Hacker News Reader

Comment by psunavy03 | Hacker News Reader

Although I was never named to a mishap board, my experience in my prior career in aviation is that the proper way to look at things like this is that while it is valuable to identify and try to fix the ultimate root cause of the mishap, it's also important to keep in mind what we called the "Swiss cheese model."

Basically, the line of causation of the mishap has to pass through a metaphorical block of Swiss cheese, and a mishap only occurs if all the holes in the cheese line up. Otherwise, something happens (planned or otherwise) that allows you to dodge the bullet this time.

Meaning a) it's important to identify places where firebreaks and redundancies can be put in place to guard against failures further upstream, and b) it's important to recognize times when you had a near-miss, and still fix those root causes as well.

Which is why the "retrospectives are useless" crowd spins me up so badly.

View on HN

> it's important to recognize times when you had a near-miss, and still fix those root causes as well.

I mentioned this principal to the traffic engineer when someone almost crashed into me because of a large sign that blocked their view. The engineer looked into it and said the sight lines were within spec, but just barely, so they weren't going to do anything about it. Technically the person who almost hit me could have pulled up to where they had a good view, and looked both ways as they were supposed to, but that is relying on one layer of the cheese to fix a hole in another, to use your analogy.

Likewise with decorative hedges and other gardenwork; your post brought to mind this one hotel I stay regularly where a hedge is high enough and close enough to the exit that you have to nearly pull into the street to see if there's oncoming cars. I've mentioned to the FD that it's gonna get someone hurt one day, yet they've done nothing about it for years now.

Send certified letters to the owner of the hedge and whatever government agency would enforce rules about road visibility. That puts them "on notice" legally, so that they can be held accountable for not enforcing their rules or taking precautions.

The problem is that they are legally doing nothing wrong. Everything is done according to the rules, so they can't be held accountable for not following them. After all, they are taking all reasonable precautions, what more could be expected of them?

The fact that the situation on the ground isn't safe in practice is irrelevant to the law. Legally the hedge is doing everything, so the blame falls on the driver. At best a "tragic accident" will result in a "recommendation" to whatever board is responsible for the rules to review them.

All that applies for criminal cases, but if a civil lawsuit is started and evidence is presented to the jury that the parties being sued had been warned repeatedly that it would eventually occur, it can be quite spicy.

Which is why if you want to be a bastard, you send it to the owners, the city, and both their insurance agencies.

This is stupid. Unless you happen to be the one that crashes it won't be a factor at all.

Well, it could be; you can watch out for accidents at that intersection and offer to support a case arising from one.

If your goal is to get the intersection fixed, this is a reasonable thing to do.

you think it's reasonable to have 24/7 surveillance and then case support to get a hedged trimmed?

Discovery’s a bitch which is why they settle.

@Bombcar is correct. Once they've been legally notified of the potential issue, they have increased exposure to civil liability. Their lawyers and insurance company will strongly encourage them to just fix it (assuming it's not a huge cost to trim back the stupid hedge). A registered letter can create enough impetus to overcome organizational inertia. I've seen it happen.

In my experience (European country) even email with magic words "clear risk to health and life" can jumpstart the process.

People love to rag on Software Engineers for not being "real" engineers, whatever that means, but American "Traffic Engineers" are by far the bigger joke of a profession. No interest in defense in depth, safety, or tradeoffs. Only "maximize vehicular traffic flow speed."

In this case, being a "traffic engineer" with the ability to sign engineering plans means graduating from an ABET-accredited engineering program, passing both the Fundamentals of Engineering exam and the Principles & Practice of Engineering exam, being licensed as a professional engineer, and passing the Professional Traffic Operations Engineer exam. I think they do a little more than "maximize vehicular traffic flow."

> I think they do a little more than "maximize vehicular traffic flow."

You would be mistaken. Traffic engineers are responsible for far, far more deaths than software engineers.

Certifications prove that you studied, and are smart and or diligent enough to pass an exam.

If those certifications try to teach you bad approaches. Then they don't help competence. In fact, they can get people stuck in bad approaches. Because it's what they have been Taught by the rigorous and unquestionable system. Especially when your job security comes from having those certifications, it becomes harder to say that the certifications teach wrong things.

It seems quite likely from the outside that this is what happened to US traffic engineering. Specifically that they focus on making it safe to drive fast and with the extra point that safe only means safe for drivers.

This isn't just based on judging their design outcomes to be bad. It's also in the data comparing the US to other countries. This is visible in vehicle deaths per Capita, but mostly in pedestrian deaths per Capita. Correcting for miles driven makes the vehicle deaths in the US merely high. But correcting for miles walked (not available data) likely pushes pedestrian deaths much higher. Which illustrates that a big part of the safety problem is prioritizing driving instead of encouraging and proyecting other modes of transportat. (And then still doing below average on driving safety)

To be fair, there is no way to fix this in the general case—large vehicles and other objects may obstruct your view also. Therefore, you have to learn to be cognisant of line-of-sight blockers and to deal with them anyway. So for a not-terrible driver, the only problem that this presents is that they have to slow down. Not ideal, but not a safety issue per se.

That we allow terrible drivers to drive is another matter...

> there is no way to fix this in the general case—large vehicles and other objects may obstruct your view also

Vehicles are generally temporary. It is actually possible to ensure decent visibility at almost all junctions, as I found when I moved to my current country - it just takes a certain level of effort.

That's exactly the problem—vehicles may exist anywhere at any time and block arbitrary parts of your line-of-sight. That's why you have to learn to deal with it as a driver.

That said, obviously care should be taken to limit occurrences of view limiting obstacles whenever possible, especially in areas frequented by unskilled traffic participants—so pedestrians, really. A straightforward example would be disallowing street parking within a few tens of metres of pedestrian crossings. Street parking in general is horrible, especially on quiet residential streets—kids may dart around them onto the street at full speed.

The problem is not limited to large vehicles either.

——————

Anyways, here are some examples of what I'm talking about:

- Self-inflicted LOS issues by passing/filtering (motor)cyclists: https://youtu.be/qi6ithdYA_8?t=861, https://youtu.be/TRPYfHzQSFw?t=644, https://youtu.be/WgaWwWUYX64?t=200, https://youtu.be/WgaWwWUYX64?t=209, https://youtu.be/vYrxbdhLEN0?t=1083

- Cars obstructing view of an intersection: https://youtu.be/swmt44N9DJc?t=307, https://youtu.be/ejqpeFyqNz0?t=258, https://youtu.be/veLDLUXLrdQ?t=8, https://youtu.be/q46XoynHTpM?t=109, https://youtu.be/q46XoynHTpM?t=1016, https://youtu.be/m8jk2H7a-BI?t=70, https://youtu.be/9tgMe3CurNE?t=558, https://youtu.be/QCALZbDC_i0?t=172

- Cars obstructing view of a pedestrian/cyclist crossing: https://youtu.be/axCAi7Cjh2g?t=12, https://youtu.be/MReD5mieJ1c?t=1071, https://youtu.be/14c-iwZUh9M?t=5, https://youtu.be/Mzs0izUSoFo?t=14, https://youtu.be/vT7uI6EBQRM?t=238, https://youtu.be/O7UIACa35KY?t=366, https://www.youtube.com/shorts/IQHWUEPEwcg, https://youtu.be/vYrxbdhLEN0?t=551 (watch the whole video, it's very instructive)

- Pedestrian behavior around buses: https://youtu.be/oxN0tqO9cSk?t=8, https://youtu.be/03qTXV4aQKE?t=709

——————

And counterexamples, showing proper driving:

- Obstructed pedestrian crossing: https://www.youtube.com/watch?v=OThBjk-oFmk (I said proper driving, not proper cycling)

- Around a blind turn: https://youtu.be/86-qjb_m43A?t=294

- And to top it off, obstructed pedestrian crossing plus a bus: https://youtu.be/RpB4bx63qmg?t=439

——————

As you can see, LOS issues can pop up anywhere and there is no way to "fix" it. You have to adjust your behavior accordingly. You can't drive "optimistically", assuming nothing's there just because you can't see it. That's like closing your eyes and flooring it. Can't see nothing, therefore nothing is there!

> Which is why the "retrospectives are useless" crowd spins me up so badly.

When I see complaints about retrospectives from software devs they're usually about agile or scrum retrospective meetings, which have evolved to be performative routines. They're done every sprint (or week, if you're unlucky) and even if nothing happens the whole team might have to sit for an hour and come up with things to say to fill the air.

In software, the analysis following a mishap is usually called a post-mortem. I haven't seen many complaints about those have no value. Those are usually highly appreciated. Thought some times the "blameless post-mortem" people take the term a little too literally and try to avoid exploring useful failures if they might cause uncomfortable conversations about individuals making mistakes or even dropping the ball.

Agree. I am obligated to run those retrospectives and the SNR is very poor.

It is nice though (as long as there isn't anyone in there that the team is afraid to be honest in front of), when people can vent about something that has been pissing them off, so that I as their manager know how they feel. But that happens only about 15-20% of the time. The rest is meaningless tripe like "Glad Project X is done" and "$TECHNOLOGY sucks" and "Good job to Bob and Susan for resolving the issue with the Acme account"

Post mortems are absolutely key in creating process improvements. If you think about an organization's most effective processes, they are likely just representations of years of fixed errors.

Regarding blamelessness, I think it was W. Edwards Deming who emphasized the importance of blaming process over people, which is always preferable, but its critical for individuals to at least be aware of their role in the problem.

>When I see complaints about retrospectives from software devs they're usually about agile or scrum retrospective meetings, which have evolved to be performative routines.

You mean to tell me that this comment section where we spew buzzwords and reference the same tropes we do for every "disaster" isn't performative.

this is essentially the gist of https://how.complexsystems.fail which has been circulating more with discussions of the recent AWS/Azure/Cloudflare outages.

> Swiss cheese model

I always thought that before the "Swiss cheese model" introduced in the 1990s that the term Swiss cheese was used to mean something that had oodles of security holes(flaws).

Perhaps I find the metaphor weird because pre-sliced cheese was introduced later in my life (processed slices were in my childhood, but not packets of pre-sliced cheese which is much more recent).

>Which is why the "retrospectives are useless" crowd spins me up so badly.

As Ops person, I've said that before when talking about software and it's mainly because most companies will refuse to listen to the lessons inside of them so why am I wasting time doing this?

To put it aviation terms, I'll write up something being like (Numbers made up) "Hey, V1 for Hornet loaded at 49000 pounds needs to be 160 knots so it needs 10000 feet for takeoff" Well, Sales team comes back and says NAS Norfolk is only 8700ft and customer demands 49000+ loads, we are not losing revenue so quiet Ops nerd!

Then 49000+ Hornet loses an engine, overruns the runway, the fireball I'd said would happen, happens and everyone is SHOCKED, SHOCKED I TELL YOU this is happening.

Except it's software and not aircraft and loss was just some money, maybe, so no one really cares.

> All the holes in the cheese line up...

I absolutely heard that in Hoover's voice.

Is there an equivalent to YouTube's Pilot Debrief or other similar channels but for ships?

https://www.youtube.com/@pilot-debrief

As I said elsewhere, the upshot is that you need to know which holes the bullet went through so you can fix them. Accidents like this happen when someone does not (care to) know the state of the system.

> Basically, the line of causation of the mishap has to pass through a metaphorical block of Swiss cheese, and a mishap only occurs if all the holes in the cheese line up.

The metaphor relies on you mixing and matching some different batches of presliced Swiss cheese. In a single block, the holes in the cheese are guaranteed to line up, because they are two-dimensional cross sections of three-dimensional gas bubbles. The odds of a hole in one slice of Swiss cheese lining up with another hole in the following slice are very similar to the odds of one step in a staircase being followed by another step.

And there's the archetypal comment on technology-based social media that is simultaneously technically correct and utterly irrelevant to the topic at hand.

Actually the pedantry is meaningful!

You cannot create a swiss cheese safety model with correlated errors, same as how the metaphor fails if the slices all come from the same block of swiss cheese!

You have to ensure your holes come from different processes and systems! You have to ensure your swiss cheese holes come from different blocks of cheese!

No, it's a metaphor.

The three-dimensional gas bubbles aren't connected. An attacker has to punch through the thin walls to cross between the bubbles or wear and tear has to erode the walls over time. This doesn't fundamentally change anything.

Life tip: nitpicking a figure of speech is never useful and always makes you look like an arse.

Reply on news.ycombinator.com