Free Article: The Bridge: A Systems View

You’re an experienced airline pilot, comfortable with the plane’s equipment and procedures. Takeoff went smoothly, and your passengers are settling in. Without warning, the plane nosedives. You follow the procedures, try to level out, but the control system fights you.

by Nic Gardner MNI, Nautical Institute Automation Technical Advisory Group

---

You override the control system, but it turns back on a few seconds later. In desperation, you leave your co-pilot to try to fly the plane while you read the manual, hoping to find some way to disconnect the faulty system. Just 13 minutes after takeoff, you, your co-pilot, your plane, and 157 passengers plunge into the ocean. No-one survives. This was the reality for the pilots of Lion Air 610 in 2018. Just a few months later, the story repeated with Ethiopian Airlines flight ET602, another Boeing 737 Max, which survived just 12 minutes after takeoff. The problem? A faulty sensor, and a secret safety system.

What is a system?

Systems rule our lives: safety management systems, human bodily systems, propulsion and sewage systems, personal computer systems and more. The system on Lion Air 610 is actually a system intended to improve safety, but it caused a disaster. 

Well-designed systems make all our lives considerably easier, and the ship’s bridge is no exception. But what is a system?

For our purposes, a system is a set of components that work together to turn inputs into outputs via processes.

A simple system

In a closed system such as a cup of hot chocolate with a lid, mass cannot enter or leave the system, even if energy (heat) can. In contrast, an open system takes inputs from outside the system, then turns them into outputs that return outside the system. Most systems are open systems.

Take your body as an example: you input food and drink. Your digestive system processes the food, and outputs energy and waste products. The energy enters other systems as an input, and is processed, along with other inputs, to create other outputs and – if it’s working properly – keep you alive. 

As in so many systems, one of the outputs of the digestive system — energy — becomes an input to other systems. In turn, these other systems process the energy – their input – to create more outputs such as movement and breathing. Your body is a system of systems.

When you’re injured, you expect the medical professionals to consider your body’s systems as a whole, not just treat the obvious symptom. For example, if you have a terrible headache, painkillers might help; however, if someone doesn’t look more carefully at the system as a whole and address the twistlock embedded in your skull, it will end badly for you.

Why should you care? 

But what does this have to do with a ship’s bridge? Actually, quite a lot. How many bridge watchkeepers have complained because the same alarm goes off every few minutes? Like the headache above, the alarm is the symptom, not the problem. If you silence the alarm without fixing the problem, of course it will keep going off. But to fix it, you must understand what the alarm is telling you: you have to understand the system, including its inputs, processes, and outputs.

 

Let’s look at some examples of bridge equipment from a systems perspective. A basic stabilised radar is a great place to start.

The radar’s inputs are the radar signal and the ship’s heading and speed. A computer processes these inputs to create a picture that it displays on the screen and sends to the Voyage Data Recorder (VDR) – the output. Any alarm alerts you to a discrepancy in inputs, processes, or outputs. If the primary output of your radar—the radar picture you’re watching—suddenly changed from a north-up stabilised display to a head-up unstabilised display, what would you check first?

If you answered ‘the heading input’ you understand the system and the function of each input. As an initial response, checking your gyro compass and its connections to your radar, or changing over to your backup heading input (if you have one) would make far more sense than checking your power supply or your speed log. Even if that doesn’t work, at least you have more useful information to pass on to the engineer or technician.

Can we control systems?

Systems exist to serve us, so they’re useless if we can’t control them. Open-loop control systems are the simplest type of control system. The common emergency steering system in which you stick a pin into a solenoid to turn the rudder is an open-loop system –the rudder keeps moving until you remove the pin, or it reaches its maximum angle. Without a human to close the loop, open-loop control systems are useless.

In contrast to open-loop control systems, in a closed-loop control system part of the output feeds back to the controller, which adjusts the process in response. The main steering system on most vessels is a closed-loop system; when you turn the wheel to starboard 10, it sends a signal to the steering control system to move the rudder. The system feeds back the rudder angle to the bridge. Once the rudder reaches starboard 10, the control unit stops sending the ‘move the rudder’ signal. Most bridge systems have closed-loop control systems as the primary system, with open-loop backup systems.

 

 

In an open-loop control system, there are only three things that can go wrong:

1. Inputs
2. Processes
3. Outputs

In a closed-loop control system (see diagram above) there is a fourth factor to consider: feedback. Forgetting about the feedback can be a problem, as the bulk carrier Dumun found out in 2011. The ship ran aground after the rudder angle indicator stopped working. Even though the steering system was working and the rudder was moving as intended, the officers and pilot assumed the problem was the system output – the rudder movement – rather than considering the possibility of a feedback problem and sending someone to the steering compartment to check what the rudder was doing. The Boeing 737 Max described earlier was a more catastrophic example of a feedback problem in a closed-loop system, where false information from the angle of attack sensor caused the system to automatically force the plane’s nose down.

What use are humans?

Did any junior officer object when computers took over updating the List of Lights? It left more time for the more interesting (and, some might say, useful) jobs that humans actually enjoy doing. Unlike humans, computers can store, recall, and process data quickly and accurately, and they don’t suffer from boredom, fatigue, or distraction. For routine, repetitive operations, computers are the correct tool for the job. However, humans outperform computers when it comes to creative thinking and dealing with novel situations. Tasks such as crew communication in emergencies or working around regulatory changes at the next port are still a job for the humans.

Modern bridge systems are complex, but bridge watchkeepers don’t need to become elecrotechnical officers (ETOs) or computer programmers to understand the basics of how their systems work. For each system, look at the inputs and the outputs, and work out how they’re related. Whether a sensor fails, or a criminal spoofs a GPS signal, all watchkeepers need to be able to at least identify that:

1. there is a problem; and 
2. which part of the system is likely to be the problem.

Sometimes fi xing the problem really is as simple as, ‘check that it’s plugged in’ or ‘turn it off and on again,’ and it will start working. But knowing which input to turn off and on again, when there are multiple inputs? For that, you need to understand the system.

---

Key terminology for digital systems 

I/O: input/output. This refers to data sent to or from a computer, including keyboards, mice, displays, and network or internet data.
Logic: digital logic is the sequence of operations for a computer or computer chip. Hardware logic is built into the hardware, while software logic is programmed in the software.