the resilient organisation[1]

7/23/2019 the Resilient Organisation[1]

http://slidepdf.com/reader/full/the-resilient-organisation1 1/49

© Erik Hollnagel, 2009

The Resilient Organisation

Erik HollnagelProfessor & Industrial Safety hair

!I"ES ParisTe#h risis and Risk Resear#h entre –

So$hia %nti$olis, ran#eE'(ail) erik*hollnagel+#r#*ens($*fr




Three ages of industrial safety

2000930900430

95Industriala##ident

$re6ention

495

Railroad Safety%$$lian#e %#t789IndustrialRe6olution

98ault tree

analysis

%ge of te#hnology

Hale & Ho6den 994:

ITRe6olution

Things canThings can

go wronggo wrong

becausebecause

technology failstechnology fails




Te#hni#al analysis (ethods

900 90 920 950 9;0 930 980 970 940 990 2000 200

!E%

H%<OP

!E%ault tree




Ho1 do 1e kno1 te#hnology is safe

=esign $rin#i$les)%r#hite#ture and #o($onents)

!odels)%nalysis (ethods)

!ode of o$eration)Stru#tural staility)un#tional staility)

lear and e-$li#it>no1nor(al, e-$li#itStandardised, 6alidated

/ell'defined si($le:High $er(anent:High




Hu(an fa#tors 1ake'u$ #all

Hu(an fa#tors as a #riti#al $art of $lant safety o$eratortraining and staffing re?uire(ents, instru(entation and

#ontrols, instru#tions and $ro#edures*

Three !ile Island @nit2 T!I'2:, !ar#h 24,979) $artial(eltdo1n of the#ore*

=ue to a #o(ination ofe?ui$(ent (alfun#tions, design

$role(s and 1orker errors





2000930900430


$re6ention

495

Railroad Safety%$$lian#e %#t

789IndustrialRe6olution

98ault tree

analysis

%ge of te#hnology

ITRe6olution

979Three !ile

Island

%ge of hu(an fa#tors

Things can go wrong becauseThings can go wrong because

the human factor failsthe human factor fails




Hu(an fa#tors analysis (ethods

900 90 920 950 9;0 930 980 970 940 990 2000 200

Root#ause =o(ino !E%

H%<OP

!E%S"I

THERP

HR

HPES

S1iss heese

R%, %THE%"%

ault tree

%EA

HE%T

HER%

TR%Er

Hu(an a#torsTe#hni#al




Ho1 do 1e kno1 hu(ans are safe

@nkno1n, inferredPartly kno1n, $artly unkno1n!ainly analogies%d ho#, un$ro6en

Baguely defined, #o($le-Bariale@sually reliale


!odels)%nalysis (ethods)

!ode of o$eration)Stru#tural staility)un#tional staility)




Safety #ulture . organisational failures

hallenger, 948

hernoyl, 948

Se6eral 6ery seriousa##idents (ade it #lear, thatsafety #ould not e ensuredy addressing te#hni#al andhu(an fa#tors alone*

CThat asse(ly of #hara#teristi#s and attitudes inorganiDations and indi6iduals 1hi#h estalishes that, as

an o6erriding $riority, nu#lear $lant safety issuesre#ei6e the attention 1arranted y their signifi#an#e*

Safety #ultu e

I%E%, I"S%F' 948:




"or(al a##ident theory 94;:

COn the 1hole, 1e ha6e #o($le- syste(se#ause 1e donGt kno1 ho1 to $rodu#ethe out$ut through linear syste(s*




ITRe6olution


2000930900430


$re6ention

495

Railroad Safety%$$lian#e %#t

789IndustrialRe6olution

98ault tree

analysis

%ge of te#hnology

979Three !ile

Island

%ge of hu(an fa#tors

2005olu(ia

%ge of safety (anage(entThings can goThings can go

wrong because wrong because

Organisations failOrganisations fail

2009

% ;;7




Organisational analysis (ethods

900 90 920 950 9;0 930 980 970 940 990 2000 200

Root#ause =o(ino !E%

H%<OP

!E%S"I

THERP

HR

STEP

HPES

S1iss heese

!TO

TRIPO=

R%, %THE%"%

%##i!a$

ault tree

RE%!

!ER!OS

%EA

!ORT

HE%T

HER%

TR%Er

Hu(an a#torsTe#hni#al Organisational




Ho1 do 1e kno1 organisations are safe

High'le6el, $rogra((ati#Partly kno1n, $artly unkno1nSe(i'for(al,

%d ho#, un$ro6enPartly defined, #o($le-Stale for(al:, 6olatile infor(al:Food, hystereti# lagging:*


!odels)

%nalysis (ethods)!ode of o$eration)Stru#tural staility)un#tional staility)




Si($le #ausal thinking

Starting fro(the effe#t,

you #anreasona#k1ards tofind the #ause

Startingfro( the

#ause, you#an reason

for1ards tofind the

effe#t




Su#h(an,

2982

=efen#e

Host

%gent En6iron(ent

o($le- #ausal thinking

In e$ide(iology, inury .da(age isdue to the intera#tion a(onghost, agent and en6iron(ent*

=efen#es of a host (ay e 1eakenedy an unsu$$orti6e en6iron(ent*




"ature of te#hni#al for(al: syste(s

They #an e des#riedotto('u$ in ter(s of

#o($onents andsusyste(s*

Risks and failures #antherefore e analysedrelati6e to indi6idual

#o($onents ande6ents*

=e#o($osition 1orks forte#hni#al syste(s, e#ause

they ha6e een designed*

!anyidenti#alsyste(s

Out$ut effe#ts: are $ro$ortional to in$ut #auses: and $redi#tale fro( kno1ledgeof the #o($onents* Te#hni#al syste(s are linear and e6ent out#o(es are tra#tale*




"ature of so#io'te#hni#al syste(s

!ust e des#ried to$'do1n in ter(s of

fun#tions and oe#ti6es*

Risks and failures (usttherefore e des#ried

relati6e to fun#tional 1holes*

=e#o($osition does not 1ork for so#io'te#hni#al

syste(s, e#ause they aree(ergent*

o($le- relations et1een in$ut #auses: and out$ut effe#ts: gi6e rise toune-$e#ted and dis$ro$ortionate #onse?uen#es* So#io'te#hni#al syste(s arenon'linear and e6ent out#o(es are intra#tale*

%ll syste(suni?ue




Theories and (odels of the negati6e

Te#hnology and (aterials arei($erfe#t so failures are ine6itale

%##idents are #aused y $eo$le,due to #arelessness, ine-$erien#e,

and.or 1rong attitudes*

Organisations are #o($le-

ut rittle 1ith li(ited(e(ory and un#leardistriution of authority




*+,- *+,. *+/- *+/. *+0- *+0. *++- *++. 1--- 1--. 1-*-

-

*-

1-

2-

3-

.-

,-

/-

0-

+-

*--

hanges in attriution of #auses

Te#hnology

Hu(an

fa#to s

Chu(an

e o E

O ganisation




Safety as risk redu#tion

Safety, as #o((only $ra#tised, i($lies adistin#tion et1een)

/hat ha$$ens 1hen

there is no(easurale #hange

"or(al o$erations that ensure the syste(1orks as it should and $rodu#es the intended out#o(es*%nor(al o$erations that disru$t or distur nor(al o$erations or other1ise

render the( ineffe#ti6e*The $ur$ose of safety (anage(ent is to (aintain nor(al o$erations y$re6enting disru$tions or disturan#es* Safety efforts are usually dri6en y 1hat has ha$$enedin the $ast, and are therefore rea#ti6e*

Safety is nor(ally (easured y theasen#e of negati6e out#o(es*This #an e a#hie6ed in three different 1ays)' eli(inating haDards design:,' $re6enting initiating e6ents #onstraints:' $rote#ting against #onse?uen#es arriers:




Safety J ' Risk:

CAy 2020 a ne1 safety $aradig( 1ill ha6e een 1idely ado$ted in Euro$ean industry*Safety is seen as a key fa#tor for su##essful usiness and an inherent ele(ent ofusiness $erfor(an#e* %s a result, industrial safety $erfor(an#e 1ill ha6e

$rogressi6ely and (easuraly i($ro6ed in ter(s of redu#tion of' re$ortale a##idents at 1ork,' o##u$ational diseases, ' en6iron(ental in#idents and' a##ident'related $rodu#tion losses*

It is e-$e#ted that an Kin#ident eli(inationG #ulture 1ill de6elo$ 1here safety ise(edded in design, (aintenan#e, o$eration and (anage(ent at all le6els inenter$rises* This 1ill e identifiale as an out$ut fro( this Te#hnology Platfor(

(eeting its ?uantified oe#ti6es*

The (easure(entsare all negati6e or

un1anted out#o(es*




o#us on o$eration shar$ end, 94;:

=esign !aintenan#e

Organisation(anage(ent:

Te#hnology@$strea(

=o1nstrea(

/ork has #learoe#ti6es and takes

$la#e in 1ell'definedsituations* Syste(sand te#hnologies areloosely #ou$led and

tra#tale*




Berti#al and horiDontal e-tensions 2004:

One horiDontal e-tension, to #o6er the1hole life#y#le, fro( design to(aintenan#e

% 6erti#al e-tensionto #o6er

the entiresyste(,

fro( te#hnology to organisation

% se#ond horiDontal e-tension, to #o6eru$strea( and do1nstrea( $ro#esses

/ork is unders$e#ified*Syste(s and te#hnologiesare tightly #ou$led and

intra#tale*

=esign !aintenan#e

Organisation

(anage(ent:

Te#hnology@$strea(




Complicacy

Comprehensibility

Tra#tale and intra#tale syste(s

%ll $rin#i$les offun#tioning are kno1n

=es#ri$tion are si($le1ith fe1 details

Tractable system

(loosely coupled)

ully s$e#ified Partly s$e#ified

Intractable system

(tightly coupled)

@nders$e#ified

So(e $rin#i$les offun#tioning are unkno1n

=es#ri$tion are elaorate1ith (any details

Stability

Syste( does not #hange1hile eing des#ried

Syste( #hanges efore ades#ri$tion is #o($leted

H

L

L

L

H

H




Perfor(an#e 6ariaility is ne#essary

!any so#io'te#hni#al syste(s are intra#tale* The#onditions of 1ork therefore ne6er #o($letely (at#h1hat has een s$e#ified or $res#ried*

Syste(s are so #o($le- that 1ork situations al1aysare unders$e#ified hen#e $artly – un$redi#tale

e1 if any tasks #an su##essfully e #arried out – –

unless $ro#edures and tools are ada$ted to thesituation* Perfor(an#e 6ariaility is oth nor(al andne#essary*

?

Indi6iduals, grou$s, and organisations nor(allyadust their $erfor(an#e to (eet e-isting #onditions,s$e#ifi#ally a#tual resour#es and re?uire(ents*

Ae#ause resour#es ti(e, (an$o1er, infor(ation,et#*: al1ays are finite, su#h adust(ents 1illal1ays e a$$ro-i(ate rather than e-a#t*

Perfor(an#e6ariaility

Su##ess

ailure



© Erik Hollnagel, 2009Bery high

Predi#taility

Range of e6ent out#o(es

Out#o(e

Bery lo1

P o s i t i 6 e

" e g a t

i 6 e

Mishaps

(outcomes that

should have been

eliminated)

Normal outcomes

(things that go

right)

" e u t r a l

D i s a s t e

r s

Near misses

Accidents

Random events

Incidents

Serendipity

ood luc!




Predi#taility


Out#o(e

Bery lo1

P o s i t i 6 e

" e g a t

i 6 e

Mishaps

(outcomes that

should have been

eliminated)

Normal outcomes

(things that go

right)

" e u t r a l

D i s a s t e

r s

Near misses

Accidents

Random events

Incidents

Serendipity

ood luc!

"ocus o# sa#ety management




Predi#taility


Out#o(e

Bery lo1

P o s i t i 6 e

" e g a t

i 6 e

Mishaps

(outcomes that

should have been

eliminated)

Normal outcomes

(things that go

right)

" e u t r a l

D i s a s t e

r s

Near misses

Accidents

Random events

Incidents

Serendipity

ood luc!

"ocus o# resilienceengineering




Predi#taility


Out#o(e

Bery lo1

P o s i t i 6 e

" e g a t

i 6 e

Mishaps

(outcomes that

should have been

eliminated)

Normal outcomes

(things that go

right)

" e u t r a l

D i s a s t e

r s

Near misses

Accidents

Random events

Incidents

Serendipity

ood luc!"ocus o# resilience"ocus o# resilience

engineeringengineering

"ocus o# sa#ety"ocus o# sa#ety

managementmanagement




Predi#taility

re?uen#y of out#o(es

Out#o(e

Bery lo1

P o s i t i 6 e

" e g a t

i 6 e

" e u t r a l

Mishaps

(outcomes that

should have beeneliminated)

Normal outcomes

(things that go

right)

Near misses

Random events

Incidents

Serendipity

ood luc!

AccidentsD

i s a s t e r s

& r e

? u e n

# y

&

r e ? u

e n # y




/hy only look at 1hat goes 1rong

o#us is on 1hat goes 1rong*Look for the underlying failures and (alfun#tions*

Try to eli(inate #auses and i($ro6e arriers*

Safety and #ore usiness #o($ete for resour#es*

Learning only uses a fra#tion of the data a6ailale

o#us is on 1hat goes right*@nderstand 1hy nor(al $erfor(an#e su##eed*

@se that to $erfor( etter and safer**Safety and #ore usiness hel$ ea#h other*

Learning uses (ost of the data a6ailale

Safety J Redu#ed nu(er of ad6erse e6ents*

Safety J %ility to su##eed under 6arying#onditions*

0'; )J failure in

0*000 e6ents

' 0'; )J 9*999 non'failures in 0*000 e6ents




ailures or su##esses

/ho or 1hat are res$onsilefor the re(aining 0'20M

/hen so(ething goes right,e*g*, 9*999 e6ents out of0*000, are hu(ans alsores$onsile in 40'90M of

the #ases

/hen so(ething goes 1rong,e*g*, e6ent out of 0*000

0E';:, hu(ans are assu(edto e res$onsile in 40'90M

of the #ases*

/ho or 1hat areres$onsile for there(aining 0'20M

In6estigation of failures isa##e$ted as i($ortant*

In6estigation ofsu##esses is rarely

undertaken*




%ll out#o(es $ositi6e andnegati6e: are due to$erfor(an#e 6ariaility**

ro( the negati6e to the $ositi6e

"egati6e out#o(es are#aused y failures and(alfun#tions*

Safety J Redu#ednu(er of ad6erse

e6ents*

Eli(inate failures and(alfun#tions as far

as $ossile*

Safety J %ility tores$ond 1hen

so(ething fails*

I($ro6e aility tores$ond to ad6erse

e6ents*

Safety J %ility tosu##eed under 6arying

#onditions*

I($ro6e resilien#e*




%re failures different fro( su##esses

&ailu es,

(alfun#tions,

6iolations,

Ce o

(e#hanis(s,E

0 0 0

Things that go 1rong Things that go right

=isasters %##idents In#idents "ear (isses "or(al a#tions

Sli$s, unsafe

a#ts




Pre(ises for Resilien#e Engineering

Perfor(an#e #onditions are al1ays unders$e#ified*Indi6iduals and organisations (ust therefore al1ays adust their $erfor(an#eto (at#h #urrent de(ands and resour#esN e#ause resour#es and ti(e arefinite, su#h adust(ents 1ill ine6italy e a$$ro-i(ate*

!any ad6erse e6ents #an e attriuted to a reakdo1n or (alfun#tioning of#o($onents and nor(al syste( fun#tions, ut (any #annot*

These e6ents #an e understood as the result of une-$e#ted #o(inations of$erfor(an#e 6ariaility*

Safety (anage(ent #annot e ased on hindsight, nor rely on error taulationand the #al#ulation of failure $roailities*Safety (anage(ent (ust e $roa#ti6e as 1ell as rea#ti6e*

Safety #annot e isolated fro( the #ore usiness: $ro#ess, nor 6i#e 6ersa*Safety is the $rere?uisite for $rodu#ti6ity, and $rodu#ti6ity is the $rere?uisitefor safety* Safety is a#hie6ed y i($ro6e(ents rather than y#onstraints*




The resilient organisationResilien#e is the intrinsi# aility of a syste( to adust its fun#tioning $rior to,

during, or follo1ing #hanges and disturan#es, so that it #an sustain re?uiredo$erations under oth e-$e#ted and une-$e#ted #onditions*

% $ra#ti#e of Resilien#e Engineering . Proa#ti6e Safety !anage(ent re?uires thatall le6els of the organisation are ale to)

Learn fro( $ast e6ents,understand #orre#tly

1hat ha$$ened and 1hy

a#tual

!onitor short'ter(de6elo$(ents and threatsNre6ise risk (odels

riti#al

%nti#i$ate long'ter(threats and o$$ortunities

Potential

Res$ond to regular andirregular #onditions in an

effe#ti6e, fle-ile (anner,%#tual




=esigning for resilien#e

Res$onding) >no1ing1hat to do, eing

#a$ale of doing it*

!onitoring) >no1ing1hat to look forindi#ators:

%nti#i$ating) indingout and kno1ing 1hatto e-$e#t

Learning)>no1ing 1hat has

ha$$ened

%n in#reased a6ailaility and reliaility of fun#tioning on all le6els 1ill oth i($ro6esafety and enhan#e#ontrol, hen#e the aility to $redi#t, $lan, and $rodu#e*

a#tual riti#al Potential

%#tual




Ti(e to think or ti(e to do

DO!

/ork is $a#ed yte#hnology and e-ternal

e6ents*

=e(ands e-#eed #a$a#ityEasy to lose #ontrol*

THINK!

/ork is #arefully$lanned and (onitored

=e(ands (at#h

#a$a#ityontrol is ke$t*

Effi#ient $erfor(an#ere?uires a alan#e et1eenthinking and doing*




If thoroughness do(inates,there (ay e too little ti(e

to #arry out the a#tions*

If effi#ien#y do(inates,a#tions (ay e adly

$re$ared or 1rong

"egle#t $ending a#tions!iss ne1 e6ents

!iss $re'#onditionsLook for e-$e#ted results

Thoroughness) Ti(e to think

Re#ognising situation*hoosing and $lanning*

Effi#ien#y) Ti(e to do

I($le(enting $lans*E-e#uting a#tions*

Effi#ien#y'Thoroughness Trade'Off

Ti(e & resour#es needed

Ti(e & resour#es a6ailale




"o ti(e or resour#es: to do it no1

So(e ETTO heuristi#s

Looks fine"ot really i($ortant

"or(ally O>, no need to #he#k

/ill e #he#ked y so(eone else

anGt re(e(er ho1 to do it/e al1ays do it this 1ay

Idiosyn#rati#

1ork related:

Has een #he#ked y so(eone else

ogniti6e

indi6idual:udge(ent under

un#ertainty

ogniti6e $ri(iti6esS! F: –

Rea#tions to

infor(ation in$uto6erload and

underload

ogniti6e style

olle#ti6e

organisation:

"egati6e re$orting

Redu#eredundan#y

!eet C$rodu#tion

targetsRedu#e

unne#essary #ost

=oule'ind

/e (ust get this done!ust e ready in ti(e

!ust not use too (u#h of

IG6e done it (illions of ti(e efore

This 1ay is (u#h ?ui#ker

It looks like so it $roaly is :

Ree#t #onfli#ting

infor(ation

onfir(ation ias




Effi#ien#y'Thoroughness Trade'Off

One 1ay of (anagingti(e and resour#e li(itations is to

think only one ste$ a#k and.or one ste$ ahead*

onfir( thatin$ut is #orre#t Thoroughness

Effi#ien#y Trust that in$ut

is #orre#t

onsider se#ondaryout#o(es and side'

effe#ts

%ssu(e so(eoneelse takes #are of

out#o(es

or distriuted 1ork it is ne#essary to trust 1hat

others doN it is i($ossileto #he#k e6erything*




!utual o$ti(is(

I #an allo1(yself to eeffe#ti6e e#ausethe others 1ill e

thorough

I #an allo1(yself to e

effe#ti6e e#ausethe others 1ill e

thorough



thorough

I #an allo1(yself to eeffe#ti6e e#ausethe others 1ill e

thorough



thorough



thorough




The ETTO $rin#i$le

The ETTO $rin#i$le des#ries the fa#t that $eo$leand organisations: as $art of their a#ti6ities$ra#ti#ally al1ays (ust (ake a trade'off et1eenthe resour#es ti(e and effort: they s$end on$re$aring an a#ti6ity and the resour#es ti(e, effortand (aterials: they s$end on doing it*

ETTOing fa6ours effi#ien#y o6er thoroughness ifthrough$ut and out$ut are the do(inant #on#erns,and thoroughness o6er effi#ien#y if safety and?uality are the do(inant #on#erns*

It follo1s fro( the ETTO $rin#i$le that it isi($ossile to (a-i(ise effi#ien#y and thoroughness at the sa(e ti(e* "or #an ana#ti6ity e-$e#t to su##eed, if there is not a (ini(u( of either*




Resilien#e and 1hat indi6iduals do

%nti#i$ating


%#tual

!onitoring

Res$onding

Learning

% single indi6idual #annot addressall four ailities e?ually 1ell, and 1illnor(ally $rioritise the aility tores$ond*ETTOing 1ill affe#t the trade'offet1een the four ailities*

This 1ay is (u#h ?ui#ker"o ti(e or resour#es: to do it no1anGt re(e(er ho1 to do it/e al1ays do it this 1ayIt looks like so it $roaly is :/e (ust get this done ready in ti(e:/e (ust not use too (u#h of

Looks fine"ot really i($ortant

"or(ally O>, no need to #he#k no1

IG6e done it hundreds of ti(es efore/ill e #he#ked y so(eone else

Has een #he#ked y so(eone else

Indi6idualETTO rules




Resilien#e and 1hat organisations do

%nti#i$ating


%#tual

!onitoring

Res$onding

Learning

%n organisation #an allo#ateresour#es to all four ailities,a##ording to its $riorities*ETTOing 1ill affe#t ho1 1ell ea#haility is addressed trade'off1ithin ailities:*

Redu#e redundan#y=oule'ind =O and =O"GT:

Ree#t #onfli#ting infor(ation

Redu#e unne#essary #ost and effort!eet K$rodu#tionG targets Ksafety firstG ut :…

"egati6e re$orting only re$ort 1hen so(ething is 1rong:

Organisational or#olle#ti6e ETTO rules




The ETTO TETO $arado- –

Thoroughness

Effi#ien#y

Thoroughness

Effi#ien#y

Effi#ien#y in the $resentre?uires thoroughness inthe $ast*

Effi#ien#y in the futurere?uires thoroughness inthe $resent*

Learning and $re$aringindi#ators & res$onses

Learning and $re$aringindi#ators & res$onses

In order to e resilient it is ne#essary that short'ter( ETTO is alan#ed y long'ter(TETO Thoroughness'Effi#ien#y Trade'Off:




%s high as reasonaly $ra#ti#ale

/hi#h e6ents Ho1 1ere

they found Is the listre6ised Ho1 is readinessensured and (aintained

Ho1 are indi#ators defined Lagging .leading Ho1 are they C(easured %reeffe#ts transient or $er(anent /ho looks

1here and 1hen Ho1, and 1hen,are they re6ised

/hat is our C(odel of the future

Ho1 long to 1e look ahead /hatrisks are 1e 1illing to take /hoelie6es 1hat and 1hy

/hat, 1hen #ontinuously ore6ent'dri6en su##esses orfailures:, ho1 ?ualitati6e,

?uantitati6e:,y indi6idual ory organisation


%#tual




Thank you for your attention

We attribute the success of HROs in managing the unexpected to their

determined efforts to act mindfully. By this we mean that they organize

themselves in such a way that they are better able to notice the

unexpected in the making and halt its development. If they have

difficulty halting the development of the unexpected, they focus oncontaining it. And if some of the unexpected breaks through the

containment, they focus on resilience and swift restoration of system

functioning.

When we call this approach mindful, we mean that HROs strive to

maintain an underlying style of mental functioning that is

distinguished by continuous updating and deepening of

increasingly plausible interpretations of what the context is, what

problems define it, and what remedies it contains. The key

difference between HROs and other organizations in managing theunexpected often occurs in the earliest stages, when the

unexpected may give off only weak signals of trouble. The

overwhelming tendency is to respond to weak signals with a weak

response. Mindfulness preserves the capability to see the

significant meaning of weak signals and to give strong responses

to weak signals. This counterintuitive act holds the key to

managing the unexpected.Managing the Unexpected: Assuring High Performance in an Age of

Complexity, Vol. 1 by Karl E. Weick and Kathleen M. Sutcliffe Jossey-Bass Inc.2001

the resilient organisation[1]

Documents