Dr Richard Cook: How Complex Systems Fail

Dr Richard Cook

I was recently saddened to learn of the passing of Dr Richard Cook, and felt it appropriate that I dedicate this issue of the newsletter to Richard and his achievements. I was hoping that Richard may be able to speak at an upcoming psychological safety meetup, and you’ll see why. Richard was an incredible man, a true polymath, and according to everyone that knew him, a genuinely kind, compassionate, and generous person. Richard was one of those rare “boundary spanners” who bring new and insightful ideas to the world of human endeavour: in the morning he could be working in his role as an anaesthesiologist, then delivering a DevOps workshop on complex systems analysis in the afternoon, through his role with Adaptive Capacity Labs. Lorin Hochstein described Richard as a storyteller and raconteur, and as an interpreter who could ground complex theory into practice.
 

In 2006 he wrote a paper titled “Being Bumpable“, which used a story of a patient in hospital to examine the absurdity of apportioning “human error” to the cause of an incident, and described how practitioners cope with the demands of the socio-technical systems of modern healthcare.

Much earlier, in 1998, he wrote an excellent paper called “How Complex Systems Fail“, where he highlights eighteen characteristics of complex system failure modes, which his friend and mine John Willis rightfully compares in significance to Deming’s 14 points – Richard’s work in this area had a huge impact on so many people in a wide variety of fields from aviation and medicine to technology and manufacturing.

1) Complex systems are intrinsically hazardous systems.
2) Complex systems are heavily and successfully defended against failure. 
3) Catastrophe requires multiple failures – single point failures are not enough.
4) Complex systems contain changing mixtures of failures latent within them.
5) Complex systems run in degraded mode.
6) Catastrophe is always just around the corner.
7) Post-accident attribution to a ‘root cause’ is fundamentally wrong.
8) Hindsight biases post-accident assessments of human performance.
9) Human operators have dual roles: as producers & as defenders against failure.
10) All practitioner actions are gambles.
11) Actions at the sharp end resolve all ambiguity.
12) Human practitioners are the adaptable element of complex systems.
13) Human expertise in complex systems is constantly changing.
14) Change introduces new forms of failure.
15) Views of ‘cause’ limit the effectiveness of defences against future events.
16) Safety is a characteristic of systems and not of their components.
17) People continuously create safety.
18) Failure free operations require experience with failure. 
 

In 2004 Richard became engaged in another new development — the rise of Resilience Engineering as an alternative approach to safety & complexity that emphasised the adaptive power of people. It is this same aspect (Richard’s point 12) that first drew me to the ideas of resilience engineering – the idea that people are the adaptive component of a complex sociotechnical system, and we must create and maintain the conditions in which people can *be* adaptive. Being adaptive means anticipating, detecting, responding to and learning from incidents, changes and shocks – and it is cultures of psychological safety (amongst other capabilities) that are essential to this adaptive capacity. Constructing and managing technological systems is hard, but working with social systems and people is even harder. (Thanks go to Richard himself for the Han Solo link)

Indeed, Richard was featured in the very first psychological safety newsletter, with this 2.5 hour Symposium on Safety Culture, Lean, and DevOps, with Dr. Sidney Dekker, Dr. Steven Spear, John Willis and Gene Kim. This session is really worth watching.

In 2009, John Allspaw wrote a WebOps perspective on four of Richard’s 18 failure modes, which I understand catalysed John’s interest in resilience engineering, and I don’t think it’s a coincidence that this was also the year of his “10+ Deploys Per Day: Dev and Ops Cooperation at Flickr” at the Velocity Conference.

As an example of Richard’s spirit, in 2010 he visited Haiti to help provide relief efforts after the devastating earthquake, providing his expertise in anaesthesia and critical care at a field hospital that provided essential care to the injured. He reflects in these videos the challenges faced by the relief teams and the Haitians. Hearing of Richard’s work in Haiti helped encourage me to study my Masters Degree in Global Health, for which I’m eternally grateful.
 

More recently, Richard delivered a talk at DevOpsDays Chicago, now infamously known as his “Bone Talk”: bone is the archetype of resilience, and medicine the archetype of resilience engineering. Bone is completely replaced in the human body every few years, but we often view it as static. In fact bone is constantly responding to strain, fractures, and stress – and improving as a result: getting stronger where it needs to be stronger, and leaner where it makes sense to be leaner. Medical professionals do not “heal” bone themselves, they create the conditions for resilience to occur. The same applies to sociotechnical systems – we must create the conditions in which it is possible to be resilient before we can demonstrate resilience. Psychological safety is a core element of those conditions.

David Woods, John Allspaw, and Michael O’Connor have written an obituary for Dr Richard Cook here: The Career, Accomplishments, and Impact of Richard I. Cook: A Life in Many Acts. 
 

This newsletter is sponsored by Conflux.

Conflux is the leading business consultancy worldwide helping organisations to navigate fast flow in software. We help organisations to adopt and sustain proven, modern practices for delivering software rapidly and safely.

Many organisations today are stuck using ways of working from a bygone age. In this article, Sophie Weston, Principal at Conflux, takes a look at why knowledge work needs a new approach in which psychological safety is a key ingredient.

Psychological Safety In the Workplace:

The big news this week: Yvon Chouinard, the founder of Patagonia and original creator of the 15/5 report, has given the company away to a charitable trust. The aim is that any profit that is not reinvested into running the business will now go to fighting climate change. I’ve long been a fan of Yvon, Patagonia, and the way they do business, and i’m impressed at this bold step. Yvon is an accomplished climber and alpinist, and started the Patagonia business making and selling climbing pitons and crampons. In 2002, Yvon founded 1% for the Planet and Patagonia became the first business to commit 1% of annual sales to the environment.
 

I’m not suggesting you should go out and free solo El Capitan, but, inspired by the story of Yvon Chouinard, I wanted to share this piece from Alex Honnold, another inspiring climber.
 

“Is it even failure if you’ve learned from it and you’ve taken those lessons onto your next project or the next thing that you’re working on?”
 

Alex talks to Adam Grant in this episode of Rethinking, about managing fear and taking risks.


This is a great paper by Ashley Woodson: Don’t let me be misunderstood: Psychological safety, Black girls’ speech, and Black feminist perspectives on directness. I’m sorry, this isn’t open access, but I felt that the content was important enough to share anyway, in case you have an academic account with which to access it, (or know someone who does!). This paper addresses the specific cultural realities and societal conditions that affects black girls’ participatory risk and the conditions that can move black girls and women from silence into action. 


Words matter. Here’s a great piece in Agile From the Trenches by Nic Easton about language in agile and scrum teams, and how we should be careful and precise with our language. Nic also highlights one of my key bugbears – the use of the word “resources” in place of “people”.
 

This piece by Tim Berglund in InfoQ is a transcript of a talk at QCon, and I like how it dives into the practical realities of managing and dealing with emotions, empathy, and communication. I think there are some really good suggestions here, particularly if you, or people you know, sometimes have difficulty in translating others’ behaviours and actions into emotions.

The psychsafety.com website now records over 20,000 page views per month, which is great! The downside is that it costs more to maintain and host as well! If you’re interested in reaching thousands of people every month with your message, get in touch and we can talk about advertising.

Things to do and try:

I love this from Sketchplanations. Being clear isn’t just helpful, it’s kind. When we’re unclear, or not specific about a request or feedback, we’re creating uncertainty that can cause stress and anxiety, damage psychological safety, and have a negative impact on outcomes. If we want to set someone up with the greatest chance of success, we have to be really clear about what we’re asking from them in the first place.
 

This week’s poem:

Epitaph on a Tyrant, W. H. Auden – 1907-1973

Perfection, of a kind, was what he was after,
And the poetry he invented was easy to understand;
He knew human folly like the back of his hand,
And was greatly interested in armies and fleets;
When he laughed, respectable senators burst with laughter,
And when he cried the little children died in the streets.

Mission statement

The mission of this newsletter is to make the world of work a better, safer, more inclusive and equitable place. We work towards this by sharing, as widely as possible, new research and opinion, case studies, news, practices and methods related to psychological safety. 

This includes topics such as inclusion, human factors, facilitation, safety critical environments, systems thinking, leadership and management, diversity and equity, mental health, organisational dynamics, culture, ethics, and more. 

A core goal is to amplify the voices of minoritised groups and those who are less represented in this field. This includes (but is not limited to) voices of people of colour, neurodiverse people, LGBTQ+ people, women in leadership and tech, and more.

Another goal is to share insights and best practices across different domains: for example, so that those of us in tech may learn from healthcare, and those of us in education can learn from aviation.

I believe knowledge is worthless unless it’s accessible. A key principle of this newsletter is to only share content that everyone can access. This excludes content behind paywalls, research papers that are not open-access, and proprietary tools that don’t open source their algorithms (preventing us from observing how systems make decisions about us). There may be some exceptions to this principle in practice, for example, where authors are able to share original texts of papers.

Whilst this statement will evolve this over time, the core principles of equity, amplification, and progressive & humanistic leadership shouldn’t change.