Wednesday, December 31, 2008

Unintended user interface consequences

NASA released the report of the Columbia accident. The gruesome stuff was redacted, but there is plenty description of how things ended. But I was interested in the following user interface problem (I've italicized the interface problem, and ACES = Advanced Crew Escape Suit, i.e. pressure suit):
Deorbit burn occurred at GMT 13:15:30 (EI–1719/TIG+0). The burn was nominal, and Columbia began entry into the Earth’s atmosphere. Per the checklist, a few tasks remain to be completed after the burn, including stowing the last laptop computer, which requires a crew member to be out of the seat. Crew equipment configuration items on the entry checklist (all crew members seated and strapped in, helmets and gloves donned, and suit pressure checked) were not entirely completed prior to EI. At least one crew member was not wearing the helmet and several were not wearing gloves. The flight deck video shows that conditions on the flight deck were nominal during the entire time of the video recording. The video shows the flight deck crew finishing most checklist tasks close to the planned times. However, one flight deck crew member did not yet have gloves in place in time for the ACES pressure check. One event of note occurred at GMT 13:36:04 (EI–485/TIG+1234) when the CDR bumped the rotational hand controller (RHC) accidentally. Movement of the RHC out of the centered position caused the digital autopilot (DAP) to “downmode” from the “Auto” mode to “Inertial” mode. When this occurred, a “DAP DOWNMODE RHC” caution and warning message was displayed, the INRTL button on the C3 panel was illuminated, and a tone, which can be heard in the recovered flight deck video, was annunciated. An immediate reactivation of the autopilot was performed by the CDR. The capsule communicator (CAPCOM) in the Mission Control Center (MCC) then requested the CDR to enter “another Item 27,” which is a command to fully recover the vehicle attitude from the bumped RHC. Bumping of the RHC is a relatively common occurrence by either the PLT or the CDR because the ACES is bulky and the area near the controls is confined. Such RHC bumps with prompt recovery represent a very low hazard to the crew. The original design specifications of the orbiters were for a shirtsleeve environment (i.e., no special clothing needed to be worn). Although pressure suits have been worn during launch and entry since the Challenger accident, no modifications were made to displays and controls to accommodate the ACES.
So as a result of the previous Challenger accident and the requirement to wear a pressure suit, bumping the controller is "relatively common".

The mention of the Digital Autopilot (DAP) caught my eye since back in the day we looked at reverse engineering formal specifications for a small portion as a demonstration. Also in the Columbia report is a discussion of the reaction control system (RCS) jets, that were firing continuously just before loss of control, trying to correct the flawed flight. That also reminded me that the bigger group we were associated with at NASA JPL was looking at formally specifying the RCS "jet select" system.