Touchscreens in Control: Stylish, Smart, but not Safe?

IBNS helm controls on the bridge of USS Dewey. USS John S McCain had a similar layout.   Image credit: US Navy

The Navy Lark

Paraphrased excerpt from the BBC 1960s radio comedy show featuring the incompetent crew of the imaginary RN ship, HMS Troutbridge.

(Scene on the bridge, sailing into Portsmouth harbour.)

First Officer: Let’s see, taking into account the tide, windspeed and direction… I should say… steer… helmsman?

Helmsman: Yessir?

First Officer: Left-hand down a bit.

Helmsman: Left-hand down a bit it is sir!

Captain: Watch out for that…!

(Loud clanging and crashing noise followed by silence.)

Captain: Oh, never mind. It’s sunk.

It was a very popular Sunday afternoon show when I was a child. We all laughed at the mayhem, not appreciating that accidents like that happened for real. And people died. In those days, there were few safety systems; no computers to catch errors of judgement by bridge officers. Just years of training and experience. Basic controls consisted of a big steering wheel which turned the rudder and a telegraph instrument that signalled ‘Full Ahead’, ‘Half-Astern’ and so forth to the engine room crew who actually set the engine rpm. Inevitably, new electronic systems took the human out of the propulsion control loop enabling direct engine control from the bridge. Finally, the introduction of computers brought about the integration of all bridge controls and ‘fly-by-wire’ automation. Despite all this sophistication, the Human-Machine Interface (HMI) still relied upon individual mechanical switches and buttons. Then came the touchscreen.

Older version of helm controls on the bridge of USS Donald Cook on July 25, 2019.   Image credit: US Navy

On August 21, 2017, the US Navy destroyer John S McCain was involved in a collision with the Liberian-flagged tanker Alnic MC, while both vessels were sailing in the same direction along the westbound lane in the Middle Channel passage of the Singapore Strait Traffic Separation Scheme. The destroyer’s crew claimed to have lost steering control and their vessel swerved into the path of the tanker. In that unequal fight, 10 sailors on the John S McCain died and 48 were injured. The US National Transportation Safety Board’s report documented a whole catalogue of failings including a lack of training and oversight. But beyond the usual blame-game and finger-pointing, they did express concerns about the design of the destroyer’s Integrated Bridge and Navigation System (IBNS) which relied heavily on touchscreen technology. This was not a one-off event: a few months earlier the USS Fitzgerald had crashed into a container ship off the coast of Japan killing seven members of the destroyer’s crew. There have been other similar accidents. The NTSB’s recommendations were accepted by the US Navy and a programme refitting some of the primary controls – steering and propulsion – with good old-fashioned wheels and levers has begun.

The Automotive environment

Physical switchgear in a 2005 Volvo V70. Image credit: Glenn Lindberg/Vi Bilägare

Meanwhile, the massive increase in electronic gadgetry now deemed ‘essential’ in even the most basic car models, has caused a major headache for the designers of dashboards. Not long ago, before microprocessors started proliferating under the bonnet (hood), dashboards barely figured in the overall design process. The first automotive electrical switches were of the pull-on type, matching other controls such as the ‘choke’ knob – a cold starting device for enriching the fuel mixture from the ‘carburettor’. Er… those terms may be unfamiliar to those readers yet to reach the age of 50. Anyway, the point is that car instrument panels were often beautiful, being made of polished walnut wood, but contained a seemingly random scattering of knobs and dials placed for the convenience of the manufacturer, not the driver. While driving at night, you had to rely on what we now call ‘muscle memory’ to find anything in the darkness, as nothing was illuminated to (a) enable a particular switch to be located or (b) indicate whether it was on or off. Even in daylight, the function of a particular switch had to be deduced from a single tiny embossed letter. In other words, learning to drive a car had certain similarities with learning to touch-type on a keyboard, or play the piano. Rotary switches posed a worse problem because they had more than two positions. Still, at least the dials (speedometer, tachometer, etc) lit up. Sort of. During the 2000s, physical switchgear was nearing its limits in terms of sophistication and ergonomic layout: you now had fully illuminated switches and dials arranged logically based upon the principles of Ergonomics. By now though, ‘Infotainment’ centres were replacing radios, air conditioning was upgrading to ‘Climate Control’, and the humble map giving way to ‘SatNav’. Car dashboards were in danger of resembling that of the Apollo Command Module……

Apollo spacecraft Command Module instrument panel. For nerds (like myself), the yellow dotted box is the Display-Keyboard (DSKY) unit for the legendary Apollo Guidance Computer. The yellow arrow points to the equally legendary Signal Conditioning Equipment (SCE) power selection switch. When toggled to ‘Aux’ after a lightning strike on Apollo 12 just after the launch turned all telemetry to gibberish, it restored order and saved the mission. The NASA history website has an exhaustive report on the ‘SCE to Aux’ incident. Most of the toggle switches have ‘hoops’ on each side so that a big gloved finger can’t flip two at once. Image credit: Steve Jurvetson

Two developments have, at least for the time being, have forestalled the need for learner drivers to practise in aircraft-type simulators before being allowed out into traffic:

• The multi-function touchscreen display.
• Automation, in the form of Advanced Driver-Assistance Systems (ADAS).

Car manufacturers love touchscreen technology: a ‘standard’ display unit can replace a whole mass of expensive switchgear. That statement is a bit misleading because many of the functions will require additional high-current electronic switches or relays to drive them. Nevertheless, the ability to program the display to suit different models or update with new features, perhaps wirelessly, provides a solution that may be more expensive to start with, but which works out a lot cheaper long-term. The second factor, automation has already been widely adopted with headlights that switch on and off according to light levels, and windscreen wipers that sense rainfall. These features reduce the number of manual controls required – touch or mechanical.

Touchscreen controls of a 2022 Tesla model S electric car.

Touchscreens in Space

The picture of the Apollo Command Module panel above makes ‘flying’ a spacecraft seem a pretty daunting task, doesn’t it? I mean, all those switches to flip and buttons to press, just to keep it going in the right direction…. Um, no. Just watch the Apollo cockpit videos showing the astronauts actions during launch and during the flight to the Moon. Leaving aside those of Apollo 13, what do you see? What you don’t see is anyone using the hand controllers (joysticks) or furiously throwing switches or pushing buttons. Why not? Because the Saturn V is a ‘driverless’ rocket. Fully automatic; no human input required, except when something goes seriously wrong. Something did go seriously wrong on Apollo 12 when the rocket was struck by lightning as it took off. What prevented an instant disaster was the triple-redundant flight-control computer of the Saturn V; it shook-off the electrical assault and kept going leaving time for mission control time to figure out a way of restoring the scrambled telemetry. The only control clutched by the commander was the abort handle, which would have caused the escape rocket to fire and drag the capsule clear and high enough for a safe parachute descent. Finally, one of the mission controllers in Houston remembered a similar situation tried in the simulator. And its solution: “Try SCE to Aux” he told the crew. Two out of the three astronauts were baffled. What and where is the SCE switch? Luckily, Alan Bean remembered the simulated incident and knew where the switch was on the panel.

So, if all those switches are not for direct operation of the spacecraft under normal conditions, what are they for? Some enable/isolate individual functions, others allow manual re-routing of essential systems - the SCE power switch was one of those. Further switches (usually under safety covers) will detonate explosive bolts allowing, for example, the separation of the Command Module from the Service Module at the end of the mission. Some things are better left under human control. Given that, even in the 1960s, astronauts had few ‘driving’ activities to perform under normal conditions. Nowadays, automatic systems have reduced that load still further. Modern crewed spacecraft, such as the SpaceX Crew Dragon, have multi-function graphical displays enabling astronauts to perform more efficiently a task that has always been of prime importance – monitoring the automatic systems and dealing with faults.

Control Panel for the SpaceX Crew Dragon Spacecraft. The display panels are actually rectangular. Note the limited number of mechanical switches below the displays and the abort handle in the middle. Image Credit: SpaceX

The Trouble with Touchscreens

Is there a problem with touchscreens? Not with the technology; that opens up many opportunities for innovation. If there is a problem, it’s with designers getting carried away with all the possibilities and not appreciating that the end-user may get overwhelmed, especially in a high-stress life-threatening situation. You would think that the US Navy officers who commissioned the development of the USS John S McCain’s IBNS would have spotted the potential flaws at the design stage. But they didn’t.

The John S McCain: With the benefit of hindsight, it seems inevitable that some sort of accident was bound to occur attributable to crew confusion with this integrated bridge control system. Many have blamed the touchscreen controls, but they just represent a symptom of a deeper problem – designers making systems overcomplicated and overburdened with extra features just because the digital technology makes it easy to do. The NTSB determined that the bridge system didn’t fail; it was the crew who lacked a full understanding of how to drive it. There were too many ‘modes’ of operation, but I’d bet their training focussed on only one or two. It was reported that the ships’ commanders preferred to use one of the manual modes, presumably because they felt that they could react to situations quicker than the computer. That meant the simple operation of switching engine control from one console to another required a different procedure. Only five minutes elapsed from the point when the senior bridge officer ordered the change, to the big bulbous bow of the tanker smashing into the side of the destroyer, killing sailors as they slept in their bunks. Five minutes of panic as the crew tried to restore steering control that hadn’t in fact been lost, just misplaced.

The Automotive environment: The current fashion for replacing nearly all manual switchgear with a single touchscreen crammed with virtual buttons and drop-down menus won’t last long – there are serious and obvious safety implications. These were demonstrated during tests carried out by a Swedish car magazine on a number of new models plus an old manual-switchgear Volvo from 2005. That doesn’t signal the end of the automotive touchscreen: it will still be used for non-driving functions such as infotainment. Manual switches will not disappear until cars become safely and fully autonomous. At that point, touchscreen controls will be limited to TV channel changing or making ‘phone calls. Clearly, Tesla are designing their cars for full autonomy, but until that is achieved, I’d be nervous about trying to drive a car solely with virtual manual controls.

Total reliance on the touchscreen is proving to be a headache for Tesla owners: when the technology fails you ain’t goin’ nowhere. I don’t personally like the things in a car – have you tried programming a SatNav in a moving vehicle, even as a passenger? Terrible UX (user experience).

Touchscreens in Space: Fortunately, Space travel has not entered the consumer market just yet. Manned Spacecraft are still designed for function and safety – not style. Well, SpaceX have managed to introduce some style, so a crewed capsule interior looks a bit more like a modern aircraft cockpit than an old power station control room. The Crew Dragon control panel is very simple – just three touchscreens, a handful of mechanical switches and a prominent abort handle. The simplicity is due, like the Apollo spacecraft, to automation. The screens are there mainly to provide status information and the views from outside cameras. In most cases, the switches provide manual backup for say parachute deployment should the automatics fail.

Conclusion

I started with comic chaos aboard a fictional Royal Navy Ship of the 1960s and end with the very real, horrific chaos on the bridge of a US Navy destroyer in 2017 that led to deaths and injuries. The Navy Lark was funny because such incompetence was very, very rare in the real navy. Perhaps because the technology was so much easier for the users to understand. The Space industry has always understood the need for careful design – when rockets go wrong, boy do they go wrong! The ability of the crew to respond to any potentially fatal situation is tested, with many hours spent in simulators until there are no ‘hidden traps’ of ignorance. It took the Apollo 1 fire to snap NASA out of its complacency; hopefully, the USS John S McCain incident has snapped the US military out of theirs.

If you're stuck for something to do, follow my posts on Twitter. I link to interesting articles on new electronics and related technologies, retweeting posts I spot about robots, space exploration and other issues. To see my back catalogue of recent DesignSpark blog posts type “billsblog” into the Search box above.