Ámbito de aplicación subjetivo y objetivo y determinación de la base imponible

3.3.3.1. System Under-specification

Nowadays systems have become more complex and their performance varies according to the situation. This is because they are intractable. Clarke (2000) defined intractable systems as underspecified systems where details may be missing or unavailable. This under-specification is either due to the need to consider many more details, or incompletely known modes of operations, or tight couplings among functions, or because systems change faster than they can be described (Hollnagel, 2012a). This is may be due to the combination of these factors altogether.

Current conditions of work are dramatically different from the conditions that existed from the 1960’s until 1980’s; particularly systems are more dependent on information technology than ever and lack the detailed specification required to accomplish work as imagined. Accordingly, the management systems that have been developed based on assumptions considered reasonable for that conditions are not valid for nowadays systems that have become more complex and socio-technique where situations are underspecified. If any issue was raised, the problem was isolated and a technical solution was looked up by acting upon the technological part by more automation or more safety devices considered nicer and cleaner than the socio-technical one.

Among these assumptions, Hollnagel et al (2013) cited: (1) well designed and correctly maintained systems, (2) comprehensive, complete and correct procedures in place, (3) operators’ behaviour as expected and trained, and (4) every contingency is foreseen at design and a solution is provided. Moreover, methods such as those dealing with human factors, object of this research, have actually been based on the principles that systems and particularly the relationship between the human part and the other elements of the system can be known and described thoroughly. This is not the case for socio-technical systems, these systems are underspecified and intractable (Hollnagel, 2006). Actually, system elements/components are

- 54 -

interdependent of each other and cannot be isolated (see the example discussed in Chapter 5, exploring maintenance environment).

3.3.3.2. System Conditions of Work

Working under pressure, lacking important elements (e.g. time, knowledge, resources, and competence), and dealing with complexity requires human performance to be adaptive to meet the changes systems face in everyday activities by doing local adjustments or adaptations. The adjustments that are approximate imply the variability of the system’s performance be inevitable and necessary (Hollnagel, 2010a). Moreover, it may lead to unpredictable results in both directions that is, hazardous or positive ones.

Lack of time implies a reactive culture of the system. The latter is always under pressure to achieve production goals for instance. It responds as a fire fighter to fix broken components. There is no time to think strategy, develop vulnerability models, analyse trends from system performance monitoring and surrounding environment monitoring, detect opportunities and take benefit of them, etc.

Lack of knowledge implies the absence of expertise to think the unthinkable, to go beyond what is known in order to anticipate threats as well as opportunities (e.g. developing strategic plans for the future) by searching what may actually help perform such actions. Even though a system is not reactive but is rather proactive and possesses the required expertise, the necessary resources that make the system able to respond to threats/opportunities must be available; in addition, systems must know beforehand how these resources will be used and when.

As a result, trade-offs are daily made in order to achieve goals and people make adjustments that are actually approximate.

3.3.3.3. Trade-Offs

People face real conditions at the bottom of the pile and generally behave as fire fighters (reactive) trying to be more efficient than thorough; they work continuously under pressure. Accordingly, at all levels, particularly engineers/front-line managers lack the necessary time to think strategy and to apply what they learned in the universities to improve work performance for example in maintenance departments. In other words, learning from past experiences, developing vulnerability models to anticipate future uncertainties, improving costs of

- 55 -

maintenance activities among others have become secondary interests, letting equipment availability at all costs the primary objective.

Trade-offs are always made in daily activities; that is either being thorough and complete or being efficient thus carrying out activities as rapidly as possible. Hollnagel calls this Efficiency Thoroughness Trade-Offs (Hollnagel, 2009a). In ETTO, thoroughness can be seen through the analysis of daily activities that go right which lead the system to be more efficient when actions are needed. The following example illustrate the trade-offs made continuously at the shop floor. Managers face the choice to shut down an oil/gas field in order to intervene (following the procedure thoroughly and loosing days of production) or to make the decision not to follow the procedure and find out a way to solve the problem without stopping the work (see examples given in Chapters 5 and 7).

3.3.3.4. Explaining System Performance Variability

To explain performance variability, Hollnagel (2010a) came up with two theories, the W and Z theories. The W theory stipulates that certain conditions (well-designed systems, complete and correct procedures provided, and well trained people behaving as expected) must be met so that systems work properly. The efforts to manage safety are generally directed to implementing barriers of all kinds (see Swiss cheese model of accidents) because accidents are attributed to technology, human “errors”, and/or organisational failures. This leads to the perception (Macchi, 2011) that every resource allocated to safety is in competition with production goals (obviously, trade-off safety-production is in favour of production) and to restrict the opportunity of organisational learning, if this culture exists, to negative events only.

In daily life examples, things go (have gone) right because of the human intervention that makes (has made) the correct adjustments/adaptations and not because systems have been well- thought/designed and people have been well trained and have performed their work as imagined. To respond to actual conditions, individuals take decisions and make required adjustments they judge appropriate to meet demands and achieve objectives. The cup is mid- full or mid-empty. Trying to understand why things go (have gone) right to increase the number of those that go right, is more productive than focusing only on things that go (have gone) wrong. Comparing work as imagined and work as performed allows assuredly understanding why adjustments/adaptations succeed; it is therefore important to find indicators that monitor such performance. As explained in the maintenance system of the Company (Chapter 5), tasks

- 56 -

are regularly performed by adapting current conditions (procedures, tools, etc.) that generally result in successes and rarely in accidents.

Hollnagel (2010c) sorted out the main sources of performance variability. Performance varies because of psychological factors (that may affect perception, vigilance, ingenuity, creativity, etc.), organisational factors (such as meeting performance demands, stretching resources, etc.), social factors (such as meeting oneself, colleagues, or managers’ expectations, etc.), and contextual factors (such as workplace environment). To achieve safety, all kinds of performance variability are constrained (rules, procedures, strict training, etc.) in order to avoid malfunctions or failures. This cannot be attained since systems are intractable (Hollnagel, 2010a). The solution lies within the capability of the humans to make the correct adjustments to fill in the gap between “what should be done” and “what could be done” using available resources. Since adjustments/adaptations made by the human element in particular are omnipresent within complex socio-technical systems, the performance of such systems is variable. Performance variability explains successes through the dynamic processes of adjustments/adaptations to achieve goals. However, it can also lead to undesired outcomes.

Management commitment is among the important themes that make an organisation resilient (Hollnagel, 2008a). This is to say that from top management to the shop floor, the role of performance variability must be recognised, the conditions that led to this variability understood, and the performance variability must be regarded as an asset. Failures actually are an expression of everyday performance variability as well as successes.

On the other hand, the occurrence of any negative outcome cannot be described by means of a decomposition of a linear chain of cause-effect tracking backward a potential “root cause” that is generally decided by the analyst. Consequently, building techniques/methods of risk assessment or designing models of accidents investigation based on principles of bimodality and/or causality that are in contradiction respectively with the principles of performance variability and emergence is not appropriate.

According to Hollnagel (2010a), accident investigation and risk assessment techniques should be based on the Z theory where systems work because the following conditions are met:

 People learn to identify and overcome design flaws and functional glitches

- 57 -

 When procedures must be applied, people can interpret and apply them to match the conditions

 Finally, people can detect and correct when something goes wrong or when it is about to go wrong, and hence intervene before the situation seriously worsens

The reliability of such systems is because people are flexible and adaptive, rather than because the systems have been perfectly thought out and designed (Hollnagel, 2010a).

According to the Efficiency–Thoroughness Trade-Off (ETTO) principle introduced by Hollnagel (2009a), people tend to be efficient rather than thorough doing something reasonably precise and correct rather than spending all their time to evaluate the best possible option (Macchi, 2011). This can be achieved through the description and measurement of system abilities that may lead to success or failure.

3.3.3.5. System Abilities

A system can be characterised by abilities that let it perform daily work (what an organisation does) to achieve objectives. The set of all these abilities defines a resilient system. Because safety is treated as a core value, not a commodity that can be counted, Hollnagel (2010b) stated that a resilient organisation is also safe. To be resilient, an organisation must be able: (1) to respond to threats/opportunities that is, know what to do, (2) to flexibly monitor that is, know what to look for, (3) to anticipate any development that is, know what to expect, and (4) to learn that is, know to learn from past experiences (Hollnagel, 2010b). It is worth adding the ability to transform the system from current state to another facing all kind of resistance particularly the resistance to change. Current system state will produce inevitably its end if it continues to follow the same way of thinking i.e. the same culture. This may be characterised by lack of resilience or a tendency to brittle. The solution resides therefore in its ability of transformation to build resilience from a given level to a more resilient one. As explained by Hollnagel and Woods (2005), the system actually makes trade-offs between all these capabilities to achieve designed goals.

Filling the gap of knowledge should be directed toward taking benefit of performance adjustments/adaptations by learning from them. That is, the learning process should take place around both positive and negative outcomes. The majority of adaptations/adjustments are actually successful (Hollnagel, 2009b), see section 3.3.4 related to the AHRAP concept. Since

- 58 -

nowadays systems have become more complex, the need for such adjustments/adaptations is a great opportunity to grasp to understand system performance. According to Hollnagel (2014), risks can be understood only if the operational environment is sought, bearing in mind that all outcomes result from performance variability of systems, particularly the performance of the human element.

3.3.3.6. Functional Resonance

Hollnagel (2004, 2012b) introduced the concept of functional resonance to explain the non- linear interrelation between nowadays system elements to show that in such systems events do neither happen one after another nor have cause-effects relationship between them. Rather, systems evolve in a complex dynamic environment where its performance is always variable (see previous sections) leading usually to successes and rarely to failures; successes are the flip side of failures. The latter are stemming from inappropriate or insufficient adjustments/adaptations of system components to the changing environment. They should therefore be described using functional resonance in order to explain what could happen in such systems.

Resonance is used in physical phenomena to explain the oscillation of a system with larger amplitude when for instance intensity of electrical current is in phase with the voltage. In resilience engineering approach, functions refer to activities; they describe something a system element does and/or the interaction between the human part of the system and the others. For Hollnagel (2012b), the approximate adjustments that are carried out by the human part of the system, are made in response –and anticipation- of what others do individually or collectively; functional resonance can be therefore defined as “the detectable signal that emerges from the unintended interaction of the everyday variability of multiple signals” (Hollnagel, 2012b, p. 29). In other words, some signals are detectable whereas others are not; when the variability of functions within the system resonates and gains larger amplitude exceeding the limits of system capacities, the signal is therefore detectable. A resilient system is one that is also able to detect such signals beforehand, act upon to minimise or eliminate those that may exceed the limits of systems capabilities.

For Ferreira (2011), people and organisations should be provided with tools that allow monitoring sources and changes in system performance variability. Providing a tool to measure system abilities is a great challenge thus.

- 59 -