Explainable Fault
When something goes wrong, the system names the actual fault in the operator's terms and points to what to do about it.
CBP Predator B drone Draft
April 25, 2006 · Nogales, Arizona
Before dawn on a border patrol flight, the pilot's console in the ground control station locked up. He switched control to the identical console beside it, the one the camera operator used. On that console, the lever that adjusts the camera's iris becomes the engine's fuel control when the console is flying the aircraft, and it was sitting in the position that meant fuel cutoff. The engine stopped. The pilot saw the drone losing altitude, but nothing told him why. The Predator B came down in the desert about 10 miles northwest of Nogales International Airport. No one was hurt.2
Anti-pattern: Symptoms Without a Cause Draft
The ground station showed every symptom of an engine failure (falling altitude, decaying speed) but never named the cause: one lever, on one console, in the cutoff position. The pilot had to infer it, and didn't.
Explainable Fault
Therefore: Name the fault itself, not just its symptoms, and record it so it reaches the people who can fix it.
DraftSimplified illustration, not real ground station data.
Without
Ground control station · Console 2
Press to see what the pilot saw.
With the pattern
Ground control station · Console 2
The same fault, on a display that names it.
The alert names the condition in terms the operator recognizes and carries the procedure with it, so the diagnosis isn't left to inference. Because the fault has a name, it's logged and reaches maintenance before the next flight.
The mechanism
fault occurs → record it
- 01Fault occursA sensor, link or subsystem fails
- 02Diagnose itFind the cause behind the symptoms
- 03 · Key momentName it in the operator's termsThe condition, not an error code
- 04Point at the responseThe procedure that goes with it
- 05Record itSo maintenance inherits the diagnosis
On this page
Design considerations
- Name the condition, not the code. The operator should recognize what failed without looking anything up.
- Group symptoms under their cause. A stick shaker, two disagree alerts and moving trim are one fault, not four. Leaving them ungrouped makes the operator "parse multiple information sources to figure out what happened, and what action they need to take" — which is Alert Triage's problem, met here from the other side.5
- Point to the response. On the 777, the message names the condition and an icon beside it shows there's a checklist to run; pressing CHKL brings up that checklist rather than leaving the crew to pick one.6
- Record what you name. Naming the fault is what makes it reportable, so it reaches maintenance before the next flight.3
- Explain what the system did and why. Stated for software as Amershi's eleventh guideline, "Make clear why the system did what it did", and by PAIR as an error in its own right when a system's actions aren't well explained.15
In the field Draft
Observed · Aviation. Lion Air 610. The crew had the stick shaker, disagreeing instruments and runaway trim, but no alert named the faulty sensor behind them.34
Observed · Aviation. The 777's crew alerting pairs each message with a checklist indicator: the icon sits beside the message while its checklist is outstanding and clears once it is done, so the alert carries its response rather than just its name.6
Related patterns
- Complements · 03Graceful DegradationDegradation is the step down; this is the part that says which fault caused it. A fallback nobody can name is hard to work with.
- Complements · 09Learning LoopAn unnamed fault cannot feed back. Without the alert, the JT610 crew could not document the faulty sensor, so it was not available to help maintenance. JT610 is now an In the field entry on this page rather than its opening.
- Complements · 14Alert TriageTriage decides which alert reaches the operator first; the other decides whether it names anything useful when it gets there. A ranked flood of error codes is still unreadable.
Sources
Symptoms are not a diagnosis. That's why the last step of this pattern is recording rather than displaying: naming the condition is what makes it travel, from the crew to maintenance to the next flight.
- Guidelines for Human-AI InteractionPaper
- Brief of Accident CHI06MA121 (Predator B, Nogales, Arizona, April 25, 2006), and Safety Recommendations A-07-70 through A-07-86Incident
- Lion Air MAX report finds Boeing, airline, pilots contributed to tragedyArticle
- Bjorn's Corner: Analysing the Lion Air JT610 crash, Part 3Article
- People + AI Guidebook — Errors + Graceful FailureArticle
- 16.422 Human Supervisory Control of Automated Systems — alerting systemsTalk