How Small Failures Combine to Trigger Catastrophic System Accidents

This inherent danger drives the creation of multiple layers of defense, including technical components like backup systems, human elements like training, and organizational measures such as policies, certification, and work rules. These defenses normally divert operations away from accidents, and system operations are generally successful. Overt catastrophic failure occurs when small, apparently innocuous failures join together to create an opportunity for a systemic accident.

Each of these small failures is necessary to cause catastrophe, but only their combination is sufficient to permit failure. There are many more failure opportunities than overt system accidents, as most initial failure trajectories are blocked by designed safety components, and those that reach the operational level are mostly blocked by practitioners. The complexity of these systems makes it impossible for them to run without multiple flaws being present.