By John H. Reed, Chairman NTSB (1969-1976)

[Editor’s Note: This address was delivered in the 1st Annual International System Safety Symposium in July 1973. It was originally published in Volume 10 Issue 1 of Hazard Prevention (now Journal of System Safety). Additional formatting, hyperlinks, and emphasis have been added, but the text is unchanged.]

I sincerely appreciate the opportunity to meet with you today to keynote this First Annual International System Safety Symposium. It is always a pleasure to share ideas with outstanding professional organizations such as yours.

I was particularly interested in the sub-theme of this symposium “The Application Of System Safety To The Protection Of The Public.” Safety, especially of the-traveling public, is, of course, the primary concern of the National Transportation Safety Board. It is the reason for our existence. 

In these remarks, I would like to highlight for you the challenges facing us in protecting the traveling public, now and in the foreseeable future. I am sure you will agree with me that we are indeed faced with a tremendous challenge if we wish to control the appalling death toll of our mobile citizenry. The use of the term “appalling” is not intended just for dramatic effect – the toll is truly appalling.

As former Transportation Secretary Volpe once noted: “Auto crashes have killed off more Americans than all our violent crimes and all the wars in our history.” We cannot let this loss continue unabated. The federal government is now attacking these losses through various forms of legislation action. However, the problems which face us cannot be solved by government alone. We need the dedicated efforts of safety specialists from all segments of the industry if we are to meet the challenge.

Before I proceed, let me briefly acquaint you with the role of the National Transportation Safety Board. The Safety Board was created in 1966 as an autonomous body within the Department of Transportation to serve essentially as the overseer of U.S. transportation safety. We have safety responsibility for all aviation transportation, and for the highway, railroad, marine and pipeline modes of transportation. The Board is composed of five members who are appointed by the President and confirmed by the Senate. We have two operating bureaus – the Bureau of Aviation Safety and the Bureau of Surface Transportation Safety, a much smaller but equally active organization. The directors of both bureaus, Mr. C.O. Miller and Mr. Henry Wakeland, as I am sure most of you know, are active members of your society. In fact, Mr. Miller is a charter member as well as a past president. I am pleased to note that both Mr. Miller and Mr. Wakeland were instrumental in the formulation of this program.

The mission of the Safety Board is twofold. We are charged with the determination of the cause or causes of all aviation accidents, and of selected surface accidents. It is also our responsibility to use this knowledge gained from our investigations to prevent recurrence of similar accidents. We do this predominantly by defining problem areas and by recommending to the appropriate parties changes which will correct the conditions which led to the accidents.

Now I would like to discuss the current safety status of our national transportation system. When measured by almost any yardstick, highway safety stands out as the number one transportation safety problem in the U.S.A. Out of a total of 60,789 transportation fatalities in 1972 (all statistics are from 1972), highway accidents accounted for 55,358 lives. In addition, the sixteen-plus million highway accidents which occurred in that year were responsible for about two-million injuries and a total property loss to the nation in excess of five-billion dollars.

The next biggest killer among our transportation modes was our railroad system, with 1,922 fatalities, followed closely by the marine mode with 1,871 total fatalities. In these two modes, 70 to 80 percent of the total fatalities were those associated with the general public – grade crossings in the case of the railroads, and recreational boaters in the marine mishaps.

The next mode, in descending order of the number of casualties, is aviation, with a total of 1,534 lives taken. Although our air carriers accounted for only 190 of these, the impact of air carrier accidents should not be minimized. Few fatal accidents create more public concern than do those involving air carrier airplanes, and the relatively few fatal air carrier accidents account for a disproportionately high percentage of the total property and equipment loss resulting ‘from all-transportation accidents. Nor is the true hazard potential reflected in these statistics, since the crash of a fully loaded Boeing 747 into a highly populated area could produce an immense death toll.

Pipeline accidents killed relatively few people last year. but here again, accident statistics can be misleading since the potential for catastrophic losses is possibly greater in the pipeline area than in any other mode.

At this point let us look at what the future holds in store. We have seen ever-increasing sophistication in all transportation systems, as evidenced by the evolution of the DC-3 into the DC-IO, and we will see a rapid growth of complex new systems such as high-speed railroad trains. The increased complexity of these systems creates greater problems in the discovery of hazards and assessment of risks, increases the cost of safety improvements, and complicates the investigation of accidents involving these vehicles.

Another problem which is challenging our ingenuity is the transportation of hazardous materials. Our expanding energy usage is resulting in the transportation of much more fuel of all types. This, of course, creates greater hazard potential for the modes involved, especially as these cargos are being concentrated into larger loads. We have seen examples of this in our supertankers, in the increased size of barge tows, and in large, widebodied jet cargo freighters.

Although our past efforts have been primarily safety oriented, our problems are no longer limited to those of saving life and limb. Social considerations now demand that we reduce the waste and pollution caused by transportation losses. In this respect, problems such as reduction or containment of oil spills from our tankships loom as a large challenge to all of us, and they will be increasingly more important in the years ahead.

Now, having reviewed the challenge facing us, what are we to do about it?

The Safety Board sees two general areas in which we believe your efforts can produce maximum results. The first of these is the need for further utilization of your knowledge and technology in all modes of transportation. Then, we need a rigorous application of system safety principles to our national transportation problems in order to direct our national safety efforts and obtain maximum benefits from our limited fund resources.

With regard to the first area, the technology and lessons learned in aviation should be applied to other forms of transportation. Those of you associated with air carrier aviation are fortunate indeed, because your accident prevention technology is highly developed compared to that of some other modes, such as highways or recreational boating. The present air carrier accident rate is evidence of continuous attention to safety.

With respect to aviation, at least, I think we can say that system safety has come of age, and that this is the time to consolidate our gains. We need to standardize and simplify techniques, and to improve the communication of practical solutions throughout the entire transportation system. This is the reason I was happy to learn of the first international gathering of system safety specialists. This is indeed a major step in that communication.

The Safety Board, since its establishment, has been anxious to disseminate new information on scientific safety methods. Our first system safety-based recommendations were made just a few months after our inception. Our two bureau directors are firmly committed to the use of this approach when it can be helpful, both in our internal accident investigation procedures and in our general safety efforts. The Board is the only agency within the Department of Transportation where transportation specialists in all modes are gathered in close association. Our success in transferring technologies among modes is one of the major forms of improvement of Department of Transportation safety approaches: We have actively transferred system safety techniques from aerospace into rapid transit, pipeline, and the marine fields; we have promoted the use of highway crash injury prevention techniques in the railroad and rapid transit fields; and we have been instrumental in applying aviation crash survival and escape requirements to the intercity bus and school bus industries.

As a result of the gains made, we believe that a strong foothold has been established for the methods which you have done so much to establish in the defense electronics and aerospace fields. We have made advances in almost all means of transportation; however, we are conscious of the fact that the national effort in some areas – notably highway safety – is still largely limited to finding remedies after the accident. This after-the-fact approach has evolved because, unfortunately, in the various means of transportation where the need is greatest – general highway operations, recreational boating, and to a lesser degree, general aviation – system safety has not yet been generally applied. System safety efforts are best applied in systems characterized by unitary control and well defined and controlled operations. In highway passenger car operations, there exists a diffusion of authority which makes changes difficult. Even in this mode, however, certain individual elements of the system safety technology such as gross hazard, failure mode and effects, and fault tree analyses might be profitably employed. However, I believe that much stronger effort will be required in order to solve the general problem of evolving our highway safety technology into a predictive, first time safe approach.

We at the Safety Board believe that, in the surface modes, system safety is closest to realization in rapid transit operations, followed by pipelines, and then by any new project starting on the drawing board. In these and in other areas, we have made recommendations which have advanced the cause of system safety. The earliest of these recommendations was that system safety concepts be applied in the Tracked Air Cushion Research Vehicle project. Then we recommended system safety application to the Washington Metro system. We also recommended that the Urban Mass Transportation Administration require submission of system safety plans as a condition for every request for capital grants and. in a special study entitled. “A Systematic Approach to Pipeline Safety,” the Board recommended the application of system safety to the entire field of pipeline safety.

Actions which we believe are highly significant have been taken on our recommendations. For example, in response to our recommendation, the Urban Mass Transportation Administration hired a system safety staff and developed a plan for implementing system safety in projects involving approximately one billion dollars of capital equipment. Also, recommendations regarding pipeline safety developed in our pipeline study are being actively taken into consideration by the Gas Piping Standards Committee of the American Society of Mechanical Engineers.

In addition to the statutorily authorized promotional aspects of our efforts, the Safety Board also has a functional role in the system safety cycle. In this cycle there is a task which is often simply defined as feedback. This, as you know, is the stage when service experience is fed back into the system to assist in identifying potential hazards and potential problem areas.

2023 Accident Facts:

• U.S. automobile fatalities peaked in 1972 around 55,000 deaths
• U.S. automobile fatalities reached their lowest since then in 2011 at 32,500
• Since 2011, U.S. fatalities are up 32%
• Worldwide, approximately 1.35 million people die on roads each year.

The Safety Board detects safety deficiencies by our accident investigation activities. and we make these known to the public and to those with safety responsibility by our recommendations.

Our accident experience also provides a valuable source of statistical information about our aviation transportation systems. Such records permit identification of significant trends by comparing the present operation of a system with its past operation. At present, we have this capability only for aviation. In the surface modes we are not only hampered by the lack of adequate data sources, but also by the fact that there is no single centralized source for storing all accident data. The Board is now striving to have established a unified, collocated accident data system which encompasses all modes.

With respect to the paucity of accident data, I should note that the NTSB is the only federal-level organization which investigates or determines cause for accidents in all modes. We are also, I might add, the only agency which investigates solely to aid accident prevention, with no interest in law enforcement proceedings. Thus, we believe that the Safety Board, by acting as the focal point for safety activities of all modes, is ideally situated to provide the impetus for system safety activities. We are a primary source of intermodal accident data. We can serve as a clearing house for safety ideas because of the public exposure we obtain by issuing reports and recommendations, by holding forums and public hearings, and by participation of our personnel in activities such as this symposium.

In summary, I believe that because of the efforts of many dedicated persons such as yourselves, transportation safety has, in some modes, reached an admirable level in this country. But we can’t rest on our laurels. We must now strive to further improve the safety levels of all modes. and we must master the problems which our rapidly advancing transportation systems will be presenting us in the future. These are problems which cross all technological, economic, sociological, and political boundaries. They are problems which will only be solved by a rigorous, total systems approach to our national transportation needs. This is a job which will require the combined efforts of government, industry, and our universities, and you ladies and gentlemen are the nucleus of the task force which must meet this challenge. I wish you well.

John H. Reed (January 5, 1921 – October 31, 2012) was the 2nd Chair of the National Transportation Safety Board and the 67th Governor of Maine. Later, Mr. Reed was twice appointed ambassador to Sri Lanka and the Maldives.

Join us for the 41st Annual International System Safety Conference!

by Warner Talso

[Editor’s note: this opinion piece originally appeared in Vol 38 No 1 (Q1 2002) of Journal of System Safety. The text has not been modified except for formatting changes, images, and hyperlinks]

Most of us are aware of the evolutionary, even revolutionary, changes that have been taking place in the system safety discipline. These include both technology and areas of application. It is time to review exactly what defines system safety, or at least what we perceive system safety to be. This is a “what” statement, not a “how” statement, and it should be a vision of what system safety encompasses. It is important because it is the key ingredient of what binds us together. It shapes how we see ourselves and how we describe our profession to others.

Recall our origins in the Air Force aerospace arena. The discipline was, and still is, defined by MIL-STD-882. This document has been consistent in defining system safety as, “The application of engineering and management principles, criteria, and techniques to achieve acceptable mishap risk within the constraints of operational effectiveness and suitability, time, and cost, throughout all phases of the system life cycle.” [1] This definition has served us well over the years. However, the discipline was driven by the Department of Defense’s (DoD’s) mandating the implementation of 882. Our Society coasted along on the coattails of this mandatory requirement, with little effort to preach the gospel of system safety or seek out new applications.

This all changed when the Berlin Wall came down and the DoD was no longer driven by the threat of the Union of Soviet Socialist Republics. Remember the de-emphasis on military standards? All of a sudden we had to become proactive in promoting system safety and saving our Society. We have been successful to varying degrees. As the Society reaches out to new members and new industries, the definition of system safety is the shorthand version of what identifies us. I submit that it needs to be more than the military-oriented definition of 882.

Speaking of the Society, what does the Constitution say about defining system safety? Section 1.3 of the Constitution doesn’t define system safety per se, but says: “The term ‘system’ as used herein shall be considered to include any product, service and/or activity developed, produced and/or managed by a specific person, agency, or organization for a designated purpose.

The term ‘safety’ as used herein shall be considered to include any technical, social, educational, and/or managerial action initiated for the purpose of eliminating or reducing the hazards (i.e., risk of property loss and personal injury) associated with a procedure or system.” Well, there certainly are a lot of words there. It is a little verbose and not as focused as it could be. Note that the environment is not mentioned. In today’s world, should it be?

When Perry D’Antonio was our Society President, he wrote the following definition of system safety for the Society’s strategic plan: “The system safety concept is the application of special technical and managerial skills to the systematic identification and elimination or control of hazards throughout the life-cycle of a system.”

This definition of a system includes not only the product or the process, but also the influences (stresses) that the surrounding environment (including human interactions) may have on the product’s or process’s safety performance. A “system,” therefore, defines the boundaries to which the systematic process of hazard identification and control is applied.

When Dick Stephans and I have presented tutorials on the System Safety Analysis Handbook, [2] we have defined system safety as “the application of system engineering and management principles, criteria, and techniques to take positive steps to optimize all aspects of safety within the constraints of operational effectiveness, time, and cost.” We have emphasized the system analysis/engineering/management process and the need to be proactive.

One of our chapter members is performing software system safety work on a very large project. The client is so impressed with our chapter member’s grasp of the systems approach that the member has been asked to do other systems management and engineering tasks. This anecdotal evidence supports my contention that the system approach is very important to the system safety discipline, and is an engineering and management skill in its own right. In my observation, we do not put enough emphasis on the systems approach of looking at the impact of hazards (i.e., potential sources of danger) to the entire system.

When Clemens and Simmons wrote the National Institute for Occupational Safety and Health (NIOSH) Instruction Manual for System Safety and Risk Management, [3] they did not specifically define system safety, but they did identify the two primary characteristics as “(1) it is a doctrine of management practice that mandates that hazards be found and risks be controlled; and (2) it is a collection of analytical approaches with which to practice the doctrine” (emphasis in the original). This definition introduces management decision-making. This is very important. As Steve Mattern has pointed out in several articles, the system safety practitioner must show value added to the project. The practitioner must be seen by management as a worthwhile member of the team. Recognition of the value of system safety is accomplished by making a positive contribution to managers and the decision-making DOE process. Should this be part of the definition?

The OSHA regulation on process safety management (PSM) provides “an integrated approach to chemical safety, putting the focus on a comprehensive management program.”[4] I don’t think there is any argument that this PSM regulation is an application of system safety. Again, we have an emphasis on management. By the way, why doesn’t the Society have greater representation in OSHA because of PSM, and in the EPA because of Risk Management Planning (40 CFR Part 68)? Just asking.

The tragic events of September 11 should be ample reason alone to reevaluate our discipline. Was not the safety (and security) of the World Trade Center a systems issue? How could we have been involved in preventing this event (security) or mitigating the damage (safety)?

Sandia National Laboratories does research on critical infrastructures encompassing communications, transportation, banking and finance, and several other complex systems. The term high-consequence surety has been coined to identify the safety, security and reliability controls associated with preventing catastrophic events. One such critical infrastructure is municipal water supplies. These are complex systems involving pumping, treatment and distribution processes using highly computerized control systems, and are considered attractive targets for terrorists. The system safety approach allows one to see the broad hazards and evaluate the acceptability of the controls associated with preventing undesired consequences to these processes. One observation of this work is that safety and security are closely related.

The Department of Energy (DOE) has created the Integrated Safety Management System (ISMS) [5] process to apply a systems approach to safety. This is part of the “Work Smart” process. [6] ISMS defines a five-function process for incorporating safety into the workplace that is almost identical to the system safety process.

As an aside, DOE never calls this a systems approach, nor does it use the term system safety. DOE is now testing the concept that the ISMS approach can be used for security. The above examples raise an interesting question. Should security be included in the definition of system safety? Is there a System Security Society (SSeS) or a System Surety Society (SSuS) on the horizon? Do we want to lead the way in this area?

In summary, I believe it is time to review the definition of system safety to make it reflect the world of today, and to help us better understand our profession and enlighten our associates and friends. A few ideas:

• The definition should include more than just military systems. Recognition of industrial systems, medical systems, software and more should all fit under the umbrella.
• The proactive, positive nature of system safety should be recognized. There should be more recognition of system engineering and management.
• There should be recognition of management decision-making.
• The environment should be addressed.
• The definition should be included in the Society’s Constitution.

A great deal of information could be included. You will have your own ideas. Decisions have to be made. Perhaps we should also promulgate a set of principles to support the definition.

References:

1. MIL-STD-882D, “Department of Defense Standard Practice for System Safety,” Government Printing Office, February 10, 2000.
2. Stephans, R.A. and Warner W. Talso, Eds. System Safety Analysis Handbook, System Safety Society, Unionville, VA, 1993.
3. Clemens, Pat L. and Rodney K. Simmons, System Safety and Risk Management, National Institute for Occupational Safety and Health, Cincinnati, Ohio, March 1998.
4. 29 CFR 1910.119, Process Safety Management, Government Printing Office, July 1972.
5. DOE G 450.3-3, “Tailoring for Integrated Safety Management Applications,” U.S. Department of Energy, Washington, DC, February 1997.
6. DOE G 450.3-1, “Documentation for Work Smart Standards Application: Characteristics and Considerations,” U.S. Department of Energy, Washington, DC, February 1997.

Warner Talso is a former New Mexico Chapter President and SSS Director of Member Services. He was the Treasurer of the New Mexico Chapter. Along with Dick Stephans, he was also co-editor of the System Safety Analysis Handbook, a renowned and landmark system safety publication.

(Photo: Warner Talso, right, receives the ISSS 1994 Educator of the Year Award from Mike Brown, left.)

Don’t miss our annual event. Register here.

Also by this author:

By Donald M. Layton

[Editor’s Note: This opinion piece originally appeared in Volume 9 Issue 3 of Hazard Prevention (now Journal of System Safety) in January-February 1973. It is unchanged except for formatting and minor corrections.]

Anyone who has attempted to recruit new members for the System Safety Society has heard the question. “What does the Society do, and what can it do for me? ”

Some of the answers to this multiple-question may be found in an excellent folder which is available from the Society Administrative Office, 6060 Duke Street, Suite 101. Alexandria. VA 22304 [Ed.: see here].

Included in this folder are two items of prime importance to prospective members and to present members as well. These are the listings of the objectives and the activities of the System Safety Society.

OBJECTIVES

1. To advance the state-of-the-art of system safety.

2. To contribute to a meaningful scientific and technological understanding of system safety.

3. To disseminate newly developed knowledge to all interested groups and individuals.

4. To further the development of the professionals engaged in system safety.

5. To improve public understanding of the system safety discipline.

6. To improve the communication of the system safety movement and discipline to all levels of management, engineering, and other professional groups.

Let us consider these objectives and see what is being done, and what could be done to meet them.

The Society was founded in 1962 as a non-profit, professional association and was registered in the State of California as the Aerospace System Safety Society, inasmuch as the formalized principles and the term “system safety” originated in, and was principally applied by, the aerospace industry at that time. The original Society consisted of about thirty members.

With the expansion of the Society’s scope to include all product/system safety activity and personnel in other fields, the label, Aerospace, was dropped from the title in 1966.

Individual and group efforts to achieve the objectives have not been limited to those who wear the “Two Sigma” pin, but many of the members of the System Safety Society have consistently been in the forefront of such activity.

One of the most obvious examples of the improvement of communication and the dissemination of matters of safety interest has been this publication, Hazard Prevention. Begun as a newsletter under the direction of the Society’s Founder, Roger Lockwood, the publication was formalized by its first official Editor, Dr. George A. Peters. When the pressure of his business forced George to relinquish this position Roger once again assumed the leadership until Jim Johncox assumed the Editorship.

The majority of the credit of the current size and format of Hazard Prevention can be given to the last three Presidents of the Society – Jack Parrish, who started the new format; Roy Harris, who started the page growth; and Ed Fosler, who has brought a whole new concept to Associate Editors, increased page count, support through advertising and Corporate Memberships, and increased emphasis on submitted articles.

Discussions had been occurring in the Board of Directors meetings for several years as to the sponsorship of an annual symposium, but with the caution that was derived from the desire to make such a conference a meaningful expression, many delays were incurred. As somewhat of a “trial run.” the Southern California Chapter agreed to sponsor a “mini-symposium” (an idea proposed to the Board of Directors by Willie Hammer of Hughes Aircraft) which proved so successful that they have now completed a second one-day symposium. And now finally, plans are underway for the First Annual International System Safety Symposium to be held in Denver in July 1973 under the Chairmanship of George Cranston.

Now to “old timers” in the Society the above information is well known, but a significant point is centered in these facts. I have mentioned but a few of those active in the Society, but if I were to continue the listing of former Society and Chapter officers, members of the Board of Directors, contributors to Hazard Prevention and participants in the other activities of the System Safety Society, I could. probably identify several dozen SSS members who have been or are now active to some degree.

But several dozen out of a membership that exceeds seven hundred is a rather small percentage!

And so, my fellow Americans: ask not what your country can do for you — ask what you can do for your country.

– John F. Kennedy, Jan 20, 1961

So, before someone asks us what the System Safety Society can do for its members, let us ask ourselves, in a paraphrase of the words of the late President John F. Kennedy, “What can I do for the System Safety Society?”

One of the most obvious things that can be done is the recruitment of new members. There are, of course, the lofty reasons for increasing our membership – reasons such as the improvement of our professional knowledge; making what we have to offer available to all in the field, and the bestowing of our prestige gained  from being members of an august society to others, but there are more practical reasons for encouraging a membership growth. These include the benefits of national (and international) recognition that comes from representing a majority of those involved in System Safety, conservation of financial resources in the way of administrative costs (which increase at a much slower rate than the membership they support), and greater return to the members in the form of services such as local and national meetings, publications, speakers, and Society sponsored pressure on standards and member privileges.

Another way in which each member may be of service is in participation in Chapter and National society affairs. I don’t propose that every member immediately run for an office, but support would be welcome at all levels. At the Chapter level, for those of you who are fortunate enough to be near an active group, assisting with the newsletter, aiding in obtaining speakers, contacting potential members, and even such a simple task as being in charge of the name tags for the meetings o ‘collecting the money for dinner would take some of the load off those few who are doing most of the work.

And don’t forget Hazard Prevention. If you don’t have an article that is anxious to be printed, perhaps you have an idea that someone else could expand so that others might have the benefit of these thoughts. One of the few direct benefits that we offer to the members is this publication, and it will only be as good as the members make it.

A most important manner in which you can help the Society and system safety in general is to talk about safety to the non-safety types in your organization. Recently I sat next to a man on an airliner who was in charge of one phase of a company product – a product that was designed, manufactured, and partially maintained by his company. There were eight other men on the same plane who were part of a team that was involved in the setting up of this product for a consumer. Our conversation got around to system safety and this team leader stated that he had never heard of the term and had no idea that his company had such a program in force. I wouldn’t want to embarrass anyone by identifying the organization, but over the past few years we have had National officers from this company! And yet here was a person deeply involved in one of the company’s products who didn’t know of the existence of system safety.

If each of the current members of the System Safety Society did a little more for the Society the answer to the question “What can the Society do for me?“. would become so obvious to potential members that the question might never be raised. What have you done? What have you done lately? 

[Ed. – Current volunteer opportunities are on the society website. Submit your JSS manuscript here.]

Donald M. Layton was the former editor of Hazard Prevention and the 1984 ISSS Educator of the Year. He was a professor at the Naval Post Graduate School. He passed away in 2017 at the age of 94.

Don’t miss our annual event. Register here.

Also by this author:

By John Covan

[Editor’s note: This opinion piece originally appeared in Vol 35 Issue 4 of Journal of System Safety in 4Q 1999. It has been reformatted from the original, but the text is otherwise unchanged.]

I‘d like to begin a debate about the role of system safety in business.

I have often heard the complaint that safety (in particular, system safety) is viewed by system developers as a necessary evil – something that must be tacked on after the important decisions are made about system architecture and function. How many of us have heard, when trying to inject system safety into a new project, “Come back later, it’s too early for us to talk to you just now”?

Of course we know that to be maximally effective, system safety must be fully integrated from day one. But if we act as if system safety is at the top of the list and argue for our presence based on our company’s slogan (let’s assume it is “Safety is job one”), we will never achieve this integration.

In my opinion, nobody in upper management of the typical company believes that safety is the top priority. This simply reflects the cold, hard facts of business. In his March 1998 Atlantic Monthly article on the crash of ValuJet Flight 592 into a Florida swamp, William Langewiesche writes, “Safety is never first, and it never will be, but for obvious reasons it is a necessary part of the venture.” What venture? The business venture.

So what if you don’t work in the corporate, for-profit world? Does that mean you, as a government or military employee, are exempt from the “business” mindset? No, not for at least the last decade or two. Let’s face it, all the outfits we work for boil down in the end to a business of some sort, competing to produce goods and services and maintain the status quo. Maybe they don’t have a profit line, but they work pretty hard to grow their budgets.

Business people (including project leaders and upper management) tend to focus on words like functionality, marketability, cost and schedule. And why shouldn’t they? If they don’t tend to these issues, their business —- whether product or service – is at risk of failing from loss of competitiveness or other business deficiencies. But safety is not their long suit, and that does hurt their business.

Now, nearly three-and-a-half years after the crash, the lawsuits are still making the news. It was a high consequence event, especially in the business sense. One would think that the airline industry would have gotten busy and hired a phalanx of system safety experts to improve things. But recent press releases tell of improper hazardous materials shipments (the reason the ValuJet flight went down) continuing to flood the airways.

Consider the demise of the billion dollar offshore oil-drilling platform Piper Alpha by fire and explosion in the North Sea in 1988, with the loss of 167 lives. System safety could undoubtedly have prevented the accident by re-emphasizing safety culture as a necessary part of the profit motive, for example. And system safety could have mitigated the horrible consequences by redesigning the rig’s survival systems when the decision was made to retrofit for gas production. Yet the platform design and its management enjoyed no such benefits, and the system blundered forward to a predictable, catastrophic end. The business impact was a bitter pill to swallow – Occidental Petroleum left the North Sea, never to return.

So what’s wrong with this picture? It’s that missing or inadequate system safety is a business risk – just like any other business risk. Sounds simple, right? I don’t think so. If it were, I wouldn’t be writing this essay. The temptation for upper management to separate safety from other business concerns is strong. As long as this way of thinking persists, system safety will continue to be a day late and a dollar short.

To my way of thinking, the only road to success is convincing the powers responsible for designing, building and running systems to add system safety to their business toolkit. These people must become active partners in the process and understand it to its core. Only then will our tasks be elevated to the importance they deserve.

So what can be done to turn things around? Probably lots of things like educating the business community, CEOs and the like. Perhaps we can start with the SSS. What can we do to attract such an audience? Or, are there other avenues to changing the culture of the business community?

I would like to hear your opinions. I believe the SSS has a golden opportunity to reinvent itself and become inclusive of a broader audience. If we don’t, we will remain a bunch of specialists talking to ourselves.

About the Author

At the time of writing, Dr. John Covan was the Vice President of the New Mexico Chapter of the International System Safety Society and was a senior member of the technical staff with Sandia National Laboratory.

by Ann S. Waterman  

[Editor’s note: This editorial originally appeared in Vol 33 Issue 4 of Hazard Prevention (now Journal of System Safety) in 4Q 1997. It has been reformatted from the original, but the text is otherwise unchanged. We note that in the 25 years since this article was published, “terminal acronymia” has gone from novel phenomenon to global engineering pandemic!]

“I don’t know what this means,” he ventured hesitantly after glancing at my note. I smiled. That was precisely my point.

What I had written, in response to his request for comments on his paper, was a long series of capital letters, broken into random threes and fours, and crammed mercilessly into already overburdened parentheses. Looking again at his own first page, he burst out laughing. Terminal acronymia, to be sure.

In the first paragraph, not one sentence consisted entirely of English words. Several consisted almost entirely of acronyms, some of which were being used to explain other acronyms. Some were not explained anywhere in sight, an apparent revision having bumped the definitions to subsequent pages. Still others were left entirely to the imagination, an option far more appealing than deciphering the text. I finally decided that DSAG stood for “desperately seeking a glossary.” “But everyone in my group understands these,” the gentleman protested, shaking his head. Perhaps, but his group wasn’t the intended audience. Who were the authors writing for? By definition, the goal of publishing is to reach a wide audience. Reaching them, though, is only the beginning.

Clearly, as technical writing becomes more widely disseminated through journals, conferences and the Internet, vital participants are being increasingly left out of the process: the readers. This is a trend that needs to be reversed before it renders technical writing pointless and therefore obsolete.

Respected engineering journals such as Hazard Prevention regularly publish articles that were originally written in a language other than English. No one would recommend publishing the original in an English language magazine because the majority of readers wouldn’t understand it; and yet authors continue to publish articles in a language that no one understands. For scientists, the logic must confound.

Those readers for whom English is a second language are being asked to learn a third one and translate twice. All readers are being asked to memorize definitions, or else to constantly flip back and forth. And what is their reward? The opportunity to try to forget this batch of acronyms and clear their brains for the lot in the next article. Yet authors seem to be oblivious, as they compete to create new and more imaginative acronyms to perpetuate the cycle.

The most baffling fact of all is that it seems much more excusable to publish in a foreign language than to ask engineers to separate from their acronyms. They have forgotten that other means of expression exist. “But I don’t want to say System Safety Working Group when I can say SSWG.” Of course you don’t. Say it once, and then “the group” will work just beautifully. After all, “the group” has two syllables, while “SSWG” has six. This is economizing?? Now think about other substitutions for most of your acronyms: “the system”; “the engineer”; “ review team”; “book”; “test suite.” And do we really need an acronym to say “start the engine,” “close the file” or “notify the boss”? Words are a scientist’s most powerful tool, since without them the others are meaningless.

“Words work. They have amazing clarity, speed and precision – if only people will take a shortcut and use them!”

Look at the bright side. With fewer acronyms you won’t have to worry about inadvertently spelling a word (as an embarrassed associate recently did with Numeric Engineering Requisition Directives), conveying the wrong image (as another did with GYN) or staring at a page for twenty minutes trying to figure out how to say it quickly (as a rushed proposal team did with NAWSEAWARENGSTA). Words work. They have amazing clarity, speed and precision – if only people will take a shortcut and use them!

Hazard Prevention has adopted a policy of ensuring that the articles we publish will be understood by a majority of its readers. In many cases, this means translating acronyms into plain English. We have entered into a brave and wondrous new world. Won’t you join us? Your readers are eagerly waiting.

About the Author

Ann Waterman is the former Editor-in-Chief and Publisher (1997-2007) of Hazard Prevention, the journal of the System Safety Society. She is a former director of the Society and the 2005 winner of the Society’s International award.

by Anonymous and George Kondreck

[Editor’s note: This letter to the editor and editor’s response originally appeared in Vol 27 Issue 3 of Hazard Prevention (now Journal of System Safety) in 1991. It has been reformatted from the original, but the text is otherwise unchanged.]

Dear Editor,

Mr. Berry’s recent essay in Hazard Prevention, “Is System Safety The Answer?” contains many interesting points. This letter addresses only his statement that “As a result of an undefined career path, the appeal of system safety to young professionals is low. ” I would agree with his statement, if it were reworded to say “As a result of what appears to be an undefined career path …“  In either case, corrective action of the society is needed.

A major cause for this problem is that our society and many of its members speak and act as if system safety is, or should be, a life-long career. It may be true that system safety is a life-long career for many system safety practitioners, it isn’t true for all of us. For some of us, system safety is part of a broader professional career. I believe that we could attract more professionals (new and experienced) to system safety if we made it clear that system safety can be part of a broader career plan. I also believe that we can show that safety professionals who have non-safety experience and aspirations are a valuable asset to safety and non-safety management and to system safety “lifers.”

To illustrate my point, I cite my own experience. My career goal has always been to be a versatile engineer who could command a good salary while working on things of interest to me. I first became involved in safety 20 years ago after working 16 years in design, project engineering, and quality. During these last 20 years I have gone from safety to quality to reliability to safety to design to safety to systems and back to safety. Each change was at my request. Each was designed to promote my career as an engineer (not as a system safety engineer). My experience in each specialty has made me more “salable” as an engineer in the other specialties. It also permitted me to bring new perspectives to my safety peers and to promote system safety in non-safety organizations. Finally, it resulted in two promotions beyond what is normally considered to be ‘the end of the line” for the engineers who choose not to go into management. These promotions would not have occurred if management didn’t believe that broad experience is important. The promotions resulted in pay equal to or better than that of some managers for whom I worked. In other words, system safety helped me attain career satisfaction.

My experience is not unique. I know others who have had similar experience. I know people who had non-safety experience, became system safety managers. moved on to management of other activities, and then rose to high positions in corporate management. And I know persons who started their careers in system safety and are rising up the corporate ladder in non-safety areas. I believe that many Hazard Prevention readers know of similar career success stories.

To help attract professionals to a career in system safety, the society and its members should publicize the success stories and stop lamenting perceived but nonexistent career limits. The society should also encourage its members to define their own career paths and to use their own initiative to attain their career objectives.

Name withheld by request

The author of the letter makes two very valid points that I would like to expand upon. First is that system safety need not be a lifelong career, and second, that the Society and its members are responsible for promoting the profession, either as a career or as part of a career.

Many times, in this space, I have mentioned that I believe the discipline of system safety to be a part of systems engineering. One of the aspects I like best about this job is the broad overview of the system that it gives me. Like systems engineers, system safety engineers specify requirements, analyze design concepts and verify performance across a variety of subsystem disciplines. Only the lead systern engineer has a broader view of the system than the system safety engineer. In that respect, system safety is more easily a path to lead systems engineer than to any other defined role in engineering That can be a very senior engineering position depending on the scope of the system involved. That is also a career path to program management and beyond. I don’t see a limitation here, but an opportunity.

In this space I have also commented on the fact that the system safety perspective of the system is slightly, but significantly, different from the systems engineering perspective. We have to concentrate on adverse effects of normal operation and malfunctions. The system engineer strives to achieve a performance goal, considering only how malfunctions and normal operation contribute to or inhibit that goal. However, the more I practice system safety, the more I see the systems engineer’s viewpoint. When I review system specifications, test procedures and other analyses, I not only derive the safety impacts, but also achieve an appreciation for their contribution to the successful outcome of the program. Also, the more I interact with systems engineers, the more I see an appreciation in them for my perspective. A good system safety engineer should be a good systems engineer.

I believe that if we promote system safety as a part of systems engineering we will enhance the profession both with attracting new engineers and with its reputation among other engineers. If a “tour” in system safety were a part of the career path of systems engineers, it would broaden the young engineers’ experience and provide the infusion of diverse talent that this profession needs. System safety need not be a lifelong career, and for many engineers it should not be. That “locked-in” attitude would discourage most from entering the profession, even for a brief sojourn.

Of course, if we are to promote system safety as not only a career, but also a part of a larger career path, we must better define the practice. MIL-STD-882X is not sufficient. We must promote system safety courses in universities as a part of the systems engineering curriculum. We must also change some of the attitudes in the various industries in which we work. Many of them still don’t see the difference between the industrial safety engineer and the system safety engineer. We need to talk to management about setting up rotation programs to allow promising systems engineers the opportunity to practice system safety for a period of time. And we should, as the included letter mentions, pub licize the success stories. I’m all for pub lishing anything to do with system safety, now if I could just find the authors…

As always, the future of this profession is in the hands of the professionals. We can moan about the lack of respect the profession generates, the lack of funds, the lack of manpower, etc., or we can take a more proactive role. It really is up to us.

– GK (George Kondreck, Technical Editor, Hazard Prevention, 1991)

More perspectives on the system safety profession:

By Pat L. Clemens, PE, CSP and Warner W. Talso

[Editor’s note: This editorial originally appeared in Vol 31 Issue 1 of Hazard Prevention (now Journal of System Safety) in 1995. It has been reformatted from the original, but the text is otherwise unchanged.]

IN 1982, PAT CLEMENS wrote an article for Hazard Prevention that discussed several safety analysis techniques and documented 25 of them in a standardized format. This was the genesis of the recently published System Safety Analysis Handbook. It seemed appropriate to ask Pat to write the Foreword for the Handbook. This article is based on that Foreword and is adapted for Hazard Prevention by Warner Talso. Pat has presented a unique philosophical overview of system safety. The message is sufficiently timely and thought provoking us to merit this additional dissemination.

JUST WHAT IS SYSTEM SAFETY?

Many authors have offered definitions of system safety. There has been disappointingly little agreement among them. Even the military standard devoted to system safety has varied from one revision to another in defining just what system safety is. There is, in fact, disagreement as to whether the discipline is properly called “system safety” or “systems safety.” (The former has earned the greater favor among today’s more knowledgeable practitioners.)

Among those who practice system safety, dispute also surrounds definitions of even the most basic of concepts that are imbedded within the discipline – such elemental concepts, for example, as what constitutes a hazard, and what risk is. These inconveniences detract fom orderliness in the practice of system safety. Moreover, they impede the universality of understanding necessary for communication within the community of practitioners. Because system safety is a relatively new discipline, there are some who blame these problems on its youth. It’s true enough, after all, that in the more mature disciplines such problems were long ago put to rest. There is not likely a single mechanical engineer who would quarrel with the well-known and universally understood handbook definitions for mechanical stress or hydraulic pressure.

Youth alone, or age, may not be the explanation however. Mechanical engineering, after all, is a science-based discipline whose fundamental principles rest solely upon the physical laws of nature and on applying those laws to the solution of practical problems. This is not the case for system safety. There are no closed-form solutions available even to its most fundamental process – that of hazard discovery. And what subjective assessment of risk is wholly free of emotional bias? In system safety, one finds rich elements of philosophy interwoven with art (… and, sometimes, with guile!).

Despite uncertainty as to how to define system safety and its imbedded concepts, there is much less dispute that system safety may be described as incorporating both a doctrine of management practice and a collection of analytical methods which support practicing that management doctrine. It is the analytical methods rather than the management doctrine that are dealt with in this compendium. Those analytical methods have proliferated quite remarkably over the past two decades, and more is to be said of that below. Of the textbooks that are devoted to system safety, many treat no more than a few of the analytical methods. None treat them all. Thus, the practitioner has no single, comprehensive source book to which to turn for descriptions of them all. It is the principal purpose of this Handbook to overcome that shortcoming. Yet even this Handbook will not have succeeded at that purpose – at least, not for very long. At any moment we might choose, someone, somewhere, for better or for worse, is developing or modifying or improvising a new, “best-yet” system safety analytical method. More is to be said later on that issue, as well.

THOSE ANALYTICAL METHODS – TYPES OR TECHNIQUES?

It is too little recognized that, of the approaches to “doing” system safety, some of the so-called analytical methods are types of analysis rather than true analytical techniques. More than trivial wordplay is involved in drawing this distinction. The techniques address the how of carrying out the analysis. The types of analysis address the where, the when, or the what it is that gets analyzed. Thus, a Subsystem Hazard Analysis is a type. It deals with analysis (by whatever technique) at the subsystem level – i.e., where, rather than how. And as a type, Subsystem Hazard Analysis can be supported by applying any of a number of the techniques. Conversely, Failure Modes and Effects Analysis is a technique of analysis – a how -and it is applicable at many system levels varying, for example, from the subsystem level down to the parts-count level.

With few exceptions, the analytical techniques are divisible into two major sets: those that rely on a hazard inventory approach (e.g., Preliminary Hazard Analysis, Failure Modes and Effects Analysis) and those that employ symbolic logic to produce a conceptual model of system behavior (e.g., Event Tree Analysis, Cause-Consequence Analysis). Some authors think of the inventory techniques as inductive, whereas the modeling techniques are deductive. And, it is worth noting, many of the techniques are simply derivatives of others. Fault Hazard Analysis, for example, is indistinguishable in its basic methodology from Failure Modes and Effects Analysis, though many would argue otherwise with an inexplicable vehemence that both marks and mars this field.

THE CHOICE OF METHOD – AVOIDING FAILURE AT THE OUTSET

In the rush to “do system safety,” it is too often the case that inadequate regard is given to the important business of selecting, with rational care, the particular analytical method to be used – whether that method might be a type or a technique. Methods are selected on the basis of their current popularity, their fancied potency, or the affection developed for them by the individual practitioner, rather than on the basis of their worth at dealing meaningfully with the real technical issues at hand. Recourse to a well-constructed compendium of methods is a way of rendering this pitfall less perilous. This Handbook is such a compendium.

SUPERMETHOD LIVES ON!

The search for the ideal system safety analytical method moves inexorably onward! The notion will not die that there must exist, somewhere out there, one particular analytical approach that is overwhelmingly superior to all of the others. That notion will not die as long as there are charlatan, and shallow thinkers to perpetuate the myth. Of the many analytical techniques, each has its advantages and its shortcomings. Each has more or less virtue in some applications than in others. Recourse to a dispassionate, annotated compendium can help to guide in selecting the technique(s) for a specific application, but it can only help. Again, this Handbook is such a compendium.

No SUPERMETHOD? – WELL, SHUCKS… INVENT ONE!

Just as the search among existing analytical methods for the ideal one does not end, neither does the quest to invent the cosmically universal technique go unpursued. Even as physics struggles to develop a Unified Field Theory, system safety practice seeks to produce an umbrella-style approach to which all system safety problems will succumb. Indeed, the latest, ultimate, tine-size-fits-all analytical method is brought to us in the technical periodicals several times each year. (Often, these ultimate methods are given clever names that spell out catchy acronyms, and usually the papers that describe them have been given no benefit of sound technical review by peer practitioners.) The result has been a proliferation of Swiss-Army-knife-style system safety approaches that enjoy starburst popularity, then are seen no more.

Just as it was without recognized success that the van Gigch Applied General System Theory sought to provide an absolute system approach for any issue, so also have all such attempts in system safety practice failed, and largely for the same reasons. Students of operations research – a very responsible group too little heard from among system safety practitioners -are quick to point out that the variability of systems and the permutations of failure opportunities within systems make analyses of those failure opportunities intractable by a single analytical approach. It’s a rare Swiss Army knife, after all, that has both a bumper jack and a lobotomy kit in its inventory of tools. However, undaunted by the physical truth of the matter, we find among us those who do continue to develop equipment to measure the flatness of the earth with ever greater precision.

WHERE LIES LEADERSHIP?

The Baton of Excellence in system safety practice has passed from one domain of application to another during the past few decades. Among those who employ system safety methods to gauge and to control risk, the chief impetus for generating roles of leadership has been the perceived urgency of need. That element – the perceived urgency of need – was found in U.S. Air Force circles in the epoch of Minuteman development. From there, excellence in system safety practice became a DOD-wide imperative, propelled by the combined realization of success in the Air Force experience and the coming of ever more intense sources of energy under control by ever more complex systems. It moved next to nuclear power circles with the requirement for probabilistic risk assessment to support the licensing of reactor plants during the period when nuclear power seemed to offer hope of energy salvation. And from there, it came to be shared with NASA as manned rocketry had its beginnings and quantitative methods were considered necessary to ensure that risk was under appropriate control. It was there, during the Apollo days, that numerical probabilistic methods began to provide unpopular gloomy results, and NASA returned to less elegant, subjective approaches.

Now, in the post-Bhopal era and perhaps accelerated by the downsizing of the DOD, the Baton of Excellence in system safety practice has most assuredly moved into the private- sector chemical processing industry A recent OSHA standard, CFR 1910.119, will ensure that it remains there for a time – until it is seized upon by yet another field of endeavor in response to a Bhopal-like catastrophe in some other venue.

COUNTERING MALPRACTICE

Abuses abound in the contemporary practice of system safety This is the case, largely, because much of current system safety practice rests upon “art form.” There are few if any exact solutions to problems in system safety, no matter how well the practice might be supported by sophisticated analytical trappings. Art permeates the practice. Art invites constructive innovation, of course. But art rests upon subjective judgment rather than logic. Thus, art admits abuse. In addition to the opportunity for abuse that is provided by the art-nature of system safety practice, there is insidious motivation for abuse as well. Consider the end use to which the results of system safety analyses are put. Systems are analyzed as to their hazards, and those hazards are assessed as to their risks for a single reason: to support the making of management decisions. Management must decide if system risk is acceptable or if it is not. And, if risk is not acceptable, then management must decide what is to be done, and by whom, and by when, and at what cost.

Management decisions, too, are often arrived at through the raw practice of art. And they are decisions in which very serious interests are vested monetary interests, ethical interests, emotional interests, legal interests, interests involving reputation. Decisions favoring one of these interests are often in conflict with decisions favoring another. Thus, the making of management decisions is an art form that tempts introducing subtle elements of personal bias – bias to favor a particular interest. If one wishes to exercise that bias and to endow its exercise with the appearance of legitimacy, how might the wish be accommodated? Why not twist gently at the arm of another art form? Lean a bit upon the vagaries of system safety. In management practice, the distinction between a desired analytical result and one objectively reached can be indistinguishably blurred, the more so if the analytical result is one that rests on the exercise of an art rather than an exact science.

And so, abuses do abound in the practice of system safety. Some of those abuses arise out of ignorance, and some out of malevolence. And so, perhaps, it may always remain. But the abuses can be lessened in their prevalence and in their sinister character. They can be lessened through the dissemination of well ordered information, assembled by reputable practitioners, and effectively describing the elements of responsible practice. That is the principal purpose of the System Safety Analysis Handbook.

ABOUT THE AUTHORS

Pat L. Clemens, PE, CSP

Mr. Clemens is the Corporate Safety Manager for Svedrup Technology, Inc. He is a Director on the Executive Council of the System Safety Society. His experience includes being Past President of the Board of Certified Safety Professionals, a recipient of the System Safety Society Educator of the Year Award, and recipient of the IEEE Centennial Award

Warner W. Talso

Mr. Talso is a co-editor of the Safety Analysis Handbook published by the System Safety Society. He is currently a Safety Analyst for M. H. Chew C Associates working with the Department of Energy. He is a Lead Nuclear Quality Assurance Auditor, a Past President of the New Mexico Chapter of the System Safety Society, and a Past President of the New Mexico Chapter, Society of Logistics Engineers. He is the 1994 recipient of the System Safety Society Educator of the Year Award

More perspectives on system safety:

by Donald M. Layton

[Editor’s note: This editorial originally appeared in Vol 6 Issue 5 of Hazard Prevention (now Journal of System Safety) in June-July 1970. It has been reformatted from the original, but the text is otherwise unchanged.]

A quick perusal of a listing of professional engineering societies is enough to make one wonder if all of this is really necessary. Is a professional society really a necessary adjunct to one’s profession, or are such groups formed just to foster the whims of a small, elite group of people? Without pausing to assess the merits of any of the hundreds of other societies, let us take inventory of what SSS is, what it is doing, and what it may do in an effort to ascertain whether we really need the Systems Safety Society.

The concept of safety in industrial activity has been with us longer than it has been officially recognized. Some safety practices were implicitly recognized long before these practices were tagged with a formal title of safety. Industrial safety seems to have taken the forefront in the attempt to identify and eliminate hazards in production procedures. In general, however, these groups were concerned with the safety of preparation (manufacturing) and not in the safety of the ultimate consumer. But with the advent of forms of built-in consumer safety-under such appellations as product insurance, product assurance and even quality control, efforts began to be expended to eliminate or reduce the potential hazards before the product reached the hands of the consumer.

A System Safety Society charter and pin does not make a professional organization. If we are to achieve recognition as an association of the highest standards, we must work hard at it.

Many people in the safety field recognized at this time that there existed a need for an interchange of information in regard to methods and procedures, not only to improve the product, but also to lessen the load on those who were charged with safety and safety improvements.

In the late 1950’s, the concept of safety of the system vice safety of the bits and pieces began to be recognized, not only at the safety level, but even at higher levels of management. As the years progressed, the manufacturers found that specific safety efforts were no longer on a ‘nice to have’ basis, but now began to be included in work statements via the route of the Mil Spec and later, the Mil Std. At long last, there came to be a realization among other than the safety types that a concentrated safety effort across the board was not only a worthwhile task, but also that it might be funded by other than overhead.

The possibility of including System Safety as a discipline to stand alongside Reliability, Maintainability brought not only recognition to the safety engineer, but it also enlarged the scope and depth of his endeavors. It was about this time that a group of these dedicated safety engineers felt that the time was propitious to establish a formal association of those who were working in this field.

The mere establishment of such a society, however, is not an indication of its merits, but the post-formation activities of the System Safety Society have already demonstrated that this is going to be much more than a membership club. Interest in the promotion of the basic aims of the society has resulted in the chartering of local Chapters, all of which have active programs. This, in itself, is almost the ultimate in accomplishment for a national association, since the real strength of the SSS, or any other professional group, lies not in a strong upper hierarchy (although that is of prime necessity) but in activities on the personal level.

All of the functions cannot be focussed at the Chapter level, for by so doing, the activities will overlook and slight a great many of those who need to be reached. One danger that is always present even with an optimum local/national mix of activities is that the program and projects tend to become incestuous in nature. Although there exists a need to ‘spread the word’ among safety engineers, there is perhaps as great a requirement to indoctrinate those in other disciplines as to the necessities, peculiarities and advantages of a strong system safety engineering program.

An excellent example of the latter activity may be found in the participation of the System Safety Society in the annual Reliability and Maintainability Conference. (See Safety Has Its Day, this issue). Even before the establishment of SSS, there was a concentrated safety flavor to the meetings of this conference. Individuals (many of whom were among the founders of the Society) organized sessions and presented papers as early as 1965. This forum not only permitted those of like interests to talk among themselves, but also offered the opportunity for those of the related disciplines to gain a little insight as to what was going on in safety.

Now as to the future. Two great needs must be fulfilled if we are to improve the stature of the SSS to that of a truly ‘professional’ professional society. First, as a continuation and improvement of the effort that has already been seen at the R & M Conference, a concerted program to include safety-oriented papers in national meetings must be established and maintained. A quick look at but one segment, the AIAA, shows a minimum of seven meetings in the next year that could fit one or more safety papers into their general theme.

The second need is possibly even more urgent if we are to speak as the voice of System Safety. The origin of this association was in the aerospace field for it was here that the concepts leading to the Mil Spec were founded. But in our early growth there has been some evidence of the neglect of some of the other aspects of the safety community. This neglect is probably more due to external circumstances than to any internal workings, but now is the time to invite, persuade and even cajol such activities as nuclear, highway, rail, consumer product and industrial safety to join with us in furthering the cause. Of course, there are those in SSS who are representative of these fields, but we have only begun to tap this vital resource. There is an ancient axiom that states that we must profit from the mistakes of others since we do not have time to make all of the mistakes ourselves. It should be obvious that there have been lessons learned in other fields that may have direct or indirect application to some of the problems that we are facing.

How can we achieve this broadening of the base of the System Safety Society? One way is for local Chapter programs to include those from allied safety fields either as speakers or just as guests. Equally opportune is the offering of our services to talk about our problems (and solutions).

If you know of some group, such as traffic safety for example, that has some form of get-together, why not offer yourself for a visit to their meeting? The number of these groups and individuals in these fields (many who have never joined any society because no one ever asked them) is legion. Did you know that there is a society with a safety section that is called Women’s National Aeronautical Association of the United States, Inc.? They are a great bunch, but I wouldn’t want my sister to marry one of them.

A System Safety Society charter and pin does not make a professional organization. If we are to achieve recognition as an association of the highest standards, we must work hard at it.

[Editor Note: Donald M. Layton was the former editor of Hazard Prevention and the 1984 ISSS Educator of the Year. He was a professor at the Naval Post Graduate School. He passed away in 2017 at the age of 94. Read his professional biography.]

Please see these related posts:

by Brian M. Moriarty

[Editor Note (2022): This President’s message originally appeared in Vol 15 Issue 6 of Hazard Prevention (now Journal of System Safety) in Sept-Oct 1979. It has been reformatted from the original, but the text is otherwise unchanged.]

EDITORS NOTE (1979): The following presentation was made by our Society President Brian Moriarty on July 10, 1979, at the opening of the Fourth International System Safety Conference in San Francisco. It is reproduced for the benefit of the many members who were unable to attend the conference so each one may comment on the society’s objectives as Brian outlines them.

We have come to San Francisco to exercise our hazard control techniques. In many ways it is rather opportune that the entry of Skylab is not mapped over this area and I must compliment the committee on good planning for this time and date and the invitation sent to the many of us from the Eastern section of the United States who can join you here. With the last trajectory path of Skylab that I remember the termination path was going to cross Washington D.C. Therefore, I know that judicious use of the hazard control techniques has been exercised in seeking the Western region for this conference. However, I still remember the warnings given by NASA that we should keep away from the top floors of buildings to assure that we have no penetrations through the roof.

Our challenge […] should focus on developing system safety efforts that are “more effective, meaningful and comprehensive”.

I particularly remember our System Safety Conference in 1973 at Denver when Guy Cohen was able to give us first hand information regarding Skylab and its problem with the solar panel deployment. In many ways it is rather ominous that this time this satellite is with us again now in another phase of its life cycle, that being termination rather than initiation. This truly represents a life history of a particular project that many of you have personally followed with intense interest as System Safety Professionals.

The year of 1979 has been a year of action for Safety…perhaps in a manner that many of us did not expect nor anticipate related to accidents. The BART tunnel fire, Three Mile Island incident, DC10 accident and subsequent grounding, Nuclear waste disposal, asbestos disclosure, railroad derailments and collisions, pollution of chemicals in waste areas, etc. We learn from accidents in an even more penetrating manner that we, perhaps, exert in the initial design and development phase. However, it is quite obvious to us that the avoidance of accidents must come from the realization that a more thorough and complete examination of products and systems must be performed “up-front” in the concept, design and development and production and testing areas. A frontal attack to gain top management visibility and commitment on this need for examination is a clear and distinct mandate. The “cause and effect” relationship between the potential of hazards must be thoroughly disclosed and the alternatives for control must be acknowledged for action.

Yet I think you would all concur that this must not be “Cosmetic” as Chuck Childs very strongly brings out in his recent article in Hazard Prevention. If we, as System Safety Professionals, are going to be able to contribute to the hazard identification and control it means incisive questioning about the operation of a system and the use of a product…to the extent that the System Safety Professional becomes the “System Integrator“: System Safety in many ways grew out of the System Engineering discipline where it was totally necessary to know all facets of the design, production, operation and maintenance requirements with the perceiving examination of action to take in emergency when failures occur in the product or the system. We understand System Safety as a total examination in all aspects of the Life Cycle of the product or system to distinguish the eminent hazards, to identify the controls that can be applied, and to evaluate the risks associated with the types of controls that are available.

The very reknown Physicist Max Born commented on the nature of the Universe in pointing out that most things can be ruled into the “possible occurrences” and the “impossible occurrences.” However, he went one step further in recognizing that the controls to these situations occurring can be “sensibility” is a part of the examination of controls, so that “insensible” things do not become a reality. The direction of the System Safety professional is in acknowledging a practical, realistic basis of consideration of his findings that is attuned to “‘potential of the hazard” occurrence and “reasonableness of acceptability?”

There has been tremendous advancements in Science and Technology in the last years to increase the complexity of the hardware and controls of products and systems. This, in turn, has made it more difficult to perform System Safety Analysis. The incorporation of software and hardware has created the requirement to carefully understand the close relationship that these elements have. The rapid advancement of automated missile systems, controlled by a myriad of software programs has necessitated copious detailed analysis of the software and its impact in leading to undesired events for the missile. These same architectural happenings are occurring in rail transit, energy systems, space technology, automobiles, and manufacturing and construction areas, to name a few. A challenge that exists is for System Safety to continue to develop techniques and methods to assure the better understanding of software and hardware hazards and provide the total umbrella of knowledge of hazard detection before the equipments become operational.

The Three Mile Island incident has surfaced a unique problem in the ability to follow through with System Safety Analysis and corrective action methods from design to procurement, to installation, to operation and full turnover to responsive ownership.

The challenge that exists, in this instance, is to provide the safety management methods to assure that a total disclosure of hazards is done not only by the designer, but also by the installer, the user and the maintainer. Where needed proper regulation oversight may also be required to follow a consistent thread of safety in design to safety in practice. Again the life cycle aspects of System Safety bring us to the realization that performing the System Safety task in one element is NOT ENOUGH.

It must be accomplished across the board and traceability provided for all parties in order to not neglect responsive hazard control action.  In setting a course for the following year I have some basic goals that I would like to state to you and also have the chance to hear back from you concerning the method to implement them.

Our challenge for the 1980s should focus on developing system safety efforts that are “more effective, meaningful and comprehensive”. Special attention should be given to a true appreciation of the benefits, costs, risk assessment, criticality, and priorities for accomplishment of safety tasks and objectives.

Performing the System Safety task in one element is NOT ENOUGH.

The Society must improve its ability to provide to the membership basic knowledge concerning new and improved techniques, technical and management information, and to implement progress being achieved in academic education and membership professional development.

The Society’s objectives should be to provide meaningful services to its members and its officers should provide dynamic leadership to cooperatively advance the professional interests of its members. Specifically the following goals during this period are offered:

• To develop positive System Safety Education and Training Programs. This involves encouraging academic training in system safety and continuing mini-symposia on specialized topics for cooperation and support of safety conferences.
• To support activities that will result in professional development.
• To improve cooperative relationships with other organizations and Societies (around the World) with common objectives to facilitate exchange of information.
• To expand the recognition of Safety professionals by annual awards such as Safety of the Year, Safety Scientist of the Year, Safety Educator of the Year, Safety Manager of the Year, etc.
• To formulate and develop System Safety consensus standards for definition of program requirement standards relating to product and system safety development.
• To actively encourage more professionals to join in Society membership and participate in Society activities.
• To coordinate with legislative actions involving System Safety.
• To communicate to System Safety professionals in all fields through chapter activities, mini-symposia, conferences, and international activity.
• To expand and improve our means of the exchange of ideas, concepts, information, methods by increasing size and frequency of publications such as Hazard Prevention, the Journal for the SSS, Chapter newsletters, Conference proceedings, and other written publications.
• To encourage more company and group affiliations for System Safety instruction of all engineers in undergraduate programs.
• To encourage more company and group affiliations for System Safety Society membership.
• To make the System Safety Society a recognized “international forum” for the exchange of information on product and system safety.

The accomplishment of these goals is dependent upon the cooperation and participation of the membership. Every effort will be made to create and increase the opportunity for active involvement of the membership at all levels. The strength of the Society rests in each one of us performing at some level of activity and actively accepting some responsibility as a professional toward improvement of himself and thereby increasing the stature of the Society.

[Editor Note (2022): Brian M. Moriarty was a Past President of ISSS as well as the co-author of the book System Safety Engineering and Management.]

by John Livingston and Chad Thrasher

[Editor’s note: This Opinion piece originally appeared in Vol 40 Issue 1 of Journal of System Safety in January-February 2004. It has been reformatted from the original, but the text is otherwise unchanged.]

The motto on our System Safety Society coffee mugs proclaims that we are “Professionals Dedicated to the Safety of Systems, Products and Services.” But what are the attributes necessary to turn that dedication into effective practices that are the mark of an outstanding professional?

Most employment ads for system safety professions will list education, areas of expertise and years of experience as requirements. They may also require certain capabilities, such as strong communication skills (written and spoken), and an ability to navigate standard desktop tools such as word processing software. Some may even have the insight to ask for specific analytical skills or the ability to systematically address specific systems or processes. Advertisements for senior or management positions may add organizational or administrative skills to the list. Descriptions of openings for top-level positions may call for promotional skills that seem more appropriate for a “company cheerleader” than for the manager of a serious technical or analytical effort.

What makes an outstanding system safety professional goes beyond a desire to do our best and the possession of the kinds of technical knowledge and skills cited in the employments ads. There is a range of personal qualities that contribute to a higher and broader level of performance. These qualities, which make up our “System Safety Character,” are an important part of everything we do and must come to the forefront in crisis situations and in the making of key risk decisions. These include:

1. The ability to recognize potential risks and safety issues:

• A perspective and an imagination that identifies hazards, supported by an inventiveness that aids in the formulation of solutions
• The ability and enough healthy skepticism to recognize issues with proposed solutions to safety issues and false closure logic
• A thorough understanding of our risk analysis tools and the ability to apply them to real-life situations (which may require real-time solutions)
• A clarity and depth of vision of the safety aspects of the total operation, understanding the program as a whole and the interrelationships of the individual components

2. The ability to identify an issue must be coupled with a willingness to speak out. For example, the safety personnel present at critical meetings while Columbia circled the earth during the STS-107 mission were dedicated, and they knew the related safety assessments. Yet the Columbia Accident Investigation Board (CAIB) Report criticized their performance, noting,

“… safety personnel were present but passive and did not serve as a channel for the voicing of concerns of dissenting views.” “Safety representatives attended meetings of the Debris Assessment Team, Mission Evaluation Room, and Mission Management Team, but were merely party to the analysis process and conclusions instead of an independent source of questions and challenges.”

[CAIB Report, vol. I, p. 170]

The CAIB also drew discomforting parallels to the “silent” role of a previous generation of safety professionals noted in the Rogers Commission report on the Challenger accident in 1986. Part of the willingness to speak up is the acceptance that this may require taking an unpopular stand, even to the point of nonconcurrence with a majority opinion.

3. Every outstanding practitioner exhibits certain leadership qualities:

• The skill to “win over” others to their position, including the ability to present a position and defend it
• A sense of teamwork that encourages inputs from all parties involved
• The ability to focus on the issue and the search for the best solution
• A sense of fairness, honesty and respect for opposing positions

4. A sense of responsibility that acknowledges the expectations of the customer (developer and/or user of the product):

• Relentless pursuit of resolution of issues
• Meticulous system analysis (including hazard identification and resolution)
• Commitment to the role of safety advocate

5. The most overlooked quality in our system safety character is the ability to critically review our own performance. Successful self-assessment requires the application of all of our knowledge and skills. It requires an assessment of both the quality of the system safety effort (products and services) and how the effort is utilized. The CAIB Report observed that,

“Structure and process places Shuttle safety programs in the unenviable position of having to choose between rubber-stamping engineering analyses, technical efforts, and Shuttle program decisions, or trying to carry the day during a committee meeting in which the other side almost always has more information and analytic capability.”

[CAIB Report, vol. I, p. 187]

Clearly, this is not the kind of situation that leads to the best products or the most effective contribution to a program.

In short, we would submit that it takes more than dedication, knowledge, experience, special skills and even knowledge of the latest safety fight song. We would add system safety character, which includes a little common sense and a lot of true grit.

The authors, John Livingston and Chad Thrasher, are officers in the Tennessee Valley Chapter of the System Safety Society.