Comment by andrewaylett | Hacker News Reader

Comment by andrewaylett | Hacker News Reader

Parent Full thread

It always surprises me that system changes like Alternate and Direct Law, or Sukhoi's Direct Mode, are quite so different from normal operation. I'm sure they have a really good reason not to make Normal Law better mimic Direct Law (but with all the safety systems), and maybe the reason I don't understand it is because I tend to read about the times when dropping into Alternate or Direct Law resulted in an incident?

One of the patterns I try to follow in designing our operations is that the tasks we need to follow in an emergency should be as close to routine as we can make them. We don't have a manual override to deploy into production in case of emergency, we make sure that our normal deploy process is suitable for emergency use. Which means we won't make the emergency worse by messing up a manual deploy.

Similarly, my car has some fancy drive-by-wire features -- the steering is dynamic, and the throttle balances the electric motor and petrol engine seamlessly. But the manufacturer didn't change anything fundamental about the controls, and if the power steering fails (or the cruise control stops working, or the radar can't track the vehicle in front) I lose some affordances and some safety systems but I can still drive the car.

It is true that the non-normal modes are supposed to only very infrequently activate, but with that in mind it should surely be more important to not drop users into a totally different control regime?

Hoping someone has some more insight. I don't have anything to do with avionics in general, and the day job isn't safety-critical, but I'm always keen to learn and I've definitely learned a lot over the years that I can apply to the day job by reading about how people design systems to stay safe when a failure means loss of life.

Think of normal mode more like adaptive cruise control with lane keeping. When everything works, it’s much easier to control the car, but if the data necessary to feed the control laws go bad, the car has to drop back to the regular old gas/brake + steering wheel (i.e., direct mode) or it may crash. Getting the handover right is obviously tricky though.

In this case, if your IMU or airspeed data looks bad, your attitude estimate can’t be relied on and you can’t be certain that any derived values you’re controlling to are valid or stable. Current designs assume the best course of action in those cases is to hand control over to the pilot.

Cruise control was one of the things I was thinking of, actually -- but the brake and accelerator on every car I've used cruise control with, still act as a brake and an accelerator. If I engage with the controls, they act in the way they'd act if the assistance was missing. Sometimes with warnings or stops (lane departure, speed limiters), often with smarter behaviour than might be apparent (regenerative braking, hybrid power trains, adaptive steering, radar/lidar support).

Airbus's Normal Law sounds more akin to a car that maintains its current speed and rate of turn if no inputs are given, so if you lift your foot off the accelerator then the car doesn't slow down and if you let go of the steering wheel then it doesn't wobble or re-centre. It might be easier to drive when the assistance is working, but it's not going to be easy to transition to regular brake, accelerator, and steering functions if the assistance needs to switch off.

Well at a high level, ADAS and normal law both basically function as a way to remove the steady state effort of steering, allowing the driver/pilot to focus solely on fine corrections. You can still avoid potholes, overtake cars, etc., when ADAS is on but that’s the majority of your inputs.

I think really the biggest difference between the two systems is that ADAS does not abstract away nearly so many actions. Once direct mode is activated, obviously you suddenly have to start doing all the low-frequency yoke movement, but then you also need to work rudders to coordinate your turns, trim control surfaces, etc., etc., and if you are unaware that the mode has changed then it is not going to go well.

You might be surprised (or not) to learn that some modern cars are fully brake-by-wire; no mechanical connection between the pedal and the hydraulics [0]. Mostly hybrid or fully electric cars. Many "emergency" brakes are now merely parking brakes driven by an electric motor. Afaik there are no fully steer-by-wire cars on the road today, thankfully.

I am similarly confused at the lack of sustained training in direct law/mode flight. The primary reason for the difference in operation is convenience and smoothness of flight achieved by intentional control stick movements as opposed to direct aerodynamic surface control, but like the article said pilots should have a comprehensive mental operating model of what the "normal" law/mode is producing at the control surfaces.

[0] https://en.m.wikipedia.org/wiki/Brake-by-wire

My hybrid has an absolutely seamless transition between regenerative braking and friction braking. It's quite impressive.

Crucially, this is the car's normal mode of operation, and you can assume that a lot of effort went into that consumer experience.

There's really no comparison to an emergency fallback mode on an airliner.

Reply on news.ycombinator.com