Understanding Coordination Challenges in Urban ...

PROCEEDINGS of the HUMAN FACTORS and ERGONOMICS SOCIETY 53rd ANNUAL MEETING—2009

284

Understanding Coordination Challenges in Urban Firefighting: A Study of Critical Incident Reports Matthieu Branlat1, Lisa Fern2, Martin Voshell1, Stoney Trent3 1

2

C/S/E/L, Institute for Ergonomics, the Ohio State University, Columbus, OH US Army Aeroflightdynamics Directorate (AFDD), NASA Ames Research Center, Mountain View, CA 3 Department of Behavioral Sciences and Leadership, United States Military Academy, West Point, NY

This paper explores the central role played by coordination during fire incident response. Following preliminary investigations based on other methods, the authors analyzed a corpus of 29 critical incident reports produced by one fire department’s safety services. Urban firefighting is a complex domain in which members’ activities need to be highly synchronized in order to reach common operational and safety goals. As the work environment challenges the capacity of firefighters to coordinate efficiently, coordination breakdowns might occur, creating safety threats as role interdependencies become difficult to manage.

Copyright 2009 by Human Factors and Ergonomics Society, Inc. All rights reserved. 10.1518/107118109X12524441080740

INTRODUCTION The current research is part of an on-going Cognitive Task Analysis initiated in 2007 with the fire department of a major metropolitan area confronted with the difficulties of improving the safety of fire operations. Addressing these challenges remains a priority for fire services and organizations across the country despite numerous past and on-going efforts (Granito, 2008). As a means to further investigate elements uncovered by previous research (Prue et al., 2008; Fern, Trent, and Voshell, 2008; Voshell, Prue, Trent and Fern, 2008), the authors were given the opportunity to analyze a corpus of approximately 30 Critical Incident Reports produced by the fire department’s safety services. These reports were created following life-threatening injuries to or fatalities of firefighters during fire operations. Based on this corpus, we explore the central role played by coordination during a fire incident response. Such a focus is consistent with issues largely acknowledged by practitioners of the domain, as communication deficiencies are often identified as a major source of operation management difficulties (NIOSH, 2009). The importance of “inadequate fireground communication” within the contributing factors identified in their incident investigations, as well as “the limited availability of research on such an important topic” (USFA, 1999), are a general consensus. The label ‘communication’ however encompasses a wide variety of themes, from purely technical topics to “human factors” related issues. Cognitive Systems Engineers, in particular, are interested in the nature of the information flows that allow a team, as a whole, to perform efficient decision-making – a basis for safe and successful operations in complex, high-risk domains. The current analysis, therefore, concentrates on coordination across team members, for which communication, both direct and mediated by technology, is a primary facilitator. Our focus is also consistent with the critical relation between coordination and operation safety described by the literature on High-Reliability Organizations (Owen, 2007) and resilient organizations (Woods, 2006). Urban firefighting is a complex domain in which members’ activities need to be highly coordinated and synchronized in order to reach common goals (Prue et al., 2008). Understanding how

members manage the interdependencies between their roles and maintain (or fail to maintain) synchronization in the face of environmental or operational challenges is a key element of the analysis of their activity and of the discovery of ways to support their work in order to increase safety and efficiency. We see firefighting as a general type of cognitive work – distributed anomaly response (Patterson, Woods, Sarter and Watts-Perrotti, 1998). The current research looks at how patterns of performance and cognitive challenges previously described in this context inform our understanding of the specific urban firefighting context. It also aims at discovering how this particular domain might provide useful new insight in order to improve distributed response. ANALYZING PRACTITIONERS’ WORK THROUGH CRITICAL INCIDENT REPORTS Methodological challenge In order to inform the design of more efficient and safer work systems, an understanding of the cognitive challenges posed by the domain, and how practitioners manage them for successful task performance is required (Woods and Hollnagel, 2006). To build such an understanding, researchers are faced with the problem of having access to practitioners and their activities. Direct observation is one of the most used and valuable methodological approaches in the analysis of operators’ activity; however, for both practical and theoretical reasons, many environments present important challenges to the actual implementation of this family of techniques (Guérin et al., 2006; Crandall, Klein and Hoffman, 2006, p.15). This is particularly true of urban firefighting where the very nature and environment of fire operations impede the outside observer’s ability to witness the operators’ activities in their ecological context. Challenges to direct observation include: safety threats; teams spatial distribution; low visibility; unpredictable activity impeding the planning of specific observations; etc. In previous firefighting studies, other researchers have utilized different methods to overcome these limitations, relying especially on various forms of retrospective reports, such as: guided interviews about critical incidents (Klein, Calderwood and Clinton-Cirocco, 1986;


Klein, Calderwood and MacGregor, 1989); recall cued by video capture (Omodei, McLennan and Wearing, 2005); analysis of richly documented incidents (Weick, 1993). Analysis This study follows preliminary investigations focused on the analysis of various doctrinal publications, field observations (operations and training), and numerous unstructured interviews with members at all levels of the department hierarchy. These different methods fed into, and were eventually guided by, the parallel construction of a functional goal decomposition. The purpose of the functional goal decomposition was to identify decision and information requirements critical for supporting the overall goals and functions of urban fire department operations (Fern, Trent and Voshell, 2008). Based on the knowledge generated by this initial work, the authors analyzed a corpus of 29 investigation reports produced by the fire department services after accidents occurring between 1989 and 2007, which outcomes are summarized in the following figure. A first examination of a small subset of cases (see Fern, 2008) predominantly focused on coordinative processes and aimed at developing a general framework of firefighting activity during critical operations in order to analyze the entire corpus. A second part of the analysis targeted testing the initial framework against more cases, arriving at a more elaborate understanding of the issues already identified, and expanding the general scope of the investigation to other issues of resilience.

285

behavior, i.e. attempting to situate what they were doing, what they knew and what their mindset was at the given time of a particular decision or action. Tracing these decision processes helps us to avoid judgments based on the outcomes of decisions and actions, and on the adoption of a “god’s eye view” that risks underestimating local challenges members are confronted with in these complex situations (Dekker, 2006). COORDINATION IN URBAN FIREFIGHTING Needs and challenges Fire operations aim at fulfilling two main goals: saving lives and protecting property. Given the nature of the environment, managing the risks to which firefighters are exposed becomes another fundamental goal. These three goals are highly intertwined, as difficulties or failures to fulfill one of them have important consequences on the others. Through previous research, our team identified high-level functions that participate in conducting operations in order to reach these goals. These functions, such as ‘managing paths’ or ‘situation assessment’, are associated with particular types of decisions and information requirements (Fern, Trent and Voshell, 2008). For the purpose of this paper, we will only focus on their fundamentally interdependent nature. In addition to illustrating the life-threatening nature of the environment firefighters evolve in, the previous figure suggests that difficulties in operations’ management constitute important sources of risk: in particular, certain companies (e.g., ladder) depend on others for water provision; and “other traumas” (essentially due, according to the data, to structural collapses) raise important issues on the management of the subsequent rescue operations. With these types of challenges at the heart of our concerns, and along with previous research on teamwork (Klein, Feltovich, Bradshaw and Woods, 2005), we define coordination as follows: Coordination represents the various mechanisms that allow team members to manage interdependencies between their roles and tasks, and conflicts between their goals.

Figure 1. Types of critical injuries sustained by types of companies. Note that injuries often combine for a single member

In order to produce each report, the fire department conducts a thorough investigation, lasting over several months, that allows for the preservation and collection of large amounts of critical data. This corpus provides highly detailed accounts of fire operations, which capture elements of the practitioners’ activities, of the challenges they face and on forms of expertise they exert. Moreover, the events described correspond to highly challenging situations that would be virtually impossible to observe directly. Importantly, the production of the reports acknowledges the multiplicity of perspectives on the events, as well as the difficulty to construct a coherent timeline from their integration. The aforementioned characteristics allowed us to analyze the different cases while considering the context of members’

It is important to note that coordination refers to a continuous process, and does not describe the end state or product of this process. Based on the approach proposed by Klein and colleagues (2005), we can then evaluate the coordinating processes by relating them to the essential components of the firefighters joint activity. For our purpose, we are particularly interested in the concepts of common ground, i.e. “the pertinent mutual knowledge, mutual beliefs and mutual assumptions that support interdependent actions in some joint activity”, and interpredictability, i.e. “the ability to predict the actions of other parties with a reasonable degree of accuracy” (ibid.). From the perspective of the Incident Commander (IC), there are some key elements of information needed for monitoring the operations and deciding on courses of actions: where members are, what they are doing, how difficult their task is for them, and how the situation is evolving (both locally and as a whole). From the perspective of firefighters, it is important to know where one’s teammates


286

are, what they are doing, how difficult their task is for them, and how the team’s actions might have an impact on other members. In order to allow for highly synchronized joint activity, firefighters therefore have to rely on coordination mechanisms that will help maintain or restore this type of shared knowledge. Achieving this task is nonetheless difficult in an environment where observability is usually very low (physical distribution on the scene, smoke conditions), and where the activity is demanding (high action and decision tempo). Fire operations rely heavily on radio communications, shared channels providing a way for members to monitor exchanges about other firefighters’ positions and actions, as well as on the situation’s evolution, or for emergency messages to potentially reach everybody. An important result of this point is that it creates a “voice loop” (Patterson, WattsPerotti, and Woods, 1999) situation allowing transfers of information at a large scale, i.e. overcoming the local nature of operations. Unfortunately, radio channels constitute a limited resource that requires operators to manage a trade-off between information exchange and bottleneck risks.

Coordination breakdowns, i.e. losses in common ground and interpredictability, are illustrated by the following cases, in which dynamics described are representative of patterns and challenges observed throughout the corpus.

Understanding coordination breakdowns

In this case, an opportunity prompted replanning. Through a missed communication, the overall coordination broke down, and companies’ knowledge about each others’ positions and operations became erroneous, preventing synchronization and resulting in a dangerous situation, and ultimately an incident. The following emergency management was hindered by the failure to recoordinate in a timely manner, before further operations created more threats and challenges to the rescue efforts (all of this occurs within a few minutes). However, the distressed member was found quickly. In several other reported cases, the consequences of the coordination breakdowns do not necessarily result in equivalently clear goal conflicts between fire and rescue operations as in this example, but correspond to situations where members get isolated as their positions are unknown to others. Such cases often result in long exposures to heat and toxic gases, as injured, potentially unconscious, firefighters can be hard to find in a noisy, low-visibility environment.

Fern (2008) has proposed a framework of 5 phases to describe different characteristics and dynamics in terms of decision-making and coordination requirements during fire operations. The initial phases (alert and initial entry) emphasize the role of procedures, assignments and shared knowledge based on dispatch messages in supporting operations’ synchronization. While companies and members are performing their tasks, the distribution of operations increases, and perspectives on the situation start to diverge. Challenges or opportunities arise in the environment, requiring adaptations to the initial plans (replanning phase). Given the potential functional interdependencies between roles and tasks, the replanning process might occur at a more global scale than the operations directly concerned. During the course of the operations, an emergency situation (e.g., distressed member) might arise in addition to the on-going fire operations (emergency phase). The outcome of the incident will partly depend on the management of this emergency situation that will add new challenges to a situation already highly dependent on the level of coordination. Goal conflicts are likely to emerge from the need to respond to the emergency (e.g., rescue operations) while fire operations are going on. Ultimately, the establishment of synchronized operations allows for fire extinction and the potential management of emergency (resolution phase). This description emphasizes the central place of replanning processes during fire operations, a focus consistent with other research in the context of distributed emergency response, especially within the macrocognitive framework (Klein et al., 2003; Klein, 2007). The emergency phase is a particular, more challenging, instance of replanning, characterized by higher time constraints and higher likelihood of goal conflicts due to the emergence of additional operations. Initial phases, on the other hand, evoke a different form of planning, more organizational (procedures, pre-agreed upon roles, trained operations).

Case 1: After having initiated SOPs and entered a building from the front door to attack a fire in the cellar, an officer signals a better view on the fire from the cellar rear door. The Incident Commander, using this opportunity as access from the inside is proving difficult, orders the first engine company (E1) to redeploy the hose line from the front door to the rear of the building. E1 officer signals the new plan to the first ladder company (L1) operating on the first floor, but this message is not received, probably because of the ambient noise. Hose operations initiated by E1 at the rear of the building push heat and flames toward the front the building. The temperature rises and becomes unbearable on the first floor, inciting L1 to evacuate. While evacuating, L1 officer is knocked back and looses consciousness. Upon exiting, L1 firefighters realize their officer is missing, so reenter the first floor to search for him, followed by the second engine company (E2). While L1 and E2 find the officer and attempt to remove him, E1 redeploys to the first floor, and enters the building from the rear, opposing its line to the firefighters coming from the front, delaying the rescue efforts. The fire is ultimately extinguished and the officer removed but suffers severe burn injuries.

Case 2: During operations in difficult fire conditions, a ladder company (L1) officer decides to exit the fire floor on which his company was operating. Upon exiting, he realizes that one firefighter is missing and sends another one to search for him. At this point, the Incident Commander orders the building evacuation, as he evaluates that safe inside operations are no longer possible. He is then informed that a member is missing and searched for. L1 officer sees a firefighter exiting the building, visibly exhausted and still wearing his blackened facemask. The officer believes this is his company member, asks him if he is alright, and, upon reception of an affirmative answer, transmits that the missing member was found. As hose lines start to operate from the outside, L1 officer cannot find his firefighter, and finally reports that he is still missing a company member. Firefighters are sent to the fire floor with a hose line while exterior lines are ordered shut down. The missing firefighter is finally found and removed from the building, unconscious and suffering from smoke intoxication. As all members exit, exterior lines are operated again and manage to extinguish the fire.

This second case also shows elements of a coordination breakdown: when the officer believed he had found the right firefighter (it was actually another member), the established


common ground was erroneous, and this error remained undetected for several minutes. Upon detection of the issue, coordination with the IC allowed for an efficient management of the goal conflict emerging from the need to perform rescue operations while the fire was still active. Coordination breakdowns are related to emergency situations in two major ways: they can be a source of critical incidents; they hinder rescue operations and make emergency management less efficient as immediate responses emerge out of alignment with the overall goals and situation. DISCUSSION Addressing coordination challenges in urban firefighting As a vehicle for flows of information about the situation, its evolution and management, coordination processes support situation assessment and decision making for the incident commander involved at the strategic and tactic level, as well as for firefighters and officers operating on the scene and participating in the assessment and decision processes. Cases show that replanning can itself be costly. For example, having to redeploy hose lines because the initial attack was inadequate (based on limited or erroneous information available at the time) has a high cost in terms of physical efforts and of delay of water provision (creating risks of escalation). Additionally, coordination is needed in order to manage the global impact of necessary local adaptations, i.e. to preserve the synchronization of activities. Unfortunately, “coordination costs, continually” (Woods and Hollnagel, 2006, p. 173-174). Engaging in coordination activities can interfere with the demanding physical and cognitive activities performed by operators. This becomes critical when situations escalate, requiring more resources and hand-off processes, but also increasing the complexity of the operations, i.e. the interdependencies between functions and roles and the consequent coordination demands (Peffer et al., 2008). Furthermore, communication channels represent shared resources that can prove scarce when adverse events occur, potentially creating bottleneck situations during which coordination is made more difficult. Cases show that important messages (e.g., requests for help) can be lost due to heavy radio traffic generated by the need to communicate important information (e.g., alert about a degrading situation). Peffer and colleagues (2008) have proposed an approach for informing the design or transformation of Command and Control systems. It is based on mapping the organizationally defined roles onto a functional goal decomposition of the domain to identify interdependencies and corresponding coordination loops (Prue et al., 2008). The authors argue that such functional approach is needed to define requirements for technological development or organizational transformation, so that they actually support (and reduce the costs of) the needs for coordination and avoid or mitigate information and decision bottlenecks at the level of particular roles. Additionally, the relation between coordination needs and the concept of commander’s intent (Shattuck and Woods,

287

2000) suggests that coordination efforts are not necessarily needed when local adaptations are implemented. The general plan established by the incident commander represents an envelope of more or less specified “paths” to reach desired “states”. Procedures cannot be too specific because the reality of the situations will always challenge the capacity of systems to anticipate all potential situations. In the face of this uncertainty, designing flexible incident response systems that do not continuously rely on information sharing “requires that local actors have a variety of responses at their disposal and the authority to implement them at their discretion” (ibid.). Such an architecture nonetheless creates other challenges: firefighters are faced with the potentially difficult assessments of whether their actions still meet the commander’s intent, and whether common ground or interpredictability are degrading. It is a difficult task because it requires operators to consider others’ positions and tasks while their own task demands attention. It requires that firefighters have a sufficient knowledge of their own role, the roles of other members (especially in terms of interdependencies with their own role), and of the information they (officers especially) need in order to assess situations and make decisions efficiently. Although already present, further development of this form of expertise seems to us to be a potentially interesting leverage point. This point has important consequences on various forms of training or knowledge acquisition. In addition to training targeted at technical skill acquisition related to their roles, a fundamental form of knowledge for firefighters, particular drillings can be oriented towards the acquisition of expertise at managing the adaptability / coordination dynamics subsequent to the functional interdependencies, what constitutes a more reflective form of practice (Schön, 1983). Such training could for example rely on scenarios confronting firefighters with the type of difficult situations presented in this paper. The use of carefully designed training scenarios is indeed a fruitful method for reaching higher levels of system resilience and safety (Voshell et al., 2008; Hintze, 2008; Hoffman et al., 2009). For that purpose, the corpus of critical incident reports provides a rich and accurate set of cases that can be simplified, combined, or used as inspiration. Contributions and limitations of the current research Adaptations and replanning are fundamentally associated with firefighting operations. However, repeated adaptive processes threaten the maintenance of the synchronization between tasks. Coordination plays a key role in maintaining or reestablishing a sufficient shared knowledge of the situation required for synchronization. Firefighting illustrates the fundamental trade-off between stability and flexibility in distributed anomaly response. If procedures can provide a relatively stable framework that supports synchronization, the uncertain nature of the work environment requires high levels of adaptability. Coordination is essential to cope with the complexity of fire operations, i.e. with the interdependencies between roles and functions, and to avoid the fragmentation that local adaptations could generate. The existence of the corpus of critical incidents represents the desire of the fire department to learn from these dramatic


events in order to help prevent similar accidents from reoccurring. It aims at providing detailed information in order to improve the design of procedures, tactics, training or equipment. The reports, oriented toward the need to understand rather than to identify responsibilities, can also provide researchers with rich access to operators’ activity. Each report gave us firefighters’ perspectives on the events described, especially in contrast with safe behavior or process norms. Although not every aspect of the operations is explicitly described, this allowed us to better understand what is expected from firefighters and officers during specific conditions. This corpus provided us with highly detailed accounts of fire operations, which captured elements of the field practitioners’ activities, of the challenges they face and on forms of expertise they exhibit. However, fatal issues usually reveal adaptive processes that turned out to be unsuccessful. The corpus analyzed, although highly informative and useful for our purposes, therefore represents a particular and limited view on fire operations. More work is therefore needed to implement ways in which organizations can generate equivalently rich learning opportunities without focusing on the negative outcomes of operations. Improving resilience also relies on the capacity to identify, reflect and build on successful adaptations and answers to challenging, potentially surprising, events (Woods, 2006). As recent natural disasters, terrorist threats and large fire incidents have brought to light new demands and challenges, it is critical to better understand and support coordinative processes in the case of emergency response distributed across organizations and roles. The urban firefighting context provides, in our opinion, a rich and fruitful setting to build such scientific and operational knowledge. ACKNOWLEDGEMENTS The authors are grateful to the fire department that showed interest in their work, welcomed them and gave them access to considerable human and material resources. This research was supported by the Advanced Decision Architectures Consortium sponsored by the U. S. Army Research Laboratory under the Collaborative Technology Alliance Program, Cooperative Agreement DAAD19-01-20009. The views expressed in this article are those of the authors and do not necessarily represent the view of the Department of Defense. REFERENCES Crandall, B. B., Klein, G. A., & Hoffman, R. R. (2006). Working minds: a practitioner’s guide to cognitive task analysis. Cambridge, Mass.: MIT Press. Dekker, S. (2006). The Field Guide to Understanding Human Error. Adelshot, UK: Ashgate. Fern, L. C., (2008). Coordination in urban firefighting: a critical incident analysis. Unpublished master’s thesis, The Ohio State University, Columbus, OH. Fern, L., Trent, S., & Voshell, M. (2008). A functional goal decomposition of urban firefighting. Proceedings of the 5th International ISCRAM Conference, Washington, D. C. Granito, J. (2008). Introduction to the Symposium. Proceedings of PERI’s 2008 Virtual Symposium. http://www.riskinstitute.org/peri/images/file/S908-Intro-Granito.pdf

288

Guérin, F., Laville, A., Daniellou, F., Duraffourg, J., & Kerguelen, A. (2006). Understanding and transforming work. The practice of ergonomics. Paris, France: ANACT. Hintze, N. R. (2008). First Responder Problem Solving and Decision Making in Today’s Asymmetrical Environment. Unpublished Master’s Thesis, Naval Postgraduate School. Hoffman, R., Feltovich, P., Fiore, S., Klein, G., & Ziebell, D. (2009). Accelerated Learning (?). Intelligent Systems, IEEE, 24(2), 18-22. Klein, G. A. (2007). Flexecution as a Paradigm for Replanning, Part 1. Intelligent Systems, IEEE, 22(5), 79-83. Klein, G. A., Calderwood, R., & Clinton-Cirocco, A. (1986). Rapid decision making on the fire ground. Proceedings of the 30th Annual Human Factors Society, 1, 576-580. Klein, G. A., Calderwood, R., & MacGregor, D. (1989). Critical decision method for eliciting knowledge. IEEE Transactions on Systems, Man, and Cybernetics, 19(3), 462-472. Klein, G. A. Feltovich, P., Bradshaw, J. M., & Woods, D. D. (2005). Common ground and coordination in joint activity. In W. Rouse & K. Boff (Eds.). Organizational simulation. New York: Wiley. Klein, G. A., Ross, K., Moon, B., Klein, D., Hoffman, R., & Hollnagel, E. (2003). Macrocognition. Intelligent Systems, IEEE, 18(3), 81-85. NIOSH (2009). Leading Recommendations for Preventing Fire Fighter Fatalities, 1998–2005. National Institute for Occupational Safety and Health, Cincinnati, OH. http://www.cdc.gov/niosh/docs/2009100/pdfs/2009-100.pdf Omodei, M. M., McLennan, J. P., & Wearing, A. J. (2005). How expertise is applied in real-world dynamic environments: Head mounted video and cued recall as a methodology for studying routines of decision making. In T. Betsch, & S. Haberstroh (Ed.). The routines of decision making (pp. 271-288). Mahwah, NJ Laurence Erlbaum Associates. Owen, C. (2007). Analysing the activity of work in emergency incident management, @ctivités, 4 (1), 217-225, http://www.activites.org/v4n1/v4n1.pdf Patterson, E. S., Watts-Perotti, J., & Woods, D. D. (1999). Voice loops as coordination aids in space shuttle mission control. Computer Supported Cooperative Work, 8(4), 353-71. Patterson, E. S., Woods, D. D., Sarter, N. B., & Watts-Perotti, J. (1998): Patterns in Cooperative Cognition. COOP ’98, Third International Conference on the Design of Cooperative Systems. Cannes, France, 26– 29 May, pp. 13–23. Peffer, J., Tittle, J., Elm, W. C., Voshell, M., Prue, B., & Woods, D. D. (2008). How costly is your C2 Coordination? Assessing the coordination requirements within Command and Control. Proceedings of the 13th International Command and Control Research and Technology Symposium, Bellevue, WA. Prue, B., Voshell, M., Woods, D. D., Peffer, J., Tittle, J., & Elm, W. C. (2008). Synchronized coordination loops: A model for assessing distributed teamwork. In: NATO RTO HFM-142 Symposium on Adaptability in Coalition Teamwork, 21-23 April 2008, Copenhagen, Denmark. Schön, D. (1983). The reflective practitioner. New York: Basic Books. Shattuck, L. G., & Woods, D. D. (2000). Communication of intent in military command and control systems. In C. McCann & R. Pigeau (Eds.), The human in command: Exploring the modern military experience (pp. 279291). New York: Plenum Publishers. USFA (1999). Special Report: Improving Firefighter Communications. U.S. Fire Administration, Emmitsburg, MD. http://www.usfa.dhs.gov/downloads/pdf/publications/tr-099.pdf Voshell, M., Trent, S., Prue, B., & Fern, L. (2008). Cultivating Resilience in Urban Firefighting: supporting skill acquisition through scenario design. Proceedings of the Human Factors and Ergonomics Society 52nd Annual Meeting, New York, NY. Weick, K. E. (1993). The collapse of sensemaking in organizations: The Mann Gulch disaster. Administrative Science Quarterly, 38(4), 628-653. Woods, D.D. (2006). How to Design a Safety Organization: Test Case for Resilience Engineering. In E. Hollnagel, D.D. Woods & N. Leveson (Eds). Resilience Engineering: Concepts and Precepts (pp. 315-325). Aldershot, UK: Ashgate. Woods, D.D, & Hollnagel, E. (2006) Joint Cognitive Systems: Patterns in Cognitive Systems Engineering. Taylor and Francis: Boca Raton, Florida.