Link to the interview on YouTube

Asked about how design has changed over the past 50 years, Prince Philip replied that the trend to design by corporate or government committee has reduced the chances of producing exceptional designs.

He also feels that designers on contract create more innovative designs than staff designers.   This is because a contractor knows that her employment is temporary, while an employee always fears that hers is!  Thus employee designers are inclined to play it safe by complying with their employer’s opinions rather than truly expressing themselves.  He has observed that success results from giving a designer the authority to make design decisions. I would call this concept "empowerment" and say it's still all too rare, despite being a popular management buzzword.

Link to the video: Seth Godin at Gel 2006 from Gel Conference on Vimeo.

I once worked with an architect and it was enlightening.  You might think there’s a lot of similarity between architects and engineers, but if you do, you’re wrong.

Both of us started our problem solving with learning as much as we could about the nature of the problem. As an engineer, my next step was to investigate and define constraints for the solution.  I needed a foundation upon which I could build.  It hadn’t even occurred to me that there was another approach.  The architect did the opposite.  He started by creating a theme.  His theme was circles.  This could not have been more foreign to me!  From there he worked out until he bumped up against the constraints, which then became boundaries for his solution.  I was amazed to watch as this simple theme evolved into a sophisticated design.

The difference in results between these two approaches is startling.  When you begin from the known, your design reflects that from which you started.  This is a good thing for engineers because it results in a product that is safe and predictable.  On the other hand, when you start fresh, this results in a design that is innovative and original, which is a good thing for architects (or so I assume).

Neither approach is perfect for all situations.  Competitive environments demand continuous improvement.  Evolution alone is often not sufficient; the occasional revolution is necessary.  However, starting from scratch requires a bigger investment in time and resources, and not all new ideas will result in practical products.

There is great value in combining these approaches.  As Prince Philip quoted the Prince Consort, “You’ve got to have a marriage of art and manufacturing and engineering in order to produce good stuff!”

^* For a complete list of what else they didn’t teach me or any other engineering student (and a good laugh), you must read Ed Medley’s award-winning article What They Didn’t Teach Me in Engineering School.

Efficient or lazy? The designer used the same handles on both sides of these doors. The little "PUSH" and "PULL" signs are required reading! Doors are simple - why do designers force us to read instructions to use them?

Have you ever been confused by a door? Push or pull? Which side opens? Is it locked? It’s not your fault! The designer screwed up.

If you’re running a shopping mall or a store or an office, you need customers to come into your building. Unless it has a drive-through or a take-out window, that’s a necessary requirement for business. It’s amazing how often a poor customer experience starts right here. Designers have no excuses. It’s not like doors are new technology. Everybody’s seen and used lots. There must be some best practices guide out there somewhere.

Nobody likes being embarrassed, but it’s hard to look good when you’re colliding with a door that swings opposite to what you were expecting. Do you not tense up when approaching a bank of doors in a large building? Many of us have even developed coping mechanisms just for this situation. I employ logic: look for the hinges and try to devise how the door operates. One of my friends aims between two doors, simultaneously pulling on one and pushing the other. Others hesitate to observe and then imitate the successful users.

Somebody did invent a hinge that will let a door open in either direction, whether pushed or pulled. How come we don’t see more of those?

Ever walk up to a set of double doors and one of them is locked? This happens to me so often that I have begun to suspect there is a law requiring it. I went to a convention centre to shop at a craft fair. It was a big place and the small fair was only at one end, so most of the doors were locked. It took a while to hunt down, by process of elimination, the unlocked doors. Some of the doors that I expected to be locked were open, so perhaps the facility operators were also confused. Of course, upon leaving, the problem presented itself anew, as some types of door can allow exit even when they are locked from the outside, but not all. Which type where these and were they completely bolted or just locked to the outside? I think designers could build in visual clues to let us know when a door is locked.

In Calgary, the Plus 15 network contains many automatic doors that use a sensor to detect you and open. That sounds good in theory, but not all applications are satisfactory. The sensors are not always located in the same place and the timing is different for many doors. You can never be sure if the door has detected you and will open in time, or if you need to take evasive action. Sometimes the system is broken, has been turned off (in which case the door may still open manually), or the door has been locked. This can result in a very convincing Maxwell Smart impression as you bang your nose on the door. To avoid this, I have developed a technique where I lean forward as I drag my back toes, like a wide receiver making a catch along the sideline. I can then wait for slow doors without breaking stride or stop for closed ones without breaking my nose.

We all like to laugh at people that push on doors with “Pull” written on them, but we’ve all done it. Obviously we are expecting a door to be intuitive and don’t want to read instructions to make it work. We’re all experienced users, so when a door doesn’t work like you expect it to, there’s something wrong with the design, not you.

Merry Christmas!

Real or artificial?  When it comes to Christmas trees, this is an ongoing and contentious debate.  I’m a hard-core proponent of the artificial tree for the following reasons:

Some assembly required

Not much appeals more to an engineer than the opportunity to assemble something, especially when it comes in kit form and is guaranteed to go together smoothly!  Modular construction – sweet!  IKEA furniture looks like IKEA furniture, it’s true, but man is it fun to put together!  Assembling a Christmas tree could only be better if some special tools were required.

The first family tree consisted of a green wooden pole and individual branches.  Some of my fondest Christmas memories are of Dad bringing out that great big box and letting us help sort out the branches.  The branches were colour-coded with a little bit of paint at the base of the stem.  Trying to differentiate between ‘red’ and ‘copper’ was a challenge I looked forward to each year.  Later, my siblings and I were allowed to drag the box out of the crawlspace and assemble the tree by ourselves.  This was probably a greater privilege than being able to use the car.  My parents might still be using that tree if the crawlspace hadn’t flooded, turning the box to pulp and making a mess of the tree.

Unfortunately, Christmas tree design has advanced considerably and the tree I obtained for my first house is an umbrella style.  It does have three sections, but most of the thrill of assembly has been removed.  I am left to admire this improvement and wax nostalgic about the good ol’ days when I had to install each individual branch.  Almost makes me with I had grandkids to tell the story to.

Déjà vu all over again

Engineers love standards.  An artificial tree has wonderfully uniform dimensions.  It’s always the same height and width as it was last year and the year before and the year before that, so I never have to worry about whether it will fit in the door or fill the room appropriately.  I can’t imagine trying to evaluate one of those tightly wound real trees it its fish net bag to determine if it were the correct size and shape.  An artificial tree has no good side or bad side, so it doesn’t matter how I put it up.  I know precisely where to place the base every year in order to have sufficient clearance on all sides for the ladder.

I also know there is room for all of our decorations, no more, no less.  Wouldn’t it be sad if some of your ornaments wouldn’t fit on the tree and had to remain in their boxes?  What a tragedy!  Or worse, if you didn’t have enough and had to buy more at pre-Christmas prices?

I also know exactly how many lights are required.  This is causing me some stress as I make the switch to LED’s – those strings are a different length, so how many will I need?  You can understand I’m losing sleep over this.  These days, you can get an umbrella-style tree with the lights built in.  That’s progress!  Yes, you lose the thrill of assembly mentioned above, but hassles are reduced even more, as discussed below.  Again, it would be useful to have grandkids so I could tell them how good they have it these days.

Relatively hassle-free

No needles to clean up!  That’s such a huge benefit, I get to say it again:  no needles to clean up!

Having managed to get my tree home in the car once, which required a highly questionable cargo and passenger configuration, I never have to do it again.  I could even have had it delivered, which is not a very common option for real trees.  I don’t have to worry about selecting the perfect tree and strapping it to my perfect car roof, only to have both of them become somewhat less than perfect during the ride home – every year.

Around these parts, one can obtain a very cheap permit to cut one’s own tree.  Does that sound good to you?  If so, are you a masochist or just a rugged outdoorsperson?  Maybe those are the same thing.  Sing it with me: “I’m a lumberjack and I’m okay!”  Anyway, I don’t need to go tramping off into the snowy woods in search of the perfect natural tree in its native environment…and then ruthlessly hack it down.  Then I don’t need to somehow drag it back to the vehicle and transport it home (likely along the highway, for you’d need to travel out of town to get to the forest) without damaging it.

“Smoke on the water, fire in the sky” should be a lyric, not a headline

This is The Big One, the reason that trumps all others.  I’m no Boy Scout (I mean that in the literal sense – I am not now, nor have I ever been, a member of the Boy Scouts or any similar outdoor camping or survival organization), but I know kindling when I see it.  Back in the days of my youth, when it was not considered a mortal sin to dispose of real Christmas trees by burning them, I witnessed how quickly flame engulfed them.  If you are too young to have seen this or just had a sheltered childhood, Mythbusters lit one up a few years ago that you can occasionally catch on re-runs, and of course you can find many videos on-line.

They should provide a bag of marshmallows and some sharp sticks with every real Christmas tree, so you can have a little snack while you’re waiting for the fire department to douse the smouldering embers of what used to be your home.  I’m not having one of those things in my house!

Real Christmas tree fanatics will counter with a couple of points, so I will have to address them here:

Tradition

The original Christmas trees were actual trees.  Sure, but they didn’t have engineered polymers or even indoor plumbing, and cows could kick over lanterns and burn whole cities down.  And they had The Plague, too.  Do you miss The Plague?  If you live in a stone castle or even a sod hut, then you’ll probably want a real tree, but if you’re that much of a traditionalist, you shouldn’t be on the Internet reading blogs, should you?

Scent

The real tree fanatics maintain that part of the appeal of a Christmas tree is to fill the house with a pine scent (unless it’s a fir tree, of course).  I just want to point out that cleaning with Pine-Sol will give you the same effect all year round (unless you get the lavender-scented kind, of course).  I have no argument with the pine scent of a real tree; it’s the potential for a smoky scent I wish to avoid.

The Environment

From an environmental standpoint, ironically it appears that cutting down a tree may be less harmful when all factors are considered.  I admit that, on this basis, a real tree does appeal to my sense of humour: “Hey, why are you cutting down that tree?”  “Well, to save the environment, of course!”  In my defence, I’ll contend that’s only if it doesn’t burn your house down.  But Christmas in conventional form is never going to win any points from a true environmentalist – it just creates too much waste and uses too much energy – so nobody’s going to win the Christmas tree debate on environmental terms.

At Christmastime, they say it’s the thought that counts, so while I’m assembling my clean, predictable, and safer artificial tree in my cozy living room, I’ll be thinking of you real tree fanatics tramping around in the frozen woods or scratching up your car roof.  And I know we’ll both be happy, which is what the season is all about, so Merry Christmas!

CASA 212 performing an air drop in Afghanistan

The investigation into a 2004 accident raises many questions, and disturbingly, it doesn’t provide any answers.  Would your company work safely if there were no enforcement?  How safely would you work if you knew no one was watching?  Does your safety depend on people who no one is watching?

A U.S. airline was contracted by the U.S. government to provide cargo and passenger service in Afghanistan.  Legally, they were under U.S. regulations.  Practically, they were unregulated, as there were no inspectors in Afghanistan.

One morning a flight crew decided to fly into the mountains, instead of around them, just for fun.  They ended up flying into a box canyon.  ‘“At 0803:21, the first officer stated, “yeah you’re an x-wing fighter star wars man,” and the captain replied, “you’re [expletive] right. this is fun.”’^* Less than 20 minutes later, as the crew attempted a 180º turn, the plane hit the canyon wall.

Five of the six aboard were killed in the crash.  The remaining passenger survived for at least eight hours, but nobody realized the plane was missing until seven hours after the crash, and then five hours were spent searching in the wrong place.

The airline did not require its pilots to file flight plans, even though this was a legal requirement.  The pilots could have filed a flight plan anyway, but they chose not to.  Why didn’t the airline require flight plans?  Why didn’t the pilots create a flight plan?  Because it gave them the freedom to be unsafe and fly into the mountains instead of flying around them?  If they had filed a flight plan into the mountains, which was not the usual route, would anyone have questioned it?  If they had filed a flight plan, knowing that no one could monitor them, would they have followed it?

The pilots didn’t use oxygen, even though they were flying well above the altitude where oxygen deprivation (hypoxia) begins to affect the ability to think.  They were already making poor decisions, including this one, so hypoxia would only have made things worse.  The investigators interviewed other pilots working for the airline in Afghanistan.  They didn’t know the correct (and legally mandated) criteria for determining when to use oxygen.  These pilots were aware of the threat, yet they didn’t attempt to learn how to protect themselves.  Why not?  If they had known the correct thing to do, would they have chosen to do it?  Why didn’t the company provide better training?  The investigation determined that the plane was capable of climbing over the ridge, had the pilots started the climb at the time they realized they were in a box canyon.  Did hypoxia impair their judgment?

Due to the lack of infrastructure in remote areas of Afghanistan, communications were difficult.  The airline provided the pilots with satellite telephones so they could check in.  However, the airline took no action when it became apparent that these didn’t always work effectively.  This was a violation of regulations because the airline could not know if a flight had arrived safely or not.  The pilots did not seem very concerned about this, either.  Why didn’t the airline develop another solution?  Why didn’t the pilots object to this unsafe condition?

Would this accident have happened if there were inspectors to monitor the airline?  Would the pilots have behaved this way even if the airline had been more concerned about safety?

We can never really know the right answers to questions like these.  We still need to try to answer them to prevent future accidents.

*NTSB/AAB-06/07, Aircraft Accident Brief, Controlled Flight Into Terrain, CASA C-212-CC, N960BW, Bamiyan, Afghanistan, November 27, 2004

Bombardier CRJ200

One sometimes hears, “The only thing faster than a company truck is a rental!” The Canadair Regional Jet 200 (CRJ200) can carry up to 50 passengers and is capable of altitudes greater than 41,000 feet (12,497 metres). Capable of 41,000 feet in the same sense as the average pickup truck is capable of 96 mph (155 km/h) – you can do it, but there’s no valid reason to.

A “repositioning flight” is when a passenger aircraft is moved from one airport to another without passengers. Some pilots see this as an opportunity to fly aggressively and enjoy testing the limits of the airplane. Several accidents prove that sometimes they end up exceeding their own limits.

Having just reached 41,000 feet, the captain told air traffic control, “We don’t have any passengers on board so we decided to have a little fun and come on up here.” The plane impacted the ground less than 25 minutes later.

Long story short, the pilots had made an error by climbing too quickly. They fell behind the energy curve: as the plane slowed, induced drag increased, slowing the plane further. At 41,000 feet, the engines couldn’t produce enough thrust to power the plane out of trouble.  Eventually the  plane was going so slowly that the engines stopped.  They made further errors in following the restart procedure and couldn’t get the engines going again.

The captain had a B.Sc. in aeronautical sciences, had worked as a flight instructor, and had 6,900 hours of flying time, including 5,055 as pilot-in-command. Leaving aside poor judgment, he made fundamental piloting errors and failed to detect those made by his less experienced first officer. It’s difficult to have a true understanding of our own knowledge and abilities, and we usually overestimate them. We need to actively maintain a margin of safety to keep from inadvertently straying over the edge.

The captain initially tried to downplay the seriousness of their predicament by informing air traffic control that only one engine had failed. The situation was therefore misinterpreted as an emergency rather than an EMERGENCY by air traffic control, who could have offered greater assistance. The pilots used up their altitude trying to restart the engines rather than attempting to glide to an airport. How often do we make a situation worse by trying to cover it up so nobody finds out how bad it really is?

As a result of this and several other accidents, repositioning flights are now recognized as a risk and airlines routinely review flight recorder data to look for evidence of improper behaviour (but this only works for those planes legally required to carry flight data recorders). Some trucking fleet operators have installed data recorders on their vehicles in order to perform the same kind of monitoring. This is a reactive approach that may prevent repeat occurrences, but will only deter those who are fearful of being caught. Prisons are full of people who didn’t think they’d get caught.

Thrill seekers often require an audience to witness the incident or to be told about it after. The airline’s pilots had an unofficial club for those who had flown at 41,000 feet. I think this is where we can have the greatest impact, because peer pressure is a powerful motivator. Show your disapproval for unsafe behaviour!

Beech A100 King Air Instrument Panel

It’s not unusual for an employer to check the references of a job applicant.  Unfortunately, it is unusual for those references to be useful.  Privacy legislation and the threat of lawsuits make many afraid to provide a complete and open evaluation of a former employee.  Read about this accident and see if you agree that privacy can create a significant safety hazard.

At Airline #1, a pilot was employed as a first officer.  He was reprimanded four times over two years for not following procedures.  Airline #1 gave him a letter of reference stating that he had performed well.

Airline #2 hired the pilot as a captain and then demoted him to first officer for repeatedly violating standard operating procedures (SOPs).

Airline #3 also hired the pilot as a captain and then demoted him to first officer because of “… weak systems knowledge, pre-flight planning shortcuts, fixation on minor problems, dwelling on errors, narrow attention span, and poor decision making.”^* After three years, Airline #3 refused to renew his pilot proficiency check because he was unsatisfactory in crew coordination, crew resource management, and adherence to procedures.  This refusal meant that the pilot could no longer fly for this airline.  Airline #3 later “… provided the captain with a letter of reference stating that he had been employed as a captain for three and one-half years, that he was extremely knowledgeable about the aircraft he flew, and that, at times, he operated the aircraft in accordance with the SOPs.”^*

The pilot started work as a captain for Airline #4 on May 8^th, 2006.  He was killed in a crash on January 7^th, 2007.  His copilot (who had far less experience) received minor injuries and their two passengers were seriously injured.  Failing to follow procedures and poor crew resource management were cited in the list of causes and contributing factors.

Airline #4 had not attempted to check the pilot’s references, but it turns out that wouldn’t have mattered.  The first three airlines told the Transportation Safety Board they would not have provided any negative information about the pilot to any prospective employers that asked them.  They were concerned about breaking federal and provincial privacy laws, and being sued.  They were even reluctant to divulge this information to the investigators.  What’s probably worse than refusing to provide negative information is that, “In fact, the letters of reference the companies provided portrayed a substantially different perspective of the captain than did their training records.”^*

As noted in the accident report, the U.S. National Transportation Safety Board identified this as a safety issue in 1988.  This eventually led to a new law, the Pilot Records Improvement Act of 1996.  This safety hazard remains for everyone else, employers, employees, and the public, too.

*Transportation Safety Board Aviation Investigation Report Number A07C0001

Beech A100 King Air

A recent crash investigation yielded some very useful insights into why workers deviate from procedures. This analysis applies to any workplace that relies on procedures for safe and reliable outcomes.

Standard operating procedures (SOPs) are a quality assurance tool. In the context of this posting, they define parameters for working safely. Procedures can be perceived to reduce productivity and it seems to be a natural human tendency to deviate from them. Such deviations do not have to be malicious violations (e.g. motivated by laziness or cheating), they can be well-meaning attempts to manage a high workload (including task saturation), to simplify complexity, or to cope with situations not envisaged when the procedures were developed.

With sufficient repetition, deviations can become routine and workers stop recognizing their actions as deviations. The threat of punishment is not a deterrent because these deviations are no longer deliberate (workers don’t decide to risk punishment by deviating, they no longer realize they are deviating). Supervision is the only way to detect deviations and bring them to the attention of workers. Investigating the causes of such deviations can also help improve procedures to reduce the incentive for future deviation.

The accident report explains it extremely well:

“Time and resource pressures can result in individuals making adaptations to get the job done. While SOPs are prescribed in order to set boundaries for safe operations, individuals may experiment with the boundaries in order to become more productive. This leads to adaptations of procedures and a shift beyond the prescribed boundaries described in the SOPs toward unsafe practices.³²

“One reason for this is that humans rarely perform work with strict adherence to prescribed rules or instructions. Procedures are often developed for a particular task in isolation from the work context. Performance requirements impose constraints on operators beyond what was considered (and available) when the task instructions were written. To get the job done, people work outside the defined rules. This is why studies of humans, even those working in high-risk, complex systems, have found that operators modify instructions and violate rules in ways that are quite rational given the actual workload and timing constraints (Dekker, 2006).³³

“Without regular supervision, education, and enforcement of the expected boundaries, individuals are likely to continue to adapt procedures and cut corners until the actual unsafe boundary is found through the occurrence of a minor or major accident. Additionally, the communication of successful adaptations between crew members … will tend to lead to the spread of these adaptations throughout an organization unless adequate supervision is applied.

“The captain’s history of non-compliance indicates that he had a predisposition toward deviations from required procedures, but does not in itself support a conclusion that the non-compliance was deliberate. The crew of {the accident flight} and most of the other {regional airline’s} pilots were likely unaware that the many policy and procedural deviations identified by this investigation were actually deviations. Some of the SOP deviations were adaptations. As described {above}, adaptations occur when humans adapt their behaviour to their work. … The deviations within the {regional airline’s} operation almost certainly developed into routine practices for the flight crews and were not deliberate digressions.

“Without increased supervisory surveillance to identify routine deviations, crews were unlikely to identify practices that were no longer conforming to established procedure or policy. The new disciplinary policy, designed to stop conscious deviations, was unlikely to have the rapid, broad impact that was intended because it was not accompanied by proactive identification of routine deviations.”^*

* Quoted from Transportation Safety Board Aviation Investigation Report Number A07C0001, which listed these references:

32 J. Rasmussen, “Risk management in a dynamic society: a modeling problem,” Safety Science, pages 197, 27 (2-3), 183-213

33 Transport Canada, Safety Study on Risk Profiling the Air Taxi Sector in Canada, September 2007, RDIMS 3820455 v3, paraphrasing from S. Dekker, The Field Guide to Understanding Human Error, Ashgate, 2006

The Shuttle's replacement: the Orion capsule

Some things have changed for the better.  Debris from the Space Shuttle Challenger was dumped into an abandoned missile silo.  Out of sight, out of mind, perhaps.  Even the data was not catalogued for use in further investigations.  The Spacecraft Crew Survival Integrated Investigation Team (SCSIIT) lamented that, “The lack of debris for comparison and methods of data preservation made the Challenger data essentially unavailable for this investigation.”

Not so with the debris and data from Columbia.  Both have been preserved to allow further investigation and research into the development of future spacecraft and crew survival equipment.  Given the timing of the Columbia Crew Survival Investigation Report, the SCSIIT members might not have had any other option to make their work meaningful.  Design of space vehicles for the Constellation program, which are to take astronauts to the Moon and possibly to Mars, has already begun.

On the other hand, as a result of the Challenger accident, NASA made some substantial changes to improve the survivability of a Space Shuttle accident.  Unfortunately, the Columbia accident does not appear to have initiated much in the way of further improvements, despite a demonstrated need to do so.  Following the report of the Columbia Accident Investigation Board, the Shuttles were returned to service, not waiting for the Columbia Crew Survival Investigation Report.

SCSIIT does not seem to have harboured any illusions that their report would impact the Shuttle program.  In fact, SCSIIT maintained confidentiality until they had published their report, although apparently they did release some interim directives internally.   It's not possible for me to say if  any of their findings benefited the first eleven missions after Columbia, except for the replacement of the seat belt inertial reels.

NASA’s conclusion from the Columbia accident seems to be, “We’ve identified the problem and made changes so it probably won't happen again.  If it does, we'll find it and fix it.”  They’ve increased inspection of the external tank prior to launch, increased the quantity and quality of surveillance during ascent, developed repair kits, implemented a thorough in-orbit investigation of the Shuttle, and have a contingency plan for a second Shuttle to mount a rescue mission.

Foam fell off the external tank as the Space Shuttle Endeavour headed for orbit on July 15^th, 2009, so the threat of catastrophic damage from that remains, even if NASA is better at detecting it.  But what if there are other unknown threats?  I think a different approach is in order.

ADDENDUM

The Summary Report of the Review of U.S. Human Space Flight Plans Committee was published on September 8th, 2009.  The Committee was set up to provide the Obama Administration with an evaluation of NASA's current plan versus its budget.  In the words of the Committee:

“The Committee noted that the projected flight rate is nearly twice that of the actual flight rate since return to flight after the Columbia accident.  Recognizing that undue schedule and budget pressure can subtly impose a negative influence on safety, the Committee finds that a more realistic schedule is prudent. With the remaining flights likely to stretch into the second quarter of 2011, the Committee considers it important to budget for Shuttle operations through that time.”

In other words, the Committee is concerned that the budget set by the Bush Administration, which retires the Shuttle fleet in 2010 so that NASA can concentrate on the next generation of space vehicle, has resulted in an overly compressed schedule for the remaining Shuttle flights.  The Challenger accident may be seen as an example of past reluctance to delay the program (until the known O-ring flaw could be rectified).  The Obama Administration has already allowed NASA to extend the Shuttle program into Fiscal Year 2011, but it hasn't budgeted any additional funding.  I hope the Administration acts on the Committee's recommendation to provide sufficient time and money to operate the Shuttles safely.