Leading Article: A matter of life and death

THE RESIGNATION of John Wilby, chief executive of the London Ambulance Service, is timely and welcome, for he has presided over an avoidable catastrophe. We do not know how many people have died this week as a result of the breakdown of a new computerised dispatching system. It may be two, it may be 20. One would be too many.

A prompt and efficient ambulance service is one of the necessary conditions for a civilised society. The speed with which an ambulance responds is one of the most important factors determining the survival of the patients who depend on them. An ambulance that takes half an hour to arrive might as well be a minicab. But in London the standards have slipped below even those of a minicab firm: the Independent on Sunday earlier reported on an ambulance station that rang a patient after she had been waiting three hours to ask whether it would be acceptable if the ambulance turned up the following day instead.

Even without the crisis this week, the system was placing patients' lives in jeopardy every day. It is commonplace to wait up to 15 minutes in a telephone queue before reaching an ambulance controller. This is because there are only 20 operators when the switchboard is fully staffed. A single accident in a public place can generate 30 calls, each of which must be logged, so it is easy to see how the operators can be overwhelmed at peak times. But why is such an easily foreseeable failure tolerated?

It may take some time to unravel the technical causes of the debacle on Monday, when the computerised dispatching system collapsed under the weight of its first full day's work. But some general points may be made with confidence, whether the fault lies with the software, the communications equipment, or some combination of these. Whatever component it was that failed, it is clear that the system was insufficiently tested before use. It is not surprising that it failed. Large computer programs are among the most complex artefacts that human ingenuity has ever produced, and the only thing certain about them is that they will malfunction in unforeseen ways as soon as they are used in earnest. The way around this problem is not to demand perfection as soon as the program is running, but to ensure that it is not trusted until it has proved itself.

What is shocking is that the managers of the London Ambulance Service did not realise this, even though the system that failed on Monday had been installed at considerable cost to replace an earlier, and expensive, computer which had proved unsatisfactory. The unique demands placed on a dispatching system by the complexity and urgency of the tasks that it must perform make it almost certain that computers will prove inadequate the first few times they are set to solve the problem. Yet the proximate cause of Monday's catastrophe was that the manual back-up had to be removed when the final stage of automation was put in place.

Virginia Bottomley, Secretary of State for Health, has taken considerable time to respond to the distress of Londoners over the shortcomings of the ambulance service, which long predates the computer crisis. The independent inquiry she announced yesterday should not confine itself to the computer failure. All aspects of this unsatisfactory service need review.