CAREFUL READING TEA LEAVES…AFTER A STORM IN THE CUP
Don’t
crucify dead and buried brave hearts
On 8 March 2014 a Boeing 777-200 ER went
missing less than an hour after take-off. 239 people on board were presumably
dead. Explanations and propositions ranging from the mundane to the bizarre
have been doing the rounds. With cockpit voice recorders, flight data
recorders, modelling and simulation and other IT aids accident investigation,
never simple, has now evolved into a fine science and yet in complex cases
there are discontinuities and fallibilities. Without the cockpit recorders
recovered, accident investigators are want to conclude any theory or apportion
any blame and wisely so.
The main
purpose of accident investigation is to identify causes and prevent recurrences
by improving design/correcting procedures/managing hazards, environments and
human fallibilities as the case maybe. To do so the emphasis is on finding ‘the’
cause(s) and not just any cause. Advancements in accident investigation methods
and maturing of investigative processes have proven the criticality of Data/Voice
Recorders, large data banks and super computers that can crunch data and build
possible scenarios for evaluation. Running scenarios and arriving at
conclusions with minimal or insufficient data is dishonest and risky, very
risky.
So while the
Nation, the Ministry, the Navy and the submariners may want or even demand an
explanation to the accident on board INS Sindhurakshak. The Navy needs to be
doubly cautious ‘reading the tea leaves’ left behind in the Sindhurakshak case
for multiple reasons-
Evidence
·
There are no
survivors to relate what happened inside the submarine. It is only known that
the crew was working on torpedoes in preparation for an operational deployment.
- Torpedo
preparation is a process that demands caution and care but is not a new or out
of ordinary task and is a well-oiled procedure. Particularly considering that
the boat’s crew had just passed a series of training and work up routines with
the work up authority.
·
The wreck of the
submarine was awash with the waters of Mumbai harbour for almost ten months.
The compartments which sustained maximum damage were open to sea and much of
the material evidence inside would either have got washed out or be thoroughly
contaminated.
- The
investigation itself is critically dependent on forensic analysis.
- Forensic analysis
is severely crippled due to the non-availability of reliable and uncontaminated
evidence to analyse.
·
Unlike in commercial
aircraft, the submarine had no voice recorders which can reveal conversations,
there were no data recorders which can reveal details of parameters at the time
of the accident.
- There is no
means of confirming the sequence of events leading to the explosion. All
analysis will have to be based on application of existing rational knowledge to
an extraordinary irrational event (like to trying to explain infinity with
finite tools).
Mitigating Crew Liability
·
The crew of
Sindhurakshak were handpicked based on their competence and experience to
operate the newly refurbished submarine. After ferrying the boat to India, the
crew were put through a mature and rigorous work up routine before being
cleared for operational roles.
- The work up
pays special emphasis on Standardisation of Operating Procedures, Drills and
emergency drills.
- The crew had
completed the work up just a few days before the accident and as such should be
considered to be at the peak of their operational preparedness.
·
The explosion(s)
was of such intensity that many parts of the submarine were damaged beyond
recognition. The speed of the explosion(s) was so high that some crew not
directly involved in the operation but resting in remote compartments had no
time to react and were incinerated wherever they were, resting in their bunks.
People at the scene itself would clearly not have had any reaction time
whatsoever.
- All hazardous procedures have emergency drills
and actions but can there be a procedure laid out for a catastrophic failure or
an explosion of the kind experienced?
- Can we really
hold crew responsible for failing to react to a catastrophic failure?
·
The explosion was
powerful enough to rip open a steel double hull and the temperatures inside the
boat were so high that metal doors and hatches had fused. Yet, inexplicably,
none of the warheads of the torpedoes seem to have exploded.
- Hints at
unlikelihood of mishandling of torpedoes.
Fallibility
of methods
The Swiss cheese theory of accident analysis suggests that accidents
result from an alignment of conditions and occurrences each of which is
necessary, but none alone sufficient. In that sense even serious accidents may
sometimes happen even though nothing failed as such. In unusual accidents we
need accident analysis methods that recognise that confluences occur and
provide a plausible explanation of why they using predictive accident
models. Performance variability management accepts the fact that accidents
cannot be explained in simplistic cause-effect terms, but that instead they
represent the outcome of complex interactions and coincidences which are due to
the normal performance variability of the system, rather than actual failures
of components or functions. Even in relatively simple systems new cases
continue to appear, despite the best efforts to the contrary. In complex cases
and complex systems efforts of accident analysis and cause finding are that
much more complicated and error prone. The most serious errors to which such
deductive processes are exposed are:-
Dangers of
learning backward from Inductive Knowledge
Bertrand Russell had famously pointed out in the
problem of inductive knowledge that there are traps built into any type of
knowledge gained from observation. This is best explained through an
illustration, this one is modified from Bertrand Russell’s original…
Consider a ‘Bakra’ (of the Bakra Eid fame) that is fed
every day. Every single day of feeding will firm the goat’s belief that it is
the general rule of life to be fed every day by friendly members of the human
race “looking out for its best interest”. On the afternoon of ‘Bakra id’
something unexpected will happen to
the ‘Bakra’, it will incur a revision of belief. Go a step further and consider
induction’s most worrisome aspect: learning backward. The bakra’s confidence
increased as the number of friendly feedings grew, and it felt increasingly
safe even though the slaughter was more and more imminent. Consider the feeling
of safety reached its maximum when the risk was at its highest! Something has
worked in the past, until-well, it unexpectedly no longer does, and what we
have learned from the past turns out to be at best irrelevant or, at worst
viciously misleading.
Standard Operating Procedures particularly those
dealing with hazardous processes are often reviewed and amended/altered
following accidents and incidents. So we must acknowledge that while SOPs are
based on extant understanding and are followed diligently they stand true only
until proven inadequate by an accident/incident. So also with material
failures.
Appetite for a
Narrative
Driven by an appetite for ‘causal determinism’ or
otherwise, humans by nature need explanations. Nassim Nicholas Taleb[1] calls this the
“narrative fallacy”. Stories help us summarise and simplify complex and
multi-dimensional matters i.e. to reduce the dimension of matters (Those who
watched Christopher Nolan’s Interstellar would probably relate readily). The
fallacy is associated with our vulnerability to over interpretation and our
predilection for compact stories over raw random truths. It is particularly
acute when it comes to the rare event. The narrative fallacy addresses our
limited ability to look at sequences of facts without weaving an explanation
into them, forcing a logical link, an arrow of relationship, upon them. The
more random the information is, the greater the dimensionality, and thus the
more difficult to summarize. The more you summarize, the more order you put in,
the less randomness. Hence the same condition that makes us simplify pushes us
to think that the world is less random than it actually is, and the Black Swan[2] is what we leave out
of simplification.
Our tendency to impose narrativity and causality are
symptoms of the same disease – dimension reduction. Moreover, like causality,
narrativity has a chronological dimension and leads to the perception of the
flow of time. Causality makes time flow in a single direction, and so does
narrativity. Where this propensity can go wrong is when it increases our
impression of understanding.
Perils of walking
back in Time, Reversing Non-linear processes
Many of us have seen Hollywood animate, ‘storify’ and
even glorify forensics to the level of infallibility. We see super sleuths
doing scene building using multiple screens which reflect data interpreted by
‘super’ computers. These computers in turn have probably crunched multiple data
inputs to (re)create various possibilities and the super sleuth then selects
the probable scenario based on his vast experience and an unfailing gut
instinct. Lo and behold the suspect confesses under the pressure of
interrogation coupled with forensic evidence…case closed. Unfortunately,
accident analysis is not so easy, more so when the case is unusual, a
statistical ‘outlier’, a Black Swan, a ‘Sindhurakshak’, with no data inputs and
virtually no forensic analysis.
Consider the following…
·
Put
an ice cube on your floor and consider how it may melt, try to envision the
resulting shape of the puddle. You will
have a few possibilities of shape, size etc.
·
Now
consider noticing a puddle of water on the floor. Now try and reconstruct in
your mind’s eye the shape of the ice cube it may have once been…now consider
further it may not have originated from an ice cube at all consider the number
of possibilities for the origin of the puddle on the floor.
The second operation is harder, much harder …The
difference in these two processes is that the first case can still be
scientifically predicted if you do some modelling. However, for the second case
there could be infinite possibilities, if in fact there was an ice cube at all.
The first case involves a forward ‘predictive’
process, the second case involves a process of reverse engineering history, a
process that is fraught with error. Mind
you the ice example was a relatively simple linear process…the complications
involved in a non-linear process get mind boggling. Sindhurakshak falls in this
category.
What
we learn will depend on what we want to learn
The Sindhurakshak accident has cost the
Indian Navy a lot- the invaluable lives of 18 brave professionals, complete
loss of one fully refurbished operational boat, resignation of a Chief of Naval
Staff and many, many intangibles.
That price having already been paid,
what the Navy learns from the Sindhurakshak accident is what will define the
final cost of the accident. What we learn will in turn depend on what we want to learn. It is therefore important
that we go beyond mere cause determination, particularly because of the
severely limiting circumstances viz. no eyewitness accounts, no recorders, no
forensic inputs owing to a severely contaminated site, the sequence being
non-linear etc.
Acknowledging that the purpose of cause
determination is prevention of recurrence it is understandable if the
investigation board adopts an approach where every possible contributor (say, ‘hazard’) whether procedural,
environmental, materiel or human is identified and graded and mitigating
measures recommended.
Our predisposition for ‘causal
determinism’ and the need for closure
makes us gullible and naïve such that every possible cause gets transformed
into a probable cause and hence
implying blame worthiness. It is here that the Navy faces the biggest
challenge. To be able to assure its submariners and convince the government and
in turn the people (read as Parliament and PQs) that it is acceptable or even
wise to move on having rendered procedures and equipment safe and without
apportioning blame. Pinning a blame on either the man or the materiel should be
backed by conclusive evidence, which in this case I am sure cannot be
found.
So as a people, we cannot and should not
fault the Navy or the officers of the BOI if they do not assign blame, rather
we should complement the board if they are honest enough to steer clear of
ascribing blame. We should, however, demand that the Navy set up a robust
organisation to oversee the safety of submarines, cosmetic rejigs of existing
organisations may not suffice. The existing organisation under the Inspector General
Nuclear Safety only looks at nuclear safety and does not cover the conventional
fleet of submarines. It may be well worth our while to take a leaf out of the
book of the Royal Australian Navy which despite operating only conventional
submarines has a comprehensive SUBSAFE programme, working since 1987 and has often
been recognised as one of the best safety programmes in Defence environmental
safety management. The USN of course has taken submarine safety to another
level, from the SUBSAFE programme that emanated from the accident on USS
Thresher in 1963, today they even have a NASA/Navy benchmarking exchange
programme which looks at strengthening individual safety systems in the Navy
and NASA by drawing from lessons learnt in each other’s domain.
In sum, is Sindhurakshak going to be our
‘Thresher’ which enables a comprehensive review of our safety systems and
organisation? Only time will tell. For starters we definitely shouldn’t blame
the crew.
Irrespective of the outcome of the
Sindhurakshak investigation, I must place on record that the submariners of the
Indian navy are a highly professional and respected lot. Not only have I
sparred with them in the oceans as the pilot of an ASW helicopter but have also
sparred with them in boxing rings and bars. An Indian Navy submariner will
never cringe to pay any price to fulfil his mission and yet I have not met men
as careful and calculating as my submariner friends so there are no foolish
risks taken. The fact that the Indian Navy’s submarine arm, born in 1967, has
had an otherwise impeccable safety record for over 47 years despite operating
old, really old boats stands testimony to their professionalism. INS Vagli, the last of the Foxtro class submarines operated by the Indian Navy completed her last dive safely at a grand old age of 36 years!
On this submariners day I salute every
submariner of the Indian Navy serving and veteran and I pay a special homage to
those who lost their lives on Sindhurakshak.
