to make the pilot feel like the aviator in charge. Although the control yoke looks and feels like something from the analogue era, the way it behaves—including shaking when approaching a stall—is created digitally by a computer. Airbus’s joystick is seldom used besides take-off and landing. A sound alerts the pilot to trouble; in an Airbus, he is more supervisor than airman.
虽然各国政府已禁飞 MAX 8 客机，但波音公司仍坚称该型号客机是适航的。波音正在升级 MAX 的自动飞行控制软件，方便驾驶员手动接管飞行。波音和空客的飞机都安装了自动驾驶系统，控制着大部分的飞行操作。但英国克兰菲尔德大学（Cranfield University）的穆达希尔·隆内（Mudassir Lone）认为，两者在处理驾驶员如何对自动驾驶系统做出反应上有着不同的理念。波音的设计令驾驶者感觉自己是操控飞机的飞行员。虽然操纵杆的外观和感觉都像是模拟信号时代的产物，但其动作方式（包括在接近失速时的抖动） 是由计算机以数字方式生成的。而在空客的飞机上，除了在起飞和降落时，驾驶员很少需要用到操纵杆。出现问题时，系统会发出警报声通知驾驶员。在空客飞机上，驾驶员更像指挥官，而不是飞行员。
The big worry is what happens if a sensor feeds the flight-control system the wrong data. This might have happened in the Lion Air crash, according to a preliminary report. Something similar downed an Air France Airbus A330 over the Atlantic in 2009: an airspeed sensor iced over and the ensuing loss of data caused the autopilot to disengage. Unable to work out what was happening, the pilots lost control.
人们最担心的是，万一传感器向飞控系统提供了错误数据会有什么后果。一份初步调查报告显示，狮航坠机事件中可能就出现了这种情况。2009 年法航的一架空客 A330 客机也因类似问题坠落大西洋：空速传感器结冰，系统无法读取数据，导致自动驾驶仪解除控制。驾驶员搞不清楚发生了什么情况，没能控制住飞机。
Switching from automatic to manual is not straightforward. Flight-control systems may not disengage entirely. Instead, they might continue to assist the pilot in an attempt to prevent a dangerous manoeuvre. When things do go wrong, it is critical that pilots follow the correct procedures, which are different for each model of aircraft. Pilots learn these and carry checklists spelling them out. Proliferation of systems necessitates frequent retraining. To make life easier for pilots, the MAX 8 employs a system that makes it feel to them like older, more familiar versions of the 737. But this adds another layer of complexity.
从自动驾驶切换到手动操作不是一件简单的事情。飞控系统可能没有完全解除控制。相反，它可能会继续协助驾驶员以防出现危险操作。一旦真出现了问题，驾驶员按正确步骤处理是至关重要的。但每种机型的应对步骤各不相同，驾驶员必须一一学习并带上列明步骤的操作清单。新系统层出不穷，使得驾驶员需要频繁再培训。为方便驾驶员操作，MAX 8 采用的系统在操作感受上沿袭了驾驶员们更熟悉的波音 737 旧机型。但这又增添了一层复杂性。
Incidents are not confined to aviation. In Washington, DC, automated trains have largely been out of service since 2009, when a faulty circuit made a stationary train invisible to the safety system on the one behind it. The driver was unable to brake in time; the resulting crash killed nine people. Ships may soon face similar problems. Some ferries and offshore support vessels have already replaced ship’s wheels with computer-assisted joysticks. A series of accidents involving self-driving cars may have been caused by sensors’ failure to recognise objects in the road, and drivers failing to respond fast enough.
Studies have shown that when people have to wrest control from an automated system, it can take them around five seconds to grasp what is happening. The monotony of monitoring a semi-automated vehicle may reduce vigilance by provoking what psychologists refer to as “passive” fatigue. Such concerns have led some carmakers, Ford among them, to consider skipping semi-automation and go straight to something closer to full autonomy, cutting people out of the loop. That would remove the human-machine interface—but not humans’ machine-induced fears.