What US Airways Flight 1549’s ditching in the Hudson River teaches companies about how to create world-class user interface design solutions

When tasked with creating compelling and empowering user interfaces for new high technology products and services, companies can learn more from the struggling airline industry than from Google or even Apple. The fact is, there is scant reliable data available on how to actually create compelling user interface solutions that are based on demonstrated real-world solution excellence. For sure there have been hundreds of books written on the topic and as many seminars are sold each year. However, when one looks deeply at this literature there is almost nothing that is based on proven and repeatable conceptual frameworks drawn from commercial success. This is a major problem for companies that now have the need, desire and technology to create products and related interfaces with high levels of automation and massive feature sets. Where then can companies turn for reliable insights into the design of compelling and empowering user interfaces in the future? The answer is not what you might assume…one of the best places to look is the struggling commercial airline industry.

 Photo by Greg L. available under a Creative Commons Attribution Non-commercial license.

One might reasonably ask what does an A320 Airbus have to do with the design of products ranging from MP3 players to popular social networking websites? For example had MP3 player manufacturers applied even a small portion of the user interface design methods employed by the commercial aircraft companies iTunes would have been a non-starter and the music companies would be a happy bunch today. The more surprising point is that the best insights come not from how contemporary commercial aircraft fly, but how they crash.

No example in recent history is more helpful in this regard than the ditching of US Airways 1549 into the Hudson River on January 15th, 2009. Here is a condensed analysis of what this incident teaches all who strive to build compelling user interfaces for high technology products and services in the future. You will not find these insights combined in any currently available source on user interface design.

To set these leanings in context, below is a link to the audio recording of communications between US Airways Flight 1549 (using the call designation “Cactus 1549”), the New York TRACON flight controller, and the controller from Teterboro airport in New Jersey. The entire clip is about 3 min. in length. The tape picks up where Cactus 1549 reports a bird strike to the TRACON controller and continues until Cactus 1549 vanishes from his radar view. The brief conversations at the end of the tape are communications between the TRACON controller and several other planes in TRACON’s space a short time after Cactus 1549 vanished into the Hudson River. (Note: If you are really into this sort of thing, you will get the most from the audio if you listen to it 3 times; first for overall flow, second focusing on the pilot, and a final pass focusing on the TRACON controller.)

Listen to the cockpit conversation below:

While you listen to the audio follow the flight path on the diagram below. Note that the entire event string consumed only about 3 min on the time line. The bird strike takes place at about 3:27 on the chart below.

Photo by S.Bollman, available under a Creative Commons Attribution Non-commercial license.

User Interface design insights from Cactus 1549…why did everyone survive?

Insight 1: Design for automation, plan for user control
The push to automation in all forms of high technology development is inevitable. This thrust is wide-ranging from simple products like the iPod and extending to the A320 Airbus as it bobbed in the Hudson River. It is a fact that automation is at the center of all future user interface design problems and solutions. Some industries deal with this variable better than others. For example the history of the airline industry shows that no other commercial sector has undertaken such a massive and aggressive stance on the use of automation related to its technology. Over 2 decades ago the airlines, working in collaboration with the aircraft manufacturers launched an effort known essentially as the “Cockpit Automation Program”. That effort coincided with the development of a new generation of commercial aircraft. As with most major transitions in technology, the program was controversial from the start and produced a pitched battle between the Air Line Pilots Association (ALPA) and the airlines and manufacturers for control of cockpit flight systems (user interface) for planes of the future. On the one side were pilots rejecting nearly all additional automation and on the opposing side were airlines and aircraft manufacturers demanding nearly complete automation which they believed was necessary to achieve smaller crew sizes that would result in major operational cost reductions. In the end the ALPA gave up the third seat in nearly all commercial aircraft as functions previously spread across three professional pilots were reallocated to two pilots supported by new levels of aircrew automation. The pilots however retained control of some critical functions and most importantly the ability to take complete control from cockpit automation at anytime. Captain Sullenberger in Cactus 1549 made use of this allocation design to maintain control of the A320 during its entire descent into the Hudson River. He did so without being stuffed in the gap between automation and lower operating costs.

Think of this insight in another context. Had the A320 been designed by Facebook one can envision a large crater in Queens with a terse statement on the Facebook website reading “we have changed our flight policy…crashing is now allowed as part of our terms of use”. In the Facebook A320 Captain Sully would have spent the last 3 minutes of his life scanning pages of obscure text looking for the automation control check boxes. Clearly, a commercial aircraft has a different set of usability and user engagement objectives than a Social Networking website but in the end success is determined by applying the same concepts. It is a fact that you can design for 90% automation but realistically you will never achieve more than 60% automation. Therefore, it is more productive to design for automation but plan continually for giving the user control of the functions of the product when your clever software-based automation simply does not work properly or gives the user more complexity to deal with not less. This fact is just as valid on a Social Networking site as it is on the Airbus A320.

Insight 2: Simulate everything, build almost nothing

No industry has made better use of simulations during both development and user training than commercial airlines and the military. Today pilots undergo massive levels of required simulation training to make procedures routine and to experience the actual handling attributes of the planes they fly in sometimes dangerous and dysfunctional situations such as a “total loss of power” descent with a full fuel and passenger load. Professional pilots today can achieve up to 90% of their required training for a commercial license in flight simulations. There are those who believe that modern commercial aviation has been possible essentially through the use of flight simulations for training. Imagine if you will the amount of jet fuel saved based on simulator certification allowances. You are talking about millions of gallons of jet fuel a year. Both Captain Sully and Patrick Harten (the TRACON flight controller), and the tower controller at Teterboro ALL spent time in simulations. When one listens to the dialogue between these parties it is clear that their responses were essentially automatic. These automatic responses would have been impossible without being subjected to the system failure scenarios made possible by simulations. What does this have to do with the user interface design solutions for commercial and consumer products and services in the future?

Surprisingly this insight may be the most important lesson available. To be clear there are several relevant factors in using simulations to create compelling and empowering user interfaces for high technology products and services. The form we are discussing here is known as RS or Robust Simulations. These are simulations that are high fidelity interfaces created during development to allow users to exercise the user interface in ALL critical ways. They are also “robust” because they are created before a single line of actual code has been written. Their entire purpose is to simulate new user interfaces comprehensively BEFORE alpha, beta or launch. Why is this insight important for those who develop new user interfaces in the future? Well, ponder these numbers. This year software development expenditures will total about 270 billion dollars on a global basis. Less than 10 million will be spent on simulations before code is written. About 90% of all large software projects can be termed failures due to cost overruns, failure to deliver functions as specified or flat out user rejection due to dysfunctional user interface design. This is not an especially promising track record for the future even without the current economic crisis. Clearly something is broken here that indicates the need to plan before we build.

Today in the development of commercial aircraft, every aspect of the design is simulated including all flight systems and pilot control and automation configurations and interfaces. Years before the first prototype leaves the runway commercial aircraft manufacturers know exactly how the commercial aircraft will behave and more importantly how it will actually feel to the pilots as they interface with new hardware and software cockpit interface designs. Not every industry sector is so enlightened.

It is curious that no other industry has made less use of simulations than those corporations and startups that develop complex high technology products and services ranging from Social Networking websites to new high-tech consumer products. These companies routinely pound out a million lines of code before sitting a user in front of the system. This is old news. However the lesson in Cactus 1549 for all those who hope to develop successful high technology products and services is now a bit more refined. Here are some additional interesting numbers.

To develop a robust simulation of your product or service is 1/10 the cost of coding the same interface to early alpha level. If you have to make changes in beta or in early launch it is 100 times more costly than the same changes resulting from the simulation. The major benefit of simulation that Cactus 1549 teaches is that with the proper attention to detail simulated user experiences can be made virtually indistinguishable from the real experience. This allows you to simulate almost everything and build almost nothing except that which will objectively drive user adoption and profitability. It is a mystery why VCs routinely fund startups to create early production products based on real code when they could get vastly better return by requiring robust simulations and carefully structured user testing. In the context of how most user interfaces are designed today, let’s think of this whole idea of robust simulations in another way.

Had the A320 been designed by Facebook there would have been no simulation because Facebook flies all of its planes by pure automation. Such automation would have likely lead Cactus 1549 back to LaGuardia runway 1, which almost certainly would have produced a large crater in Queens a mile short of the runway. This would have been followed by another terse statement on the Facebook website reading: “To all our pilots flying the new Facebook A320: whether you like it or not we are turning on the automation, so suffer the consequences!”

Insight 3: The strength of your user’s mental model predicts product success.

This is a concept that is important and not well understood but one that the flight of 1549 teaches all those involved in development of high technology products and services. This concept is revealed in the analysis of  the TRACON controller, Patrick Harten, who plotted alternate landing options for Cactus 1549 at three area airports in less time than it takes most of us to check our email on a Blackberry Storm. When we speak about developing a mental model of a system what we mean is the user’s ability to create a robust mental picture and functional understanding of the system with which they are interacting. The design of all high technology user interfaces virtually determines the strength and clarity of the customer’s mental model. A well designed user interface helps users develop such mental models by DESIGN. Patrick Harten demonstrated an amazingly well developed mental model of his transition air space and 3 major NY area airports. This was present in his rapid suggestions of alternate airports but further included his recall of actual runway numbers, spatial orientations, and distances. Mr. Harten maintained a robust mental model of his operational environment. In the current leading theory in systems design this is known technically as “situation awareness” and was reflected in the operational profile of the pilot and the involved air traffic controllers. This unquestionably contributed to the successful end to a potentially tragic series of events. Designing a user interface to support and create situation awareness will be a fundamental requirement of all successful high technology user interfaces in the future.

Most new high technology products and services are based on user interface design concepts that have virtually no focus on supporting the development of the user’s or customer’s mental model of the system. Yet, this is the single most effective way to test a new system for usability and more importantly the best way to ensure commercial success. If, after appropriate exposure, your customers do not have a firmly established mental model of your new product or service they will never understand either its benefits or its functions. Such products cannot become successful. In the end all of the key players in the Cactus 1549 ditching had highly developed mental models of the systems they were interacting with, where they were, and what actions could and should be taken to produce a productive outcome. Very few new high technology products offer customers interfaces that build such robust mental models or support such decision making performance. Cactus 1549 teaches this important lesson and it is not a trivial learning.

Photo by jkrums, posted on Twitter.

The big lesson

It has been said that we learn more from our failures than from our successes. While Flight 1549 is formally classified by the FAA as a crash it was none the less an amazing example of how an industry (even one crippled by mismanagement) employed development methods that led to the development of a truly world-altering technology, the commercially viable, mass produced, commercial airliner. Possibly the big lesson from 1549 for all who aspire to creating world-altering technology is that by employing automation, simulation and cognitive modeling it is possible to fly 10 billion miles a year without an incident. Even more important may be that, when your time comes (and it will) a soft glide to the Hudson where everyone survives and your corporate brand value skyrockets is a solution worth simulating and ultimately designing for.

Charles L Mauro CHFP


Additional observations of interest from Flight 1549 incident.

Captain Sully: What made him extraordinary in this situation? Captain Sully had 20 + years of commercial airline experience and previously flew fighter aircraft in the military, but his most interesting and relevant background may have been his sailplane experience. Did this contribute to his situation awareness and flight domain knowledge as the A320 descended in unpowered flight? Did his final flare out and use of ground effect upon landing result in a vastly more reliable final water landing? Almost certainly this played a role as can be seen in the images of the final water landing taken from a security camera in New Jersey. Was Captain Sully experiencing extreme stress?…almost certainly. How do we know? He failed to activate the “Ditch Switch” once in the water which is designed to close water inlet valves and reduce flooding of the aircraft. This oversight led to more rapid flooding of the aircraft once in the water. This was a classic omission error correlated with high stress. Did he deserve the keys to New York presented to him by Mayor Bloomberg?…without question.

Patrick Harten: how “situation aware” was he really?Was Patrick Harten experiencing high levels of stress during the 3 minutes of the event? Without question he was. How do we know? If you listen carefully to the audio tape you will hear Mr. Harten misstate the actual flight number of Cactus 1549 as 1529 multiple times. This form of error is known as a “commission error” and is understood to be a predictor in most cases of excessive cognitive workload and stress. How “situation aware” was he really? The audio file shows he was extraordinarily “situation-aware”…almost hyper-aware. This is demonstrated by his maintaining control of the emergency flow as well as communications with at least 6 other planes in his direct airspace during the actual crash sequence and by his attending to the location and heading of these other aircraft within seconds of losing Cactus 1549 from radar view. Mr. Harten’s hyper-awareness can likely be attributed to his unique experience as a TRACON controller. His father held the same position at TRACON 30 years prior and young Harten would often come with him to work. The 5 year old was even occasionally allowed to guide planes to turn left or right. From a young  age Mr. Harten has been building awareness of the area he covers as a TRACON controller and on Jan. 15th, he was at the absolute top of his game.

Subscribe to email updates


  1. An interesting post. It would appear that the situation awareness of any number of systems in the world have been tested recently. Katrina, Wall Street, flu epidemics….

  2. When lives are at stake, this type and level of prototyping is not limited solely to the commercial aircraft industry. The military, particularly the combat arms, routinely train and practice tactics and techniques over and over, with the hope that they will never have to use them. They will rehearse particular operations as many times as possible, even if just as walkthroughs, before conducting actual missions. This is akin to prototyping.

    Generally speaking, no one dies when Word chokes on your document, or Facebook hiccups, or the like. So obtuse user interaction design can persist, it seems…

  3. James: Thanks for the response. The point of the post is to suggest that more robust methods can result in better interfaces at all levels. However, you point is well taken.

  4. Milan: Point well taken. Thanks for the link. The transcript is actually very helpful when conducting a formal content analysis. For example the flight number errors are easy to detect but the pace of the communications and framing is lost. Thanks for the link….CM.

  5. First of all great article. I have to know, how do you know about me going to work with my dad as a young kid? I don’t remember saying that in front of the media.

  6. Patrick: thanks for the post. I am not totally sure of the exact reference discussing you going to work with your father, but I can assure you that somewhere in the mass of data related to your management of that event there was a comment. If it is important we are happy to search our references and find it for you. BTW: I hope you received a promotion. Great job.

Post a Comment

Your email address will not be published. Required fields are marked *