Otto’s Manual Control

7 Jan 2014 by claytonbeese

When it refused to give up authority, the Captain wrested control of the Axiom from the artificial intelligence autopilot, Otto. Otto’s body is the helm wheel of the ship and fights back against the Captain. Otto wants to fulfil BNL’s orders to keep the ship in space. As they fight, the Captain dislodges a cover panel for Otto’s off-switch. When the captain sees the switch, he immediately realizes that he can regain control of the ship by deactivating Otto. After fighting his way to the switch and flipping it, Otto deactivates and reverts to a manual control interface for the ship.

The panel of buttons showing Otto’s current status next to the on/off switch deactivates half its lights when the Captain switches over to manual. The dimmed icons are indicating which systems are now offline. Effortlessly, the captain then returns the ship to its proper flight path with a quick turn of the controls.

One interesting note is the similarity between Otto’s stalk control keypad, and the keypad on the Eve Pod. Both have the circular button in the middle, with blue buttons in a semi-radial pattern around it. Given the Eve Pod’s interface, this should also be a series of start-up buttons or option commands. The main difference here is that they are all lit, where the Eve Pod’s buttons were dim until hit. Since every other interface on the Axiom glows when in use, it looks like all of Otto’s commands and autopilot options are active when the Captain deactivates him.

A hint of practicality…

The panel is in a place that is accessible and would be easily located by service crew or trained operators. Given that the Axiom is a spaceship, the systems on board are probably heavily regulated and redundant. However, the panel isn’t easily visible thanks to specific decisions by BNL. This system makes sense for a company that doesn’t think people need or want to deal with this kind of thing on their own.

Once the panel is open, the operator has a clear view of which systems are on, and which are off. The major downside to this keypad (like the Eve Pod) is that the coding of the information is obscure. These cryptic buttons would only be understandable for a highly trained operator/programmer/setup technician for the system. Given the current state of the Axiom, unless the crew were to check the autopilot manual, it is likely that no one on board the ship knows what those buttons mean anymore.

Thankfully, the most important button is in clear English. We know English is important to BNL because it is the language of the ship and the language seen being taught to the new children on board. Anyone who had an issue with the autopilot system and could locate the button, would know which button press would turn Otto off (as we then see the Captain immediately do).

Considering that Buy-N-Large’s mission is to create robots to fill humans’ every need, saving them from every tedious or unenjoyable job (garbage collecting, long-distance transportation, complex integrated systems, sports), it was both interesting and reassuring to see that there are manual over-rides on their mission-critical equipment.

…But hidden

The opposite situation could get a little tricky though. If the ship was in manual mode, with the door closed, and no qualified or trained personnel on the bridge, it would be incredibly difficult for them to figure out how to physically turn the ship back to auto-pilot. A hidden emergency control is useless in an emergency.

Hopefully, considering the heavy use of voice recognition on the ship, there is a way for the ship to recognize an emergency situation and quickly take control. We know this is possible because we see the ship completely take over and run through a Code Green procedure to analyze whether Eve had actually returned a plant from Earth. In that instance, the ship only required a short, confused grunt from the Captain to initiate a very complex procedure.

Security isn’t an issue here because we already know that the Axiom screens visitors to the bridge (the Gatekeeper). By tracking who is entering the bridge using the Axiom’s current systems, the ship would know who is and isn’t allowed to activate certain commands. The Gatekeeper would either already have this information coded in, or be able to activate it when he allowed people into the bridge.

For very critical emergencies, a system that could recognize a spoken ‘off’ command from senior staff or trained technicians on the Axiom would be ideal.

Anti-interaction as Standard Operating Procedure

The hidden door, and the obscure hard-wired off button continue the mission of Buy-N-Large: to encourage citizens to give up control for comfort, and make it difficult to undo that decision. Seeing as how the citizens are more than happy to give up that control at first, it looks like profitable assumption for Buy-N-Large, at least in the short term. In the long term we can take comfort that the human spirit–aided by an adorable little robot–will prevail.

So for BNL’s goals, this interface is fairly well designed. But for the real world, you would want some sort of graceful degradation that would enable qualified people to easily take control in an emergency. Even the most highly trained technicians appreciate clearly labeled controls and overrides so that they can deal directly with the problem at hand rather than fighting with the interface.

Dust Storm Alert

17 Dec 2013 by claytonbeese

While preparing for his night cycle, Wall-E is standing at the back of his transport/home. On the back drop door of the transport, he is cleaning out his collection cooler. In the middle of this ritual, an alert sounds from his external speakers. Concerned by the sound, Wall-E looks up to see a dust storm approaching. After seeing this, he hurries to finish cleaning his cooler and seal the door of the transport.

A Well Practiced Design

The Dust Storm Alert appears to override Wall-E’s main window into the world: his eyes. This is done to warn him of a very serious event that could damage him or permanently shut him down. What is interesting is that he doesn’t appear to register a visual response first. Instead, we first hear the audio alert, then Wall-E’s eye-view shows the visual alert afterward.

Given the order of the two parts of the alert, the audible part was considered the most important piece of information by Wall-E’s designers. It comes first, is unidirectional as well as loud enough for everyone to hear, and is followed by more explicit information.

Equal Opportunity Alerts

By having the audible alert first, all Wall-E units, other robots, and people in the area would be alerted of a major event. Then, the Wall-E units would be given the additional information like range and direction that they need to act. Either because of training or pre-programmed instructions, Wall-E’s vision does not actually tell him what the alert is for, or what action he should take to be safe. This could also be similar to tornado sirens, where each individual is expected to know where they are and what the safest nearby location is.

For humans interacting alongside Wall-E units each person should have their own heads-up display, likely similar to a Google-glass device. When a Wall-E unit gets a dust storm alert, the human could then receive a sympathetic alert and guidance to the nearest safe area. Combined with regular training and storm drills, people in the wastelands of Earth would then know exactly what to do.

Why Not Network It?

Whether by luck or proper programming, the alert is triggered with just enough time for Wall-E to get back to his shelter before the worst of the storm hits. Given that the alert didn’t trigger until Wall-E was able to see the dust cloud for himself, this feels like very short notice. Too short notice. A good improvement to the system would be a connection up to a weather satellite in orbit, or a weather broadcast in the city. This would allow him to be pre-warned and take shelter well before any of the storm hits, protecting him and his solar collectors.

Other than this, the alert system is effective. It warns Wall-E of the approaching storm in time to act, and it also warns everyone in the local vicinity of the same issue. While the alert doesn’t inform everyone of what is happening, at least one actor (Wall-E) knows what it means and knows how to react. As with any storm warning system, having a connection that can provide forecasts of potentially dangerous weather would be a huge plus.

Eve’s Gun

12 Dec 2013 by claytonbeese

For personal security during her expeditions on Earth, Eve is equipped with a powerful energy weapon in her right arm. Her gun has a variable power setting, and is shown firing blasts between “Melt that small rock” and “Mushroom Cloud visible from several miles away”

EvesGun03_520

After each shot, the weapon is shown charging up before it is ready to fire again. This status is displayed by three small yellow lights on the exterior, as well as a low-audible charging whine. Smaller blasts appear to use less energy than large blasts, since the recharge cycle is shorter or longer depending on the damage caused.

On the Axiom, Eve’s weapon is removed during her service check-up and tested separately from her other systems. It is shown recharging without firing, implying an internal safety or energy shunt in case the weapon needs to be discharged without firing.

While detached, Wall-E manages to grab the gun away from the maintenance equipment. Through an unseen switch, Wall-E then accidentally fires the charged weapon. This shot destroys the systems keeping the broken robots in the Axiom’s repair ward secured and restrained.

Awesome but Irresponsible

I am assuming here that BNL has a serious need for a weapon of Eve’s strength. Good reasons for this are:

They have no idea what possible threats may still lurk on Earth (a possible radioactive wasteland), or
They are worried about looters, or
They are protecting their investment in Eve from any residual civilization that may see a giant dropship (See the ARV) as a threat.

In any of those cases, Eve would have to defend herself until more Eve units or the ARV could arrive as backup.

Given that the need exists, the weapon should protect Eve and the Axiom. It fails to do this because of its flawed activation (firing when it wasn’t intended). The accidental firing scheme is an anti-pattern that shouldn’t be allowed into the design.

The only lucky part about Wall-E’s mistake is that he doesn’t manage to completely destroy the entire repair ward. Eve’s gun is shown having the power to do just that, but Wall-E fires the weapon on a lower power setting than full blast. Whatever the reason for the accidental shot, Wall-E should never have been able to fire the weapon in that situation.

First, Wall-E was holding the gun awkwardly. It was designed to be attached at Eve’s shoulder and float via a technology we haven’t invented yet. From other screens shown, there were no physical buttons or connection points. This means that the button Wall-E hits to fire the gun is either pressure sensitive or location sensitive. Either way, Wall-E was handling the weapon unsafely, and it should not have fired.

Second, the gun is nowhere near (relatively speaking) Eve when Wall-E fires. She had no control over it, shown by her very cautious approach and “wait a minute” gestures to Wall-E. Since it was not connected to her or the Axiom, the weapon should not be active.

Third, they were in the “repair ward”, which implies that the ship knows that anything inside that area may be broken and do something wildly unpredictable. We see broken styling machines going haywire, tennis ball servers firing non-stop, and an umbrella that opens involuntarily. Any robot that could be dangerous to the Axiom was locked in a space where they couldn’t do harm. Everything was safely locked down except Eve’s gun. The repair ward was too sensitive an area to allow the weapon to be active.

In short:

Unsafe handling
Unauthorized user
Extremely sensitive area

Any one of those three should have kept Eve’s gun from firing.

Automatic Safeties

Eve’s gun should have been locked down the moment she arrived on the Axiom through the gun’s location aware internal safeties, and exterior signals broadcast by the Axiom. Barring that, the gun should have locked itself down and discharged safely the moment it was disconnected from either Eve or the maintenance equipment.

A Possible Backup?

There is a rationale for having a free-form weapon like this: as a backup system for human crew accompanying an Eve probe during an expedition. In a situation where the Eve pod was damaged, or when humans had to take control, the gun would be detachable and wielded by a senior officer.

Still, given that it can create mushroom clouds, it feels grossly irresponsible.

In a “fallback” mode, a simple digital totem (such as biometrics or an RFID chip) could tie the human wielder to the weapon, and make sure that the gun was used only by authorized personnel. (Notably Wall-E is not an authorized wielder.) By tying the safety trigger to the person using the weapon, or to a specific action like the physical safeties on today’s firearms, the gun would prevent someone who is untrained in its operation from using it.

If something this powerful is required for exploration and protection, it should protect its user in all reasonable situations. While we can expect Eve to understand the danger and capabilities of her weapon, we cannot assume the same of anyone else who might come into contact with it. Physical safeties, removal of easy to press external buttons, and proper handling would protect everyone involved in the Axiom exploration team.

Nucleolab Kill Switch

12 Apr 2013 by Christopher Noessel

General Munro isn’t sure what’s going to come out of the other end of Mactilburgh’s process. He’s never seen a Mondoshawan and doesn’t know if they can be trusted. Fortunately for his sense of panic, there’s a built in kill switch on the control panel facing the nucleolab chamber. To activate the switch, he slips his multipass into a slot. While this card is in the slot, a small red LED lights, and the Big Red Button is active.

The interface is simple to read, which is nice. The button conveys a bit of its importance through its size and color. The order of operations is well laid out for a Western user: left to right, in the order of reading.

Three improvements

There are lots of questions about the security strategy, though. Single-factor authentication is too easy to thwart. Couldn’t someone just take his multipass and use it? How does the system know it’s really Munro? Better would be multifactor authentication, requiring both this token and either a knowledge token like a password, or an inheritance factor. Maybe it could require Munro to place his other hand on a handprint reader before the button activates.

Another problem is that the signal that this button is active is too tiny: that little red LED that’s associated with the slot rather than the button. If this is an undoable action, you’d hope that the input would convey the sense of risk. Maybe have the button glow, or surround it with a glowing red ring (think the Krell warning system)?

If it really is a kill switch, i.e. would kill the subject, a nice safeguard against accidental activation would be a press-and-hold button, requiring Munro to hold it down for a few seconds while a warning klaxon sounds. This would give Munro the opportunity to change his mind or move his hand if he’d placed it accidentally. If it triggers something nonlethal, like an incapacitating sticky foam, then no such delay is necessary.

Slideaway bed

28 Mar 2013 by Christopher Noessel

When Korben stands up, his bed recognizes the change. In response it pulls the messy bed and linens away, where they will be “autowashed,” i.e. automatically sanitized, remade, and sealed in plastic (for bedbug protection?) A fresh bed rises up to replace the messy one as the bedframe slides into the wall.

This automated response might be frustrating if it presumed too much. Say, if Korben got up in the night to use the restroom and came back to find his bed missing, so you’d want it to be as context-aware as possible. And there’s evidence that it’s not too smart a system. Later in the film Cornelius hides in the bed and is nearly suffocated as it tries to autowash the bed with him in it, and wraps him in plastic. I get the comedy in the scene, but really, if it had the sensors to know when Korben was laying down in it, it should have a safety that prevents that very thing when a person is there.

Korben does have manual controls. There are two panels of pushbuttons at waist height, about a meter apart on a sliver of wall above the bed recess. We don’t get great views of these panels, but we do see Korben using one of the buttons to hide General Munro and his cronies in the hideaway refrigerator. In the glimpses we get we can see that there are six buttons on each panel, each button labeled with a high-contrast icon. The leftmost button on each controls the bed. Pressing it when it’s hidden opens it. Pressing it when it’s open closes it and, as we saw before, starts the murderous autowash.

All told it’s a pretty awesome system. The agentive part of getting up is handled seamlessly. The alarm has gone off, Korben’s up, and having the bed disappear saves space in the room and removes the temptation of Korben’s slinking back to bed and making himself late for work. And to summon the bed or hide it manually at some unusual time, Korben has understandable, accessible controls. The main down side is the lack of a safety or panic button, and the comparatively minor annoyance that Korben has to tear that plastic off every night even if he just wanted to pass out after a long day of saving the world.

Spacesuits

26 Dec 2012 by Christopher Noessel

The surface of LV-223, as one imagines with the overwhelming majority of alien planets, is inhospitable to human life. For life support and protection, the crew wears suits complete with large clear “fishbowl” helmets that give a full-range of view. A sensor strip arcs across the forehead of the bowl, with all manner of sensors broadcasting information back to the ship. Crew also wear a soft fabric cap beneath the bowl with their name clearly stitched into a patch that sits above the forehead. (Type nerds: The face is modular, something similar to Eurostile. The name is in all caps. This is par for sci-fi typography, but poor for legibility at distance.)

Sadly for the crewmembers (and the actors as well) the air inside these bowls are not well filtered and circulated. The inside surface fogs up quite easily from the wearer’s breath.

Audio

Audio is handled intuitively, with all microphones between spacesuits being active all the time, with an individual’s volume relative to his or her proximity to the listener. Janek is at one point able to stand in front of the ship and address everyone inside it, knowing that the helmet microphones are monitored at all times.

Lights, Cameras

There are lights inside the helmet, placed over the forehead and pointing down to make the wearer’s face visible to others nearby, as well as anyone remote-monitoring the wearer with a backward-facing camera. A curious feature of the suits that they also include yellow lights that highlight the wearer’s neck. What is the purpose of these lights? Certainly it shows off Michael Fassbender’s immaculate jawline, but diegetically, it’s unclear what the purpose of these things are. It is after the scientists remove their helmets in the alien environment—against the direct orders of the Captain—it becomes clear that the spacesuits were designed with this in mind. This way the spacesuits can be operated helmetlessly while maintaining identification lights for other crew. The odds of this being a feature that would ever be used on an alien planet are astronomically low, but the designers accommodated the ability to be operated without helmets.

Sleeve computers

Holloway’s left sleeve has two small screens. The left one of these displays inscrutably small lines of cyan text. The right one has a label of PT011, with a 3×3 array of two-digit hexadecimal numbers beneath it.

A few of the hexadecimal pairs have highlight boxes around them. Looking at this grid, Holloway is able to report to the others that, “Look at the CO2 levels. Outside it’s completely toxic, and in here there’s nothing. It’s breathable.” It’s inscrutable, but believably shorthand for vital bits of information, understsandable to well-trained wearers. For inputs to the sleeve computer, he has four momentary buttons along the bottom and a rotary side-mounted dial. Using these controls, Holloway is able to disable his safety controls and remove the helmet.

Prometheus’ Flight instrument panels

21 Dec 2012 by Christopher Noessel

There are a great many interfaces seen on the bridge of the Prometheus, and like most flight instrument panels in sci-fi, they are largely about storytelling and less about use.

The captain of the Prometheus is also a pilot, and has a captain’s chair with a heads-up display. This HUD has with real-time wireframe displays of the spaceship in plan view, presumably for glanceable damage feedback.

He also can stand afore at a waist-high panel that overlooks the ship’s view ports. This panel has a main screen in the center, grouped arrays of backlit keys to either side, a few blinking components, and an array of red and blue lit buttons above. We only see Captain Janek touch this panel once, and do not see the effects.

Navigator Chance’s instrument panel below consists of four 4:3 displays with inscrutable moving graphs and charts, one very wide display showing a topographic scan of terrain, one dim panel, two backlit reticles, and a handful of lit switches and buttons. Yellow lines surround most dials and group clusters of controls. When Chance “switches to manual”, he flips the lit switches from right to left (nicely accomplishable with a single wave of the hand) and the switches lights light up to confirm the change of state. This state would also be visible from a distance, useful for all crew within line of sight. Presumably, this is a dangerous state for the ship to be in, though, so some greater emphasis might be warranted: either a blinking warning, or a audio feedback, or possibly both.

Captain Janek has a joystick control for manual landing control. It has a line of light at the top rear-facing part, but its purpose is not apparent. The degree of differentiation in the controls is great, and they seem to be clustered well.

A few contextless flight screens are shown. One for the scientist known only as Ford features 3D charts, views of spinning spaceships, and other inscrutable graphs, all of which are moving.

A contextless view shows the points of metal detected overlaid on a live view from the ship.

There is a weather screen as well that shows air density. Nearby there’s a push control, which Chance presses and keeps held down when he says, “Boss, we’ve got an incoming storm front. Silica and lots of static. This is not good.” Thought we never see the control, it’s curious how such a thing could work. Would it be an entire-ship intercom, or did Chance somehow specify Janek as a recipient with a single button?

Later we see Chance press a single button that illuminates red, after which the screens nearby change to read “COLLISION IMMINENT,” and an all-ship prerecorded announcement begins to repeat its evacuation countdown.

This is single button is perhaps the most egregious of the flight controls. As Janek says to Shaw late in the film, “This is not a warship.” If that’s the case, why would Chance have a single control that automatically knows to turn all screens red with the Big Label and provide a countdown? And why should the crew ever have to turn this switch on? Isn’t a collision one of the most serious things that could happen to the ship? Shouldn’t it be hard to, you know, turn off?

Military navigation

11 Sep 2012 by Christopher Noessel

The C-57D is a military vessel with much of its technology feeling like that of a naval vessel.

Lt. Farman navigates the ship towards Altair.

The navigator, called an astrogator, sits at a station on the bridge facing a large armillary. He has a binocular scope into which he can peer to see outside the ship. Within easy reach to the left is a table-top panel of concentrically arranged buttons. To his right is a similar panel. Directly in front of him, beyond the scope, is a massive armillary that is the centerpiece of the bridge.

A model of United Planets Cruiser C-57D sits at the center of the ship’s armillary.

A model of the C-57D sits at the center of a transparent globe, which rotates in turn inside of another transparent globe. The surface of the interior globe is detailed with a graduated ring around its equator, semi-meridians extending from the poles, and a number of other colorful graduations. The outer, stationary globe has markings on the surface, which seem to describe stars and major constellations as dots and lines.

The utility of the armillary is somewhat questionable. From a relatively fixed position like the Earth, the celestial sphere doesnt change. But while astronavigating, the celestial sphere would change. Even though Altair is a relatively close to Earth, the change in position of the stars on the celestial sphere would likely be significant to correct positioning. So, for this to be useful, the markings on the outer sphere should be dynamic. Of course in the short sequence we see the armillary in use, we would not see the markings change, but there are no visual cues that it is dynamic in this way.

Additionally it should be noted that the biggest and most important things with which Lt. Farman would be concerned, i.e. the star Altair and planet Altair IV, are not represented in the display at all and represents a major failing of the design.

The crew makes it safely through decelleration.

One of the movie’s technology conceits is that deceleration from light speed is a shaky business. To protect the crew during this phase of travel, they stand atop deceleration stations. These small cylindrical pedestals have matching extensions from the ceiling that look vaguely like circular ventilation grills. Ten seconds before deceleration, the lights dim, a beeper sounds ten times, and the crew members step onto the pedestals. They fade from view in a beam of fuzzy aquamarine light. They fade back into view as the blue light disappears. During the period when the crew has passed from view, one would expect the ship to be shaking violently as discussed, but this doesn’t happen. Nonetheless, as the crew steps out of the station, a few are holding their necks as if in pain.

Military defense

11 Sep 2012 by Christopher Noessel

To defend themselves from the monster, the crew erects a defensive perimeter with terrifyingly inadequate affordance. It consists of roughly meter-high posts with eight edge-lit transparent triangles jutting out of opposite sides. When solid matter passes between any two posts, it is dealt a massive jolt of electricity. While useful, perhaps, to trap an invisible, animal-minded monster, the lack of any visual affordance to this effect seems stupidly dangerous to innocent animals and humans that might unknowingly step across its fatal path.

The bosun tests the defensive perimeter.

Sci-fi interfaces

Stop watching sci-fi. Start using it.

Tag Archives: safety

Otto’s Manual Control

A hint of practicality…

…But hidden

Anti-interaction as Standard Operating Procedure

Dust Storm Alert

A Well Practiced Design

Equal Opportunity Alerts

Why Not Network It?

Eve’s Gun

Awesome but Irresponsible

Automatic Safeties

A Possible Backup?

Nucleolab Kill Switch

Three improvements

Slideaway bed

Spacesuits

Audio

Lights, Cameras

Sleeve computers

Prometheus’ Flight instrument panels

Military navigation

Lt. Farman navigates the ship towards Altair.

A model of United Planets Cruiser C-57D sits at the center of the ship’s armillary.

The crew makes it safely through decelleration.

Military defense

The bosun tests the defensive perimeter.