Define a system and its parts, explain how interdependent elements, feedback loops and emergence produce intended and unintended consequences, read and draw system maps, and use systems as a lens on digital society.
Each is in the Digital Society glossary, with every other term in the subject.
A failure in one part of an interdependent system that triggers failures in other parts, which in turn trigger further failures, so that the damage spreads well beyond the original fault.
A diagram that shows cause-and-effect links between the elements of a system with arrows, and marks each feedback loop as reinforcing (R) or balancing (B).
Any part of a system that can be identified on its own, whether physical (a server), digital (code or data) or human (a user, designer or regulator).
The appearance of properties or patterns in a system as a whole that arise from interactions between its elements and cannot be found in, or easily predicted from, any single element.
A chain of cause and effect in which the output of a system returns as an input and changes the system's later behaviour.
A simple model of a system in which inputs enter the system, processes inside it transform them, and outputs leave it.
A relationship in which elements of a system rely on one another to function, so that a change or failure in one affects the others.
The core part of an operating system that controls a computer's memory, processor and hardware; software running in the kernel has full access to the machine, so an error there can crash the whole computer.
Define a system, and identify its elements, interconnections, boundary, inputs, outputs and purpose.
Outline how sociology, environmental systems and societies, science and technology studies, information science, computer science and design each study systems.
Distinguish between digital systems and social systems, and explain why many digital systems are best understood as sociotechnical systems.
Describe the human elements involved in designing and using a specific digital system.
Explain how positive and negative feedback loops, interdependence and emergence shape the behaviour of digital systems.
Analyse how a change within a system of interdependent connections can produce intended and unintended consequences.
Evaluate what models, maps and visualisations show and hide about a digital system.
Apply systems thinking as a lens to analyse a real-world example step by step.
A system is a set of elements that are connected to each other and work together as a whole. Systems thinking helps explain why a single faulty software update in July 2024 grounded flights, delayed surgeries and stopped card payments on several continents within hours. The elements of modern digital society depend on each other in ways that are rarely visible until one of them fails.
Systems is one of the seven concepts of the course, alongside change, expression, identity, power, space, and values and ethics. It gives insight into every content topic, because data, algorithms, computers, networks, media, artificial intelligence and robots are all parts of larger systems, and into every context, from ride-hailing platforms (economic) to the energy and materials behind data centres (environmental).
With a free account, Augment remembers where you stopped and what you have practiced.
A simplified representation of a system, such as a diagram, map, equation or simulation, that shows selected elements and relationships in order to explain, predict or communicate how the system behaves.
Feedback that counteracts a change and pushes a system back towards a target or balance, as a thermostat or surge pricing does.
Feedback that amplifies a change, so that the system moves further in the same direction; 'positive' describes the direction of the loop, not whether the outcome is good.
An element of a system whose failure causes the whole system to stop working, because no other element can take over its function.
A system in which people, social structures and technology are so closely interconnected that neither the social nor the technical part can be understood or changed without the other.
A set of interacting, interdependent or interconnected elements that are organised so that, together, they produce a particular pattern of behaviour or achieve a purpose.
The line, chosen by the person studying a system, that separates the elements treated as part of the system from its environment.
An approach that studies the relationships, flows and feedback between the elements of a system, and between the system and its environment, in order to understand and predict the behaviour of the whole rather than of each part separately.
A property of a system in which elements are linked so closely and act so quickly on each other that there is little slack or time to stop a fault from spreading.
An outcome of an action or change that its designers or decision-makers did not intend and often did not foresee; it may be beneficial, harmful, or the opposite of what was intended.
Every system has three basic parts. Its elements are the things that make it up, such as people, devices, software, rules or data. Its interconnections are the relationships between those elements: flows of data, money, energy, materials or instructions, and the rules that govern them. Its purpose or function is what the system as a whole does or tends to produce. The environmental scientist Donella Meadows, in Thinking in Systems (2008), argued that interconnections and purpose usually matter more than the individual elements: replace every player in a football team and it is still the same team, but change the rules and it becomes a different system.
An element is any part of a system that can be identified on its own: a smartphone, a recommendation algorithm, a content moderator, a data centre or a law. Elements can be physical (cables, servers), digital (code, data) or human (users, designers, regulators).
A common way to describe a system is the input–process–output model. Inputs enter the system, processes transform them, and outputs leave it. A navigation app such as Google Maps or Waze takes in speed data from millions of phones, map data and accident reports; its routing algorithm processes them; and it outputs suggested routes and arrival times, as the system diagram shows.
The system boundary separates what is inside a system from its environment. The person studying the system draws it for a purpose. An engineer might place the boundary of a navigation app around its servers and algorithm; a town planner would draw it much wider, to include drivers, the residential streets they are sent along and the people who live there.
An open system exchanges energy and matter (for digital systems, also data and money) with its environment; a closed system exchanges energy but not matter. Almost every digital system is open: a social media platform constantly takes in users, posts and advertising money and sends out recommendations and data.
Systems give one way of thinking about structure and order: how the parts of the world are arranged and why they behave in regular, predictable ways. Most systems are made of smaller subsystems and are themselves part of larger ones. A computer contains an operating system and security software; it is part of a company network, which belongs to an organisation such as an airline, which is part of the global economy. The nested diagram shows these levels.
Thinking in levels helps locate where a cause lies and where its effects appear. It also explains why one event can be described as a technical bug, an organisational failure or a social crisis, depending on the level examined.
Systems thinking applies to three kinds of environment. Human systems include families, schools, markets, governments and online communities. Natural systems include ecosystems, the water cycle and the climate. Built systems are made by people: roads, power grids, buildings and digital infrastructure. Digital systems often connect all three.
Environment | Example of a system | Where digital systems connect |
|---|---|---|
Human | A national health service | Electronic patient records and appointment booking link doctors, patients and pharmacies |
Natural | A river basin or a forest | Satellite monitoring and sensors measure rainfall, flooding and deforestation |
Built | An electricity grid | Smart meters and software balance supply and demand in real time |
All three | A city | Navigation apps redirect traffic (built) through neighbourhoods (human), affecting air quality (natural) |
Systems thinking studies a situation by looking at the whole system and the relationships between its parts. It contrasts with a purely reductionist approach, which breaks something into parts and studies each separately. Reductionism is useful for finding and fixing a faulty component, while systems thinking helps explain why a fix in one place can cause a problem somewhere else.
Systems thinking asks a recognisable set of questions. What are the elements, and who are the people involved? How are they connected? Where are the feedback loops? What lies outside the boundary, and who has been left out? These questions make it a practical tool for understanding the role of people and communities within human, natural and built environments.
Many disciplines use the concept of systems, each with its own vocabulary and questions, and a strong analysis borrows from several.
Field | How it understands systems | Typical question about a digital system |
|---|---|---|
Sociology | Society as interrelated institutions, groups and norms that create order and change over time | How does a platform change relationships between workers, employers and the state? |
Environmental systems and societies (ESS) | Ecosystems and human societies as open systems of stores, flows, inputs and outputs, regulated by feedback and capable of tipping points | What energy, water and minerals flow into a data centre, and what waste flows out? |
Science and technology studies (STS) | Technologies as inseparable from the people, institutions and values that build and use them | Whose decisions and values are built into an algorithm, and who was left out? |
Information science | Information systems of people, procedures, data, software and hardware that create, organise and retrieve information | How does a hospital's records system store, share and protect patient information? |
Computer science | Systems as components with defined interfaces, inputs and outputs, designed through abstraction and decomposition | Which component failed, and how did the failure spread through the interfaces? |
Design | Products and services as systems experienced by users, shaped through user research, prototyping and iteration | What does the user expect the system to do, and where does the interface mislead them? |
Each field adds something the others miss: computer science traces the technical path of a failure, STS and sociology explain why organisations came to depend on that path, ESS adds the physical resources consumed, and design explains what users expect. The biologist Ludwig von Bertalanffy proposed a general systems theory in the mid-twentieth century, and the related field of cybernetics studied control and communication through feedback in both machines and living things.
A digital system is a technology, application or platform that creates, stores, processes and distributes digital data. A social system is a pattern of relationships between people, organised by roles, norms and institutions: a family, a school, a market or a political party. An important inquiry question asks whether these two kinds of system are really distinct.
Digital and social systems can be separated for some purposes. A database follows its code exactly, while people interpret, break and change rules. Digital systems can be copied, scaled and updated faster than any social institution. Keeping the two apart also helps assign responsibility, since a software bug and a management decision are different kinds of cause.
Many researchers argue that in practice the two cannot be separated. The idea of a sociotechnical system comes from studies by the Tavistock Institute in London in the early 1950s. Eric Trist and Ken Bamforth found that new mechanised coal-mining methods in Britain failed to raise productivity because the technology broke up the small, self-organising teams that miners relied on. The lesson was that the technical system and the social system had to be designed together.
Most digital systems fit this description. A ride-hailing platform is code, servers and maps, but also drivers deciding when to work, riders deciding whether to trust a stranger, and cities deciding whether to license it. An online encyclopedia is software, but its reliability depends on the norms and disputes of its volunteer editors. Through the concept of power, the sociotechnical view also shows that design choices embed decisions about who controls what: the person who sets the rules of the code sets some of the rules of the community.
Three words describe relationships between elements, with different meanings.
Elements are interconnected when a link exists between them, for example a phone connected to a cell tower.
Elements are interacting when they act on each other, for example a user and a recommendation algorithm, each responding to the other's last move.
Elements are interdependent when each relies on the other to function, for example an airline's check-in system and the operating system it runs on.
Interdependence is the most important of the three for understanding risk. When elements depend on each other, the failure of one can stop the others, and the system as a whole becomes only as reliable as its weakest critical link.
Every digital system includes people at every stage of its life, and identifying them is the first step in analysing impacts for people and communities.
Stage | Human elements | Example |
|---|---|---|
Design | Product managers, software engineers, user experience designers, data scientists | Engineers choose what data a ride-hailing app's pricing algorithm uses |
Building and training | Testers, data labellers, content raters | Workers in Kenya labelled harmful text to make OpenAI's chatbots safer |
Operation | IT administrators, support staff, content moderators | Moderators review flagged posts on Facebook and TikTok |
Use | Users, customers, workers who depend on the platform | Drivers decide when to log on; riders decide whether to accept a fare |
Governance | Regulators, courts, standards bodies, civil society groups | City authorities license or ban ride-hailing services |
Affected non-users | People outside the system who feel its effects | Residents of streets that navigation apps send traffic through |
Affected non-users are often left out of an analysis. People who never use a system can be among its most affected stakeholders, and a boundary that excludes them also excludes their claims.
Uber shows how many interdependent elements a single app depends on. Behind the app sit matching and pricing algorithms, cloud servers, satellite positioning, mapping data, payment networks and phone operating systems; around it sit drivers, riders, Uber's staff and city regulators, as the system map shows.
The map shows that Uber depends on elements it does not own: if a mapping service, payment network or cloud provider fails, Uber fails with it. It also shows drivers as an element of the system who, in most countries, are not Uber's employees, which is why disputes over workers' rights are partly disputes over where the company's boundary lies. Through the concept of power, the map makes visible which elements Uber controls (its algorithms and prices) and which it must negotiate with (drivers and regulators).
A single point of failure is one element whose failure stops the whole system, because nothing else can do its job. Engineers remove such points by adding redundancy, such as backup servers or a manual procedure to fall back on.
The sociologist Charles Perrow, in Normal Accidents (1984), argued that some systems are so complex and so tightly coupled that serious accidents are almost certain to happen eventually. In a tightly coupled system, one step follows another quickly, with little slack or time to intervene, so a small fault spreads before anyone can stop it. Automatic software updates sent to millions of computers at once are an example: their speed helps against cyber attacks but leaves no time to notice a mistake.
When a failure in one element triggers failures in the elements that depend on it, and those in turn trigger further failures, the result is a cascading failure.
A feedback loop exists when the output of a system returns to influence its own input, so the system changes its own behaviour over time. The two kinds appear side by side in the feedback diagram.
Positive feedback (also called reinforcing feedback) amplifies a change: more leads to more, or less leads to less. "Positive" here describes the direction of the loop, not whether the result is good. A video platform's recommendation algorithm learns from what a user watches, recommends more of it, and so collects even more data about that interest. This helps users find content they enjoy but can narrow what they see over time. Network effects are another positive loop: each new user makes a messaging app such as WhatsApp more useful to the next.
Negative feedback (also called balancing feedback) works against a change and keeps a system near a target. A thermostat is the classic example. Uber's surge pricing is designed as a balancing loop: when riders outnumber available drivers in an area, the price rises, which attracts more drivers and persuades some riders to wait, until supply and demand are closer again.
Positive loops in digital systems can be dangerous because they run at machine speed. On 6 May 2010, during the "Flash Crash", the Dow Jones Industrial Average fell by nearly 1,000 points and then largely recovered, all within about 36 minutes. A joint report by the US Securities and Exchange Commission and the Commodity Futures Trading Commission found that a very large automated sell order, combined with high-frequency trading algorithms selling to each other, drained buyers from the market, so falling prices triggered more selling.
Emergence is the appearance of patterns or properties in a whole system that none of its elements has on its own and that no one designed. A traffic jam is emergent: no driver chooses to create one, but it appears from many drivers each keeping a safe distance. Online, the hashtag is a well-known example. Twitter did not invent it; a user, Chris Messina, suggested using the # symbol to group posts in 2007, other users copied the practice, and only later did Twitter turn hashtags into clickable links.
Emergence explains why digital systems often surprise their designers: online communities develop their own norms, and misinformation spreads through shares by people who each meant no harm. Because emergent behaviour is not located in any one element, responsibility for it is hard to assign, which links systems to the concept of values and ethics.
When one element of an interdependent system changes, the effects spread along its connections. Some effects are the ones the designers wanted: these are intended consequences. Others were not wanted or not foreseen: these are unintended consequences. The sociologist Robert K. Merton argued in 1936 that ignorance, error, short-term thinking and strongly held values all lead purposeful actions to produce results nobody planned.
Unintended consequences take three common forms. An unexpected benefit is a good outcome nobody planned. An unexpected drawback is a harm that comes alongside the intended benefit. A perverse result is an outcome that works against the original aim. The same change can produce all three for different people and communities.
Change | Intended consequence | Unintended consequence | Type |
|---|---|---|---|
Navigation apps route drivers along the fastest roads | Shorter journeys for drivers | Commuter traffic sent through quiet residential streets, as in Leonia, New Jersey | Unexpected drawback for residents |
Facebook's 2018 News Feed change to favour "meaningful social interactions" | More wellbeing, less passive scrolling | Internal research reported by the Wall Street Journal (2021) found it rewarded divisive content that drew many comments | Perverse result |
Twitter users began adding # to group posts (2007) | Easier way to follow a conversation | Hashtags became a tool for global social movements and for marketing | Unexpected benefit |
Boeing added the MCAS software to the 737 MAX | The new aircraft handles like the older 737, so pilots need less retraining | Faulty sensor data triggered repeated nose-down commands in two crashes | Perverse result (safety system caused harm) |
The Boeing 737 MAX shows how a software change made for good reasons can interact with other elements in unforeseen ways. Its larger engines, mounted further forward, made the nose tend to rise in some conditions. Boeing added software, the Maneuvering Characteristics Augmentation System (MCAS), that automatically pushed the nose down so the plane handled like earlier 737s and airlines could avoid expensive simulator retraining.
MCAS relied on a single angle-of-attack sensor, so one faulty sensor could activate it repeatedly, and many pilots had not been told it existed. In the crashes of Lion Air Flight 610 in Indonesia (October 2018) and Ethiopian Airlines Flight 302 (March 2019), faulty sensor readings triggered MCAS and the pilots could not regain control; 346 people died. The aircraft was grounded worldwide from March 2019 until late 2020. Through a systems lens, the cause was the interaction of a design change, a single point of failure, training decisions driven by cost and competition, and regulators who had delegated much safety certification to Boeing itself.
Four features make consequences hard to foresee. Delays separate a cause from its effect, so the link is missed. Non-linearity means that a small change can have a very large effect once a threshold or tipping point is crossed, as when a post suddenly goes viral. Interactions mean the outcome depends on other parts of the system, not just the part changed. Human adaptation means that people change their behaviour in response to a system, for example sellers who learn to game a marketplace's ranking algorithm.
Unintended consequences also differ in timescale, from minutes (the Flash Crash) to decades (the build-up of electronic waste). Their benefits often go to a system's users or owners while the costs fall on those outside its boundary, which links systems to questions of power and fairness.
A model is a simplified representation of a system that keeps the features needed for a particular purpose and leaves out the rest. Every model leaves out detail on purpose. A map drawn at the same scale as the land it shows would be too large to use, so a model is judged by whether it keeps the features that matter for its purpose.
Different models show different aspects of a system, so the right one depends on the question.
Type of model | What it shows | Digital society example |
|---|---|---|
Input–process–output diagram | What enters a system, what happens to it, what leaves | How a facial recognition system turns camera images into matches |
System map | The elements of a system and the connections between them | The elements of Uber and the flows between them |
Causal loop diagram | Cause-and-effect links and feedback loops, marked as reinforcing or balancing | How recommendation algorithms and attention reinforce each other |
Network map | Nodes and links, often drawn from real data | TeleGeography's Submarine Cable Map of the undersea cables that carry most international internet traffic |
Flowchart or data flow diagram | The steps of a process or the path data takes | How a hospital's patient records move between departments |
Simulation or digital twin | A computer model that predicts how the system behaves when conditions change | City traffic simulations used to test new road layouts |
A causal loop diagram is particularly useful in systems thinking because it shows feedback, which most other models leave out. Each arrow shows that a change in one element causes a change in another, and each loop is labelled R (reinforcing) or B (balancing), as in the feedback diagram.
Maps and visualisations make visible connections that are invisible in everyday use. In 2018 the researchers Kate Crawford and Vladan Joler published Anatomy of an AI System, a large map of everything involved in a single voice command to an Amazon Echo smart speaker. It traced the minerals in its components, the workers who assemble devices and label data, the data centres and energy behind each request, and the electronic waste at the end, showing that a device presented as simple depends on a global system of labour, resources and data.
Every model also hides something. A company's architecture diagram may show servers and data flows but not the contract workers who moderate content; a map of internet cables shows physical links but not who controls the data on them. Through the concept of power, the key questions are who made a model, for what purpose, and whose interests lie outside its boundary, the same questions of origin and purpose asked of any source.
A concept is used as a lens when it guides the questions asked about a real-world example. Applying systems as a lens follows a sequence of steps that overlap in practice.
Define the system and its boundary. Name the specific digital system and state what is inside and outside the analysis, and why.
Identify the elements, including human elements. List the technical, physical and human elements, including people affected outside the system.
Trace the interconnections and flows. Show what moves between elements: data, money, instructions, energy, materials.
Look for feedback loops and emergence. Identify reinforcing and balancing loops and any patterns that no single element produces.
Examine change and consequences. Ask what changed, what was intended, what was not, who gains, who loses, and over what timescale.
Model it. Sketch a system map or causal loop diagram to test and communicate the analysis.
Evaluate. Judge where the system is fragile or resilient, where responsibility lies, and which changes would most improve outcomes for people and communities.
CrowdStrike is a US cybersecurity company whose Falcon platform protects computers in large organisations against malware and cyber attacks through a program, the Falcon sensor, installed on each computer. To detect attacks, the sensor runs inside the kernel of the operating system, the core part of Windows that controls memory and hardware. Running there gives deep visibility, but an error can crash the whole computer rather than one application.
Updates to the sensor's detection rules, called Rapid Response Content, were delivered automatically to customers' computers worldwide, often several times a day, a speed that helps against fast-moving attacks.
At 04:09 UTC on Friday 19 July 2024, CrowdStrike released an update to a configuration file known as Channel File 291, intended to detect a new technique used by attackers. The detection template behind the new content defined 21 input fields, but the sensor code supplied only 20 input values, and this update was the first to rely on the 21st field. Reading memory that was not there caused a kernel error, so the computers crashed to the "blue screen of death", and many crashed again every time they restarted (a boot loop).
CrowdStrike replaced the faulty content at 05:27 UTC, 78 minutes later, but Windows computers running the sensor that were online during that window had already received it. Microsoft estimated that about 8.5 million Windows devices were affected, less than 1% of all Windows machines. Mac and Linux computers were not affected, because they do not use this channel file.
Because the affected computers could not start normally, the fix could not be sent over the internet. IT staff had to restart each machine in safe mode and delete the faulty file by hand, often after typing a long BitLocker disk-encryption recovery key, which in large organisations meant visiting thousands of machines one by one.
The outage reached far beyond CrowdStrike's customers because they were themselves elements in larger systems.
Air travel. Airlines worldwide grounded or delayed flights as check-in and crew systems failed. Delta Air Lines was hit hardest, cancelling about 7,000 flights over five days because its crew-scheduling system could not track its pilots and cabin crew. Delta later estimated its losses at about $550 million and took legal action against CrowdStrike, which rejected responsibility for Delta's slow recovery.
Health care. Hospitals in several countries postponed operations and appointments. In England, many GP surgeries could not access the EMIS Web patient records and booking system.
Money and retail. Banks, payment terminals and supermarket self-checkouts stopped working in countries including Australia and New Zealand, where the outage struck during the working day.
Public services and media. Some US emergency 911 call centres lost their systems, and Sky News in the UK was briefly unable to broadcast live.
The insurer Parametrix estimated the direct financial losses to the largest US companies alone, as the chart shows.
Impacts were unequal. Organisations with large IT teams and well-organised recovery keys restored service within hours; smaller hospitals and companies with many remote computers took days. Individuals bore costs they had no part in creating, such as missed flights and delayed treatment.
YouTubeThe outage illustrates almost every idea of the concept.
Interdependence. Airlines, hospitals and banks depended on Windows, Windows machines depended on the Falcon sensor, and the sensor depended on a stream of content from CrowdStrike's cloud. None of the end users chose or saw these links.
Tight coupling. Content updates went to every customer at once, with no gradual roll-out, so a system built to react within minutes to attacks had no buffer against its own mistakes, the condition Perrow described.
Single point of failure. For many organisations, one security product on one operating system had become a single point of failure.
Cascading failure. The failure travelled up the nested levels: from a file, to the kernel, to millions of devices, to organisations, to public services and to people in many countries.
Unintended consequences. Software meant to protect systems from disruption caused it, a perverse result. At Delta, the failure of the crew-scheduling system turned a one-day outage into a five-day crisis.
Feedback and learning. Balancing loops were added afterwards. CrowdStrike's root cause analysis (August 2024) promised more testing, run-time checks on input fields, staged releases starting with a small group of computers, and customer control over when updates arrive. In November 2024 Microsoft announced a Windows Resiliency Initiative that includes work to let security software run outside the kernel.
Through the concept of power, the outage shows how concentrated some elements of the global digital system have become: a few operating systems and security vendors sit underneath a large share of critical services. Microsoft said afterwards that a 2009 undertaking to the European Commission, made during a competition investigation, obliged it to give rival security vendors the same access to Windows as its own products, a claim critics disputed. Either way, decisions about who may run code at the heart of an operating system turned out to be decisions about the resilience of hospitals and airlines, made by companies and regulators the affected public never saw.
Describing the outage as a technical bug is incomplete. The bug was small and fixed within 78 minutes; the scale of the damage came from the structure of the system: automatic, simultaneous updates; software running at the deepest level of the operating system; and many organisations depending on the same vendor with no manual fallback.
There are counter-claims. Kernel access and fast updates exist because cyber attacks are fast and dangerous, and slower protection against ransomware is also a risk. Concentration on a few trusted vendors brings expertise most organisations could not afford alone. The strongest conclusion is that resilience requires both technical changes (staged roll-outs, safer architectures) and organisational ones (redundancy, tested recovery plans), and that the costs of failure fall most heavily on the people and communities outside the system's boundary, who had the least say in how it was designed.
The second question is in the style of the HL extended response.
I can define a system, identify its elements, interconnections, purpose, inputs and outputs, and explain why its boundary is a choice.
I can describe how systems give structure and order in human, natural and built environments, including systems within systems.
I can define systems thinking, contrast it with reductionism, and outline how sociology, ESS, STS, information science, computer science and design approach systems.
I can discuss whether digital systems are distinct from social systems, using the idea of a sociotechnical system.
I can distinguish between interacting, interdependent and interconnected elements.
I can identify the human elements involved in designing, operating, using and governing a specific digital system.
I can explain single points of failure, tight coupling and cascading failure with a real-world example.
I can distinguish positive (reinforcing) from negative (balancing) feedback loops with digital examples.
I can define emergence and give an example from a digital system.
I can analyse intended and unintended consequences of a change within a system, including unexpected benefits, drawbacks and perverse results.
I can evaluate what a model, map or visualisation shows and hides about a digital system, and draw a simple system map.
I can apply systems as a lens to a real-world example step by step.
I can use the CrowdStrike outage of July 2024 to analyse interdependence and cascading failure.