Understanding maintenance activities in a macrocognitive work system

Transcription

1 Understanding maintenance activities in a macrocognitive work system L. Macchi P. Oedewald M. H. Rø Eitrheim C. Axelsson VTT- Technical Research Centre of luigi.macchi@vtt.fi VTT- Technical Research Centre of pia.oedewald@vtt.fi Institute for Energy Technology (IFE) Norway Maren.Eitrheim@hrp.no Vattenfall AB Sweden christer.axelsson@v attenfall.com ABSTRACT Motivation To illustrate a theoretical framework as well as three methods applied for describing how maintenance activities are actually carried out in a nuclear power plant, for understanding their local rationale and for evaluating their possible effects on system safety. Research approach Based on document analysis, interviews, field observations, and workshops Organisational Core Task modelling, Functional Resonance Analysis Method, and the analysis of trade-offs and goal conflicts have been applied to understand maintenance activities in nuclear power plants. Findings/Design Each method sheds light on specific aspects of maintenance activities performed during outages. Their combination provides insight about what maintenance activities actually are, and about the reasons for maintenance activities being performed in the manner they are actually performed. Take away message An innovative approach is needed to support safe and efficient maintenance activities. Keywords Maintenance activities, trade-offs, resilience, macrocognition, OCT, FRAM. 1 INTRODUCTION In nuclear power plants, maintenance activities are of crucial importance for providing the technical preconditions for undisturbed operations and functioning of the systems. Maintaining a nuclear power plants implies executing many tasks with varying degrees of technical demands, safety significance and inter-couplings. Maintenance workers need to identify, remove, control and prevent the various hazards associated with the work. In addition, in the nuclear industry not only work is hazardous and complex, but the social organisation is normally complex and it becomes even more complex during the annual outage. During that period maintenance organisation operates under increased time and financial pressure, and it has to rely on a large number of external interconnections like contractors and suppliers for meeting its goals. It is well known how effective and reliable maintenance is fundamental for any safety critical industry, and poorly executed maintenance is often one of the sources of technical failures and initiating event for plant disturbances (e.g. Reason, 1997; Hale et al., 1998; Kletz, 2003; Reason & Hobbs 2003; Perin, 2005; Baker, 2007; Sanne, 2008a). Thus it is of common interest for the industry, the society and the scientific community to properly understand maintenance practices and their impact on system safety. As organisational safety researchers we have applied an innovative approach, based on the Resilience Engineering perspective, to understand and support the development of safe and efficient maintenance activities. This paper illustrates the theoretical premises of our work in the nuclear domain, and how they have steered our thinking and practices. 2 RESEARCH CONTEXT AND OBJECTIVES This paper is based on the work jointly funded by The Finnish Research Programme on Nuclear Power Plant Safety (SAFIR2014) and the Nordic Nuclear Safety Research (NKS) platform. The project named Modelling Resilience for Maintenance and Outage (MoReMO) has the overall goal to develop and test models and methods to identify and analyse resilience in safety-critical activities in natural everyday settings. The MoReMO project studies the organisation and working practices of maintenance and outage organisations in Nordic nuclear plants. This paper is based on the advances and findings of the first year of work. Despite much effort is put in planning outages to a great detail, emerging problems and unexpected events require some human and organisational flexibility for accommodating changes in the planned schedule. Aware of this, planners usually allocate some slack time in the master schedule for dealing with minor deviations. In the case of major problems planners have to search for effective re-planning solutions while at the same time trying to minimise outage delays and their associated financial implications. When dealing with maintenance tasks, especially the ones performed under substantial time pressure, it is important to acknowledge that balancing and prioritizing concurrent goals actually becomes a daily task for the maintenance organisation. A number of tools and techniques (e.g. procedures, schedules, work practices) are available to operators to achieve one or several objectives. Due to the characteristics of maintenance activities during outages, operators have to balance between several factors like efficiency, plant operability, nuclear safety, occupational safety and costs. When multiple goals cannot be met at the same time, workers are facing dilemmas related to 52

2 prioritisation of their activities. Dilemmas can get even bigger in the situation when operators do not have clear criteria for each goal, and/or they lack explicit rules or guidelines for prioritizations, and/or they are not sure if the goal can actually be met. In any case, whenever two or more goals are conflicting, individuals have to make sacrificing decisions concerning how well one or all goals can be achieved. In this kind of situations a number of trade-offs can potentially take place, either at individual or at organisational level. Understanding how, when and why trade-offs occur and what do they mean for the safety and the functioning of the system represents the first step towards supporting effective and reliable maintenance activities in the nuclear industry. 3 THEORETICAL PREMISES The cultural and professional background of the researchers involved in the project had a great influence on a number of theoretical stances taken in the beginning of the work. These had obviously steered our explicit assumptions, our hypothesis, our thinking and our research practices. We briefly summarise here some of the major theoretical premises of our work and how they do diverge from the more traditional way to address issues related to risks, safety and the human contribution to the (mal)functioning of complex industrial activities. 3.1 Resilience Engineering The first basic premise that influenced the approach to understand the local rationale of maintenance activities and their effects on system safety is the paradigm of Resilience Engineering. The rational underlying the development of Resilience Engineering is the need to deal with risks and safety in complex and tightly coupled systems in a world where safety and productivity could no longer be disjoint (Hollnagel, 2008). Resilience Engineering looks for ways to manage organisational safety (Dekker, 2006) and to enhance the ability of organisations to monitor and revise risk models, to create processes that are robust yet flexible, and to use resources proactively in the face of disruptions or on-going production and economic pressures (Woods et al., 2010). Resilience Engineering acknowledges that local adaptations and human performance variability are not necessarily threats to safety and reliability. Instead, adaptation and performance variability are essential because they allow the system to function as smooth as possible and to respond to unexpected challenges. A focal message of Resilience Engineering is that safety efforts should focus not only on errors, deviations and accidents, but also on to what goes right. Learning from incidents and accidents is important, but in terms of safety development we miss the opportunity to exploit a huge amount of relevant data concerning successful performance of the system. This implies that normal, everyday activities of maintenance personnel in their natural setting should be the basis for understanding the reasons that make maintenance activities safe and effective. 3.2 Macrocognitive work system A second assumption concerns the perspective on cognition and on the system being analysed. For the sake of frankness, the way in which this assumption had been made was implicit and entirely set by researchers background. The need to tackle practical problems happening in the real world called for a macrocognitive level of analysis. The distinction between microcognition and macrocognition was first made by Cacciabue et al. (1995). The former refers to the studies, in controlled settings, of the building blocks of human cognition. The latter is concerned with the analysis of the cognitive functions in natural decision making processes (Klein et al, 2003). Klein et al. (Op. cit.) also claim that by using the concept of macrocognition, with respect to similar approaches as Activity theory, Distributed cognition and Situated cognition, the level of description of the functions themselves is broader. Macrocognition is focused on the activities performed in real settings in order to achieve a goal or an objective, and it aims at developing descriptive models of the on-going processes structuring the course of actions. Hoffman et al (2009) note how macrocognitive activities comprehend individual processes (e.g. forming mental models, detecting problems etc.), social processes (e.g. coordination, sense making etc.) and a mix of the two (e.g. replanning, adapting etc.). Macrocognitive functions are normally performed with the use of some sort of technology. Adopting the macrocognitive perspective therefore implies that what is subject of study are the actual human activities performed in complex joint socio-technical systems. To simplify this label Hoffman et al (Op.cit) suggest the use of the term Macrocognitive work systems (MWS). The Macrocognitive work system approach to maintenance activities means that instead of focusing solely on the interpretations and decisions the individual carry out we analyse the social processes and their effects in the work processes. 3.3 Human performance variability In the nuclear industry traditional safety and risk assessment, such as Human Reliability Assessment, are mainly based on linear models of human cognition in which information is processed in order to produce an action (e.g. COCOM (Contextual Control Model, Hollnagel, 1993), RMC (Reference Model of Cognition, Cacciabue 1998), SRK (Skill Rules Knowledge, Rasmussen, 1986). All these cognitive models can be considered part of the Information Processing System paradigm and since they rely on the assumption that human cognition was limited and fallible they are concerned with ensuring human reliability and reducing human error i.e. any kind of variability of performance. This traditional view on cognition means that system safety is achievable by designing and enforcing barriers to reduce the number of human errors and to mitigate their consequences, or in other terms to reduce human discretion and variability of performance. One of the effects of this approach is that training and instruction are designed to provide the personnel with means for coping with the likely disturbances and risks at work. Further, emphasis on compliance with written procedures is normally very strong implying that almost everything the employees face is covered by rules and procedures. The Resilience engineering and the macrocognitive work system approaches, as above briefly described, can barely coexist with this view on human performance. Re et al. (2010) summarise how other approaches were, almost independently from the main Human Factors tradition, developed and are now rather close to the type of perspective on human performance advocated by the resilience engineering and macrocognitive work system approach. Variability of performance, flexibility, anticipation adaptation were and are all seen as constitutive characteristics of human and organisational activities taking place in macrocognitive work systems (de Terssac, 1992; Musatti, 1971; Leplat, 2000; de Montmollin, 1984), and they are all required to sustain the functioning of a system operating under pressure (Hollnagel, 2009). The explicit adoption of this perspective on human performance means that, not only the interest is placed on understanding normal, everyday activities of maintenance operators in their natural setting, but the intrinsic variability of performance has to be acknowledged. Further, performance variability is understood as the source of both successful and unsuccessful performance of the macrocognitive work system (Hollnagel, 2004). 53

3 3.4 Bounds and Trade-offs The fourth and last theoretical premise, coherent with the three assumptions so far presented, concerns the reasons why human performance is actually variable in any work systems. Simon (1991) referred to bounded cognition to explain why humans sometime do not perform as supposed. Expanding his idea and drawing on researches in complex adaptive systems, in safety management and in the field of complexity, Hoffman et al (2011) identified and proposed five bounds (Bounded Ecology, Bounded Cognizance, Bounded Perspectivity, Bounded Responsibility, and Bounded Effectivity) on performance in macrocognitive work systems. Each of the bounds creates gaps that the macrocognitive work system has to deal with (Gaps in Fitness, Gaps in Plans, Gaps in Perspectives, Gaps across Roles, and Gaps in Progress). The way macrocognitive work systems have to deal with those gaps is to actuate trade-offs. In their model Hoffman et al. (Op. cit) identify the following five fundamental trade-offs that bound human performance: 1. Optimality-Resilience Trade-off. To rely extensively on routines increases the possibilities for being surprised by outof-the-ordinary situations. Thus, systems need to balance between the implementation and use of routines in their working practices, and the investment on developing and maintaining appropriate resources, including knowledge and expertise, for being able to adapt to surprising events. 2. Efficiency-Thoroughness Trade-off. Macrocognitive systems need to balance between being efficient and being thorough in the planning and execution of their activities. For example, the scope of plans needs to be evaluated against restrictions in personnel coordination and inflexibility 3. Acute-Chronic Trade-off. Chronic goals tend to get sacrificed to acute goals, which in turn leads systems to miss how and where they are brittle. Macrocognitive systems need to balance between paying attention to, and dealing with acute and chronic goals. For example, the costs of correcting daily communication shortcomings among maintenance personnel could be evaluated against the cost of introducing a new communication system at the plant. 4. Specialist-Generalist Trade-off. Specialist roles increase the ability to handle specific kinds of cases, but challenge the ability to deal with cases that cut across roles. Generalist roles enable handling diverse situations, but less fluently for specific kinds of situations. Macrocognitive systems have to balance between investing on and developing specialist and/or generalist roles and competences, for example by reallocating tasks between field operators, maintenance groups and contractors. 5. Distributed-Concentrated Trade-off. Distributing activities between different roles can increase the range of effective action, but increasing the distribution of activities can constitute a challenge for keeping them coherent and synchronized. Concentrating activities in single roles can produce more immediate progress toward goals, but also reduces the range of effective action. Macrocognitive systems need to balance between micromanagement and delegation over echelons. For example, the benefits of specialised groups monitoring specific plant systems need to be balanced against distributed responsibility achieved through standardised rounds. By adopting such perspective for explaining performance variability means that maintenance activities are analysed with the objective to identify the actual existence and magnitude of the bounds as well as to understand the actuation of trade-offs and their potential effect on the functioning and safety of the system. 4 METHODS AND DATA COLLECTION To understand and support the development of safe and efficient maintenance activities, three different methods were applied: Organisational Core Task (OCT) modelling (Oedewald et al., 2003; Reiman et al., 2006), Functional Resonance Analysis Method (FRAM) (Hollnagel, 2004; Macchi, 2010) and the analysis of trade-offs and goal conflicts (Hollnagel, 2009; Skjerve, 2009). The application of the OCT allows the identification and description of the core task of the maintenance organisation during outages in a nuclear power plant. It also aims at defining demands and constraints the organisation has to take into account when taking care of its core task. The FRAM allows the modelling of the functions performed in the macrocognitive work system to accomplish a specific task. As case study, it was decided to model the maintenance of a diesel engine generator. The analysis of trade-offs and goal conflicts provides an opportunity for describing how maintenance operators recognise safety goals, how they handle goal conflicts, and what supports positive work practices. 4.1 Organisational Core Task Modelling The scope of the OCT-modelling is to define the organisation s mission, i.e. its core task as well as the critical demands for safe and effective activities. The rational of the OCT is that if these demands are identified, kept in mind and taken into account in daily practices, organisational practices do not and will not drift into the unsafe zone. A demand valid for all activities at all levels of the organisation is considered a critical core task demand. The application of the OCT modelling was based on document (e.g. introductory training material, maintenance task description, work orders and schedules etc.) analysis, semistructured interviews and literature review The application of methodology allowed the definition of the organisational core task of maintenance during outages as: the provision of the technical conditions for effective and safe operation of the plant until the next scheduled overhauls and fuel load. This includes tasks such as fuel reload, periodical inspections, planned overhauls and fixing detected faults. (Oedewald et al, 2012). For the core task of maintenance during outages, six critical demands have been identified: Planning of the tasks, schedule and resources (which need to be as complete beforehand as possible) Coordination of the activities with the other parties (needs to be continuous) Monitoring of the plant condition while performing any tasks (needs to be a shared task) Knowing what is essential in each technical system one works with and knowing what might be the (safety) consequences if the work does not succeed Prompt reacting to unexpected findings at the plant Allocating resources in a flexible manner, redirecting attention and resources from task to another. The application of the OCT highlights, for example, how in the maintenance macrocognitive work systems, there is a need for a certain degree of flexibility and adaptability that manifests itself in the continual coordination and collaboration between diverse working groups and disciplines. 54

4 4.2 Functional Resonance Analysis Method The scope of the FRAM modelling was to capture the actual way in which the maintenance of a diesel engine generator took place during the 2011 outage at one of the case plants. This means identifying and describing the functions necessary to perform the maintenance of the diesel engine generator. The description of the functions can be used to support the reasoning of how small deviations and adjustments can resonate in the system and result in unexpected problems. Couplings and dependencies can also be used to illustrate the reasons why activities are successfully performed in the maintenance macrocognitive work system and how the maintenance activity is deeply interconnected with other activities performed during the outage as well as before the outage is started. The data collection for the FRAM modelling consisted of site visits to get acquaint with the case, collection of official material and documentation (e.g. list of tasks, work permits and associated schedule etc.), workshops to discuss and finalise a FRAM model. As result of the modelling activity, 25 functions have been identified and described (e.g. Drain system; Remove cylinder head; Inspect cylinder liner & cleaning; Evaluate urgency of problems; Spare parts management etc.). Each function was described in terms of six aspects (Input, Output, Preconditions, Resources, Control, Time) (Hollnagel 2004). The FRAM model pinpointed to the fact that maintenance of a diesel engine generator is a complex and complicated task. The model illustrates how functions are highly interconnected, and how the accomplishment of maintenance tasks requires far more activities to be performed than the one represented in the official documentation of work permits (Axelsson et al, 2011). 4.3 Analysis of trade-offs and goal conflicts The scope of the analysis of trade-offs and goal conflicts is to make sense of adaptations and performance variability occurring in the everyday performance of a macrocognitive work system. We performed eight interviews of maintenance staff at a Nordic nuclear power plant. The interviews were focused on how the personnel recognise safety goals, how they handle goal conflicts, and what supports appropriate work practices (Axelsson et al, 2011). Safety goals were perceived in association with both the safetyrelevant equipment and professionalism in work performance. The interviewees recognised professional work the one performed in accordance with norms of the group, the standards or their training, as well as application of human performance tools (e.g., pre-job briefings, stop-think-actreview). While procedures were considered supportive in performing planned work safely, in unexpected and unplanned situations personnel referred to the need to rely on team s experience in order to solve problems. During the interviews, the maintenance staff recalled incidents that happened because procedures were not applied and/or complacency and misperception of risks took place. To investigate possible trade-offs, we identify goals conflicting with safety goals. Not surprisingly all respondents experienced high workload and periods of time pressure. The case of a contractor not performing his/her job due to perceived time pressure was reported as an example. The same case was also attributed to complacency from the contractor. Administrative routines were also mentioned as cause of delays in the work progress, and they were not perceived as beneficial for the overall safety or thoroughness of tasks execution. None of the interviewees indicated budget or financial aspects as relevant constraint of their work, and in general they referred to the policy of you have as much time as it takes to meet the desired quality standards when working under time pressure. The analysis of trade-offs and goal conflicts highlighted examples of positive work practices, in particular related to teamwork and team decision making, were identified. The application of this method supports the assumption that tradeoffs are rarely used consciously. 5 DISCUSSION AND CONCLUSION Our aim is to understand the local rationale of maintenance working practices and the impact of the practices on system safety. Our framework includes four theoretical premises, and they clearly influenced our thinking and practices for tackling our research questions. The framework with the associated implications for our research can be summarised as follows (Figure 1): Figure 1 - Theoretical premises and implications for research We approached the question of how to identify and analyse resilience by applying three different methods (OCT, FRAM, and analysis of trade-offs and goal conflicts). While the three methods are coherent with respect to the theoretical premises, they were applied independently one from the other and in parallel during the year of research work. Each of them proved to be able to provide relevant insight on specific aspects of maintenance work in nuclear power plants. Since this research paper presents the work of an on-going research project, no final results are presently available. Nevertheless, some insight on the added value of approaching maintenance activities from the perspective of macrocognitive work systems can be here summarised. The OCT modelling told us what is mission of the maintenance organisation during outages, and which critical demands have to be taken into account. The FRAM helped us in modelling specific activities as actually performed and it allows the description of variability of performance. The analysis of trade-offs and goal conflicts pointed to the factors potentially effecting performance in real settings. Nevertheless, to really contribute to the development of safe and effective maintenance practices we think that the results obtained should be integrated and complemented. It is possible to say that these results respond to the questions of what maintenance activities actually are about (i.e. providing technical conditions for effective and safe operation of the plant), and to potential reasons of their variability. Especially by means of the concept of bounds and 55

5 trade-offs it is possible to shed light of the factors contributing to performance variability. It still remains to be investigated how and when trade are actualised i.e. the reasons why in a macrocognitive work system individuals trade, for example, efficiency for thoroughness, or acute for chronic goals. An answer to these questions can potentially be provided by the safety cultural perspective. Safety culture sets social norms, defines what is considered important, and how goals are prioritised. The prevailing culture in an organisation influences the psychological states and the conceptions of individual worker, and it creates for example feelings of being in hurry or perception of risk in certain situation. The culture of an organisation frames the behaviours and situational decisions taken in real activities (Reiman & Oedewald 2009). Furthermore, safety culture manifests itself in the concrete structures of the activities, such as in the resources, working arrangements and in the instructions. These as well influence organisational practices. The integration of the safety culture perspective with the other described approaches will be part of the continuation of the MoReMO project in This will allow to achieve a deeper understanding on how develop safe and effective maintenance practices in the nuclear industry. 6 ACKNOWLEDGMENTS We thank the Nordic Nuclear Safety Research and Safir2014 research program, the case study organisations, and especially all the staff that participated in workshops and interviews. 7 REFERENCES [1.] Axelsson, C et al. (2011). An Interview Study Investigating Efficiency-Thoroughness Trade-Offs in Maintenance Work at a Nordic Nuclear Power Plant. (IFE-HR-2011/1516) [2.] Baker, J., The report of the BP U.S. refineries independent safety review panel. Available from: ING/ [Accessed 23 March 2010]. [3.] Cacciabue PC (1998). Modelling and simulation of human behaviour in system control. Springer, Berlin Heidelberg New York [4.] Cacciabue P.C. & Hollnagel, E.(1995). Simulation of cognition: Applications. In: J.M. Hoc, P.C. Cacciabue, and Hollnagel, E., eds. Lawrence Erlbaum Associates, pp [5.] Dekker, S. W. A. (2006). Resilience engineering: Chronicling the emergence of confused consensus. In E. Hollnagel, D. D. Woods & N. Leveson (Eds.), Resilience Engineering: Concepts and precepts. Aldershot, UK: Ashgate Publishing Co. [6.] de Montmollin M (1990) L ergonomie. La Découverte, Paris [7.] de Terssac, G. (1992) Autonomie dans le travail. Presses Universitaires de France, Paris [8.] Hale, A.R., et al., Evaluating safety in the management of maintenance activities in the chemical process industry. Safety Science, 28, [9.] Hoffman, R.R et al. (2009) Complex sociotechnical joint cognitive work systems? IEEE Intelligent Systems, vol. 24, no. 3, 2011, pp [10.] Hoffman, R.R., & Woods D.D. (2011) Beyond Simon s Slice: Five Fundamental Trade-Offs that Bound the Performance of Macrocognitive Work Systems. IEEE Intelligent Systems, vol. 26, no. 6, 2011, pp [11.] Hollnagel E (1993) Human reliability analysis: context and control. Academic Press, London [12.] Hollnagel E (2004) Barriers and accident prevention. Ashgate, Aldershot [13.] Hollangel, E. (2008) Preface and Safety management, looking back or looking forward In: Hollnagel E, Nemeth CP, Dekker S, editors. In Resilient Engineering Perspectives, Ashgate, Aldershot, USA. [14.] Hollnagel E (2009) The ETTO principle: efficiencythoroughness trade-off. Why things that go right sometimes go wrong. Ashgate, Aldershot, UK [15.] Klein G. et al., (2003) Macrocognition, IEEE Intelligent Systems, vol. 18, no. 3, 2003, pp [16.] Kletz, T., (2003). Still going wrong! Case histories of process plant disasters and how they could have been avoided. Oxford: Butterworth-Heinemann. [17.] Leplat, J. (2000) L analyse psychologique de l activité en ergonomie Apercu sur son evolution. Octares, ses mode`les et ses méthodes. Toulouse [18.] Macchi, L. (2010). A Resilience Engineering approach to the evaluation of performance variability: Development and application of the Functional Resonance Analysis Method for Air Traffic Management safety assessment. PhD Thesis, MINES ParisTech, France. [19.] Musatti, C.L. (1971) Studio sui tempi di cottimo in una azienda metalmeccanica. Rassegna di Medicina dei Lavoratori, n.3, pp [20.] Oedewald, P., et al. (2012). Intermediate report of MOREMO: Modelling Resilience for Maintenance and outages. NKS-262report. [21.] Oedewald, P. & Reiman, T. (2003). Core task modelling in cultural assessment: A case study in nuclear power plant maintenance. Cognition, Technology & Work 5 (4), [22.] Perin, C., Shouldering risks: the culture of control in the nuclear power industry. New Jersey: Princeton University Press. [23.] Rasmussen, J. (1986) Information processes and humanmachine interaction. Elsevier-North Holland, Amsterdam [24.] Re, A. & Macchi, L., (2010) From cognitive reliability to competence? An evolving approach to human factors and safety. Cognition, Technology & Work, Volume 12, Number 2, June 2010, pp (7) [25.] Reason, J., Managing the risks of organizational accidents. Aldershot: Ashgate. [26.] Reason, J. & Hobbs, A., Managing maintenance error. A practical guide. Hampshire: Ashgate. [27.] Reiman, T. & Oedewald, P. (2006). Assessing the maintenance unit of a nuclear power plant identifying the cultural conceptions concerning the maintenance work and the maintenance organization. Safety Science 44 (9), [28.] Reiman, T. & Oedewald, P. (2009). Evaluating safety critical organizations. Focus on the nuclear industry. Swedish Radiation Safety Authority, Research Report 2009:12. 56

6 [29.] Sanne, J.M., 2008a. Framing risks in a safety-critical and hazardous job: risk taking as responsibility in railway maintenance. Journal of Risk Research, 11, [30.] Simon, H. (1991). "Bounded Rationality and Organizational Learning". Organization Science 2 (1): doi: /orsc [31.] Skjerve, A.B. (2009). A Goal-Conflict Typology to Support Adequate Prioritization of Safety Goals in Decision-Processes Mediated Via Co-operation Rooms A Psychological Perspective. In: A.B. Skjerve, M. Building Safety. Literature Surveys of Work Packages 2 and 3: Decision Making, Goal Conflicts, Cooperation, IO Teamwork Training, Decision Support, and the impact on Resilience of New Technology (IFE/HR/F-2009/1388), Halden, Institute for Energy Technology, pp [32.] Woods, D.D. et al.. (2010). Behind Human Error. Farnham, UK: Ashgate. 57