Time circuits (which interface the Flux Capacitor)

BttF_137Time traveling in the DeLorean is accomplished in three steps. In the first, he traveler turns on the “time circuits” using a rocking switch in the central console. Its use is detailed in the original Back to the Future, as below.

In the second, the traveler sets the target month, day, year, hour, and minute using a telephone keypad mounted vertically on the dashboard to the left, and pressing a button below stoplight-colored LEDs on the left, and then with an extra white status indicator below that before some kind of commit button at the bottom.

In the third, you get the DeLorean up to 88 miles per hour and flood the flux capacitor with 1.21 gigawatts of power.

Seems simple.

It’s not… Continue reading

Main Power Board


To restore the power that Nedry foolishly shut down (and thereby regain a technological advantage over the dinosaurs), Dr. Sattler must head into  the utility bunker that routes power to different parts of the park. Once she is there Hammond, back in the Visitors Center, communicates to her via two-way radio that operating it is a two part process: Manually providing a charge to the main panel, and then closing each of the breakers.

The Main Panel


To restore a charge to the main panel, she  manually cranks a paddle (like a kinetic-powered watch, radio, or flashlight), then firmly pushes a green button labeled “Push to Close”.  We hear a heavy click inside the panel as the switch flips something, and then the lights on the Breaker Panel list light up green.

Now that she has built up a charge in the circuit, she has to turn on each of the breakers one by one. Continue reading

Flight Recorder


Jack flies the airship most of the way to the TET when he decides to listen the recordings of the Odyssey. He presses the play button on the recorder, it makes a beep and an electronic voice says, “Flight recorder playback for the Odyssey mission, 3 May 2017.” Then the playback starts.

First, real flight recorders

Before starting the analysis of the black box in Oblivion I thought it could be helpful to do some research on real-word black boxes. That way I had a reference point, something to compare this to. Oddly enough, there is a lot of information on the internet about the required recording and survival aspects of the device, but not much about means to find it after a crash. Beacons and transmitters are mentioned, but not many requirements to facilitate a person actually spotting it. Anyway, after that research I came up with a list of requirements for the device. It must…

  • Survive extreme temperature, pressure, and water conditions.
  • Record both ship and crew´s data on the flight.
  • Be easy to find in a crash site.
  • Provide quick access to the stored data.

You can think of modern flight recorders as big and tough hard drives that make digital recordings of both ship data and cockpit voice. Most modern commercial jets use a “quick access recorder” that stores data in a removable memory that can be plugged in to a common computer. And some recorders can also have an USB or Ethernet port for quick access, too. But often the device is damaged by the crash, and the full data needs to be accessed with special equipment.

So it’s against these requirements that we can analyze the real-world design of the flight recorder.

And really, this thing is like a Christmas tree of attention getting lights and sounds in comparison.

Great: Commanding attention

I have to give it to them here, they did a really good job. Aside from the normal design patterns for black boxes, the flight recorder in the movie provides other ways to find the device. The flashing white light can be easily spotted in the dark —and also on the day if bright enough. Even more, flashing is one of the most attention-getting signals that there are, neurologically speaking. And it can be instantly associated with an electronic device, while a fixed flight could be taken as a reflection on some debris.

Irregular flashing is even more powerful: A pattern that is semi random (or stochastic in the literature), with some flashes slightly offset from the main pattern. That difference in the flashing is even more attention getting that a regular one. This too would be really helpful in a crash site where you have an important amount of flashes going on as well: police cars, ambulances and fire cars. In that situation, the randomness of the flashing can help in distinguishing the device from the surroundings.

Julia was wandering through the Odyssey´s wreckage when she heard a soft and repeating sound. She pulled out some wreckage to find the flight recorder. These sound signals help her to locate the device more precisely when at close distance, even when it´s covered by debris if the sound is strong enough.


She takes it out to give it a look, and it´s here when we see the device.


When Julia finds the recorder, she knows that she and Jack need to carry it back to the Tower to better examine it. And as the recorder is kind of heavy, Julia folds out an small handler and uses it to lift up the recorder.

Great: Even better than a flash memory

The recorder in the movie also provides a way to instantly access the voice recordings of the crew. It uses a display and several buttons in a way that is similar to a music player, and building on a known mental model means that anyone looking for the device is going to be able to use it.

Assistive tools for the emergency mode

The recorder in the movie also seems to have two different modes or settings, an “emergency” mode when it has to be found and another mode to play the recordings. As with real flight recorders, the emergency mode could be activated by internal sensors. These could detect the crash via a sudden and/or significant change in velocity, for example. But it ought to have a manual control of some sort to return to normal mode.

When Julia finds the recorder, the device was beeping and using a light as beacon. It also had two status LEDs turned on and the small display was showing a graph curve in red. In contrast, when Jack is hearing the playbacks, the recorder doesn´t show any of those functions. Both the beeping, the lights, and the small screen display are all turned off, and the graph isn´t showing anymore.

What is that red graph supposed to mean anyway?

It´s not very clear what the purpose of the small screen display is. What is it meant to communicate? Additionally the display is oddly placed next to the controls of the recorder, which implies a mapping that doesn’t really seem logical. But mapping is not the only issue, because when the recorder is actually playing, this display is always off.

Given that It´s only on when Julia finds the recorder and the device is capable of playing the recordings by itself, it might be a way to tell the amount of battery life of the device. Although even then, a graph is something that shows change through time. When you need to know the energy levels at one specific moment, using a common battery indicator, or even a depletion bar would work better.

So maybe the graph is telling us that the device has some way of recharging itself. In that case, the graph could be showing charge and discharge cycles—or energy consumption rates—and by association also telling about some problem with the charging system. Even assuming this is the case, it´s odd that the display is always off during playback so it probably has some control to turn it on and off.

A screen dedicated to sound.

The recorder uses another, bigger display to show a number that indicates some time value, like recording or playback time. The bottom half of the display shows a spectrum analyzer of the recording playing at the moment, but when the recorder is not working this part of the display remains empty. During the movie we see that the recorder plays only sound, i.e. the voice recordings during the mission.

This screen offers some visualization but showing the spectrum analysis of the playback seems like a secondary feature. You know, given that it´s not necessary to actually hear the playback. But the display has a MODE button, so maybe the recorder can also record video to take advantage of the full size of the screen. In that case maybe the crew of the Odyssey just chose to only record audio, be it for privacy or to save storage space for the rest of the mission.


Jack was already in space and closing in to the Tet. And as he has to maintain his cover until he gets inside the Tet with the bomb, he stops the recording of the Odyssey.

After getting permission to dock in the Tet, Jack the returns to the playback. But the recording suddenly stops when the command module of the Odyssey got inside the Tet, then there´s only static and an—end of recording—message.

After getting permission to dock in the Tet, Jack the returns to the playback. But the recording suddenly stops when the command module of the Odyssey got inside the Tet, then there´s only static and an—end of recording—message.

But again, we never actually see the recorder playing video. And the display has a low resolution, monochrome screen—like some early PDAs. So making sense of any video playing from there would definitely be a challenge.

In case of evasion, BREAK GLASS

  • You sent for me, sir?
  • Yes I did…I did not, however, invite you to sit, Lieutenant.
  • Sorry, sir.
  • Are you aware that we have just lost contact with the Rodger Young?
  • Everyone’s talking about it, sir.
  • Well, I have the video feed from the bridge here. I understand you are the designer of the emergency evasion panel, and the footage raises some fundamental questions about that design. Watch with me now, Lieutenant.


Continue reading

Otto’s Manual Control



When it refused to give up authority, the Captain wrested control of the Axiom from the artificial intelligence autopilot, Otto. Otto’s body is the helm wheel of the ship and fights back against the Captain. Otto wants to fulfil BNL’s orders to keep the ship in space. As they fight, the Captain dislodges a cover panel for Otto’s off-switch. When the captain sees the switch, he immediately realizes that he can regain control of the ship by deactivating Otto. After fighting his way to the switch and flipping it, Otto deactivates and reverts to a manual control interface for the ship.

The panel of buttons showing Otto’s current status next to the on/off switch deactivates half its lights when the Captain switches over to manual. The dimmed icons are indicating which systems are now offline. Effortlessly, the captain then returns the ship to its proper flight path with a quick turn of the controls.

One interesting note is the similarity between Otto’s stalk control keypad, and the keypad on the Eve Pod. Both have the circular button in the middle, with blue buttons in a semi-radial pattern around it. Given the Eve Pod’s interface, this should also be a series of start-up buttons or option commands. The main difference here is that they are all lit, where the Eve Pod’s buttons were dim until hit. Since every other interface on the Axiom glows when in use, it looks like all of Otto’s commands and autopilot options are active when the Captain deactivates him.

A hint of practicality…

The panel is in a place that is accessible and would be easily located by service crew or trained operators. Given that the Axiom is a spaceship, the systems on board are probably heavily regulated and redundant. However, the panel isn’t easily visible thanks to specific decisions by BNL. This system makes sense for a company that doesn’t think people need or want to deal with this kind of thing on their own.

Once the panel is open, the operator has a clear view of which systems are on, and which are off. The major downside to this keypad (like the Eve Pod) is that the coding of the information is obscure. These cryptic buttons would only be understandable for a highly trained operator/programmer/setup technician for the system. Given the current state of the Axiom, unless the crew were to check the autopilot manual, it is likely that no one on board the ship knows what those buttons mean anymore.


Thankfully, the most important button is in clear English. We know English is important to BNL because it is the language of the ship and the language seen being taught to the new children on board. Anyone who had an issue with the autopilot system and could locate the button, would know which button press would turn Otto off (as we then see the Captain immediately do).

Considering that Buy-N-Large’s mission is to create robots to fill humans’ every need, saving them from every tedious or unenjoyable job (garbage collecting, long-distance transportation, complex integrated systems, sports), it was both interesting and reassuring to see that there are manual over-rides on their mission-critical equipment.

…But hidden

The opposite situation could get a little tricky though. If the ship was in manual mode, with the door closed, and no qualified or trained personnel on the bridge, it would be incredibly difficult for them to figure out how to physically turn the ship back to auto-pilot. A hidden emergency control is useless in an emergency.

Hopefully, considering the heavy use of voice recognition on the ship, there is a way for the ship to recognize an emergency situation and quickly take control. We know this is possible because we see the ship completely take over and run through a Code Green procedure to analyze whether Eve had actually returned a plant from Earth. In that instance, the ship only required a short, confused grunt from the Captain to initiate a very complex procedure.

Security isn’t an issue here because we already know that the Axiom screens visitors to the bridge (the Gatekeeper). By tracking who is entering the bridge using the Axiom’s current systems, the ship would know who is and isn’t allowed to activate certain commands. The Gatekeeper would either already have this information coded in, or be able to activate it when he allowed people into the bridge.

For very critical emergencies, a system that could recognize a spoken ‘off’ command from senior staff or trained technicians on the Axiom would be ideal.

Anti-interaction as Standard Operating Procedure


The hidden door, and the obscure hard-wired off button continue the mission of Buy-N-Large: to encourage citizens to give up control for comfort, and make it difficult to undo that decision. Seeing as how the citizens are more than happy to give up that control at first, it looks like profitable assumption for Buy-N-Large, at least in the short term. In the long term we can take comfort that the human spirit–aided by an adorable little robot–will prevail.

So for BNL’s goals, this interface is fairly well designed. But for the real world, you would want some sort of graceful degradation that would enable qualified people to easily take control in an emergency. Even the most highly trained technicians appreciate clearly labeled controls and overrides so that they can deal directly with the problem at hand rather than fighting with the interface.

The Lifeboat Controls


After Wall-E and Eve return to the Axiom, Otto steals the Earth plant and has his security bot place it on a lifeboat for removal from the ship. Wall-E follows the plant onboard the pod, and is launched from the Axiom when the security bot remotely activates the pod. The Pod has an autopilot function (labeled an auto-lock, and not obviously sentient), and a Self-Destruct function, both of which the security bot activates at launch. Wall-E first tries to turn the auto-pilot off by pushing the large red button on the control panel. This doesn’t work.


Wall-E then desperately tries to turn off the auto-destruct by randomly pushing buttons on the pod’s control panel. He quickly gives up as the destruct continues counting down and he makes no progress on turning it off. In desperation, Wall-E grabs a fire extinguisher and pulls the emergency exit handle on the main door of the pod to escape.

The Auto-Destruct

There are two phases of display on the controls for the Auto-Destruct system: off and countdown. In its off mode, the area of the display dedicated to the destruct countdown is plain and blue, with no label or number. The large physical button in the center is unlit and hidden, flush with the console. There is no indication of which sequence of keypresses activates the auto-destruct.

When it’s on, the area turns bright red, with a pulsing countdown in large numbers, a large ‘Auto-Destruct’ label on the left. The giant red pushbutton in the center is elevated above the console, surrounded by hazard striping, and lit from within.


The odd part is that when the button in the center gets pushed down, nothing happens. This is the first thing Wall-E does to turn the system off, and it’s has every affordance for being a button to stop the auto-destruct panel in which it sits. It’s possible that this center button is really just a pop-up alert light to add immediacy to the audible and other visual cues of impending destruction.

If so, the pod’s controls are seriously inadequate.

Wall-E wants to shut the system off, and the button is the most obvious choice for that action. Self-destruction is an irreversible process (even more so than the typical ‘ejector seat’ controls that Alan Cooper likes to talk about). If accidentally activated, it is something that needs to be immediately shut off. It is also something that would cause panicked decision making in the escape pod’s users.

The blinking button in the center of the control area is the best and most obvious target to “SHUT IT OFF NOW!”

Of course this is just part of the fish-out-of-water humor of the scene, but is there a real reason it’s not responding like it obviously should? One possibility is that the pod is running an authority scan of all the occupants (much like the Gatekeeper for the bridge or what I suggested for Eve’s gun), and is deciding that Wall-E isn’t cleared to use that control. If so, that kind of biometric scanning should be disabled for a control like the Anti-Auto-Destruct. None of the other controls (up to and including the airlock door exit) are disabled in the same way, which causes serious cognitive dissonance for Wall-E.

The Axiom is able to defend itself from anyone interested in taking advantage of this system through the use of weapons like Eve’s gun and the Security robots’ force fields.

Anything that causes such a serious effect should have an undo or an off switch. The duration of the countdown gives Wall-E plenty of time to react, but the pod should accept that panicked response as a request to turn the destruct off, especially as a fail-safe in case its biometric scan isn’t functioning properly, and there might be lives in the balance.

The Other Controls

No Labels.



This escape pod is meant to be used in an emergency, and so the automatic systems should degrade as gracefully as possible.

While beautiful, extremely well grouped by apparent function, and incredibly responsive to touch inputs, labels would have made the control panel usable for even a moderately skilled crewmember in the pilot seat. Labels would also provide reinforcement of a crew member’s training in a panic-driven situation.

Buy-N-Large: Beautifully Designed Dystopia


A design should empower the people using it, and provide reinforcement to expert training in a situation where memory can be strained because of panic. The escape-pod has many benefits: clear seating positions, several emergency launch controls, and an effective auto-pilot. Adding extra backups to provide context for a panicked human pilot would add to the pod’s safety and help crew and passengers understand their options in an emergency.


Dome City Rail


Citizens move between the distant parts of the city by means of a free, public transportation system. It is an ultra-light rail, featuring cars for two passengers, that move between long translucent tubes that connect the domes of the city. When one car stops at a station, its door slides open to allow exit and entry. We never see a car waiting behind another. Once seated, riders press a red button on a panel between the two seats (just visible in the screen capture below), and the car seals shut and takes off to the next station.



A small panel inside the car alerts passengers to the name of the next stop as well as any additional information that is of use. When Logan and Jessica head to Cathedral Station, the panel blinks a red light to draw their attention. (The paired green light is never seen illuminated. What’s it there for?) A female voice says "Entering a reservation for violent delinquents. Authorized persons only." The screen before them reads, “personal risk area." (For those wondering why it stops there at all, anyone can get out of their car here, but Logan has to use his personal communication device with Control to have the gate to Cathedral opened.

The panel and voice output are useful to alert riders whose attention has drifted. Text could be put in the environment of course, since this information rarely changes, but it’s a bit harder to read when it’s moving and isn’t as likely to gain a distracted rider’s attention.

The last bit of interface is the LED displays on the walls of fancier stops like Arcade (the dome with the shopping mall and Caroussel.) We never see this sign change, but it makes sense that while riders are at the station, it displays the stop as a reinforcing bit of information, and can display alternate messages for citizens waiting on a car otherwise.


The interface is incredibly simple because the system is so constrained. You have to hop on at a station, and like an airport tram or a shabbat elevator, the car runs along a fixed loop. You hop out when you’re there. The main negative issues I see are selecting a stop and perhaps safety.

Selecting a stop

It’s a waste of time and energy to have cars stopping and starting at unwanted stations. It can also be distracting to have the car tell you about all the intermediate stops when you’re not interested in them.

To solve this problem, the track system should be built with track bypasses so we have to worry less about track congestion at stops. Then riders could either ride the “local” from stop to stop, or optionally have some way to indicate their desired stop, bypassing the ones in between. What’s this indication look like? In the panopticon of Dome City, the Übercomputer can just listen to your conversations wherever you’re having them, and when you get to a car default to the stop expressed in conversation. Logan and Jessica had just spoken about Cathedral Station, so when they stepped in, it could have just asked them to confirm. If the selection was wrong, or no stop had been mentioned recently, riders should be able to speak their destination or the event to which they’re headed. As a last fallback, a screen displaying discrete options could allow them to select a destination by touch or gesture.


Rider safety

The safety issue is subtle, but if riders have no control over the cars, why are the seats facing forward? It’s much safer in a head-on collision to be seated "backward," like an infant’s car seat. Psychologically, people are most comfortable sitting forward to see in the direction of potential collisions, but if you lived in an UberNanny State like Dome City, the system would just force people to sit in the safest way.

It’s going to be more complicated than this

Getting public transportation experience design right is tough enough. But it’s going to get more complicated. Here at the dawn of computer-driven cars and computer-requested and computer-wayfinding "routeless" busses, the challenges will be manifold. How do you signal a stop? How does it gracefully degrade? How do you pay? How do you get to a just-in-time defined stop? How do you indicate your destination(s), willingness to share the ride, and urgency? How do you not disenfranchise people just because they have no cell phone? Dome City is small and constrained enough to ignore such problems, like a light rail in a small, wealthy, downtown core, making it almost too simple to be instructive.


Initiating Apartment Lockdown


Zorg issues orders to the police to arrest Korben Dallas. A squad of 8 officers arrive to his apartment block. They know what apartment number he’s supposed to be in, but the residents have blacked out their unit numbers on their doors.


To authorize the lockdown, the squad leader opens a police box mounted on the wall in the hallway by placing the top edge of a transparent warrant into a slot on its side. The box verifies the warrant and slides open. The squad leader presses a red button within.


During lockdown a klaxon sounds, red beacon lights descend from the hallway ceiling, and a loud, clear voiceover is heard in the hallway and in the apartments themselves.



The circles in question are painted at chest height on the walls inside of each apartment, a little wider than shoulder width. There is a small intercom interface mounted in the wall directly between the yellow circles. The police use different interfaces for peering inside apartments and this intercom for communicating with citizens, but these will be discussed separately in the next post.


There are a few sets of users for this particular set of interfaces: The police, Zorg, and Korben. To evaluate the system, we need to look at each user independently.

  1. For the police, this interface seems to work well. Since the lockdown is part of the infrastructure, they don’t have to bring anything but their standard gear and the warrant. They save energy and the tedium of alerting the citizens and issuing standard compliance instructions. In a fully networked world, you might think to simply have him or her authorize themselves using biometrics, but in keeping with the principles of multifactor authentication, you might require the officer to carry something anyway. Since you’d want a physical warrant for a poor or luddite citizen to be able to see and verify, it’s going to be there, might as well use it.
  2. For Zorg and issuing authorities like him, he kind-of wants to minimize danger to his people and certainly his equipment, which this helps do. He also wants to cover his ass from citizen lawsuits, and having the traceability of the warrant-scan means he will have a record that due process has been followed. As we’ll see tomorrow, ultimately he doesn’t get what he needs, but as far as this lockdown interface, it seems like it would work just fine.
  3. For the citizen Korben, the interface provides a clear signal and easy-to-follow instructions, so the proximal part “works.” What doesn’t work is that the whole system is horribly demeaning, authoritarian, and—fully risking Godwin’s Law, here—fascist.

Security is almost always at odds with usability, and this interface proves no different. To improve the experience for the good citizen, you might want to provide some warning, some ability to finish what they’re doing, or some less demeaning way to show that they are cooperating. But any concessions made for the good citizens will be taken advantage of by the bad ones, and so I don’t know that design can really fix that tension.

P.S. As of this writing my Minority Report review is not posted, but readers interested to compare and contrast a similar scene done with more seriousness some 5 years later should check it out.



Amongst its many holdings (including taxi cab companies) Zorg industries manufactures weapons, including their flagship weapon, the ZF-1. It has a great many features. It stores as a sealed pod, and can be activated by a remote control. With a press of a button, shielding retracts and parts extend so it can be handled like a traditional small arms weapon.

Zorg makes a pitch to the Mangalores for the ZF-1, so we’ll just let his own words sell it.

It’s light. The handle is adjustable for easy carrying. Good for righties and lefties. Breaks down into four parts. Undetectable by x-ray. Ideal for quick, discreet interventions. A word on firepower: Titanium recharger. 3,000 round clip with liquid bursts of 3-to-300.”

Next he pitches something quite unique to the weapon.

“With the Replay™ button—another Zorg invention—it’s even easier. One shot…and Replay™ sends every following shot to the same location…”

As he turns and points the weapons at the Mangalores, the ammunition arcs around to home in on the first shot.


But wait, don’t answer. The ZF-1 has other features as well.

…And to finish the job, all the Zorg oldies but goldies: Rocket launcher, arrow launcher with explosive, poisonous gas heads (very practical), our famous net launcher, the always-efficient flamethrower (my favorite), and for the grand finale, the all-new Ice Cube™ System.

After the Magalores fail to uphold their end of the bargain, Zorg leaves them to play with the weapons. As they do, one discovers that the glowing red button on the side is actually an explosive self-destruct.



I know Mangaglores are not meant to be shining examples of intellect, but if I was considering a purchase, I would yes, compliment the incredibly nifty technology of Replay, but follow it up with four more important questions about the design of the thing.

First, Mr. Zorg, what good is the remote control? Doesn’t this make the weapon hackable remotely? Isn’t that device easy to misplace? What on-weapon means do we have to unlock it?

Second, how are you selecting from among the six different types of ammunition?


On the exterior, we only see that red button. There might be some other subtle switches somewhere on the exterior, but you had to support the weight of the device with your left hand, so it’s fairly immobilized and I didn’t see you moving it. Unless it can only fire in exactly the order we saw, there’s got to be some other control. With your right hand hidden up inside the weapon, there must be other activation switches there. What switches are tucked up in there that are easy to differentiate by touch and easy to activate with your palm remaining against the grip?

Third, there’s that red button. Sure, who wouldn’t want to carry around a device that could erupt as an all-consuming fireball, but I notice that it doesn’t have a safety cover on it, gives no pause or warning during which the command can be retracted, and draws attention to itself by its glow. Isn’t that going to be increadibly easy to, you know, accidentally kill all my troops?

Fourth, during the demonstration we got a good glimpse at the front of the weapon. It’s got animated, blinking red LEDs whose pattern merges together to form a bright red diamond shape near the top of the weapon before looping over again.


I’m not a militarily-minded person, but isn’t it counter to a soldier’s goals to have anything blinking, glowing, or pinpointing the soldier’s exact midline to enemies, much less something that does all three at once, and in red, the color that travels the farthest in atmosphere?

What was that about “discreet” interventions?