Engineered to Fail · Part 3 of 6

Human Machine Interface Failure in Defence: What Reverting to Old Equipment Tells You

Reversion is a disclosure. When an institution quietly goes back to the equipment it was replacing, it is telling you where the designed workflow stopped matching the work that has to be done.

Dr Anthony Walker, PhD in thermal and occupational physiology. Founder and Managing Director, Optimised Human Performance.
Published 28 September 2026.

What does it mean when a military goes back to older equipment?

Between 30 November and 16 December 2022, eighteen Puma infantry fighting vehicles took part in a firing exercise at the German Army’s armoured training centre in Munster, in preparation for Germany’s NATO high-readiness commitment. The German Ministry of Defence later reported to Parliament that by the end of the exercise, "alle 18 Fahrzeuge als nicht mehr einsatzbereit gemeldet": all 18 vehicles were reported as no longer operational (my translation).

The Minister’s response on 27 December was to stop the retrofit programme and to attach a condition to any future order: "Neue Pumas werde ich erst dann bestellen, wenn diese Bedingungen erfüllt sind", I will only order new Pumas once these conditions are met, the conditions being that the vehicles are operational and function reliably. On 4 January 2023 the Ministry confirmed that industry had repaired all but one of the vehicles, and in the same statement announced that Germany would meet its contribution to NATO’s VJTF Land spearhead "mit Schützenpanzern vom Typ Marder", with Marder infantry fighting vehicles.

Seventeen of eighteen vehicles repaired is a maintenance outcome. The decision to send the older vehicle to the Alliance’s highest-readiness force is a different kind of statement. It records a judgement that the new system could not yet be relied on to be operated as designed under the conditions the commitment would impose.

What did the USS John S. McCain collision reveal about the helm design?

On 21 August 2017 the destroyer USS John S. McCain collided with the tanker Alnic MC in the Singapore Strait. Ten sailors died and 48 were injured. The US National Transportation Safety Board found that during a change of thrust control, "a John S McCain watchstander unintentionally transferred control of steering from the helm to the lee helm station which resulted in a perceived loss of steering by the John S. McCain’s helmsman, however, steering control was available at all times in the accident sequence."

The Board found the transfer was possible "because the system was being operated in backup manual mode, which removed a safeguard against inadvertent transfer of steering control." Its probable cause was "a lack of effective operational oversight of the destroyer by the US Navy, which resulted in insufficient training and inadequate bridge operating procedures."

The system did what it was built to do, and the crew could not tell who was steering the ship. Among the recommendations the Board issued to the Navy were the "Issuance of permanent guidance directing destroyers equipped with the Integrated Bridge and Navigation System to operate in computer-assisted steering modes, except during an emergency", and the "Revision of written instructions for bridge watchstanders on destroyers equipped with the Integrated Bridge and Navigation System to include procedures for shifting steering and thrust control between all bridge stations." A system that has to be confined by permanent guidance to one safe mode, with written instructions issued for a transfer the crew could already make by accident, was not specified around the way a bridge is actually worked.

What happens when the fallback for a failed system is the human?

When a communications system gets overloaded and fails under pressure, the fallback is the human, and you had better be sure that human knows what they are doing. On a storm night in Canberra, with more than a thousand jobs underway across the district, a dispatch system that had not been optimised for the way it was used fell over. No computer aided dispatch, no visual picture of where units were, just a whiteboard and a radio to run the city. The accountability system at fires is the same story from the other direction: it still runs on a whiteboard, because a better technical solution that may or may not work on the day is not a solution at all.

In a world dominated by the need to "maintain situational awareness" in many cases by pushing as much information into the poor operator’s brain as possible, how do you even begin to design the user interfaces when information overload is designed into the system right from the start?

Is every reversion a design failure?

When an institution reverts to older equipment, it is disclosing where the design stopped matching the work. The reversion is a confession that the workflow was specified around the system and tested against the system, and that the people who had to operate it under real conditions were not the reference point.

This is the claim I am least sure holds in every case. Some reversions are sound engineering judgement about maturity and risk, with nothing to confess. If you have made or advised on a reversion decision that fits that description, I would like to understand how you drew the line.

Dr Anthony Walker holds a PhD in thermal and occupational physiology and served fifteen years in operational firefighting, including station officer command. He is Founder and Managing Director of Optimised Human Performance, a specialist consultancy in human systems integration and work system design for Defence, aviation, emergency services and resources clients.