Your comment reminds me of a hidden brain episode that focused on the use of checklists in aviation and surgery. Now I often think of checklists from the perspective of various stakeholders at various levels when designing systems. This reframe has given me a more systemic view of parts that I'd once considered discrete. I'm much more careful now in applying the concepts of "blame" and "personal responsibility".

https://www.npr.org/2018/08/27/642310810/you-2-0-check-yours...

It’s also the approach the large e-retailer I worked for took. If a human made an error, it’s not the human’s fault. Find the process and design failures that led up to it.

This concept is elemental to any competent manager. Which is funny, because I've had very, very few managers who've ever understood it.

Oddly enough, the ones who utilized it most were in the military, using the "Swiss Cheese" method of failure analysis. In order for a failure to actually occur, there had to be a complete path all the way through the "cheese", where the problem wasn't caught by any "slice". So a failure at the lowest level was also a failure at each level all the way to the top, and each level was required to figure out why it wasn't caught at their level. Very effective system.

For all its failings, the military has tons of good management practices. After all, leading people is their core business and they do it in some pretty severe circumstances. They also have extremely good incentives to get it right.

Surprise, surprise, the military has been around a few years/centuries. Some of that experience has stuck...

I remember an ex-colleague saying that as an RAF person, he knew he could go on to a totally new airfield and ask for "XYZ Role" officer - and there would be an answer and direction to appropriate person.

Military knows to design also for "deceased personnel" (redundancies etc)...

My mother (civilian MOD employee working at an "airbase" which was in fact just a lot of office buildings, no airfield, although it did have machine guns and a nuclear bunker unlike most office parks) used to have an email address which basically said what her job was [I don't remember the exact address, something involving REG twice because she worked for the REGistry of the RAF's REGiment], and yup, the day after she retired that address still worked it just dropped in somebody else's lap.

So many IT outfits have problems that come back to "Oh, that was going to Bob and Bob left" and it infuriates me every time I see it, because we've known for decades how to avoid this problem.

What’s odd is that the MOD does that and the rest of the civil service carries on using name-based emails, despite people moving round every year or two.

There is a huge problem in the civil service of information being local to teams. Important information sots in inboxes or a shared drive if you’re lucky.

Finding out who to contact in another department on a given topic can take days and usually requires asking your private office to check (because they at least have the other department’s private office contact details). Otherwise people just look for emails in published documents and email out in the hope that at least one of them still works in the right department.

This could all be so easily solved with permanent, shared mailboxes per team. I suspect the reluctance is in part due to how much easier it would make FOIs.

Well then you need at least two email addresses per person. One role-based, one personal - promotions happen, you may want to keep being able to contact the human, not the role.

Yes, you do. But for the military this does not really matter, one of their defining characteristics is that they care MUCH more about "getting the job done" than about cost. This leads both to massive inefficiencies and to their extreme resilience to "bus factor" type events. It's a decent tradeoff for the military, it probably wouldn't be for commercial entities.

Having a role based system also makes it easier to move those tasks into a ticketing system.

In Sweden we used to have a conscription army. It was said that they got really good at leadership and training since they could afford to experiment. If they screwed up one year they could just scrap the whole batch since they anyway got a new cohort every year.

The Israeli claim a lot of their startup culture comes from the high degree of responsibility their (very young) conscripts get in during their mandatory military service. I can imagine that someone who's been an 18-year old tank gunner in actual tank-to-tank combat has a different outlook on acceptable levels of risk than most people.

> For all its failings, the military has tons of good management practices

Military needs consistency, predictability, and uniformity. It needs a lot of good management practices to achieve that with people and parts that are not consistent, predictable, or uniform.

The military has to account for leadership moving up or out, a constant influx of new people, and the operational challenges of what they do, and a different perspective on money. Military dysfunction is different than private sector

Companies tend to focus on chiseling pennies and hope for the best.

In critical systems I agree with this philosophy. However, there are trade-offs to building process and checklists and peer reviews to every step in a human system.

Yet when this same retailer takes down half the internet with a bad config change to a large storage system you are likely asking why they didn't have better processes to prevent this dangerous action

Which is a much healthier reaction than blaming the poor employee that changed that config file.

they didn't blame the employee they did the right thing, that's the culture.

There’s a fairly well-known design concept in other engineering disciplines called “human factors” that is squarely in the domain of reliability.

Page 2 of this link goes into a useful breakdown

https://sma.nasa.gov/docs/default-source/sma-disciplines-and...

Parts are also designed on the basis that they WILL fail at some point so the whole system can still perform WHEN this happens

Great example: Cirrus has a new personal jet, the Vision Jet. It has a feature called Safe Return Emergency Land [1]. If the pilot is incapacitated, a passenger can press the Big Red Button to activate the system, at which point the aircraft switches to autonomous mode to select the closest airport to navigate to and auto land at. Even the pilot can fail and the system will attempt to recover from this failure mode.

[1] https://cirrusaircraft.com/story/introducing-safe-return-eme...

Pretty much all new commercial jets have an autoland mode. If something happens to the pilots get into the cockpit (this is the hard part!) fast put on a headset, find the push to talk button and yell help. You need to be fast enough that the radio frequency to use hasn't changed (this is almost as hard as getting in!) as the plane moved on, but if you get a response whoever it is will get in contact with control for you and from there on they will tell you what buttons to push.

Of course if you are in an old airplane (private plane, or legally retired but still in use in some poor country) all bets are off.

"Autoland" in an airliner is nothing like this. It performs the actual landing (and in some cases part of roll out) only. The airliner's designers assume that since their planes are designed to be used only with at least two fully trained pilots there is no reason to worry about scenarios in which a non-pilot is now in charge. Those simply don't happen.

Is it possible that they could talk a civilian down in an otherwise perfectly functional jet airliner given the pilots both are totally unavailable? Yes, but it'd be really hard and I would not give them great odds for it working.

Plenty of random non-pilots won't even successfully work an airliner's radio, if you end up talking to yourself, or the passenger cabin, that doesn't help you.

In contrast what Safe Return Emergency does is really one button "Oops, the pilot is unconscious/ dead, fix it". It has the same reassuring "Don't touch the controls" you get from Waymo cars. The SRE system is flying the plane, you can best help by staying calm and maybe trying to fix the pilot if that possible. It will figure out where there's a viable landing strip it can reach, broadcast its intentions to nearby humans, fly to its chosen strip, set up, perform the landing, roll out, stop and shut down the plane.

I agree that it isn't easy. However in fair weather gentel adjustments to the controls (preferably the auto pilot ) will get you close enough. Control towers will clear your path so you having a fighting chance of walking away. Mostly the training is for small planes where there is one pilot.

Pushing a button is or course a lot easier. I don't want to diminishing that. However most of us can't afford the type of plane ticket where it is needed, first class on a commercial flight is an order of magnitude cheaper. Thus the odds of both pilots dead is much higher, and so knowing there is still hope may be useful.

The revolution in this product is that it's available to general aviation users and the UX is "push button to land". It'll even squawk 7700 and announce intentions on 121.5 [1].

[1] https://www.faasafety.gov/SPANS/noticeView.aspx?nid=11667

Amazing tech! Thanks for sharing.

The first think that occurred to me is that the app could list the transactions this would cause and present that list for confirmation, along with a total and how much of the whole it was.

It would make the error much easier to spot.

OTOH, the people approving may not have the right to see values, just the process part they are involved in.

This and the aerospace mention reminded me of John Glenn: "two million parts, all built by the lowest bidder".

And the approach to natural disasters. There's no way to avoid them, we just need to be prepared to minimize the damage and recover as gracefully as possible.