Today's summary is about a paper written by Richard I. Cook (MD) in 2002.
The paper already succinctly conveys the key ideas.
Complex systems are intrinsically hazardous systems.
Complex systems are heavily and successfully defended (technically and ops-wise) against failure.
Catastrophe requires multiple failures – single-point failures are not enough.
Complex systems contain changing mixtures of failures latent within them.
Complex systems run in degraded mode: Corollary of (4) — complex systems run as broken systems.
Catastrophe is always just around the corner.
Post-accident attribution of an accident to a ‘root cause’ is fundamentally wrong: There are multiple contributors to accidents. Each of these is necessary insufficient in itself to create an accident.
The evaluations based on such reasoning as ‘root cause’ do not reflect a technical understanding of the nature of failure but rather the social, and cultural need to blame specific, localized forces or events for outcomes.
Hindsight biases post-accident assessments of human performance: Knowledge of the outcome makes it seem that events leading to the outcome should have appeared more salient to practitioners at the time than was actually the case.
Human operators have dual roles: as producers & as defenders against failure: The system practitioners operate the system in order to produce its desired product and also work to forestall accidents.
All practitioner actions are gambles: All practitioner actions are actually gambles, that is, acts that take place in the face of uncertain outcomes.
Actions by practitioners at the sharp end resolve all organization ambiguity.
Human practitioners are the adaptable element of complex systems.
Human expertise in complex systems is constantly changing as technology changes and people move.
Change introduces new forms of failure: When new technologies are used to eliminate well-understood system failures or to gain high precision performance they often introduce new pathways to large-scale, catastrophic failures. Low consequence vs frequent failures.
Views of ‘cause’ limit the effectiveness of defenses against future events: Instead of increasing safety, post-accident remedies usually increase the coupling and complexity of the system. Past failures are over-indexed even tho they are less likely to happen again.
Safety is a characteristic of systems and not of their components.
People continuously create safety.
Failure-free operations require experience with failure.