Showing papers by "Erik Hollnagel published in 2012"

FRAM: The Functional Resonance Analysis Method: Modelling Complex Socio-technical Systems

Abstract: Contents: Prologue The need The intellectual background The principles The method: preliminaries The method: identify and describe the functions (step 1) The method: the identification of variability (step 2) The method: the aggregation of variability (step 3) The method: consequences of the analysis (step 4) Three cases Afterthoughts FRAM on FRAM Index.

From Titanic to Costa Concordia—a century of lessons not learned

Abstract: The recent foundering of the Costa Concordia in January 2012 demonstrated that accidents can occur even with ships that are considered masterpieces of modern technology and despite more than 100 years of regulatory and technological progress in maritime safety. The purpose of this paper is, however, not to speculate about the concrete causes of the Costa Concordia accident, but rather to consider some human and organizational factors that were present in the Costa Concordia accident as well as in the foundering of the Titanic a century ago, and which can be found in many other maritime accidents over the years. The paper argues that these factors do not work in isolation but in combination and often together with other underlying factors. The paper critically reviews the focus of maritime accident investigations and points out that these factors do not receive sufficient attention. It is argued that the widespread confidence in the efficacy of new or improved technical regulations, that characterizes the recommendations from most maritime accident investigations, has led to a lack of awareness of complex interactions of factors and components in socio-technical systems. If maritime safety is to be sustainably improved, a systemic focus must be adopted in future accident investigations.

A Tale of Two Safeties

Abstract: The sustained existence of modern societies depends on the safe and efficient functioning of multiple systems, functions, and specialised services. Because these often are tightly coupled, safety cannot be managed simply by responding whenever something goes wrong. Both theory and practice make clear that safety management that follows developments rather than leads them runs a significant risk of lagging behind and of becoming reduced to uncoordinated and fragmentary fire-fighting. (The same, of course, goes for the management of quality and productivity.) In order to prevent this from happening, safety management must look ahead, not only to avoid that things go wrong but also - and more importantly - to ensure that they go right. Proactive safety management must focus on how everyday performance usually goes well rather than on why it occasionally fails, and must actively try to improve the former rather than simply prevent the latter. Keyword: Safety-I; safety-II; resilience engineering; performance variability; successes

Coping with complexity: past, present and future

Abstract: In 1981, a technical report was published with the somewhat enigmatic title ‘Coping with complexity.’ Its purpose was to discuss how computers could be used to assist process plant operators in coping with complex situations during plant disturbances. Today, coping with complexity is a problem not only for process plant operators but for everyone. And while computers in 1981 were looked upon as the solution, they are now seen as the source of the problem. This paper discusses why and how the meaning of ‘coping with complexity’ has changed over the years and speculate on what may lie ahead.

Learning lessons in resilient traffic management : A cross-domain study of Vessel Traffic Service and Air Traffic Control

Abstract: Although younger than the maritime domain, aviation has had a huge impact on the system design and development within shipping. Stakeholders often look towards aviation to make shipping, and the wa ...

Some myths about industrial safety

Abstract: There are many definitions of safety, but most of them are variations on the theme that safety can be measured by the number of adverse outcomes. This vision has consequences for how industry thinks safety can be achieved. This paper looks at six safety-related assumptions, or safety myths, which impact industry practices. We argue that these practices are littered with fragile beliefs, which in many cases make the safety management flawed and ineffectual. The open acknowledgement of these myths is a necessary first step to genuinely improve industrial safety.

Learning lessons in resilient traffic management: A cross-domain study of Vessel Traffic Service (VTS) and Air Traffic Control (ATC)

Abstract: Although younger than the maritime domain, aviation has had a huge impact on the system design and development within shipping Stakeholders often look towards aviation to make shipping, and the way that traffic is handled and organised, safer, more efficient and more effective Although legally not the same, Vessel Traffic Service (VTS) is frequently compared to Air Traffic Control (ATC) In this article the area of traffic management within the maritime and aviation domains is addressed from a Resilience Engineering perspective Focus is placed on the arrival part of a mission The comparison is based on information collected during two study visits at VTS centres and one study visit at an ATC centre The two organisations are described with the help of the Resilient Engineering capabilities: to respond, to monitor, to anticipate, and to learn Furthermore, it is discussed how VTS and ATC adapt to cope with the complexity encountered during daily work

A framework for modeling the consequences of the propagation of automation degradation : application to air traffic control systems

Abstract: This paper presents a modelling approach for representing consequences of automation degradation in the context of a socio-technical network. This modelling approach involves two different notations. In previous work we have proposed a synergistic approach integrating these two views for describing the evolution of system performances under automation degradation. In the current paper we propose a more global approach encompassing the previous contribution and being specifically addressing the representation of consequences flowing from the occurrence of automation degradation. In this approach, four modelling levels of consequences are studied: direct consequences of automation propagation, consequences on the capacity to respond, consequences on resilience capacity and consequences on network performance. This stepwise refinement aims at acquiring and modelling additional information needed for being able to assess the consequences of automation degradation. The approach is exemplified on a case study in the domain of Air Traffic Management and more precisely Terminal Manoeuvre Area including an Arrival Manager (AMAN). Due to space constraints only the first level is fully presented.

A Tale of Two Safeties (Draft)

Abstract: The sustained existence of modern societies depends on the safe and efficient functioning of multiple systems, functions, and specialised services. Because these often are tightly coupled, safety cannot be managed simply by responding whenever something goes wrong. Both theory and practice make clear that safety management that follows developments rather than leads them runs a significant risk of lagging behind and of becoming reduced to uncoordinated and fragmentary fire-fighting. (The same, of course, goes for the management of quality and productivity.) In order to prevent this from happening, safety management must look ahead, not only to avoid that things go wrong but also – and more importantly – to ensure that they go right.1 Proactive safety management must focus on how everyday performance usually goes well rather than on why it occasionally fails, and must actively try to improve the former rather than simply prevent the latter.