More on trustworthy data

You are flying a high tech airliner, at night, over the ocean. Your instruments become useless, airspeed and altitude randomly moving from off-scale-low to other, arbitrary values. Or are they true values? The computerized control system reacts to those with a series of warnings, some of which are contradictory: over-speed and stall, at the same time. Without any visual frame of reference, there's no way to tell even roughly how high or fast you are going. What do you do?

Ask for help.

Air traffic control has radars covering the area (it does for most places airliners fly, but not some of the deep ocean routes) so you call back and ask them to give you accurate information off their screens.

They can easily, if slowly and by voice, give bearing, direction of travel and speed.

Who knows what is wrong with this last data point?

Altitude is not derived from radar data, but is instead telemetry; the aircraft sends the information, along with those identifying codes at the top, to the radar as part of the transponder data. If flight instruments are inaccurate, its very likely -- and in this case, indeed true -- that the number on the ATC display screen is wrong also.

And as a result, you fly into the ocean.

Aeroperu 603 New York Times article Wikipedia article

There's plenty more to hate about this crash (and the similar Birginair one) from a human factors point of view, from providing static and pitot port blocking devices, to the difficulty the flight crew has of focusing on a problem with so many conflicting instruments and warnings.

But I think there's something to be said for the problem of displaying the trustworthiness of data in this one narrow context. ATC systems have worked like this forever, and will probably continue to do so. I was surprised no one seemed to be aware of their manner of operation. And remember, the ground controller does not have as many issues as the aircrew, so should have had a chance to think over the issue. I presume he was, deep down, aware of how the system works.

But I generally avoid anything that has training as its backbone. Would there be a way to denote how information works, or where it comes from? I have nothing now, but its worth considering. The big problem as I see it is that the information is of mixed sources, and therefore mixed reliability. When transponders fail, or are turned off (terrorists, smugglers), the data supplied by it simply disappears. But before that, its displayed in the exact same manner as the systematically, radar-derived data.

Note that just because air travel is a high-reliability system with lots of history, these systems are not bulletproof. Changes to the displays frequently are poorly implemented and cause confusion. I suspect much of the design is status quo, and is not that good were testing to be done on it. Problems are alleviated with training and procedure, leading to accidents that result from poor training, breakdowns in procedure, and poor communications of changes in either.

My favorite recording meter

This is right near my house, tucked between a couple of buildings in the Script Pro complex off Johnson drive. More photos of it Seems to be something from the gas company. If you can't tell by looking, its a disk of paper, adhered to a very slowly moving metal disk. An ink needle drives a trace based on... whatever. Gas pressure I presume. Sorta like the classic seismometer, but its a disk (not a long tape) and records over a one month period. And, its still working. The paper is regularly changed, and presumably someone is reading the information. Seems to work just fine, therefore. I just wonder how long until its replaced by a digital device, feeding back to the home office by wires or radio.

Off Scale High

I've finished the overwhelming stack of magazines I was behind on, and now I'm into the overwhelming pile of books I am behind on reading. Right now, its Inviting Disaster. I love disaster books. Especially when they get into engineering or design failures. Why Buildings Fall Down is a must read if this appeals to you also.

Anyway, its covering the usual. Challenger O-rings, the Ocean Ranger capsize, etc. Well, I just finished the TMI2 part. There are plenty of lessons about procedure, training, usability, human behavior, control room design, etc. (the best of course being a light to indicate you asked a valve to close, not whether its actually closed!) But there was one I didn't recall before.

When the morning shift arrived, someone noticed the overflow cooling tank temperature was high. They see something like this:


Which means its 280°, which is not too bad. Too hot, so they start figuring out its a loss-of-coolant accident, instead of a danger of going-solid accident, but no one noticed before because its not all /that/ hot.

Well, that's because the water is not really 280°. Seems some programmer decided that all values over 280 should be discarded, so the top of the scale is...280. No standard way to know that on a digital readout, though. And certainly it was not indicated on the meter, or in any obvious place in the

Consider if that gauge was displayed like this:


Not necessarily bad that someone makes the decision no reading over 280 is important, but the classic dial gives us other information. Lots of it, really. But here, you can detect the top end, and understand that the reading is not a specific value, but an unknown above a certain value, off scale high.


This is something I particularly hate about digital display of anything. My GPS (actually, all of them) is similar. It will happily give your position down to at least 1 meter. But if you look somewhere else, it will also inform you that it only knows its position within a certain accuracy, usually between 11 and 70 feet. There's even a handy circle around your location marker if you look at the map; somewhere in this circle is where you actually are.

I have warned about this but I still think there is a fundamental design flaw in most of these sorts of display mechanisms. Excessive implied precision, and implied accuracy. Everyone I work with seems to understand its true, yet hardly anything seems to actually happen about it.

In the disaster book, Chiles talks about how the control room is oddly isolated from the boiler functions, much more so than any boiler operator from a century before would let himself be. Not just in proximity, so he can observe it, but in the type and value of his instruments. Those instruments were developed carefully, over time, to meet specific needs and avoid dangers. Since digital display is not going anywhere, I wonder when will universal digital standards start to emerge to prevent these sorts of issues?