Recently I watched a talk by a doctor. Richard Cook was an anaesthetist who spent twenty five years studying how complex systems fail, in operating theatres, cockpits, power stations and semiconductor plants. He was speaking to a room full of people who run websites, and he told them one story I have not been able to put down.
A hospital decided to replace every infusion pump it owned with one new model, all on the same day. On install day somebody worked through the setup and came to a setting for a mandatory software update, with a date to fill in. They set it a year out. It was a reasonable thing to do. They were thinking about the hundred other things you think about on install day.
A year later, twenty minutes past midnight, a technician got a call. One pump had stopped accepting commands. He swapped it and reset it. Then the second call came, and the third. Within the hour about a fifth of the pumps in the building had stopped. The date had arrived, and a pump past its update date refuses new instructions until it gets new software. Nobody at the hospital knew that, because nobody had had a reason to.
The technician worked through the night and by morning everything was back. Afterwards, Cook says, nobody thought much of it. They changed the setting and went back to work.
Then he asked the question that stayed with me. What if the technician had not been in the building? A pump already running would have carried on. Any pump anyone tried to change would have stopped. Seven or eight hours on, he said, none of them would have been running.
Same fault. Same night. The only difference was who was there.
Who is looking after it at three in the morning
I run an IT company that looks after factories, so I hear this story differently from the people in that room.
If production is running at three in the morning, somebody has already decided how it will be looked after. That is true whether there is a full shift on the floor or a lights-out cell running on its own with a phone number on the wall. Somebody thought about it, and it is on a rota.
What is much less often obvious is who owns the things underneath it: the network, the servers, the links between the machines, the office and the outside world. Production cover is designed. Cover for the estate under it is usually inherited, or assumed, or nobody's until the night it becomes somebody's. And on that night somebody does pick up the phone, because somebody always does. The maintenance lead, the shift manager, the owner in his kitchen.
That is the thing I want to say. The chair is never empty at three in the morning. The question is whether anyone chose who is in it, and what they had to hand when the phone rang.
As imagined, as found
Cook had a phrase for the gap: the system as imagined versus the system as found. The system as imagined is the diagram, the layout of the racks. In my world it is also the drawing the auditor asked for. It is static, tidy and complete. The system as found is what is actually running at three in the morning, including every setting somebody changed to make a stubborn thing work, every box that was meant to be temporary, and every date set a year out by someone thinking about something else. One of the people he interviewed put it in five words. Stuff don't work as advertised.
The person who answers the phone acts on the picture of the system in their head. If that picture is the diagram, they are in trouble before they start. If it is the system as found, they have a chance.
What I take from it
This part is mine, not Cook's. His story shows what one person who knew the system was worth on one night. What I keep coming back to is what that person needs, and how rarely any of it is given on purpose.
They need to know what is actually there, what depends on what, and which things can be moved safely.
They need to know what they are allowed to do. Can they take the line down. Can they pull the cable. Can they ring the owner. Understanding without permission is a particular kind of misery: you can see what needs doing and you cannot do it.
And they need to know what the business can stand to lose. Every important part of a factory reaches a point where being down stops being inconvenient and starts costing the business properly. For most of them nobody has ever said where that point is. It gets discovered at three in the morning, by whoever picked up the phone. That is a decision for daylight, by the people who run the business, and it is far kinder to the person on the night to have made it for them.
Is it worth it, if it is going to happen anyway
I asked myself this while writing. The unpredictable will happen. Cook's whole point is that it always does, and that the surprising thing about complex systems is not how often they fail but how rarely. So if something is coming regardless, why prepare?
Because you do not get to choose what goes wrong. You do get to choose what the person holding it finds when the phone rings.
Most factories have what they have. The person in the chair is whoever answered, and the rules are the ones nobody quite wrote down. I have been that person. Cook's technician was that person too, and the only reason the hospital had a quiet morning is that he knew the pumps, and he was there.