Pattern 10 · Failure
Explainable Fault
When something goes wrong, the system names the actual fault in the operator's terms and points at what to do about it, instead of showing symptoms or a code. On the 777 a checklist icon sits beside the message.
The mechanism
fault occurs → record it
- 01Fault occursA sensor, link or subsystem fails
- 02Diagnose itFind the cause behind the symptoms
- 03 · Key momentName it in the operator's termsThe condition, not an error code
- 04Point at the responseThe procedure that goes with it
- 05Record itSo maintenance inherits the diagnosis
At 02: On JT610 the crew met the symptoms — stick shaker, airspeed and altitude disagreement, repeated nose-down trim — with nothing naming the miscalibrated angle-of-attack sensor behind them. The AOA DISAGREE alert was not working on that aircraft.
At 04: The 777's EICAS puts a checklist icon next to a message whenever an electronic checklist has to be completed, so the fault and its response arrive together.
Without / with the pattern
Anti-pattern: Symptoms Without a Cause
Fault occurs, then Symptoms only, then Wrong diagnosis
Symptoms Without a Cause: the crew gets the downstream effects and has to infer the fault under time pressure. On the flight before JT610 the captain attributed the trim behaviour to the speed trim system — a different system entirely.
With the pattern
Fault occurs, then Cause named, then Response to hand
The alert names the condition in terms the operator recognises and carries the procedure with it, so the diagnosis is not left to inference.
Related patterns
- Complements · 03Graceful DegradationDegradation is the step down; this is the part that says which fault caused it. A fallback nobody can name is hard to work with.
- Complements · 09Learning LoopAn unnamed fault cannot feed back. Without the alert, the JT610 crew could not document the faulty sensor, so it was not available to help maintenance.
- Complements · 14Alert TriageTriage decides which alert reaches the operator first; the other decides whether it names anything useful when it gets there. A ranked flood of error codes is still unreadable.
Sources
The useful detail in JT610 is that the alert meant to name the fault was not working on that aircraft, so the crew were left with a stick shaker, disagreeing airspeed and altitude, and trim that kept pushing the nose down.23 Symptoms are not a diagnosis. The previous day's captain had put the same behaviour down to the speed trim system,3 which is exactly what happens when a cluster of effects arrives without the cause attached: the crew reaches for the system that best explains what they can see.
There is a second cost, further downstream. Investigators noted that without the alert the crew could not document the faulty sensor, so it never reached maintenance.2 A fault that cannot be named cannot be reported, which means it cannot be fixed, which means the next crew meets it too. That is why the last step here is recording rather than displaying — naming the condition is what makes it transmissible. The 777's answer is the plainest version of the pattern: the message states the condition, and the icon beside it says there is a checklist to run.5
- Guidelines for Human-AI InteractionPaper
- Lion Air MAX report finds Boeing, airline, pilots contributed to tragedyArticle
- Bjorn's Corner: Analysing the Lion Air JT610 crash, Part 3Article
- People + AI Guidebook — Errors + Graceful FailureArticle
- 16.422 Human Supervisory Control of Automated Systems — alerting systemsTalk