Working in the Cyclone

Understanding the cognitive work of experts is a powerful way of understanding the "system" and grounding our own understanding of where opportunities and vulnerabilities lie. Dr. Richard Cook emphasizes that the study of incidents is the revealing thing about how systems actually work. Working at the Center of the Cyclone. IT Revolution 2018. youtube

Dr. Cook diagnoses the fundamental problem in modern software incident management. We miss the opportunity to use incidents to stimulate recalibration of mental models and instead use them only to identify "microfractures" to be fixed.

27m19s The most important information about where people are uncalibrated about what the system is doing are the incidents that you are having. They are [untyped]* pointers that point to areas of the system that are of interest. When you point to that area, you aren't pointing to anything specific. Your job is to figure out what type of thing is there in order to interpret that result. Incidents are messages sent from this thing down below the line about how the system really works. They're the only important pieces of information that can lead to a recalibration of a stale, inaccurate mental model. They are the prompts to engage in calibration [and] recalibration activities. But we're not using them that way. That's not what we are doing. We're using them as signals of micro fractures that need to be repaired.

* Dr. Cook's exact words at this point in the video is "unsigned pointers". However, in the later elaboration he calls them "untyped pointers." As he explains the metaphor, it is clear that "untyped pointer" better matches his intent. An unsigned pointer represents positive integers. An untyped pointer is just an address in memory and the programmer will have work to do to study and interpret the bytes that begin at that address.

See Above and Below the Line.