8 ms·

> “You have a system that is known for its ability to detect very small quantities of smoke,” Mr. Corbett said. “Yet the whole outcome of it is this clumsy huma

> “You have a system that is known for its ability to detect very small quantities of smoke,” Mr. Corbett said. “Yet the whole outcome of it is this clumsy human response. You can spend a lot to detect a fire, but it all goes down the drain when you don’t move on it.” It seems to me that the biggest issue with the fire system was the lack of a graphical display of the alarm... with all the security cameras and screens likely to already be in place, why not add one with maps of the cathedral, showing up in red when an alarm triggers? The need to understand shortcodes it waiting for disaster...

blauditore 7y ago
I would guess no prioritization of usability ("it's just an internal tool, we can train people, it's cheaper anyway"). This seems like a common pattern on software projects, especially company-internal ones.
- Someone 7y ago
  For an example see https://www.theguardian.com/technology/2019/jul/13/margaret-hamilton-computer-scientist-interview-software-apollo-missions-1969-moon-landing-nasa-women https://www.theguardian.com/technology/2019/jul/13/margaret-...: ”I suggested a program change to prevent a prelaunch program being selected during flight. But the higher-ups at MIT and Nasa said the astronauts were too well trained to make such a mistake. Midcourse on the very next mission – Apollo 8 – one of the astronauts on board accidentally did exactly what Lauren had done. The Lauren bug! It created much havoc and required the mission to be reconfigured. After that, they let me put the program change in, all right.”
  - Sharlin 7y ago
    This was a great read, thanks!
  - papln 7y ago
    Is selecting a prelaunch program much worse than selecting an incorrect post-launch program? Or was there still a major risk of selecting an unsafe post-lauch program?
    - scrumper 7y ago
      The problem was that, with such limited memory available to the computer, it erased all the en-route navigational data to make room for the preflight data. So now you have a spacecraft on its way to the moon with no way to know where it is...
kweks 7y ago
Small aside, there are / were no security cameras anywhere in the cathedral.
- onli 7y ago
  But that's really just an aside. You just need a 3D map of the cathedral with the position of the fire detectors marked, blinking red when a fire breaks out. After all they already had a unique ID, according to the article. That's not hard. But they had too many years and too much money to implement a usable solution.
  - kweks 7y ago
    Absolutely. The fire panels were banks of LEDs stuck on a wall in the guardian's house. As you say, presumably over the years the system was added to, and they hit a point where changing the entire system would have cost "too much", so they kept adding to a legacy solution..
    - hef19898 7y ago
      Always a good idea isn't it? Someone somewhere was certainly applauded for this brilliant business case and decision making. Everybody pointing out the flaws not so much I would assume...
  - liberte82 7y ago
    > they had too many years and too much money to implement a usable solution Oh man, that hits home
gpvos 7y ago
It doesn't even have to be graphical (although I guess that would be best), as long as the location is clear, or a map is on hand.
userbinator 7y ago
Yes, it's really surprising that a system which "took dozens of experts six years to put together, and in the end involved thousands of pages of diagrams, maps, spreadsheets and contracts" didn't contain something that I've seen in nearly all the reasonably large buildings I've been in, some which have probably been there for many decades: https://static1.squarespace.com/static/53ca9e5ce4b0bcaba3c714ac/53d68247e4b061b2d21f8d96/53d69ca6e4b0f6dd3188b27e/1421765711991/Picture1.jpg https://static1.squarespace.com/static/53ca9e5ce4b0bcaba3c71...
- maeln 7y ago
  It's sadly often the cases for public contract here... Very much often, the contractor has no interest or incentive in doing a "quick and proper" job. Company that deal with public contract get really good at dragging the duration of a project, and its cost, way up. They know that the state will want to continue the project and will continue funneling money until its finish in any case. And when a project has some incentive (often financial penalty when deadline are not respected), company will give unrealistic deadlines to win the contract and then just run the penalty has normal cost of the projects. I know some project that had years of delay and were still profitable for the private company. Obviously it's not always the case, but having work for both a state owned company contracting private contractor and for a private contractor seeking public contract, it has certainly made me not optimistic about any projects funded by public money.
  - godzillabrennus 7y ago
    You could also be IBM and make lots of money while never delivering anything: https://www.bloomberg.com/news/articles/2018-03-01/canada-to-scrap-ibm-payroll-plan-gone-awry-costing-c-1-billion https://www.bloomberg.com/news/articles/2018-03-01/canada-to... Not directly related but comical to me, I recently heard from someone working with IBM that they are really upset over the calls from Washington to regulate big tech. Upset because they aren’t mentioned by politicians or the media as big tech. It’s almost like they don’t really matter anymore.
    - 7y ago
zkms 7y ago
> It seems to me that the biggest issue with the fire system was the lack of a graphical display of the alarm i agree that the lack of a graphic/synoptic display for the smoke detection system was a horrid flaw, especially when rapid response is needed. However, i feel that the lack of an automatic extinguishing system was pretty grave too; given the excellent record of automatic fire sprinklers in containing -- if not fully extinguishing -- fires, well before the fire brigade arrives. Of course, accidental activation is a serious concern, but this can be addressed, whether through the use of a double-interlock preaction scheme (where the piping is kept water-free with a valve that is opened only when the heat/smoke detectors signal a fire; and even once the pipes are filled with water, sprinkler heads need to be individually activated with heat) or using a gaseous clean-agent instead of water.
- anilakar 7y ago
  I've written a touch panel UI for a next-gen sprinkler system. The valves themselves used high-pressure mist to bind smoke particles and minimize liquid damage often associated with sprinklers, and could be individually shut off when needed. I think the rationale was that by minimizing collateral damage you could install sprinklers in places where they would be considered a liability. I heard the largest end customers were shipbuilders and police stations; a few systems were installed in underground public spaces such as train stations. (Don't ask if the police has ever used the water spray as a taming device in the cells. I don't really want to know.)
  - simonh 7y ago
    I doubt it would work. How is dealing with slippery wet angry prisoners an advantage over dry angry ones?
    - jon-wood 7y ago
      Totally off-topic, but this reminds me of a story from a psychiatric nurse I know. They apparently once had to deal with someone who decided to strip down, then cover themselves head to toe with some form of body oil they'd managed to get hold of. Hilarity ensued.
pintxo 7y ago
Yes and no. There seem to be multiple points of failure on the critical path. Yes the interface might be sub-perfect, but there is also a human on the critical path, who started work at 7am, meaning he's been working for 12 hours now. There is a reason regulation usually mandates limited hours for safety critical jobs. Why not automatically inform the fire department, ensuring that there is not one single critical path but an alternate option? Relying on the presence and correct reaction of a single security guard sounds like a less than perfect idea.
- elliekelly 7y ago
  > Why not automatically inform the fire department, ensuring that there is not one single critical path but an alternate option? I think this was the most confusing part of the response to me. Even my home security system calls the fire department by default and my condo isn’t an 850 year old landmark. It made me wonder whether the system produced a lot of false alarms that would make an immediate default response impractical.
  - pintxo 7y ago
    That might be an issue. But then one might not need to send a whole fire brigade from t0. Maybe just send a single truck, or a single car.
    - zhte415 7y ago
      This depends where you are, I suppose. Fire Brigades in urban areas typically dispatch two engines that take two different routes to ensure one route is not congested, and at least one engine is on a faster, if not shorter, path than the other. Even real-time route planning cannot mitigate an unexpected cause of congestion yet to occur. Depends on area. Dense urban streets where contagion of fire may require this while a remote home in a rural may mean this route mitigation isn't necesary. However in both and all cases a rapid response is needed as lives are at risk.
  - throw0101a 7y ago
    > Even my home security system calls the fire department by default and my condo isn’t an 850 year old landmark. Non-residential buildings are often charged for false alarms, so standard procedure is to have a human confirm things first: * https://gps-securitygroup.com/the-role-of-security-guard-regarding-fire/ https://gps-securitygroup.com/the-role-of-security-guard-reg... If confirmation is not done in x minutes, there is an automatic call though (with the requisite charge back for false alarms).
BryantD 7y ago
I do technical operations for a living. If I had a buck for every time I've seen an alert with unclear or non-actionable information, I would have retired ten years ago. This article describes a tragic situation, but it's not terribly surprising. Other things I saw: - people scared to talk about what happened because of blame issues - putting new employees in critical situations with only three days of training
WalterBright 7y ago
These all seem obvious now in hindsight, but that's always the way of things. People, even educated, intelligent, and earnest people are very bad at user interface design. Good UI design comes from experience, not foresight. For example, the aviation industry has standard terms for things. "Takeoff Power" means full power. Can you guess what happened? A pilot needed to abort a landing, and yelled "takeoff power" to the copilot, who promptly chopped the power, an accident ensued. This phrase was then changed to (I think) "Full Power". The Air Force didn't learn from that civil aviation incident until it happened to them, too, then they fixed it. It seems obvious, doesn't it? Everybody missed it.
- misterprime 7y ago
  "Takeoff power" -> "Take off [the] power". Interesting.
- paulcole 7y ago
  It all boils down to one of the simplest and most ignored truths: Most people aren't great at their jobs, they're average or worse than average.
  - FooHentai 7y ago
    It's not possible for most people to be worse than average.
    - throwaway2048 7y ago
      Only true where there is a normal distribution, the vast majority of people are less wealthy than the global mean of individual wealth for instance. The vast majority of people have more than the mean number of legs per person.
    - OJFord 7y ago
      Depends on what's meant by 'average'. True for median, (by definition) but false for mean and mode.
droithomme 7y ago
> It seems to me that the biggest issue with the fire system was the lack of a graphical display of the alarm The man monitoring the alarm, even though he had just started the job, says he did understand the code and where the alarm was and communicated that information to the guard. He does not claim that the problem was he didn't understand the code or there was anything wrong with the design of the alarm system. The guard on the other hand says the man monitoring the alarm told him the wrong location to go to. Neither of these issues though are related to the subsequent decision to call his supervisor as the number of alarms going off increased, and then sit around and do nothing while waiting for a call back. Nor does this have anything to do with the design of the alarm display.

blauditore 7y ago

I would guess no prioritization of usability ("it's just an internal tool, we can train people, it's cheaper anyway"). This seems like a common pattern on software projects, especially company-internal ones.

Someone 7y ago
For an example see https://www.theguardian.com/technology/2019/jul/13/margaret-hamilton-computer-scientist-interview-software-apollo-missions-1969-moon-landing-nasa-women https://www.theguardian.com/technology/2019/jul/13/margaret-...: ”I suggested a program change to prevent a prelaunch program being selected during flight. But the higher-ups at MIT and Nasa said the astronauts were too well trained to make such a mistake. Midcourse on the very next mission – Apollo 8 – one of the astronauts on board accidentally did exactly what Lauren had done. The Lauren bug! It created much havoc and required the mission to be reconfigured. After that, they let me put the program change in, all right.”
- Sharlin 7y ago
  This was a great read, thanks!
- papln 7y ago
  Is selecting a prelaunch program much worse than selecting an incorrect post-launch program? Or was there still a major risk of selecting an unsafe post-lauch program?
  - scrumper 7y ago
    The problem was that, with such limited memory available to the computer, it erased all the en-route navigational data to make room for the preflight data. So now you have a spacecraft on its way to the moon with no way to know where it is...

kweks 7y ago

Small aside, there are / were no security cameras anywhere in the cathedral.

onli 7y ago
But that's really just an aside. You just need a 3D map of the cathedral with the position of the fire detectors marked, blinking red when a fire breaks out. After all they already had a unique ID, according to the article. That's not hard. But they had too many years and too much money to implement a usable solution.
- kweks 7y ago
  Absolutely. The fire panels were banks of LEDs stuck on a wall in the guardian's house. As you say, presumably over the years the system was added to, and they hit a point where changing the entire system would have cost "too much", so they kept adding to a legacy solution..
  - hef19898 7y ago
    Always a good idea isn't it? Someone somewhere was certainly applauded for this brilliant business case and decision making. Everybody pointing out the flaws not so much I would assume...
- liberte82 7y ago
  > they had too many years and too much money to implement a usable solution Oh man, that hits home

gpvos 7y ago

It doesn't even have to be graphical (although I guess that would be best), as long as the location is clear, or a map is on hand.

userbinator 7y ago

Yes, it's really surprising that a system which "took dozens of experts six years to put together, and in the end involved thousands of pages of diagrams, maps, spreadsheets and contracts" didn't contain something that I've seen in nearly all the reasonably large buildings I've been in, some which have probably been there for many decades: https://static1.squarespace.com/static/53ca9e5ce4b0bcaba3c714ac/53d68247e4b061b2d21f8d96/53d69ca6e4b0f6dd3188b27e/1421765711991/Picture1.jpg https://static1.squarespace.com/static/53ca9e5ce4b0bcaba3c71...

maeln 7y ago
It's sadly often the cases for public contract here... Very much often, the contractor has no interest or incentive in doing a "quick and proper" job. Company that deal with public contract get really good at dragging the duration of a project, and its cost, way up. They know that the state will want to continue the project and will continue funneling money until its finish in any case. And when a project has some incentive (often financial penalty when deadline are not respected), company will give unrealistic deadlines to win the contract and then just run the penalty has normal cost of the projects. I know some project that had years of delay and were still profitable for the private company. Obviously it's not always the case, but having work for both a state owned company contracting private contractor and for a private contractor seeking public contract, it has certainly made me not optimistic about any projects funded by public money.
- godzillabrennus 7y ago
  You could also be IBM and make lots of money while never delivering anything: https://www.bloomberg.com/news/articles/2018-03-01/canada-to-scrap-ibm-payroll-plan-gone-awry-costing-c-1-billion https://www.bloomberg.com/news/articles/2018-03-01/canada-to... Not directly related but comical to me, I recently heard from someone working with IBM that they are really upset over the calls from Washington to regulate big tech. Upset because they aren’t mentioned by politicians or the media as big tech. It’s almost like they don’t really matter anymore.
  - 7y ago

zkms 7y ago

> It seems to me that the biggest issue with the fire system was the lack of a graphical display of the alarm i agree that the lack of a graphic/synoptic display for the smoke detection system was a horrid flaw, especially when rapid response is needed. However, i feel that the lack of an automatic extinguishing system was pretty grave too; given the excellent record of automatic fire sprinklers in containing -- if not fully extinguishing -- fires, well before the fire brigade arrives. Of course, accidental activation is a serious concern, but this can be addressed, whether through the use of a double-interlock preaction scheme (where the piping is kept water-free with a valve that is opened only when the heat/smoke detectors signal a fire; and even once the pipes are filled with water, sprinkler heads need to be individually activated with heat) or using a gaseous clean-agent instead of water.

anilakar 7y ago
I've written a touch panel UI for a next-gen sprinkler system. The valves themselves used high-pressure mist to bind smoke particles and minimize liquid damage often associated with sprinklers, and could be individually shut off when needed. I think the rationale was that by minimizing collateral damage you could install sprinklers in places where they would be considered a liability. I heard the largest end customers were shipbuilders and police stations; a few systems were installed in underground public spaces such as train stations. (Don't ask if the police has ever used the water spray as a taming device in the cells. I don't really want to know.)
- simonh 7y ago
  I doubt it would work. How is dealing with slippery wet angry prisoners an advantage over dry angry ones?
  - jon-wood 7y ago
    Totally off-topic, but this reminds me of a story from a psychiatric nurse I know. They apparently once had to deal with someone who decided to strip down, then cover themselves head to toe with some form of body oil they'd managed to get hold of. Hilarity ensued.

pintxo 7y ago

Yes and no. There seem to be multiple points of failure on the critical path. Yes the interface might be sub-perfect, but there is also a human on the critical path, who started work at 7am, meaning he's been working for 12 hours now. There is a reason regulation usually mandates limited hours for safety critical jobs. Why not automatically inform the fire department, ensuring that there is not one single critical path but an alternate option? Relying on the presence and correct reaction of a single security guard sounds like a less than perfect idea.

elliekelly 7y ago
> Why not automatically inform the fire department, ensuring that there is not one single critical path but an alternate option? I think this was the most confusing part of the response to me. Even my home security system calls the fire department by default and my condo isn’t an 850 year old landmark. It made me wonder whether the system produced a lot of false alarms that would make an immediate default response impractical.
- pintxo 7y ago
  That might be an issue. But then one might not need to send a whole fire brigade from t0. Maybe just send a single truck, or a single car.
  - zhte415 7y ago
    This depends where you are, I suppose. Fire Brigades in urban areas typically dispatch two engines that take two different routes to ensure one route is not congested, and at least one engine is on a faster, if not shorter, path than the other. Even real-time route planning cannot mitigate an unexpected cause of congestion yet to occur. Depends on area. Dense urban streets where contagion of fire may require this while a remote home in a rural may mean this route mitigation isn't necesary. However in both and all cases a rapid response is needed as lives are at risk.
- throw0101a 7y ago
  > Even my home security system calls the fire department by default and my condo isn’t an 850 year old landmark. Non-residential buildings are often charged for false alarms, so standard procedure is to have a human confirm things first: * https://gps-securitygroup.com/the-role-of-security-guard-regarding-fire/ https://gps-securitygroup.com/the-role-of-security-guard-reg... If confirmation is not done in x minutes, there is an automatic call though (with the requisite charge back for false alarms).

BryantD 7y ago

I do technical operations for a living. If I had a buck for every time I've seen an alert with unclear or non-actionable information, I would have retired ten years ago. This article describes a tragic situation, but it's not terribly surprising. Other things I saw: - people scared to talk about what happened because of blame issues - putting new employees in critical situations with only three days of training

WalterBright 7y ago

These all seem obvious now in hindsight, but that's always the way of things. People, even educated, intelligent, and earnest people are very bad at user interface design. Good UI design comes from experience, not foresight. For example, the aviation industry has standard terms for things. "Takeoff Power" means full power. Can you guess what happened? A pilot needed to abort a landing, and yelled "takeoff power" to the copilot, who promptly chopped the power, an accident ensued. This phrase was then changed to (I think) "Full Power". The Air Force didn't learn from that civil aviation incident until it happened to them, too, then they fixed it. It seems obvious, doesn't it? Everybody missed it.

misterprime 7y ago
"Takeoff power" -> "Take off [the] power". Interesting.
paulcole 7y ago
It all boils down to one of the simplest and most ignored truths: Most people aren't great at their jobs, they're average or worse than average.
- FooHentai 7y ago
  It's not possible for most people to be worse than average.
  - throwaway2048 7y ago
    Only true where there is a normal distribution, the vast majority of people are less wealthy than the global mean of individual wealth for instance. The vast majority of people have more than the mean number of legs per person.
  - OJFord 7y ago
    Depends on what's meant by 'average'. True for median, (by definition) but false for mean and mode.

droithomme 7y ago

> It seems to me that the biggest issue with the fire system was the lack of a graphical display of the alarm The man monitoring the alarm, even though he had just started the job, says he did understand the code and where the alarm was and communicated that information to the guard. He does not claim that the problem was he didn't understand the code or there was anything wrong with the design of the alarm system. The guard on the other hand says the man monitoring the alarm told him the wrong location to go to. Neither of these issues though are related to the subsequent decision to call his supervisor as the number of alarms going off increased, and then sit around and do nothing while waiting for a call back. Nor does this have anything to do with the design of the alarm display.