10 ms·

This is also the approach taking in aviation safety, and similar safety-critical systems. The pilot is treated as part of the system. Just like any other compon

by lmkg 6y ago

This is also the approach taking in aviation safety, and similar safety-critical systems. The pilot is treated as part of the system. Just like any other component, it's a part that can fail, and its error states can be modeled. Performance and reliability can be affected by training and certification, but just like anything else you're shooting for a threshold of tolerance for errors, not a complete removal of errors.

jack_riminton 6y ago
Parts are also designed on the basis that they WILL fail at some point so the whole system can still perform WHEN this happens
- toomuchtodo 6y ago
  Great example: Cirrus has a new personal jet, the Vision Jet. It has a feature called Safe Return Emergency Land [1]. If the pilot is incapacitated, a passenger can press the Big Red Button to activate the system, at which point the aircraft switches to autonomous mode to select the closest airport to navigate to and auto land at. Even the pilot can fail and the system will attempt to recover from this failure mode. [1] https://cirrusaircraft.com/story/introducing-safe-return-emergency-autoland/ https://cirrusaircraft.com/story/introducing-safe-return-eme...
  - skynetv2 6y ago
    Amazing tech! Thanks for sharing.
  - bluGill 6y ago
    Pretty much all new commercial jets have an autoland mode. If something happens to the pilots get into the cockpit (this is the hard part!) fast put on a headset, find the push to talk button and yell help. You need to be fast enough that the radio frequency to use hasn't changed (this is almost as hard as getting in!) as the plane moved on, but if you get a response whoever it is will get in contact with control for you and from there on they will tell you what buttons to push. Of course if you are in an old airplane (private plane, or legally retired but still in use in some poor country) all bets are off.
    - toomuchtodo 6y ago
      The revolution in this product is that it's available to general aviation users and the UX is "push button to land". It'll even squawk 7700 and announce intentions on 121.5 [1]. [1] https://www.faasafety.gov/SPANS/noticeView.aspx?nid=11667 https://www.faasafety.gov/SPANS/noticeView.aspx?nid=11667
    - tialaramex 6y ago
      "Autoland" in an airliner is nothing like this. It performs the actual landing (and in some cases part of roll out) only. The airliner's designers assume that since their planes are designed to be used only with at least two fully trained pilots there is no reason to worry about scenarios in which a non-pilot is now in charge. Those simply don't happen. Is it possible that they could talk a civilian down in an otherwise perfectly functional jet airliner given the pilots both are totally unavailable? Yes, but it'd be really hard and I would not give them great odds for it working. Plenty of random non-pilots won't even successfully work an airliner's radio, if you end up talking to yourself, or the passenger cabin, that doesn't help you. In contrast what Safe Return Emergency does is really one button "Oops, the pilot is unconscious/ dead, fix it". It has the same reassuring "Don't touch the controls" you get from Waymo cars. The SRE system is flying the plane, you can best help by staying calm and maybe trying to fix the pilot if that possible. It will figure out where there's a viable landing strip it can reach, broadcast its intentions to nearby humans, fly to its chosen strip, set up, perform the landing, roll out, stop and shut down the plane.
      - bluGill 6y ago
        I agree that it isn't easy. However in fair weather gentel adjustments to the controls (preferably the auto pilot ) will get you close enough. Control towers will clear your path so you having a fighting chance of walking away. Mostly the training is for small planes where there is one pilot. Pushing a button is or course a lot easier. I don't want to diminishing that. However most of us can't afford the type of plane ticket where it is needed, first class on a commercial flight is an order of magnitude cheaper. Thus the odds of both pilots dead is much higher, and so knowing there is still hope may be useful.
8ytecoder 6y ago
It’s also the approach the large e-retailer I worked for took. If a human made an error, it’s not the human’s fault. Find the process and design failures that led up to it.
- craftinator 6y ago
  This concept is elemental to any competent manager. Which is funny, because I've had very, very few managers who've ever understood it. Oddly enough, the ones who utilized it most were in the military, using the "Swiss Cheese" method of failure analysis. In order for a failure to actually occur, there had to be a complete path all the way through the "cheese", where the problem wasn't caught by any "slice". So a failure at the lowest level was also a failure at each level all the way to the top, and each level was required to figure out why it wasn't caught at their level. Very effective system.
  - WJW 6y ago
    For all its failings, the military has tons of good management practices. After all, leading people is their core business and they do it in some pretty severe circumstances. They also have extremely good incentives to get it right.
    - robaato 6y ago
      Surprise, surprise, the military has been around a few years/centuries. Some of that experience has stuck... I remember an ex-colleague saying that as an RAF person, he knew he could go on to a totally new airfield and ask for "XYZ Role" officer - and there would be an answer and direction to appropriate person. Military knows to design also for "deceased personnel" (redundancies etc)...
      - tialaramex 6y ago
        My mother (civilian MOD employee working at an "airbase" which was in fact just a lot of office buildings, no airfield, although it did have machine guns and a nuclear bunker unlike most office parks) used to have an email address which basically said what her job was [I don't remember the exact address, something involving REG twice because she worked for the REGistry of the RAF's REGiment], and yup, the day after she retired that address still worked it just dropped in somebody else's lap. So many IT outfits have problems that come back to "Oh, that was going to Bob and Bob left" and it infuriates me every time I see it, because we've known for decades how to avoid this problem.
mrmonkeyman 6y ago
They still crash though..
joombaga 6y ago
Your comment reminds me of a hidden brain episode that focused on the use of checklists in aviation and surgery. Now I often think of checklists from the perspective of various stakeholders at various levels when designing systems. This reframe has given me a more systemic view of parts that I'd once considered discrete. I'm much more careful now in applying the concepts of "blame" and "personal responsibility". https://www.npr.org/2018/08/27/642310810/you-2-0-check-yourself https://www.npr.org/2018/08/27/642310810/you-2-0-check-yours...
bumby 6y ago
There’s a fairly well-known design concept in other engineering disciplines called “human factors” that is squarely in the domain of reliability. Page 2 of this link goes into a useful breakdown https://sma.nasa.gov/docs/default-source/sma-disciplines-and-programs/human-factors/nasa-hfacs-v1-0-quick-reference.pdf?sfvrsn=f736f0f8_0 https://sma.nasa.gov/docs/default-source/sma-disciplines-and...
unbalancedevh 6y ago
And the approach to natural disasters. There's no way to avoid them, we just need to be prepared to minimize the damage and recover as gracefully as possible.
rbanffy 6y ago
The first think that occurred to me is that the app could list the transactions this would cause and present that list for confirmation, along with a total and how much of the whole it was. It would make the error much easier to spot. OTOH, the people approving may not have the right to see values, just the process part they are involved in. This and the aerospace mention reminded me of John Glenn: "two million parts, all built by the lowest bidder".

by lmkg 6y ago

jack_riminton 6y ago

Parts are also designed on the basis that they WILL fail at some point so the whole system can still perform WHEN this happens

toomuchtodo 6y ago
Great example: Cirrus has a new personal jet, the Vision Jet. It has a feature called Safe Return Emergency Land [1]. If the pilot is incapacitated, a passenger can press the Big Red Button to activate the system, at which point the aircraft switches to autonomous mode to select the closest airport to navigate to and auto land at. Even the pilot can fail and the system will attempt to recover from this failure mode. [1] https://cirrusaircraft.com/story/introducing-safe-return-emergency-autoland/ https://cirrusaircraft.com/story/introducing-safe-return-eme...
- skynetv2 6y ago
  Amazing tech! Thanks for sharing.
- bluGill 6y ago
  Pretty much all new commercial jets have an autoland mode. If something happens to the pilots get into the cockpit (this is the hard part!) fast put on a headset, find the push to talk button and yell help. You need to be fast enough that the radio frequency to use hasn't changed (this is almost as hard as getting in!) as the plane moved on, but if you get a response whoever it is will get in contact with control for you and from there on they will tell you what buttons to push. Of course if you are in an old airplane (private plane, or legally retired but still in use in some poor country) all bets are off.
  - toomuchtodo 6y ago
    The revolution in this product is that it's available to general aviation users and the UX is "push button to land". It'll even squawk 7700 and announce intentions on 121.5 [1]. [1] https://www.faasafety.gov/SPANS/noticeView.aspx?nid=11667 https://www.faasafety.gov/SPANS/noticeView.aspx?nid=11667
  - tialaramex 6y ago
    "Autoland" in an airliner is nothing like this. It performs the actual landing (and in some cases part of roll out) only. The airliner's designers assume that since their planes are designed to be used only with at least two fully trained pilots there is no reason to worry about scenarios in which a non-pilot is now in charge. Those simply don't happen. Is it possible that they could talk a civilian down in an otherwise perfectly functional jet airliner given the pilots both are totally unavailable? Yes, but it'd be really hard and I would not give them great odds for it working. Plenty of random non-pilots won't even successfully work an airliner's radio, if you end up talking to yourself, or the passenger cabin, that doesn't help you. In contrast what Safe Return Emergency does is really one button "Oops, the pilot is unconscious/ dead, fix it". It has the same reassuring "Don't touch the controls" you get from Waymo cars. The SRE system is flying the plane, you can best help by staying calm and maybe trying to fix the pilot if that possible. It will figure out where there's a viable landing strip it can reach, broadcast its intentions to nearby humans, fly to its chosen strip, set up, perform the landing, roll out, stop and shut down the plane.
    - bluGill 6y ago
      I agree that it isn't easy. However in fair weather gentel adjustments to the controls (preferably the auto pilot ) will get you close enough. Control towers will clear your path so you having a fighting chance of walking away. Mostly the training is for small planes where there is one pilot. Pushing a button is or course a lot easier. I don't want to diminishing that. However most of us can't afford the type of plane ticket where it is needed, first class on a commercial flight is an order of magnitude cheaper. Thus the odds of both pilots dead is much higher, and so knowing there is still hope may be useful.

8ytecoder 6y ago

It’s also the approach the large e-retailer I worked for took. If a human made an error, it’s not the human’s fault. Find the process and design failures that led up to it.

craftinator 6y ago
This concept is elemental to any competent manager. Which is funny, because I've had very, very few managers who've ever understood it. Oddly enough, the ones who utilized it most were in the military, using the "Swiss Cheese" method of failure analysis. In order for a failure to actually occur, there had to be a complete path all the way through the "cheese", where the problem wasn't caught by any "slice". So a failure at the lowest level was also a failure at each level all the way to the top, and each level was required to figure out why it wasn't caught at their level. Very effective system.
- WJW 6y ago
  For all its failings, the military has tons of good management practices. After all, leading people is their core business and they do it in some pretty severe circumstances. They also have extremely good incentives to get it right.
  - robaato 6y ago
    Surprise, surprise, the military has been around a few years/centuries. Some of that experience has stuck... I remember an ex-colleague saying that as an RAF person, he knew he could go on to a totally new airfield and ask for "XYZ Role" officer - and there would be an answer and direction to appropriate person. Military knows to design also for "deceased personnel" (redundancies etc)...
    - tialaramex 6y ago
      My mother (civilian MOD employee working at an "airbase" which was in fact just a lot of office buildings, no airfield, although it did have machine guns and a nuclear bunker unlike most office parks) used to have an email address which basically said what her job was [I don't remember the exact address, something involving REG twice because she worked for the REGistry of the RAF's REGiment], and yup, the day after she retired that address still worked it just dropped in somebody else's lap. So many IT outfits have problems that come back to "Oh, that was going to Bob and Bob left" and it infuriates me every time I see it, because we've known for decades how to avoid this problem.

mrmonkeyman 6y ago

They still crash though..

joombaga 6y ago

Your comment reminds me of a hidden brain episode that focused on the use of checklists in aviation and surgery. Now I often think of checklists from the perspective of various stakeholders at various levels when designing systems. This reframe has given me a more systemic view of parts that I'd once considered discrete. I'm much more careful now in applying the concepts of "blame" and "personal responsibility". https://www.npr.org/2018/08/27/642310810/you-2-0-check-yourself https://www.npr.org/2018/08/27/642310810/you-2-0-check-yours...

bumby 6y ago

There’s a fairly well-known design concept in other engineering disciplines called “human factors” that is squarely in the domain of reliability. Page 2 of this link goes into a useful breakdown https://sma.nasa.gov/docs/default-source/sma-disciplines-and-programs/human-factors/nasa-hfacs-v1-0-quick-reference.pdf?sfvrsn=f736f0f8_0 https://sma.nasa.gov/docs/default-source/sma-disciplines-and...

unbalancedevh 6y ago

And the approach to natural disasters. There's no way to avoid them, we just need to be prepared to minimize the damage and recover as gracefully as possible.

rbanffy 6y ago

The first think that occurred to me is that the app could list the transactions this would cause and present that list for confirmation, along with a total and how much of the whole it was. It would make the error much easier to spot. OTOH, the people approving may not have the right to see values, just the process part they are involved in. This and the aerospace mention reminded me of John Glenn: "two million parts, all built by the lowest bidder".