You may submit such, if you're willing to endure a very long lecture on the mathematical nature of complex systems. I still maintain that it is not possible to engineer a system that cannot fail. There are only two classes of design: those that have failed, and those that have not yet failed.
Failure of a system is de facto proof of a deficiency of that system's design or operation. That I grant you easily. The fallacy is in assuming that such a failure should have been foreseen and that some degree of negligence or incapacity must necessarily have played a part in the ensuing failure.
Inability of an operator to correctly diagnose and alleviate a failure is de facto proof of a deficiency in that operator's understanding. The question is whether a comprehensive understanding of a complex system is possible, and thus whether operator error is synonymous with culpability. Experts always "lack". The question is whether they culpably "lack".
| If a designer/ engineer/ expert fails to see a potential situation | (the highly improbable?) then the system failure is likely to be | completely unforeseen.
That is substantially my point. The question lies in what is reasonably foreseeable. As systems become very complex, the ability to predict all possible behaviors drops off dramatically, as I shall explain.
| Dominos always fall with the first one. This causes that which | causes something else and soon it's an unforeseen circumstance.
Yes, in simple linear failure modes. Most systems of any interest are not linear.
You also have to consider the notion of coupling, which is analogous to how closely spaced the dominos are. Move the dominos farther apart and they fall more slowly, perhaps allowing you time to jump in and stop the cascade. Move them sufficiently far apart and the fall of one domino does not affect another. Loosely-coupled systems allow time for operators or automatons to diagnose the problem and try a remedy.
A table saw is a tightly-coupled system in that, say, the misfeed of stock may be separated in time from a ball of hamburger at the end of your wrist by only a few milliseconds. This leaves very little time for the operator to notice the problem and apply a remedy.
You also have to consider the notion of non-linearity, which is analogous to "branching" the domino chain and starting two concurrent paths of failure, and of mixed-mode failures and feedback systems that have absolutely no analogue in the world of tumbling dominos but which affect our systems. Pogo in rocket engines is a good example of a feedback system. An simple example of a mixed mode failure would be a slippery floor in front of your table saw: you reach to control the stock, slip, and fall into the blade. Remove either the table saw or the floor contaminant and the accident might have been preventable. But neither is necessarily foreseeable by the agent controlling the other.
Non-linear systems are difficult to diagnose because cause and effect are not always straightforwardly observed.
Take several thousand dominos and place them in a room. Arrange them in criss-crossing patterns with several intersections, branches, and loops. Now turn off the lights -- you don't get to observe at one glance the state of the entire system. All you have is a flashlight and your ears. When you hear the dominos start to fall it's your job to stop them all falling, using only your flashlight and your memory of the domino layout. You have only seconds, or at best, minutes.
Go.
| Truth is for everything someone wants to call an accident you only need | to find the first domino and the events leading up to it's tipping and | virtually every time you'll find it could have been easily prevented.
That's hindsight. We're talking about foresight.
You're also forgetting that most failures are mixed-mode failures: the combination of several conditions to produce a failure. Oil on the floor is itself a manageable risk. A table saw is itself a manageable risk. Oil on the floor in front of your table saw is a *set* of circumstances that
*together* spell a significant danger. Remove either of those conditions and the risk is substantially mitigated. But the trick is to recognize that *combination* of circumstances as dangerous.In systems that employ literally thousands of components, the ways in which those components can interact is a number so large as to lose all meaning. This is the mathematical nature of complex systems and the reason why you can't predict their operation in foresight. To recognize in advance every potentially dangerous *combination* of all those components and all their respective operational states is simply impossible. It cannot be done.
When you design or operate a complex system you don't have the luxury of knowing ahead of time which paths of operation will lead to failure. You don't have the luxury of a single solitary path to reason through. You don't have the luxury of concentrating your attention on one variable that you know to be a root cause of some potential failure.
Imagine you're in a very large office building with which you are unfamiliar. There is a bomb in the building, wired into the building's electrical system. If you flip a certain combination of light switches either on or off, it will disarm the bomb. You do not know where all the light switches in the building are -- but you realize there are about a thousand of them. You do not know how many of the switches are wired into the bomb, and how many are still wired to the lights. You do not know whether to turn any particular switch on or off in order to disarm the bomb. The bomb is on a timer, so you don't have forever to experiment with the light switches.
Go.
--Jay