Scenario ambiguity

A common pattern of operational failure is of coordination or cooperation problems, due to scenario ambiguity.

Often, the source for the ambiguity is that the modes defining the operational scenario, which should represent the operator's intention, are not defined formally in the system specification documents, and thereof, are missing from the system design.

Many legacy systems implement algorithms for inferring the operators intention based on the history of the operators commands. However, it sometimes happens that the operator's intention is different from that obtained by these algorithms. Such situations are often incidence-prone.

The problem of implicit scenario setting

If during the operation, the operational scenario is implicit, then the machine does not have any means to learn about the operator's intention, namely, which of the possible scenarios is active.

Examples

A common source of operational failure is when an operator performs a maintenance procedure when the system is in functional mode (such as production).

1967 Torrey Canyon Supertanker disaster. The operator was not aware of the navigation in control mode, in which the steering rod was disconnected from the wheel at the helm
1979 TMI nuclear power plant accident. The operators were not aware of the backup pumps being closed following a maintenance procedure.
The user of a home TV system changes the Sources state unintentionally, and consequently, assuming the wrong mode, s/he cannot find a particular station ( more).

Other examples

Nagoya, Asiana 214