2014/08/14

OUTLINE Introduction
 History

Resilience Engineering and Safety-Ⅱ for
Advanced Accident Management

 Safety-Ⅱ
 Essential Capabilities
 Applications
 Concluding Remarks

Masaharu Kitamura
Emeritus Professor of Tohoku University
President of Research Institute for Technology Management Strategy
12Introduction

Introduction

 The word “resilience” is gaining popularity in Resilience is defined as the intrinsic capability ofmany domains where “safety” is an issue ofserious concern.
 The popularity is becoming even higher in Japanafter the East Japan Earthquake and the nuclear
disaster at the Fukuushima-Daiichi Nuclear
Power Station (NPS).
 For example, the prime minister of Japan
introduced a new position named minister ofnational resilience in his cabinet.
 But the method to establish “resilience” is not
yet established.

a system to adjust its functioning prior to, during,or after internal changes or external
disturbances, so that the system can continue
operations under expected and unexpectedconditions.
 When the magnitude of an internal change orexternal disturbance is extraordinarily large, theresilient system may change its operational modeand become less productive, but can continue itsoperation without falling into a catastrophic state. 43Introduction

History The concept of resilience thus covers not In 2004, a small group of international experts

were invited to participate in a special symposium
held in a small town of Söderköping in Sweden.
 The experts discussed about possibilities ofovercoming the limitations of existing approaches
toward enhancing system safety, and the notionof resilience engineering has been graduallyformulated through the discussions

only mere safety but sustainability ofoperation and graceful-degradation as
desirable characteristics of socio-technicalsystems.

 Hollnagel, E, Woods, D．D．, Leveson, N．(Eds.) (2006),

Resilience Engineering: Concepts and Precepts.
Aldershot. UK: Ashgate Publishing Co.
561

History

Pursuit of Safety by Eliminating Causes-1

 Since then, a number of research papers has

been published, five international meetings named
Resilience Engineering Symposium have been
held, and several important books have beenpublished.
 Though the methodology of resilience engineering
is still young and growing, a wide variety ofvaluable lessons and observations have beenobtained up to present.

Gigantic Seawall ：Height 10m, Length 2,400m.
Located in Iwate prefecture, Town of Tarou

Photos are eliminated.

7Pursuit of Safety by Eliminating Causes-2


8Safety-Ⅱ

Disaster Prevention Building Expected to Withstand aTsunami

 The central idea of safety pursued by

Photos are eliminated.

9Safety-Ⅱ

theadoption of these artifacts is not resilience butrobustness.
 Robust design is useful enough as far as themagnitude of external disturbances are lower
than the expectations.
 However, if the magnitude exceeds the expectedlevel, the robustness-based safety becomesuseless.
 More emphasis must be placed on resiliencebased safety.

10Safety-Ⅱ

 The idea of robustness-based (i.e. conventional) The resilience-based safety aims at empowering relevant

safety is; “The safety of the system will bemaintained if potential causes of failures areeliminated in advance”.
 This notion of safety is named Safety-Ⅰ.
 As far as the safety in this sense is pursued, themain efforts toward safety are focused on reductionof undesirable factors such as a tsunami as shown in
the previous slides.

functions of the system so that the system can continue
operation even though the performance might be somewhat
degraded.
 The safety pursued in this way is named Safety-Ⅱ. Of
course this increase in the number of desirable events will inconsequence lead to decrease in the number of undesirable
events.
 But the Safety-Ⅱ approach is mode appropriate to safety
management of modern socio-technical systems where thenumber of failures are becoming less and less via various
improvements in mechanical and other hardware-related
technology, human factors study, organization management12techniques, etc

112

Safety-Ⅱ

Safety-Ⅱ

 The resilience-based safety to empower relevant functions

 If the ratio of failure cases to success cases is asof the system so that the system can continue operationeven though the performance might be somewhat degraded.
 The safety pursued in this way is named Safety-Ⅱ. Of
course this increase in the number of desirable events will inconsequence lead to decrease in the number of undesirable
events.
 But the Safety-Ⅱ approach is mode appropriate to safety
management of modern socio-technical systems where thenumber of failures are becoming less and less via various
improvements in mechanical and other hardware-related
technology, human factors study, organization management
techniques, etc
13

low as 1:10,000 or even less, every failure casetends to be a rare case.
 Efforts of examining the rare case to extract lessons
to prevent future accident will be less efficient since
the future accident will be caused by other cause(s)often unexpected.
 The improvement of system’s capability for
performance adjustment via application of resilienceengineering will be more beneficial in this context.

Safety-Ⅱ

Essential Capabilities

 The pursuit of system safety in the sense of Safety- The framework of resilience engineering is based

Ⅱ does not imply to exclude the conventional
activities (i.e. high reliability design of hardware
components and systems, incorporation of design
improvements suggested by human factors
principles, standardization of operational procedures,etc.) pursuing safety in the sense of Safety-Ⅰ.
 However, the novel safety methodology based on
Safety-Ⅱ is necessary for supplementing the wellestablished traditional methodology based on
Safety-Ⅰ.
1514on the recognition that systems are always
changing either due to internal changes or external
disturbances.
 No system can bee free from these changes.

 A system must be able to adjust its performance.
 by either a reactive method which takes place aftersomething has happened, or a proactive method whichtakes place before something happens.
 The latter approach is basically more preferable since
it can be used to prevent adverse events to take
16place.

Essential Capabilities

Essential Capabilities

 But the potential benefit provided by the Essential capabilities needed for attaining

proactive method is limited by the uncertainty of
future situations.
 An organization responsible for safety of criticallyimportant socio-technical systems such as NPSs
must be aware of the fact that higher level ofsafety can only be attained by paying due
attention to the potential benefit of the proactive
approach despite the potential sacrifice thatmight be caused by the intrinsic uncertainty of
future situations.
17

resilience through appropriate performanceadjustment are briefly summarized as follows: Knowing what to do, or being able to respond toregular and irregular changes and disturbances.
 Knowing what to look for, or being able to monitor

that which changes, or may change, so much that it
will require a response in the near term.
 Knowing what to expect, or being able to anticipatechanges, threats and opportunities further into thefuture.
 Knowing what has happened, or being able to learn
from experiences to obtain lessons.

183

Essential Capabilities

Essential Capabilities This approach has been useful for relatively simple

 Additional requirements for attaining resilience: Resources are also important in order to be able torespond properly. Even if one knows what to do andhow to do it, the work cannot be done without enoughtime, tools, personnel, funding, and so forth.
 Another feature of the resilience engineering is in thatit pays more attention to success cases.
 Historically, safety engineering have been paying
attention to accidents, trying to find out failures(mechanical as well as human-originated)
responsible for the accidents, trying to identify key
causes responsible for the failures, and tying to19
prevent accidents by reducing or eliminate thecauses.

artifacts, but not so any more for large-scale, complex
artifacts in which accident mechanisms cannot be
described by simple, cause-consequence
relationships (Perrow, 1984).

20

Key Capabilities Needed for Resilient Systems
Responding
Knowing what to do

Anticipating
Knowing what toanticipate; opportunities
and threats

ActualFactualCriticalLearning
Knowing what had
actually happened

Monitoring
Knowing what to lookfor

Potential

Prepare and allocate appropriate resources.
Pay more attention to success cases rather than failures.

You need to lookahead to see
what is coming:
Monitoring
Anticipating

You need tomake use of pastexperiences:
Learning
You need to noticewhere you are and how
the river is flowing:
Responding

2122

Ｃｏｐｙｒｉｇｈｔ©2011 M.Kitamura

Essential Capabilities

Applications

 A new paradigm for pursuing safety is definitely needed incurrent society where a resilient operation of sociotechnical systems is critically important for sustainmentand development of our society. The endeavor toward
establishment of the methodology of resilienceengineering summarized as the four capabilities, together with the requirements of The resilience engineering methodology has been applied invarious domains including airline safety, air traffic control, railway
transportation, offshore production, power plant maintenance, financial service
systems, patient safety, etc.
 In this panel discussion, one particular application to severeaccident investigation is reviewed.
 Most of the activities of Fukushima accident investigation

 (1) appropriate resource management andseem to be based on the notion of Safety-Ⅰ.

 (2) emphasis on learning lessons from success events rather thanfrom failure events
 is a quest for meeting the demand of modernsociety.
23

In consequence, tremendous efforts had been paid to identify a large
number of cause-consequence relationships that contributed to theonset or development of the accident. After the identification of thecauses, recommendations had been formulated to reduce or eliminate
the causes.
24
 As a natural outcome, the recommendations are large in number andcomplicated in structure4

Applications
 It is much promising to restructure and prioritize the large

number of recommendations so that countermeasures toprevent recurrence of the disaster can be implemented in
more efficient manner.

Concluding Remarks
 Resilience engineering is still in its development

situations must be resolved by proper implementation ofsuggestions derived from resilience engineering.
 Efforts to improve nuclear safety in terms of the Safety-Ⅱ
will be imperative for realistic safety management of
25
nuclear facilities.

stage. Further efforts are definitely necessary for
attaining higher applicability to target domains.
 However, even at the present stage, themethodology can provide us with rich suggestions
and proposals toward enhancing safety of artifacts.
 It is obvious that the nuclear safety community will
be highly benefitted by the HT experts if they candevelop efficient and dependable tools for “fasterthan-real-time simulation” of nuclear accidents.
 One might claim that such a simulation tool is26
already available.

Concluding Remarks

Concluding Remarks

 However, it is absolutely needed that the software tool can Another future application, highly desirable for nuclear

 Guidelines derived from resilience engineering have been used tomeet the needs.
 Ongoing efforts to improve safety of NPSs are inclined toincrease Safety-Ⅰ by hardware systems.
 Lack of capabilities for performance adjustments in diverse

cover effects of human interventions causing various
changes in plant configuration.
 Note that the type and timing of the intervention are not specified

as initial conditions of the simulation.
 Such a simulation software can be utilized to estimate time

margins to core melt and/or release of radioactive
materials . Information derived by such tools will be mosthelpful for operators in a control room of a NPS under
severe disturbances.
 Similar simulation can be utilized during design andevaluation phases of countermeasures to be implemented27
to mitigate severe accidents.

safety, would be the development of techniques forevaluating resilience of the nuclear components and/orsystems withstanding beyond-design-specification
situations.
 Further applications can be proposed and resolved underclose collaborations between nuclear and thermal science
experts.

28

5