By: Sergio R. Concha, Technical Editor

[Editor’s note: this opinion piece originally appeared in Vol 20 No 6 (Q3 1984) of Hazard Prevention (now Journal of System Safety). The text has not been modified except for the addition on a title, formatting changes, images, and hyperlinks]

Technological advances in this century have changed the way of life of humans with unprecedented speed. The built-in “self-preservation” instinct of humans (our ability to detect and evade danger) is lagging behind the advances made by technology.

Television programs, newspaper articles, motion pictures, concerned citizens, politicians, scientists and self appointed prophets debate incessantly on whether cigarettes are that harmful, or if nuclear electrical power generation is a “safe” policy to follow, or if chemicals, combustion products and waste are polluting the earth, water and air to a point where life will be extinguished and, of course, whether nuclear armaments should ever be produced.

All these debates have produced an awareness in the general public of danger from unseen and little understood causes and may be close to producing mass hysteria. The public, in general, wishes that these evils be stopped.

Governments, which theoretically acquiesce to the public’s wishes, are taking the role of being protectors of humans by devising means by which we are warned of dangers. As a consequence, human safety and health decisions are being institutionalized by governments. The determination of “what is safe” and “what is an acceptable risk” are being made by anonymous technocrats in private business and government. The public in general is never asked whether he or she is willing to assume a risk Projects are presented to the public as completed facts. This method of presenting projects to the public has polarized public opinion in two broad sectors. There are those which advocate the return to caves, and there are those which advocate that quantitative acceptable risk levels be developed. Both approaches are impossible to achieve without socio-economic upheavals.

The latter approach, even though it appears logical at first glance, is insidious to the point of being unacceptable because a few technologists with esoteric knowledge will dictate to the rest of humanity “what is safe” and “what is not safe.” Freedom of choice will be destroyed. The technocrat will be all powerful and insulated from responsibility by anonymity. The solution to this problem is to inform the public and allow the public to influence the decision making process.

The article in this issue, “Keeping an Eye on Our Nukes,” is a novel experiment by which the public had a role in influencing the way the data was presented to the decision makers The authors acknowledge that the method used is inefficient and full of perils, but at least it is a start to involve the public in deciding “what is safe for them.”

This experiment of public involvement had two features not found in similar projects. The first is that the institution making the study (the Federal Government in this case) provided funds to the public to hire third party independent scientists to verify that the study was unbiased. The second feature is that the public could and did make corrections in the study when the study was in error. The System Safety Society through its members should try to be a source of third-party independent scientists which can inform the public and the institutions on “safety risks” so that decisions are made by informed people. After all, System Safety is a predictive discipline and we know how to predict hazards.

By: the Editors

[Editor’s note: this opinion piece originally appeared in Vol 20 No 4 (Q3 1984) of Hazard Prevention (now Journal of System Safety). The text has not been modified except for formatting changes, images, and hyperlinks]

In 1947 the Engineering Council for Professional Development (ECPD) included the “responsibility to the public” within their code of ethics in contrast to the original concept adopted in 1910 by civil engineers in England which emphasized “responsibility to the client.” In 1974 the EDCP broadened the code by specifically mentioning “the safety, health, and welfare to the public” in their code of ethics. The evolution of these codes mirrors the engineering profession’s own perception of its responsibility to the welfare of the public.

The ethical dilemma of engineers, specifically those practicing in the safety and health fields, is rooted in their perception that engineering decisions are not made by them but are subverted by others. Their rationale for derogation of personal responsibility is “I followed orders.”

Because of the widespread impact of engineers in the technological society of today, it is imperative that engineers become involved with their work at a level in consonance with an ethical code. Thus, engineers must view their work in a broader sense than the technical skill needed to design or operate a “widget.” In other words, engineers, specifically those practicing in the fields of safety and health, must be true “professionals,” i.e., an individual, who by reason of his or her intellectual capacity, learning, and application of the learning is uniquely qualified to solve problems in specialized areas of human need. Thus, engineering decisions must be balanced between the responsibility to the client, to society, to the firm, to the profession, and to the engineer himself. None of these responsibilities should exclude any of the others. All responsibilities must be considered when making a decision; however, depending upon the unique circumstances, one will assume a dominant role.

The dilemma of making these decisions arises from the complexity of these responsibilities and the socioeconomic and technological issues involved in engineering projects. The challenge to the engineering professional is there.

The challenge to the safety and health professional engineer is even greater because, by our own choosing, we are the representatives of the “public” to assure that “their safety, health, and welfare” were considered in the engineering project. We have chosen to be the guardians of the “code of ethics” of the engineering profession. To be able to perform this duty we must be trusted by our peers for our demonstrated technical capabilities and moral rectitude.

By: C.O. Miller

[Editor’s note: this opinion piece originally appeared in Vol 29 No 4 (Q4 1993) of Hazard Prevention (now Journal of System Safety). The text has not been modified except for formatting changes, images, and hyperlinks]

The following is an excerpt from a letter of concern to me from one of the more distinguished members of our society. Mr: C.O. Miller was a member of the original “Aerospace Systems Safety Society.” In 1963, he was elected President of the society; in 1967, he was named a “Lifetime Honorary Member” in 1974; a “Fellow” in 1980; and is currently listed as an Emeritus Member. He has served as a member of the Board of Directors, or on important society committees almost continuously for the past 30 years. He has been actively involved in System Safety for the past 40 years (which is about 10 years longer than the term has been in existence). As a concerned member of the system safety community, Mr. Miller has shared a few of the concerns that he has about the practice of system safety. I share his concerns about these issues and suggest that we work as a group to find adequate solutions to the problems identified in this editorial. – CPH

Let me list and describe briefly the concerns I have about the practice of system safety:

Continued Confusion Between System Safety and System Safety Engineering…

System Safety is a lifecycle concept with operations and disposal being significant phases beyond engineering, tests, manufacturing and initial deployment. Application of operational system safety tasks and feedback loops between all of these phases are essential to the effectiveness of the concept, if not in the system in question then on future systems. Still, in HP articles and editorials we see continued interchangeable references to system safety and system safety engineering. Some courses (texts) and seminars labeled “system safety” are hardly more than exercises in hazard analyses or risk management. Government agencies with significant operational roles (e.g., the FAA) don’t really understand what system safety means. Too many non-government endeavors have been exposed only to limited application of the full scope of system safety processes.

The System Safety Society needs to broaden its influence in various industries, which IS basic to gaining more members and which is, perhaps, even basic to survival as a professional group. I don’t believe this can be accomplished by trying to change the orientation of prospective members. We should sell them on the contribution they can make to the Society in their language. That’s basic salesmanship. If people in the operational world (a group that is not well represented in the Society’s membership) see the term “engineering” in the title of or synonymous with the actual title of the Society, they are not going to be interested since an overwhelming number of them are not engineers and they know only the narrow definition of the word “engineering.” Also, many other professionals (physicians, lawyers, scientists of one kind or another, managers, pilots, et al) do not look too kindly at engineers and, frankly, would be insulted to be mistaken for one. (It is like when I was in the Marines and people called me soldier!)

Lack of Definition and attention to Operational Phases in MIL-STD-882…

DOD continues to resist or limit inclusion of the supplier’s role in operations and their own operational commands’ role in the entire system safety process. Since MIL-STD-882 IS looked upon as the model of system safety thinking by many different groups, inside and outside government agencies, it IS mandatory to get optimum definitions and lifecycle task descriptions including those with operations relevance into that standard.

Excessive attention to the Paperwork at the Expense of the Real World Benefits of the System Safety Concept…

Contract data requirements are important, including hazard analyses and various reports. However, system safety thought processes by the people performing and interpreting analyses and tests and application of the findings to Hazard Prevention 4th Quarter 1993 accident prevention in a timely manner are what really count. Too often, checking off the boxes seems most important. Hazard analyses become late and/or compromised (rationalized?) away for schedule or short-term cost reasons. Closely allied to this is excessive dependence upon numerical results of hazard analyses (actually and frequently, reliability analyses masquerading as hazard analyses) to make decisions rather than to simply aid in decision-making.

Foot Dragging in Integrating Hazard Analyses and Human Factors Task Analyses to Minimize Human Error…

One of the fundamental differences between reliability analyses and hazard analyses over the years has been the latter’s concern for potential human error. (Reliability types did not know how to handle human error numerically; hence, they just tended to bypass it.) Human performance can be the greatest contributor to safety or one of its main detractors. Like most other cost-effective measures, controlling human error begins in the initial design phase. Both hazard analyses and task analyses can be found there, but all too frequently, following separate, not integrated, paths. This needs to be improved if system safety really wants to live up to its name. After all, what “component” is common to all systems?

Difficulties the Society Has in Fostering the System Safety Concept in Non- Aerospace Activities…

Much has been accomplished in this regard by individual Society members and through occasional pleas by Society officials (e.g., your own message to the membership in HP). Also, the membership scope has been enlarged well beyond aerospace participants (witness the roster of speakers and attendees at the 1991 symposium). Nevertheless, this remains the significant challenge for the 90s – a challenge that might just best be met by paying more attention to the basics implicit in the foregoing items of concern.

The purposes for which the Society was founded are more important today than they were in 1963 for the simple reason systems are more complex than ever. Our problem-solving techniques are better, too; however, if the techniques are applied without due regard to the fundamentals that gave rise to them, the result may be a negative contribution to safety. More on the practical side, if the Society does not realize and pay attention to these fundamentals, it too may encounter difficulties in survival.  -C.O. Miller

By John H. Reed, Chairman NTSB (1969-1976)

[Editor’s Note: This address was delivered in the 1st Annual International System Safety Symposium in July 1973. It was originally published in Volume 10 Issue 1 of Hazard Prevention (now Journal of System Safety). Additional formatting, hyperlinks, and emphasis have been added, but the text is unchanged.]

I sincerely appreciate the opportunity to meet with you today to keynote this First Annual International System Safety Symposium. It is always a pleasure to share ideas with outstanding professional organizations such as yours.

I was particularly interested in the sub-theme of this symposium “The Application Of System Safety To The Protection Of The Public.” Safety, especially of the-traveling public, is, of course, the primary concern of the National Transportation Safety Board. It is the reason for our existence. 

In these remarks, I would like to highlight for you the challenges facing us in protecting the traveling public, now and in the foreseeable future. I am sure you will agree with me that we are indeed faced with a tremendous challenge if we wish to control the appalling death toll of our mobile citizenry. The use of the term “appalling” is not intended just for dramatic effect – the toll is truly appalling.

As former Transportation Secretary Volpe once noted: “Auto crashes have killed off more Americans than all our violent crimes and all the wars in our history.” We cannot let this loss continue unabated. The federal government is now attacking these losses through various forms of legislation action. However, the problems which face us cannot be solved by government alone. We need the dedicated efforts of safety specialists from all segments of the industry if we are to meet the challenge.

Before I proceed, let me briefly acquaint you with the role of the National Transportation Safety Board. The Safety Board was created in 1966 as an autonomous body within the Department of Transportation to serve essentially as the overseer of U.S. transportation safety. We have safety responsibility for all aviation transportation, and for the highway, railroad, marine and pipeline modes of transportation. The Board is composed of five members who are appointed by the President and confirmed by the Senate. We have two operating bureaus – the Bureau of Aviation Safety and the Bureau of Surface Transportation Safety, a much smaller but equally active organization. The directors of both bureaus, Mr. C.O. Miller and Mr. Henry Wakeland, as I am sure most of you know, are active members of your society. In fact, Mr. Miller is a charter member as well as a past president. I am pleased to note that both Mr. Miller and Mr. Wakeland were instrumental in the formulation of this program.

The mission of the Safety Board is twofold. We are charged with the determination of the cause or causes of all aviation accidents, and of selected surface accidents. It is also our responsibility to use this knowledge gained from our investigations to prevent recurrence of similar accidents. We do this predominantly by defining problem areas and by recommending to the appropriate parties changes which will correct the conditions which led to the accidents.

Now I would like to discuss the current safety status of our national transportation system. When measured by almost any yardstick, highway safety stands out as the number one transportation safety problem in the U.S.A. Out of a total of 60,789 transportation fatalities in 1972 (all statistics are from 1972), highway accidents accounted for 55,358 lives. In addition, the sixteen-plus million highway accidents which occurred in that year were responsible for about two-million injuries and a total property loss to the nation in excess of five-billion dollars.

The next biggest killer among our transportation modes was our railroad system, with 1,922 fatalities, followed closely by the marine mode with 1,871 total fatalities. In these two modes, 70 to 80 percent of the total fatalities were those associated with the general public – grade crossings in the case of the railroads, and recreational boaters in the marine mishaps.

The next mode, in descending order of the number of casualties, is aviation, with a total of 1,534 lives taken. Although our air carriers accounted for only 190 of these, the impact of air carrier accidents should not be minimized. Few fatal accidents create more public concern than do those involving air carrier airplanes, and the relatively few fatal air carrier accidents account for a disproportionately high percentage of the total property and equipment loss resulting ‘from all-transportation accidents. Nor is the true hazard potential reflected in these statistics, since the crash of a fully loaded Boeing 747 into a highly populated area could produce an immense death toll.

Pipeline accidents killed relatively few people last year. but here again, accident statistics can be misleading since the potential for catastrophic losses is possibly greater in the pipeline area than in any other mode.

At this point let us look at what the future holds in store. We have seen ever-increasing sophistication in all transportation systems, as evidenced by the evolution of the DC-3 into the DC-IO, and we will see a rapid growth of complex new systems such as high-speed railroad trains. The increased complexity of these systems creates greater problems in the discovery of hazards and assessment of risks, increases the cost of safety improvements, and complicates the investigation of accidents involving these vehicles.

Another problem which is challenging our ingenuity is the transportation of hazardous materials. Our expanding energy usage is resulting in the transportation of much more fuel of all types. This, of course, creates greater hazard potential for the modes involved, especially as these cargos are being concentrated into larger loads. We have seen examples of this in our supertankers, in the increased size of barge tows, and in large, widebodied jet cargo freighters.

Although our past efforts have been primarily safety oriented, our problems are no longer limited to those of saving life and limb. Social considerations now demand that we reduce the waste and pollution caused by transportation losses. In this respect, problems such as reduction or containment of oil spills from our tankships loom as a large challenge to all of us, and they will be increasingly more important in the years ahead.

Now, having reviewed the challenge facing us, what are we to do about it?

The Safety Board sees two general areas in which we believe your efforts can produce maximum results. The first of these is the need for further utilization of your knowledge and technology in all modes of transportation. Then, we need a rigorous application of system safety principles to our national transportation problems in order to direct our national safety efforts and obtain maximum benefits from our limited fund resources.

With regard to the first area, the technology and lessons learned in aviation should be applied to other forms of transportation. Those of you associated with air carrier aviation are fortunate indeed, because your accident prevention technology is highly developed compared to that of some other modes, such as highways or recreational boating. The present air carrier accident rate is evidence of continuous attention to safety.

With respect to aviation, at least, I think we can say that system safety has come of age, and that this is the time to consolidate our gains. We need to standardize and simplify techniques, and to improve the communication of practical solutions throughout the entire transportation system. This is the reason I was happy to learn of the first international gathering of system safety specialists. This is indeed a major step in that communication.

The Safety Board, since its establishment, has been anxious to disseminate new information on scientific safety methods. Our first system safety-based recommendations were made just a few months after our inception. Our two bureau directors are firmly committed to the use of this approach when it can be helpful, both in our internal accident investigation procedures and in our general safety efforts. The Board is the only agency within the Department of Transportation where transportation specialists in all modes are gathered in close association. Our success in transferring technologies among modes is one of the major forms of improvement of Department of Transportation safety approaches: We have actively transferred system safety techniques from aerospace into rapid transit, pipeline, and the marine fields; we have promoted the use of highway crash injury prevention techniques in the railroad and rapid transit fields; and we have been instrumental in applying aviation crash survival and escape requirements to the intercity bus and school bus industries.

As a result of the gains made, we believe that a strong foothold has been established for the methods which you have done so much to establish in the defense electronics and aerospace fields. We have made advances in almost all means of transportation; however, we are conscious of the fact that the national effort in some areas – notably highway safety – is still largely limited to finding remedies after the accident. This after-the-fact approach has evolved because, unfortunately, in the various means of transportation where the need is greatest – general highway operations, recreational boating, and to a lesser degree, general aviation – system safety has not yet been generally applied. System safety efforts are best applied in systems characterized by unitary control and well defined and controlled operations. In highway passenger car operations, there exists a diffusion of authority which makes changes difficult. Even in this mode, however, certain individual elements of the system safety technology such as gross hazard, failure mode and effects, and fault tree analyses might be profitably employed. However, I believe that much stronger effort will be required in order to solve the general problem of evolving our highway safety technology into a predictive, first time safe approach.

We at the Safety Board believe that, in the surface modes, system safety is closest to realization in rapid transit operations, followed by pipelines, and then by any new project starting on the drawing board. In these and in other areas, we have made recommendations which have advanced the cause of system safety. The earliest of these recommendations was that system safety concepts be applied in the Tracked Air Cushion Research Vehicle project. Then we recommended system safety application to the Washington Metro system. We also recommended that the Urban Mass Transportation Administration require submission of system safety plans as a condition for every request for capital grants and. in a special study entitled. “A Systematic Approach to Pipeline Safety,” the Board recommended the application of system safety to the entire field of pipeline safety.

Actions which we believe are highly significant have been taken on our recommendations. For example, in response to our recommendation, the Urban Mass Transportation Administration hired a system safety staff and developed a plan for implementing system safety in projects involving approximately one billion dollars of capital equipment. Also, recommendations regarding pipeline safety developed in our pipeline study are being actively taken into consideration by the Gas Piping Standards Committee of the American Society of Mechanical Engineers.

In addition to the statutorily authorized promotional aspects of our efforts, the Safety Board also has a functional role in the system safety cycle. In this cycle there is a task which is often simply defined as feedback. This, as you know, is the stage when service experience is fed back into the system to assist in identifying potential hazards and potential problem areas.

2023 Accident Facts:

• U.S. automobile fatalities peaked in 1972 around 55,000 deaths
• U.S. automobile fatalities reached their lowest since then in 2011 at 32,500
• Since 2011, U.S. fatalities are up 32%
• Worldwide, approximately 1.35 million people die on roads each year.

The Safety Board detects safety deficiencies by our accident investigation activities. and we make these known to the public and to those with safety responsibility by our recommendations.

Our accident experience also provides a valuable source of statistical information about our aviation transportation systems. Such records permit identification of significant trends by comparing the present operation of a system with its past operation. At present, we have this capability only for aviation. In the surface modes we are not only hampered by the lack of adequate data sources, but also by the fact that there is no single centralized source for storing all accident data. The Board is now striving to have established a unified, collocated accident data system which encompasses all modes.

With respect to the paucity of accident data, I should note that the NTSB is the only federal-level organization which investigates or determines cause for accidents in all modes. We are also, I might add, the only agency which investigates solely to aid accident prevention, with no interest in law enforcement proceedings. Thus, we believe that the Safety Board, by acting as the focal point for safety activities of all modes, is ideally situated to provide the impetus for system safety activities. We are a primary source of intermodal accident data. We can serve as a clearing house for safety ideas because of the public exposure we obtain by issuing reports and recommendations, by holding forums and public hearings, and by participation of our personnel in activities such as this symposium.

In summary, I believe that because of the efforts of many dedicated persons such as yourselves, transportation safety has, in some modes, reached an admirable level in this country. But we can’t rest on our laurels. We must now strive to further improve the safety levels of all modes. and we must master the problems which our rapidly advancing transportation systems will be presenting us in the future. These are problems which cross all technological, economic, sociological, and political boundaries. They are problems which will only be solved by a rigorous, total systems approach to our national transportation needs. This is a job which will require the combined efforts of government, industry, and our universities, and you ladies and gentlemen are the nucleus of the task force which must meet this challenge. I wish you well.

John H. Reed (January 5, 1921 – October 31, 2012) was the 2nd Chair of the National Transportation Safety Board and the 67th Governor of Maine. Later, Mr. Reed was twice appointed ambassador to Sri Lanka and the Maldives.

Join us for the 41st Annual International System Safety Conference!

by Warner Talso

[Editor’s note: this opinion piece originally appeared in Vol 38 No 1 (Q1 2002) of Journal of System Safety. The text has not been modified except for formatting changes, images, and hyperlinks]

Most of us are aware of the evolutionary, even revolutionary, changes that have been taking place in the system safety discipline. These include both technology and areas of application. It is time to review exactly what defines system safety, or at least what we perceive system safety to be. This is a “what” statement, not a “how” statement, and it should be a vision of what system safety encompasses. It is important because it is the key ingredient of what binds us together. It shapes how we see ourselves and how we describe our profession to others.

Recall our origins in the Air Force aerospace arena. The discipline was, and still is, defined by MIL-STD-882. This document has been consistent in defining system safety as, “The application of engineering and management principles, criteria, and techniques to achieve acceptable mishap risk within the constraints of operational effectiveness and suitability, time, and cost, throughout all phases of the system life cycle.” [1] This definition has served us well over the years. However, the discipline was driven by the Department of Defense’s (DoD’s) mandating the implementation of 882. Our Society coasted along on the coattails of this mandatory requirement, with little effort to preach the gospel of system safety or seek out new applications.

This all changed when the Berlin Wall came down and the DoD was no longer driven by the threat of the Union of Soviet Socialist Republics. Remember the de-emphasis on military standards? All of a sudden we had to become proactive in promoting system safety and saving our Society. We have been successful to varying degrees. As the Society reaches out to new members and new industries, the definition of system safety is the shorthand version of what identifies us. I submit that it needs to be more than the military-oriented definition of 882.

Speaking of the Society, what does the Constitution say about defining system safety? Section 1.3 of the Constitution doesn’t define system safety per se, but says: “The term ‘system’ as used herein shall be considered to include any product, service and/or activity developed, produced and/or managed by a specific person, agency, or organization for a designated purpose.

The term ‘safety’ as used herein shall be considered to include any technical, social, educational, and/or managerial action initiated for the purpose of eliminating or reducing the hazards (i.e., risk of property loss and personal injury) associated with a procedure or system.” Well, there certainly are a lot of words there. It is a little verbose and not as focused as it could be. Note that the environment is not mentioned. In today’s world, should it be?

When Perry D’Antonio was our Society President, he wrote the following definition of system safety for the Society’s strategic plan: “The system safety concept is the application of special technical and managerial skills to the systematic identification and elimination or control of hazards throughout the life-cycle of a system.”

This definition of a system includes not only the product or the process, but also the influences (stresses) that the surrounding environment (including human interactions) may have on the product’s or process’s safety performance. A “system,” therefore, defines the boundaries to which the systematic process of hazard identification and control is applied.

When Dick Stephans and I have presented tutorials on the System Safety Analysis Handbook, [2] we have defined system safety as “the application of system engineering and management principles, criteria, and techniques to take positive steps to optimize all aspects of safety within the constraints of operational effectiveness, time, and cost.” We have emphasized the system analysis/engineering/management process and the need to be proactive.

One of our chapter members is performing software system safety work on a very large project. The client is so impressed with our chapter member’s grasp of the systems approach that the member has been asked to do other systems management and engineering tasks. This anecdotal evidence supports my contention that the system approach is very important to the system safety discipline, and is an engineering and management skill in its own right. In my observation, we do not put enough emphasis on the systems approach of looking at the impact of hazards (i.e., potential sources of danger) to the entire system.

When Clemens and Simmons wrote the National Institute for Occupational Safety and Health (NIOSH) Instruction Manual for System Safety and Risk Management, [3] they did not specifically define system safety, but they did identify the two primary characteristics as “(1) it is a doctrine of management practice that mandates that hazards be found and risks be controlled; and (2) it is a collection of analytical approaches with which to practice the doctrine” (emphasis in the original). This definition introduces management decision-making. This is very important. As Steve Mattern has pointed out in several articles, the system safety practitioner must show value added to the project. The practitioner must be seen by management as a worthwhile member of the team. Recognition of the value of system safety is accomplished by making a positive contribution to managers and the decision-making DOE process. Should this be part of the definition?

The OSHA regulation on process safety management (PSM) provides “an integrated approach to chemical safety, putting the focus on a comprehensive management program.”[4] I don’t think there is any argument that this PSM regulation is an application of system safety. Again, we have an emphasis on management. By the way, why doesn’t the Society have greater representation in OSHA because of PSM, and in the EPA because of Risk Management Planning (40 CFR Part 68)? Just asking.

The tragic events of September 11 should be ample reason alone to reevaluate our discipline. Was not the safety (and security) of the World Trade Center a systems issue? How could we have been involved in preventing this event (security) or mitigating the damage (safety)?

Sandia National Laboratories does research on critical infrastructures encompassing communications, transportation, banking and finance, and several other complex systems. The term high-consequence surety has been coined to identify the safety, security and reliability controls associated with preventing catastrophic events. One such critical infrastructure is municipal water supplies. These are complex systems involving pumping, treatment and distribution processes using highly computerized control systems, and are considered attractive targets for terrorists. The system safety approach allows one to see the broad hazards and evaluate the acceptability of the controls associated with preventing undesired consequences to these processes. One observation of this work is that safety and security are closely related.

The Department of Energy (DOE) has created the Integrated Safety Management System (ISMS) [5] process to apply a systems approach to safety. This is part of the “Work Smart” process. [6] ISMS defines a five-function process for incorporating safety into the workplace that is almost identical to the system safety process.

As an aside, DOE never calls this a systems approach, nor does it use the term system safety. DOE is now testing the concept that the ISMS approach can be used for security. The above examples raise an interesting question. Should security be included in the definition of system safety? Is there a System Security Society (SSeS) or a System Surety Society (SSuS) on the horizon? Do we want to lead the way in this area?

In summary, I believe it is time to review the definition of system safety to make it reflect the world of today, and to help us better understand our profession and enlighten our associates and friends. A few ideas:

• The definition should include more than just military systems. Recognition of industrial systems, medical systems, software and more should all fit under the umbrella.
• The proactive, positive nature of system safety should be recognized. There should be more recognition of system engineering and management.
• There should be recognition of management decision-making.
• The environment should be addressed.
• The definition should be included in the Society’s Constitution.

A great deal of information could be included. You will have your own ideas. Decisions have to be made. Perhaps we should also promulgate a set of principles to support the definition.

References:

1. MIL-STD-882D, “Department of Defense Standard Practice for System Safety,” Government Printing Office, February 10, 2000.
2. Stephans, R.A. and Warner W. Talso, Eds. System Safety Analysis Handbook, System Safety Society, Unionville, VA, 1993.
3. Clemens, Pat L. and Rodney K. Simmons, System Safety and Risk Management, National Institute for Occupational Safety and Health, Cincinnati, Ohio, March 1998.
4. 29 CFR 1910.119, Process Safety Management, Government Printing Office, July 1972.
5. DOE G 450.3-3, “Tailoring for Integrated Safety Management Applications,” U.S. Department of Energy, Washington, DC, February 1997.
6. DOE G 450.3-1, “Documentation for Work Smart Standards Application: Characteristics and Considerations,” U.S. Department of Energy, Washington, DC, February 1997.

Warner Talso is a former New Mexico Chapter President and SSS Director of Member Services. He was the Treasurer of the New Mexico Chapter. Along with Dick Stephans, he was also co-editor of the System Safety Analysis Handbook, a renowned and landmark system safety publication.

(Photo: Warner Talso, right, receives the ISSS 1994 Educator of the Year Award from Mike Brown, left.)

Don’t miss our annual event. Register here.

Also by this author:

By Donald M. Layton

[Editor’s Note: This opinion piece originally appeared in Volume 9 Issue 3 of Hazard Prevention (now Journal of System Safety) in January-February 1973. It is unchanged except for formatting and minor corrections.]

Anyone who has attempted to recruit new members for the System Safety Society has heard the question. “What does the Society do, and what can it do for me? ”

Some of the answers to this multiple-question may be found in an excellent folder which is available from the Society Administrative Office, 6060 Duke Street, Suite 101. Alexandria. VA 22304 [Ed.: see here].

Included in this folder are two items of prime importance to prospective members and to present members as well. These are the listings of the objectives and the activities of the System Safety Society.

OBJECTIVES

1. To advance the state-of-the-art of system safety.

2. To contribute to a meaningful scientific and technological understanding of system safety.

3. To disseminate newly developed knowledge to all interested groups and individuals.

4. To further the development of the professionals engaged in system safety.

5. To improve public understanding of the system safety discipline.

6. To improve the communication of the system safety movement and discipline to all levels of management, engineering, and other professional groups.

Let us consider these objectives and see what is being done, and what could be done to meet them.

The Society was founded in 1962 as a non-profit, professional association and was registered in the State of California as the Aerospace System Safety Society, inasmuch as the formalized principles and the term “system safety” originated in, and was principally applied by, the aerospace industry at that time. The original Society consisted of about thirty members.

With the expansion of the Society’s scope to include all product/system safety activity and personnel in other fields, the label, Aerospace, was dropped from the title in 1966.

Individual and group efforts to achieve the objectives have not been limited to those who wear the “Two Sigma” pin, but many of the members of the System Safety Society have consistently been in the forefront of such activity.

One of the most obvious examples of the improvement of communication and the dissemination of matters of safety interest has been this publication, Hazard Prevention. Begun as a newsletter under the direction of the Society’s Founder, Roger Lockwood, the publication was formalized by its first official Editor, Dr. George A. Peters. When the pressure of his business forced George to relinquish this position Roger once again assumed the leadership until Jim Johncox assumed the Editorship.

The majority of the credit of the current size and format of Hazard Prevention can be given to the last three Presidents of the Society – Jack Parrish, who started the new format; Roy Harris, who started the page growth; and Ed Fosler, who has brought a whole new concept to Associate Editors, increased page count, support through advertising and Corporate Memberships, and increased emphasis on submitted articles.

Discussions had been occurring in the Board of Directors meetings for several years as to the sponsorship of an annual symposium, but with the caution that was derived from the desire to make such a conference a meaningful expression, many delays were incurred. As somewhat of a “trial run.” the Southern California Chapter agreed to sponsor a “mini-symposium” (an idea proposed to the Board of Directors by Willie Hammer of Hughes Aircraft) which proved so successful that they have now completed a second one-day symposium. And now finally, plans are underway for the First Annual International System Safety Symposium to be held in Denver in July 1973 under the Chairmanship of George Cranston.

Now to “old timers” in the Society the above information is well known, but a significant point is centered in these facts. I have mentioned but a few of those active in the Society, but if I were to continue the listing of former Society and Chapter officers, members of the Board of Directors, contributors to Hazard Prevention and participants in the other activities of the System Safety Society, I could. probably identify several dozen SSS members who have been or are now active to some degree.

But several dozen out of a membership that exceeds seven hundred is a rather small percentage!

And so, my fellow Americans: ask not what your country can do for you — ask what you can do for your country.

– John F. Kennedy, Jan 20, 1961

So, before someone asks us what the System Safety Society can do for its members, let us ask ourselves, in a paraphrase of the words of the late President John F. Kennedy, “What can I do for the System Safety Society?”

One of the most obvious things that can be done is the recruitment of new members. There are, of course, the lofty reasons for increasing our membership – reasons such as the improvement of our professional knowledge; making what we have to offer available to all in the field, and the bestowing of our prestige gained  from being members of an august society to others, but there are more practical reasons for encouraging a membership growth. These include the benefits of national (and international) recognition that comes from representing a majority of those involved in System Safety, conservation of financial resources in the way of administrative costs (which increase at a much slower rate than the membership they support), and greater return to the members in the form of services such as local and national meetings, publications, speakers, and Society sponsored pressure on standards and member privileges.

Another way in which each member may be of service is in participation in Chapter and National society affairs. I don’t propose that every member immediately run for an office, but support would be welcome at all levels. At the Chapter level, for those of you who are fortunate enough to be near an active group, assisting with the newsletter, aiding in obtaining speakers, contacting potential members, and even such a simple task as being in charge of the name tags for the meetings o ‘collecting the money for dinner would take some of the load off those few who are doing most of the work.

And don’t forget Hazard Prevention. If you don’t have an article that is anxious to be printed, perhaps you have an idea that someone else could expand so that others might have the benefit of these thoughts. One of the few direct benefits that we offer to the members is this publication, and it will only be as good as the members make it.

A most important manner in which you can help the Society and system safety in general is to talk about safety to the non-safety types in your organization. Recently I sat next to a man on an airliner who was in charge of one phase of a company product – a product that was designed, manufactured, and partially maintained by his company. There were eight other men on the same plane who were part of a team that was involved in the setting up of this product for a consumer. Our conversation got around to system safety and this team leader stated that he had never heard of the term and had no idea that his company had such a program in force. I wouldn’t want to embarrass anyone by identifying the organization, but over the past few years we have had National officers from this company! And yet here was a person deeply involved in one of the company’s products who didn’t know of the existence of system safety.

If each of the current members of the System Safety Society did a little more for the Society the answer to the question “What can the Society do for me?“. would become so obvious to potential members that the question might never be raised. What have you done? What have you done lately? 

[Ed. – Current volunteer opportunities are on the society website. Submit your JSS manuscript here.]

Donald M. Layton was the former editor of Hazard Prevention and the 1984 ISSS Educator of the Year. He was a professor at the Naval Post Graduate School. He passed away in 2017 at the age of 94.

Don’t miss our annual event. Register here.

Also by this author:

By Clif Ericson

[Editor’s note: This opinion piece originally appeared in Vol 36 Issue 3 of Journal of System Safety in 3Q 2000. It has been reformatted from the original, but the text is otherwise unchanged.]

I often overhear, or am involved in, discussions in which safety engineers are discussing the pros and cons of using Fault Tree Analysis (FTA) during an accident investigation. The discussion often degenerates into a heated argument over whether FTA can be used effectively in an accident investigation. After giving the question much thought and performing some accident FTA, my response is a resounding yes.

Fault Tree Analysis is normally a proactive analysis tool for predicting potential causes of undesired events during the design of a new system. FTA is very powerful as a structured methodology for identifying root causes, and also provides a visual communication model that most individuals can readily understand and follow with little knowledge of the tool, the system design or the accident situation. The visual model displays the logical progression in the chain of events leading to an anomaly or accident. Therefore, it also makes an excellent reactive analysis tool for ferreting out the root causes leading to an event, anomaly, incident or accident that has already occurred.

“The discussion often degenerates into a heated argument over whether FTA can be used effectively in an accident investigation. After giving the question much thought and performing some accident FTA, my response is a resounding yes.”

Accident investigation is much like performing a system autopsy. Its purpose is to determine what caused the accident so that preventive measures can be implemented to prevent future occurrences of the same problem. The analysis uses all available clues, data and information to develop a model that adequately describes the sequence of events leading to the accident. Root cause analysis of an incident is sometimes required in real time to correct and prevent an anomaly from further progressing into a fullblown accident. In this situation, time is of the essence.

FTA provides a model for tying all of the accident investigation data and clues together. One of the valuable FTA tools specifically suited for accident analysis is the Evidence Gate. The Evidence Gate is similar to a check valve in that it is either open or closed, based on input conditions. In accident investigation, the Evidence Gate either opens or closes a fault tree branch based on the collected empirical evidence. Evidence can be derived from many different sources, such as instrumentation data, witnesses, flight data recorder, video cameras, built-in tests, etc. When a branch can be closed based on hard evidence, no further investigation is necessary in that particular area. Only the true root cause branches with supporting evidence are followed. In addition, branches with insufficient evidence must be followed until either positive or negative evidence is found, or until the root causes are identified. For example, an undesired state in a fault tree might be Tank Overpressurization, but if a review of available evidential data found that the tank’s relief valves were working properly, this path would be eliminated as a contributor to the incident.

Figure 1 shows the Evidence Gate. The methodology for developing an accident investigation fault tree is very similar to normal fault tree construction. First, analyze the system and incident using normal FTA construction rules and logic. Identify and establish major system fault states that could possibly lead to the accident. Second, go through the first tree and determine where known evidence applies or where additional evidence is needed. Place these conditions in the FT using the Evidence Gate. Continue down branches with positive evidence or insufficient evidence, and terminate branches with negative evidence.

The Fault Tree, using the Evidence Gate, provides a complete cause-consequence root cause analysis diagram of the accident or incident under investigation. The Evidence Gate allows you to insert actual evidence into fault tree branches, and thereby infer which events were active during an incident. This also allows the analyst to quickly identify actual root causes and avoid analyzing possible scenarios that did not actually cause the accident. It also provides a visual model, including a list of all scenarios considered, as well as those ruled out due to specific evidence.

This approach facilitates rapid accident investigation to quickly and correctly identify root causes, without wasting analysis time in areas that did not actually contribute to the accident. It provides a notation for the inclusion of evidence either supporting or negating a particular suspected causal event. It also creates a visual model that sequentially ties all of the relevant contributing events together. For more information on the Evidence Gate, see my paper entitled “Accident Investigation Using EEFTA” in the Proceedings of the 18th International System Safety Conference.

About the Author

Clif Ericson is a past President of the International System Safety Society and former editor of the Journal of System Safety. He is the author of 12 books on system safety.

You may also be interested in:

By John Covan

[Editor’s note: This opinion piece originally appeared in Vol 35 Issue 4 of Journal of System Safety in 4Q 1999. It has been reformatted from the original, but the text is otherwise unchanged.]

I‘d like to begin a debate about the role of system safety in business.

I have often heard the complaint that safety (in particular, system safety) is viewed by system developers as a necessary evil – something that must be tacked on after the important decisions are made about system architecture and function. How many of us have heard, when trying to inject system safety into a new project, “Come back later, it’s too early for us to talk to you just now”?

Of course we know that to be maximally effective, system safety must be fully integrated from day one. But if we act as if system safety is at the top of the list and argue for our presence based on our company’s slogan (let’s assume it is “Safety is job one”), we will never achieve this integration.

In my opinion, nobody in upper management of the typical company believes that safety is the top priority. This simply reflects the cold, hard facts of business. In his March 1998 Atlantic Monthly article on the crash of ValuJet Flight 592 into a Florida swamp, William Langewiesche writes, “Safety is never first, and it never will be, but for obvious reasons it is a necessary part of the venture.” What venture? The business venture.

So what if you don’t work in the corporate, for-profit world? Does that mean you, as a government or military employee, are exempt from the “business” mindset? No, not for at least the last decade or two. Let’s face it, all the outfits we work for boil down in the end to a business of some sort, competing to produce goods and services and maintain the status quo. Maybe they don’t have a profit line, but they work pretty hard to grow their budgets.

Business people (including project leaders and upper management) tend to focus on words like functionality, marketability, cost and schedule. And why shouldn’t they? If they don’t tend to these issues, their business —- whether product or service – is at risk of failing from loss of competitiveness or other business deficiencies. But safety is not their long suit, and that does hurt their business.

Now, nearly three-and-a-half years after the crash, the lawsuits are still making the news. It was a high consequence event, especially in the business sense. One would think that the airline industry would have gotten busy and hired a phalanx of system safety experts to improve things. But recent press releases tell of improper hazardous materials shipments (the reason the ValuJet flight went down) continuing to flood the airways.

Consider the demise of the billion dollar offshore oil-drilling platform Piper Alpha by fire and explosion in the North Sea in 1988, with the loss of 167 lives. System safety could undoubtedly have prevented the accident by re-emphasizing safety culture as a necessary part of the profit motive, for example. And system safety could have mitigated the horrible consequences by redesigning the rig’s survival systems when the decision was made to retrofit for gas production. Yet the platform design and its management enjoyed no such benefits, and the system blundered forward to a predictable, catastrophic end. The business impact was a bitter pill to swallow – Occidental Petroleum left the North Sea, never to return.

So what’s wrong with this picture? It’s that missing or inadequate system safety is a business risk – just like any other business risk. Sounds simple, right? I don’t think so. If it were, I wouldn’t be writing this essay. The temptation for upper management to separate safety from other business concerns is strong. As long as this way of thinking persists, system safety will continue to be a day late and a dollar short.

To my way of thinking, the only road to success is convincing the powers responsible for designing, building and running systems to add system safety to their business toolkit. These people must become active partners in the process and understand it to its core. Only then will our tasks be elevated to the importance they deserve.

So what can be done to turn things around? Probably lots of things like educating the business community, CEOs and the like. Perhaps we can start with the SSS. What can we do to attract such an audience? Or, are there other avenues to changing the culture of the business community?

I would like to hear your opinions. I believe the SSS has a golden opportunity to reinvent itself and become inclusive of a broader audience. If we don’t, we will remain a bunch of specialists talking to ourselves.

About the Author

At the time of writing, Dr. John Covan was the Vice President of the New Mexico Chapter of the International System Safety Society and was a senior member of the technical staff with Sandia National Laboratory.

by Ann S. Waterman  

[Editor’s note: This editorial originally appeared in Vol 33 Issue 4 of Hazard Prevention (now Journal of System Safety) in 4Q 1997. It has been reformatted from the original, but the text is otherwise unchanged. We note that in the 25 years since this article was published, “terminal acronymia” has gone from novel phenomenon to global engineering pandemic!]

“I don’t know what this means,” he ventured hesitantly after glancing at my note. I smiled. That was precisely my point.

What I had written, in response to his request for comments on his paper, was a long series of capital letters, broken into random threes and fours, and crammed mercilessly into already overburdened parentheses. Looking again at his own first page, he burst out laughing. Terminal acronymia, to be sure.

In the first paragraph, not one sentence consisted entirely of English words. Several consisted almost entirely of acronyms, some of which were being used to explain other acronyms. Some were not explained anywhere in sight, an apparent revision having bumped the definitions to subsequent pages. Still others were left entirely to the imagination, an option far more appealing than deciphering the text. I finally decided that DSAG stood for “desperately seeking a glossary.” “But everyone in my group understands these,” the gentleman protested, shaking his head. Perhaps, but his group wasn’t the intended audience. Who were the authors writing for? By definition, the goal of publishing is to reach a wide audience. Reaching them, though, is only the beginning.

Clearly, as technical writing becomes more widely disseminated through journals, conferences and the Internet, vital participants are being increasingly left out of the process: the readers. This is a trend that needs to be reversed before it renders technical writing pointless and therefore obsolete.

Respected engineering journals such as Hazard Prevention regularly publish articles that were originally written in a language other than English. No one would recommend publishing the original in an English language magazine because the majority of readers wouldn’t understand it; and yet authors continue to publish articles in a language that no one understands. For scientists, the logic must confound.

Those readers for whom English is a second language are being asked to learn a third one and translate twice. All readers are being asked to memorize definitions, or else to constantly flip back and forth. And what is their reward? The opportunity to try to forget this batch of acronyms and clear their brains for the lot in the next article. Yet authors seem to be oblivious, as they compete to create new and more imaginative acronyms to perpetuate the cycle.

The most baffling fact of all is that it seems much more excusable to publish in a foreign language than to ask engineers to separate from their acronyms. They have forgotten that other means of expression exist. “But I don’t want to say System Safety Working Group when I can say SSWG.” Of course you don’t. Say it once, and then “the group” will work just beautifully. After all, “the group” has two syllables, while “SSWG” has six. This is economizing?? Now think about other substitutions for most of your acronyms: “the system”; “the engineer”; “ review team”; “book”; “test suite.” And do we really need an acronym to say “start the engine,” “close the file” or “notify the boss”? Words are a scientist’s most powerful tool, since without them the others are meaningless.

“Words work. They have amazing clarity, speed and precision – if only people will take a shortcut and use them!”

Look at the bright side. With fewer acronyms you won’t have to worry about inadvertently spelling a word (as an embarrassed associate recently did with Numeric Engineering Requisition Directives), conveying the wrong image (as another did with GYN) or staring at a page for twenty minutes trying to figure out how to say it quickly (as a rushed proposal team did with NAWSEAWARENGSTA). Words work. They have amazing clarity, speed and precision – if only people will take a shortcut and use them!

Hazard Prevention has adopted a policy of ensuring that the articles we publish will be understood by a majority of its readers. In many cases, this means translating acronyms into plain English. We have entered into a brave and wondrous new world. Won’t you join us? Your readers are eagerly waiting.

About the Author

Ann Waterman is the former Editor-in-Chief and Publisher (1997-2007) of Hazard Prevention, the journal of the System Safety Society. She is a former director of the Society and the 2005 winner of the Society’s International award.

by Anonymous and George Kondreck

[Editor’s note: This letter to the editor and editor’s response originally appeared in Vol 27 Issue 3 of Hazard Prevention (now Journal of System Safety) in 1991. It has been reformatted from the original, but the text is otherwise unchanged.]

Dear Editor,

Mr. Berry’s recent essay in Hazard Prevention, “Is System Safety The Answer?” contains many interesting points. This letter addresses only his statement that “As a result of an undefined career path, the appeal of system safety to young professionals is low. ” I would agree with his statement, if it were reworded to say “As a result of what appears to be an undefined career path …“  In either case, corrective action of the society is needed.

A major cause for this problem is that our society and many of its members speak and act as if system safety is, or should be, a life-long career. It may be true that system safety is a life-long career for many system safety practitioners, it isn’t true for all of us. For some of us, system safety is part of a broader professional career. I believe that we could attract more professionals (new and experienced) to system safety if we made it clear that system safety can be part of a broader career plan. I also believe that we can show that safety professionals who have non-safety experience and aspirations are a valuable asset to safety and non-safety management and to system safety “lifers.”

To illustrate my point, I cite my own experience. My career goal has always been to be a versatile engineer who could command a good salary while working on things of interest to me. I first became involved in safety 20 years ago after working 16 years in design, project engineering, and quality. During these last 20 years I have gone from safety to quality to reliability to safety to design to safety to systems and back to safety. Each change was at my request. Each was designed to promote my career as an engineer (not as a system safety engineer). My experience in each specialty has made me more “salable” as an engineer in the other specialties. It also permitted me to bring new perspectives to my safety peers and to promote system safety in non-safety organizations. Finally, it resulted in two promotions beyond what is normally considered to be ‘the end of the line” for the engineers who choose not to go into management. These promotions would not have occurred if management didn’t believe that broad experience is important. The promotions resulted in pay equal to or better than that of some managers for whom I worked. In other words, system safety helped me attain career satisfaction.

My experience is not unique. I know others who have had similar experience. I know people who had non-safety experience, became system safety managers. moved on to management of other activities, and then rose to high positions in corporate management. And I know persons who started their careers in system safety and are rising up the corporate ladder in non-safety areas. I believe that many Hazard Prevention readers know of similar career success stories.

To help attract professionals to a career in system safety, the society and its members should publicize the success stories and stop lamenting perceived but nonexistent career limits. The society should also encourage its members to define their own career paths and to use their own initiative to attain their career objectives.

Name withheld by request

The author of the letter makes two very valid points that I would like to expand upon. First is that system safety need not be a lifelong career, and second, that the Society and its members are responsible for promoting the profession, either as a career or as part of a career.

Many times, in this space, I have mentioned that I believe the discipline of system safety to be a part of systems engineering. One of the aspects I like best about this job is the broad overview of the system that it gives me. Like systems engineers, system safety engineers specify requirements, analyze design concepts and verify performance across a variety of subsystem disciplines. Only the lead systern engineer has a broader view of the system than the system safety engineer. In that respect, system safety is more easily a path to lead systems engineer than to any other defined role in engineering That can be a very senior engineering position depending on the scope of the system involved. That is also a career path to program management and beyond. I don’t see a limitation here, but an opportunity.

In this space I have also commented on the fact that the system safety perspective of the system is slightly, but significantly, different from the systems engineering perspective. We have to concentrate on adverse effects of normal operation and malfunctions. The system engineer strives to achieve a performance goal, considering only how malfunctions and normal operation contribute to or inhibit that goal. However, the more I practice system safety, the more I see the systems engineer’s viewpoint. When I review system specifications, test procedures and other analyses, I not only derive the safety impacts, but also achieve an appreciation for their contribution to the successful outcome of the program. Also, the more I interact with systems engineers, the more I see an appreciation in them for my perspective. A good system safety engineer should be a good systems engineer.

I believe that if we promote system safety as a part of systems engineering we will enhance the profession both with attracting new engineers and with its reputation among other engineers. If a “tour” in system safety were a part of the career path of systems engineers, it would broaden the young engineers’ experience and provide the infusion of diverse talent that this profession needs. System safety need not be a lifelong career, and for many engineers it should not be. That “locked-in” attitude would discourage most from entering the profession, even for a brief sojourn.

Of course, if we are to promote system safety as not only a career, but also a part of a larger career path, we must better define the practice. MIL-STD-882X is not sufficient. We must promote system safety courses in universities as a part of the systems engineering curriculum. We must also change some of the attitudes in the various industries in which we work. Many of them still don’t see the difference between the industrial safety engineer and the system safety engineer. We need to talk to management about setting up rotation programs to allow promising systems engineers the opportunity to practice system safety for a period of time. And we should, as the included letter mentions, pub licize the success stories. I’m all for pub lishing anything to do with system safety, now if I could just find the authors…

As always, the future of this profession is in the hands of the professionals. We can moan about the lack of respect the profession generates, the lack of funds, the lack of manpower, etc., or we can take a more proactive role. It really is up to us.

– GK (George Kondreck, Technical Editor, Hazard Prevention, 1991)

More perspectives on the system safety profession: