Love/hate Relationship with the FMS, a Critique
Capt. W. Patrick Gordon, M.Sc.
The Airbus A340, with its fly-by-wire controls commanded through a sidestick, is arguably the most highly automated airplane flying today. Its introduction has presented pilots with an entirely new realm of aviation.
Airbus Captain P. Chandler wrote as part of the Royal Aeronautical Society’s discussions on the Future Flight Deck, “As a result of the highly automated systems, pilots frequently complain of feeling remote from the aircraft; the flight deck is very quiet, the throttles don’t move with autothrust engaged, there is no feedback through the sidestick of speed changes and the autopilot can automatically adjust many flight parameters (e.g., speed and descent profile). Secondly, comments such as, ‘Why won’t it let me do this?’ and ‘What’s it doing now?’ are all too common. Part of the reason behind these complaints is almost certainly pilots’ unfamiliarity with a new system and natural resistance to change, neither of which should be used to justify altering the design of the aircraft. However, a more fundamental cause of these problems is the high degree of automation on the flight deck; the consequent complexity of the systems.
At the heart of this complex hardware is the flight management system (FMS), which has been a boon to military, airline and corporate aviation. At its best, the FMS allows for the most efficient operation of an aircraft by offering more detailed monitoring of systems navigation, fuel management and flight profiles.
Unfavorable aspects of the FMS include its ability to cause confusion in the cockpit at the worst possible times, such as during departures or arrivals, when the flight deck stress and workload is already at the highest level. Evidence from accidents and thousands of pilot-reported incidents suggests that confusion regarding mode behavior is still a chronic problem in these human-machine systems. It also appears that this trend is bound to escalate as newer automated systems are developed and put into use.
Since the basis of the FMS is one or more computers, it is reasonable to expect problems in the human-computer interface.
Such systems are designed to perform many functions,
The functions are activated directly by the user or by external events,
For simplicity and “cleanness,” the interface includes fewer control and display elements (e.g., buttons, icons) than the number of possible functions and interactions,
In the case of dynamic systems, the user must specify (i.e., “program”) in advance what type of behavior the system should exhibit in the future,
The user must be informed when these specifications cannot be fulfilled due to some external or internal change, and
The user must be able to modify the specifications at any time.
It would be hard to find a more generic, typical FMS than Honeywell’s FMZ series flight management system, installed in each of three Falcons flown by this writer. This FMS series is designed as a distributed systems with three independent components. The first is the CD-800/810 control display unit (CDU), two of which are mounted on the center pedestal. The other two are NZ-600/800/900 navigation computer and the PZ-800 performance computer.
All flight crew input to the typical FMZ is through the control display unit (CDU). The CDU, through its built-in cathode-ray tube, provides readouts from the system’s database and its nav and performance computers. The Honeywell FMS CDU has a full alphanumeric keyboard, with four line-section keys on each side of the CRT. Seven function keys are provided to allow direct access to specific display pages. Annunciators are located in the top of the bezel to advise the pilot of the system’s status. The display itself has nine lines of text, each of which may constitute up to 24 characters. The top line is dedicated as a title line and the bottom line is used as a scratchpad for brief notes from the flight crew from the unit itself.
To further enhance the capabilities of the Honeywell FMZ flight management system the additional features of “Dual,” ”Independent Operation” and “Initiated Transfer” have been included. “Dual” mode allows for information inserted in either FMS to be transferred instantly to the other system to ensure that they remain identical. Many pilots continually operate their FMS units in this mode to simplify matters. Some FMS manufacturers don’t even offer other mode capabilities. “Independent Operation” mode allows each FMS to operate independently with no transfer of information permitted between the two. “Initiated Transfer” allows each FMS to be operated independently but transfer of information from either side to the other is permitted.
Although the “Initiated Transfer” mode opens the door to even more “automation surprises,” the enhanced capability of this mode can be invaluable. For example, there are two complex standard terminal arrivals (STARs) at Paris’ Le Bourget Airport. Prior to the top of descent, a different STAR can be loaded into each FMS and, when Paris ATC issues the clearance, the appropriate STAR can be selected and transferred to the other FMS. Properly accomplishing the FMS preload procedure significantly reduces workload and stress. Improper preload or transfer obliterates the correct information and it must be reprogrammed quickly and accurately. The resulting FMS “automation surprise,” coupled with deteriorating weather, English-speaking French air traffic controllers, the proximity of Charles De Gaulle Airport and an offset ILS approach at Le Bourget, causes workload and stress levels to peak.
Other findings on automation:
• Workload is changed but not necessarily reduced by automation,
• Human errors are not eliminated, but their nature may be changed. In many cases (such as the depicted Le Bourget arrivals), the errors may be even more critical. Automation, it has been said, may eliminate small errors and create the opportunity for large ones,
• There are wide differences of opinion about the usefulness and benefits versus risks of automation in the minds of line pilots, and therefore wide differences in patterns of use.
Pilots Poor System Monitors
The tidal wave of cockpit automation is irreversible and, for the professional pilot, safety demands the adaptation to automation. This adaptation includes learning how to mentally process the information that automation provides. A renowned flight surgeon, Dr. Richard Reinhart, said, “The single greatest ongoing concern, therefore, is identifying where the pilot has the greatest risk of breaking this loop of information processing, often with surprising and embarrassing results. At best, it’s a quick and easy way to complacency and to lose situational awareness. Most errors or disconnects in this loop are the results of some physiological and psychological impairment.”
Humans are easily distracted and become bored with inactivity. As a result we are not very good system monitors. In the cockpit, pilots go from one extreme of information input to another; from information overload on takeoff and landing to information underload at cruise. Distraction from extensive FMS information occurs during the busy phases of flight and boredom occurs during cruise as the pedantic display of incredibly accurate information is presented at a leisurely pace, checkpoint after checkpoint after checkpoint. Although the condition may not often be prevalent during the takeoff and landing phases, complacency is most often found in the cockpit after an airplane at cruise altitude. The term “automation complacency” has evolved from recent work in this area and describes the tendency to become overly trustful and dependent on the various automatic devices in the cockpit. It is just this pedantic display of incredibly accurate information that leads to pilot complacency.
Operation needs to be Intuitive
John Lauber, former Safety Director of Delta Airlines and former human-factors specialist on the National Transportation Safety Board, said, “I am not entirely convinced that many so-called automation problems really are uniquely associated with automation technology. The real problem is that we, once again, have failed to appreciate the support requirements for the humans who end up having to use the systems. Training, performance monitoring and evaluation, operating procedures all need to be satisfactorily addressed.”
To accept the position that humans are not very good monitors and therefore susceptible to FMS mode identification errors opens the question, “What do we do about it?”
FMS design should follow the lead of major computer manufacturers and ensure that procedures required of flight crew members are as intuitive as possible. Macintosh initiated the intuitive approach to computer use and Microsoft, through its Windows operating program, has followed Mac’s lead, making the memorization of arcane DOS commands a thing of the past. There is no reason that FMS manufacturers should not be doing the same thing.
Existing FMS operating manuals should be rewritten by the same individuals who now write good computer software operating manuals. In the early days of computers, the software manuals were written by engineers and, as a result, were nearly Greek, or Geek, to the average computer user. The same might be said for FMS manuals. Much of the new computer software available today is so well written that the manuals aren’t really required by the users to achieve a basic operational familiarity with some programs. The same should be done with FMS manuals and the software within them.
FMS buttons and knobs should be reevaluated and designed in such a way that human errors are reduced.
The Honeywell FMS information is processed to the Falcon 900 through the autopilot, which has two control heads. There is one on each side of the cockpit featuring five identical knobs and three identical buttons on each unit. Try finding the right one at night, by feel. Especially if you are a training captain and must maintain currency in both the left and right seats. Change seats and you also change operating hands.
The course selector should be one distinct shape, the heading selector another, and so forth. After years of experience and man accidents, we accomplished this tactile differentiation with the flap and gear handles. We should be able to surmount this identification problem with FMS and autopilot controls.
Initial training in FMS and other automation features of the modern cockpit must be improved drastically. It is not uncommon for corporate pilots, in particular, to be self-taught in FMS operation. Frequently, a passing nod at FMS training is given by contract training facilities when a pilot transitions to an automated cockpit and no in-depth, concentrated training is given.
Generally, the automated equipment is installed in sophisticated aircraft simulators available at training facilities. However, the requirement for the flight-training aspects of the simulator usually is more demanding than that for automation-familiarity training. Part of this problem is that while the controlling agencies, such as FAA, endorse the automated cockpit, they fail to appreciate the problems automation, or its failure, can induce. They still insist on seeing steep turns and approaches to stalls during a check ride when that valuable time could be spent demonstrating automation proficiency.
By the time pilots reach the level at which they are exposed to cockpit automation – either in the airlines, military or in corporate aviation – they are certainly able to fly the basic maneuvers. What is necessary in the training phase today is to develop the ability to work with, and around the automation systems; when and how to use them; and when to revert to the "round dials" and fly the airplane the old-fashioned way. by hand. Either the amount of simulator training must be extended or the training must be adapted to include more hands-on work with the automated features of the modem cockpit. As training equipment becomes more readily available, strong consideration should be given to the concept of "Free Play." in which flight crew members at some carriers are given the opportunity to work with computer-based training (CBT), CDU and even personal computer (PC) based trainers to enhance their FMS skills prior to, during and even after FMS initial training.
One other causal factor of FMS error identification and/or acceptance may have to do with cultural attitudes based on the differences between high-power-distance cultures as opposed to low-power-distance cultures. High-power-distance cultures where great respect is shown to power and authority might tend to accept the FMS almost as a senior flight crewmember. They may be unwilling to question information emitting from such a revered source. On the other hand, low-power-distance cultures where members believe it is their right to speak up and question authority have a more accepting attitude toward automation. An approach somewhere between these two extremes might be well considered.