Resilience Engineering Perspectives, Volume 2

Preparation and Restoration

Erik Hollnagel, Christopher P. Nemeth

• Publisher: CRC Press
• Year: 2016
• ISBN:
  9781351903882
• Edition: 1
• Topic: Tecnología e ingeniería
• Subtopic: Ingeniería industrial

Preparation and Restoration is the second volume of Resilience Engineering Perspectives within the Ashgate Studies in Resilience Engineering series. In four sections, it broadens participation of the field to include policy and organization studies, and articulates aspects of resilience beyond initial definitions: - Policy and Organization explores public policy and organizational aspects of resilience and how they aid or inhibit preparation and restoration - Models and Measures addresses thoughts on ways to measure resilience and model systems to detect desirable, and undesirable, results - Elements and Traits examines features of systems and how they affect the ability to prepare for and recover from significant challenges - Applications and Implications examines how resilience plays out in the living laboratory of real-world operations. Preparation and Restoration addresses issues such as the nature of resilience; the similarities and differences between resilience and traditional ideas of system performance; how systems cope with varying demands and sometimes succeed and sometimes fail; how an organization's ways of preparing before critical events can enable or impede restoration; the trade-offs that are needed for systems to operate and survive; instances of brittle or resilient systems; how work practices affect resilience; the relationship between resilience and safety; and what improves or erodes resilience. This volume is valuable reading for those who create and operate systems that must not only survive, but thrive, in the face of challenge.

Chapter 1

The Ability to Adapt¹

Christopher P. Nemeth

Not being able to control events, I control myself; and I adapt myself to them, if they do not adapt themselves to me.

Michel de Montaigne (1533–1592), French essayist.
“Of Presumption,” The Essays (Les Essais), bk. II, ch. 17, Abel Langelier, Paris (1588)
Source: Andrews et al., 1996

The first volume in the Resilience Engineering Perspectives series (Hollnagel, Nemeth and Dekker, 2008) grew from papers that were presented at the Second Symposium on Resilience Engineering at Juan les Pins, France, in November 2006. As the first volume in the series outside of a symposium setting, this text considers what it means for an organization to be able to adapt, and how that ability relates to resilience and efforts to engineer resilient systems. Its authors deliberate on how that ability plays out before and after a critical challenge – the preparation to meet challenges and the restoration that returns a system to working order afterward.

Resilience Engineering (RE) (Hollnagel et al., 2006) focuses on the ability of an organization to cope with, and recover from, unexpected developments. Rather than a focus on a system’s productive capacity, RE can be used to assess and enhance the ability of an organization to adapt in order to meet challenges. With roots in complexity study (Carlson and Doyle, 2002) and cognitive systems engineering (Hollnagel and Woods, 2005), RE seeks to create and maintain systems that can cope with and adapt to complex, dynamic, and changing environments. RE acknowledges the inability to specify all possible threats and responses. Instead, it provides methods and tools to manage safety and productivity.

On the face of it, the ability to adapt has features that most organizations would want. Being able to adjust to different conditions or environments sounds like a desirable trait. It offers the potential for a system to change to new modes of operation, much like the crew of a Navy ship shifting to “General Quarters.” The analogy ends there, though. Sending all hands on a ship to their battle stations is a proven, accepted need that has been tested over time. The need and ability for organizations to make substantial changes to prepare for potential threats is more complex. Change poses a potentially unsettling challenge for organizations that seek to maintain the status quo.

Studies of system failure reasonably lead to the question of what to do about it. The easy, but inadequate, response is to react by making a quick revision. The harder, but more substantive, response is to understand the setting in which systems exist and create essential features that have the potential to resolve such issues long term. The following chapters examine the nature and implications of taking the harder, more substantive approach.

Probing Resilience

The chapters in this text spell out the very real considerations of how resilience and engineering efforts to create resilient systems play out in the real world. They also view the topic from viewpoints that are outside of systems safety and engineering. Notions of resilience have evolved in multiple disciplines, including organizational research, traditional risk management, and complexity studies. Organizational research views resilience as the need for collective mindfulness (Wildavsky, 1988; Weick et al., 1999), and chapters in this volume by Birkland and Lengnick-Hall and Beck provide insightful discussions on this theme. Traditional risk assessment (Rasmussen, 1983) has approached resilience as a minor variation in performance due to over- or under-adaptation. Complexity studies (Csete and Doyle, 2002) approach resilience as an engineering and ecological issue, and most of the chapters in the volume reflect this perspective.

Resilience is Not Reliability

Those who are less familiar with the resilience literature may not see the difference between resilience and what has come to be known as high reliability (Rochlin et al., 1987). The initial call for a symposium on resilience engineering explained the difference. “It is not enough that they are reliable so that the failure probability is acceptably low. They must also be resilient and have the ability to recover from irregular variations, disruptions and a degradation of expected working conditions” (Hollnagel et al., 2004). A broader comparison between reliability and resilience might help to explain why this is so.

Few contributions to the notion of the high reliability organization (HRO) rival Rochlin, LaPorte and Roberts’ (1998) analysis of US Navy aircraft carrier flight operations. That seminal work identified four aspects of reliability:

1. Self design and self replication – Tasks are broken down internally into decomposition rules that are often ad hoc and circumstantial. The organization is integrated horizontally, vertically, and across command structures. Structures shift in time to adapt to varying circumstances. Continual training and retraining develops, transmits and maintains the information needed for safe and efficient operation. Workups intensify training prior to operational deployment. Objects, events, situations, and appropriate conduct are codified. Assignments are rotated regularly.

2. The paradox of high turnover – Efforts to manage rapid crew turnover benefit the organization. Turnover requires officers to command respect among senior petty officers. Organizational and technical innovation are resisted until proven to benefit operations, then quickly diffused throughout the fleet. Standard operating procedures (SOP) and procedures are unusually robust.

3. Authority overlays – Officers negotiate to plan operations and act cooperatively to maximize output.

4. Redundancy – Technical and supply back-ups, decision crosschecks, shadow roles, and the ability to perform more than one task make it possible to replace lost capability.

Four key characteristics are said to typify the high reliability organization (Gaba, 2003):

1. systems, structures and procedures conducive to safety and reliability are in place;

2. intensive training of personnel and teams takes place during routine operations, drills and simulations;

3. safety and reliability are examined prospectively for all the organization’s activities, and organizational learning by retrospective analysis of accidents and incidents is aggressively pursued;

4. a culture of safety permeates the organization.

Efforts have been made to export the HRO concept to other sectors beyond the military (Leape et. al., 1998; Bogner, 1994). Significant differences make the transfer of such models from one sector to another difficult, if not problematic. This difference has implications for how we view system performance and system safety. Healthcare provides an opportunity to compare the HRO concept with resilience.

In the case of healthcare, the differences between resilience and reliability are significant.

Healthcare’s high variability, diversity, partition between workers and managers, and production pressure make it difficult to employ the redundancy and extensive training that are essential aspects of HROs. This is because healthcare systems do not share the same characteristics as other operational systems such as the naval aircraft carrier. The difference in character makes it difficult, if not futile, to expect healthcare to display results in the same way.

• Development – Military systems are developed according to specifications and are maintained according to strict procedural requirements. Healthcare has been likened to a collection of cottage industries that have a loose affiliation (Reid et al., 2005: 12–13).

• Hierarchy – Military systems develop and use policy and procedures to improve interchangeability, which enables units and individuals to quickly affiliate and re-affiliate. Career growth relies on candidate evaluation by boards of promotion and screening boards that follow legally mandated guidance. Healthcare follows a commercial and professional model of selection.

• Management – Military leaders rise to senior levels of command after training as engineers (generally) and years of exposure to the operational work setting. Healthcare managers are typically businessmen and women who have no clinical background.

• Behaviour – The military encourages coordination and, in some services, initiative, based on long-standing service tradition. Healthcare allows for individual caprice if individual practitioners are politically powerful or generate enough billing.

• Mission – The military can, and does, stand down to deal with significant safety concerns. Healthcare never stands down.

Among the four key characteristics that Gaba proposed, procedures, training and culture place clinician behaviour at the centre of attention. Given the complex interactions of procedures, equipment, facilities along with personnel, it is not clear whether this is feasible, tenable, or even desirable in healthcare. Very real practical considerations stand in the way of their implementation. Cost limits force systems to run at or near capacity, making the imposition of new systems, structures and procedures problematic. Current pressures to generate revenue allow little room for intensive training beyond what already occurs (Cook and Rasmussen, 2005). Creation of a facility-wide “culture of safety” pales in importance in comparison with the built-in hazards that require engineering, not simply behavioural, attention.

Changes in the type and volume of demand require systems that can adapt, not simply consistently repeat. Demand for healthcare is uncertain, evanescent, and contingent. Organizations to provide care must necessarily change as care demand changes. Healthcare organizations, though, consist of disconnected groups that practice specialties, are only loosely coordinated, and are not well-suited to change. Much of the resilience that has been demonstrated by healthcare systems has been initiated by the human element of the system: clinicians. Wears, Perry, Anders, and Wood (2008), for example, describe how an emergency department staff adapted to handle surges in patient load with no increase in capacity or resources. Physicians and nurses do amount to joint cognitive systems (Hollnagel and Woods, 2005: 21) that can modify their behaviour on the basis of experience in order to maintain order in the face of disruptive influences. However, human operators cannot be expected to provide all of a system’s adaptive capacity. Other elements such as an organization’s management, equipment, and information technology need to act as a “team player” (Christoffersen and Woods, 2002) for the system to be resilient. Systems that are resilient can sustain required operations even after a major mishap or in the presence of continuous stress. They can mount a robust response to unforeseen, unpredicted, and unexpected demands. They are able to resume normal operations or develop new ways to achieve operational objectives. For these reasons, resilience holds a stronger promise for such a poorly-bounded, uncertain, highly variable, and evanescent work domain (Nemeth et al., 2008).

Preparation and Restoration

How do organizations prepare to withstand a critical challenge? How do organizations recover from critical events and restore themselves to normal operations? The answers have a great deal to do with resilience engineering and those who seek to understand and use it to improve system performance.

Preparation suggests much more than anticipation or planning. It incorporates all that precedes a challenge: from an organization’s structure and ability to adapt and reconfigure, to knowing whether resources can be identified, made available, and defended. Preparation poses questions that are either addressed in these pages or invite further discussion. Have we learned from past lessons, or will the past be repeated in the future? Does an organization have the requisite imagination (Westrum, 1999) that is needed to foresee future challenges? How can various perceptions of the future be integrated to produce a coherent view? Among ideas that are proposed, which of them are worthwhile and how can we tell? Some views of the challenges that organizations face are accurate, but how can they be identified, brought to the attention of others, and integrated? When an organization learns about future challenges, how does the organization respond? Does it encourage the new information? Accept it? Dilute it? Suppress it?

Restoration implies far more than clean-up, recovery, reorganization, or rebuilding. Activities during restoration, following in the wake of an event, can be moulded by a variety of influences. Under pressure to “get on with it,” the time to reflect and draw conclusions from what happened is typically shorter than the time that is available to prepare. Unlike preparation, restoration occurs in disorder and in circumstances of degraded performance. The time and effort to restore an organization can vary significantly depending on the amount of damage that was sustained, and the residual effects of recovery can draw out over a substantial length of time. Conclusions regarding causes for the event and what to do about it can be blurred by efforts to shift blame.

Restoration poses similar kinds of questions as we considered for preparation. At what point is it appropriate to start drawing “take away” lessons for the future? What lessons were learned within the organization in the wake of surviving a challenge? How are those lessons viewed? Who is responsible for consolidating the account of what happened, why it happened, and what to do about it? If changes are needed, are they for the short or long term? Are the changes authentic, or simply “lip service” to serve a social agenda? How vulnerable are changes to the tug of “business as usual?” Can changes be made beyond the immediate scope of the organization, or will influences that are outside of the organization push it in directions similar to those beforehand?

Preparation and restoration are not single states that occur sequentially. They are instead ebbs and flows of activity that occur in varying degrees and rates at different parts of organizations and in different neighbouring organizations. Whether either or both occur depends on will, ability, and resources.

Visible Language of Resilience

The way that a problem is presented can improve or degrade our ability to solve it (Woods, 1998: 168). Just as tools influence our ability to perform work, our verbal and visual languages influence our ability to cultivate the discipline of resilience engineering. Limits to what our visual language offers may limit our ability in discussions of resilience to express properties such as uncertainty and change through time. This is the visual equivalent of the reductive tendency in thought related to cognitive systems engineering and the substitution myth that it engenders (Feltovich et al., 2004). Many features of tasks such as continuous, simultaneous, and dynamic are challenging to manage cognitively. These and other traits are also difficult for cognitive engineers to allow for in the tools they develop. Our visual representations reflect the difficulty we have with envisioning complexity. As a result, representations show dynamic work as static, interdependent relationships as neatly bounded, and irregular work as regular and routine.

Systems are abstractions and we rely on visual as well as verbal representations to describe them in order to grasp what they could be, what they are, and how they perform. Traditional systems that are developed to operate in simpler and more static circumstances can be represented by simple, static diagrams. However, resilience is substantially about dynamic, not static, properties. New thinking along the lines of resilience requires new kinds of language to describe system properties.

Resilience anticipates future possibilities rather than simply repeating past performance. The future that resilience anticipates is not clear and well defined, but is instead uncertain and poorly defined. The best that our visual language has to offer to indicate uncertainty is dotted, rather than solid, lines. This suggests a binary state between either certain or uncertain, yet a continuum exists between certain and uncertain. The visual grammar does not yet exist to spell out degrees of certainty even though subtle degrees of uncertainty are routine in daily life.

We have similar issues when representing change. Currently, change through time is shown by diagrams such as time lines or the storyboard panels in the manner of a graphic novel or comics. These can ...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Table of Contents
• List of Figures
• List of Tables
• About the Contributors
• Acknowledgements
• Chapter 1 The Ability to Adapt
• PART I POLICY AND ORGANIZATION
• PART II MODELS AND MEASURES
• PART III ELEMENTS AND TRAITS
• PART IV APPLICATIONS AND IMPLICATIONS
• Bibliography
• Index