{"id":13501055,"url":"https://github.com/lorin/resilience-engineering","last_synced_at":"2026-01-26T13:03:09.200Z","repository":{"id":34355490,"uuid":"163348245","full_name":"lorin/resilience-engineering","owner":"lorin","description":"Resilience engineering papers","archived":false,"fork":false,"pushed_at":"2024-05-28T04:34:56.000Z","size":27083,"stargazers_count":2929,"open_issues_count":0,"forks_count":146,"subscribers_count":143,"default_branch":"master","last_synced_at":"2024-10-16T04:02:23.049Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://resiliencepapers.club","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lorin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-12-28T00:39:50.000Z","updated_at":"2024-10-11T20:16:09.000Z","dependencies_parsed_at":"2024-01-14T10:01:09.464Z","dependency_job_id":"5fed31cc-91e5-489b-bb82-e533a11f1fb6","html_url":"https://github.com/lorin/resilience-engineering","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lorin%2Fresilience-engineering","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lorin%2Fresilience-engineering/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lorin%2Fresilience-engineering/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lorin%2Fresilience-engineering/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lorin","download_url":"https://codeload.github.com/lorin/resilience-engineering/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245492577,"owners_count":20624349,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T22:01:23.788Z","updated_at":"2026-01-26T13:03:09.185Z","avatar_url":"https://github.com/lorin.png","language":null,"funding_links":[],"categories":["Others","others"],"sub_categories":[],"readme":"# Resilience engineering papers\n\n## Overview\n\nAlias: \u003chttp://resiliencepapers.club\u003e (thanks to [John Allspaw](https://twitter.com/allspaw)).\n\nThis doc contains notes about people active in resilience engineering, as well as some influential\nresearchers who are no longer with us, organized alphabetically. It also includes people and papers\nfrom related fields, such as cognitive systems engineering and naturalistic decision-making.\n\nIf you're not sure what to read first, check out [Resilience engineering: Where do I start?](intro.md)\n\n## Annotations\n\nA [BH](https://safety177496371.wordpress.com/) link indicates Ben Hutchinson's [Safety \u0026 Performance Research Summaries](https://safety177496371.wordpress.com/) blog.\nBen writes summaries of safety papers, posting them to his blog as well as LinkedIOn.\n\nA [TWRR](http://resilienceroundup.com) link indicates Thai Wood's [Resilience Roundup](http://resilienceroundup.com). Thai publishes a newsletter that\nsummarizes resilience engineering papers.\n\n## Other interesting links\n\n[resilienceinsoftware.org](https://resilienceinsoftware.org) is the Resilience in Software Foundation, a community of software people who are interested in resilience engineering.\n\n\nFor a collection of talks, check out the [Resilience Engineering, Cognitive Systems\nEngineering, and Human Factors Concepts in Software\nContexts](https://www.youtube.com/playlist?list=PLb1aZTnPf3-OMChMkrr6WsokRI6LOnuem)\nYouTube playlist maintained by John Allspaw.\n\nYou might also be interested in my [notes on David Woods's Resilience Engineering short course](https://github.com/lorin/res-eng-short-course-notes).\n\nThe papers linked here are also in the [zotero res-eng group](https://www.zotero.org/groups/2335189/res-eng/items).\n\n## People\n\nFor each person, I list concepts that they reference in their writings, along\nwith some publications. The publications lists aren't comprehensive:\nthey're ones I've read or have added to my to-read list.\n\n* [John Allspaw](#john-allspaw)\n* [Lisanne Bainbridge](#lisanne-bainbridge)\n* [Andrea Baker](#andrea-baker)\n* [E. Asher Balkin](#e-asher-balkin)\n* [Johan Bergström](#johan-bergström)\n* [Matthieu Branlat](#matthieu-branlat)\n* [Sheuwen Chuang](#sheuwen-chuang)\n* [Todd Conklin](#todd-conklin)\n* [Richard I. Cook](#richard-i-cook)\n* [Sidney Dekker](#sidney-dekker)\n* [John C. Doyle](#john-c-doyle)\n* [Bob Edwards](#bob-edwards)\n* [Anders Ericsson](#anders-ericsson)\n* [Paul Feltovich](#paul-feltovich)\n* [Pedro Ferreira](http://www.resilience-engineering-association.org/user/pedro/)\n* [Meir Finkel](#meir-finkel)\n* [Marisa Grayson](#marisa-grayson)\n* [Ivonne Andrade Herrera](#ivonne-andrade-herrera)\n* [Robert Hoffman](#robert-hoffman)\n* [Erik Hollnagel](#erik-hollnagel)\n* [Leila Johannesen](#leila-johannesen)\n* [Gary Klein](#gary-klein)\n* [Elizabeth Lay](#elizabeth-lay)\n* [Jean-Christophe Le Coze](#jean-christophe-le-coze)\n* [Nancy Leveson](#nancy-leveson)\n* [Carl Macrae](#carl-macrae)\n* [Laura Maguire](#laura-maguire)\n* [Christopher Nemeth](#christopher-nemeth)\n* [Anne-Sophie Nyssen](#anne-sophie-nyssen)\n* [Elinor Ostrom](#elinor-ostrom)\n* [Jean Pariès](#jean-paries)\n* [Emily Patterson](#emily-patterson)\n* [Charles Perrow](#charles-perrow)\n* [Shawna J. Perry](#shawna-j-perry)\n* [Jens Rasmussen](#jens-rasmussen)\n* [Mike Rayo](#mike-rayo)\n* [James Reason](#james-reason)\n* [J. Paul Reed](#j-paul-reed)\n* [Emilie M. Roth](#emilie-m-roth)\n* [Nadine Sarter](#nadine-sarter)\n* [James C. Scott](#james-c-scott)\n* [Steven Shorrock](#steven-shorrock)\n* [Barry Turner](#barry-turner)\n* [Diane Vaughan](#diane-vaughan)\n* [Robert L. Wears](#robert-l-wears)\n* [David Woods](#david-woods)\n* [John Wreathall](#john-wreathall)\n\n## Some big ideas\n\n* [The adaptive universe](#the-adaptive-universe) (David Woods)\n* [Dynamic safety model](#dynamic-safety-model) (Jens Rasmussen)\n* [Safety-II](#safety-i-vs-safety-ii) (Erik Hollnagel)\n* [Graceful extensibility](#graceful-extensibility) (David Woods)\n* [ETTO: Efficiency-tradeoff principle](#etto-principle) (Erik Hollnagel)\n* [Drift into failure](#drift-into-failure) (Sidney Dekker)\n* Robust yet fragile (John C. Doyle)\n* [STAMP: Systems-Theoretic Accident Model \u0026 Process](#stamp) (Nancy Leveson)\n* Polycentric governance (Elinor Ostrom)\n\nNote: there are now [multiple contributors](https://github.com/lorin/resilience-engineering/graphs/contributors) to this repository.\n\n## John Allspaw\n\nAllspaw is the former CTO of Etsy. He applies concepts from resilience engineering to the tech industry.\nHe is one of the founders [Adaptive Capacity Labs](http://www.adaptivecapacitylabs.com/), a resilience engineering consultancy.\n\nAllspaw tweets as [@allspaw](https://twitter.com/allspaw).\n\n### Selected publications\n\n* [STELLA: Report from the SNAFUcatchers Workshop on Coping with Complexity](https://snafucatchers.github.io/)\n* [Trade-Offs Under Pressure: Heuristics and Observations Of Teams Resolving Internet Service Outages](https://www.researchgate.net/publication/295011072_Trade-Offs_Under_Pressure_Heuristics_and_Observations_Of_Teams_Resolving_Internet_Service_Outages)\n* [Etsy Debrief Facilitation Guide](http://extfiles.etsy.com/DebriefingFacilitationGuide.pdf)\n* [Blameless PostMortems and a Just Culture](https://codeascraft.com/2012/05/22/blameless-postmortems/) (blog)\n* [Resilience engineering: learning to embrace failure](https://doi.org/10.1145/2366316.2366331)\n* [Fault Injection in Production: Making the case for resiliency testing](http://queue.acm.org/detail.cfm?id=2353017)\n* [Technical Debt: Challenges and Perspectives](https://doi.org/10.1109/MS.2017.99)\n* [Revealing the Critical Role of Human Performance in Software](https://queue.acm.org/detail.cfm?id=3380776)\n* [SRE Cognitive Work] in [Seeking SRE]\n* [The infinite hows: An argument against the Five Whys and an alternative approach you can apply](https://www.oreilly.com/radar/the-infinite-hows/)\n\n[SRE Cognitive Work]: https://www.researchgate.net/publication/343430302_SRE_Cognitive_Work\n[Seeking SRE]: https://www.oreilly.com/library/view/seeking-sre/9781491978856/\n\n### Selected talks\n\n* [Resilience Engineering: The What and How](https://devopsdays.org/events/2019-washington-dc/program/john-allspaw/)\n* [Incidents as we Imagine Them Versus How They Actually Are](https://www.youtube.com/watch?v=8DtzmV1jiyQ)\n* [How your systems keep running day after day](https://www.youtube.com/watch?v=xA5U85LSk0M)\n* [Problem detection (papers we love)](https://www.youtube.com/watch?v=NxctiGRI2y8)\n  (presentation of [Problem detection] paper)\n* [Common Ground and Coordination in Joint Activity (papers we love)](https://paperswelove.org/2016/video/john-allspaw-common-ground/) (presentation of [Common Ground and Coordination in Joint Activity] paper)\n* [Amplifying sources of resilience](https://www.infoq.com/presentations/resilience-thinking-paradigm/) (presentation about applying Resilience Engineering thinking \u0026 paradigms to the world of software engineering)\n* [Incidents: What Is Often Missed \u0026 What Can Be Done About That](https://www.adaptivecapacitylabs.com/blog/2020/03/30/incidents-what-is-often-missed-what-can-be-done-about-that/#fvp_10,1s)\n* [Incident Analysis: How *Learning* is Different Than *Fixing*](https://www.adaptivecapacitylabs.com/blog/2020/05/06/how-learning-is-different-than-fixing/)\n\n\n## Lisanne Bainbridge\n\nBainbridge is a psychology researcher. She has a website at http://www.complexcognition.co.uk/\n\n### Contributions\n\n#### Ironies of automation\n\nBainbridge is famous for her 1983 [Ironies of automation] paper, which continues to\nbe frequently cited.\n\n## Concepts\n* automation\n* design errors\n* human factors/ ergonomics\n* cognitive modelling\n* cognitive architecture\n* mental workload\n* situation awareness\n* cognitive error\n* skill and training\n* interface design\n\n## Selected publications\n* [Ironies of automation] ([TWRR](https://resilienceroundup.com/issues/35/))\n\n\n[Ironies of automation]: https://www.sciencedirect.com/science/article/abs/pii/0005109883900468\n\n## Andrea Baker\n\n[Baker](https://www.thehopmentor.com/) is a practitioner who provides\ntraining services in human and organizational performance (HOP) and learning\nteams.\n\nBaker tweets as [@thehopmentor](https://twitter.com/thehopmentor).\n\n### Concepts\n\n* Human and organizational performance (HOP)\n* Learning teams\n* Industrial empathy\n\n### Selected publications\n\n* [A bit about HOP](https://docs.wixstatic.com/ugd/1a0149_21bcf20f158540098d3d7987ffbf3f58.pdf) (editorial)\n* [A short introduction to human and organizational performance (hop) and learning teams](http://www.safetydifferently.com/a-short-introduction-to-human-and-organizational-performance-hop-and-learning-teams/) (blog post)\n\n## E. Asher Balkin\n\n### Selected publications\n\n* [Resiliency Trade Space Study: The Interaction of Degraded C2 Link and Detect and Avoid Autonomy on Unmanned Aircraft](https://www.researchgate.net/publication/330222613_Resiliency_Trade_Space_Study_The_Interaction_of_Degraded_C2_Link_and_Detect_and_Avoid_Autonomy_on_Unmanned_Aircraft)\n* [Developing Systemic Contributors and Adaptations Diagramming (SCAD): systemic insights, multiple pragmatic implementations]\n\n### Selected talks\n\n* [Root cause and the wrong path](https://www.youtube.com/watch?v=kK6t-gttsJw)\n\n## Johan Bergström\n\n[Bergström](http://www.jbsafety.se/p/about-me.html) is a safety research and\nconsultant. He runs the [Master Program of Human Factors and Systems\nSafety](http://www.humanfactors.lth.se/msc-programme/) at Lund University.\n\nBergström tweets as [@bergstrom_johan](https://twitter.com/bergstrom_johan).\n\n### Concepts\n\n* Analytical traps in accident investigation\n   - Counterfactual reasoning\n   - Normative language\n   - Mechanistic reasoning\n* Generic competencies\n\n### Selected publications\n\n* [Resilience engineering: Current status of the research and future challenges](https://www.sciencedirect.com/science/article/pii/S0925753516306130)\n* [Rule- and role retreat: An empirical study of procedures and resilience](https://www.researchgate.net/publication/50917226_Rule-_and_role_retreat_An_empirical_study_of_procedures_and_resilience)\n* [Team Coordination in Escalating Situations: An Empirical Study Using Mid-Fidelity Simulation]\n\n[Team Coordination in Escalating Situations: An Empirical Study Using Mid-Fidelity Simulation]: https://portal.research.lu.se/ws/files/1376441/3014838.pdf\n\n### Selected talks\n\n* [Three analytical traps in accident investigation](https://www.youtube.com/watch?v=TqaFT-0cY7U)\n* [Two Views on Human Error](https://www.youtube.com/watch?v=rHeukoWWtQ8)\n* [What, Where and When is Risk in System Design?](https://www.youtube.com/watch?v=BtJIumyCrtE\u0026feature=youtu.be) (Velocity 2013)\n\n## Matthieu Branlat\n\n### Selected publications\n\n* [Basic patterns in how adaptive systems fail](https://www.researchgate.net/publication/284324002_Basic_patterns_in_how_adaptive_systems_fail) ([TWRR](https://resilienceroundup.com/issues/34/))\n* [A practitioner’s experiences operationalizing Resilience Engineering]\n* [Noticing Brittleness, Designing for Resilience]\n\n[A practitioner’s experiences operationalizing Resilience Engineering]: https://www.sciencedirect.com/science/article/abs/pii/S0951832015000812\n[Noticing Brittleness, Designing for Resilience]: https://www.taylorfrancis.com/chapters/edit/10.1201/9781315605708-18/noticing-brittleness-designing-resilience-elizabeth-lay-matthieu-branlat\n\n## Sheuwen Chuang\n\n### Selected publications\n\n* [Beyond surge: Coping with mass burn casualty in the closest hospital to the Formosa Fun Coast Dust Explosion]\n* [Coping With a Mass Casualty: Insights into a Hospital’s Emergency Response and Adaptations After the Formosa Fun Coast Dust Explosion] ([TWRR](https://resilienceroundup.com/issues/76/))\n\n[Beyond surge: Coping with mass burn casualty in the closest hospital to the Formosa Fun Coast Dust Explosion]: https://doi.org/10.1016/j.burns.2018.12.003\n[Coping With a Mass Casualty: Insights into a Hospital’s Emergency Response and Adaptations After the Formosa Fun Coast Dust Explosion]: https://www.researchgate.net/publication/335366770_Coping_With_a_Mass_Casualty_Insights_into_a_Hospital's_Emergency_Response_and_Adaptations_After_the_Formosa_Fun_Coast_Dust_Explosion\n\n\n\n## Todd Conklin\n\nConklin's books are on my reading list, but I haven't read anything by him\nyet. I have listened to his great [Preaccident investigation\npodcast](https://preaccidentpodcast.podbean.com/).\n\nConklin tweets as [@preaccident](https://twitter.com/preaccident).\n\n### Selected publications\n* [Pre-accident investigations: an introduction to organizational safety](https://www.amazon.com/Pre-Accident-Investigations-Todd-Conklin/dp/1409447820)\n* [Pre-accident investigations: better questions - an applied approach to\n  operational learning](https://www.amazon.com/gp/product/1472486137)\n* [Do Safety Differently](https://www.amazon.com/Do-Safety-Differently-Sidney-Dekker/dp/B09RM3Z17V)\n\n### Selected talks\n\nQuanta - [Risk and Safety Conf 2019](https://www.youtube.com/watch?v=5WTbeFj2kJY\u0026feature=youtu.be)\n\n## Richard I. Cook\n\n[Cook](https://en.wikipedia.org/wiki/Richard_Cook_(safety_researcher)) was an anasthesiologist who studies failures in complex systems.  He is one of the founders [Adaptive Capacity Labs](http://www.adaptivecapacitylabs.com/), a resilience engineering consultancy.\nHe tweeted as [@ri_cook](https://twitter.com/ri_cook).\n\n### Concepts\n* how complex systems fail\n* degraded mode\n* sharp end (c.f. Reason's blunt end)\n* Going solid\n* Cycle of error\n* \"new look\"\n* first vs second stories\n\n### Selected publications\n\n* [A celebration of the work of Richard Cook, MD: A pioneer in understanding accidents, safety, human factors, and resilience](https://www.researchgate.net/publication/371403498_A_celebration_of_the_work_of_Richard_Cook_MD_A_pioneer_in_understanding_accidents_safety_human_factors_and_resilience)\n* [How complex systems fail](https://www.adaptivecapacitylabs.com/HowComplexSystemsFail.pdf) ([BH](https://safety177496371.wordpress.com/2022/11/04/how-complex-systems-fail-a-classic-from-richard-cook/))\n* [A brief look at the New Look in complex system failure, error, safety, and resilience](https://www.adaptivecapacitylabs.com/BriefLookAtTheNewLook.pdf)\n* [void \\*: Incidents as Untyped Pointers. *Where* complex systems fail](https://www.snafucatchers.com/single-post/2017/11/14/void-Incidents-as-Untyped-Pointers)\n* [Distancing through differencing: An obstacle to organizational learning following accidents](https://www.researchgate.net/publication/292504703_Distancing_through_differencing_An_obstacle_to_organizational_learning_following_accidents)\n* [Being bumpable](http://csel.eng.ohio-state.edu/productions/woodscta/media/beingbump.pdf) ([TWRR](https://www.getrevue.co/profile/resilience/issues/resilience-roundup-being-bumpable-issue-33-177340))\n* [Behind Human Error]\n* [Incidents - markers of resilience or brittleness?](https://www.researchgate.net/publication/292504952_Incidents_-_markers_of_resilience_or_brittleness)\n* [“Going solid”: a model of system dynamics and consequences for patient safety](https://qualitysafety.bmj.com/content/14/2/130) ([TWRR](https://resilienceroundup.com/issues/going-solid-a-model-of-system-dynamics-and-consequences-for-patient-safety/))\n* [Operating at the Sharp End: The Complexity of Human Error](https://www.researchgate.net/publication/313407259_Operating_at_the_Sharp_End_The_Complexity_of_Human_Error)\n* [Patient boarding in the emergency department as a symptom of complexity-induced risks](https://www.researchgate.net/publication/312624891_Patient_boarding_in_the_emergency_department_as_a_symptom_of_complexity-induced_risks)\n* [Sensemaking, Safety, and Cooperative Work in the Intensive Care Unit](https://www.researchgate.net/publication/220579381_Sensemaking_Safety_and_Cooperative_Work_in_the_Intensive_Care_Unit)\n* [Medication Reconciliation Is a Window into “Ordinary” Work](https://www.taylorfrancis.com/books/e/9781317164777/chapters/10.1201/9781315572529-4)\n* [Cognitive consequences of clumsy automation on high workload, high consequence human performance]\n* [Implications of automation surprises in aviation for the future of total intravenous anesthesia (TIVA)]\n* [The Messy Details: Insights From the Study of Technical Work in Healthcare]\n* [Nosocomial automation: technology-induced complexity and human performance]\n* [The New Look at Error, Safety, and Failure: A Primer for Health Care]\n* [Grounding explanations in evolving, diagnostic situations]\n* [A Tale of Two Stories: Contrasting Views of Patient Safety] (appendix B, starting on page 64 (numbered 52) contains the talk by Charles Billings, MD, Chief Scientist (retired), NASA Ames on the lessons learned from incident reporting in aviation. Dr. Billings designed, started, and managed the Aviation Safety REporting System)\n* [\"Those found responsible have been sacked\": some observations on the usefulness of error](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.623.5749\u0026rep=rep1\u0026type=pdf) ([BH](https://safety177496371.wordpress.com/2025/01/26/those-found-responsible-have-been-sacked-some-observations-on-the-usefulness-of-error/))\n* [Perspectives on Human Error: Hindsight Biases and Local Rationality])\n* [Mistaking Error]\n* [Adapting to new technology in the operating room]\n* [Verite, Abstraction, and Ordinateur Systems in the Evolution of Complex Process Control](https://www.researchgate.net/publication/3657912_Verite_abstraction_and_ordinateur_systems_in_the_evolution_of_complex_process_control)\n* [Collaborative Cross-Checking to Enhance Resilience] ([TWRR](https://resilienceroundup.com/issues/73/))\n* [Resilience Engineering: New directions for measuring and maintaining safety in complex systems]\n* [The Role of Automation in Complex System Failures]\n* [Thinking about accidents and systems](https://www.researchgate.net/publication/228352596_Thinking_about_accidents_and_systems)\n* [The Stockholm blizzard of 2012](https://www.taylorfrancis.com/books/e/9781315605739/chapters/10.1201/9781315605739-11)\n* [New Arctic Air Crash Aftermath Role-Play Simulation Orchestrating a Fundamental Surprise]\n* [Dissenting Statement: Health IT Is a Class III Medical Device](https://www.nap.edu/read/13269/chapter/14)\n* [Nine Steps to Move Forward From Error] ([BH](https://safety177496371.wordpress.com/2022/11/03/nine-steps-to-move-forward-from-error/))\n* [Gaps in the continuity of care and progress on patient safety]\n* [Above the Line, Below the Line](https://queue.acm.org/detail.cfm?id=3380777) ([TWRR](https://resilienceroundup.com/issues/68/))\n* [Coping With a Mass Casualty: Insights into a Hospital’s Emergency Response and Adaptations After the Formosa Fun Coast Dust Explosion] ([TWRR](https://resilienceroundup.com/issues/76/))\n* [SRE Cognitive Work] in [Seeking SRE]\n* [Building and revising adaptive capacity sharing for technical incident response: A case of resilience engineering](https://www.sciencedirect.com/science/article/pii/S0003687020301903) ([TWRR](https://resilienceroundup.com/issues/building-and-revising-adaptive-capacity-sharing-for-technical-incident-response-a-case-of-resilience-engineering/))\n* [Automation, interaction, complexity, and failure: A case study]\n* [Human Performance in Anesthesia]\n* [Two years before the mast: Learning how to learn about patient safety](https://www.researchgate.net/publication/285346573_Two_years_before_the_mast_Learning_how_to_learn_about_patient_safety)\n* [Resilience is not control: healthcare, crisis management, and ICT]\n* [Taking Things in One’s Stride: Cognitive Features of Two Resilient Performances]\n* [Human Performance in Anesthesia: A Corpus of Cases]\n* [Minding the Gaps: Creating Resilience in Health Care]\n* [From Counting Failures to Anticipating Risks: Possible Futures for Patient Safety]\n* [Resilience Engineering: New directions for measuring and maintaining safety in complex systems]\n* [Behind Human Error: Taming Complexity to Improve Patient Safety]\n* [The Illusion of Explanation]\n\n\n[Behind Human Error]: https://www.amazon.com/Behind-Human-Error-David-Woods/dp/0754678342\n[Cognitive consequences of clumsy automation on high workload, high consequence human performance]: https://ntrs.nasa.gov/search.jsp?R=19910011398\n[Implications of automation surprises in aviation for the future of total intravenous anesthesia (TIVA)]: https://doi.org/10.1016/S0952-8180(96)90009-4\n[The Messy Details: Insights From the Study of Technical Work in Healthcare]: https://doi.org/10.1109%2FTSMCA.2004.836802\n[Nosocomial automation: technology-induced complexity and human performance]: https://www.researchgate.net/profile/David_Woods11/publication/224649052_Nosocomial_automation_technology-induced_complexity_and_human_performance/links/59399b1da6fdcc58ae902c49/Nosocomial-automation-technology-induced-complexity-and-human-performance.pdf\n[The New Look at Error, Safety, and Failure: A Primer for Health Care]: https://pdfs.semanticscholar.org/67f7/53ec089e5a8879f241e2be867dad0a2026fb.pdf\n[Grounding explanations in evolving, diagnostic situations]: https://pdfs.semanticscholar.org/1bed/356b5aa67c701f5bad6d943768622095f418.pdf\n[A Tale of Two Stories: Contrasting Views of Patient Safety]: https://www.researchgate.net/publication/245102691_A_Tale_of_Two_Stories_Contrasting_Views_of_Patient_Safety\n[Perspectives on Human Error: Hindsight Biases and Local Rationality]: https://www.nifc.gov/PUBLICATIONS/acc_invest_march2010/speakers/Perspectives%20on%20Human%20Error.pdf\n[Mistaking Error]: https://www.researchgate.net/publication/328149714_Mistaking_Error\n[Adapting to new technology in the operating room]: https://www.researchgate.net/publication/14230576_Adapting_to_New_Technology_in_the_Operating_Room\n[Collaborative Cross-Checking to Enhance Resilience]: https://www.researchgate.net/publication/220579448_Collaborative_Cross-Checking_to_Enhance_Resilience\n[Resilience Engineering: New directions for measuring and maintaining safety in complex systems]: https://pdfs.semanticscholar.org/a0d3/9cc66adc64e297048a32b71aeee209a451af.pdf\n[The Role of Automation in Complex System Failures]: https://www.researchgate.net/publication/232191704_The_Role_of_Automation_in_Complex_System_Failures\n[New Arctic Air Crash Aftermath Role-Play Simulation Orchestrating a Fundamental Surprise]: https://www.researchgate.net/publication/2484621_New_Arctic_Air_Crash_Aftermath_Role-Play_Simulation_Orchestrating_a_Fundamental_Surprise\n[Nine Steps to Move Forward From Error]: http://csel.eng.ohio-state.edu/productions/pexis/readings/submod4/nine%20steps%20CTW2002.pdf\n[Gaps in the continuity of care and progress on patient safety]: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1117777/\n[Automation, interaction, complexity, and failure: A case study]: https://doi.org/10.1016/j.ress.2006.01.009\n[Human Performance in Anesthesia]: http://dx.doi.org/10.13140/RG.2.2.29675.36648\n[Resilience is not control: healthcare, crisis management, and ICT]: https://www.researchgate.net/profile/Robert-Wears/publication/225108705_Resilience_is_Not_Control_Healthcare_Crisis_Management_and_ICT/links/00b49532b2c7f3ed62000000/Resilience-is-Not-Control-Healthcare-Crisis-Management-and-ICT.pdf\n[Taking Things in One’s Stride: Cognitive Features of Two Resilient Performances]: https://www.taylorfrancis.com/chapters/edit/10.1201/9781315605685-19/taking-things-one-stride-cognitive-features-two-resilient-performances-richard-cook-christopher-nemeth\n[Human Performance in Anesthesia: A Corpus of Cases]: https://www.researchgate.net/publication/347964304_Human_Performance_in_Anesthesia_Human_Performance_in_Anesthesia_Human_Performance_in_Anesthesia\n[Minding the Gaps: Creating Resilience in Health Care]: https://europepmc.org/article/NBK/nbk43670\n[From Counting Failures to Anticipating Risks: Possible Futures for Patient Safety]: https://citeseerx.ist.psu.edu/document?repid=rep1\u0026type=pdf\u0026doi=ffe74633027ee354ebbf0ff9a6418e75f3b7a047\n[Resilience Engineering: New directions for measuring and maintaining safety in complex systems]: https://www.academia.edu/download/83819345/Resilience_Engineering_New_directions_fo20220411-23835-1ipo8pk.pdf\n[Behind Human Error: Taming Complexity to Improve Patient Safety]: https://citeseerx.ist.psu.edu/document?repid=rep1\u0026type=pdf\u0026doi=15f31969c4e1f4f599c5c68aa63f3bf930e0406f\n[The Illusion of Explanation]: https://onlinelibrary.wiley.com/doi/pdf/10.1197/j.aem.2004.07.001\n\n### Selected talks\n* [How Complex Systems Fail](https://www.youtube.com/watch?v=2S0k12uZR14) (Velocity 2012)\n* [Resilience in Complex Adaptive Systems: Operating at the Edge of Failure](https://www.youtube.com/watch?v=PGLYEDpNu60\u0026feature=youtu.be) (Velocity 2013)\n* [Lectures on the study of cognitive work](https://www.youtube.com/playlist?list=PLb1aZTnPf3-OEU1by77zZQQYckvXUGmNY) (Graduate student lecture-discussions at The Royal Institute of Technology, Huddinge, SWEDEN in 2012 )\n* [Panel discussion: Safety Culture, Lean, and DevOps] (DOES 2017)\n* [Working at the center of the Cyclone](https://www.youtube.com/watch?v=3ZP98stDUf0\u0026feature=youtu.be) (DOES 2018)\n* [A Few Observations on the Marvelous Resilience of Bone \u0026 Resilience Engineering](https://www.youtube.com/watch?v=8LbePBiOvZ4) (REdeploy 2019)\n\n[Panel discussion: Safety Culture, Lean, and DevOps]: https://www.youtube.com/watch?v=gtxtb9z_4FY\u0026feature=youtu.be\n\n\n## Jean-Christophe Le Coze\n\nLe Coze is research director at INERIS (National Institute for the Industrial Environment and Risks) in France.\nHe frequently writes on historical views of safety.\n\nLe Coze tweets as [@JcLeCoze](https://twitter.com/JcLeCoze).\n\n### Selected publications\n\n* [Managing the Unexpected](https://www.academia.edu/36790092/Managing_the_unexpected)\n* [The 'new view' of human error. Origins, ambiguities, success and critiques](https://www.sciencedirect.com/science/article/abs/pii/S0925753522001928)\n* [1984-2014. Normal Accident. Was Charles Perrow right for the wrong reasons?](https://www.academia.edu/15301538/1984_2014_Normal_Accident_Was_Charles_Perrow_right_for_the_wrong_reasons)\n* [Good and bad reasons: The Swiss cheese model and its critics](https://dx.doi.org/10.1016/j.ssci.2020.104660)\n* [Recurring themes in the legacy of Jens Rasmussen](https://doi.org/10.1016/j.apergo.2016.10.002)\n* [Reflecting on Jens Rasmussen’s legacy. A strong program for a hard problem](https://www.sciencedirect.com/science/article/pii/S0925753514000848)\n* [Reflecting on Jens Rasmussen's legacy (2) behind and beyond, a ‘constructivist turn’](https://www.sciencedirect.com/science/article/abs/pii/S0003687015300429)\n\n## Sidney Dekker\n\nDekker is a human factors and safety researcher with a background in aviation.\nHis books aimed at a lay audience (Drift Into Failure, Just Culture, The Field Guide to 'Human Error' investigations)\nhave been enormously influential. He was a founder of the MSc programme in Human Factors \u0026 Systems Safety at Lund University.\nHis PhD advisor is [David Woods](#david-woods).\n\nDekker tweets as [@sidneydekkercom](https://twitter.com/sidneydekkercom).\n\n### Contributions\n\n#### Drift into failure\n\nDekker developed the theory of *drift*, characterized by five concepts:\n\n1. Scarcity and competition\n1. Decrementalism, or small steps\n1. Sensitive dependence on initial conditions\n1. Unruly technology\n1. Contribution of the protective structure\n\n#### Just Culture\n\nDekker examines how cultural norms defining justice can be re-oriented to minimize the negative impact and maximize learning when things go wrong.\n\n1.  Retributive justice as society's traditional idea of justice:  distributing punishment to those responsible based on severity of the violation\n2.  Restorative justice as an improvement for both victims and practicioners:  distributing obligations of rebuilding trust to those responsible based on who is hurt and what they need\n3.  First, second, and third victims:  an incident's negative impact is felt by more than just the obvious victims\n4.  Learning theory:  people break rules when they have learned there are no negative consequences, and there are actually positive consequences - in other words, they break rules to get things done to meet production pressure\n5.  Reporting culture:  contributing to reports of adverse events is meant to help the organization understand what went wrong and how to prevent recurrence, but accurate reporting requires appropriate and proportionate accountability actions\n6.  Complex systems:  normal behavior of practicioners and professionals in the context of a complex system can appear abnormal or deviant in hindsight, particularly in the eyes of non-expert juries and reviewers\n7.  The nature of practicioners:  professionals want to do good work, and therefore want to be held accountable for their mistakes; they generally want to help similarly-situated professionals avoid the same mistake.\n\n### Safety Differently\n\n- There is a difference between the organization's prescribed processes for completing work and how work is actually completed.  (work as imagined vs work as done)\n    - The difference between work as imagined and work as done is the result of the expertise that exists in your workers from contact with real-life pressures, heuristics, and unexpected conditions.\n    - Old View: People are the problem to control with process\n        - They did something wrong\n        - They need more rules and enforcement\n        - They need to try harder\n        - We need to get rid of \"bad apples\"\n        - Focus on the \"sharp end\" of the organization - the people closest to the work\n    - New View: Work is done adaptively in an uncertain world\n        - Things go wrong all the time\n        - Workers often detect and correct these problems\n        - Local adaptations are a source of organizational expertise\n        - \"What conditions existed that made the selected course of action seem correct to the people involved?\"\n- Traditional safety interventions have diminishing yields with increasing overhead.  Accumulated compliance burden and \"safety clutter\" makes it harder to get work done *and* to do so safely.\n    - Safety Clutter is accountable to safety bureaucracy and compliance rather than the safety of the workers or the process\n    - Safety Clutter is produced by the \"blunt end\" of the organization without local expertise of what is practicable or practical in-situ\n    - Safety Clutter represents a broader \"deprofessionalization\" - a removal of trust and confidence in professionals to do their job well, removing their pride, autonomy, and achievement.\n    - Paradoxically, Safety Clutter can result from government deregulation - organizations need to self-impose risk controls in the absence of external guidelines.\n    - Sadly for organizations with Safety Clutter, more internal rules do not equal better legal protection.\n- When a process is relatively safe or stable, measurements of bad outcomes lack statistical significance to understand trends or tie trends to interventions.\n    - Fundamental Regulator Paradox: regulating a system so well that there are no useful measurements left to understand how the system is performing\n    - Zero Paradox: A study of construction contractors showed more fatal accidents in firms with \"goal zero\" safety policies than in those without.  Non-fatal accidents were similar.\n    - Risk Secrecy: \"goal zero\" commitments result in injury underreporting and hiding of incidents which prevents learning, particularly when tied to financial incentives for leadership.\n- There are patterns (capacities) that help things go well\n    - _Diversity of opinion_ - possibility to voice dissent\n    - _Keeping the discussion on risk alive_ even when things go well\n    - _Deference to expertise_ that already exists in people at the sharp end\n    - _Psychological safety_ / \"stop\" ability\n    - _Low barriers_ to interaction between organizational groups\n    - _Sharp end improvements_ to existing systems based on local expertise\n    - _Pride in work_ - process and results\n- Rapid problem-solving can prevent effective problem-understanding\n- Leadership buy-in and practice of New View safety is imperative to its success.  It's also difficult to foster.\n    - Worker buy-in is rapid and fits their existing mental model\n    - Leadership must abandon the mental model that has governed their past work and decision-making - difficult for anyone.\n    - Peer discussions are especially helpful for leadership\n    - Highlighting how local adaptations helped things go well also helps\n\n### Concepts\n* Drift into failure\n* Safety differently\n* New view vs old view of human performance \u0026 error\n* Just culture\n* complexity\n* broken part\n* Newton-Descartes\n* diversity\n* systems theory\n* unruly technology\n* decrementalism\n* generic competencies\n* work as imagined vs work as done\n\n### Selected publications\n\n* [Drift into failure](https://www.amazon.com/Drift-into-Failure-Sidney-Dekker/dp/1409422216)\n* [Reconstructing human contributions to accidents: the new view on error and performance](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.411.4985\u0026rep=rep1\u0026type=pdf)\n* [The field guide to understanding 'human error'](https://www.amazon.com/Field-Guide-Understanding-Human-Error/dp/1472439058s://www.amazon.com/Field-Guide-Understanding-Human-Error/dp/1472439058)\n* [Behind Human Error]\n* [Rule- and role retreat: An empirical study of procedures and resilience](https://www.researchgate.net/publication/50917226_Rule-_and_role_retreat_An_empirical_study_of_procedures_and_resilience?enrichId=rgreq-23625e555a0d8e5250c74f24b5fd01ca-XXX\u0026enrichSource=Y292ZXJQYWdlOzUwOTE3MjI2O0FTOjk3MzU5NjY5MjM1NzQ1QDE0MDAyMjM3NjI5NDY%3D\u0026el=1_x_2\u0026_esc=publicationCoverPdf)\n* [Anticipating the effects of technological change: A new era of dynamics for human factors](https://www.researchgate.net/publication/247512351_Anticipating_the_effects_of_technological_change_A_new_era_of_dynamics_for_human_factors)\n* [Why do things go right?](http://www.safetydifferently.com/why-do-things-go-right/)\n* [Six stages to the new view of human error](http://www.humanfactors.lth.se/fileadmin/lusa/Sidney_Dekker/articles/2007/SafetyScienceMonitor.pdf)\n* [Employees: A Problem to Control or Solution to Harness?](http://sidneydekker.com/wp-content/uploads/2014/08/DekkerPS2014.pdf)\n* [Team Coordination in Escalating Situations: An Empirical Study Using Mid-Fidelity Simulation]\n* [Resilience Engineering: New directions for measuring and maintaining safety in complex systems]\n* [Illusions of explanation: A critical essay on error classification](http://www.humanfactors.lth.se/fileadmin/lusa/Sidney_Dekker/articles/2003_and_before/Illusions_of_explanation.pdf)\n* [Failure to adapt or adaptations that fail: contrasting models on procedures and safety](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.606.3361\u0026rep=rep1\u0026type=pdf)\n* [Human factors and folk models]\n* [The High Reliability Organization Perspective] ([TWRR](https://resilienceroundup.com/issues/09/))\n* [Illusions of explanation: A critical essay on error classification](http://www.humanfactors.lth.se/fileadmin/lusa/Sidney_Dekker/articles/2003_and_before/Illusions_of_explanation.pdf) ([TWRR](https://resilienceroundup.com/issues/42/))\n* [Safety II professionals: How resilience engineering can transform safety practice] ([TWRR](https://resilienceroundup.com/issues/64/))\n* [The complexity of failure: implications of complexity theory for safety investigation](https://static1.squarespace.com/static/53b78765e4b0949940758017/t/5722beb0d51cd4d11675a69c/1461894833950/Dekker%2C+Cilliers+and+Hofmeyr+-+The+Complexity+of+Failure.pdf)\n* [The Safety Anarchist](https://www.amazon.com/Safety-Anarchist-innovation-bureaucracy-compliance/dp/1138300462))\n* [Compliance Capitalism](https://www.amazon.com/Compliance-Capitalism-Overregulated-Management-Neoliberalism/dp/1032012366)\n* [Resilience Engineering: New directions for measuring and maintaining safety in complex systems]\n* [Drifting into failure: Complexity theory and the management of risk](https://maritimesafetyinnovationlab.org/wp-content/uploads/2021/03/DekkerDriftRiskChapter2013.pdf) ([BH 1](https://safety177496371.wordpress.com/2025/05/03/drifting-into-failure-complexity-theory-and-the-management-of-risk/) [BH 2](https://safety177496371.wordpress.com/2025/05/03/complex-systems-and-drifting-into-failure-further-extracts-from-dekker-2013/))\n\n[Human factors and folk models]: https://link.springer.com/article/10.1007%2Fs10111-003-0136-9\n[The High Reliability Organization Perspective]: http://sidneydekker.com/wp-content/uploads/2013/01/CH005.pdf\n[Safety II professionals: How resilience engineering can transform safety practice]: https://doi.org/10.1016/j.ress.2019.106740\n\n### Selected talks\n\n* [Panel discussion: Safety Culture, Lean, and DevOps]\n\n\n## John C. Doyle\n\n[Doyle](http://www.cds.caltech.edu/~doyle/wiki/index.php?title=Main_Page) is a\ncontrol systems researcher. He is seeking to identify the universal laws that capture the\nbehavior of resilient systems, and is concerned with the architecture of such\nsystems.\n\n### Concepts\n* Robust yet fragile\n* layered architectures\n* constraints that deconstrain\n* protocol-based architectures\n* emergent constraints\n* Universal laws and architectures\n* conservation laws\n* universal architectures\n* Highly optimized tolerance\n* Doyle's catch\n\n#### Doyle's catch\n\n*Doyle's catch* is a term introduced by David Woods, but attributed to John Doyle. Here's how\n[Woods quotes Doyle](https://www.researchgate.net/publication/303832480_The_Risks_of_Autonomy_Doyles_Catch):\n\n\u003e Computer-based simulation and rapid prototyping tools are now broadly available and powerful enough that it is\n\u003e relatively easy to demonstrate almost anything, provided that conditions are made sufficiently idealized.\n\u003e However, the real world is typically far from idealized, and thus a system must have enough robustness in order to close\n\u003e the gap between demonstration and the real thing.\n\n\n### Selected publications\n\n* [Universal Laws and Architectures](http://www.cis.upenn.edu/~ngns/docs/Review_2010/Doyle%20MURI%202010.pdf) (slides)\n* [Contrasting Views of Complexity and Their Implications For Network-Centric Infrastructures](http://dx.doi.org/10.1109/TSMCA.2010.2048027)\n* [Architecture, constraints, and behavior](https://www.pnas.org/content/108/Supplement_3/15624)\n* [The “robust yet fragile” nature of the Internet](https://doi.org/10.1073/pnas.0501426102)\n* [Highly Optimized Tolerance: Robustness and Design in Complex Systems](http://dx.doi.org/10.1103/physrevlett.84.2529)\n* [Robust efficiency and actuator saturation explain healthy heart rate control and variability](https://doi.org/10.1073/pnas.1401883111)\n\n## Bob Edwards\n\n[Edwards](http://hopcoach.net/) is a practitioner who provides\ntraining services in human and organizational performance (HOP).\n\nEdwards tweets as [@thehopcoach](https://twitter.com/thehopcoach).\n\n## Anders Ericsson\n\nEricsson introduced the idea of *deliberate practice* as a mechanism for\nachieving high level of expertise.\n\nEricsson isn't directly associated with the field of resilience engineering.\nHowever, Gary Klein's work is informed by his, and I have a particular\ninterest in how people improve in expertise, so I'm including him here.\n\n### Concepts\n\n* Expertise\n* Deliberate practice\n* Protocol analysis\n\n### Selected publications\n\n* [Peak: secrets from the new science of expertise](https://www.amazon.com/Peak-Secrets-New-Science-Expertise/dp/1531864880/)\n* [Protocol analysis: verbal reports as data](https://www.amazon.com/Protocol-Analysis-Revd-Verbal-Reports/dp/0262550237)\n\n## Paul Feltovich\n\n[Feltovich](https://www.ihmc.us/groups/pfeltovich/) is a retired Senior Research Scientist at the Florida Institute for Human \u0026 Machine Cognition (IHMC),\nwho has done extensive reserach in human expertise.\n\n### Selected publications\n\n* [Common Ground and Coordination in Joint Activity]\n* [Issue of expert flexibility in contexts characterized by complexity and change](https://www.researchgate.net/publication/232465540_Issue_of_expert_flexibility_in_contexts_characterized_by_complexity_and_change)\n* [A rose by any other name...would probably be given an acronym]\n* [Learners' (mis)understanding of important and difficult concepts: a challenge to smart machines in education](https://www.researchgate.net/publication/234818797_Learners'_misunderstanding_of_important_and_difficult_concepts_a_challenge_to_smart_machines_in_education)\n* [Ten challenges for making automation a team player] ([TWRR](https://resilienceroundup.com/issues/ten-challenges-for-making-automation-a-team-player-in-joint-human-agent-activity/))\n* [Issue of expert flexibility in contexts characterized by complexity and change](https://www.researchgate.net/publication/232465540_Issue_of_expert_flexibility_in_contexts_characterized_by_complexity_and_change)\n\n[Common Ground and Coordination in Joint Activity]: http://jeffreymbradshaw.net/publications/Common_Ground_Single.pdf\n[A rose by any other name...would probably be given an acronym]: https://www.researchgate.net/publication/3454029_A_rose_by_any_other_namewould_probably_be_given_an_acronym\n[Ten challenges for making automation a team player]: https://ieeexplore.ieee.org/abstract/document/1363742\n\n## Meir Finkel\n\nFinkel is a Colonel in the Israeli Defense Force (IDF) and the Director of the IDF's Ground Forces Concept Development and Doctrine Department\n\n### Selected publications\n* [On Flexibility: Recovery from Technological and Doctrinal Surprise on the Battlefield](https://www.amazon.com/Flexibility-Recovery-Technological-Doctrinal-Battlefield/dp/0804774897/ref=sr_1_3?ie=UTF8\u0026qid=1546046916\u0026sr=8-3\u0026keywords=on+flexibility)\n\n## Marisa Grayson\n\n[Grayson](https://www.linkedin.com/in/marisa-grayson/) is a cognitive systems engineer at Mile Two, LLC.\n\n### Selected Publications\n\n* [Approaching Overload: Diagnosis and Response to Anomalies in Complex and Automated Production Software Systems](https://www.researchgate.net/publication/333091997_Approaching_Overload_Diagnosis_and_Response_to_Anomalies_in_Complex_and_Automated_Production_Software_Systems)\n* [Cognitive Work of Hypothesis Exploration During Anomaly Response](https://queue.acm.org/detail.cfm?id=3380778)\n\n## Ivonne Andrade Herrera\n\n[Herrera](https://www.ntnu.edu/employees/ivonne.a.herrera) is an associate professor in\nthe department of industrial economics and technology management at NTNU and a\nsenior research scientist at SINTEF. Her areas of expertise include safety management and\nresilience engineering in avionics and air traffic management.\n\n### Selected publications\n\n* [Organisational accidents and resilient organisations: six perspectives](https://www.sintef.no/globalassets/upload/teknologi_og_samfunn/sikkerhet-og-palitelighet/rapporter/sintef-a17034-organisational-accidents-and-resilience-organisations-six-perspectives.-revision-2.pdf) (SINTEF A17034 report)\n\nSee also: [list of publications](https://wo.cristin.no/as/WebObjects/cristin.woa/wa/fres?sort=ar\u0026pnr=30556\u0026action=sok)\n\n\n## Robert Hoffman\n\n[Hoffman](https://www.ihmc.us/groups/rhoffman/) is a senior research scientist at Florida Institute for Human \u0026 Machine Cognition (IHMC),\nwho has done extensive reserach in human expertise.\n\n### Selected publications\n\n* [Measuring resilience](https://journals.sagepub.com/doi/abs/10.1177/0018720816686248)\n* [Myths of automation and their implications for military procurement]\n* [The Seven Deadly Myths of \"Autonomous Systems\"]\n* [A rose by any other name...would probably be given an acronym]\n* [Seeing the invisible: perceptual-cognitive aspects of expertise](https://cmapspublic3.ihmc.us/rid=1G9NSY15K-N7MJMZ-LC5/SeeingTheInvisible.pdf)\n* [Toward a Theory of Complex and Cognitive Systems]\n* [Macrocognition] ([TWRR](https://resilienceroundup.com/issues/62/))\n\n[Myths of automation and their implications for military procurement]:https://www.researchgate.net/publication/326000581_Myths_of_automation_and_their_implications_for_military_procurement\n\n[The Seven Deadly Myths of \"Autonomous Systems\"]: https://www.researchgate.net/publication/260304859_The_Seven_Deadly_Myths_of_Autonomous_Systems\n\n[Toward a Theory of Complex and Cognitive Systems]: https://www.researchgate.net/publication/3454245_Toward_a_Theory_of_Complex_and_Cognitive_Systems\n\n[Macrocognition]: https://pdfs.semanticscholar.org/df74/b2909f54b41a485cd4c0189fc4aa19d176d0.pdf\n\n\n### Concepts\n\n#### Seven deadly myths of autonomous systems\n\n1. \"Autonomy\" is unidimensional.\n2. The conceptualization of \"levels of autonomy\" is a useful scientific grounding for the development of autonomous system roadmaps.\n3. Autonomy is a widget.\n4. Autonomous systems are autonomous.\n5. Once achieved, full autonomy obviates the need for human-machine collaboration.\n6. As machines acquire more autonomy, they will work as simple sibstitutes (or multipliers) of human capability\n7. \"Full autonomy\"  is not only possible, but is always desireable.\n\n## Erik Hollnagel\n\n### Contributions\n\n#### ETTO principle\n\nHollnagel proposed that there is always a fundamental tradeoff between\nefficiency and thoroughness, which he called the *ETTO principle*.\n\n#### Safety-I vs. Safety-II\n\nSafety-I: avoiding things that go wrong\n* looking at what goes wrong\n* bimodal view of work and activities (acceptable vs unacceptable)\n* find-and-fix approach\n* prevent transition from 'normal' to 'abnormal'\n* causality credo: believe that adverse outcomes happen because something goes\n  wrong (they have causes that can be found and treated)\n* it either works or it doesn't\n* systems are decomposable\n* functioning is bimodal\n\nSafety-II: performance variability rather than bimodality\n* the system’s ability to succeed under varying conditions, so that the number\n  of intended and acceptable outcomes (in other words, everyday activities) is\n  as high as possible\n* performance is always variable\n* performance variation is ubiquitous\n* things that go right\n* focus on frequent events\n* remain sensitive to possibility of failure\n* be thorough as well as efficient\n\n#### FRAM\n\nHollnagel proposed the Functional Resonance Analysis Method (FRAM) for modeling\ncomplex socio-technical systems.\n\n\n#### Four abilities necessary for resilient performance\n* respond\n* monitor\n* learn\n* anticipate\n\n### Concepts\n* ETTO (efficiency thoroughness tradeoff) principle\n* FRAM (functional resonance analysis method)\n* Safety-I and Safety-II\n* things that go wrong vs things that go right\n* causality credo\n* performance variability\n* bimodality\n* emergence\n* work-as-imagined vs. work-as-done\n* joint cognitive systems\n* systems of the first, second, third, fourth kind\n\n### Selected publications\n\n* [The ETTO Principle: Efficiency-Thoroughness Trade-Off: Why Things That Go Right Sometimes Go Wrong](https://www.amazon.com/ETTO-Principle-Efficiency-Thoroughness-Trade-Off-Sometimes/dp/0754676781/ref=sr_1_1?s=books\u0026ie=UTF8\u0026qid=1545965837\u0026sr=1-1\u0026keywords=etto+principle)\n* [From Safety-I to Safety-II: A White Paper](https://www.skybrary.aero/bookshelf/books/2437.pdf)\n* [Safety-II in Practice](https://www.amazon.com/Safety-II-Practice-Developing-Resilience-Potentials/dp/1138708925)\n* [Safety-I and Safety-II: The past and future of safety management](https://www.amazon.com/gp/product/1472423089/ref=dbs_a_def_rwt_bibl_vppi_i0)\n* [FRAM: The Functional Resonance Analysis Method: Modelling Complex Socio-technical System](https://www.amazon.com/gp/product/B010WIDYE8/ref=dbs_a_def_rwt_bibl_vppi_i15)\n* [Joint Cognitive Systems: Patterns in Cognitive Systems Engineering](https://www.amazon.com/gp/product/0849339332/ref=x_gr_w_bb?ie=UTF8\u0026tag=x_gr_w_bb-20\u0026linkCode=as2\u0026camp=1789\u0026creative=9325\u0026creativeASIN=0849339332\u0026SubscriptionId=1MGPYB6YW3HWK55XCGG2)\n* [Resilience Engineering: Concepts and Precepts]\n* [I want to believe: some myths about the management of industrial safety](http://dx.doi.org/10.1007/s10111-012-0237-4)\n* [Resilience engineering – Building a Culture of Resilience](http://www.ptil.no/getfile.php/1325150/PDF/Seminar%202013/Integrerte%20operasjoner/Hollnagel_RIO_presentation.pdf) (slides)\n* [Anomaly Response]\n* [Cognitive Systems Engineering: New wine in new bottles] ([TWRR](https://www.getrevue.co/profile/resilience/issues/resilience-roundup-cognitive-systems-engineering-new-wine-in-new-bottles-issue-32-175912))\n* [Epilogue: Resilience Engineering Precepts](https://www.researchgate.net/publication/265074845_Epilogue_Resilience_Engineering_Precepts)\n* [Resilience Engineering: New directions for measuring and maintaining safety in complex systems]\n* [Resilience Engineering](https://erikhollnagel.com/ideas/resilience-engineering.html) (web essay)\n* [RAG - Resilience Analysis Grid](http://erikhollnagel.com/onewebmedia/RAG%20Outline%20V2.pdf)\n* [Resilience engineering in practice: a guidebook]\n* [Mapping Cognitive Demands in Complex Problem-Solving Worlds] (mentions disturbance management)\n* [Human factors and folk models]\n* [Designing for joint cognitive systems](https://www.researchgate.net/publication/4213914_Designing_for_joint_cognitive_systems)\n* [Macrocognition] ([TWRR](https://resilienceroundup.com/issues/62/))\n* [A day when (Almost) nothing happened](https://www.sciencedirect.com/science/article/abs/pii/S0925753521004719)\n* [Minding the Gaps: Creating Resilience in Health Care]\n* [Resilience Engineering: New directions for measuring and maintaining safety in complex systems]\n* [Understanding Accidents - From Root Causes to Performance Variability](https://www.researchgate.net/publication/3973687_Understanding_accidents-from_root_causes_to_performance_variability) ([BH](https://safety177496371.wordpress.com/2025/03/12/understanding-accidents-from-root-causes-to-performance-variability/))\n* [Human error: trick or treat](https://onlinelibrary.wiley.com/doi/abs/10.1002/9780470713181.ch9)\n* [THe 5th paradox of safety](https://incrementalsafety.com/onewebmedia/fifth%20paradox%20oct%2031.pdf) ([BH](https://safetyinsights.org/2026/01/09/the-fifth-paradox-of-safety-new-article-from-erik-hollnagel/))\n\n\n[Resilience Engineering: Concepts and Precepts]: https://www.amazon.com/gp/product/B009KNDF64/ref=x_gr_w_glide_bb?ie=UTF8\u0026tag=x_gr_w_glide_bb-20\u0026linkCode=as2\u0026camp=1789\u0026creative=9325\u0026creativeASIN=B009KNDF64\u0026SubscriptionId=1MGPYB6YW3HWK55XCGG2\n[Anomaly Response]: https://docs.wixstatic.com/ugd/3ad081_f46dda684154447583c8a5b282b60cc2.pdf\n[Cognitive Systems Engineering: New wine in new bottles]: https://www.ida.liu.se/~729A15/mtrl/CSEnew.pdf?utm_campaign=Resilience%20Roundup\u0026utm_medium=email\u0026utm_source=Revue%20newsletter\n[Resilience Roundup]: https://resilienceroundup.com/\n[Mapping Cognitive Demands in Complex Problem-Solving Worlds]: https://www.researchgate.net/publication/220108174_Mapping_Cognitive_Demands_in_Complex_Problem-Solving_Worlds\u003cPaste\u003e\n\n## Leila Johannesen\n\n[Johannesen](https://www.linkedin.com/in/leilajohannesen/) is currently a UX researcher and community advocate at IBM.\nHer PhD dissertation work examined how humans cooperate, including studies of anesthesiologists.\n\n### Concepts\n\n* common ground\n\n### Selected publications\n\n* [Grounding explanations in evolving, diagnostic situations]\n* [Maintaining common ground: an analysis of cooperative communication in the operating room](https://www.abdn.ac.uk/iprc/documents/Communication%20Book%20Chapter.pdf)\n* [Behind Human Error]\n\n\n## Gary Klein\n\nKlein studies how experts are able to quickly make effective decisions in high-tempo situations.\n\nKlein tweets as [@KleInsight](https://twitter.com/KleInsight).\n\n### Concepts\n\n* naturalistic decision making (NDM)\n* intuitive expertise\n* cognitive task analysis\n* common ground\n* problem detection\n* automation as a \"team player\"\n\n### Selected publications\n\n* [Sources of power: how people make decisions](https://www.amazon.com/gp/product/0262534290/ref=dbs_a_def_rwt_bibl_vppi_i0)\n* [Common Ground and Coordination in Joint Activity]\n* [Working minds: a practitioner's guide to cognitive task analysis](https://www.amazon.com/gp/product/0262532816/ref=dbs_a_def_rwt_bibl_vppi_i5)\n* [Patterns in Cooperative Cognition](https://www.researchgate.net/publication/262449980_Patterns_in_Cooperative_Cognition)\n* [Can We Trust Best Practices? Six Cognitive Challenges of Evidence-Based Approaches]\n* [Conditions for intuitive expertise: a failure to disagree](http://dx.doi.org/10.1037/a0016755)\n* [Problem detection]\n* [Ten challenges for making automation a team player] ([TWRR](https://resilienceroundup.com/issues/66))\n* [Decision making in action: models and methods](http://www.macrocognition.com/documents/Decision-Making-in-Action-Models-and-Methods-0316.pdf)\n* [Critical decision method for eliciting knowledge](https://ieeexplore.ieee.org/document/31053)\n* [A recognition-primed decision (RPD) model of rapid decision making](https://pdfs.semanticscholar.org/0672/092ecc507fb41d81e82d2986cf86c4bff14f.pdf)\n* [Seeing the invisible: perceptual-cognitive aspects of expertise](https://cmapspublic3.ihmc.us/rid=1G9NSY15K-N7MJMZ-LC5/SeeingTheInvisible.pdf)\n* [Patterns in Cooperative Cognition]\n* [The strengths and limitations of teams for detecting problems](https://link.springer.com/article/10.1007/s10111-005-0024-6)\n* [Macrocognition] ([TWRR](https://resilienceroundup.com/issues/62/))\n\n[Problem detection]: https://www.researchgate.net/publication/220579480_Problem_detection\n[Patterns in Cooperative Cognition]: https://www.researchgate.net/publication/262449980_Patterns_in_Cooperative_Cognition\n[Can We Trust Best Practices? Six Cognitive Challenges of Evidence-Based Approaches]: https://journals.sagepub.com/doi/abs/10.1177/1555343416637520?journalCode=edma\n\n### Selected talks\n\n* [Problem detection](https://www.youtube.com/watch?v=UXx51qK4ItQ\u0026feature=emb_title)\n\n## Elizabeth Lay\n\nElizabeth Lay is a resilience engineering practitioner. She is currently a director of safety and human performance at Lewis Tree Service.\n\n### Selected publications\n\n* [Noticing Brittleness, Designing for Resilience]\n* [A practitioner’s experiences operationalizing Resilience Engineering]\n\n## Nancy Leveson\n\nNancy Leveson is a computer science researcher with a focus in software safety.\n\n### Contributions\n\n#### STAMP\n\nLeveson developed the accident causality model known as STAMP: the Systems-Theoretic Accident Model and Process.\n\nSee [STAMP](STAMP.md) for some more detailed notes of mine.\n\n### Concepts\n\n* Software safety\n* STAMP (systems-theoretic accident model and processes)\n* STPA (system-theoretic process analysis) hazard analysis technique\n* CAST (causal analysis based on STAMP) accident analysis technique\n* Systems thinking\n* hazard\n* interactive complexity\n* system accident\n* dysfunctional interactions\n* safety constraints\n* control structure\n* dead time\n* time constants\n* feedback delays\n\n### Selected publications\n* [A New Accident Model for Engineering Safer Systems](http://sunnyday.mit.edu/accidents/safetyscience-single.pdf)\n* [Engineering a safer world](https://mitpress.mit.edu/books/engineering-safer-world)\n* [STPA Handbook](http://psas.scripts.mit.edu/home/get_file.php?name=STPA_handbook.pdf)\n* [Safeware](https://www.amazon.com/Safeware-Computers-Nancy-G-Leveson/dp/0201119722)\n* [Resilience Engineering: Concepts and Precepts](https://www.amazon.com/gp/product/B009KNDF64/ref=x_gr_w_glide_bb?ie=UTF8\u0026tag=x_gr_w_glide_bb-20\u0026linkCode=as2\u0026camp=1789\u0026creative=9325\u0026creativeASIN=B009KNDF64\u0026SubscriptionId=1MGPYB6YW3HWK55XCGG2)\n* [High-pressure steam engines and computer software](http://dx.doi.org/10.1145/143062.143076)\n* [Resilience Engineering: Concepts and Precepts]\n\n## Carl Macrae\n\n[Macrae](https://www.nottingham.ac.uk/business/people/lizcjm.html) is a social psychology\nresearcher who has done safety research in multiple domains, including aviation\nand healthcare. He helped set up the new healthcare investigation agency in\nEngland. He is currently a professor of organizational behavior and psychology\nat the Notthingham University Business School.\n\nMacrae tweets at [@CarlMacrae](https://twitter.com/CarlMacrae).\n\n### Concepts\n\n* risk resilience\n\n### Selected publications\n\n* [Close calls](http://www.closecalls.cc/)\n* [Early warnings, weak signals and learning from healthcare disasters](https://qualitysafety.bmj.com/content/23/6/440)\n\n## Laura Maguire\n\n[Maguire](https://www.linkedin.com/in/lauramaguire/) is a cognitive systems\nengineering researcher with a PhD from Ohio State\nUniversity. Maguire has done safety work in multiple domains, including\nforestry, avalanches, and software services. She currently works as a researcher\nat [jeli.io](jeli.io)\n\nMaguire tweets as [@LauraMDMaguire](https://twitter.com/lauramdmaguire).\n\n### Selected publications\n\n* [Managing the Hidden Costs of Coordination](https://queue.acm.org/detail.cfm?id=3380779)\n* [Controlling the Costs of Coordination in Large-scale Distributed Software Systems](http://rave.ohiolink.edu/etdc/view?acc_num=osu1593661547087969) (PhD dissertation)\n* [Howie: The Post-Incident Guide](https://www.jeli.io/howie-the-post-incident-guide/)\n\n### Selected talks\n\n* [How Many Is Too Much? Exploring Costs of Coordination During Outages](https://www.infoq.com/presentations/incident-command-system/)\n* [Mental models – why saying “I didn’t know it worked that way” is a sign of expertise not incompetence](https://www.youtube.com/watch?v=VEprjLtHzg0)\n* [Operating at the edge of the envelope](https://re-deploy.io/videos/27-maguire.html)\n\n## Christopher Nemeth\n\n[Nemeth](https://www.linkedin.com/in/christopher-nemeth-6651204) is a principal scientist at Applied Resesarch Associates, Inc.\n\n### Selected publications\n\n* [Replacing Hindsight With Insight: Toward Better Understanding of Diagnostic Failures]\n* [Resilience is not control: healthcare, crisis management, and ICT]\n* [Taking Things in One’s Stride: Cognitive Features of Two Resilient Performances]\n* [Minding the Gaps: Creating Resilience in Health Care]\n\n\n[Replacing Hindsight With Insight: Toward Better Understanding of Diagnostic Failures]: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.458.7283\u0026rep=rep1\u0026type=pdf\n\n## Anne-Sophie Nyssen\n\n[Nyssen](http://www.lecit.ulg.ac.be/equipe/anne-sophie-nyssen/) is a psychology professor at the University of Liège,\nwho does research on human error in complex systems, in particular in medicine.\n\nA list of publications can be found on her website linked above.\n\n\n## Elinor Ostrom\n\n[Ostrom](http://www.elinorostrom.com/) was a Nobel-prize winning economics and\npolitical science researcher.\n\n### Selected publications\n* [Coping with tragedies of the commons](https://www.annualreviews.org/doi/abs/10.1146/annurev.polisci.2.1.493)\n* [Governing the Commons: The Evolution of Institutions for Collective Action](https://www.amazon.com/Governing-Commons-Evolution-Institutions-Collective/dp/1107569788)\n\n### Concepts\n\n* tragedy of the commons\n* polycentric governance\n* social-ecological system framework\n\n## Jean Pariès\n\nPariès is the president of [Dédale](http://www.dedale.net/dedale_en/), a safety and human factors consultancy.\n\n### Selected publications\n* [Resilience engineering in practice: a guidebook]\n\n\n[Resilience engineering in practice: a guidebook]: https://www.crcpress.com/Resilience-Engineering-in-Practice-A-Guidebook/Paries-Wreathall-Hollnagel/p/book/9781472420749\n### Selected talks\n\n* [Predicting The fatal flaws: The challenge of The unpredictable...](paries-keynote-2015.pptx)\n\n## Emily Patterson\n\n[Patterson](https://hrs.osu.edu/faculty-and-staff/faculty-directory/patterson-emily)\nis a researcher who applies human factors engineering to improve patient safety\nin healthcare.\n\n### Selected publications\n\n* [Patient boarding in the emergency department as a symptom of complexity-induced risks](https://www.researchgate.net/publication/312624891_Patient_boarding_in_the_emergency_department_as_a_symptom_of_complexity-induced_risks)\n* [Using observational study as a tool for discovery: uncovering cognitive and collaborative demands and adaptive strategies]\n* [Voice Loops as Coordination Aids in Space Shuttle Mission Control]\n* [Functionally distributed coordination during anomaly response in space shuttle mission control]\n* [Patterns in Cooperative Cognition]\n* [Collaborative Cross-Checking to Enhance Resilience] ([TWRR](https://resilienceroundup.com/issues/73/))\n* [New Arctic Air Crash Aftermath Role-Play Simulation Orchestrating a Fundamental Surprise]\n* [Handoff strategies in settings with high consequences for failure: lessons for health care operations] ([TWRR](https://resilienceroundup.com/issues/56))\n* [How Unexpected Events Produce An Escalation Of Cognitive And Coordinative Demands] ([TWRR](https://resilienceroundup.com/issues/how-unexpected-events-produce-an-escalation-of-cognitive-and-coordinative-demands/))\n* [Communication Strategies from High-reliability Organizations: Translation is Hard Work](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1876978/) ([TWRR](https://resilienceroundup.com/issues/communication-strategies-from-high-reliability-organizations-translation-is-hard-work/))\n* [Understanding rigor in information analysis]\n* [Behind Human Error: Taming Complexity to Improve Patient Safety]\n\n[Using observational study as a tool for discovery: uncovering cognitive and collaborative demands and adaptive strategies]: https://www.researchgate.net/profile/Emily_Patterson2/publication/237138704_USING_OBSERVATIONAL_STUDY_AS_A_TOOL_FOR_DISCOVERY_UNCOVERING_COGNITIVE_AND_COLLABORATIVE_DEMANDS_AND_ADAPTIVE_STRATEGIES/links/0deec52c8e310b385a000000.pdf\n\n[Voice Loops as Coordination Aids in Space Shuttle Mission Control]: https://www.semanticscholar.org/paper/Voice-Loops-as-Coordination-Aids-in-Space-Shuttle-Patterson-Watts-Perotti/068dfee1a859a63fa2ef82f008d239e6a81ed004\n\n[Functionally distributed coordination during anomaly response in space shuttle mission control]: https://www.researchgate.net/publication/3657906_Functionally_distributed_coordination_during_anomaly_response_inspace_shuttle_mission_control\n\n[How Unexpected Events Produce An Escalation Of Cognitive And Coordinative Demands]: http://csel.eng.ohio-state.edu/productions/laws/laws_mediapaper/2_4_escalation.pdf\n\n[Handoff strategies in settings with high consequences for failure: lessons for health care operations]: https://www.researchgate.net/publication/8648890_Handoff_strategies_in_settings_with_high_consequences_for_failure_Lessons_for_health_care_operations\n\n[Understanding rigor in information analysis]: https://www.researchgate.net/publication/228809190_Understanding_rigor_in_information_analysis\n\n\n\n## Charles Perrow\n\nPerrow is a sociologist who studied the Three Mile Island disaster.  \"Normal Accidents\" is cited by numerous other influential systems engineering publications such as [Vaughan's](#diane-vaughan) \"The Challenger Launch Decision\".\n\n### Concepts\n* Complex systems: A system of tightly-coupled components with common mode connections that is prone to unintended feedback loops, complex controls, low observability, and poorly-understood mechanisms.  They are not always high-risk, and thus their failure is not always catastrophic.\n* Normal accidents: Complex systems with many components exhibit unexpected interactions in the face of inevitable component failures.  When these components are tightly-coupled, failed parts cannot be isolated from other parts, resulting in unpredictable system failures.  Crucially, adding more safety devices and automated system controls often makes these coupling problems worse.\n* Common-mode:  The failure of one component that serves multiple purposes results in multiple associated failures, often with high interactivity and low linearity - both ingredients for unexpected behavior that is difficult to control.\n* Production pressures and safety:  Organizations adopt processes and devices to improve safety and efficiency, but production pressure often defeats any safety gained from the additions:  the safety devices allow or encourage more risky behavior.  As an unfortunate side-effect, the system is now also more complex.\n\n### Selected publications\n* [Normal Accidents: Living With High-Risk Technologies](https://www.amazon.com/Normal-Accidents-Living-Technologies-Updated-ebook/dp/B00CHRINUI)\n\n## Shawna J. Perry\n\nPerry is a medical researcher who studies emergency medicine.\n\n### Concepts\n* Underground adaptations\n* Articulated functions vs. important functions\n* Unintended effects\n* Apparent success vs real success\n* Exceptions\n* Dynamic environments\n\n### Selected publications\n\n* [Underground adaptations: case studies from health care](https://doi.org/10.1007/s10111-011-0207-2)\n* [Can We Trust Best Practices? Six Cognitive Challenges of Evidence-Based Approaches]\n* [The Role of Automation in Complex System Failures]\n* [Extemporaneous Adaptation to Evolving Complexity: A Case Study of Resilience in Healthcare] ([TWRR](https://resilienceroundup.com/issues/55))\n* [Automation, interaction, complexity, and failure: A case study]\n\n### Other\n\n* [Interview on Naturalistic Decision Making podcast](https://open.spotify.com/episode/7lHcgt2KuDoLyvTP9wMbEn?si=nPIyk9L8QB2Iuck2fKKrNA)\n\n\n\n[Extemporaneous Adaptation to Evolving Complexity: A Case Study of Resilience in Healthcare]: https://pdfs.semanticscholar.org/1423/f18530599b9de186af0eee4852bb7e619384.pdf\n\n## Jens Rasmussen\n\nJens Rasmussen was an enormously influential researcher in human factors and safety systems. In particular, you can see his influence in the work of Sidney Dekker, Nancy Leveson, David Woods.\n\n### Contributions\n\n#### Skill-rule-knowledge (SKR) model\n\nRasmussen proposed three models of human performance.\n\n**Skill-based** behavior doesn't require conscious attention. The prototypical example is riding a bicycle.\n\n**Rule-based** behavior is based on a set of rules that we have internalized in\nadvance. We select which rule to use based on experience, and then carry it\nout. An example would be: if threads are blocked, restart the server. You can think of rule-based behavior as a memorized runbook.\n\n**Knowledge-based** behavior comes into play when facing an unfamiliar\nsituation. The person generates a set of plans based on their understanding of\nthe environment, and then selects which one to use. The challenging incidents\nare the ones that require knowledge-based behavior to resolve.\n\nHe also proposed three types of information that humans process as they perform work.\n\n**Signals**. Example: weather vane\n\n**Signs**. Example: stop sign\n\n**Symbols**. Example: written language\n\n#### Abstraction hierarchy\n\nRasmussen proposed a model of how operators reason about the behavior of a\nsystem they are supervising called the *abstraction hierarchy*.\nThe levels in the hierarchy are\n\n1. functional purpose\n2. abstract functions\n3. general functions\n4. physical funcitons\n5. physical form\n\nThe hierarchy forms a means-ends relationship: proper function is described top-down (ends), and problems are explained bottom-up (means)\n\n\n#### Dynamic safety model\n\nRasmussen proposed a state-based model of a socio-technical system as a system\nthat moves within a region of a state space. The region is surrounded by\ndifferent boundaries:\n\n* economic failure\n* unacceptable work load\n* functionality acceptable performance\n\n![Migration to the boundary](boundary.png)\n\nSource: [Risk management in a dynamic society: a modelling problem]\n\nIncentives push the system towards the boundary of acceptable performance:\naccidents happen when the boundary is exceeded.\n\n\n#### AcciMaps\n\nThe AcciMaps approach is a technique for reasoning about the causes of an accident, using a diagram.\n\n\n#### Risk management framework\n\nRasmussen proposed a multi-layer view of socio-technical systems:\n\n![Risk management framework](risk-management-framework.png)\n\nSource: [Risk management in a dynamic society: a modelling problem]\n\n### Concepts\n* Dynamic safety model\n* Migration toward accidents\n* Risk management framework\n* Boundaries:\n    - boundary of functionally acceptable performance\n    - boundary to economic failure\n    - boundary to unacceptable work load\n* Cognitive systems engineering\n* Skill-rule-knowledge (SKR) model\n* AcciMaps\n* Means-ends hierarchy\n* Ecological interface design\n* Systems approach\n* Control-theoretic\n* decisions, acts, and errors\n* hazard source\n* anatomy of accidents\n* energy\n* systems thinking\n* trial and error experiments\n* defence in depth (fallacy)\n* Role of managers\n\t- Information\n\t- Competency\n\t- Awareness\n\t- Commitment\n* Going solid\n* observability\n\n### Selected publications\n* [Mental procedures in real-life tasks: a case study of electronic trouble shooting](https://www.tandfonline.com/doi/abs/10.1080/00140137408931355) (1974)\n* [Coping with complexity](https://orbit.dtu.dk/en/publications/coping-with-complexity)\n* [Skills, rules, and knowledge; signals, signs, and symbols, and other distinctions in human performance models](https://www.iwolm.com/wp-content/downloads/SkillsRulesAndKnowledge-Rasmussen.pdf)\n* [“Going solid”: a model of system dynamics and consequences for patient safety](https://qualitysafety.bmj.com/content/14/2/130)\n* [Human error and the problem of causality in analysis of accidents](https://www.ida.liu.se/~729A71/Literature/Human%20Error_T/Rasmussen_1990.pdf) ([TWRR](https://resilienceroundup.com/issues/human-error-and-the-problem-of-causality-in-analysis-of-accidents/))\n* [Human Errors: A Taxonomy for Describing Human Malfunction in Industrial Installations](https://backend.orbit.dtu.dk/ws/portalfiles/portal/158020073/ERTAX1.PDF)\n* [Ecological interfaces: A technological imperative in high‐tech systems](https://core.ac.uk/download/pdf/13788397.pdf)\n* [Information processing and human-machine interaction: an approach to cognitive engineering](https://www.amazon.com/Information-Processing-Human-Machine-Interaction-North-Holland/dp/0444009876)\n* [The role of hierarchical knowledge representation in decisionmaking and system management](https://backend.orbit.dtu.dk/ws/files/158019622/HISMC.PDF)\n* [A Model of Human Decision Making in Complex Systems and its Use for Design of System Control Strategies](https://core.ac.uk/download/pdf/13777954.pdf)\n* [The role of error in organizing behaviour](https://qualitysafety.bmj.com/content/qhc/12/5/377.full.pdf) ([TWRR](https://resilienceroundup.com/issues/the-role-of-error-in-organizing-behaviour/))\n* [Information processing and human-machine interaction](https://www.osti.gov/biblio/7011990-information-processing-human-machine-interaction)\n* [Risk management in a dynamic society: a modelling problem]\n* [Proactive risk management in a dynamic society](https://rib.msb.se/Filer/pdf/16252.pdf)\n* [Trends in Human Reliability Analysis](https://backend.orbit.dtu.dk/ws/portalfiles/portal/137294535/TREND.PDF)\n* [The role of hierarchical knowledge representation in decisionmaking and system management](https://backend.orbit.dtu.dk/ws/portalfiles/portal/158019622/HISMC.PDF)\n* [The role of error in organizing behaviour](https://backend.orbit.dtu.dk/ws/portalfiles/portal/137538698/ERRROLE_1_.PDF)\n* [Human error and the problem of causality in analysis of accidents](https://backend.orbit.dtu.dk/ws/portalfiles/portal/158018718/ROYSOC.PDF)\n* [Coping with human errors through system design: implications for ecological interface design](https://citeseerx.ist.psu.edu/document?repid=rep1\u0026type=pdf\u0026doi=5fb7644d205b342aa52c594b7982a9e208086238)\n* [Graphic representation of accident scenarios: mapping system structure and the causation of accidents](https://www.sciencedirect.com/science/article/abs/pii/S0925753500000369)\n* [Diagnostic reasoning in action](https://backend.orbit.dtu.dk/ws/portalfiles/portal/158017532/DIAACT.PDF)\n* [A framework for cognitive task analysis in systems design](https://orbit.dtu.dk/en/publications/a-framework-for-cognitive-task-analysis-in-systems-design)\n* [Analysis of human errors in industrial incidents and accidents for mprovement of work safety](https://backend.orbit.dtu.dk/ws/portalfiles/portal/158019864/LEPRAS.PDF)\n* [Why do complex organizational systems fail?](https://documents1.worldbank.org/curated/ru/535511468766200820/pdf/multi0page.pdf)\n* [Notes on human error analysis and prediction](https://orbit.dtu.dk/en/publications/notes-on-human-error-analysis-and-prediction)\n\n(These are written but others about Rasmussen's work)\n* [Recurring themes in the legacy of Jens Rasmussen](https://www.sciencedirect.com/science/article/abs/pii/S0003687016302150?via%3Dihub) - special issue of Applied Ergonomics\n* [Reflecting on Jens Rasmussen’s legacy. A strong program for a hard problem](https://doi.org/10.1016/j.ssci.2014.03.015) ([my notes](https://github.com/lorin/booknotes/blob/master/papers/Reflecting-on-Jens-Rasmussens-Legacy.md))\n* [Reflecting on Jens Rasmussen's legacy (2) behind and beyond, a ‘constructivist turn’](https://doi.org/10.1016/j.apergo.2015.07.013)\n* [Musings on Models and the Genius of Jens Rasmussen](https://www.sciencedirect.com/science/article/abs/pii/S0003687015301009?via%3Dihub)\n\n[Risk management in a dynamic society: a modelling problem]: https://doi.org/10.1016/S0925-7535(97)00052-0\n\n## Mike Rayo\n\nRayo is the Director of the Cognitive Systems Engineering Laboratory at the Ohio State University.\n\n### Concepts\n\n* SCAD (Systematic Contributors Analysis and Diagram)\n\n### Selected Publications\n\n* [Developing Systemic Contributors and Adaptations Diagramming (SCAD): systemic insights, multiple pragmatic implementations]\n* [Multiple Systemic Contributors versus Root Cause: Learning from a NASA Near Miss](https://www.researchgate.net/publication/308194080_Multiple_Systemic_Contributors_versus_Root_Cause_Learning_from_a_NASA_Near_Miss)\n* [The Silicon Valley Way: Move fast and break…aviation safety?]\n\n[Developing Systemic Contributors and Adaptations Diagramming (SCAD): systemic insights, multiple pragmatic implementations]: https://journals.sagepub.com/doi/10.1177/1071181322661334\n[The Silicon Valley Way: Move fast and break…aviation safety?]: https://thebulletin.org/2025/05/the-silicon-valley-way-move-fast-and-breakaviation-safety/\n\n## James Reason\n\nReason is a psychology researcher who did work on understanding and categorizing human error.\n\n### Contributions\n\n#### Accident causation model (Swiss cheese model)\n\nReason developed an accident causation model that is sometimes known as the *swiss cheese* model of accidents.\nIn this model, Reason introduced the terms \"sharp end\" and \"blunt end\".\n\n#### Human Error model: Slips, lapses and mistakes\n\nReason developed a model of the types of errors that humans make:\n\n* slips\n* lapses\n* mistakes\n\n### Concepts\n\n* Blunt end\n* Human error\n* Slips, lapses and mistakes\n* Swiss cheese model\n\n### Selected publications\n\n* [Human error]\n* [Organizational Accidents Revisited](https://www.amazon.com/Organizational-Accidents-Revisited-James-Reason/dp/1472447689)\n\n[Human error]: https://www.amazon.com/gp/product/0521314194/ref=dbs_a_def_rwt_bibl_vppi_i0\n\n## J. Paul Reed\n\n[Reed](https://jpaulreed.com/) is a Senior Applied Resilience engineer at Netflix and runs [REdeploy](https://re-deploy.io), a conference focused on Resilience Engineering in the software development and operations industry.\n\nReed tweets as [@jpaulreed](https://twitter.com/jpaulreed).\n\n### Selected Publications\n\n* [Maps, Context, and Tribal Knowledge: On the Structure and Use of Post-Incident Analysis Artifacts in Software Development and Operations](https://lup.lub.lu.se/student-papers/search/publication/8966930j\n* [Beyond the \"Fix-it\" Treadmill](https://queue.acm.org/detail.cfm?id=3380780d)\n\n\n### Concepts\n\n* [Blame \"Aware\"](https://jpaulreed.com/blame-aware) (versus \"Blameless\") Culture\n* Postmortem Artifact _Archetypes_\n\n## Emilie M. Roth\n\n[Roth](http://www.rothsite.com/resume.html) is a cognitive psychologist who\nserves as the principal scientist at [Roth Cognitive Engineering](http://www.rothsite.com/), a small\ncompany that conducts research and application in the areas of human factors\nand applied cognitive psychology (cognitive engineering)\n\n### Selected publications\n\n* [Uncovering the Requirements of Cognitive Work](http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.564.2044) ([TWRR](https://www.getrevue.co/profile/resilience/issues/resilience-roundup-uncovering-the-requirements-of-cognitive-work-issue-30-173410))\n* [Using observational study as a tool for discovery: uncovering cognitive and collaborative demands and adaptive strategies]\n* [Handoff strategies in settings with high consequences for failure: lessons for health care operations] ([TWRR](https://resilienceroundup.com/issues/56))\n* [Bootstrapping multiple converging cognitive task analysis techniques for system design] ([TWRR](https://resilienceroundup.com/issues/70))\n\n### Other\n\n* [Interview on Naturalistic Decision Making podcast](https://open.spotify.com/episode/3XqAhdpyrszLoB59VcRJWG)\n\n## Nadine Sarter\n\n[Sarter](https://ioe.engin.umich.edu/people/nadine-sarter/) is a researcher in industrial and operations engineering.\nShe is the director of the Center for Ergonomics at the University of Michigan.\n\n### Concepts\n\n* cognitive ergonomics\n* organization safety\n* human-automation/robot interaction\n* human error / error management\n* attention / interruption management\n* design of decision support systems\n\n\n### Selected publications\n\n* [Learning from Automation Surprises and \"Going Sour\" Accidents: Progress on Human-Centered Automation](https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/19980016965.pdf)\n* [Behind Human Error]\n* [Designed-Induced Error and Error-Informed Design: A Two-Way Street](https://www.amazon.com/Cognitive-Systems-Engineering-Expertise-Applications-ebook/dp/B076TDR6H9/ref=sr_1_1?keywords=cognitive+systems+engineering\u0026qid=1554075974\u0026s=gateway\u0026sr=8-1)\n* [The Critical Incident Technique: A Method for Identifying System Strengths and Weaknesses Based on Observational Data](https://www.taylorfrancis.com/books/e/9780429134845)\n* [Myths of automation and their implications for military procurement]\n* [Automation surprises]\n* [Team Play with a Powerful and Independent Agent: A Full-Mission Simulation Study] ([TWRR](https://resilienceroundup.com/issues/team-play-with-a-powerful-and-independent-agent-a-full-mission-simulation-study/))\n\n[Bootstrapping multiple converging cognitive task analysis techniques for system design]: https://www.researchgate.net/publication/313737506_Bootstrapping_multiple_converging_cognitive_task_analysis_techniques_for_system_design\n[Automation surprises]: https://www.researchgate.net/publication/270960170_Automation_surprises\n[Team Play with a Powerful and Independent Agent: A Full-Mission Simulation Study]: https://www.researchgate.net/publication/12195752_Team_Play_with_a_Powerful_and_Independent_Agent_A_Full-Mission_Simulation_Study\n\n## James C. Scott\n\nScott is an anthropologist who also does research in political science. While\nScott is not a member of a resilience engineering community, his book *Seeing\nlike a state* has long been a staple of the cognitive systems engineering and\nresilience engineering communities.\n\n### Concepts\n\n* authoritarian high-modernism\n* legibility\n* mētis\n\n### Selected publications\n\n* [Seeing like a state: how certain schemes to improve the human condition have failed](https://www.amazon.com/Seeing-like-State-Certain-Condition/dp/0300078153/ref=sr_1_1)\n\n\n## Steven Shorrock\n\nShorrock is a chartered psychologist and a chartered ergonomist and human\nfactors specialist. He is the editor-in-chief of EUROCONTROL\n[HindSight](https://www.skybrary.aero/index.php/HindSight_-_EUROCONTROL)\nmagazine. He runs the excellent [Humanistic Systems](https://humanisticsystems.com/) blog.\n\nShorrock tweets as [@StevenShorrock](https://twitter.com/StevenShorrock).\n\n### Selected publications\n\n* [Systems Thinking for Safety: Ten Principles A White Paper Moving towards Safety-II](https://skybrary.aero/sites/default/files/bookshelf/2882.pdf)\n* [Human Factors and Ergonomics in Practice: Improving System Performance and Human Well-Being in the Real World](https://www.crcpress.com/Human-Factors-and-Ergonomics-in-Practice-Improving-System-Performance-and/Shorrock-Williams/p/book/9781472439253) (book)\n* [State of science: evolving perspectives on ‘human error’](https://doi.org/10.1080/00140139.2021.1953615)\n\n### Selected talks\n\n[Life After Human Error](https://www.youtube.com/watch?v=STU3Or6ZU60) (Velocity Europe 2014 keynote)\n\n## Diane Vaughan\n\nVaughan is a sociology researcher who did a famous study of the NASA Challenger accident, concluding that it was the result of organizational failure rather than a technical failure.  Specifically, production pressure overrode the rigorous scientific safety culture in place at NASA.\n\n### Concepts\n\n* Structural Secrecy:  Organizational structure, processes, and information exchange patterns can systematically undermine the ability to \"see the whole picture\" and conceal risky decisions.\n* Social Construction of Risk:  Out of the necessity to balance risk with the associated reward, any group of people will develop efficient heuristics to solve the problems they face.  The understanding of risk that faces one subgroup may not match that of another subgroup or of the whole group.  The ability of an individual to change a social construction of risk, formed over years with good intentions and often with evidence, is limited.  (Though the evidence is usually accurate, the conclusion might not be, leading to an inadvertent scientific paradigm.)\n* Normalization of Deviance:  During operation of a complex system, inadvertent deviations from system design may occur and not result in a system failure.  Because the intial construction of risk is usually conservative, the deviation is seen as showing that the system and its redundancies \"worked\", leading to a new accepted safe operating envelope.\n* Signals of potential danger:  Information gained through the operation of a system that may indicate the system does not work as designed.  Most risk constructions are based on a comprehensive understanding of the operation of the system, so information to the contrary is a sign that the system could leave the safe operation envelope in unexpected ways - a danger.\n* Weak signals, mixed signals, missed signals:  signals of potential danger that have been interpreted as non-threats or acceptable risk because at the time they didn't represent a clear and present danger sufficient to overcome the Social Construction of Risk.  Often, post-hoc, these are seen as causes due to cherry-picking - such signals were ignored before with no negative consequences.\n* Competition for Scarce Resources:  An ongoing need to justify investment to customers leads to Efficiency-Thoroughness Tradeoffs (ETTOs).  In NASA's case, justifying the cost of the Space Shuttle program to taxpayers and their congressional representatives meant pressure to quickly develop payload delivery capability at the lowest cost possible.\n* Belief in Redundancy:  Constructing risk from a signal of potential danger such that a redundant subsystem becomes part of the normal operating strategy for a primary subsystem.  In NASA's case, signals that the primary O-ring assembly did not operate as expected formed an acceptable risk because a secondary O-ring would contain a failure.  Redundancy was eliminated from the design in this construction of risk - the secondary system now became part of the primary system, eliminating system redundancy.\n\n### Selected publications\n\n* [The Challenger Launch Decision: Risky Technology, Culture, and Deviance at\n  NASA](https://www.amazon.com/Challenger-Launch-Decision-Technology-Deviance/dp/022634682X/ref=sr_1_1?ie=UTF8\u0026qid=1545966442\u0026sr=8-1\u0026keywords=diane+vaughan)\n\n## Barry Turner\n\n[Turner](https://www.tandfonline.com/doi/pdf/10.1080/10245289508523441) was a sociologist who greatly influenced the field of organization studies.\n\n### Selected publications\n\n* [Man-made disasters](https://www.amazon.com/Man-Made-Disasters-Second-Barry-Turner/dp/0750620870/ref=sr_1_1)\n\n## Robert L. Wears\n\n[Wears](https://en.wikipedia.org/wiki/Robert_Wears) was a medical researcher who also had a PhD in industrial safety.\n\n### Concepts\n\n* Underground adaptations\n* Articulated functions vs. important functions\n* Unintended effects\n* Apparent success vs real success\n* Exceptions\n* Dynamic environments\n* Systems of care are intrinsically hazardous\n\n### Selected publications\n\n* [The error of counting \"errors\"](https://linkinghub.elsevier.com/retrieve/pii/S0196064408006070) [BH](https://safety177496371.wordpress.com/2023/09/20/the-error-of-counting-errors/)\n* [Underground adaptations: case studies from health care](https://doi.org/10.1007/s10111-011-0207-2)\n* [Fundamental On Situational Surprise: A Case Study With Implications For Resilience](https://books.openedition.org/pressesmines/1122)\n* [Replacing Hindsight With Insight: Toward Better Understanding of Diagnostic Failures]\n* [Seeing patient safety ‘Like a State’](http://dx.doi.org/10.1016%2Fj.ssci.2014.02.007)\n* [Fundamental On Situational Surprise: A Case Study With Implications For Resilience](https://books.openedition.org/pressesmines/1122?lang=en)\n* [The Role of Automation in Complex System Failures]\n* [Exploring the Dynamics of Resilient Performance](https://pastel.archives-ouvertes.fr/pastel-00664145/document)\n* [Extemporaneous Adaptation to Evolving Complexity: A Case Study of Resilience in Healthcare] ([TWRR](https://resilienceroundup.com/issues/55))\n* [Automation, interaction, complexity, and failure: A case study]\n* [Resilience is not control: healthcare, crisis management, and ICT]\n* [The Secret Life of Policies](https://www.annemergmed.com/article/S0196-0644(17)30874-0/fulltext)\n* [The tragedy of adaptability](https://www.annemergmed.com/article/S0196-0644(13)01554-0/abstract) [BH](https://safety177496371.wordpress.com/2021/04/19/the-tragedy-of-adaptability/)\n* [Relying on resilience: too much of a good thing?](https://www.taylorfrancis.com/chapters/edit/10.1201/9781315605722-11/relying-resilience-much-good-thing-robert-wears-charles-vincent) [BH](https://safety177496371.wordpress.com/2024/03/20/relying-on-resilience-too-much-of-a-good-thing/)\n* [Replacing hindsight with insight: toward better understanding of diagnostic failures] [BH](https://safety177496371.wordpress.com/2024/02/26/replacing-hindsight-with-insight-toward-better-understanding-of-diagnostic-failures/)\n* [The science of human factors: separating fact from fiction](https://safety177496371.wordpress.com/2024/10/29/the-science-of-human-factors-separating-fact-from-fiction/) [BH](https://safety177496371.wordpress.com/2024/10/29/the-science-of-human-factors-separating-fact-from-fiction/)\n* [Resilience skills as emergent phenomena: A study of emergency departments in Brazil and the United States](https://doi.org/10.1016/j.apergo.2016.02.012) [BH](https://safety177496371.wordpress.com/2023/01/20/resilience-skills-as-emergent-phenomena-a-study-of-emergency-departments-in-brazil-and-the-united-states/)\n* [Our current approach to root cause analysis: is it contributing to our failure to improve patient safety?](https://qualitysafety.bmj.com/content/26/5/381) [BH](https://safety177496371.wordpress.com/2021/03/18/our-current-approach-to-root-cause-analysis-is-it-contributing-to-our-failure-to-improve-patient-safety/)\n* [Error Reduction and Performance Improvement in the Emergency Department through Formal Teamwork Training: Evaluation Results of the MedTeams Project](https://pmc.ncbi.nlm.nih.gov/articles/PMC1464040/) [BH](https://safety177496371.wordpress.com/2021/03/18/our-current-approach-to-root-cause-analysis-is-it-contributing-to-our-failure-to-improve-patient-safety/)\n* [In situ simulation: detection of safety threats and teamwork training in a high risk emergency department](https://www.academia.edu/download/85660593/468.full.pdf)\n* [“Safeware”: Safety-Critical Computing and Health Care Information Technology](https://europepmc.org/article/nbk/nbk43774)\n* [The Illusion of Explanation]\n* [Thick Versus Thin: Description Versus Classification in Learning From Case Reviews](https://www.annemergmed.com/article/S0196-0644(07)01451-5/fulltext)\n* [Safety, Error, and Resilience: a Meta-narrative Review](https://www.resilience-engineering-association.org/download/resources/symposium/symposium_2015/Wears_R.-Sutcliffe_K.-Safety-error-and-resilience-a-meta-narrative-review-Paper.pdf)\n* [Resilient Procedures: Oxymoron or Innovation?](https://www.taylorfrancis.com/chapters/edit/10.1201/9781315366838-18/resilient-procedures-oxymoron-innovation-robert-wears-garth-hunte) ([BH](https://safetyinsights.org/2025/02/24/resilient-procedures-oxymoron-or-innovation/))\n* [Design Trumps Training](https://www.annemergmed.com/article/S0196-0644(15)01376-1/abstract)\n\n### Selected talks\n\n* [Design of resilient systems](https://www.youtube.com/watch?v=nV52yh6GDMg)\n\n\n## David Woods\n\n[Woods](https://u.osu.edu/csel/member-directory/david-woods/) has a research background in cognitive systems engineering and did work\nresearching NASA accidents.  He is one of the founders [Adaptive Capacity\nLabs](http://www.adaptivecapacitylabs.com/), a resilience engineering\nconsultancy.\n\nWoods tweets as [@ddwoods2](https://twitter.com/ddwoods2).\n\n### Contributions\n\nWoods has contributed an enormous number of concepts.\n\n#### The adaptive universe\n\nWoods uses *the adaptive universe* as a lens for understanding the behavior of\nall different kinds of systems.\n\nAll systems exist in a dynamic environment, and must adapt to change.\n\nA successful system will need to adapt by virtue of its success.\n\nSystems can be viewed as units of adaptive behavior (UAB) that interact. UABs\nexist at different scales (e.g., cell, organ, individual, group, organization).\n\nAll systems have competence envelopes, which are constrained by boundaries.\n\nThe resilience of a system is determined by how it behaves when it comes near\nto a boundary.\n\nSee [Resilience Engineering Short Course](https://www.youtube.com/playlist?list=PLvlZBj1NU_ikTy1ot30EbEbYMAoBf9eAt) for more details.\n\n#### Charting adaptive cycles\n\n* Trigger\n* Units of adaptive behavior\n* Goals and goal conflicts\n* Pressure points\n* Subcycles\n\n### Graceful extensibility\n\nFrom [The theory of graceful extensibility: basic rules that govern adaptive systems]:\n\n(Longer wording)\n\n1. Adaptive capacity is finite\n2. Events will produce demands that challenge boundaries on the adaptive\n   capacity of any UAB\n3. Adaptive capacities are regulated to manage the risk of saturating CfM\n4. No UAB can have sufficient ability to regulate CfM to manage the risk of saturation alone\n5. Some UABs monitor and regulate the CfM of other UABs in response to changes\n   in the risk of saturation\n6. Adaptive capacity is the potential for adjusting patterns of action to\n   handle future situations, events, opportunities and disruptions\n7. Performance of a UAB as it approaches saturation is different from the\n   performance of that UAB when it operates far from saturation\n8. All UABs are local\n9. There are bounds on the perspective any UAB, but these limits are overcome\n   by shifts and contrasts over multiple perspectives.\n10. Reflective systems risk mis-calibration\n\n(Shorter wording)\n\n1. Boundaries are universal\n2. Surprise occurs, continuously\n3. Risk of saturation is monitored and regulated\n4. Synchronization across multiple units of adaptive behavior in a network is necessary\n5. Risk of saturation can be shared\n6. Pressure changes what is sacrificed when\n7. Pressure for optimality undermines graceful extensibility\n8. All adaptive units are local\n9. Perspective contrast overcomes bounds\n10. Mis-calibration is the norm\n\nFor more details, see [summary of graceful extensibility theorems](graceful-extensibility.md).\n\n### SCAD (Systemic Contributors Analysis and Diagram)\n\n(tbd)\n\n### Concepts\n\nMany of these are mentioned in Woods's [short course](https://www.youtube.com/playlist?list=PLvlZBj1NU_ikTy1ot30EbEbYMAoBf9eAt).\n\n* adaptive capacity\n* adaptive universe\n* unit of adaptive behavior (UAB), adaptive unit\n* continuous adaptation\n* graceful extensibility\n* sustained adaptability\n* Tangled, layered networks (TLN)\n* competence envelope\n* adaptive cycles/histories\n* precarious present (unease)\n* resilient future\n* tradeoffs, five fundamental\n* efflorescence: the degree that changes in one area tend to recruit or open up\n  beneficial changes in many other aspects of the network - which opens new\n  opportunities across the network ...\n* reverberation\n* adaptive stalls\n* borderlands\n* anticipate\n* synchronize\n* proactive learning\n* initiative\n* reciprocity\n* SNAFUs\n* robustness\n* surprise\n* dynamic fault management\n* software systems as \"team players\"\n* multi-scale\n* brittleness\n* how adaptive systems fail (see: [How do systems manage their adaptive capacity to successfully handle disruptions? A resilience engineering perspective])\n    - decompensation\n    - working at cross-purposes\n    - getting stuck in outdated behaviors\n* proactive learning vs getting stuck\n* oversimplification\n* fixation\n* fluency law, veil of fluency\n* capacity for manoeuvre (CfM)\n* crunches\n* turnaround test\n* sharp end, blunt end\n* adaptive landscapes\n* law of stretched systems: Every system is continuously stretched to operate at capacity.\n* cascades\n* adapt how to adapt\n* unit working hard to stay in control\n* you can monitor how hard you're working to stay in control (monitor risk of saturation)\n* reality trumps algorithms\n* stand down\n* time matters\n* Properties of resilient organizations\n    - Tangible experience with surprise\n    - uneasy about the precarious present\n    - push initiative down\n    - reciprocity\n    - align goals across multiple units\n* goal conflicts, goal interactions (follow them!)\n* to understand system, must study it under load\n* adaptive races are unstable\n* adaptive traps\n* roles, nesting of\n* hidden interdependencies\n* net adaptive value\n* matching tempos\n* tilt toward florescence\n* linear simplification\n* common ground\n* problem detection\n* joint cognitive systems\n* automation as a \"team player\"\n* \"new look\"\n* sacrifice judgment\n* task tailoring\n* substitution myth\n* observability\n* directability\n* directed attention\n* inter-predictability\n* error of the third kind: solving the wrong problem\n* buffering capacity\n* context gap\n* Norbert's contrast\n* anomaly response\n* automation surprises\n* disturbance management\n* Doyle's catch\n* Cooperative advocacy\n\n### Selected publications\n\n* [Resilience Engineering: Concepts and Precepts](https://www.amazon.com/gp/product/B009KNDF64/ref=x_gr_w_glide_bb?ie=UTF8\u0026tag=x_gr_w_glide_bb-20\u0026linkCode=as2\u0026camp=1789\u0026creative=9325\u0026creativeASIN=B009KNDF64\u0026SubscriptionId=1MGPYB6YW3HWK55XCGG2)\n* [Prologue: Resilience Engineering Concepts](http://erikhollnagel.com/onewebmedia/Prologue.pdf)\n* [Epilogue: Resilience Engineering Precepts](https://www.researchgate.net/publication/265074845_Epilogue_Resilience_Engineering_Precepts)\n* [Resilience is a verb](https://www.researchgate.net/publication/329035477_Resilience_is_a_Verb)\n* [Four concepts for resilience and the implications for the future of resilience engineering](https://www.researchgate.net/publication/276139783_Four_concepts_for_resilience_and_the_implications_for_the_future_of_resilience_engineering) ([TWRR](https://resilienceroundup.com/issues/65))\n* [Basic patterns in how adaptive systems fail](https://www.researchgate.net/publication/284324002_Basic_patterns_in_how_adaptive_systems_fail) ([TWRR](https://resilienceroundup.com/issues/34/))\n* [Resilience and the ability to anticipate](https://www.researchgate.net/publication/285487326_Resilience_and_the_ability_to_anticipate) ([TWRR](https://resilienceroundup.com/issues/resilience-and-the-ability-to-anticipate/))\n* [Distancing through differencing: An obstacle to organizational learning following accidents](https://www.researchgate.net/publication/292504703_Distancing_through_differencing_An_obstacle_to_organizational_learning_following_accidents)\n* [Essential characteristics of resilience](https://www.researchgate.net/publication/284328979_Essential_characteristics_of_resilience)\n* [Essentials of resilience, revisited](https://www.researchgate.net/publication/330116587_4_Essentials_of_resilience_revisited) ([TWRR](https://resilienceroundup.com/issues/71/))\n* [Learning from Automation Surprises and \"Going Sour\" Accidents: Progress on Human-Centered Automation](https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/19980016965.pdf)\n* [Behind Human Error]\n* [Joint Cognitive Systems: Patterns in Cognitive Systems Engineering](https://www.amazon.com/gp/product/0849339332/ref=x_gr_w_bb?ie=UTF8\u0026tag=x_gr_w_bb-20\u0026linkCode=as2\u0026camp=1789\u0026creative=9325\u0026creativeASIN=0849339332\u0026SubscriptionId=1MGPYB6YW3HWK55XCGG2)\n* [Patterns in Cooperative Cognition](https://www.researchgate.net/publication/262449980_Patterns_in_Cooperative_Cognition)\n* [Origins of cognitive systems engineering](https://www.researchgate.net/publication/298793082_Origins_of_Cognitive_Systems_Engineering)\n* [Incidents - markers of resilience or brittleness?](https://www.researchgate.net/publication/292504952_Incidents_-_markers_of_resilience_or_brittleness) [BH](https://safety177496371.wordpress.com/2023/12/18/incidents-markers-of-resilience-or-brittleness/)\n* [The alarm problem and directed attention in dynamic fault management](https://www.researchgate.net/publication/40961767_The_Alarm_problem_and_directed_attention_in_dynamic_fault_management)\n* [Can We Trust Best Practices? Six Cognitive Challenges of Evidence-Based Approaches]\n* [Operating at the Sharp End: The Complexity of Human Error](https://www.researchgate.net/publication/313407259_Operating_at_the_Sharp_End_The_Complexity_of_Human_Error)\n* [The theory of graceful extensibility: basic rules that govern adaptive systems]\n* [Beyond Simon’s Slice: Five Fundamental Trade-Offs that Bound the Performance of Macrocognitive Work Systems](https://www.researchgate.net/publication/220628177_Beyond_Simon%27s_Slice_Five_Fundamental_Trade-Offs_that_Bound_the_Performance_of_Macrocognitive_Work_Systems) ([TWRR](https://resilienceroundup.com/issues/five-fundamental-trade-offs-in-cognitive-work/))\n* [Anticipating the effects of technological change: A new era of dynamics for human factors](https://www.researchgate.net/publication/247512351_Anticipating_the_effects_of_technological_change_A_new_era_of_dynamics_for_human_factors)\n* [Common Ground and Coordination in Joint Activity]\n* [Resilience as Graceful Extensibility to Overcome Brittleness](https://www.irgc.org/wp-content/uploads/2016/04/Woods-Resilience-as-Graceful-Extensibility-to-Overcome-Brittleness-1.pdf)\n* [Resilience Engineering: Redefining the Culture of Safety and Risk Management](http://ordvac.com/soro/library/Aviation/Aviation%20Safety/General%20Safety%20Articles/resilience%20engineering%20bulletin.pdf)\n* [Problem detection]\n* [Cognitive consequences of clumsy automation on high workload, high consequence human performance]\n* [Implications of automation surprises in aviation for the future of total intravenous anesthesia (TIVA)]\n* [Ten challenges for making automation a team player] ([TWRR](https://resilienceroundup.com/issues/66))\n* [The Messy Details: Insights From the Study of Technical Work in Healthcare]\n* [Nosocomial automation: technology-induced complexity and human performance]\n* [Human-centered software agents: Lessons from clumsy automation](http://www.ifp.illinois.edu/nsfhcs/abstracts/woods.txt)\n* [STELLA: Report from the SNAFUcatchers Workshop on Coping with Complexity](https://snafucatchers.github.io/)\n* [The New Look at Error, Safety, and Failure: A Primer for Health Care]\n* [Grounding explanations in evolving, diagnostic situations]\n* [Resilience Engineering: Concepts and Precepts]\n* [A Tale of Two Stories: Contrasting Views of Patient Safety]\n* [Voice Loops as Coordination Aids in Space Shuttle Mission Control]\n* [The Critical Incident Technique: 40 Years Later](https://journ","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Florin%2Fresilience-engineering","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Florin%2Fresilience-engineering","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Florin%2Fresilience-engineering/lists"}