In praise of roundabouts

The first time I ever noticed roundabouts, I was on vacation in the UK. This was many years ago, but they seemed to be everywhere. At first I thought it was just one more peculiar feature of local transportation, along with narrow roads, streets that changed their name with each new block, and driving on the left. In fact, I didn't realize how much they improved the flow of traffic until I found myself immobilized in a column of cars for what seemed a very long time, only to realize we were all stopped for a traffic light.

That afternoon I saw why roundabouts were so common in the UK, and I began to wonder why they aren't just as common everywhere else. Of course rebuilding an existing intersection is time-consuming and expensive. But the statistics comparing roundabouts to traditional intersections are remarkable.

• The Federal Highway Administration estimates that replacing a traditional intersection with a roundabout reduces the number of fatal and injury crashes by about 80%. (That's 82% for a two-way stop-controlled intersection, and 78% for a signal-controlled intersection.)*
• When collisions do occur, they are generally side-to-side collisions from merging or changing lanes, rather than head-on or right-angle collisions. On the whole, side-to-side collisions are less damaging and less often lethal than the other kind.
• Not only are they safer for cars, but roundabouts have 10-40% fewer pedestrian or bicycle crashes than traditional intersections.
• Since cars typically don't have to wait as long at roundabouts as at traditional intersections, they contribute to reducing air pollution from idling engines.    

And all these benefits stem from one root cause: Roundabouts are far simpler than traditional intersections. In this context, simplicity is measured by counting "conflict points." These are points in the intersection where a collision can be foreseen. A traditional intersection of two roads, each supporting two-way traffic and crossing at right angles, has 32 conflict points. If those same two roads meet in a roundabout, the number of conflict points drops to eight. No wonder the roundabout is safer!

Why am I writing about traffic this week? There's no special reason, except that it illustrates in a dramatic way another important Quality principle: when other things are equal, simplicity is better than complexity. In other words, if you have two solutions to a problem and they both solve it equally well, choose the simpler one. The complex tool has more parts; the complex procedure has more steps; the complex intersection has more conflict points. In all events, this means that the complex solution has more ways to go wrong: more parts that can break, more steps that can be mis-executed, more collisions that can happen. From the perspective of risk management, the complex solution is always—again, other things being equal—more fragile and more at risk of failure.

Years ago, a colleague at work was telling me about the cup holders in his cars. He owned two cars, and the cup holders were very different. One car had a sleek and elegant design. The cup holder was tucked discreetly out of sight until you pushed a button; then a little motor gently unfolded it for you. But at the time we talked, a tiny part had broken in the motor, so it had stopped working. He had contacted the dealership, but it would be several weeks before they could get the piece in stock.

The other car wasn't nearly so elegant. But it had a piece of plastic in arm's reach, molded to hold a cup. The overall look wasn't nearly as sleek and beautiful as the first car, but there was nothing that could break. From the perspective of customer satisfaction, the simpler solution clearly had the higher Quality. And it's often like that.

__________

* You can find more detailed numbers, for example, here.    

Hierarchy of hazard controls

When I find that I've interrupted myself—twice in a row!—to make a disclaimer that's no part of the main post, maybe I need to pay attention. Maybe it's time for me to discuss the topic on its own, to get it settled, rather than pushing it off into footnotes.  

My last two posts—last week and three weeks ago—were about how to use written procedures. In both articles, I explained that written procedures should be regularly enhanced with the lessons learned from mistakes or disasters, so that the organization learns from those mistakes and doesn't repeat them. And both times I had to include a little caveat, to the effect that updating procedures is often not the best way to prevent safety problems.

Why did I bother to say this—especially twice? Also, what is the best way to prevent safety problems?

For the first question: I bothered to say it because updating procedures is probably the easiest way to address safety problems. Typically it costs less than any other approach, and it usually takes less time. But it is also one of the least effective ways to address safety problems, because people forget what they read, or decide to ignore it, or never get around to reading it in the first place.

For the second question, ... well, it depends. Classically there are five options, but they aren't always available in every case. So you have to see what you can do in each specific situation.

By Original version: NIOSHVector version: Michael Pittman
https://commons.wikimedia.org/w/index.php?curid=90190143

Elimination 

The most effective way to control a hazard is to eliminate it completely, but this isn't always possible. If your workplace has extension cords stretched across walking areas, those constitute a trip hazard. Get rid of the extension cords, perhaps by installing power outlets where you need them or by rearranging your workstations, and you have eliminated the trip hazard. If some work is being done high above the ground, there is a falling hazard. If you can relocate the work to ground level, you have eliminated the falling hazard. Again, this is the most effective approach—the hazard is gone, after all!—but sometimes it is not practical.

Substitution

The next-most-effective approach is to substitute something less dangerous for the original hazard. A common use-case for substitution involves the use of hazardous chemicals, because sometimes there is a less-hazardous chemical that will do the same job. Some operations have replaced the solvent benzene, a carcinogen, with toluene; others have replaced lead-based solder with lead-free solder. These substitutions generally cannot be done overnight: lead-free solder melts at a different temperature than the lead-based original, so converting a printed circuit board to lead-free solder requires sourcing new components and re-laying out the board. Still, it can be done. 

Engineering controls

Engineering controls do not remove the hazard, but isolate it. The easiest example is a guard rail or shielded enclosure to keep fingers out of machinery, or a ventilation hood to shield people from breathing noxious gases. Lockout-tagout mechanisms serve a similar purpose by ensuring that a machine cannot be serviced until it has been powered off and disconnected. In all these cases the hazard still exists, so if someone went out of his way to override the engineering controls there is a theoretical chance he could be injured. But he would have to go out of his way. In normal operation, engineering controls should keep people from getting hurt.  

Administrative controls

This is where we talk about updating your procedures! Administrative controls are all the measures that rely on telling people not to do things that can hurt them: they include written procedures, but also training, signs, and warning labels. Other administrative controls could include job rotation or work schedules, to reduce the exposure of each individual worker to a certain hazard; preventive maintenance programs, so that the equipment functions properly; scheduling certain tasks during off-peak hours, when fewer workers are present; or restricting access to hazardous areas. All of these measures are important, and they certainly have a place alongside more effective measures. It may also happen, because of special circumstances at your workplace, that sometimes these are the best you can do. But they all rely on human compliance. And as we have seen, human compliance is not always reliable. That's why administrative controls rank so low on the effectiveness scale.

Personal protective equipment (PPE)

Finally, sometimes you just have to walk in and grab the hazard in both hands. After analyzing it every possible way, you find that you can't eliminate the hazard and can't substitute it; and because the work requires direct human action at that point, engineering and administrative controls are beside the point (because both of those are designed to keep you away from the hazard). Fair enough. Do what you have to do. But at least wear gloves. Or a breathing filter. Or a hazmat suit. Or whatever the right PPE is for this particular hazard. PPE is rated as the least effective form of hazard abatement, because the only time you use it is when you are getting up close and personal with the hazard itself. But sometimes that's what you've got to do, and PPE is just what you need.

Once upon a time, years ago, I was talking to the management team for a mine. (They were mining diatomaceous earth, not coal or gold, but I bet the principles are the same.) I asked them if their employees tended to suffer from emphysema, or other lung ailments. They said that back before the 1950's, yes, that was a big problem. But in the 1950's someone invented a breathing filter which screened out the tiny particles of diatomaceous earth and other rock products, and after that they'd never had any trouble. I asked about enforcement, and they said: 

"Oh, that's easy. We painted a white stripe across the road into the mine. Then we announced that anybody who was found on the other side of the stripe without his breathing filter in place and working would be fired. On the spot. No questions asked. No excuses. No matter who.

"And you know? We haven't had a single problem since then."* 

PPE may be ranked as "least effective" but sometimes it's exactly what you need.

Anyway, that's the hierarchy of hazard controls. That's what's behind the little disclaimers in my last two articles. I hope it helps.

__________

* Technically this means they used PPE, reinforced by administrative controls (the white stripe).

       

"Lazy compliance" and unintended consequences

Last week, a friend of mine got a new electric stove. But that was only the beginning of the story.

Once it was installed, she learned that her new stove wasn't compatible with her cookware. I didn't know that was possible, but she explained it to me as follows: 

Turns out all electric stoves manufactured since 2018 need to meet a safety standard to reduce fire risk which cycles the burner off when a pan is not in contact with it. 

In complete contact with it; to work on my "sensi-temp" burners, pans have to have a completely flat bottom.

My only 2-quart saucepan was warped.

So, this morning I purchased a new one.  Stainless steel, $28, sigh.

But at least I can cook rice tonight!

This is the kind of outcome that makes people believe conspiracy theories. To her credit, my friend didn't start yelling that the stove-manufacturers must be in cahoots with the cookware-manufacturers to drive up sales—at least, she didn't say it around me—but I would have understood if she had. For myself, I began to wonder how such a defective outcome came to pass in the first place. 

Should I take a minute to explain what it is that makes this update to new stoves an impairment and not an improvement?

It's unexpected. Maybe there was coordination inside the kitchen-appliance industry, but I don't remember seeing any communication to the general public back in 2018 that stoves were changing in a fundamental way. Nor does my friend, obviously.

It requires additional actions from consumers, unrelated to the stove itself. When the auto industry introduced anti-lock brakes, they didn't insist that drivers start braking differently. Rather, they started from the known facts about how drivers react in panic situations, and redesigned the brakes to fit the drivers. By contrast, telling home-cookers that they have to buy new cookware to fit their new stoves is completely backwards. 

It requires additional and unexpected costs. This is basically the same point, hitting your wallet as well as your habits.

It's going to break. Every feature that you add to a product is one more thing that can break. But what happens if the sensor breaks on this new stove, while the shutoff-mechanism for heating elements remains intact? Then the stove will fail to detect a pan on the burner even when a pan is there, and the burner won't heat up. Result: the stove won't work. Any change that makes a product more fragile and less resilient is an impairment and not an improvement.

Sure enough, people hate it. There are long discussion threads on Reddit (see here, for example) about how to replace your brand-new "sensi-temp" burners with the old style, where to buy old-style burners as replacement parts, and so forth. Of course, buying old-style burners from some random site on the Internet means you have to spend even more, but plainly some people think it is worth the expense. 

Ironically, I bet that dismantling your stove to replace the heating elements with ones you ordered online may introduce some safety risks into your day; and yet I guarantee that when GE and other manufacturers did a safety analysis on this change before implementing it, they never considered the risks from home retrofits by angry customers. But this change to stoves has created a market and a community for exactly this kind of home retrofit. 

Why did they do it?

I wish I knew. I would love to see the FMEA carried out on this change before it was implemented.

It would be easy to blame ignorance. Maybe the engineers never actually do their own cooking, and didn't realize that this new feature could pose a problem. But that can't be the whole story, because GE (at least) provides an information sheet that warns explicitly about non-compliant cookware. You can download this sheet from the GE website here. (Also I have archived a copy locally here, in case the GE site is ever rearranged.) 

At the most basic level, the change appears to have been introduced in response to an update of the safety standard UL 858, "Household Electric Ranges." [You can buy the standard here.] Based on other informational material provided by GE, the thinking appears to have run something like this:

• Stovetop oil and grease fires are bad.
• To prevent them, we have to prevent pans on the stovetop from getting too hot.
• To measure how hot a pan is, we have to have a sensor touching the pan.
• But this approach could fail if the sensor doesn't touch the pan. So to avoid that case, if the sensor doesn't touch the pan we will cut off power to the burner. (According to this article, the stove should not cut off power completely; but my friend's experience was exactly that.)

It's logical, as far as it goes. But the whole line of reasoning exemplifies what another friend has called "lazy compliance": that's "where they make changes required for safety without bothering to make compensatory changes so the thing works as well as it did before."

Of course, you might think, So what? It's safer, and that's what counts. And to some extent, naturally that's true. But in the rest of our lives, we are often willing to make trade-offs where we sacrifice a measure of safety to secure nothing grander than convenience. 

For example, if all automobiles had to observe a strict maximum speed limit of 20 miles per hour, the number of fatal car crashes in a year would drop to nearly zero. Shall we take a vote? Never mind, I guarantee the measure would fail. Even though "car crashes are the leading cause of death in the United States for people ages 1 to 54," we'll never get a voting majority willing to eliminate those deaths by lowering the speed limit so far.

So why stovetops? And why didn't those of us who use stoves regularly get a vote? (If you remember last week's post, that's called "stakeholder engagement," and it's important.)  

I wish I knew. If you know more about it than I do, please leave a note to help explain.

     

Keep your customers informed!

Mistakes are a fact of life. Even with a very good Quality system, things still go wrong: accidents happen, and people do foolish things. Therefore every Quality system has to spell out (among other things) how to respond when something bad happens. "How to respond" typically includes several elements: containing the problem, finding the root cause, implementing corrective actions, and so on. But there's another element that can be just as important, but that is often overlooked: Let your customers know what's going on!

A friend of mine drives a Kia Soul. She's had it for years. Last fall, Kia notified her that her car was subject to a recall. According to the official documentation (NHTSA campaign number 23V652000): 

"The Hydraulic Electronic Control Unit (HECU) may experience an electrical short, which can result in an engine compartment fire while parked or driving.... Owners are advised to park outside and away from structures until the recall repair is complete."

So far, so good. Kia discovered a risk and proactively notified customers so they are aware of it. And of course Kia explained that they will repair the vehicles free of charge. 

What the notice did not contain was an estimated date that the fix would be available. And as the months went on, all my friend heard was more silence. From time to time she called her local dealership, but they were as much in the dark as she was.

To be clear, I can imagine reasons why Kia might have found it hard to give a precise date right at the beginning. And if the issue were comparatively minor—if, say, they were offering a new design of floor mats or steering wheel covers—there would be no reason to handle the communications with urgency. But when you have just told your customers there's a chance that their car will unexpectedly burst into flame, it's probably a good idea to keep them well-informed and up-to-date on when they can expect the fix to be available.

Let your customers know what's going on.

The good news is that—according to the NHTSA website—letters finally started going out late this spring and into the summer that the fix was available. They were staged according to model type, and my friend's model came at the very end of the line. So she still has to make arrangements with her local dealership. But it's progress. 

               

Boeing again, and the power of systems thinking

It seems like Boeing just can’t stay out of the news these days. 

• 
  On Saturday, June 22, Korean Air 189—a Boeing plane—developed a leak half an hour after takeoff. Within ten minutes the cabin depressurized, triggering the emergency oxygen masks. The flight was bound from Incheon Airport in Seoul, South Korea, for Taichung International Airport in Taiwan. But when the cabin lost pressure the pilots started an emergency descent to bring the plane down to a safe altitude, dropping nearly 26,900 feet in fifteen minutes. While nobody was seriously injured, nineteen passengers were hospitalized for ear pain and nosebleeds.
• 
  A couple weeks before that, on June 5, two NASA test pilots blasted off for the International Space Station aboard Boeing’s Starliner capsule. They were supposed to spend a week. But the capsule had last-minute thruster trouble after it was already launched, which almost prevented it from docking with the ISS. (It also developed several small, unrelated helium leaks.) At this writing, the two pilots have been at the ISS for three weeks (not one) … and counting. Their return has been scheduled for three different dates—and canceled each time, as NASA and Boeing continue to trouble-shoot the equipment. But a Boeing spokesman offered reassurance that that “the astronauts are not stranded.”
• Last month, Justice Department prosecutors recommended that Boeing face criminal charges for violating a 2021 settlement related to crashes of the 737 MAX in 2018 and 2019. 
• And just last week, the National Transportation Safety Board sanctioned Boeing for making inappropriate comments to the media regarding the ongoing investigation of Alaska Airlines 1282. 

What’s an airline to do?

Asking the wrong question

I wrote, “What’s an airline to do?” but it’s not clear if that’s even the right question. Let’s think about it for a minute.

Of course, it’s difficult to turn around a whole organization, especially one as large as Boeing. Growing or healing a Quality culture is a big task, and it requires coordinating a lot of elements—even something as trivial as a box of doughnuts can help make a difference. If this were the first time that Boeing had had problems, we might expect the turnaround to take a while.

But it’s not the first time. Boeing’s Quality and safety cultures have gotten worldwide attention at any rate since the crashes of Lion Air 610 in October, 2018, and of Ethiopian Airlines 302 in March, 2019. And internal discussions had already begun years before those crashes. Boeing whistleblower John Barnett testified that he began raising Quality complaints internally back in 2011.

So if the deficiencies in Boeing’s Quality and safety cultures have been well-known for over a decade, why has the company seemingly made so little progress?

A couple of months ago in this blog, we looked at how the Mayo Clinic built their Quality culture, one that continues to be healthy and effective. One of the critical elements that made the Quality initiative succeed was solid, long-term management support. Barnett and others (including other whistleblowers) have said—to put it gently—that Boeing’s management did not offer the same kind of support when Quality concerns were raised. Their focus was profitability, pure and simple.  

The funny part is, you would think that a focus on profitability ought to be enough, if only the management took a wider perspective. When customers suffer from a bad product, they sue; their damages come out of the company’s profits. When courts convict companies of criminal activities, they assess fines; those fines are paid out of the company’s profits. Besides, as we discussed with respect to the Mayo Clinic, a reputation for high Quality can itself be a key to increased profitability. Surely if only Boeing’s management were sufficiently enlightened, they would do the right things out of self-interest. Wouldn’t they? Isn’t that how this is supposed to work?

Empirically, it doesn’t seem to.     

So maybe the real question is, What’s a judge to do? Boeing has already been assessed $2.5 billion in criminal penalties; they have been subject to litigation more or less continually since the Lion Air crash; and there is no clear evidence that anything meaningful has changed. If the DOJ prosecutors have their way and Boeing is assessed another $24 billion, do we really think that will finally make the difference, when other fines and damages have failed? Or will Boeing just write it off as a cost of doing business? 

One of the recurring lessons in the Quality profession is the need to study the objective consequences of the measures we take—in other words, to assess the effectiveness of our corrective actions. If we keep doing the same thing to fix a problem and it keeps not working, the odds are pretty good that doubling down one more time isn’t going to help. Assessing fines on corporate malefactors—not just Boeing, but others as well—doesn’t seem to make much difference. Maybe it’s time to try something else.

The systems perspective

We’re often encouraged to take a “systems perspective” to solve Quality problems, though it’s not always obvious what that means in practice. But I recently ran across an example in an unexpected place. In my spare time, I’ve been reading The Dictator’s Handbook: Why Bad Behavior Is Almost Always Good Politics, by Bruce Bueno de Mesquita and Alastair Smith.* One topic they discuss is government corruption (e.g., bribes); and they point out that enacting strict laws against corruption is, by itself, not nearly enough to curtail it.** (To be very clear, I am NOT accusing Boeing executives or the FAA of corruption! But this example is meant to show how a systems perspective can illuminate questions about enforcement in general.)

Why are those laws not enough? Well, they have to be enforced by someone in the government administration. So in case the administration is also corrupt (and in some countries it is), they will not enforce laws against their friends or allies. In such countries, strict anti-corruption laws are no more than a tool that the administration can use to weed out the disloyal by engaging in very selective prosecution for something that in reality everyone does.

What Bueno de Mesquita and Smith explain is that the best way to root out corruption is to increase the number of voters that the government depends on to keep power. In an autocracy or an oligarchy, where the administration depends on a tiny number of backers, they can afford to reward those people through corruption in exchange for support. But if more people are allowed to vote, then the number of supporters needed to keep a government in power grows much larger. It then becomes pragmatically impossible to pay so many for their votes. And at that point, the anti-corruption laws can finally do their job and the prevalence of corruption starts to recede because the system no longer supports it.

This is a systems argument! And while (once again) I’m certainly not accusing anyone at Boeing of corruption, I think the example highlights how we need to approach the problem of bringing our largest and most powerful corporations to heel. Working inside the existing system by assessing fines doesn’t appear to offer much traction. The alternative is to apply some other kind of pressure to any of the very few points where there is a chance for some leverage.  

An alternative to fines

The proposal that follows is only an example, but it relies on the same kinds of systems thinking that Bueno de Mesquita and Smith use. I owe this example to the blogger and public intellectual John Michael Greer, and I will quote his description extensively in what follows.***

Greer starts by pointing out that in certain parts of Europe during the early Middle Ages, most legal punishments took the form of fines (weregild)—the same way that our courts assess fines on corporations today. Someone who injured or murdered someone else could make restitution to the victim’s family by paying the appropriate amount of money, with no additional penalty. Unsurprisingly, this arrangement meant that the very rich could commit murder uninhibited, as long as they could afford the fine. Over time, the laws changed and weregild was replaced by imprisonment or execution. Greer’s proposal is that—since a corporation is presumed to be a “legal person”—we could make similar changes in corporate law today. He describes it like this:

Imagine that a corporation—we’ll call it the Shyster Company—has just been caught deliberately selling worthless securities to widows and orphans. The district attorney files charges of felony fraud and theft in state court. The trial date arrives, the lawyers bicker, the jury finds the defendant guilty as charged, and the judge sentences the corporation to ten years in the slammer. In practice, what happens is that the judge appoints a trustee, who takes control of Shyster and all its assets. For the next ten years, Shyster is a wholly owned subsidiary of the state government. Its stock pays no dividends and has no voting rights, its directors have to find something else to do with their time, and if the trustee decides that the CEO and other overpaid office fauna get to find new jobs, they get to find new jobs—assuming that they’re not doing time themselves, as they very well could be. All profits earned by Shyster during its period of imprisonment go to the state government, subject to set-asides that pay restitution to the victims of the crime.

Meanwhile another conglomerate—we’ll call this one Dirty Rotten Scoundrel Inc.—has been caught knowingly selling food products tainted with deadly bacteria, and a dozen people have died. This time the district attorney files charges of aggravated first degree murder. The trial date arrives, the media has a field day, the lawyers bicker, the jury returns a verdict of guilty as charged, the judge sentences DRSI to death and the appeals court upholds the sentence. In practice, what happens is that on the scheduled date of execution, DRSI ceases to exist. Its stock becomes worthless, its assets are sold off in an auction in which no former shareholder is allowed to bid, its name and trademarks can never again be used by anybody under penalty of law, and its creditors get whatever scraps are left once the victims’ families receive their settlements.

OK, I guess it’s an entertaining story, but where is the systems thinking?

Fair question: Greer explains that next. 

It’s crucial that the stockholders in both cases, and the creditors in the latter case, suffer for the behavior of the corporation…. Thus under this system, if word gets out that a corporation is pushing the limits of legality, the stockholders have a very strong incentive to sell, driving down the value of the stock. Equally, if lenders become aware that a corporation is engaging in really egregious behavior, they have a very strong incentive to charge higher interest rates or even to stop loaning money to the corporation. Neither has any such incentive under the current system, which is one reason why corporations act as though their quarterly profit statements are the only things that matter. To their stockholders and creditors, this is essentially the case; this proposal would change that.

In other words, this proposal changes the incentives that a corporation faces by applying leverage to the corporation’s stock price and its access to liquidity. This kind of leverage might make a difference.****

Would this help?

Of course I can’t know for sure whether laws like this would encourage Boeing to handle its Quality culture more conscientiously. In the short run, the chain of causality is probably too long to have an immediate effect. 

On the other hand, if one of these penalties ever were to be invoked, it would likely mean a wholesale change of the company’s top management. And if the management understood that risk today, they might be more willing to take the Quality culture seriously. As Samuel Johnson once remarked, “When a man knows he is to be hanged in a fortnight, it concentrates his mind wonderfully.”

Meanwhile if you have other proposals that take adequate account of the systems incentives which drive Boeing’s management, I’d love to hear them. Please leave a comment.        

_____

* (New York: PublicAffairs, Hachette Book Group, 2011, 2022). 

** See especially Chapter 6.

*** Quotations are all from John Michael Greer, The Wealth of Nature: Economics as if Survival Mattered, 2nd ed. (Founders House Publishing LLC, 2021), pp. 213-215. An earlier draft of the same proposal can be found in an archived blogpost here, dating from January, 2010.

**** Greer says more about the legal and political aspects of his proposal in the sources cited above.

 

Does my test car have to be safe?

Last week I got a call from a friend and former colleague, who wanted to talk about stage gates. (You remember I've discussed them before here and here.) Specifically, he wanted my perspective on the question, "When do all the formal requirements have to be incorporated into a product? Can you wait till you release it, or do they have to be there before you start testing?"

Phrased like that the question sounds pretty innocuous, and also simple: It depends. Naturally all the requirements should be in place before you release the product, because otherwise you're not really done. And you'd like everything to be ready before you start testing, so that you can test it all together to make sure it works. If one feature isn't ready when you start testing, you can't test that feature; then when you finally get to it, there's always a risk you'll find a problem which impacts something else you thought was already buttoned-up. At the same time there are plenty of projects where this or that feature isn't quite ready when testing begins, and the project makes a conscious decision to proceed at risk. As I say, it depends.

Then as we talked some more, I began to understand that my friend had a real-life example in mind, one which made the discussion a little more pointed.

Last October, a GM Cruise self-driving taxi struck and dragged a pedestrian 20 feet.* This accident was only the latest of several last year, some of which got significant attention in the news.** After the October accident, the National Highway Traffic Safety Administration began an investigation; the State of California suspended Cruise's permission to operate autonomous vehicles; and Cruise recalled its entire fleet for reprogramming. Cruise's interaction with regulators appears to have been remarkably clumsy; while Cruise says they had no intention to mislead either the regulators or the public about what happened, apparently their first communications did exactly that. Since then Cruise has fired nine executives and let go a quarter of its staff. The CEO and one co-founder both resigned, and Cruise published a blog post blaming its corporate culture.*** 

So my friend's real question was something like, "What precautions do you have to take before you let an autonomous vehicle out on the public roads? Let's say you are still in the test phase; can you legitimately skip some of the safety features because your car is 'not released yet'? And if so, what stops you from ending up like Cruise?"

It's a good question, because it calls attention to the difference between formal requirements and pragmatic requirements. Often we think of formal requirements as more numerous than pragmatic ones: pragmatically, a hammer should drive nails; formally, there's an entire ISO standard of technical specifications for steel hammer heads. (That's ISO 15601:2000, in case you wondered.) But in a pre-release situation, sometimes the distinction reverses. Depending on how your Quality Management System is written, many product requirements might not be formally mandatory before release. But you may need them for pragmatic reasons, all the same. 

To be clear, Cruise's vehicles had been fully released, because Cruise was operating a business and collecting fees. But there are plenty of other companies making autonomous vehicles, or wanting to make them. So my friend wasn't asking "What did Cruise do wrong?"—though it would be fascinating to dive into that question, if we had the data—but rather, "If Whizzbang Motors decides to build an autonomous car tomorrow, what's to stop one of their test drives from ending just as badly as this well-publicized accident?"

So I started at the beginning. Quality means getting what you want. And obviously you don't want to hurt people. So Quality means making sure that you don't. For a released product, especially in the automotive market, that means complying with a long list of federal regulations; and that, in turn, means proving that you comply with them by providing objective evidence like documented test results. For an unreleased product, you may not have all of that documentation yet. But you still have to avoid hurting people, and that means you have to figure out what it is going to take.

The earliest tests, when you are first developing a new car, can probably be carried out in a laboratory. After that, you move to a test track, or proving grounds. These are environments that simulate real driving conditions, but without the innocent bystanders. The only people on the test track (at any rate during a test) should be people attached to the development project, who know what the vehicle is capable of and where the errors or problems are likely to be. Even so, sometimes test drivers die in accidents. The only consolation is that nobody takes a job as test driver without knowing the risks ahead of time.

And when the day comes that you finally have to test on the public roads? Doubtless there will be public, legal requirements that you have to meet before you can put your car on the roads, even if it's not released yet. But beyond those legal requirements, you have pragmatic and moral requirements to have done everything in your power ahead of time to make sure the car is safe. Some people will insist that "Nothing can be made 100% safe," and in a literal sense they are right. But that is never an excuse for doing any less than you possibly can.

When it comes to the safety of any pre-release product, your first thought should never be "What do the rules make me do?" Ask yourself instead, "How do I avoid hurting people?" 

__________

* See, for example, either of the following articles: 

• GM Cruise robotaxi unit faces US probes over dragging incident, vows reforms | Reuters
• GM’s Cruise reveals dual US probes into grisly collision and company’s response | Self-driving cars | The Guardian.  

** See for example this accident in April 2023, or this one in August. In all of 2023, Cruise vehicles were involved in 23 crashes, out of a fleet which numbered at least 950 at the time of the October accident. 

*** Wow, where have we heard that before? 😀       

                

Much ado about nothing?

I keep thinking that I'm done writing about Boeing. Is there really more that needs to be said at this point? And aren't there other Quality topics out there? But it's like Michael Corleone says: "Just when I thought I was out, they pulled me back in."

This time the trigger was a reader who sent me a recent article about the rash of airline safety incidents that have been making the news this spring. The article, by Kelsey Piper, appeared in Vox under the title "Are there really more things going wrong on airplanes?" Piper argues that, while the reporting of airline safety incidents is way up this spring, the actual numbers are consistent with last year, and the years before that. She summarizes the last 15 years of US commercial aviation as having "a safety record of about one or two passenger fatalities per light-year traveled."

Piper doesn't quite say it in so many words, and at the end of the article she does hint briefly that there might be a story behind the scenes. But as soon as she frames her statistics in terms of "fatalities per light-year traveled," the message to the casual reader is certainly that all this focus on airline safety is much ado about nothing. 

I always look forward to conversation with my readers, but in this case I think my reply must have been a little too abbreviated or dismissive. In any event my reader doubled down, suggesting that I look up several years of statistics from the National Transportation Safety Board (NTSB) so that I could determine independently whether we are seeing more problems with new Boeing aircraft than we saw in the past, even if the increase is being drowned out by other statistical noise.

As an aside, it's nice to know my readers have such confidence in me. But I'm not going to do that, because it is the wrong question and it hides the right one. The real story is about the changes Boeing has made in their safety management system, and about the failures of their configuration and documentation systems. These stories are critical, because they are the root causes of failures that may not even have happened yet. By contrast, counting up how many planes have lost tires while landing, or how many harmless engine fires have broken out, is a distraction. And it misses the point.

The critical fact that distinguishes these two topics is that it is perfectly possible to make a safe airplane with no Quality system (or Safety system) whatsoever! Therefore a story about Boeing hobbling their Quality system is in principle a different story from one about their current safety statistics.

Let me explain. Of course it's not likely that a team could make a safe aircraft without suitable systems in place. But if it just so happened that by random chance the team did all the right things to make the airplane safe … well then, it would be safe. The odds are against it, to be sure, but it's not impossible.

More realistically, when Boeing management removed this or that inspection step, doing so did not automatically mean that every single plane built under the new regimen was henceforth—let's say—3% less safe. The employees still remembered how to do their work, and nobody ever shows up to work wanting to do a bad job. Yes, human fallibility is always a factor, but there is no formula that rigidly connects the exact number of Quality steps in a procedure with the safety rating of the output product.

You remember that last week we talked about how Boeing management decided that Quality was "non-value-adding" overhead? This is part of why they thought that! They found, empirically, that they could eliminate one Quality inspection, save a few dollars, and no planes fell out of the sky. OK, good. How about eliminating two inspections? Three? Four? Where do we stop? You can see how, in the absence of visible negative feedback (like an increased accident rate), this could get out of hand quickly.

But wait. If that's true, why do we bother with Safety and Quality systems at all? If you can build a safe and reliable airplane without such a system, why were the Boeing executives wrong to eliminate all those extra costs?

Here's the thing: Yes, you can (in principle) build a safe aircraft without a formal Safety system. But you can't know that it is safe! What you buy with all the extra expenditures on Safety and Quality is certainty. And, of course, in order to get that certainty you implement a lot of inspections which then find problems … so the problems can be fixed before the plane is put into service. This improves the plane's safety even farther, which is all to the good.

So when Boeing pulled back their Quality system, what they did was to make their planes less certain, not less safe. This or that specific aircraft might be perfectly airworthy—who knows? To bring this discussion back to Piper's article, it is tempting to answer the question by looking at statistics: "Well, the failure rate in new planes is pretty low, so I'll take my chances." The problem with this answer is that it assumes that all planes of the same model are pretty much alike, except for the normal statistical fluctuations of the manufacturing process. But how can you know that? The presumption that all planes of the same model are pretty much alike is just one more kind of certainty. With fewer inspection steps there is less certainty, so you can't even know that the new planes are the same as the old ones. And therefore, like the ads for investment products always say, "Past performance is no guarantee of future results."

We can all be grateful that the accident rate for commercial aircraft is so very, very low. But to have confidence … or certainty … that it will stay low, we need aircraft manufacturers to rely on robust Quality and Safety systems. That's why the story that matters is about those systems, and the statistics are a tempting distraction. 

               

A podcast on Boeing!

This week I had another chance to sit down with Kyle Chambers of Texas Quality Assurance, this time to talk about Boeing. Like me, Kyle has had a series of episodes dealing with Boeing's troubles in the last year, and he always brings a refreshing and very practical energy to all Quality topics. I start off talking about the FAA report that I discussed here last week; but in the course of the discussion we also cover why Boeing should hire TQA to revamp their training programs, and how to make safety classes matter to people who don't want to be there.

Please join us!

You can find the podcast version here: #QualityMatters episode 175.

Or there's a version on YouTube that also includes video, which you can find here:

Leave me a comment to let me know your thoughts! 

          

What did the FAA find?

It's all very well to sit snugly behind a keyboard and criticize Boeing's safety culture (as I have done in a number of posts this spring, for example here and here). But how much of this is just talk, and how much is based on hard data? Has anyone done the hard work to sit down with Boeing and study their culture in detail? Maybe an exercise like that could tell us something useful.

In fact, a special Expert Panel completed just such a study last month. These experts were appointed by the Federal Aviation Administration (FAA) and began to meet a year ago, at the beginning of March, 2023. They wrapped up their investigation in February 2024 after spending a full year on it. The team reviewed 7 surveys and more than 100 policies and procedures, comprising over 4000 pages. They interviewed more than 250 people across 6 locations. In the end they issued 27 findings and 53 recommendations. You can find the full report online here, and the New York Times has an article about it here. 

The report is devastating. 

More exactly, it's written in the bland bureaucratic language that is mandatory for reports like this. There are no bold headlines screaming "J'Accuse!" But I have been auditing since 1996, and I cannot remember ever reading—much less writing!—a report about a fully functioning organization* that painted in such broad strokes a picture of a management system floating so loose from its moorings.

Background and summary

The Expert Panel was formed in accordance with the provisions of the 2020 Aircraft Certification, Safety, and Accountability Act (ACSAA), Pub. L. 116-260, Div. V, § 103, which requires review of organizations that hold an Organization Designation Authorization (ODA) from the FAA. An ODA is the arrangement by which the FAA delegates certain Boeing employees to inspect Boeing's own work, on behalf of the FAA, so that the FAA does not have to assign their own people. The idea seems to be at least in part that there are a lot of inspections which are mandated by airworthiness regulations, and if all of them had to be carried out by FAA personnel then the FAA's staff and budget would have to be significantly increased. 

If you think it sounds crazy to ask a company to inspect its own work when there are serious safety risks at stake, … well, you can look up the text of the 2005 rule (70 FR 59932) establishing ODAs in the Federal Register; the "Background" section of that document explains how the idea grew incrementally over time as a way to cut down the long delays caused by airworthiness inspections. But the FAA still retains oversight of the whole process—naturally, right?—which is why the 2020 law referenced above requires all ODA holders explicitly "to adopt safety management systems (SMS) consistent with international standards and practices," and also directs the FAA "to review The Boeing Company’s ODA, safety culture, and capability to perform FAA-delegated functions." (Reference.)    

When the Expert Panel issued their report, they summarized their findings under four general headings:

• Boeing's safety culture, where they found a "disconnect" between what they heard from senior management and what they heard from the rank and file;
• Boeing's SMS, which was structured to reflect all the applicable standards perfectly but which appeared to have been glued on top of the organization with library paste;
• Boeing's ODA management structure, which the Panel conceded had been recently reorganized to make it harder for the company to retaliate against an employee finding violations while acting in the name of the FAA (but "harder" still doesn't mean "impossible");
• Other topics.

In the remainder of this post I will highlight and discuss some of the specific findings and other observations. (Sometimes I will indent my comments in blue, when I think it helps to distinguish my remarks from those of the Panel.)

Boeing's safety culture

The basic observation here is that Boeing has defined and rolled out a formal, written safety culture, but most employees don't really understand it. (Sec. 3.3) Concretely:

• Many employees, when interviewed, didn't know about "Boeing's enterprise-wide safety culture efforts, nor its purpose and procedures." (Sec. 4.1, #1)
• Even employees who knew the terminology of the safety culture couldn't use it in a sentence. (Sec. 4.1, #2)
• Some Boeing sites have good, "confidential, non-punitive reporting systems" in place—but not all of them. (Sec. 4.1, #3)
• Managers can investigate reports in their own reporting chain, which means they risk not being impartial. (Sec. 4.1, #4)
• Employees don't know which reporting system to use for safety problems. Employees don't really trust any of the reporting systems, and prefer to report safety problems to their bosses. Employees especially don't trust the anonymity of the "preferred system." Employees do not (reliably) get informed of the outcome when they do report through these systems. (Sec. 4.1, #5)
• My comment: When you first hear it, "reporting safety problems to your manager" doesn't sound like a bad idea. (Although naturally people who report problems should still hear back how they were dispositioned, or they'll start to think that reporting is a waste of time.) The reason that "reporting safety problems to your manager" can become a problem is that ….
• When employees report safety problems to their managers, it's often done verbally. So there is no way to know if any particular problem ever made it into the reporting system. And if a problem didn't get into the system, there's no way to track whether it was ever analyzed or fixed. (Sec. 4.1, #6) 

Boeing's SMS

Grigory Potemkin,
architect of the system?

The Panel makes a number of high-level observations about Boeing's SMS, before diving into the details. Among these observations are the following:

• All the SMS documents are new, and there is no traceability to the changes from what came before. (Sec. 3.4, para. 4)
• Most of the SMS documents cover general conduct and do not translate to the concrete working level. (Sec. 3.4, para. 5)
• Many employees don't really understand the elements of the SMS, or else they think it is a management fad that won't stick around. (Sec. 3.4, para. 10) 
• Many employees point out that Boeing already had a detailed safety system before the SMS was implemented—so why do we need this new one now? (In fact the old system is still referenced in many procedure documents.) (Sec. 3.4, para. 11)
• Boeing requires employees to take safety training classes, but doesn't test whether they learned anything. (Sec. 3.4, para. 13)

In other words, the Panel says that Boeing's shiny new SMS—which complies perfectly with all the relevant requirements and standards—is a Potemkin system. 

After those general observations, the specific findings might be an anticlimax, but here are a few of them:

• The complexity of the SMS documentation, and "the constant state of document changes," make it hard for employees to understand it. (Sec. 4.2, #10)
• Boeing uses an SMS dashboard to track safety goals, but employees (and some managers) don't understand what it is or how to use it. (Sec. 4.2, #12)
• There are different tracking systems for the SMS and for the legacy safety systems, and many people are confused by them. (Sec. 4.2, #12, cont'd.)
• Since Boeing has kept all the legacy safety systems in place, employees across the company don't trust that the new SMS will last long. (Sec. 4.2, #13)
• Boeing has procedures on how to evaluate safety-relevant decisions, but there's nothing to explain how to tell which business decisions count as safety-relevant. (Sec. 4.2, #14)

In other words, employees don't understand the SMS and they have no motivation to learn it.

Boeing's ODA management structure

The Panel's general observation about the ODA program is that it is getting harder to fill, because participating inspectors (called Unit Members, or UMs) are retiring faster than new ones are being brought onboard. (Sec. 3.5, paras. 4-6; sec. 4.3, #18)

But the detailed findings have to do mostly with the risk that UMs could fear retaliation for speaking out about problems:

• Boeing has not eliminated the possibility of retaliation when UMs raise safety concerns, and some UMs have experienced what looks like retaliation. Other UMs are not willing to help or step in, and their help is rejected as interference. (Sec. 4.3, #16)
• Boeing says they took steps to make sure the ODA program is working correctly, but cannot provide proof. (Sec. 4.3, #17)
• In which case, did they really do anything?
• Supposedly Boeing has changed the ODA organizational structure, but nobody knows how. Employees still report to their old managers. Procedures are still written around the old structure. (Sec. 4.3, #19) 

There are some other smaller findings as well.

Other topics

Of the findings classified as "Other matters," the two that concern me the most state (in different ways) that input from pilots is treated inconsistently: if it comes into Executive A, it is treated seriously and addressed; but if it comes into Executive B, it might get lost or forgotten. (Sec. 4.4, #23 and #24) Less alarming are some technical points about how to handle the relationship between Boeing and the FAA in the future.

But a couple of the other general observations are worth noting.

Right at the beginning, Boeing welcomed the Panel and made sure to say that they looked forward to open collaboration. But the Panel says that in fact, Boeing answered questions rather as if the evaluation were an audit or a deposition, and asked for no input of any kind. (Sec. 2.6, paras. 12-13; sec. 3.2, para. 1)

So I have to ask, Did Boeing expect to learn anything from this evaluation? Or was the intent simply to get through it as fast as possible, with as few findings as possible? Because clearly, if you approach the whole exercise in a defensive frame of mind, you leave open fewer chances to learn and improve from the experience. 

Also interesting: the Board of Directors emphasized that they use safety-related performance metrics "when determining both Annual Incentive Pay and Long-Term Incentives." These metrics include, for example, "the requirement for executives to complete Boeing's Safety Management System training." This statement was intended to demonstrate Boeing's commitment to safety. (Sec. 3.7, paras. 5, 9, and 12)

The problem is, I think it demonstrates the reverse. Safety metrics in the bonus program? No! On the contrary, safety should be more important than any bonus program! Ironically, when you pay people for something, you cheapen it. At that point people start weighing one part of the bonus against another: Let's see, if I'm willing to give up a few dollars on safety, we can sell a lot more planes and by the end of the year the difference will more than make up for what I lost. Dollarizing the safety program is irresponsible if not worse. Safety should be non-negotiable, and paying people for it makes it negotiable. (I discuss this point in more detail in this post here.)

On the other hand, I understand why the Board of Directors would take this approach. To the man with a hammer, every problem looks like a nail. And it does seem like, in the last couple of decades, money is the hammer that Boeing's management has learned how to use. 

It's a long report. But I think it explains why Boeing has gotten into its present straits. From my point of view, the fundamental problems are all around system implementation. Boeing tried to create a new system, but went for the quick-n-easy approach rather than making sure the new system was fully implemented and integrated at all levels in the organization. As a result, people don't know what to do! Even people who want to do the right thing—and I firmly believe that this includes nearly everyone, nearly all the time—don't know how to do the right thing so that errors get caught, followed up, and fixed … and so that they themselves don't get in trouble for finding those errors in the first place.

Too much system can be as much a problem as not enough system. There's a balance and it always has to be pragmatic. I may have said this once or twice before now. 

__________

* I have participated audits that were meant as gap analyses, for organizations that wanted ISO 9001 certification and knew they weren't ready yet; and the results of those were often far worse than this one. But it was no surprise because the organizations knew in advance they had a lot of work to do.