Boeing — Future Flight Deck
The origin of a design philosophy. Automation is the easy part. Designing for the moment it fails — that's the hard problem.
This project taught me the design principle that has guided everything since. We built a cardboard flight deck at full scale, hired pilots to walk through emergency scenarios, and stop-motion tested a right engine fire event. When the simulated failure hit, we watched what happened to the pilot's attention — where it went, what it missed, and how quickly a confident expert could become cognitively overwhelmed by competing signals.
The lesson wasn't about automation. It was about what happens when automation reaches its boundary. The system had been designed to handle routine operations with extraordinary precision. Nobody had fully designed for the moment it handed back control.
The Design Problem
Modern flight decks are marvels of automation. The question we were asked to explore at the UW Flight Deck Concept Center, in collaboration with Boeing, was deceptively simple: what should the next generation of human-machine interface look like?
The answer, it turned out, was less about the interface and more about the decision architecture underneath it. When systems fail — and they will fail — the human pilot needs to rapidly reconstruct a mental model of what the aircraft is doing, what it knows, and what it doesn't know. That reconstruction is a design problem, not a training problem.
Methodology
We worked directly with commercial pilots, brought them into our physical mockup environment at the Boeing Flight Deck Concept Center, and ran structured scenario walkthroughs. The cardboard prototype wasn't a shortcut — it was a deliberate choice. We needed pilots to interact with the space physically, to reach, to scan, to feel where things were without looking.
The stop-motion method was our own invention. Rather than asking pilots to describe what they'd do in an emergency, we gave them a physical sequence to work through, frame by frame, and annotated where cognitive load peaked.
Key Insight
The finding that shaped everything that followed: conflicting signals are more dangerous than missing information. When the system gives a pilot two contradictory readings, the pilot doesn't freeze — they start constructing hypotheses. That hypothesis-formation process takes time, and in an emergency, time is exactly what you don't have.
This insight — that the design problem isn't absence of information but conflicts between signals — became the frame I brought to AI systems fifteen years later. Air France Flight 447 is the most publicized example of what happens when conflicting signals collapse a crew's mental model. I've cited it in every AI product conversation I've had since.
When the system fails, the designer is responsible for whether the human can take back control.
What Came Next
This question — how do you design the handoff from automated system to human — followed me from Boeing to Microsoft, where we had milliseconds to determine whether a touch on a 2×4 sensor grid was intentional. It followed me to Katalyst, where a training station had to degrade safely if a trainer's attention was elsewhere. It followed me to Google, where autonomous AI agents need to know when to surface disagreement rather than silently resolve it.
The domain changed every few years. The design problem didn't.