Causality credo

The causality credo makes eminent sense in the case when we reason from cause to effect (forwards causality). But it unfortunately tricks us into believing that the opposite, reasoning from effect to cause, can be done with equal justification (backwards causality). While concluding that the antecedent (the cause) is true because the consequent (the effect) is, in most cases may seem to be a plausible inference, it is regrettably logically invalid. Even worse, while it may be plausible for systems that are relatively uncomplicated, it is not plausible for systems that are complicated. This can be illustrated by considering the causality credo vis-a-vis the typical accident models. 

When thinking about safety, there must necessarily be a symmetry between the past and the future, which means that future accidents must happen in the same way as past accidents. Or, to put it differently, the reasons why accidents happened in the past must be the same as the reasons why accidents will happen in the future. This does not mean that they are due to the same types of events or conditions, since socio-technical systems constantly change. But it is meant in the sense that the principle of explanation, e.g., the causality credo, must be valid for the future as well as for the past. If that were not the case, it would require that some mysterious force in the present - meaning right now - changed the way things work and the way things happen. Since this is clearly not sensible, the consequence is that there must be a symmetry between that past and the future - and, more specifically, that accident models and risk models should follow the same principles. 

It is today common to distinguish among at least three different types of accident models, called the sequential, the epidemiological, and the systemic, respectively. Of these, the sequential and epidemiological comprise the causality credo, while the systemic does not. 

The causality credo also embraces a set of assumptions about how things happen in a system and how systems are composed. The assumptions are as follows ... 

The natural consequence of the causality credo, combined with the Domino model, is the assumption that there is a basic or first cause, which can be found if the systematic search is continued until it can go no further. This is often called the root cause, although definitions differ. In the Domino model, the root cause was the ancestry and social environment, which led to undesirable traits of character. Since this was the fifth domino, it was not possible to continue the analysis any further. Other approaches, particular if they subscribe to some form of abstraction hierarchy, suffer from the same limitation. The type of analysis (which actually is a family of methods) that tries to find the root cause is unsurprisingly called Root Cause Analysis (RCS). 

The four myths presented here (the causality credo, the accident pyramid, the 90 per cent solution, and the root cause) are of course not the only ones. Readers who are interested in other myths can quite easily find information in scientific papers and online... 

The aetiology of Safety-I thus includes assumptions about causality (cf., the causality credo), as well as the assumption that the results - the manifestations of Safety-I - can be explained by decomposition and by referring to the characteristics of... 

One of the comforts of the causality credo, combined with the myths of Safety-I, is that it becomes easy to find simple - and sometimes oversimplified - explanations for things that have gone wrong. This convenience seems to be lost with the emphasis on performance adjustments and performance variability as a basis for Safety-II. 

The predominant approach to safety relies on analysis, as in accident analysis or risk analysis. This is in good accordance with the Western tradition of science that for better or worse has brought us to where we are now. In relation to safety this tradition is found, for instance, in the causality credo, and in the ontology and aetiology of Safety-I. But an analytical approach is neither inevitable nor the only choice, as the presentation of Safety-II has... 

---