The entire debacle was caused by human error. The solution is to simply eliminate the humans from the control system (and knowing the level of management skill of our DHS oligarchs, this will be implemented as "eliminate the humans," with consequences involving the inevitable end of Mankind).

I, for one, welcome the arrival or our robotic overlords...

What kind of idiot designs a system where you can complete a control handover without it checking the controls are in a 'safe' configuration first?

Or forgets that *triple* redundancy is a better thing to aim at, rather than having two sets of controls that you can swap between.

After all, this is an expensive bit of kit to lose to operator error, and adding stuff to the control side is likely to be cheap. And much cheaper than paying for whatever the drone crashes on, say a highschool...

Are these the same "pilots" who routinely kill entire families in Iraq; did I say families, I meant "Al-Quaeda cells"?

This absolutely proves that a pilot on board is a much better bet than an unmanned, switched off robot. If one of these pilots were on board ( assuming this was a pilot and not an operator) he wouldn't have turned off the power in the first place and if for some other reason it had gone off he would have noticed and then done something about it. Until AI reaches an acceptable level to equal a human the use of UAVs should remain limited as combat observation platforms etc.

"He then went back to the MFW to open up another program, which showed him what processes were running on PPO-1 so that he could record this information."

If all else fails, randomly stab the End Process button in Task Manager

Soon. all your base are belong to us.

...would be to say that pilots are in fact absolutely essential and whatsmore they should be up there with the aircraft and not many miles away on the ground. I'm willing to bet that if this had been a manned aircraft then, even in the unlikely event of the pilot unwittingly switching off the fuel supply, the sudden silence of the engine cutting out, followed by the cows getting rapidly larger would have tipped him off that something was awry. Furthermore, I would also suggest that armed with this awareness the pilot would be much better placed to diagnose and fix the problem before he and his craft were smeared across the countryside (and incidentally, from the photos of the crash scene it looks like the Reaper in question ended up remarkably intact, considering it could have come down from anywhere up to 40k ft).

Don't get me wrong, UAVs (and UCAVs for that matter) are very useful things, and their safe operation in civilian airspace is inevitable, but it is far too early to go writing off human pilots.

Its simple: if a pilot is sitting in the aircraft any problem will get his immediate attention and he'll do something sensible because its his arse that's on the line.

Now watch sim pilots - even current pilots racing in multi-player sims. They'll have crashes, reload the last saved situation and continue. After all, its only points lost. Just a bit of fun. No danger at all.

The sim attitude most likely applies to piloting remote controlled UAVs as long as the consequences of mistakes are minor for the pilot. There are only two ways of fixing this:

a) put the pilot in the aircraft

b) use autonomous systems for all flight control aspects, leaving only course selection and weapon/surveillance systems to be controlled remotely.

Option (a) may be the most expensive of the two but its the least likely to cause careless accidents.

> When piloting is switched between consoles, a certain lever changes its function from control of the camera iris to control of the fuel feed to the aircraft's engine

WTF?? Who's the f*cking genius that designed that? Why the hell does a lever change function?

Imagine you buy a new Ford and the salesman says "that's the brake and that's the accelerator, except if you turn on the windshield wipers, the brake pedal becomes the accelerator pedal"

[mythbusters]THERE'S yer prahblem![/mythbusters]

To be honest, i feel that the pilot really should/could have done a bit better, all things considered, but does this not strike people as just a little odd:

"a certain lever changes its function from control of the camera iris to control of the fuel feed to the aircraft's engine"

I mean really, surely thats totally idiotic to change a function from something relatively trivial like a camera, to engine on/off??

Wouldnt you be a bit peeved if when you booted windows in safe mode (or whatever OS you are using), the "start" button changed it's function to format your hard drive or something?

It's probably just another coverup for an alien crash site, they'll turn round and say "it might sound stupid, but that's why it must be true" or somesuch nonsense

Based on the description in the article (I haven't had the opportunity to review the NTSB statement) it appears that the real issue is the the craft was not properly designed.

First, the console locked up in the course of flight. Second, there was no notification of stall on the second console so that the pilot could correct the issue before the Predator crashed. Third, upon disconnect from the second console (a designed behavior) the communications gear on the predator stopped responding to subsequent console requests.

While there was certainly human error involved in this accident, it seems to me that the real problem is that this vehicle was designed for combat scenarios, and is unfit to be in the same airspace as civilian flight.

No one at El Reg, or in the posts so far has caught the fact that this was really caused by a horrid user interface design? One lever being used for two very different purposes, and with no obvious feedback? As in: "WARNING: ENGINE OFF" in big red letters on the screen?

Operator error indeed. That's like having a button on the dashboard of your car that swaps the brake and accelerator functions (or at very least, brake and windshield wiper).

I'm betting these consoles cost thousands and thousands of dollars. I think they could have afforded a second lever and alert message when an airborn plane has its engine switched off.

As an aerospace engineer working in the defence environment (not in the US thankfully!) we come across people doing stupid things all the time! It basically comes down to the fact that if you pay peanuts you get monkeys!

We had a recent case of an entire squadron of helicopters being grounded because the maintainance crews failed to follow a very simple, well laid out procedure and decided to try and save 5 mins and risk the lives of entire flight crews!

Lets face facts here people flying UAV's tend to be of a much lower intelligence or just lower levels of concentration then actual pilots because a) they're lives are not in danger and b) less training is required because if you crash a UAV - no biggie! It only cost $15 million as opposed to $150+ million for a manned aircraft.

If you want things like this not to happen, train people to follow procedures and not take short-cuts! And pay them an amount of money that makes them want to pay attention!

I am not a fan of ubiquitous unmanned drones, it's really too 1984ish. However, I think a 65-foot UAV is quite ridiculous, something that size should definitely have a pilot. A UAV that is like model airplane sized, bird-sized or insect-sized? Not so much. I mean, something like that could crash right into your head and not be a big deal. For just a radar and a camera, a 65-foot wingspan is kind of ridiculous.

Um, the failover mode should restore all aircraft parameters (including the fuel supply) to a default state. Just a few lines of extra code and a diode soldered in there somewhere should do the trick. I think I'll become a military contractor and charge them 40 million for the upgrade.

They need to have large wingspans for a number of reasons, the most important of which is to minimise fuel consumption at high altitudes.

My interpretation of the article is that the second console was never intended to fly the drone except in emergencies. 99% of the time, the controls should be used for driving the camera/radar/etc. Having a separate control for fuel flow on the camera console would be a waste of space.

In an emergency, the camera console can take over the piloting role in which case all of the conveniently located camera controls take on a new meaning.

To all the people who are comparing this to brakes and windscreen wipers, I think its closer to having a video games console in the passenger seat, if the steering wheel were to fall off or the driver to pass out, the video game controls can take over the car and what was "jump" is now "brake".

If it weren't for their crappy software and mantra of "switch it off and on again" the situation could have been saved. Just like robots do, humans also act as they've been conditioned to (after decades of "good enough" malfunctioning software). So turning everything off is, although not wise under the circumstances, understandable given years of patiently watching "this computer did not shut down properly" messages after responding to a frozen unresponsive computer with the wall-switch.

I just think the ms-is-evil bell needed another chime.

Any pilot who can't follow a checklist properly is dangerous - put the guy in the air and I give him 6 months before he does a gear up landing and makes the 6pm news.

Wading through the documentation revels a new tactic.

Lob some kit at them a-rabs!

>>However, when the fuel was cut off to the engine and the UA began shedding electrical equipment to conserve battery power...>>

"The sim attitude most likely applies to piloting remote controlled UAVs as long as the consequences of mistakes are minor for the pilot. There are only two ways of fixing this:

a) put the pilot in the aircraft

b) use autonomous systems for all flight control aspects, leaving only course selection and weapon/surveillance systems to be controlled remotely."

The third option is to bring the consequences of mistakes back to the level of the pilot sitting in the cockpit. Explosives in the controller's chair, a sixteen ton weight suspended from the ceiling, a trap door over a spiked pit, the possibilities are endless.

The same people who designed this genius flying system voted Geroge W Bush into power...

..Twice

...Are any of you surprised it crashed???

"a) put the pilot in the aircraft

b) use autonomous systems for all flight control aspects..."

Or have the pilot pay for the damage out of his pay packet when he prangs it. That might make him pay attention to what he's doing.

Damn. I've got to get a job designing stuff like this for a defence contractor! You build a UI that allows a console to change role in an under-pressure situation ("The ground's coming up to say hello. Do something quick!") that invites the operator to do the first thing that he thinks will work rather than going through a 2 page (hypothetically) checklist which will take more time than the operator has before losing the vehicle. That is assuming that said checklist is within arms reach and isn't locked up with other sensitive documents in the safe. The customer then either ignores the shortcomings or pays you even more to fix them rather than giving you the sound kicking you deserve. Get me some of that!

I have no conceptual objection to a control console being multi-role as long as the role change is simple to perform and there is an unambiguous indication that not even a trained monkey could ignore as to which role it is currently in. My personal preference for a console would be to use relative encoder controls with continuous motion and an LED column showing the current absolute position of that control input. You take control and the control state of the console should take the state of the vehicle, not the other way round. You can then immediately roll controls to make changes to the state.

I do wonder, however, whether the crappy interface is the fault of the design team or if they were given a tight spec from the customer and told "build that and don't argue." Also don't forget that the original military customer would have put this system through extensive acceptance testing (as should the DHS) before forking out that much cash per unit and must have signed off on the control interface being acceptable.

Is that an icon of a UAV heading towards the ground rapidly?

Suerly they should treat the second seat like the Co-Pilot/Gunner/Navigator/Vometing TV presenter seat in a millitery Jet? Not 'oh we need to switch over controle' but they have all the controles to pilot the damb thing, but with the good sence to not touch them unless needed?

...... still wouldn't stop them killing allied troops.

I agree that people playing sims don't feel the urgency in proper corrective action, as you say, you can just reload from a previous save point. This indicates that a key feedback mechanism is missing from this design...

a gun suitably positioned at the pack of the remote pilots head, connected to a crash sensor should provide the necessary feedback mechanism here ;-)

Control panel lock up?! What the hell that console was running on? Ah, Windows for Dumbplanes... Sorry, Mr President, I can't command that missile to self-destruct - my console has locked up.

When I was going through my military training in Russia a control panel would only lock up if you put a bullet though it...

turning it off and back on again? ROFL!

There's no better incentive to not crash a plane... than being inside the damn thing when you're flying it.

I do like the trap door over a spiked pit idea, though.

Do I sense a potential for a new kind of BOFH here?

There's no better incentive to not crash a plane... than being inside the damn thing when you're flying it.

I do like the trap door over a spiked pit idea, though.

Do I sense a potential for a new kind of BOFH here?

Why? Did Microsoft design it then?

I remember see a prog on tv about bad car driving. The presenter finished with an idea, instead of an airbag in the steering wheel, fit a spike. That'll get thier attention.

(from the crash report:)

> He then recycled the power on PPO-1 and PPO-2

In other words, he rebooted it. We have bred an entire new generation that thinks the Microsoft "experience" is what computing is all about...

It has already been said, but God help us... Windows running the control consoles...??? I have nightmares about agreeing to have laser eye surgery to correct my sight, then - just before the moment that the tissue-burning laser is turned on - I see that it's being controlled from a Windows PC.... :-(

Lewis P wrote:

"Some people are seeing all this as an indication that unmanned aircraft aren't safe enough to fly in civil airspace. Another way of looking at it is that the pilots are the problem, and the sooner we get rid of them the better."

Of course, neither of these is the suitable analysis. The correct analysis is "the (US designed) control systems of US military unmanned aircraft are not safe enough for use by inadequately trained pilots (sic) when the vehicle is operated in civilian airspace."

Clearly, the muscle-bound, testosterone-dazed hooligans at the US DHS were so far more thrilled at using MIL-SPEC hardware to keep beady eyes on wetbacks, that they COMPLETELY overlooked the need to perform an adequate Safety Case to analyse the use of military systems for civilian purposes

Muppets - serves em right.

All other aspects around whether the Reaper Man-Machine Interface is adequately safe for the intended military purpose are secondary, in this case.

Well?

We've got an "IT?" icon and a "Bubble-headed Heiress?" icon.

So why no "RoTM angle?" icon

I guess I'm just going to improvise something ironic...

So, what we had here was the equivalent of a two joystick RC aircraft controller and the one joystick controlled Elevator/Aileron and the other controlled Throttle/Rudder function and switchover changes it to to camera Azimuth/Elevation and Iris/Zoom?

Why did the turkeys designing the interface completely circumvent decades of pilot control conventions? Under pressure, anything that can be done wrong will be done wrong and the increased frustration only causes a further tightening of the death spiral that ultimately leads to the loss of the mission.

KISS says that you keep flight controls completely separate from secondary mission operations. There should be no switchover, the controls for each function should be separate and distinct and in standard, familiar positions so that muscle memory takes over in a panic and allows you to do the right thing. You don't want to drop the airplane to fly the mike.

"In an emergency, the camera console can take over the piloting role in which case all of the conveniently located camera controls take on a new meaning."

So, you jump out of your dead-engine plane, and find that pulling the 'chute ripcord undoes the harness instead of deploying the canopy. That's because the designer reckoned it was ""only"" a piece of safety gear and therefore didn't need careful thought as to its controls. Yet, if you'd realised it was a piece of junk, you would have stayed with the plane and survived. Now, thanks to the DEFECTIVE SAFETY GEAR, which you placed your trust in, you won't survive.

No offence to parachute manufacturers intended!

In the Predator case, had the pilot not had a (defective) fallback option, he might've stayed at the first console and regained contol.

If it crashes on my ranch can I ebay the remains? After all, finders keepers. Or with scrap metal rpices so high, can I just take it to the junkyard?

Predator, Crash, Profit!

Every military specification that I've seen in the past 6 years has always specified a maximum reboot time for equipment, including manned flight control systems!

The brass are always expecting the reboot option to be required.