| May I submit the system was not as well built as you believe
| and your experts are lacking.
You may submit such, if you're willing to endure a very long lecture on the
mathematical nature of complex systems. I still maintain that it is not
possible to engineer a system that cannot fail. There are only two classes
of design: those that have failed, and those that have not yet failed.
Failure of a system is de facto proof of a deficiency of that system's
design or operation. That I grant you easily. The fallacy is in assuming
that such a failure should have been foreseen and that some degree of
negligence or incapacity must necessarily have played a part in the ensuing
Inability of an operator to correctly diagnose and alleviate a failure is de
facto proof of a deficiency in that operator's understanding. The question
is whether a comprehensive understanding of a complex system is possible,
and thus whether operator error is synonymous with culpability. Experts
always "lack". The question is whether they culpably "lack".
| If a designer/ engineer/ expert fails to see a potential situation
| (the highly improbable?) then the system failure is likely to be
| completely unforeseen.
That is substantially my point. The question lies in what is reasonably
foreseeable. As systems become very complex, the ability to predict all
possible behaviors drops off dramatically, as I shall explain.
| Dominos always fall with the first one. This causes that which
| causes something else and soon it's an unforeseen circumstance.
Yes, in simple linear failure modes. Most systems of any interest are not
You also have to consider the notion of coupling, which is analogous to how
closely spaced the dominos are. Move the dominos farther apart and they
fall more slowly, perhaps allowing you time to jump in and stop the cascade.
Move them sufficiently far apart and the fall of one domino does not affect
another. Loosely-coupled systems allow time for operators or automatons to
diagnose the problem and try a remedy.
A table saw is a tightly-coupled system in that, say, the misfeed of stock
may be separated in time from a ball of hamburger at the end of your wrist
by only a few milliseconds. This leaves very little time for the operator
to notice the problem and apply a remedy.
You also have to consider the notion of non-linearity, which is analogous to
"branching" the domino chain and starting two concurrent paths of failure,
and of mixed-mode failures and feedback systems that have absolutely no
analogue in the world of tumbling dominos but which affect our systems.
Pogo in rocket engines is a good example of a feedback system. An simple
example of a mixed mode failure would be a slippery floor in front of your
table saw: you reach to control the stock, slip, and fall into the blade.
Remove either the table saw or the floor contaminant and the accident might
have been preventable. But neither is necessarily foreseeable by the agent
controlling the other.
Non-linear systems are difficult to diagnose because cause and effect are
not always straightforwardly observed.
Take several thousand dominos and place them in a room. Arrange them in
criss-crossing patterns with several intersections, branches, and loops.
Now turn off the lights -- you don't get to observe at one glance the state
of the entire system. All you have is a flashlight and your ears. When you
hear the dominos start to fall it's your job to stop them all falling, using
only your flashlight and your memory of the domino layout. You have only
seconds, or at best, minutes.
| Truth is for everything someone wants to call an accident you only need
| to find the first domino and the events leading up to it's tipping and
| virtually every time you'll find it could have been easily prevented.
That's hindsight. We're talking about foresight.
You're also forgetting that most failures are mixed-mode failures: the
combination of several conditions to produce a failure. Oil on the floor is
itself a manageable risk. A table saw is itself a manageable risk. Oil on
the floor in front of your table saw is a *set* of circumstances that
*together* spell a significant danger. Remove either of those conditions
and the risk is substantially mitigated. But the trick is to recognize that
*combination* of circumstances as dangerous.
In systems that employ literally thousands of components, the ways in which
those components can interact is a number so large as to lose all meaning.
This is the mathematical nature of complex systems and the reason why you
can't predict their operation in foresight. To recognize in advance every
potentially dangerous *combination* of all those components and all their
respective operational states is simply impossible. It cannot be done.
When you design or operate a complex system you don't have the luxury of
knowing ahead of time which paths of operation will lead to failure. You
don't have the luxury of a single solitary path to reason through. You
don't have the luxury of concentrating your attention on one variable that
you know to be a root cause of some potential failure.
Imagine you're in a very large office building with which you are
unfamiliar. There is a bomb in the building, wired into the building's
electrical system. If you flip a certain combination of light switches
either on or off, it will disarm the bomb. You do not know where all the
light switches in the building are -- but you realize there are about a
thousand of them. You do not know how many of the switches are wired into
the bomb, and how many are still wired to the lights. You do not know
whether to turn any particular switch on or off in order to disarm the bomb.
The bomb is on a timer, so you don't have forever to experiment with the