Pattern 12 · Transition
Return of Control
When the machine takes control back from the human, it does so visibly and only once conditions are right, and it does not keep re-asserting itself against what the human is doing.
The mechanism
human has control → machine resumes
- 01Human has controlThey have taken over, or never left
- 02Machine stands backVisibly, and without arguing
- 03Conditions are metThe state the machine needs to resume
- 04 · Key momentHuman confirmsA deliberate act, not a timeout
- 05Machine resumesAnnounced, once — not repeatedly
At 02: When the driver steers, Super Cruise pulses the light bar blue and stands back. Standing back is a state the human can see, not an internal flag.
At 04: ISO 13850 is the strict version: a stop is maintained until reset, and reset requires an intentional human action at the place the stop was triggered.
Without / with the pattern
Anti-pattern: The Tug-of-War
Human corrects, then Machine re-asserts, then They fight
The Tug-of-War: the machine takes control back silently, over and over. On JT610 the trim moved more than thirty times, the pilots trimming back against it each time; using electric trim paused MCAS, which then reset and commanded nose-down again.
With the pattern
Human corrects, then Machine stands back, then Resumes on confirmation
Yielding is visible and resuming needs a deliberate human act, so the two are never commanding the same axis with different intentions.
Related patterns
- Required by · 15Stop AnywhereA latched stop is only safe if resuming is a deliberate act. Both patterns lean on the same rule: the machine does not decide when the human is finished.
- Complements · 01The HandoffThe Handoff covers the machine giving control up. This is the same transfer in the other direction, where the failure mode is not a cold takeover but a contest neither side acknowledges.
- Complements · 11Readiness CheckBoth treat the human's state as something to verify rather than assume — one before engaging, one before resuming.
Sources
MCAS is the clearest case of this pattern's absence because the contest was invisible to the people in it. The pilots were not refusing a handover; they were correcting an attitude, repeatedly, against a system that treated each of their corrections as an event to pause for rather than an instruction to stop.54 The design change afterwards was to give one input per elevated-angle-of-attack event,3 which is really a decision about who gets the last word. All 189 people on board JT610 died, and all 157 on ET302.2
The two interface examples sit at opposite ends and are worth holding together. Super Cruise resumes on its own once a visible condition is met, and tells the driver what that condition is through the light bar.6 ISO 13850 refuses to resume at all until a person acts, at the spot where they acted before.1 Neither is simply right. What they share is that the human can always tell which of the two is in command, which is the part MCAS did not provide — and the part that makes a disagreement a decision instead of a fight.
- ISO 13850 emergency stop resetStandard
- Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot PerformanceIncident
- Maneuvering Characteristics Augmentation SystemArticle
- Lion Air jet's flight data show 'tug of war' over controlArticle
- Taking the next steps while awaiting the MAX returnArticle
- Super Cruise escalation and resumptionArticle