This document summarizes a presentation by John Allspaw on resilient response in complex systems. Some key points discussed include the importance of high reliability in production systems, challenges of responding to issues in complex systems where failures can cascade, and characteristics of effective team responses such as cross-functional communication and learning from both failures and successes. The presentation advocates for practices such as drilling, post-mortem reviews, sharing of near-miss events, and studying what goes right in systems in addition to what goes wrong.
22. Complex Systems
⢠Cascading Failures
⢠DiďŹcult to determine boundaries
⢠Complex systems may be open
⢠Complex systems may have a memory
⢠Complex systems may be nested
⢠Dynamic network of multiplicity
⢠May produce emergent phenomena
⢠Relationships are non-linear
⢠Relationships contain feedback loops
Sunday, March 11, 12
28. How does team
troubleshooting
happen?
Sunday, March 11, 12
29. Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
ConďŹrmation
All Clear
Time
Sunday, March 11, 12
30. Problem Starts
Stress
Detection
Evaluation
Response
Stable
PostMortem
ConďŹrmation
All Clear
Time
Sunday, March 11, 12
31. Forced beyond learned roles
Actions whose consequences are both important and
diďŹcult to see
Cognitively and perceptively noisy
Coordinative load increases exponentially
Sunday, March 11, 12
36. Characteristics of response to
escalating scenarios
...tend to neglect how processes
develop within time (awareness of
rates) versus assessing how things
are in the moment
âOn the DifďŹculties People Have in Dealing With Complexityâ Dietrich Doerner, 1980
Sunday, March 11, 12
37. Characteristics of response to
escalating scenarios
...have diďŹculty in dealing with
exponential developments (hard to
imagine how fast something can
change, or accelerate)
âOn the DifďŹculties People Have in Dealing With Complexityâ Dietrich Doerner, 1980
Sunday, March 11, 12
38. Characteristics of response to
escalating scenarios
...inclined to think in causal series,
instead of causal nets.
A therefore B,
instead of
A, therefore B and C (therefore D and
E), etc.
âOn the DifďŹculties People Have in Dealing With Complexityâ Dietrich Doerner, 1980
Sunday, March 11, 12
42. Heroism
Non-communicating lone wolf-isms
Sunday, March 11, 12
43. Distraction
Irrelevant noise in comm channels
Sunday, March 11, 12
44. Jens Rasmussen, 1983
Senior Member, IEEE
âSkills, Rules, and Knowledge; Signals, Signs,
and Symbols, and Other Distinctions in Human
Performance Modelsâ
IEEE Transactions On Systems, Man, and Cybernetics, May 1983
Sunday, March 11, 12
45. SKILL - BASED
Simple, routine
RULE - BASED
Knowable, but unfamiliar
KNOWLEDGE - BASED
(Reason, 1990)
WTF IS GOING ON?
Sunday, March 11, 12
47. High Reliability Organizations
⢠Air TraďŹc Control ⢠Complex Socio-Technical
systems
⢠Naval Air Operations At Sea ⢠EďŹciency <-> Thoroughness
⢠Electrical Power Systems ⢠Time/Resource Constrained
⢠Etc. ⢠Engineering-driven
Sunday, March 11, 12
49. âThe Self-Designing High-Reliability Organization:
Aircraft Carrier Flight Operations at Seaâ
Rochlin, La Porte, and Roberts. Naval War College Review 1987
http://govleaders.org/reliability.htm
Sunday, March 11, 12
50. "So you want to understand an aircraft carrier? Well, just
imagine that it's a busy day, and you shrink San Francisco
Airport to only one short runway and one ramp and gate. Make
planes take oďŹ and land at the same time, at half the present
time interval, rock the runway from side to side, and require that
everyone who leaves in the morning returns that same day.
Make sure the equipment is so close to the edge of the envelope
that it's fragile. Then turn oďŹ the radar to avoid detection,
impose strict controls on radios, fuel the aircraft in place with
their engines running, put an enemy in the air, and scatter live
bombs and rockets around. Now wet the whole thing down with
salt water and oil, and man it with 20-year-olds, half of whom
have never seen an airplane close-up.
Oh, and by the way, try not to kill anyone."
                                            -- Senior oďŹcer, Air Division
Sunday, March 11, 12
70. Postmortems
⢠Full timelines: What happened, when
⢠Review in public, everyone invited
⢠Search for âsecond storiesâ instead of âhuman errorâ
⢠Cultivating a blameless environment
⢠Giving requisite authority to individuals to improve things
Sunday, March 11, 12
71. Qualifying Response
High signal:noise in comm channels?
Troubleshooting fatigue?
Troubleshooting hando�
All tools on-hand?
Improvised tooling or solutions?
Metrics visibility?
Collaborative and skillful communication?
Sunday, March 11, 12
73. Mature Role of Automation
âIronies of Automationâ - Lisanne Bainbridge
http://www.bainbrdg.demon.co.uk/Papers/Ironies.html
Sunday, March 11, 12
74. Mature Role of Automation
⢠Moves humans from manual operator to supervisor
⢠Extends and augments human abilities, doesnât replace it
⢠Doesnât remove âhuman errorâ
⢠Are brittle
⢠Recognize that there is always discretionary space for humans
⢠Recognizes the Law of Stretched Systems
Sunday, March 11, 12
75. Law of Stretched Systems
âEvery system is stretched to operate at its
capacity; as soon as there is some
improvement, for example, in the form of
new technology, it will be exploited to
achieve a new intensity and tempo of
activityâ
D.Woods, E. Hollnagel, âJoint Cognitive Systems: Patternsâ 2006
Sunday, March 11, 12
77. Near Misses
Hey everybody -
Donât be like me. I tried to X, but
that wasnât a good idea.
It almost exploded everyone.
So, donât do: (details about X)
Love,
Joe
Sunday, March 11, 12
78. Near Misses
⢠Can act like âvaccinesâ - help system safety without actually
hurting anything
⢠Happen more often, so provide more data on latent failures
⢠Powerful reminder of hazards, and slows down the process of
forgetting to be afraid
Sunday, March 11, 12
83. Proposition #1
âWays in which things go right are special cases
of the ways in which things go wrong.â
Sunday, March 11, 12
84. Proposition #1
Successes = failures gone wrong
Study the failures, generalize from that.
Potential data sources: 6 out of 100
Sunday, March 11, 12
85. Proposition #2
âWays in which things go wrong are special
cases of the ways in which things go right.â
Sunday, March 11, 12
86. Proposition #2
Failures = successes gone wrong
Study the successes, generalize from that
Sunday, March 11, 12
Potential data sources: 94 out of 100
88. What and WHY Do Things
Go RIGHT?
Sunday, March 11, 12
89. Not just:
why did we fail?
But also:
why did we succeed?
Sunday, March 11, 12
90. Resilient Response
⢠Can learn from other ďŹelds
⢠Can train for outages
⢠Can learn from mistakes
⢠Can learn from successes as well as failures
Sunday, March 11, 12