Formalism Helps in Describing Accidents

We analyse the `probable cause' of the 1979 Chicago DC-10 accident using a minimal formalism, and find an omission. The omission is contained in the body of the report. This omission had consequences for the public discussion of this accident, which we show. We conclude that formalism helps in accident reporting by enabling simple consistency and omission checks. We then present a quick overview of our formal method, WhyBecause Analysis, which provides the necessary mechanisms and rigor. We consider this to be the engineering of causal reasoning. As is now known from a quarter-century's experience with verification of digital systems, such reasoning engineering is both essential and non-trivial. Accident reports in aviation present careful reasoned conclusions about causes and causal factors contributing to the accident, as well as providing pro forma details which may be useful in other contexts, say for statistical investigations of accident types. In order to establish the need for engineering this reasoning, we exhibit an example of the kind of problem that can arise through using the current informal methods. Second, we briefly describe our own "reasoning engineering" method for causal analysis, Why-Because Analysis, or WBA. WBA is similar in scope and rigor to verification methods familiar in computer science. It extends such methods in that it explicitly encodes a rigorous causal logic. First, the statement of `probable cause' of the Chicago-O'Hare 1979 DC-10 accident (NTSB-AAR-79-17) : The National Transportation Safety Board determines that the probable cause of this accident was the asymmetrical stall and the ensuing roll of the aircraft because of the uncommanded retraction of the left wing leading edge slats [...] and the loss of stall warning and slat disagreement systems resulting from maintenance-induced damage leading to the separation of the No. 1 engine and pylon assembly at a critical point during takeoff. The separation resulted from damage by improper maintenance procedures which led to failure of the pylon structure. We shall analyse this statement with the following semi-formal method. First, we list the crucial events, and denote each by a simple phrase. Second, we determine all relations between the events given by true assertions of the form: `why ..... because .... . (This second step has a formal semantics, as in Section The Logical Semantics of Causal Explanation, below, but it suffices for now to do it informally.)