Since both David Woods and Sidney Dekker were in Trondheim for a PhD dissertation, SINTEF had used the opportunity and invited to a Resilience Workshop. Some 30 participants from among others aviation, railways, police, the national accident board, a few oil and gas and a bunch of PhD students turned up. Let me try to give a glimpse of the day.
Disclaimer: a LOT was said during the day (partly in a high tempo, and sometimes in little user-friendly words) and it’s difficult/impossible to catch everything, so this is obviously just scratching the surface…
Part 1: David Woods: Reaching For Resilience
Due to an “almost in time” arrival I dropped right in when David Woods started his talk. In general it’s thought that there are three drivers of Change and Innovation:
1. Connectivity
2. Sensors
3. Automation or Autonomy
Turns out one often forgets the most important one:
4. PEOPLE: Human Goals and Experience
We live in an adaptive universe. We live in it, we power it. Pressures and technologies tempt us in. We are trapped in its rules, and things don’t work like we think they do. David used the term Tangled Layered Networks to describe the things we’re in.
From collecting, analysing and sharing stories of resilience and brittleness in action we can empirically see general patterns of cycles of adaptive reverberations across networks. In our precarious present we can assess where and how our systems are brittle or resilient in the face of surprise. How can we engineer/develop for a resilient future?
David then went on discussing charting cycles of adaptations. How to get to florescence where changes in one area tend to recruit and open up beneficial changes in many other aspects of the network. The NASA were used as a (negative) example where the drive for short term Faster Better Cheaper (FBC) goals eroded the system that became brittle leading to several disasters. The challenge is to create safety under pressure.
There is a couple of explanations for Resilience:
1. Rebound from trauma
2. Robustness/well-modelled
3. Graceful Extensibility (the opposite to brittleness)
4. Sustained Adaptability
The first two are linear simplifications while the latter two are taking the look from the Adaptive Universe.
Our systems are facing “the dragons at the borderlands” that challenge normal functioning. Failure can arise through:
1. Decompensation
2. Working at cross-purposes
3. Stuck in Stale (what was effective yesterday may not be effective anymore tomorrow).
These can be countered by respectively:
1. Anticipation
2. Synchronizing over units and levels
3. Proactive learning (we don’t have to wait for accidents)
FBC pressure to make systems more efficient may deliver paradoxical results. On the surface things look good because short-term goals are met, but new forms of complexity and fragility emerge. We are highly competent when events fall within the envelope of designed-for-uncertainties. But sudden, large failures occur in the face of events that challenge or go beyond that envelope because the system is brittle and there is insufficient graceful extensibility.
Often the future seems to be implausible and the past incredible. How can we be prepared for the surprises at the borderland? Human talent and expertise is one resource. Initiative must be given to the sharp end (empower them). Another is to invest resources towards graceful extensibility.
How do you manage complexity and tilt towards florescence as connectivity, sensing, automation capabilities grow? With a positive (graceful extensibility, initiative and adjust capacity to adapt) or negative (brittleness, shortfalls, mis-calibration, trapped in trade-offs) story? The basic rules to reach resilience are emerging to: Leverage the adaptive power of human systems!
Part 2: Application of Resilience in Wideroe
Endre Berntzen and Ivonne Herrera presented a tool that has been developed and implemented by Wideroe to assist their work with proactive observations where the aim is to observe “normal people doing normal work” (and not acting up to follow procedure because they are observed). They want their personnel to tell things like they are.
In order to prevent that pilots get the idea that their performance is evaluated when they make choices and trade-off to manage challenges and conflicting goals it’s chosen to use the “label free” term “observed gaps”.
In addition Wideroe collects various indicators that can be linked to the observations.
One challenge is to protect the data. The pilots are promised confidentiality in order to get the most out of the observations.
Pilots add resilience to the system. What skills do they need to manage the variations? One must give the pilots more space to make good decisions and do their job.
Part 3: Sidney Dekker: How to Engage Stakeholders in Resilience
An extremely dynamic and engaged (without any Powerpoint slides, but a lot of acting, humor and irony and some rather sharp comments) Sidney Dekker discussed his subject by using the situation in Australia as a backdrop to illustrate what we’re up against in many instances.
Australia has still very much a late Victorian system. Human factors are seen as a (the) problem, illustrated by the 1903 quote “moral and mental shortcomings”. This characterizes the Tayloristic Universe of most MBA Educations (MBA being the abbreviation for More Bad Advice, according to Sidney): there is ONE best way (which of course only works under strict conditions while the real world rarely is this simple). The Tayloristic view means that managers and their plans are smart, while workers are dumb and not motivated. Hence focus on compliance and safety posters/slogans to “motivate” the workforce.
According to Sidney one first step in engaging stakeholders might be to rip down all the posters and look what happens - if nothing else then as an experiment. Most likely nothing will change at the safety front, but chances are that people will feel that they are taken more seriously.
But there are big stakes in holding business up. At the moment about 10% of the Australian workforce exists of so-called compliance workers of which roughly one third works in safety. So there is clear interest to keep Tayloristic views, poster programs and myths like Heinrich’s 88% or accident proneness alive.
The safety structures we have today are not enough anymore. In very safe systems Heinrichian and Reasonian (Swiss Cheese) thinking doesn’t work anymore. But it’s hard to get through the barriers raised by those that have business at stake. We need ‘micro-experiments’ to go against this ‘behemoth’.
Sidney told about a couple of these experiments. One came from a tunnelling project with a fatality. This accident happened under normal conditions where the victim was making necessary every day adjustments to get the work done ("GSD" = Gets Shit Done). So by approaching this problem the traditional way we may be fixing the wrong problems - plugging the wrong holes in the barriers. Instead of asking about accidents we should ask people about the stupidest that the company has them done.
With regard to “plugging holes” the story of Abraham Wald’s research on protection for WW2 bombers was told. He studied the damage on returning bombers in order to assess where to re-enforce their armour and had the unique insight that they had to work on the places where returning bombers did have NO holes because it was likely that damage on these places led to the loss of bombers (which then didn’t return to England for study…).
Saying ‘No’ under production pressure is a generic ability that supports resilience. Sidney told about one of his co-pilots that would say “Tell me if you see me do something that you don’t like, and I’ll do the same to you”.
Another example came from the oil and gas world where an employee encountered a lost time injury which would ruin the company’s at that time perfect LTIF metric and the connected bonus. HR came with a ‘genius’ solution to offer compassionate leave instead so the employee could take care of her sick child. The location’s HSE manager reached out for help in this situation and as a micro-experiment it was proposed to take down the ‘XX Days Without LTI’ at the gate and instead post a positive message there. Quite uniquely the HSE manager put his cell phone number at the billboard.
Our work should not be about bureaucratic accountability with systems and numbers that create a ‘Looking Good Index’, but we should have the ethical commitment to make a world with just a little bit less suffering and hurt.
Part 4: Open Space Workshop
After that it was time for the Open Space workshop (read more about the methodology on the Open Space website or Wikipedia). Each participant supplied at least two questions that he/she wanted to discuss further. These questions were clustered in four groups that were further discussed in smaller workshops:
1. Organizing for Resilience
2. Measuring for Resilience
3. Training for Resilience
4. Regulation, Compliance and Resilience
After about an hour the four sub groups returned for a feedback session.
Measuring for Resilience
I’m sorry to report that I somehow failed to make good notes from Anthony Smoker’s great feedback session. Any help would be appreciated. How to prepare for the next surprise without being surprised by the last surprise. Language does affect the measurement!
Regulation, Compliance and Resilience
Initially already discussion had been about proactive learning that doesn’t need to wait for accidents to happen. Legal systems, however, are mainly set up for learning after accidents (with national accident boards, etc.). Sidney Dekker proposed for every accident investigation to also do an investigation of a success.
In the feedback session main focus was on the homeostasis of regulations. You may choose a different approach (for example Safety I or Safety II) but the total amount of rules will stay the same, only in the traditional approach most will be actual procedures and working instructions while in the other approach most will be built into competence and courses with a minimum of formal rules. This may bring a challenge for regulators.
Training for Resilience
Some elements from this session (partly based on an ongoing EU funded project) were that it’s important to know what the actual job is all about (“work as done”) and that understanding of boundaries (can you train them without crossing them?) and trade-offs is essential. Should one train for compliance or for resilience, probably for both. Sidney Dekker added that one rather should train for objectives than for prohibitions. Theory and case based training and experience transfer are powerful tools. Training and resilience must be seen in their context.
Organizing for Resilience
This group discussed most about trade-offs and how to organize, concluding (as scientists typically do) that more empirical studies were necessary. David Woods pointed also towards the 4 I’s from his 2006 paper “How to make a Resilient Safety Organization”: Independent, Involved, Informed and Informative. One should able to question existing wisdom and customs.
Part 5: Wrapping up
David Woods summed up elements from the feedback and added his own thoughts. It’s important to keep in mind that Resilience is about more than safety, for example business continuity.
Measurement: can you map interdependencies or create tools to handle them when they emerge or matter. Examples of (hidden) interdependencies or relying on assumptions that not prove to be true in case of disaster (flood, hurricane, …).
Resilience is not just learning from events. What undermined our ability to anticipate? What undermined our ability to prepare? How do we handle the next event which will NOT be like the last event. How do we coordinate decision making at various levels? How do you scale your resources? Your challenges now are not the same as those tomorrow and our old way of doing things is unlikely to meet tomorrow’s challenges.
How do we train or practice at the boundaries? One has to train and coordinate across roles!
When implementing automation and the like often this is chosen as a possibility to make things more efficient (have the same performance with less resources), but this leads to de-skilling, fragility and problems. Instead one should opt for the resilient leverage approach where one has the opportunity to increase performance with the same resources.
Our challenge is to build partnerships within and across boundaries/disciplines. Let’s build leverages to be able to deal with future challenges and surprises.
Sidney Dekker closed off by concluding that the participants “leave with more Questions than Answers, and that’s good. Scientific progress doesn’t depend on more Answers but on asking Better Questions. So do have the courage to think differently!”.
