Re: [SystemSafety] The bomb again

From: Brent Kimberley < >
Date: Wed, 9 Oct 2013 19:24:14 +0000

Does similar logic apply to rotations such as pitch-yaw-roll and quaternians? Quaternians may eliminate singularities but pitch-yaw-roll is intuitive. -----Original Message-----
From: Peter Bernard Ladkin <ladkin_at_xxxxxx Sender: systemsafety-bounces_at_xxxxxx Date: Wed, 09 Oct 2013 13:52:24
To: Matthew Squair<mattsquair_at_xxxxxx Subject: Re: [SystemSafety] The bomb again

On 10/8/13 7:43 AM, Matthew Squair wrote:
> Isn't the question of whether you trust their efforts really a variant of the agency dilemma? And
> isn't that what 'design' of the socio-technical system should address, and what a methodology such
> as STAMP can assist you in doing?

Well, I bet some System Safety List old hands are chuckling to themselves at this one. I'd hate to disappoint........

Let's stick with accident analysis. We have our own method for causally analysing accidents, called WBA. It is used in certain large German companies, and of course Causalis uses it for clients who wish for causal analyses.

WBA does not have an inbuilt method for classifying operator/organisational/society/legal/governmental (OOSLG) factors as such. We use the PARDIA classification for pointy-end activities and use decision-theoretic analyses (Rational Cognitive Modelling) for multi-agent interactions. WBA does determine where any OOSLG factors are present and those that are not addressed by PARDIA and RCM I like to leave for the organisational scientists such as Downer and Perrow.

Two hundred fifty years ago, David Hume proposed two characterisations of cause which have persisted. One is the constant-conjunction criterion (CCC), beloved of those who collect statistics on repeatable events, for example the superb recent work of Judea Pearl and colleagues. The other is the counterfactual criterion, which WBA uses in a form called the Counterfactual Test (CT). Almost all conceptions of causality in the scientific, engineering and philosophical literature are one or the other of these. CT is used in an intuitive fashion by more or less all aviation accident investigations, and it occurs explicitly in the USAF guidance for aviation accident investigation. It should be more or less obvious why this is so - commercial-aviation accidents are not events which repeat in a manner in which CCC can address. (In contrast, CCC *obviously* helps with road safety, because road accidents happen with appropriate frequencies for CCC techniques to be useful.)

Ten years ago, Nancy announced that she had a new conception of causality, which was embodied in STAMP. I saw, and continue to see, a problem in redefining a concept which has had a good and productive run in science for three centuries (if not two and a half millenia). It could well be that this new concept is a very useful concept; it could be very helpful in identifying areas of interest in accident investigation; indeed, judging by the interest in STAMP I imagine many people think it is. But why not choose a different word for it?

We had a discussion on the York list. It wasn't scientifically very fruitful (but I do remember fondly - and repeat - a particular piece of repartee).

People who like STAMP could *obviously* use WBA for parts of what they do - the two methods are compatible. And they would see the same advantage as other WBA users. The only hindrance to such practice is use of the word "causal" for two different concepts.

The other thing about using STAMP is you have to buy the model. Now, I'm sure it is helpful, because the people developing STAMP are very smart and very dedicated and have been at it for a decade. But is the model right? One might well be able to persuade engineers that the STAMP social/organisational model is the bee's knees, but it is a quite different matter to persuade the experts in those things, the organisational scientists.

Constance Perrin wrote a book in which she investigated some incidents at nuclear power stations and came to the conclusion that there was a tension between the way the plant was conceived to work organisationally and the architecture of plant operations impregnated in the minds of the operators, who came mostly from the "nuclear navy", which had/has a modus operandi completely different from the intended plant-operations architecture. A crucial insight. It is not obvious to me how a STAMP analysis would lead you to the same conclusion. (Maybe a good project to try?) That is why I prefer to leave these matters to the organisational theorists (despite their insistence upon using a language whose syntax and vocabulary is identical with those of English but whose semantics appears to come from Alpha Centauri).

Ten years ago, some colleagues in Braunschweig compared analyses of the same accident (the Brühl derailment) using WBA and using STAMP. STAMP identified a lot of organisational features of the Deutsch Bahn (German railways, as it then was; now it's DB). STAMP likes to see feedback, but the DB, like many German organisations, is hierarchical and STAMP wanted to see cycles where things were acyclic. It wouldn't have been helpful, because, well, I guess you could try to tell DB to change things, but they would say "we have been doing it like this for over a century; here are the reasons we do it this way (giving you the very thick history book); it has evolved so and it more or less works; and if we change it to something new we are likely to introduce weaknesses which we won't know about until we start having accidents because of them." And, you know, that's not a bad set of reasons: you don't change things that aren't really broken, even when a major scientist redefines "broken" for you. (In contrast, they are happily adopting WBA through third-party recommendation and training.)

All of which is not to say that we indulge heavily in NIH round here. Indeed, there was a major STAMP workshop recently put on by colleague Schnieder in Braunschweig, which generated a lot of interest. That's very welcome - as Nancy says, the important thing is thinking hard about hazards and accidents and using whatever help you can get.

PBL Prof. Peter Bernard Ladkin, Faculty of Technology, University of Bielefeld, 33594 Bielefeld, Germany Tel+msg +49 (0)521 880 7319

The System Safety Mailing List

The System Safety Mailing List
systemsafety_at_xxxxxx Received on Wed Oct 09 2013 - 21:24:34 CEST

This archive was generated by hypermail 2.3.0 : Tue Jun 04 2019 - 21:17:06 CEST