eveson -263 264 Design Flaws 1. Interface interpretation errors o Software interprets input wrong Multiple conditions mapped to same output Mulhouse(A320) Crew directed automated system to fly in TRACK/FLIGHT PATH mode which is a combined mode related both to lateral (tracK)and vertical (flight path angle)navigation. When they were given radar vectors by the air traffic controller, they may have switched from the TRACK to the HDG SEL mode to be able to enter the heading requested by the controller However, pushing the button to change the lateral mode also automatically changes the vertical mode from FLIGHT PATH ANGLE to VERTICAL SPEED, i.e. the mode switch button affects both lateral and vertical navigation. When the pilots subsequently entered to select the desired flight path angle of 3. 3 degrees, the automation interpreted their input as a desired vertical speed of 3300 ft. Pilots were not aware of active " interface mode" and failed to detect the problem. As a consequence of too steep descent, the airplane crashed into a mountain Operating room medical device The device has two operating modes: warmup and normal. It starts in warmup mode whenever either of two particular settings are adjusted by the operator(anesthesiologist). The meaning of alarm messages and the effect of control ols are different in these two modes but neither the current device operating mode nor a change in mode are indicated to the operator. In addition, four distinct alarm-triggering conditions are mapped onto two alarm messages so that the same message has different meanings depending on the operating mode. In order to understand what internal condition triggered the message, the operator must infer which malfunction is being indicated by the alarm Display modes: In some devices, user-entered target values interpreted differently depending on active display modec ����������������������������� ����� Design Flaws 1. Interface interpretation errors Software interprets input wrong Multiple conditions mapped to same output Mulhouse (A320): Crew directed automated system to fly in TRACK/FLIGHT PATH mode, which is a combined mode related both to lateral (TRACK) and vertical (flight path angle) navigation. When they were given radar vectors by the air traffic controller, they may have switched from the TRACK to the HDG SEL mode to be able to enter the heading requested by the controller. However, pushing the button to change the lateral mode also automatically changes the vertical mode from FLIGHT PATH ANGLE to VERTICAL SPEED, i.e., the mode switch button affects both lateral and vertical navigation. When the pilots subsequently entered "33" to select the desired flight path angle of 3.3 degrees, the automation interpreted their input as a desired vertical speed of 3300 ft. Pilots were not aware of active "interface mode" and failed to detect the problem. As a consequence of too steep a descent, the airplane crashed into a mountain. Operating room medical device: The device has two operating modes: warmup and normal. It starts in warmup mode whenever either of two particular settings are adjusted by the operator (anesthesiologist). The meaning of alarm messages and the effect of controls are different in these two modes, but neither the current device operating mode nor a change in mode are indicated to the operator. In addition, four distinct alarm−triggering conditions are mapped onto two alarm messages so that the same message has different meanings depending on the operating mode. In order to understand what internal condition triggered the message, the operator must infer which malfunction is being indicated by the alarm. Display modes: In some devices, user−entered target values interpreted differently depending on active display mode