DC Metro Crash July 2009

It is time to restore the pillory for technical malfeasance.

This was a mistake, Several mistakes, Egregious mistakes. And ,,, fatal mistakes.

1. In any control system of consequence, changes in state should be logged. The DC Metro system divided the routes into blocks and placed sensors in each block to detect the presence of a car. When 6 sensors were examined after the fact, 5 appeared to work and one failed.

Trains do not disappear. If one sensor records, say 40 trains a day and adjacent sensors record 45, something is wrong and speed should be reduced and control returned to the engineer. No train should be permitted to enter a suspect block.

This is not a programming error although any programmer involved should have had compassion for the people involved and should have complained loudly about the architecture of the system. Every programmer ever connected with the system should be pilloried for rush hours for a week. Instead of acting on their responsibility for the safety of the end users of their work, they cashed their paychecks and participated in a system that forbid trains to crash. That is, they accepted the system goal of collision prevention.

Not that avoiding collisions is not a worthy goal. Automobiles that could sense objects in their path and apply brakes would undoubtedly save lives. But consider a system that would take your foot off the gas when the highway segment in front of you is congested. Put another way, consider a system that permits you to drive when you are demonstrably sober vs. one that forbids you to drive when you are perceptibly impaired. In the first case you are inconvenienced when the system fails to detect you as sober but in the second case failure implies mortal peril.

The architects chose chose the paradigm, "what is not forbidden is permitted' and had the gall to call it "fail safe". Fail safe systems follow the rule, "what is not permitted is forbidden". I propose the pillory for a week.

But where were the system managers? We know where they are now - they are looking for someone to blame, scouring the cell phone records of the young engineer who lost her life in the accident. For them, I would move the pillory into the lead car. Maybe with a stock of rotten potatoes.