The Destroyer’s Helm
Chapter 22: Returning to the Bridge of the McCain
Dear Friends,
Thanks for taking this journey with me as I’ve released my book one chapter at a time through Substack. There are only a few weeks left until User Zero can be read online completely for free. If you’ve been enjoying it and would like a physical copy, I’d be honored to exist on your bookshelf. No pressure, but copies are available on Amazon. And if you already own User Zero, maybe you’d like my first book, Art of the Living Dead, too. Stay creative.
Your friend,
Ade
“Give man the right environment and he will behave favorably.” —Buckminster Fuller
We are about to climb aboard the John S McCain Navy destroyer, to the ship’s bridge in the moments before it was ripped open by a Liberian tanker. Armed with the lessons of User Zero will you be able to save the ship?
At the beginning of this book I hinted at an alternate reality hiding in plain sight within the McCain story. Until now, the version most people have heard revolves around lack of training and failure of leadership. The accepted narrative is that the McCain crashed because of incompetence. That’s an easy excuse, but what really happened?
Let’s search for the story hidden in the negative space. Now it is time to feel for the seams of reality’s curtain, pull on the edges, and step into the illumination. A Navy destroyer is a tool, a man-made technology that we can evaluate just like the bananas or hammers in chapter six, so let’s try to understand how a Navy destroyer works.
First things first, let me give you a crash course (pun intended) in ship navigation. Controlling a boat, like any vehicle, is achieved by managing speed and direction. Usually the speed of a boat comes from a propellor while a rudder changes the direction.
Things are a bit more complicated when you are maneuvering a Navy destroyer. First, let’s study the steering. If you were hoping the McCain had a large wooden steering wheel like on a pirate ship, I’m sorry to disappoint you. While there is a small wheel at one of the ship’s four control stations, that is only one of the ways to turn the ship. The second way is to adjust the speeds of the destroyer’s two propellors. If the right propellor spins faster than the left, the boat will turn left. If the left propellor spins faster than the right, the boat turns right.
Speed controls aren’t what you would expect on a destroyer either. On most ships, speed is controlled by a forward/backward joystick. Push it forward and the propellor spins faster, causing the ship to accelerate. Pull it back and the boat slows or goes in reverse. In the months prior to the McCain’s collision, the forward/backward manual controls were replaced by digital touchscreens. The muscle memory, the visceral feedback of a physical lever was eliminated by pixels on glass.
Already your new user zero super senses are probably tingling. You have noticed that neither the speed or the direction of the McCain map cleanly to existing mental models. Perhaps you are remembering the lesson of Anton Yelchin and the confusion surrounding the monostable shifter that caused him to be crushed to death. Maybe you are recalling the fate of the Boeing 737 Max pilots who battled with autopilot all the way to the ground. Your mind may be jumping to questions about analog illusions, affordances, opacity, muscle memory, and user interface design. Congratulations, you are reaching into your mental toolbox for tools that most people lack.
There were at least 14 crew members on the bridge at the time of the accident. The bridge contained at least nine screens displaying information about the ship’s situation. It is hard to believe, but despite all these people and all this data, nobody could figure out who was steering the ship. How could so many people be fooled at the same time?
To answer that question we need to study the bridge layout. The highest ranking officers have seats at the front corners. There are two control stations in the front and two additional stations behind them. Touchscreen controls provide a feature unavailable to older ships constrained by physical levers, knobs, and buttons. Because the controls are digital anyone at any of the McCain’s four stations could take control at any moment.
To avoid a situation where five people are adjusting steering at the same time, procedures exist to transfer controls from station to station. Steering control can be requested by a station or it can be assigned to a station. In either case, the transfer has to be accepted by the other station. This little two-step dance ensures that you don’t send control to an unmanned station or that you don’t receive control of the steering unknowingly. In the case of emergency, there is a big red button that you can press to bypass everything and force everything into manual mode. More on that later.
Steering confusion can arise when a sailor is controlling the ship but doesn’t realize it. Imagine that you are starting your shift. To maintain a straight trajectory, the previous sailor may have set the rudder five degrees starboard in order to compensate for wind or water current. By design, when the steering controls are passed to your station, your defaults are applied and the rudder is set to zero degrees. From your perspective the boat should continue heading straight, but instead it starts turning left. This causes an illusion of loss of control. Confused, you ask the other sailors if they are steering the ship. The crew responds that no, nobody has adjusted the steering. This triggers a series of transfers from station to station as each sailor tries to confirm whether or not they have control.
In the minutes prior to the collision, steering on the McCain was transferred four times. Below is the timeline showing how in three minutes the ship’s trajectory got worse instead of better with each adjustment the crew made.
Above you can see the user interface that allows the transfer of steering between stations. As you study this control panel, any confidence that you could have saved the McCain is probably dwindling. How do you interpret this interface? It is unclear whether the transfer of steering control is achieved by the field at the top (is that supposed to be a dropdown menu?) or the options at the bottom (are those diamonds checkboxes or radio buttons or something else)? Does white or black text indicate the steering location is selected? It appears that multiple steering locations are active (white) which probably isn’t possible.
It is hard to even comment on the controls in the center because they are so cryptic and confusing. Perhaps this is describing the conditions of the right/left propellors. Even assuming the acronyms and terminology is understood by a sailor it is unclear what would happen when the buttons are tapped. If I tap “engage” does an action occur instantly or do I have to tap “Accept” below first? Why is the close button the primary option?
The three buttons at the bottom are unnecessarily confusing. What is the difference between cancel and close? Does the accept button apply the settings I have just changed, or am I accepting settings that someone else has transferred to my station?
It is also important to note that this screen introduces a new concept that we haven’t discussed yet. Notice the second menu where a “steering mode” can be chosen. There are five modes that offer varying degrees of computer assistance from autopilot down to backup manual mode. Not every station can support every mode. Confusion is inevitable because when you receive control at your station you need to understand what level of computer-assistance you are also inheriting along with the transfer.
Despite being recommended only for emergencies, commanders say they are more comfortable in backup manual mode. As a result computer assistance is often turned off completely, as was the case on the McCain. A dangerous side-effect of operating in backup manual mode is that it turns off the two-step process where control of the ship must be requested and accepted by both stations. Put more simply, in manual mode anyone can receive control of the ship at any moment without warning. Like a game of hot potato, steering controls get tossed around blindly.
As the sailors were trying to figure out who was steering the ship, the real reason the ship was turning was under their noses. The speed of the propellors was mismatched. How could they miss this? The image below is what the digital controls for the McCain’s throttle looks like. Like adjusting the volume on your computer speakers, the vertical sliders allows the user to drag the throttle up and down to increase or decrease speed. Sitting below these controls is a critical checkbox.
The label next to the checkbox says “Gang.” This is the term used to describe when the controls for the right and left propellors are connected. When this box is checked, the right and left sliders move together. When unchecked, you can move either slider without affecting the other. Perhaps “gang” is the wrong word to describe this locking function, but let’s give the Navy the benefit of the doubt that sailors are familiar with this term.
The moment this box became unchecked confusion began to spread through the bridge. The crew believed they had lost control of the ship because they were relying on the main steering controls, the rudder, without realizing that the ship was turning because of the secondary steering method, propellors set at different speeds.
Similar to the transfer of steering to different stations, the thrust of the boat could likewise be passed around. The transfer of thrust comes with an additional level of complexity because the propellors must be transferred one at a time. Half way through a transfer the boat is in a situation where one propellor is controlled by one station and the other is controlled by someone else. At this moment the checkbox labeled “Gang” is automatically unchecked. It wasn’t a human who mistakenly unchecked a box, it was designed to work this way.
It is unclear how the screens appeared in this state, when the thrust controls are spread across two screens. Did half the controls become disabled? Did the gang checkbox disappear? If the checkbox was visible could you tap it? If you could tap on it, would the other station have to approve your request to take full control? This is a moment when good design could have rescued the ship. Blindly adding a checkbox to a screen may meet technical requirements, but without a human-centered design approach, the nuances of life-or-death decisions are unlikely to be addressed when the interface is being built.
The photo above is not from the McCain, but it does give some clues to how confusion about which station has control could arise. In this picture we can see that the “Lee Helm” is in control of both thrust sliders. The screen on the station to the right appears to display the same information, a mirror of the first screen. If you don’t know or forget which station is the Lee Helm (and the stations don’t appear to be labeled) it is impossible to know which station has control.
As mentioned earlier, there is also a big red button in the center of the rear control stations. While it is technically called the “Emergency Override To Manual Button” crew members call it the “big red button.” I find it noteworthy that in the midst of so much nautical jargon, sailors occasionally speak like humans. The irony of this button is that it forces the ship into manual mode, the same mode that the ship was already operating under. So it should come as no surprise that even though everyone on the bridge knew there was an emergency, there was no operational benefit to hitting the big red button. Presumably, the big red button might initiate additional emergency functions, perhaps sending a radio message to nearby ships that the boat was in distress, but my research has not verified this assumption. The big red button might as well have been for decoration. Like the instructions on a vandalized hand dryer, the big red button is intentionally blank.
Confusion around steering eventually caused somebody to give a command to reduce speed. Because the throttle controls were still unganged (and probably spread across two stations) the speed was only reduced on one engine. This caused the ship to turn even more sharply. Confusion turned to panic as the boat seems to slip further out of control.
What about the physical steering wheel? If touchscreens are so bad, why not just transfer control to the wheel? This strategy also backfired. Just like in your car, to confirm that your steering wheel is working, you turn the wheel right and left. This was attempted by the sailors as they tested the only physical steering wheel at the rear station. This proved that the wheel wasn’t active, but it unfortunately left the wheel in a turned position. In the final seconds when control was passed to this manual wheel it turned the ship in the opposite direction from where they wanted to go.
After three minutes of confusion, the throttle was finally unganged and steering was recovered. Unfortunately the crew didn’t have enough time to maneuver out of the way of the oncoming ship. In addition to the loss of life, repairs to the McCain were estimated at $100 million dollars, a price tag that ballooned to $223 million after additional damage was caused during transit to the repair facility.
As tragic as these design flaws are, they are fixable. They can be identified, tested, and corrected. One of the strengths of touchscreens is that the interface can be improved without any hardware replacements. A software update can change the interface instantly. Unfortunately, that is not what happened next. In the years following the McCain accident, the Navy has done everything except address the real source of the collision. In the next chapter we will try to apply user zero thinking to try to solve this second mystery.