Unintended Consequences

The Air France crash (and my current belief that the pilot flew the plane right into the storm on autopilot – and possibly a problem with the airspeed detector caused the plane to stall) has provoked me to tell a related life story of a very similar “accident waiting to happen”.

I’m going to overexplain this (which I’m got at) because you probably don’t know or don’t care about the technology, even if it affects you personally.  I’m a public transit geek – or at least I was.   For about a year, I worked in Chicago and rode the “El” to work every day (about an hour each way).  Unlike many other transit systems, on the CTA’s “El”, if you get in the first car, you can sit opposite the motorman/driver and watch him drive the train and look out the front window.   Since I got on the train at the end of the line, it was usually easy to grab that seat.

Chicago’s subway/elevated lines have what is called “cab controls” on much (but not all) of its lines.   Over the years, there have been lots of accidents involving driver errors (in Chicago and elsewhere – most recently in Boston), where the driver did not obey a stop signal, driving too fast, being distracted by a pretty woman, etc..  and plowing into the train ahead or going around a curve too fast.   So the obvious “fix” to the human problems is to solve it with technology.

The Cab controls prevent the train from going faster than the permitted speed – the train will disengage the motors and put on the brakes.   A separate older system protects the trains from running through a red light.  There is a mechanical trip – if the train proceeds through a red signal, the arm trips the emergency stop on the train and brings it to an immediate halt.  What could possibly go wrong?

Chicago still uses 2 man (oops, person!) operation, which is somewhat rare.  Part of it is probably union rules, part of it is that Chicago’s system is very old.  The cars have doors on both sides because some of the stations have the platform on one side, and some on the other.  The motorman’s job is to drive the train.   The conductor’s job is to open and close the correct set of doors at each station.  The conductor is typically in about the middle of the train.  Late at night after the stations close, the conductor also collects fares if necessary.  They also (in theory) are a deterrent to crime.  They aren’t armed, but they do have a radio.

By splitting one job between two people, that creates a real safety problem.  What happens if the driver starts to move the train and the doors are still open?   What if the train starts moving and at the same time the conductor decides to reopen the doors as someone is running toward the train.   Someone dying is a very probable outcome.  

So technology has the answer – the safety interlock.   To make sure this can never happen, the trains have a built in system to prevent it.   The train will not move if the doors are open, and you can’t open the doors if the train is moving.  Problem solved.

Until you realize that anyone who has ever designed an idiot proof system has not met very many idiots.   The problem is that virtually all of the drivers now let the safety system drive the train.    They just push the power control to max and then let the cab controls push back and slow the train if it is going too fast.  Because the drivers are not in control, they make no judgments about speed (that’s not bad by itself), but that can lead them to become more and more careless about the trains operations.  The only way the train is under manual control is if the operator puts it in manual.  That triggers an alert back at the operations center, and the train is limited to only about 5 mph.  It’s intended to be used only to move trains in and out of the storage yard, or where cab control is not in effect or has failed for some reason.

One day in particular, an operator was doing an incredibly stupid thing – no doubt against the “rules”.     As the train would stop in each station and the doors opened, he pushed the power control to max while in the station with the doors open.   When the doors would close, the safety interlock would disengage, and the train immediately take off at maximum power.  He had taken a safety device meant to protect against a human mistake and converted it into a way to be lazy – introducing a huge risk that if the interlock ever failed, he was likely going to kill some people.   The interlocks frequently failed, but usually the other way – the doors would be shut, but the system thought they were still open and wouldn’t let the train move – the conductor would have to cycle the doors open and closed to get the train to release.

So if you realize how human behavior adapts to not being responsible and in control, it isn’t a big leap to imagine a pilot on plane that can fly itself seeing a thunderstorm on radar and saying “the plane can do a better job than me, it’s flown itself through storms before”…  let’s sit back and let it handle it.

To be clear, I’m not necessarily blaming the pilot.   Had he overridden the computer navigation, he may have had to fly 100s of miles out of the way.  He might not have had enough fuel to land at his destination with an adequate safety margin (extra fuel = more weight = less efficient).  It could be that he would face punishment for doing so.  The Captain is always in charge unless someone else tells him he isn’t.

*** Washington D.C. update ***
6 killed today as one Metro train plows into another that is stopped in a station.   Media reports are blaming a failure of the signaling system, rather than the operator not noticing the impending crash and going into emergency stop.

Just a guess, but the most likely cause of this type of accident is when an engineer overshoots a station, then backs up the train on manual.   That puts the lead train into a “block” that is supposed to be empty.  The following train doesn’t know that because they already went past the green “all clear” signal.   The witness reports all agree that the moving train did not apply brakes at all prior to the crash.   I’ve ridden the Metro, and its cab control is very thorough – the only thing the operator does is to close the doors.  The train controls the acceleration and braking.   It’s very plausible that the operator could have been playing video games on her cell phone and letting the train make all the decisions.

A detail as you look at the pictures and read the accounts – you’ll see 4 tracks, with the Metro train on the inner track.   The outside tracks are NOT metro – they are the Amtrak line that runs into Union Station.   That probably greatly complicated the crash scene and the risk that an Amtrak train could have plowed into the wreckage – fortunately that didn’t happen.