On the Primitives of Causality: from the Semantics of Agonist and Antagonist to Models of Accident Causation and System Safety

Transcription

1 Sn Jose Stte University From the SelectedWorks of Frncesc M. Fvrò September, 2013 On the Primitives of Cuslity: from the Semntics of gonist nd ntgonist to Models of ccident Custion nd System Sfety Loïc Brevult, Georgi Institute of Technology Frncesc M. Fvro, Georgi Institute of Technology Joseph H. Sleh, Georgi Institute of Technology vilble t:

2 On primitives of cuslity: from the semntics of gonist nd ntgonist to models of ccident custion nd system sfety Loïc Brevult & Frncesc M. Fvró & Joseph H. Sleh Dniel Guggenhein school of erospce Engineering Georgi Institute of Technology, tlnt, G, US BSTRCT: Controversil discussions on cuslity hve been present in ncient philosophy since the dys of ristotle. Despite the use of this concept in numerous subjects, there is no consensus on the definition of cuslity nd its possible mthemtiztion. Mny uthors hve nlyzed the reltion between cuses nd effects; the predominnt school of thought reduces custion to physicl reltion (either deterministic or probbilistic) between two events. The distinction between cuses nd consequences is not lwys cler nd meningful s different lyers of understnding my be pplied to the notion of cuslity. From this point of view the cuseeffect impliction reltion cn be thought of s first level representtion of custion. By double-clicking the link between events, the in-depth lyers of cuslity surfce, llowing better comprehension nd distinction of the cuslity nture. It is then importnt to understnd how cuslity cn be incorported in n ccident model. Severl ccident models hve been recently employed to interpret different contributing fctors to n dverse event nd to help improve our chnces on ccident prevention. However, ccident models do not focus on the nture of the cusl reltionship. The cusl reltionship is lwys limited to cuse(s) imply effect(s), but it is never nlyzed s to understnd the mechnism tht led to such impliction. Our lnguge in itself is limited in the wys of describing cusl reltionships. We will see how the ppliction of the effective metphor of gonist nd ntgonist ctions from the Force Dynmics frmework will help nlyzing the roles of different ctors long the chin of custion. The use of this metphor, enhnced by the introduction of the Inverse gonist concept, will provide new insights on the interctions mong those ctors nd will yield the insightful ide of primitives of cuslity. These primitives will be priml nd fundmentl notions t the bse of more generl concept of custion. We illustrte the use of primitives of cuslity through n ccident exmple, nd we highlight the bsence of relevnt ntgonist nd inverse gonist ctions tht filed to block nd de-esclte the ccident sequence respectively. We rgue tht the primitives of cuslity here introduced llow deeper understnding of cusl mechnisms involved in system ccidents nd provide richer bsis for conceiving nd rticulting ccident prevention strtegies. 1 INTRODUCTION ON CUSLITY IN CCIDENT MODELS We often think, nively, tht missing dt re the primry impediments to intellectul progress; just find the right fcts nd ll problems will dissipte. But brriers re often deeper nd more bstrct in thought. We must hve ccess to the right metphor, not only to the requisite informtion. Revolutionry thinkers re not, primrily, gtherers of fcts, but wevers of new intellectul structures. From The flmingos smile, S. J. Gould Metphors re prevlent in our lnguge, nd it is often rduous to convey bstrct ides without using them. metphor (literlly trnsport from the greek verb µετ αφερω) llows the interchnge of structures of thought nd logic mong different domins of the humn knowledge. The explntion of new theoreticl concepts tkes gret dvntge from the use of lredy estblished ptterns. notble exmple is Rutherford s tom plnetry model bsed on metphor with the solr system. Metphors re quite common lso in ccident custion models nd system sfety in generl; the use of simplified pproches to relity reduces the complexity nd multitude of events, conditions nd ctors. These models provide key to interpret mny of the different contributing fctors of n dverse event nd help improve our chnces on ccident prevention. They re often employed to understnd the chins of cuslity tht led to the spe-

3 cific unwnted event. Tble 1 provides summry of the metphors recently employed in ccident models, following the clssifiction by Lehto & Slvendy (1991). No clim of exhustiveness cn be mde nd mny other clssifictions re vilble, s those developed by Lflmme (1990), Kjellén (2000), nd Hollngel (2002). The metphors employed by ech model re presented together with their min fetures nd references for further detils. It is importnt to understnd how cuslity is incorported in the models of Tble 1. Even if they differ by purpose, focus nd pproch, they ll ttempt to represent both the phenomenology nd the etiology of n ccident. The how? nd why? re nlyzed nd discussed s series (or network) of contributory cuses. Combintions of the presented models re lso possible. However, neither of the nlyzed models focuses on the nture of the cusl reltionship. In other words, whether the sequence of events is viewed s chin over or s network of cuses, none of the presented models tkes into ccount the different specifities of cuslity. The cusl reltionship is lwys limited to cuse(s) imply effect(s), but it is never nlyzed s to understnd the mechnism tht led to such impliction. Our lnguge in itself is limited in the wys of describing cusl reltionships: lighted mtch in wood or broken brrier in the defense-in-depth line will, in the sme wy, be cuses tht imply the subsequent events/effects. Nevertheless, there is shrp distinction in the role plyed by mtch setting fire or filed brrier. Intuition helps us in understnding the underlying distinction for these simple cses, but forml considertions re needed for more complex scenrios. But why is it importnt to distinguish the role of cuse? The nswer to this question is the primry scope of this pper. We will see how the ppliction of the simple metphor of gonist nd ntgonist ctions from the Force Dynmics frmework will help nlyzing the roles of different ctors long the chin of custion. The use of this metphor, enhnced by the introduction of the Inverse gonist concept, will provide new insights on the interctions mong those ctors nd will yield the insightful ide of primitives of cuslity originlly introduced by Tlmy (2000). These primitives will be priml nd originl ides t the bse of more generl concept of custion. The understnding of the primitives of cuslity involved in n ccident my improve our knowledge on the mechnisms tht filed to prevent n ccident. The introduced concepts will llow us to express risk escltion nd de-escltion, nd trjectory modifiction long the risk stte trjectory of the system. The reminder of this pper is orgnized s follows. Section 2 provides brief introduction to the concept of cuslity nd the nture of the cusl reltion. Section 3 presents the metphor of gonist, ntgonist nd Inverse gonist nd introduces the primitives of cuslity. Section 4 pplies the presented concepts to nlyze two of the sfety systems involved in the Piper lph explosion in Section 5 concludes this work. 2 THE NTURE OF THE CUSL RELTION Controversil discussions on cuslity hve been present in ncient philosophy since the dys of ristotle. This topic remins stple in contemporry philosophy nd hs plyed centrl role in both metphysics nd theology. Nowdys, cuslity is still key concept in different fields, such s sciences nd ethics (Slmon 1998). Cuslity is fundmentl notion lso in ccident prevention nd sfety; Rsmussen et l. (1990) mintined tht the very nture of cusl explntion shpes the nlysis of ccidents. Despite the use of this concept in numerous subjects, there is no consensus on the definition of cuslity nd its possible mthemtiztion (Perl 2000). Possibly, the most common notion of cuslity refers to cusl connections between events which re the bsic entities of cuslity where some of these events re cuses nd some re effects (Sun 1994). Mny uthors (Hume 1890, Russell 1912, Russell 1948, Willimson 2004, mong others) hve nlyzed the reltion between cuses nd effects; the predominnt school of thought reduces custion to physicl reltion (either deterministic or probbilistic) between two different events. Moreover, in long chin of cuslity where, often, ltent conditions prior to the evident ccidents sequence exist one person s cuse (i.e. wht one person identifies s cuse ) is nother person s consequence (Bkols & Sleh 2011). s underlined in this work, the distinction between cuses nd consequences is not lwys cler nd meningful; different lyers of understnding my be pplied to the notion of cuslity. In other words, the cuse-effect impliction reltion cn be thought of s first level representtion of custion. By double-clicking the link between events, the indepth lyers of cuslity surfce, llowing better comprehension nd distinction of the cuslity nture. In order to give description of the nture nd role of this reltion we will exploit two metphors coming from the Force Dynmics context nd from Biochemistry. We will then distinguish between gonist, ntgonist nd Inverse gonist ctions. Intuitively, the different ntures of these ctions will influence the system s trjectory, mking the ccident s unfolding more or less likely. Before looking t the metphors, it is then fundmentl to introduce the concept of stte trjectory nd risk escltion/de-escltion, s those concepts constitute bsic frmework for relevnt pplictions of cusl reltions to engineering systems.

4 Tble 1: Clssifiction of mjor ccident models Model Min Fetures Sequentil Iceberg metphor: views ccidents s the nturl culmintion of series of events nd circumstnces where dissters re only the tip of the iceberg. Heinrich (1941) Domino metphor: introduces the notion of inititing event. The removl of one Heinrich et l. (1980) element in the cusl chin is sufficient to the prevention of the incident. Epidemiologic Spred of disese metphor: extends the view of cuslity by incorporting new fctors (ctive nd ltent conditions) in the description of the ccident etiology. Gordon (1949) Environmentl conditions for both humns nd technologies re considered s setting tht Hollngel (2002) could led to n ccident. Energy trnsfer This model views n ccident s n unwnted trnsfer (or relese) of energy. It is t the bse of the current Defense-in-Depth (or Lyers of protection ) ccident Hddon (1973) prevention strtegy. Reson (1997) Swiss Cheese metphor: represents the defenses ginst ccidents escltion le et l. (2010) through series of sfety brriers (slices of cheese) which possess individul Sleh et l. (2010) weknesses vrying in position nd size from slice to slice. Systemic Sheridn (1992) Rsmussen (1997) Leveson (2004) Open- nd close- loop metphors: view sfety s the desired stte output of controlled system nd ccidents s devitions from this desired stte. Devitions correspond to externl perturbtions of the system. ccident prevention is chieved through the solution of control problem, with sfety constrints, control ctions, nd (possibly) dequte feedbck. 3 NEW METPHOR FOR CCIDENT CUSTION In the Defense-in-Depth model, series of brriers re plced long n ccident trjectory to prevent the escltion of off-nominl conditions nd ultimtely the unfolding of n ccident. The notion of depth is chrcterized by the multiplicity nd the redundncy of the sfety brriers long the risk stte trjectory, s shown in Figure 1 (left). This model tkes into ccount only the possibility of defensive ction: the brrier interposed long the ccident trjectory block the system s trnsitions to higher risk stte but leve the stte in n off-nominl condition. Nothing is sid bout possible offensive ction tht would led to chnge in the riskiness of the present stte. This would open the possibility of risk de-escltion, through trnsition to new stte less risky thn the previous one, s shown in Figure 1 (right). Note tht n offensive ction is chrcterized by chnge in the risk ssocited to the stte nd does not utomticlly imply risk de-escltion, s suggested in Figure 2. Bsed on this distinction, it is convenient to introduce the notions of gonist nd ntgonist, originlly proposed by Tlmy (2000) in the context of cognitive linguistics. Used in force-dynmics to indicte the opposing effects of two forces, Tlmy relies on these terms to overcome some of the limittions of our own lnguge nd lexicl structure in its wy of representing cuslity. We will enhnce this comprison by borrowing the concept of Inverse gonist from biochemistry. In this context n gonist is viewed s substnce tht binds to receptor to induce biochemicl response; n ntgonist, conversely, blocks the ction of the gonist; finlly, the inverse gonist is n gent tht binds to the sme receptor of the gonist, but produces n opposite response. offensive ction defensive ction chnge in the level of risk no chnge in the level of risk risk escltion risk de-escltion Figure 2: Txonomy of offensive nd defensive ction strtegy In the context of ccident custion, the notion of cuslity will be extended bsed on the presented metphor of gonist/ntgonist nd inverse gonist ctions. By using these notions s metphor to express the nture of ction on the trjectory of the systems sttes, we will enble distinction between finer primitives of cuslity. 3.1 The definition of gonist, ntgonist nd Inverse gonist for n ccident trjectory In the context of ccident custion, we relte the concepts of gonist, ntgonist nd Inverse gonist to their effects on the system ccident trjectory. n gonist () is defined s n ction pplied to the system leding to discrete trnsition of the stte towrds higher risk level fter t. Therefore, the system trjectory fter n gonist ction cn be represented s in Figure 3 (left), where S i+1 is riskier stte thn S i. n ntgonist (ā) is defined s n ction pplied to the system tht blocks n gonist ction. Therefore, the system is blocked in sttionry risky stte fter t. Figure 3 (center) represents this sitution, where the trnsition from S i to S i+1 does not occur. Finlly, n Inverse gonist (i) is defined s n ction pplied fter risk escltion of the system to overcome the effects of n gonist ction, leding to discrete trnsition of the stte towrds lower risk level fter t. Therefore, the system trjectory fter n inverse gonist ction cn be represented s in Figure 3, where S i+1 is riskier stte thn S i nd where S i+2 is less risky thn S i+1.

5 risk scle sfety brriers risk scle T 1 T 2 risk de-escltion 0 risk escltion 0 Figure 1: Concepts of defensive ction principle (left) nd risk de-escltion (right) risk scle s i+1 s i gonist ction risk scle s i+1 s i gonist ction ntgonist ction risk scle s i+1 s i gonist ction inverse gonist ction Figure 3: Discrete stte spce nd effect on the ccident trjectory for: gonist ction (left), ntgonist ction (center), inverse gonist ction (right) s i+2 Note tht the notion of gonist, ntgonist nd inverse gonist should not be restricted to the ide of physicl ctions on the system (e.g. pushing n emergency button, or fire wll). Sleh et l. (2010) highlight the different sfety levers tht exist nd cn be cted upon to prevent n ccident unfolding. In this broder sense, n ction cn be referred to s to regultion, mintennce opertion, or even n economic incentive or n eductionl inititive. The presented concepts llow generliztion of the trditionl notion of cuslity, detiling custion into finer primitives, s presented in the next section. 3.2 The primitives of cuslity In his study on force dynmics in lnguge nd cognition, Tlmy (2000) identifies recurring ptterns of physicl interction leding to chnge of the system stte. We extend some of these concepts to ccident custion nd relte them to direct effects on the system sttes trjectory. The definitions of gonist, ntgonist nd inverse gonist provided in the previous section presume tht those ctions fulfill their gols (e.g. the ntgonist ction succeeds in blocking the gonist ction). This is not lwys the cse. Moreover, looking t the different possible interctions between them llows us to distinguish finer primitives of cuslity. These primitives provide in turn frmework to broden the cuse-effect impliction reltionship Interctions between gonist nd ntgonist ctions: Direct Custion: This primitive origintes from n unimpeded gonist ction pushing the system to riskier stte. The cusl reltionship between risk scle the gonist ctions directly cuse the trnsitions Figure 4: Direct Custion primitive of cuslity risk scle the ntgonist ction blocks the gonist Figure 5: Blocking primitive of cuslity the cuse gonist ction nd the effect riskescltion is defined s direct custion primitive of cuslity (Fig. 4). Blocking: This primitive origintes from the presence of both n gonist nd n ntgonist ction on the system, with n ntgonist ction stronger thn the gonist force. The cusl reltionship between the cuse gonist nd ntgonist ction nd the effect blocked riskescltion is defined s blocking primitive of cuslity (Fig. 5). Despite: This primitive origintes from the presence of both n gonist nd n ntgonist ction on the system, with n gonist ction stronger thn the ntgonist force. The cusl reltionship between the cuse gonist nd ntgonist c-

6 risk scle the gonist ction persists despite the ntgonist risk scle the ntgonist is removed,letting risk escltion Figure 6: Despite primitive of cuslity Figure 9: Letting primitive of cuslity risk scle the ntgonist ction prevents risk escltion ntgonist 1 prevention blocking despite 0: bsence 1: presence -1: removl 0 direct custion 0 1 gonist Figure 7: Prevention primitive of cuslity -1 frgilizing letting tion nd the effect unblocked risk-escltion is defined s despite primitive of cuslity (Fig. 6). Prevention: This primitive origintes from the presence of n ntgonist ction with no occurrence of n gonist ction. The effect of sttionry persistence of the system in its nominl condition defines the prevention primitive of cuslity (Fig. 7). Frgilizing: This primitive origintes from the bsence of n gonist ction nd the removl of n ntgonist ction. The cusl reltionship between the cuse removed ntgonist ction effect unblocked risk-escltion with the system persisting in its nominl condition is defined frgilizing primitive of cuslity (Fig. 8). Letting: This primitive origintes from the presence of n gonist ction nd the removl of n ntgonist ction. The cusl reltionship between the cuse gonist nd removed ntgonist ction nd the effect unblocked risk-escltion is defined s letting primitive of cuslity (Fig. 9). We cn summrize the interctions of gonist nd ntgonist leding to the distinction of primitives of cuslity s in Figure 10. The x-xis represents the presence or the bsence of n gonist, nd the y-xis Figure 10: Primitives of cuslity derived from gonist nd ntgonist interctions represents the presence, bsence or removl of n ntgonist Interctions between gonist nd Inverse gonist ctions: By definition of inverse gonist, this ctegory of ctions requires the occurrence of n gonist ction. Primitives of cuslity cn hence be derived only for the cse of presence of the gonist. Note lso tht even if the inverse gonist differs by nture from the ntgonist ction, they shre the primitives of direct custion, despite nd letting. However, the blocking primitive is now replced by: De-escltion: This primitive origintes from the presence of both n gonist nd n inverse gonist ction on the system, with the inverse gonist ction stronger thn the gonist force. The cusl reltionship between the cuse gonist nd inverse gonist ction nd the effect risk deescltion is defined s de-escltion primitive of cuslity (Fig. 11). lso in this cse, it is possible to summrize the primitives of cuslity derived from the interctions between the gonist nd the inverse gonist in risk scle the ntgonist is removed, frgilizing the system risk scle the inverse gonist ction is de-esclting the risk i Figure 8: Frgilizing primitive of cuslity Figure 11: De-escltion primitive of cuslity

7 inverse ntgonist de-escltion despite direct custion 0 1 letting gonist 0: bsence 1: presence -1: removl 4. Definition of quntifible metric: this step represents the core of the nlysis. Different metrics correspond to different definitions of risk nd of sttes/scenrio. n exmple could derive from TOPSIS technique bsed on the probbility nd the consequences ssocited with ech scenrio. This topic provides fruitful venue for future investigtion. Figure 12: Primitives of cuslity derived from gonist nd Inverse gonist interctions grphic tble, s shown in Figure 12. The x-xis represents the presence or the bsence of n gonist, nd the y-xis represents the presence, bsence or removl of n Inverse gonist. The plurlity nd co-existence of primitives of cuslity re the locl or micro-cusl mechnisms tht explin n ccident sequence. Cuslity in ccidents is then represented s web of primitives of cuslity insted of trditionl liner chin pproch. We believe tht the primitives of cuslity here introduced llow deeper understnding of cusl mechnisms involved in system ccidents nd provide richer bsis for conceiving nd rticulting ccident prevention. 3.3 risk metric for the ccident trjectory The introduced methphors of gonist, ntgonist, nd inverse gonist rely on the possibility to define risk metric for the ccident trjectory. This metric would llow rnking of the sttes tht compose such ccident trjectory in terms of hzrdousness or riskiness. Due to the limited scope of this pper, we only present here the mjor steps to chieve such gol. 1. definition of risk: the dopted definition needs to be quntifible in mthemticl terms. n exmple is the definition provided by Kpln & Grrick (2006) where risk is defined by three min ingredients: scenrio of occurrence; the probbility ssocited to the occurrence of tht scenrio; the evlution of the consequences of tht scenrio. 2. Identifiction of scenrios nd sttes: this step requires forml definition of initil stte nd scenrio. Event driven discrete representtion provides useful technique, s indicted in (Sleh, Sltmrsh, Fvrò, & Brevult 2013). 3. Clcultion of the probbility ssocited to scenrio:mny techniques exist lso in this cse. Conditionl probbilities for the trnsitions between the sttes composing the scenrio would be required in this process. 4 PPLICTION TO N CTUL CCIDENT TRJECTORY: THE PIPER LPH EXPLOSION In this section we nlyze prt of n ctul ccident trjectory to illustrte the use of the gonist, ntgonist nd inverse gonist metphor, nd to llow for n extension of the expression of cuslity through the introduction of the primitives of cuslity. The objective of the section is not to nlyze why or how the specific ccident hppened, but rther to highlight the use of the presented concepts for the ske of ccident prevention. On July 6 th 1988, mssive fire nd subsequent explosions destroyed the fixed offshore pltform Piper lph, gs nd oil production fcility in the North Se. The ccident climed the lives of 167 out of the 248 workers on the pltform tht dy (Whyte 2001). Severl ppers focused on the reconstruction of the ccident nd on detiled studies of the contributory cuses of the ccident (see, for instnce, (Pté-Cornell 1993),(Drysdle & Sylvester-Evns 1998)). This exmple will concentrte only on two of the sfety systems ment for ccident prevention bord the pltform: the firewlls nd the fire deluge system. The Piper lph pltform ws composed of four Modules (, B, C nd D) connected by firewlls. The firewlls provided fireproof brriers to stop the progression of fire between the different modules of the pltform. More specificlly, the firewll between Modules B nd C nd the one between Modules nd B were specified s fire brrier up to 4.5 hours, while the firewll between Modules C nd D ws designed for up to 6 hours fire (Drysdle & Sylvester- Evns 1998). The firewlls were not rted for explosion overpressure. The ignition point ws locted in Module C (gonist ction). The first ignition led to risk escltion of the stte of the pltform. The firewlls cted s n ntgonist ginst the propgtion of the fire (second gonist ction) to the djcent modules. Severl primitives of cuslity cn be relted to the firewll brriers. First of ll, fter the primry ignition, the firewll blocks the propgtion of the fire cting ginst the propgtion of the fire to the other module (Fig. 13). t this point, note tht there ws no blowout pnel to contin the explosion inside Module C. Therefore no ntgonist ction existed ginst the propgtion of the first explosion. The bsence of the blowout

8 risk scle the firewll blocks the fire propgtion 1 Figure 13: Firewll ntgonist ction risk scle the bsence of blowout pnel directly cuse the non-continment of the explosion 1 : first ignition 2 : propgtion of the fire to djcent module : firewlls 1 : first ignition 2 : expnsion of the first explosion st explosion 2 no ntgonist: no blowout pnel to contin the explosion inside the module Figure 14: bsence of ntgonist: missing blowout pnel pnel directly cuses the non-continment of the explosion inside the module (Fig. 14). Following the firebll originted from the first explosion, the firewlls filed s not designed ginst overpressure. The destruction of the firewlls lets the propgtion of the fire to djcent modules (Fig. 15). The trjectory of the risky sttes of the system, considering only the firewll sfety system, cn be represented s in Figure 16. Severl primitives of cuslity hve been identified for the firewll system (direct custion, blocking nd letting), llowing to highlight nd distinguish the cuses of the spred of the fire to other modules. This pproch lso underlines the bsence of n importnt ntgonist (the blowout pnel) to ct ginst such propgtion. More generlly, whenever chnge in stte is witnessed in the ccident trjectory, the nlyst cn try to identify the involved gonist, ntgonist nd inverse gonist ctions. In this cse risk escltion ws not contrsted, highlighting the bsence of the ntgonist ction. We now turn our ttention to the fire deluge system, n ctive fire protection mesure consisting of wter supply system tht provides dequte flow rte nd pressure to sprinklers. In the event of fire, this system cts s n Inverse gonist since its objective is to die down the fire nd therefore decrese the riskiness of the systems stte. In norml working conditions, the fire deluge system on the Piper lph should hve deesclted the risk stte of the system fter the first ignition. However, the deluge system of Module C hd experienced repeted clogging nd ws inoperble t the of the ccident (Cullen 1993), yielding in risk scle the destruction of the firewlls lets the possibility for fire propgtion to djcent modules 1 : first ignition 2 : fire propgtion st explosion ntgonist removl: destruction of the firewlls Figure 15: The removl of the ntgonist: destruction of firewlls risk scle 1 : first ignition 2 : propgtion of the fire to djcent module : firewlls : expnsion of first explosion 4 : fire propgtion 4 no ntgonist: bsence of the blowout pnel ntgonist removl: destruction of the firewlls Figure 16: ccident trjectory nlyzing the role of the firewll system How cn we prevent n ccident from hppening gin? Which gonist, ntgonist, nd inverse gonist re involved in the ccident? Which ntgonist nd/or inverse gonist were missing/ ineffective in order to prevent the ccident unfolding? Which primitives of cuslity re involved in the ccident? Wht cn we do bout it? Figure 17: Decomposition of the questioning process to prevent n ccident the end limited effectiveness (Pté-Cornell 1993). Moreover, deluge systems were not instlled in criticl res of the production module, directly cusing the possibility of fire propgtion to these res. The bsence of ntgonist ctions s mintennce nd detection of clogging of the fire deluge system llows ltent gonist (clogging existing long prior the ccident) to directly cuse the subsequent gonist propgtion of the fire in the djcent modules. Furthermore, the system ws ineffective in loction where it hd been instlled letting the fire to expnd, due to the turn off of the utomtic pumps used to feed the fire deluge system (Pté-Cornell 1993). Thus, despite the presence of the Inverse gonist (the deluge system), risk-escltion led to the ccident unfolding. This nlysis not only revels the trditionl type of cuslity s the bsence of blowout pnel or the bsence of fire deluge system in res tht cused the expnsion of the fire, but lso highlights other primitives of cuslity s letting or despite. On one hnd this llows descriptive point of view of cuslity by identifying the primitive of cuslity; on the other, it brings focus on the ctions tht define the ccident trjectory by highlight the presence or the bsence of ntgonist nd Inverse gonist to stop the risk escltion of the system or to de-esclte it. 5 CONCLUSIONS gonist, ntgonist nd inverse gonist concepts hve been introduced to express the effects of different types of ction on the system. This metphor introduces mechnistic pproch of cuslity into the possible wys n ction my modify system trjectory. In this frmework the cusl reltionship between events is reduced to interctions between gonists, ntgonists nd inverse gonists. Unimpeded gonist ction pushes the system stte on trjectory

9 of risk escltion. If gonist ctions re sustined over, they cn led to n ccident. ntgonist ction cn block gonists nd prevents risk escltion or further dvncement of n ccident sequence. Inverse gonist ction engges the system in risk de-escltion. The interctions between these gents llow expressing cuslity in terms of direct custion, blocking, despite, letting, prevention nd de-escltion primitives. The metphor here introduced llows deepening the concept of temporl build-up of precursors nd contributing fctors, by introducing wy to represent the pth or trjectory of the system in terms of risky sttes. The expressivity of the metphor lso llows the introduction the notion of de-escltion nd widens the sfety brrier concept, which intrinsiclly embodies only the notion of escltion blocking. The result is refocus of ccident prevention to n dptive dynmicl defense ginst risk escltion. To this end, the rgument proposed by Kletz (2012) on the necessity to give n nswer to the question how cn we prevent n ccident from hppening gin? could be decomposed s in Figure 17. Cusl mechnisms in system ccidents re prticulrly importnt nd should be crefully identified nd ssessed. We believe the metphor of gonist, ntgonist nd inverse gonist nd the primitives of cuslity offer possibility to express new concepts nd to widen the importnce of the study of etiology in ccident prevention. Cuslity in ccidents is then represented s web of primitives of cuslity insted of trditionl liner chin pproch. We rgued tht the primitives of cuslity here introduced llow deeper understnding of cusl mechnisms involved in system ccidents nd provide richer bsis for conceiving nd rticulting ccident prevention strtegies. Finlly, we provided simplified exmple of ppliction to n ctul ccident sequence, highlighting the use of the presented concepts for the ske of ccident prevention. s finl remrk, note tht intersting res for further development of the presented concepts hve been presented, including the very rich re of risk metric definition nd ppliction. We believe tht the presented concept cn serve to overcome some of the limititions of our lnguge in the expression of cuslity reltions. REFERENCES le, B., P. Swust, & C. Gulijk (2010). Metphors nd models. Relibility, risk nd sfety. ISBN Bkols, E. & J. H. Sleh (2011). ugmenting defense-in-depth with the concepts of observbility nd dignosbility from control theory nd discrete event systems. Relibility Engineering & System Sfety 96(1), Cullen, L. W. (1993). The public inquiry into the piper lph disster. Drilling Contrctor;(United Sttes) 49(4). Drysdle, D. & R. Sylvester-Evns (1998). The explosion nd fire on the piper lph pltform, 6 july cse study. Philosophicl Trnsctions 356(1748), Gordon, J. E. (1949). The epidemiology of ccidents*. mericn Journl of Public Helth nd the Ntions Helth 39(4), Hddon, W. (1973). Energy dmge nd the ten countermesure strtegies. Humn Fctors: The Journl of the Humn Fctors nd Ergonomics Society 15(4), Heinrich, H. W. (1941). Industril ccident prevention, scientific pproch -2nd edition. London: McGrw-Hill Book Compny. Heinrich, H. W., D. Petersen, & N. Ross (1980). Industril ccident prevention - 5th edition. McGrw-Hill, New York. Hollngel, E. (2002). Understnding ccidents-from root cuses to performnce vribility. In Humn Fctors nd Power Plnts, Proceedings of the 2002 IEEE 7th Conference on, pp IEEE. Hume, D. (1890). Tretise of Humn Nture: Being n ttempt to Introduce the Experimentl Method of Resoning Into Morl Subjects; nd, Dilogues Concerning Nturl Religion, Volume 1. Longmns, Green, nd Compny. Kpln, S. & B. J. Grrick (2006). On the quntittive definition of risk. Risk nlysis 1(1), Kjellén, U. (2000). Prevention of ccidents through experience feedbck. CRC. Kletz, T. (2012). Lerning from ccidents. Routledge. Lflmme, L. (1990). better understnding of occuptionl ccident genesis to improve sfety in the workplce. Journl of Occuptionl ccidents 12(1), Lehto, M. & G. Slvendy (1991). Models of ccident custion nd their ppliction: review nd repprisl. Journl of Engineering nd Technology Mngement 8(2), Leveson, N. (2004). new ccident model for engineering sfer systems. Sfety Science 42(4), Pté-Cornell, M. E. (1993). Lerning from the piper lph ccident: postmortem nlysis of technicl nd orgniztionl fctors. Risk nlysis 13(2), Perl, J. (2000). Cuslity: models, resoning nd inference, Volume 29. Cmbridge Univ Press. Rsmussen, J. (1997). Risk mngement in dynmic society: modelling problem. Sfety science 27(2), Rsmussen, J., P. Nixon, F. Wrner, J. Rsmussen, P. Nixon, & F. Wrner (1990). Humn error nd the problem of cuslity in nlysis of ccidents [nd discussion]. Philosophicl Trnsctions of the Royl Society of London. B, Biologicl Sciences 327(1241), Reson, J. T. (1997). Mnging the risks of orgniztionl ccidents, Volume 6. shgte ldershot. Russell, B. (1912). On the notion of cuse. In Proceedings of the ristotelin society, Volume 13, pp JSTOR. Russell, B. (1948). Humn knowledge: Its scope nd its limits. New York: Simon &Schuster. Sleh, J., K. Mris, E. Bkols, & R. Cowlgi (2010). Highlights from the literture on ccident custion nd system sfety: Review of mjor ides, recent contributions, nd chllenges. Relibility Engineering & System Sfety 95(11), Sleh, J. H., E.. Sltmrsh, F. M. Fvrò, & L. Brevult (2013). ccident precursors, ner misses, nd wrning signs: Criticl review nd forml definitions within the frmework of discrete event systems. Relibility Engineering nd System Sfety pubbliction). Slmon, W. C. (1998). Cuslity nd explntion. Oxford University Press, US. Sheridn, T. B. (1992). Telerobotics, utomtion, nd humn supervisory control. MIT press. Sun, R. (1994). neurl network model of cuslity. Neurl Networks, IEEE Trnsctions on 5(4), Tlmy, L. (2000). Towrd cognitive semntics, Vol. 1: Concept structuring systems. The MIT Press. Whyte, D. (2001). Lerning the lessons of piper lph? Risk Mngement nd Society 16, 263. Willimson, J. (2004). Byesin nets nd cuslity: philosophicl nd computtionl foundtions. Oxford University Press.