Ep.87 What exactly is Systems Thinking?

We will review each section of Leveson’s paper and discuss how she sets each section up by stating a general assumption and then proceeds to break that assumption down.We will discuss her analysis of:Safety vs. ReliabilityRetrospective vs. Prospective AnalysisThree Levels of Accident Causes:Proximal event chainConditions that allowed the eventSystemic factors that contributed to both the conditions and the event Discussion Points:Unlike some others, Leveson makes her work openly available on her websiteLeveson’s books, SafeWare: System Safety and Computers (1995) and Engineering a Safer World: Systems Thinking Applied to Safety (2011)Drew describes Leveson as a “prickly character” and once worked for her, and was eventually fired by herLeveson came to engineering with a psychology backgroundMany safety professionals express concern regarding how major accidents keep happening and bemoaning - ‘why we can’t learn enough to prevent them?’The first section of Leveson’s paper: Safety vs. Reliability - sometimes these concepts are at odds, sometimes they are the same thingHow cybernetics used to be ‘the thing’ but the theory of simple feedback loops fell apartSumming up this section: safety is not the sum of reliability componentsThe second section of the paper: Retrospective vs. Prospective Accident AnalysisMost safety experts rely on and agree that retrospective accident analysis is still the best way to learnExample - where technology changes slowly, ie airplanes, it’s acceptable to run a two-year investigation into accident causesExample - where technology changes quickly, ie the 1999 Mars Climate Orbiter crash vs. Polar Lander crash, there is no way to use retrospective analysis to change the next iteration in timeThe third section of the paper: Three Levels of AnalysisIts easiest to find the causes that led to the proximal event chain and the conditions that allowed the event, but identifying the systemic factors is more difficult because it’s not as easy to draw a causal link, it’s too indirectThe “5 Whys” method to analyzing an event or failurePractical takeaways from Leveson’s paper–STAMP (System-Theoretic Accident Model and Processes) using the accident causality model based on systems theoryInvestigations should focus on fixing the part of the system that changes slowestThe exact front line events of the accident often don’t matter that much in improving safetyClosing question: “What exactly is systems thinking?” It is the adoption of the Rasmussian causation model– that accidents arise from a change in risk over time, and analyzing what causes that change in risk Quotes:“Leveson says, ‘If we can get it right some of the time, why can’t we get it right all of the time?’” - Dr. David Provan“Leveson says, ‘the more complex your system gets, that sort of local autonomy becomes dangerous because the accidents don’t happen at that local level.’” - Dr. Drew Rae“In linear systems, if you try to model things as chains of events, you just end up in circles.’” - Dr. Drew Rae“‘Never buy the first model of a new series [of new cars], wait for the subsequent models where the engineers had a chance to iron out all the bugs of that first model!” - Dr. David Provan“Leveson says the reason systemic factors don’t show up in accident reports is just because its so hard to draw a causal link.’” - Dr. Drew Rae“A lot of what Leveson is doing is drawing on a deep well of cybernetics theory.” - Dr. Drew Rae Resources:Applying Systems Thinking Paper by LevesonNancy Leveson– Full List of PublicationsNancy Leveson of MITThe Safety of Work PodcastThe Safety of Work on LinkedInFeedback@safetyofwork.com