Categoría: Seguridad aérea

Three myths in technology design and HCI: Back to basics

It has been a coincidence driven by the anniversary of Spanair accident but, for a few days, comments about the train accident in Santiago de Compostela and about the Spanair accident appeared together. Both have a  common feature beyond, of course, a high and deadly cost. This feature could be stated like this: «A lapsus cannot drive to a major accident. If it happens, something is wrong in the system as a whole».

The operator -pilot, train driver or whoever- can be responsible if there is negligence or clear violation but a lapsus should be avoided by the environment and, if it is not possible, its consequences should be decreased or nullified by the system. Clearly, it did not happen in any of these cases but…what was the generic problem? There are some myths related to technology development that should be explicity addressed and they are not:

  • First myth: There is not an intrinsic difference between open and closed systems. If a system is labeled as open, that comes only from ignorance and technology development can convert it into a closed one: To be short and clear, a closed system is one where everything can be foreseen and, hence, it is possible to work with explicit instructions or procedures while an open one has different sources of interaction from outside or inside and it makes impossible to foresee all posible disturbances. If we accept the myth as a truth, no knowledge beyond operative level is required from the operator once technology reached the right point to consider a system as closed. Normative approach should be enough since every disturbance can be foreseen.

Kim Vicente, in his Cognitive Work Analysis used a good metaphor to attack this idea: Is it better having specific instructions to arrive to a place or is it better a map? Specific instructions can be optimized but they fail under closed streets, traffic jams and many other situations. A map is not so optimized but it provides resources under unforeseen situations. What if the map is so complex that including it in the training program should be very expensive? What if the operator was used to a roadmap and now he has to learn how to read an aeronautical or topographic map? If the myth works, there is not problem. Closed street and traffic jams do not exist and, if they do, they always happen in specific places that can be foreseen.

  • Second myth: A system where the operator has a passive role can be designed in a way that enables situation awareness. Perhaps to address this myth properly, we should go back to a classic experiment in Psychology:  http://bit.ly/175gKIc where a cat is transporting another one in a cart. Supposedly, the visual learning of both cats should be the same since they have a common information. However, results say that it does not happen. The transporting cat get a much better visual learning than the transported one. We don’t really need the cats nor the experiment no know that. Many of us can go a lot of times to a place while other person is driving. What happens when we are asked to go alone to that place? Probably, we did not learn how to go. If this happens with cats and with many of us…is it reasonnable to believe that the operator will be able to solve an unplanned situation where he has been fully out of the loop? Some designs could be removing continuous feedback features because they are hard and expensive to keep and, supposedly, they add nothing to the system. Time ago, a pilot in a highly automated plane told me: «Before, I was able to drive the plane; now the plane drives me»…this is other way to describe the present situation.
  • Third myth: Availability bias: We are going to do our best with our resources. This can be a common approach by designers: What can we offer with the things that we have or we can develop at a reasonnable cost? Perhaps that is not the right question. Many things that we do in our daily life could be packed in an algorythm and, hence, automated. Are we stealing pieces of situation awareness at doing so? Are we converting the «map» into «instructions» without resources if these instructions cannot be applied? However, for the last decades, designers have been behaving like that: Providing an output under the shape of a light, a screen or a sound it quite easy while handles, hydraulic lines working -and transmitting- pressure and many other mechanical devices are harder and expensive to include.

Perhaps whe should remember again «our cat» and how visual and auditive cues could not be enough. The right question is never about what technology is able to provide but about what is the situation awareness that the operator has at any moment and what are his capabilities and resources to solve an unplanned problem. Once we answer this question, perhaps some surprises could appear. For instance, we could learn that not everything that can be done, has to be done and, by the same token, some things that should be done have not a cheap and reliable technology available. Starting a design trying to provide everything that technology can provide is a mistake and, sometimes, this mistake is subtle enough to pass undetected for years.

Many recent accidents are pointing to these design flaws, not only Spanair and Renfe ones:  Automated pilots that get data from faulty sensors (Turkish Airlines, AF447 or Birgenair) , stick-shakers that can be programmed -instead of behaving as the natural reaction of a plane near to stall- provoking an over-reaction from fatigued pilots (Colgan), indicators where a single value can mean opposite things (Three-Mile Island) and many others.

It’s clear that we live in a technological civilization. That means assuming some risks, even catasthropic ones, like an EPM or a massive solar storm. However, there are other minor and current risks that should be controlled. Having people to solve the problems while, at the same time, we steal them the resources they should need to do that is unrealistic. If, driven by cost-consciousness, we assume that unforeseen situations are below one in thousand million and, hence, this is an acceptable risk, be coherent: Eliminate the human operator. By the other side, if we think that unforeseen situations can appear and have to be managed, we have to provide people with the right means to do so.  Both are valid and legitimate ways to behave. Removing resources -including the ones that allow situation awareness- and, once the unforeseen situation appears, having an operator as a breaker to burn speaking of «lack of training», «inadequate procedure compliance» and other common labels is not a right nor legitimate way. Of course, accidents will happen even if everything is properly done but, at least, the accidents waiting to happen should be removed.

Accidente de Santiago: Declaraciones del maquinista

Tras el accidente de Santiago de Compostela, debo encontrarme entre los pocos españoles que no son especialistas en trenes. Sin embargo, sí estoy suficientemente familiarizado con los factores humanos y con la seguridad para encontrar cosas que me sorprenden en las declaraciones publicadas del maquinista implicado en el accidente:

  • Cuando el juez le pregunta si pueden recorrerse cuatro kilómetros distraído, la respuesta del maquinista es de puro sentido común: “A 200 kms./h. cuatro kilómetros pasan muy deprisa”. Cierto. A 240 kms./h. cuatro kilómetros pasan exactamente en un minuto.

Tras esta respuesta, alguien podría pensar que, si va completamente distraído mientras conduce durante todo un minuto, seguramente acabará fuera de la carretera y tendrá razón: Eso ocurre en la carretera; no ocurre en los trenes, al igual que no ocurre en los barcos o en los aviones y eso nos debería dar una primera pista:

La carretera exige del conductor una mayor atención al entorno y un cierto nivel de actividad debido a la necesidad de seguir el trazado, de anticiparse a situaciones relacionadas con el tráfico, etc. Sin embargo, en otros medios de transporte lo que se exige, salvo en determinados momentos, es mantenerse alerta para supervisar el funcionamiento del vehículo que se va controlando. En aviación, se ha criticado con frecuencia a los sistemas muy automatizados que mantengan al piloto fuera del “loop de control” o, en otros términos, que el avión vuela solo pero, cuando algo ocurre, se requiere la intervención urgente de alguien cuya función era estar ahí “por si acaso”.

Si en algo estamos de acuerdo todos los que, de una u otra manera, trabajamos en factores humanos es en el hecho de que somos unos pésimos supervisores. No estamos “diseñados” para supervisar sino para hacer. Cuando alguien nos pone a supervisar, es inevitable que surjan las distracciones y los fallos de atención; éste es un hecho muy conocido en aviación pero su aplicación no es exclusiva de este ámbito.

  • Cuando el juez le pregunta si existe un sistema de frenado automático, el maquinista responde que en esa zona es él el que frena y no un sistema automático. Al repetirle la pregunta, insistiendo en saber qué es lo que ocurriría si el maquinista no frena en el punto en que debería llega la sorpresa: Si va por encima de 200 kms./h. el tren pondría en marcha todos los dispositivos de frenado automáticamente hasta detenerse pero, si va por debajo de 200 kms./h., no pasa nada. La curva del accidente está limitada a 80 kms./h.¿Sirve de algo una protección automática que sólo funciona cuando se circula a más de 200 kms./h.? La respuesta la tenemos en los periódicos de los días pasados y el video en Youtube.

No hay término medio válido aquí. Si se asume que el maquinista es un mero vigilante, dótese a la línea y al tren de sistemas automáticos que impidan situaciones como la que produjo el accidente de Santiago y asumamos que el maquinista se va a distraer, como lo hacemos todos cuando estamos en tarea de vigilancia porque, una vez más, no estamos hechos para vigilar sino para hacer.

Si se asume que el maquinista tiene un papel más activo, diséñense trenes que exijan ese papel más activo. Los aviones a prueba de fallos de pilotos y los trenes a prueba de fallos de maquinistas también traen sus propios problemas, a veces en forma de falta de realismo sobre cuáles son las cosas que hacemos bien y cuáles las que hacemos mal.

Maquinistas y pilotos: Factores humanos en trenes y aviones

El terrible accidente de tren de Santiago de Compostela ha puesto, una vez más, encima de la mesa el asunto del error humano que, en este caso, se ha revestido desde el principio del concepto de imprudencia.

Sinceramente, siempre desconfío del diagnóstico de “error humano” como causa de un accidente. Existen tanto en aviación como en ferrocarril como en cualquier otro ámbito muchos y poderosos intereses que invitan a utilizar al maquinista o al piloto como una especie de fusible de forma que el sistema, y los que lo dirigen, queden fuera de todo escrutinio.

Cuando alguien decreta que un 90% de los accidentes se producen por fallo humano, cabe pensar si, con ello, quiere evitar que se mire más arriba del maquinista o del piloto o de quien, en última instancia, haya tenido la mala suerte de estar más cerca del accidente.

Dicho esto, y una vez explicados mis motivos para la desconfianza, es cierto que la realidad suele ser muy terca y que las imprudencias existen: Las personas no somos máquinas y podemos decidir en un momento dado comportarnos en forma imprudente. Por supuesto, aunque la imprudencia tenga consecuencias profesionales, penales o incluso se pague con la vida propia y ajena, el análisis no puede detenerse ahí: ¿Es la primera vez o hay indicios de que tal actuación se venía repitiendo en el tiempo? Si había indicios ¿Por qué no se detectaron? ¿Es posible o deseable utilizar protecciones tecnológicas? ¿El lugar o la situación eran intrínsecamente peligrosos y estábamos ante un accidente en busca de la oportunidad para producirse?

La situación que hoy se nos plantea en el tren de Galicia, al menos con lo que conocemos hasta ahora, se produjo hace cinco años en un accidente de aviación: El vuelo 518 de Santa Bárbara Airlines. El avión despegó de una zona montañosa de Colombia, Mérida, para estrellarse minutos después del despegue en territorio venezolano.

La investigación posterior mostró que los pilotos se llevaron el avión al aire en la forma que la mayoría nos llevamos un coche: Girando la llave de contacto y marchándonos. Los pilotos conocían muy bien la zona; la conocían tan bien que despegaron sin dar tiempo a que funcionasen los giróscopos en que se basa el sistema de navegación y se metieron en terreno montañoso, sin visibilidad y sin más referencia que la brújula del avión. El registro de voces en cabina daría lugar a indicios de que no era la primera vez que los pilotos actuaban de esta forma; simplemente, esta vez les salió mal y nadie sabía que estaba ocurriendo y, si alguien lo sabía, una vez ocurrido el accidente optó por callarse para no ser acusado de permitir tal práctica.

¿Imprudencia clara? Sin duda; sin embargo, incluso en este caso, hay que analizar si era detectable, si era evitable y si, una vez cometida, se podían contener sus efectos. Cuando se habla de trenes, siempre hay una ventaja sobre los aviones: Se hace difícil pensar en efectos negativos para la seguridad de cualquier protección tecnológica que detenga o disminuya la velocidad del tren en caso de error o violación del maquinista; esto no ocurre en aviación donde las protecciones tecnológicas asumen que se está produciendo una situación y, si no es ésa la situación o algún sensor falla, la protección puede convertirse en el causante directo del accidente.

¿El trazado es inadecuado? Es posible pero, a la escasa distancia que se encontraba la curva de Santiago de Compostela, si el tren pasaba por ella a 190 kms./h. ¿dónde pensaba frenar?

¿Iba el maquinista descansado o tras varias horas se llevan los raíles y las traviesas clavados en la retina y se tiene una propensión al error que no se tiene al principio de un viaje?

Son muchas preguntas las que hay que responder todavía pero, desde la desconfianza ya apuntada hacia todo diagnóstico que pretenda dar carpetazo con el sello “error humano”, tiene que haber también un reconocimiento de que la imprudencia sin paliativos también existe. ¿Es éste el caso del tren de Santiago de Compostela? Hoy aún no podemos saberlo. Confiemos en que, cuando lleguemos al final de la investigación, los intereses no han prevalecido sobre la verdad. Las víctimas siempre se merecen que se llegue a la verdad, caiga quien caiga, tanto si tiene que ser un maquinista como si tiene que ser un ministro.

Human Factors: Pilot Error

A few days ago, I was watching a documentary about air accidents. The bad part of documentaries is that, if you know in depth an accident, you’ll always find a trivial if not contradictory story. The good part is that you can find some interesting case that you did not previously know about. This was my situation with Crossair 3597 and the analysis of the facts. For good reasons, I did not trust the TV documentary and accessed the official report. However, in this case TV seemed to be right: Researchers went through the whole records of the PIC finding hard to explain why this pilot was flying passengers and writing all of these findings on the official report.

In some places, it is hard or impossible to run this kind of investigation. Certainly, regulators and operators can have the biggest interest in making the pilot appear as guilty of an accident. First, if he did not survive, he will not reply. Second, responsibility for the accident goes a little bit further from them and Third, they do not have too much to change under this kind of outcome since, at last, the problem came from a bad pilot.

Pilots associations, at their time, do not like having the record of a pilot subject to any kind of criticism and try to stop a research that could go beyond current licenses and type ratings. Any other is called «throwing garbage to his memory». Actually, I remember a situation when, after pointing to the low experience of a pilot involved in an accident, someone told me that I could not demonstrate that a more seasoned pilot could have avoided the accident. That was true, as well as the fact that the person who said that could not demonstrate that an expert pilot could not have avoided the accident: Draw.

Pilot error, of course, exists. If the record of a pilot is a clearly inadequate one and it is finished with a deadly accident, the knowledge of this record will trigger questions about who, how and why hired him and how was the training and the checks that every pilot has to pass. Victims, including very often the pilot himself, deserve going through the records without witch-hunting spirit but trying to know and to avoid the same mistake in the future. Perhaps, this is more important than ever: We have MPLs and even pilots that are completing their training in the right seat of some airlines.

The Crossair example is a good one. Any investigation should be driven by the principle of knowing the truth, all the truth and nothing but the truth…and no interest should be above this.

The always missed blessing of automation in Aviation

I found this interesting article about automation in Avweb: http://www.avweb.com/news/features/Automation-Friend-Or-Foe220153-1.html Probably, nobody -including myself- is going to discuss that automation came to remain in Aviation and there is nothing wrong with that.

The problem that can make articles like this one uncomfortable for some of us is a kind of default position where a deeper analysis is missing. Can we say that in the past automation was to support humans and now it is the reverse? Probably that is right since, at this moment, many features of Aviation should be lost if someone insists in people supported by technology. A CATIII landing, for instance, simply cannot be done by a human pilot. The precision required to navigate our crowded skies with decreased distance among planes should be again impossible to keep for a human hand during a long period of time. So, what is the problem?

First, if we accept that humans are going to perform as support for automation, they should have resources -understood in a wide sense- to perform that function. People, to work properly in Aviation and probably in any other field, cannot be subject only to a feedback loop. They have to be able to anticipate what is coming, that is, they need to have information enough to forecast the next minutes or the next hours. If they do not have this kind of situation awareness, they cannot be expected to solve an important problem once it appears.. Is all the automation in the market designed to support a pilot whose head is before the plane or is the pilot expected to remain quiet passing checklists and to intervene only after a problem unmanageable for automation appeared?

That’s the problem of the «default position»: When someone speaks about automation, it is very common forgetting that automation is divided in two big classes: Good and Bad. We cannot assume that automation is always good and all the effort has to come from the human operator who has to adapt to it. Adaptation has to be mutual and that means also getting rid of features that can be error inducing or hide key information. This is not new and when highly-automated planes started to crowd the market, pilots were supposed to adapt to the situation, even if that situation could be shouting about a bad design. Some problems are so old that they already were addressed by people like the deceased designer of MacIntosh, Jef Raskin, but they are still among us.

Automation? OK, but if we want to have an alternative resource to automated systems, we need to keep current knowledge and abilities as the ones required to fly manually a plane and it seems that there is a problem here that was made public for someone as relevant in Aviation as the CAA-UK. Furthermore, automation has to be designed thinking in someone that could be required to take the controls in delicate situations. If a design does not meet these criteria and, even though, once in the market a design is considered as unquestionnable, let’s be coherent: Do not have pilots. If they cannot be that alternative resource, it should be more coherent to fully trust in automation and, if a crash happen, tell the relatives of victims that the probability was extremely low and it probably never will happen again.  Acceptable? Obviously, not.

Nothing to say about the presence and relevance of automation and/or I.T. in Aviation. The only part that could not be acceptable is this default position that makes automation an unquestionnable piece of the environment without stopping to think that, perhaps, automation and Information Technology can also be wrongly designed and, when it happens, it is not fair asking everyone to «adapt» to the creative genius of the designer that, in some cases, could not be creative nor genius and, especially not a designer. Designs, as everything, have to be open to question and, when something shows to be wrong, the «Human Error» or «Lack of Training» labels cannot be used to hide this fact.

Normal Accidents, Blackened Swans and Human Error

Long ago, in 1984, Charles Perrow published the book destined to be the most important one written by him: Normal Accidents. In this book, Perrow established that accidents happened due to an increasing complexity linked to tightly-coupled organizations. Snowball effects could happen through unexpected interactions among parts of the system.

Perrow had many followers -Hollnagel is perhaps one of the most brilliant-  that voiced their concern about the rationale behind technology improvement. Accidents increase their outcome through the same channels that organizations use for their normal activity. Accidents in efficient organizations are efficient too. The risk concept, understood as a product of impact by probability is changed through complexity: Probability is decreased and potential impact is increased.

A few years ago, Nassim Taleb used an interesting concept, Black Swan, to speak about situations that, simply, were supposed not to happen. Therefore, nobody had provided resources for this possibility. Once the accident was happened, we could attend to an incompetence exhibition in the management of the event because everyone was convinced that it cannot happen. We can try to reason in a fine and honest way but, even though, we won’t avoid the existence of black swans , that is, we always are going to find fully unexpected situations. However, there is a variety of situations that can pass undetected, that is, the blackened swans. 

What is a blackened swan? Something that, actively, we have chosen not to see. Perrow, Hollnagel and others tell about a dynamics that many others do not want to see: If an airline run into serious financial problems or works with a very short profit margin, we could reasonnably thing that they are saving money in the less visible parts -one of them is Maintenance- but Aviation regulator don’t know about financial issues and financial specialists do not know about Aviation. As it happened in the Titanic, both things work as watertight compartments. As it happened in the Titanic compartments are not fully watertight and the vessel can be sunk: When a pilot is taught that advanced electronic systems can guarantee that the plane cannot stall…he will pull the flighstick, he’ll do it still more whole-heartedly if a synthetic voice encourages him to do that and he’ll do it without a feeling that something is wrong if the flighstick does not give any feedback through pressure feeling. If regulations allow a twin plane to fly more than five hours through oceanic ways without any available airport…sooner or later, a plane will have to go into the water with a full load of passengers. If a company loads the minimum fuel required by law and it had problems in the past because of that, a moment will come with a plane going down because of fuel-starvation…these are the blackened swans, risk situations that everybody knows but where accountable people look to other place.

When these blackened swans situations produce its expected outcomes, we always will find people telling us that it was a black swan. Of course, to do that, they will carefully hide the fact that they painted it before to not see the risk and, hence, to say that they were ignorant about the risk before the event. There is still another resource to justify why a situation does not change: Call it Human Error.

Flight Engineer, in memoriam

Once upon a time, all the planes had 4 people in the flightdeck: Captain, first officer, flight engineer and radio. We can go beyond in history to find the navigator but this can be enough to go to the point. Once pilots started to be proficient enough in English, radio-operator could be redundant. Actually, the operator was making transcriptions from pilots to ATC and from ATC to pilots and every transcription is an opportunity for a mistake. With all my professional respect for radio-operators, their absence in the flight-deck should not be a big issue…assuming that the pilots were proficient enough in the language used to communicate with ATC.

The situation of Flight Engineer was not the same. All the long-haul planes had one and his missions were very well-defined. The surveillance of the engines, fuel consumption, change of fuel tanks to keep center of gravity in the right values and, of course, the analysis of any technical problem in flight were the tasks of the flight engineer.  The first big plane without a flight-engineer was the Airbus A310. Boeing complained heavily but, once they saw that it should be hard to modify this practice, they launched their 757/767 without a flight engineer too.  From that moment, every single plane, whatever the size and range, coming from Airbus or Boeing came without a place for a flight engineer.

Of course, both manufacturers promised that it was not against safety because all of the functions of the flight engineer should be performed by automatic systems and warnings under any abnormal situation. Everyone takes for granted that flight-deck are designed for two people and, if an accident happens, nobody is going to trace it back to the absence of a flight engineer. Proofs?

Let’s speak about Swissair 111: An uncontrolled fire in the flight-deck finished with the crash of a MD-11 full loaded of passengers. The MD11 was the successor of DC10 and, except for the winglets of the first one, they were not easy to distinguish at a first glance. However, it was an important difference between them: The DC10 had a flight engineer and the MD11 did not have one. At the beginning, in flight SW111, the pilots had to look for radio-frequences, runway orientation and lenght and all the information that they needed to land the plane in a fully unknown airport. Of course, at the same time, they had to keep an eye over the emergency and the development of the fire onboard.

Had the same situation happened in a DC10, one of the pilots could fly the plane, the other one could navigate and communicate and the flight engineer could be in charge of the emergency. Nobody can be sure that it should have been enough to save the plane  but it seems to be a much more rational way to manage the emergency and the plane. However, it is surprising that nobody addressed this issue in the investigation of the accident; the absence of a flight engineer was considered as a part of the environment that passed unquestionned…even though a few years before the standard crew was composed of three people in the flight-deck.

It’s not the only case even though it can be the clearest. Another plane, an Airbus A330 of Air Transatt, landed in Azores Islands without fuel onboard and with both engines stopped. We can speak about human error from the pilots but if, instead of an automatic system throwing out fuel to keep the center of gravity in the right place, they should have a flight engineer…should the outcome be the same? Again, nobody tried to trace back this accident to the absence of a flight engineer.

Of course, the present designs should make a flight engineer fully useless, hence nobody can think that the situation can be solved including a flight engineer in modern planes. Simply, there is not place for him, not a physical one and more important, the design does not give a role to him. Probably, that is why nobody tried to raise the issue of the flight engineer; giving the flight engineer a place -a useful one- should mean a radical change of the design in modern planes. It seems that nobody is willing to take that step for the sake of safety and, when an accident happens, it seems better to look to other place instead of raising uncomfortable issues.

Would you fly in a plane without a pilot?

Some time ago, I had a friendly discussion with an IFALPA member about this issue.

His opinion, even though he was not very glad about it, was that the future of aviation was in the pilotless plane. The mine, even though I am not so concerned about, was and still is the opposite one.

The first question: Is technically feasible to fly without a cockpit and, hence, without a pilot? Nothing to discuss about it. Far before the recent experience with a passenger plane and drones, we know that during II World War the famous V1 were launched over England. These flying bombs already were pilotless planes taking off from a ramp and, for obvious reasons, without requirements about how to land. Furthermore, some of them were built with a cockpit to solve a technical problem at the beginning. Since then, technology has evolved so much that we do not need to speak about present feasibility. We do not need even to speak about planes where the pilot is grounded. We can speak about planes without a pilot…onboard nor grounded. When VLJ started and they were certified for a single pilot, someone spoke about a TMH (Take Me Home) switch to be used in case of uncapability of the only pilot in the plane.

There are the plain facts about feasibility. If we speak about costs, we’ll find important advantages if compared with the present situation. If the installation of a cockpit can be avoided, design is simplified and costs decrease. If we need grounded cockpits…should we need as many of them as planes or the number of cockpits could be lower than the number of planes? Could be use a cockpit to control more than a plane model?

We do not need to speak about costs linked to salaries and travel costs of crewmembers and flight time limitations enforcing pilots to remain in place after a long flight. If we speak about cargo, more savings appear as the feasibility of operating planes without requirements of cabin pressure.

Furthermore, in more than 100 years since the beginning of powered aviation, we have learned very much. We know many things about plane behavior, about materials, about engines, about meteorology, about control systems, about communications….in other words, it seems that not many unforeseen situations could appear.

With all of these pieces… should a pilot be thinking about looking for another job? Pilots have a technical training and, hence, they are very often driven to a technical mentality in the sense that «if something can be done, it will be done»…even though it should be against their interest and they could fight against any development that could be so damaging for them but knowing or thinking that they are defeated in advance.

I hope all of this can reflect accurately the reasoning of someone who believes in this kind of development…someone who thinks that this is unstoppable and going against it should be equivalent to try to stop a train with the hands. However, that is not the real situation.

Some pilots say that every year they avoid three or four accidents and they are paid to do that. This value of Human Factor is something that many people have written about, since well-know ICAO members like Daniel Mauriño to authors like Sidney Dekker, James Reason or, if I’m allowed to be in this group, myself.  Data like the 64% of accidents coming from Human Factores published by Boeing just before changing the classification criteria can drive to a serious mistake, even assuming the data as correct.

OK. Let’s suppose that this is the reality and, furthermore, let’s suppose that these are not errors happened as a wrong reaction after a technical problem. Let’s suppose that all of them are unforced piloting errors. Certainly, it is to much for a supposition but that is fine. Let’s accept it. Now, the reasoning mistake clearly identified by people from Behavioral Economics field like Dan Kahnemann: Does that mean that by eliminating pilots we could avoid 64% of accidents? It seems so but it should be a false assumption:

The complement of 64% should not be the remaining 36% but the number of Non-Accidents that happened due to human -and often, trivial- intervention. These Non-Accidents coming from human intervention will be a number much bigger than 36% but we do not have information to know the exact figure. That should be the point where the pilots should have to fight back. Why these situations, that everyone knows about their existence, are not counted? Why not to set up a system similar to ASRS where, instead of speaking about committed errors everyone could speak about sound actions? Cases of Non-Accidents in situations that, leaving the system to behave as planned, could have finished in an accident are a first-class argument against passenger planes without a pilot.

Does the present knowledge guarantee that unplanned situations are not going to happen? A recording about the manufacturing process of  Airbus A-380 showed how the main gear resisted to go down. Someone could ask if we do still not know how to design a gear working at the first attempt…of course, all of this happened before the QF32 case that showed much more unforeseen situations. Interactions among different systems in the plane are so complex than unforeseen situations appear even in parts of the system that are supposedly fully controlled.

Bigger knowledge is not a guarantee of having everything foreseen. Some centuries ago, Pascal said that knowledge is like a sphere that, as it grows in size, has a bigger number of contact points with the unknown. That principle is as true today as it was in the moment it was established.

Revolutions that enforce change in aviation happen almost everyday. The attempt to guarantee the operativity in dense traffic, with hard meteorology and others produce important change enforcing to review from time to time everything and driving to the situation that Charles Perrow defined as «tightly-coupled organization» where a little problem can start a process finishing in a disaster. The only element in the system that can break the snowball effect once started even by a trivial fault is precisely a person.

If planes have to be flown by automatic systems, those trivial situations should be planned and resulting systems should be even more complex and, hence, prone to unforeseen situations coming from their own design. Can we avoid it? As a part of the answer, I would like you to meet Mr. Charles Simonyi, person defined by Wikipedia as software developer and spatial tourist. Simonyi was the person who managed the creation of Microsoft Office and, especially, the one who promoted the idea known as WYSIWYG (What You See is What You Get) that makes easier the task of the user because, as name shows, the printer will print things that we see on the screen.

Some years later, Simonyi started to worry about his own work because WYSIWIG was introducing more complexity and was producing problems hard to fix. The reasoning is easy: Early information systems were programmed directly in machine code or something similar called Assembler. When a problem appeared, it was not hard to find where to look: The order given to the computer was wrong. However, the power of programming languages was growing and the correspondance with machine code was decreasing, entering in a kind of abstraction scale that had more and more steps. WYSIWYG was, when it appeared, the last step of this stairs but the abstraction scale had «leaks» driving to differences between the code written by the programmer -even if he did not commit any mistake- and the action performed by the machine because the problem could be buried in any intermediate step. A programmer does not program machines anymore; he programs programmes whose products are other programmes.

The present ambition of Simonyi -with many skeptical people about it- is starting a new generation of information systems working on something that he calls «intentional software», that is, to avoid the abstraction stairs and all of its steps because there are the problems that systems are unable to foresee because they are an intrinsic part of the design and a part of the tools used to perform the design itself. When Simonyi speaks about present problems in information systems is hard to deny its existence. If these are the pieces that supposedly are going to be used to build unbreakable automatisms…are they going to be as unbreakable as expected? In aviation, the pilot has to understand the functional model -not only the operating one- of the onboard systems to be able to diagnose and to be an alternative to a failing system.

If a sneaky company wanted to get rid of pilots, the sequence to do so should be very well defined and, probably, that sequence is already in the mind of some manufacturers or operators:

  1. Start working with pilotless planes in cargo flight where the risk is only related with goods.
  2. Once the results are presented as good enough to justify the use of pilotless planes in passenger transportation, some more things should be required:
    1. An explanation about how good the system was in cargo flights…even if some details were convenient to be omitted.
    2. The passenger chooses but there should be a big difference in price or in features like punctualicty and others.
    3. Complains about pilots and how they are an obstacle to progress.
    4. Any human error related accident should be widely publicized.

These pieces could be enough to gain the public opinion creating an idea of pilots as people that did not provide value, contributed to high prices and could be responsible for accidents that, without them, had not been produced. In this way, nice profits could come in the short term even though they could be the equivalent of using a vehicle with nitroglicerine as fuel. Perhaps it could be faster bus the risk of a big explosion could be always present.

 

Now, pilots, passenger and even regulators are in a situation where a message of «unavoidable progress» is shown and, at the end of the day, planes without a cockpit should be an improvement in safety, costs and, of course, anyone opposing this should not have a reason different from reluctance to progress or personal interest. Perhaps this is the moment where the real value of human factor has to be made clear through some specific actions:

1. Specific records about unforeseen situations where a good outcome came from human flexibility.

2. Good information to consumers and their organizations instead of crafted messages designed to keep them ignorant.

The mirage  of a technological development aimed to reduce remaining uncertainties and allowing us to eliminate human factor is simply that: A mirage. The behavior of technological development regarding unforeseen situations is similar to the one of a hydraulic press where, if we increase the power, the pressed material occupies less space but, at the same time, it is harder and more difficult to introduce a hand to operate it. In other words, an increasing capacity from a 90% to a 95% is not always good news. Actually, it could be worse if, at the same time that we increase the percentage, we introduce a full inability to manage the remaining 5% of unforeseen situations.

In aviation, the technological mirage have been working for a long time. That’s why a very relevant author in Artificial Intelligence like Daniel Hillis offered himself as a passenger in a pilotless plane programmed by an artificial intelligence system able to generate programmes hard to understand for a human being but able to fly. Hillis said that he did not know how the system could work but, at the end of the day, he did not know how a human pilot worked. However, that is a half-truth. Certainly, we do not know how a human pilot works but we know something that could be enough:

There is a very high probability that the human pilot will want to enjoy a happy retirement and he will make any thing that can be required to get it. From the scope of the passenger in a flying plane, this simple purpose is a full guarantee that should not be removed and, of course, this is a guarantee that cannot be offered by any artificial system.

 

Technology development model, safety and security: Time to change?

Many people had been warning about a wrong technological development years ago; you can find an example in the frame of this blog under the name «Improving Air Safety through Organizational Learning». However, the development model did not change at all and nobody paid attention. Statistical information, in a high level analysis, could justify this behavior but, in the last years, many things have happened that can be seen as a serious warning hard to ignore. The so-called  «black swans», meaning facts impossible to forecast, start to become a full flock. Some cases:

  1. Economic crisis: We can speak about greed, opportunism and many other things. The fact is that the financial system was so complex that it was impossible to have a real surveillance and many people understand parts of it but ignore secondary effects in different parts of the same system. Perhaps, the best explanation about what happened is a humoresque one: http://youtu.be/mzJmTCYmo9g Opening any newspaper can show how hard is an agreement about the diagnostics and, hence, about the solutions. Depending on the expert one asks, forecasts are going to be different. Even, with emergent issues like BitCoin, there is not an agreement among experts about what the consequences are going to be.
  2. AF447: This air accident should mark a change: Experts with interest in the market went running to show that, at the end, everything was coming from a sensor and a human error. Is that right? If a faulty sensor and a tired pilot are enough to crash a plane…something is seriously wrong about air safety. Journalists ready to help manufacturers and regulators emphasized the time required by the pilot to go back to the cockpit. Have you ever seen the layout of a long-haul plane? Perhaps, you have observed a door in the middle of the plane where crewmembers come and go through. This door allows crewmembers to access the bunks that are downstairs. Now, watch in hand, try to find how long it takes to arrive from the bunk to the cockpit. Why bunks were removed from a position near to cockpit? The reality is that crewmembers got confused and a system that does not give enough information about what happens is, at least, questionnable because under unplanned events, it can produce confusion and inability to find the right action to perform.
  3. Cyberattacks: About two years ago, Iranian said to be able to get control over a U.S. drone forcing to land. The feasibility of that was rejected by U.S. officers but, only days ago, something happened inviting to think that it was a real possibility: http://www.businessweek.com/articles/2013-04-12/hacking-an-airplane-with-only-an-android-phone If a mobile phone is enough to get control over a manned plane…can we seriously affirm that it is not possible with more advanced technology over an unmanned one? Aviation is not the only activity where things like these can happen: http://arstechnica.com/information-technology/2013/04/the-spammer-who-logged-into-my-pc-and-installed-microsoft-office/ It’s said months ago that something bigger than 11S could come from powerful cyberattacks that could make useless vital installations. Even some technology managers are worried about the possibility of an undetected cyberattack that could convert a sophisticated weapon into something useless at the critical moment. Beyond cyberattacks, the feasibility of an EMP (http://en.wikipedia.org/wiki/Electromagnetic_pulse ) with similar but longer term effects is another real and present danger.
  4. Food fraud: Is it so hard identifying the kind of meat -if so-  that hamburgers have inside? Perhaps it is hard for users but…also for regulators? Why every other day a new scandal appears with products containing something that it is not in the declared composition? Not only horse or moose meat but dogs…what else?
  5. Aviation safety: Beyond AF447…is the average passenger informed and concerned about what is the real safety level? Does the passenger know that, when crossing an Ocean in a twin plane, if one of the engines fails, the plane is certified to fly for hours with the remaining engine? Manufacturing processes are the ones that are certified or, as some people say, different? http://www.thedailybeast.com/newsweek/2012/03/19/is-boeing-s-737-an-airplane-prone-to-problems.html . What about the air quality onboard? http://www.achooallergy.com/air-quality-airplane-cabins.asp What about the practice in some airlines of having a flight student as a first officer paying to fly in a plane with passengers?…

In short, technology has kept the same track and it is more and more hard to understand and check. Regulators cannot be trusted -independently of their knowledge or professional attitude- if final user cannot check their work. If users cannot check how the regulators protect their interests, the expected results should be that the regulators should take care of their own interest, that not always could be the same that the ones of users.

The old Rassmussen rule, «the operator has to be able to run cognitively the program that the system is running», is not followed time ago. However, as times goes by, we find that the problem goes beyond operators. Designers themselves understand specific parts without a clear understanding of the full product and, hence, unable to foresee consequences coming from interactions among different parts of the system. AF447 was a big warning light but it is not the only one and, perhaps, it is not even the worst one. It should be the right time for an assessment of technology development model. Otherwise, consequences will be worse and worse.

«Seconds to Disaster» by Glenn Meade and Ray Ronan

When I read my doctoral dissertation -you can find two versions in the blog frame depending of your kind of interest: Aviation or Organizational Studies- I remember especially one of the persons who had to evaluate it, Secundino Valladares. He said: «Now, I’m sure that I will never fly again». I cannot blame him: To justify every finding, I put two or three paragraphs, extracted from official reports about major Aviation accidents. It was quite easy to reach that conclusion. After reading the book by Meade and Ronan, I have started to think of myself as a soft nun, regarding the kind of things they bring to the discussion.

For instance, the existence of compromises between regulators and main manufacturers is crystal-clear and there are many facts that can show how the European regulator does not look with the same eyes at both, Boeing and Airbus, and the same can be said about FAA but, of course, in the opposite side. Even though, the chapter that the authors devote to Boeing 737NG shows something far beyond a «friendly eye». Nothing new; some of us are old enough to remember what happened with DC-10 and how 325 avoidable deaths (Turkish Airlines 981) were required to fix a problem that was previously known. The authors speak too about AF447 -you will find in this blog several posts dealing with AF447- and, for a moment, I had the feeling of not being alone with my conclussions about this case: The stamp «Lack of Training» is very comfortable to close a report avoiding entering in design issues. However, this stamps does not answer the main question: If that is true…why did you have people lacking training to fly a big plane over Atlantic Ocean? We can go beyond: Is that a training practice by Air France or is it shared worldwide? Still, we can go beyond: Is it possible, due to design complexity, provide pilots and engineers with the training level that they could require under an extreme situation? Once we get here, we could be around the root of the problem: Profit aimed design.

A few days ago, I published something about how average passengers boarding a twin plane for a long-haul trip does not know what are the rules: He does not know that, in the event of an engine-stop, the plane is certified to fly more than 5 hours from the nearest airport with only one engine working and full of passengers. This and many of the things that the authors of «Seconds to Disaster» say are unknown to the flying public. Perhaps, this is the first thing to change if we want to change something.