Architecting Resilient Systems: Accident Avoidance and Survival and Recovery from Disruptions

Architecting Resilient Systems: Accident Avoidance and Survival and Recovery from Disruptions

Volumn , Issue , 2009, Pages 1-297

  Jackson, Scott ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84889480544     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1002/9780470544013     Document Type: Book

References (198)

1. Anders, S., Woods, D., Wears, R., Perry, S., & Patterson, E. (2006). Limits on adaptation: Modeling resilience and brittleness in hospital emergency departments. Proceedings of the Second Symposium on Resilience Engineering, (pp. 1-9). 8-10 November, Antibes-Juan-les-Pins, France.
2. ANSI/EIA-632-1998. (1999). Processes for engineering a system. Philadelphia, PA: Electronic Industries Association.
3. Archibold, R. (2008, September 17). Commuter train did not use brakes, officials say. New York Times, p. A15.
4. Ashkenas, R., et al. (1998). The boundaryless organization : Breaking the chains of organizational structure. San Francisco, CA: Jossey-Bass.
5. Augustine, N. (1996). Yes, but will it work in theory? 1996 Woodruff distinguished lecture transcript. Retrieved March 8, 2009, from http://sunnyday.mit.edu/16.355/Augustine.htm
6. Aviation Safety Network. (1989). Accident description (1989 f Sioux City DC-10). Retrieved on March 8, 2009, from http://aviation-safety.net/database/record.-php?id=19890719-1
7. Smith, J. (2007, March 5) Aviation Week and Space Technology (2007, March 5), 166, 23.
8. Baker, J. III, et al. (2007). The report of the BP U.S. refineries independent safety review panel. Oil, Gas, & Energy Law Intelligence, 2.
9. Barter, R., & Morais, B. (1998). Systems engineering applied to integrated safety management for high consequence facilities.. 9th Annual International Symposium of the Council on Systems Engineering. 6 June, 1999, Brighton, England.
10. Bellis, M. (2009). The history of penicillin. About.com : Inventors. Retrieved on March 8, 2009, from http://inventors.about.com/od/pstartinventions/a/Penicillin.htm
11. Bennis, W. (1999). The leadership advantage. Leader to leader, 12, 18-23.
12. Besco, R. (1990). Aircraft accidents aren't. Accident Prevention. Flight Safety Foundation. 1990 (Part 1); 1991 (Part 2).
13. Billings, C. (1997). Aviation automation: The search for a human-centered approach. Mahwah, NJ: Lawrence Erlbaum Associates.
14. Blanchard, B., & Fabrycky, W. (2006). Systems engineering and analysis (4th ed.). Englewood Cliffs, NJ: Prentice Hall.
15. Bracco, F., Gianatti, R., & Pisano, L. (2008). Cognitive resilience in emergency room operations, a theoretical framework. Proceedings of the Third Symposium on Resilience Engineering. 28-30, October, Antibes-Juan-les-Pins, France.
16. Branson, R. (2007, July 29). Richard Branson's empire keeps growing. CBS News Sunday Morning. New York: Columbia Broadcasting Company.
17. Bureau Enqué tes Accidents (BEA). (2000). Accident on 25 July 2000 at ''La Patte d'Oie'' in Gonesse (95), to the Concorde, registered F-BTSC, operated by Air France. Retrieved on March 27, 2009, from http://www.bea-fr.org/docspa/2000/f-sc000725pa/pdf/f-sc000725pa.pdf
18. California Fire Fighter Joint Apprenticeship Committee. (2002). First responder: Operations-terrorism consequence management. Student Manual. California Fire Fighter Joint Apprenticeship Committee: Sacramento, CA.
19. Carnegie Mellon Institute. (2006). Capability maturity model integration. Retrieved March 13, 2009, from http://www.sei.cmu.edu/cmmi/
20. Carroll, P. (1999). The executive leader's perspective. In Senge, P., et al. (eds.) The dance of change: The challenges to sustaining momentum in learning organizations (pp. 203-211). New York: Doubleday.
21. Checkland, P. (1999). Systems thinking, systems practice.New York: JohnWiley and Sons.
22. Chiles, J. (2002). Inviting disaster: Lessons from the edge of technology, an inside look at catastrophes and why they happen. New York: Harper Business.
23. Columbia Accident Investigation Board. (2003). Columbia accident investigation report. Washington, D.C.: National Aeronautics and Space Administration.
24. Commercial Aviation Safety Team (CAST). (2007). Safer skies/CAST: 65 selected safety enhancements. Retrieved on March 27, 2009, from http://www.cast-safety.org/pdf/safety_enhancements_completed.pdf
25. Connell, R. (2008a, September 17). Metrolink seeks to film its engineers. Los Angeles Times, p. B1.
26. Connell, R., & Lopez, R. (2008b, December 5). Safety of rail system assailed. Los Angeles Times, pp. B1, B10.
27. Connell, R., & Lopez, R. (2008c, September 19). Cellphones banned for train crews. Los Angeles Times, p. B5.
28. Conrow, E. (2000). Effective risk management: Some keys to success. Reston, VA: American Institute of Aeronautics and Astronautics (AIAA).
29. Critical thinking: Moving from infrastructure protection to infrastructure resilience. (2007). CIP [Critical Infrastructure Protection] Program Discussion Paper Series. George Mason University. Retrieved on March 27, 2009, from http://www.resilient.com/download/Research_GMU.pdf
30. D'Antonio, M. (2002, July 14). The advantage of falling short. Los Angeles Times. pp. 12-15, 32-33.
31. Dean, C. (2006, May 2). Engineering a safer, more beautiful world, one failure at a time. New York Times. p. D3.
32. Dekker, S. (2006). Resilience engineering: Chronicling the emergence of confused consensus. In Hollnagel, E., Woods, D. D., & Leveson, N. (Eds.). Resilience engineering: Concepts and precepts. (pp. 77-92). Aldershot, UK: Ashgate Publishing.
33. Dekker, S., & Hollnagel, E. (2006). Resilience engineering: New directions for measuring and maintaining safety in complex systems. Second Progress Report, School of Aviation, Lund University. Retrieved on March 27, 2009, from http://www.srv.se/upload/Om%20verket/Forskning/projekt/Rapporter/Dekker%20_Progress%20Report_2.pdf
34. Department for Environment, Food and Rural Affairs (Defra). (2007). Making space for water: Outcome measures. Retrieved on March 8, 2009, from http://www.defra.gov.uk/environ/fcd/policy/strategy/sd4/default.htm
35. Department for Environment, Food and Rural Affairs (Defra). (2008). Developing the evidence base for flood resilience: Technical Summary FD 2607. Retrieved on March 27, 2009, from http://sciencesearch.defra.gov.uk/Document.aspx?Document=FD2607_7321_TSM.pdf
36. Department of Defense. (2001). Technology readiness levels and their definitions. In Mandatory procedures for major defense acquisition programs (MDAPS) and major automated information system (MAIS) acquisition programs [DoD Deskbook 5000. 2-R, Appendix 6] (pp. 183-185).Washington, D.C.:Office ofUnder SecretaryofDefense.
37. Department of Defense. (2007, April 23). DoD architecture framework (DODAF), Version 1.5: Volume II, product descriptions. Retrieved March 13, 2009, from http://www.defenselink.mil/cio-nii/docs/DoDAF_Volume_II.pdf
38. Dodge, M. E. M. (1865). Hans Brinker, Or the silver skates. Retrieved on April 14, 2009, from http://books.google.com/books?id=8TsRAAAAYAAJ&pg=PA158&ots=PlbleHItP2&dq=%22hans+brinker+or+The+Silver+Skates:+A+Life+in+Holland%22&output=html
39. Dooley, K. (1996). Complex adaptive systems: A nominal definition.Retrieved January 5, 2008, from http://www.eas.asu.edu/~kdooley/casopdef.html
40. Dreifus, C. (2006, May 14). Earth science meets social science in the study of disasters, New York Times. p. F2.
41. Epstein, S. (2006). Unexampled events, resilience and PRA. In E. Hollnagel & E. Rigaud (Eds.), Proceedings of the Second Resilience Engineering Symposium, (pp. 105-116). 8-10 November, Juan-les-Pins, France.
42. Eyles, D. (2004). Tales from the lunar module guidance computer. 27th Annual Guidance and Control Conference of the American Astronautical Society, (paper AAS-04 064). Breckenridge, CO.
43. Federal Aviation Administration. (2007a). Airworthiness standards: Transport category airplanes. Federal Aviation Regulation. FAR 25.1309: Equipment, systems and installations.
44. Federal Aviation Administration. (2007b). Airplane performance regulation in icing conditions: Final rule. Federal Aviation Regulation, 14 CFR Part 25. Federal Register (72), 44656-44669.
45. Federal Aviation Administration. (1997). Aviation safety data accessibility study index: Analysis and interpretation of safety data. Retrieved on March 29, 2009, from http://www.nasdac.faa.gov/aviation_studies/safety_data/analysis.html
46. Federal Aviation Administration (2004). Safety and security extensions for capability maturity models. Ibrahim, L., et al. (Eds.) Washington, D.C.: Retrieved March 20, 2009, from https://buildsecurityin.us-cert.gov/swa/downloads/SafetyandSecurityExt-Sep2004.pdf
47. Federal Aviation Administration (FAA) (2008) Code of Federal Regulations (CFR) Final Rule. Reduction of fuel tank flammability in transport category airplanes. July 21. Retrieved from http://www.airweb.faa.gov/Regulatory_and_Guidance_Library/rgFinalRule.nsf/0/5FA0E184CDEF9FE7862574C90055EE05?OpenDocument&Highlight=25-125 August 3, 2009
48. Federal Aviation Administration (FAA) (2008b). 14 CFR Part 39. Airworthiness Directive; Boeing Model 737 Aircraft. Retrieved on August 4, 2009 from http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/9da618efecdae41c862574fd0050510b/$FILE/2008-23-07.pdf
49. Federal Aviation Administration (FAA) (2009) Airworthiness Directives. Retrieved on August 5, 2009 from http://www.airweb.faa.gov/Regulatory_and_Guidance_Library/rgAD.nsf/Frameset?OpenPage
50. Feynman, R. (1988). An outsider's inside view of the Challenger inquiry. Physics Today, 41, 26-37.
51. Flin, R. (2006). Erosion of managerial resilience: From Vasa to NASA. In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 223-233). Aldershot, UK: Ashgate.
52. Flin, R. (2007, June 26). Managerial decision making: Counterbalancing risks between production and safety [PowerPoint slides]. Presentation at the Industrial Psychology Research Centre, University of Aberdeen, Aberdeen, Scotland.
53. Freedman, D. H. (2006). The future of NASA. Discover, 34-42.
54. Garbin, D., & Shortle, J. (2007). Measuring resilience in network-based infrastructures. In Critical thinking: Moving from infrastructure protection to infrastructure resilience (pp. 73-86). CIP [Critical Infrastructure Protection] Program Discussion Paper Series, George Mason University.
55. GCOR (General code of operating rules) (3rd Ed.) (1994). Train delayed within a block. Section 9.9. Retrieved on March 8, 2009, from http://www.trainweb.com/gcor/blocks.html#9.9
56. Global Earth Observation System of Systems (GEOSS). (2006). Working Group of the International Council on Systems Engineering (INCOSE). Retrieved on March 8, 2009, from http://www.incose.org/practice/techactivities/wg/geoss/
57. Gottlieb, J. (2008a, December 5).Crash puts rail line chief in spotlight. Los Angeles Times, p. B4.
58. Gottlieb, J. (2008b, September 29). Firm that employed Metrolink engineer had other problems. Los Angeles Times, p. B1.
59. Gottlieb, J. (2008c, October 11). Metrolink safety panel appointed. Los Angeles Times, p. B6.
60. Gottlieb, J. (2008d). Metrolink is pairing up engineers. Los Angeles TImes, p. B1.
61. Government Printing Office (GPO) (2009). Electronic Code of Federal Regulations (e-CFR). Title 14-Aeronautics and Space. Part 39-Airworthiness Directives. Retrieved on August 5, 2009 from http://ecfr.gpoaccess.gov:80/cgi/t/text/text-idx?-c=ecfr&tpl=/ecfrbrowse/Title14/14cfr39_main_02.tpl
62. GRA Incorporated. (2007). Economic values for FAA investment and regulatory decisions, a guide : Final report.
63. Gribble, S. (2001). Robustness in complex systems. Proceedings of the Eighth Workshop on Hot Topics in Operating Systems, (pp. 21-26). IEEE Computer Society.
64. Grote, G. (2006). Rules management as source for loose coupling in high-risk systems. Proceedings of the Second Symposium on Resilience Engineering, (pp. 116-124). 8-10 November, Juan-les-Pins, France, November.
65. Guikema. S. (2009). Infrastructure design issues in disaster-prone regions. Science, 323, 1302-1303.
66. Hale, A., Guldenmund, F., & Goossens, L. (2006). Auditing resilience in risk control and safety management systems. In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 389-314). Aldershot, UK: Ashgate.
67. Hamill, M. (2006). Systems engineering: What technical management means. Presentation to the Los Angeles chapter of INCOSE.
68. Hardman, N. (2008). What systems engineers need to know about human-computer interaction. Insight, 11(2), 19-22.
69. Haynes, A. (1991). The crash of United flight 232. Presentation to NASA-Dryden.
70. Heisel, W., & Weikel, D. (2007, October 28). Shortages added fuel to O.C. [Orange County] fire. Los Angeles Times, pp. A1, A32.
71. Hennessey-Fiske, M., Connell, R., & Lopez, R. (2008a, October 4). Red light on train wreck disputed. Los Angeles Times, p. B1.
72. Herkströter, C., Moody-Stuart, M., & Steel, G. (1999). Strategic transformation at Royal Dutch/Shell. In Senge, P., et al. The dance of change: The challenges to sustaining momentum in learning organizations (pp. 523-28). New York: Doubleday.
73. Hollnagel, E. (2006). Resilience-the challenge of the unstable. In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 9-14). Aldershot, UK: Ashgate.
74. Hollnagel, E., & Rigaud, E. (Eds.) (2006). Proceedings of the second Resilience Engineering Symposium. 8-10 November, Juan-les-Pins, France.
75. Hollnagel, E., Woods, D., & Leveson, N. (Eds.). (2006). Resilience engineering: Concepts and precepts. Aldershot, UK: Ashgate.
76. Hughes, Stephen (1997). The Texas City Disaster, 1947, University of Texas Press.
77. Hymon, S. (2008a, October 5). Cellphone ban imposed on all train operators. Los Angeles Times, p. B1.
78. Hymon, S. (2008b, September 26). Metrolink to consider safety gear. Los Angeles Times, p. B1.
79. Hymon, S., & Connell, R. (2008, September 25). Train safety improvements are proposed. Los Angeles Times, p. B4.
80. Hymon, S., & Dizikes, C. (2008, September 24). Accord reached on rail bill. Los Angeles Times, p.B1.
81. ISO/IEC 15288. Systems engineering-System life cycle processes. International Organization for Standardization. Geneva, Switzerland: International Organization for Standardization, 2002.
82. International Council on Systems Engineering (INCOSE). (1998). Fellows' consensus on systems engineering. International Council on Systems Engineering (INCOSE). Retrieved on March 27, 2009, from http://www.incose.org/practice/fellowsconsensus.aspx
83. International Council on Systems Engineering (INCOSE). (2006). Systems engineering handbook: A guide for system life cycle processes and activities (Version 3). Haskins, C. (Ed.) Seattle, WA.
84. Jackson, D. (2006). Dependable software by design. Scientific American, 294, 68-75.
85. Jackson, S. (1997). Systems engineering for commercial aircraft. Aldershot, UK: Ashgate.
86. Jackson, S. (2002). Organizational safety: A systems engineering perspective. Proceedings of the INCOSE International Symposium (paper 4.2.2). 28 July-1 August, Las Vegas, NV.
87. Jackson, S. (2007). A multidisciplinary framework for resilience to disasters and disruptions. Journal of Design and Process Science, 11, 91-108.
88. Jackson, S. (2008). The California firestorms of 2007. Panel presentation to the International Council on Systems Engineering (INCOSE) Symposium. 18-June, Utrecht, the Netherlands.
89. Jackson, S., & Hann, S. (2004). Attributes of a managerial and organizational infrastructure to enable safe systems. Proceedings of the INCOSE International Symposium (paper 6.5.1). 2020-24ndash;24 June, Toulouse, France.
90. Jackson, S., Erlick, K., & Gutierrez, J. (2006). The science of organizational psychology applied to mission assurance. Conference on Systems Engineering Research (paper 102). 77-8ndash;8 April, Los Angeles, CA.
91. Kaslow, D. (2004). Factors contributing to space systems failures and success. Proceedings of the 13th Annual International Council on Systems Engineering (INCOSE), (pp. 992-1006). 2020-24ndash;24 June, Toulouse, France.
92. Ketchum, M. (n.d.). Mark Ketchum's bridge collapse page. Retrieved on March 8, 2009, from http://www.ketchum.org/bridgecollapse.html
93. Kopp, C. (1993, September 7). Anatomy of a mistake: The tragic death of Jessica Santillan. 60 Minutes special report. New York: Columbia Broadcasting System (CBS).
94. Laddaga, R., & Robertson, P. (n.d.). Model based diagnosis in self adaptive software. Retrieved on March 29, 2009, from http://monet.aber.ac.uk:8080/monet/docs/pdf_files/dx03/ladd_dx03.pdf
95. Larson, E. (2000). Isaac's storm: The time, and the deadliest hurricane in history. New York: Vantage Books.
96. Leary, W. (2008). Wielding a cost-cutting ax, and often, at NASA. New York Times. p. F4.
97. Leveson, N. (1995). Safeware: Systemsafety and computers. Reading,MA:AddisonWesley.
98. Leveson, N. (2002a). A new approach to system safety engineering. MIT. Manuscript in preparation. Retrieved March 18, 2009, from http://ocw.mit.edu/NR/rdonlyres/Aeronautics-and-Astronautics/16-358JSpring-2005/7A17C38C-F622-4244-ABF0-5BD2B768661C/0/book2.pdf
99. Leveson, N. (2002b). System safety engineering: Back to the future. Manuscript in preparation. Retrieved March 8, 2009, from http://sunnyday.mit.edu/book2.pdf
100. Leveson, N. (2004a). A new accident model for engineering safer systems. Safety Science, 42, 237-270.
101. Leveson, N. (2004b). Model-based analysis of socio-technical risk. MIT Engineering Systems Division Working Paper Series. Retrieved March 13, 2009, from http://esd.mit.edu/wps/esd-wp-2004-08.pdf
102. Leveson, N. (2008). System safety engineering for software-intensive systems [Power Point slides]. Presentation at Boeing, Long Beach, CA.
103. Leveson, N., et al. (2005). Modeling, analyzing and engineering NASA's safety culture: Phase 1 Final Report, September 2004 to February 2005. Retrieved March 13, 2009, from http://sunnyday.mit.edu/Phase1-Final-Report.pdf
104. Leveson, N., et al. (2006). Engineering resilience into safety-critical systems. In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 95-122). Aldershot, UK: Ashgate.
105. Lintern, G. (2003). Tyranny in rules, autonomy in maps: Closing the safety management loop. Proceedings of the Twelfth International Symposium on Aviation Psychology, (pp. 719-24). 1414-17ndash;17 April, Dayton, OH.
106. Liu, J., et al. (2007). Complexity of coupled human and natural systems. Science, 317, 1513-1516.
107. Lopez, R., & Connell, R. (2008a, December 26). Experts see danger in signal gaps. Los Angeles Times, p. B1.
108. Lopez, R., & Connell, R. (2008b, December 5). Signal was green, says crewman. Los Angeles Times, p. B1.
109. Lopez, R., & Hymon, S. (2008a, October 7). Train engineer sent text message just before crash. Los Angeles Times, p. B1.
110. Lopez, R., & Hymon, S. (2008b, September 18). Train's engineer received, sent text messages on duty. Los Angeles Times, p. B1.
111. Lopez, R., & Hymon, S. (2009, January 7). Firm knew Metrolink engineer sent text messages, lawyers, say. Los Angeles Times, p. B3.
112. Lopez, R., & Oldham, J. (2008, September 16). Warning signals were working, officials say. Los Angeles Times, p. B1.
113. Lopez, R., & Weikel, D. (2008, September 17). Metrolink balked at safety upgrade's cost. Los Angeles Times, p. A1.
114. Lopez, R., Connell, R., & Hymon, S. (2008, November 22). Metrolink train ran red light. Los Angeles Times, p. B1.
115. Madni, A. (2007). Design for resilience [PowerPoint slides]. Presentation at Intelligent Systems Technologies, Inc. (ISTI), Los Angeles, CA.
116. Madni, A, Ahlers, R., & Chu, Y. (1987). Knowledge-based simulation: An approach to intelligent opponent modeling for training tactical decision making. Proceedings of the 9th Interservice/Industry Training Systems Conference, (pp. 179-183). 30 November-2 December, Washington, D.C.
117. Madni, A., & Jackson, S. (2009). Towards a conceptual framework for resilience engineering. IEEE Systems Journal. In Press.
118. Malakis, S., & Kontogiannis, T. (2008). Cognitive strategies in emergency and abnormal situations training: Implications for resilience in air traffic control. Proceedings of the Third Symposium on Resilience Engineering, 28-30 October, Antibes, Juan-les-Pins, France.
119. Mallak, L. (1998). Measuring resilience in health care provider organizations, Health Manpower Management, 24, 148-154.
120. Marais, K., Dulac, N., & Leveson, N. (2004). Beyond normal accidents and high reliability organizations: The need for an alternative approach to safety in complex systems. Engineering Systems 2004 Symposium. MIT. Retrieved March 13, 2009, from http://esd.mit.edu/symposium/pdfs/papers/marais-b.pdf
121. Maier, M., & Rechtin, E. (2009). The art of systems architecting (3rd ed.). Boca Raton, FL: CRC Press.
122. Mathews, M. (Ed.) (1951). A dictionary of Americanisms on historical principles (Vol. 1). Chicago, IL: University of Chicago Press.
123. Matthews, R., & Romanowski, M. (2004). Cooperative efforts are driving down the accident rate [PowerPoint slides]. US/Europe International Safety Conference, Philadelphia, June 7-11.
124. Maxwell, J. (2009). Observations of the resilience architecture of the firefighting and emergency response infrastructure [Research Paper]. University of Southern California, Los Angels, CA. February 9.
125. McCarthy, J. (2007). From protection to resilience: Injecting 'moxie' into the infrastructure security continuum. In Critical thinking: Moving from infrastructure protection to infrastructure resilience, (pp. 1-7). CIP [Critical Infrastructure Protection] Program Discussion Paper Series, George Mason University.
126. McFadden, R. (2009, January 16). All 155 aboard safe as crippled jet crash-lands in Hudson. New York Times, p. A1.
127. McKinley, J., & Wald, M. (2008, September 19). California bans texting by operators of trains. New York Times, p. A10.
128. Mendoc-a, D., & Wallace, W. (2006). Adaptive capacity: Electric power restoration in New York City following the 11 September 2001 attacks. In E. Hollnagel & E. Rigaud(Eds.), Proceedings of the Second Resilience Engineering Symposium, (pp. 209-19). 8-10 November, Juan-les-Pines, France.
129. Meshkati, N., & Osborn, J. (2008, September 17). Rail safety and the excuse of human error. Los Angeles Times, p. A23.
130. MIL-STD-882. Standard practice for system safety. Department of Defense. 1993.
131. Moody, J.,et al. (1997). Metrics and case studies for evaluating engineering designs. Upper Saddle River, NJ: Prentice Hall.
132. Morrison, P. (2008, September 18). She told the truth and lost her job. Los Angeles Times, p. A25.
133. Murphy, K. (2006, October 31). What pilots can teach hospitals about patient safety. New York Times, pp. D6, D10.
134. Nadler, G., & Chandon, W. (2004). Smart questions : Learn to ask the right questions for powerful results. San Francisco, CA: Jossey-Bass.
135. NASA Jet Propulsion Laboratory. California Institute of Technology. (1997). NASA Mars climate orbiter web site. Retrieved on March 8, 2009, from http://mars.jpl.nasa.gov/msp98/orbiter/
136. National Aeronautics and Space Administration (NASA). (1997). Safety, reliability, m aintainability and quality provisions for the Space Shuttle program. Report NSTS, 5300.4 (1D-2).
137. National Aeronautics and Space Administration (NASA). (2008). Process based mission assurance (PBMA) knowledge management system. Retrieved March 13, 2009, from http://pbma.nasa.gov/pbma_main
138. National Transportation Safety Board. (2000). Aircraft accident report, in-flight breakup over the Atlantic Ocean, Trans World Airline Flight 800, July 17, 1996. NTSB Number AAR-00/03; NTIS Number PB2000-910403. Washington, D.C.: United States National Safety Transportation Board.
139. National Transportation Safety Board (NTSB) (1990). Safety recommendation. A-9090-167ndash;167 through 175. December 14. Retrieved from http://www.ntsb.gov/recs/letters/1990/A90_167_175.pdf on August 4, 2009
140. Nicolescu, B. (2007). Transdisciplinarity as methodological framework for going beyond the science-religion debate. The Global Spiral, 8. Retrieved March 27, 2009, from http://www.metanexus.net/magazine/tabid/68/id/10013/Default.aspx
141. Nolte, J. (2008). Immediate response and long term recovery from the 9-11 terrorist attack: What should we do differently in a future attack? [PowerPoint slides]. Panel presentation to the International Council on Systems Engineering (INCOSE) Symposium, 18 June, Utrecht, The Netherlands.
142. Norman, D. (1982). Steps toward a cognitive engineering. Proceedings of the SIGCHI (Special Interest Group on Computer Human Interaction) Conference on Human Factors in Computing Systems, (pp. 378-382). 15-17 March, Gaithersburg, MD.
143. Okada, Y. (2003). Analysis of potential human error in hospital work. In D. Harris, et al. Human-centered computing: Cognitive, social and ergonomic aspects, Vol. 3. (pp. 532-536). Mahwah, NJ: Lawrence Erlbaum Associates.
144. Paté-Cornell, M. E. (1990). Organizational aspects of engineering system safety: The case of offshore platforms. Science, 250, 1210-1217.
145. Paté-Cornell, M. E., & Fischbeck, P. (1994). Risk management for the tiles of the space shuttle interface. Interfaces, 24, 64-86.
146. Patterson, E., Woods, D., Cook, R., & Render, M. (2007). Collaborative cross-checking to enhance resilience.Cognition, Technology & Work, 9, 155-162.
147. Perelman, L. (2007). Shifting security paradigm-toward resilience. In Critical thinking: Moving from infrastructure protection to infrastructure resilience, (pp. 23-48). CIP [Critical Infrastructure Protection] Program Discussion Paper Series, George Mason University.
148. Perrow, C. (1999). Normal accidents: Living with high-risk technologies. New York: Basic Books.
149. Pommerening, C. (2007). Resilience in organizations and systems: Background and trajectories of an emerging paradigm. In Critical thinking: Moving from infrastructure protection to infrastructure resilience, (pp. 9-21). CIP [Critical Infrastructure Protection] Program Discussion Paper Series, GeorgeMason University.
150. Reason, J. (1990). Human error. Cambridge, UK: Cambridge University Press.
151. Reason, J. (1997). Managing the risks of organizational accidents. Aldershot, UK: Ashgate.
152. Rechtin, E. (1991). Systems architecting: Creating and building complex systems. Englewood Cliffs, NJ: Prentice Hall.
153. Rechtin, E. (2000). Systems architecting of organizations: Why eagles can't swim. Boca Raton, FL: CRC Press.
154. Resilience Alliance. (2008). Resilience. Retrieved December 30, 2007, from http://www.resalliance.org/576.php
155. Richards, R., Ross, M., Hastings, D., & Rhodes, D. (2007). Design principles for survivable system architecture. Proceedings of the 1st IEEE Systems Conference, 9, 1-9. 9-13. Honolulu, HI.
156. Rohrlich, T. (2008). Train crash's roots run deep. Los Angeles Times, pp. A1, A22-23.
157. Rooney, J., Vanden Heuvel, L., & Lorenzo, D., Stoecklein, M., & Christensen Stoecklein, M., & Christensen, M.M. (2002). Reduce human error. Quality Progress, 35, 27-36.
158. Sage, A. (2008). Federated system of systems management [PowerPoint slides]. Presentation to the Conference on Systems Engineering Research, 4-5 April, Los Angeles, CA.
159. San Francisco Fire Department (SFFD). (1983). Manual for standard practices.
160. Scalingi, L. (2007). Moving beyond critical infrastructure protection to disaster resilience. In Critical thinking: Moving from infrastructure protection to infrastructure resilience, (pp. 49-71). CIP [Critical Infrastructure Protection] Program Discussion Paper Series, George Mason University.
161. Schwartz, J. (2008, January 9). With U.S. help, private space companies press their case: Why not us? New York Times, p. D4.
162. Senge, P. (1999). The growth processes of profound change. In Senge, P., et al. The dance of change: The challenges to sustaining momentum in learning organizations (pp. 42-57). New York: Doubleday.
163. Senge, P., et al. (1999). The dance of change: The challenges to sustaining momentum in learning organizations. New York: Doubleday.
164. Sheard, S. (2006). What you will need to know about chaos, complexity, and complex adaptive systems to do systems engineering well into the 21st century. International Council on Systems Engineering (INCOSE) tutorial, 9-13 July, Orlando, FL.
165. Stephan, K. (2007). We've got to talk: Emergency communications and engineering ethics. IEEE Technology & Society Magazine, 26, 42-48.
166. Stephens, H. (1997). The Texas City disaster, 1947. Austin, TX: University of Texas Press.
167. Technologies Strategies International (TSI) (2009). The systems approach. Retrieved March 8, 2009, from http://tsicanada.com/systems_approach.htm
168. The Nestlé management and leadership principles. (2003). Retrieved on March 8, 2009, from http://www.nestle.com/Resource.axd?Id=1353AE38-2F44-4F5F-A31F-72D57 EE0CF35
169. U.S. Department of Transportation (DOT).(1994).Technical advisory: The cost of motor vehicle accidents, T7570.2.
170. United States Air Force. (2000). Operational safety, suitability and effectiveness plan. Air Force Instruction 63-1201.
171. University of Washington. (2009). Systems theory. College of Forest Resources. Retrieved on March 8, 2009 from http://silvae.cfr.washington.edu/ecosystem-management/Systems.html
172. Utts, J., & Heckard, R. (2005). Statistical ideas and methods. Pacific Grove, CA: California Thomas Brooks Cole.
173. Van Allen radiation belt. (2008). In Encyclopedia Britannica. Retrieved on March 8, 2009, from http://www.britannica.com/eb/article-9074758/Van-Allen-radiation-belt
174. Vaughn, D. (1996). The Challenger launch decision: Risky technology, culture, and deviance at NASA. Chicago, IL: University of Chicago Press.
175. Wald, M. (2003, July 21). Study suggests space agency should consider mimicking Navy's safety techniques. New York Times, p. A13.
176. Wald, M. (2005, September 1). More planes too close than reports had listed. New York Times, p. A21.
177. Wald, M., & Schwartz, J. (2003, August 4). Shuttle inquiry uncovers flaws in communications. New York Times, p. A9.
178. Watt, K. (1974). The Titanic effect: Planning for the unthinkable. Stamford, CT: Sinauer Associates.
179. Wegner, E. (1998). Communities of practice: Learning, meaning and identity. Cambridge, UK: University of Cambridge.
180. Weick, K., & Sutcliffe, K. (2001). Managing the unexpected: Assuring high performance in an age of complexity. San Francisco, CA: Jossey-Bass.
181. Weikel, D., Connell, R., & Lopez, R. (2008, September 18). Engineer's split shift is probed. Los Angeles Times, p. A1.
182. Werner, P. (2001). Assessing an organization's culture. Proceedings of the Eleventh Annual Symposium of the International Council on Systems Engineering, (paper 1271). 1-5 July, Melbourne, Australia.
183. Westrum, R. (2006a). A typology of resilience situations. In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 55-65). Aldershot, UK: Ashgate.
184. Westrum, R. (2006b). All coherence gone: New Orleans as a resilience failure. In E. Hollnagel & E. Rigaud (Eds.), Proceedings of the Second Resilience Engineering Symposium, (pp. 333-41). 8-10 November, Juan-les-Pins, France.
185. White, J. (2006). The strongest handshake in the world. Invention and Technology, 21, 51-54.
186. White House (1993). Executive order 12866. Regulatory planning and review. September 30. Retrieved on August 5, 2009 from http://www.whitehouse.gov/omb/inforeg/eo12866/eo12866_amended_01-2007.pdf
187. Wilbur, C. (n.d.). Holistic method. University of Notre Dame. Retrieved on March 8, 2009, from http://www.nd.edu/~cwilber/pub/recent/edpehol.html
188. Woods, D. (2005). Creating foresight: Lessons for enhancing resilience in Columbia [draft article]. Retrieved on March 18, 2009, from http://csel.eng.ohio-state.edu/woods/space/Create%20foresight%20Col-draft.pdf
189. Woods, D. (2006). How to design a safety organization: Test case for resilience engineering. In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 315-26). Aldershot, UK: Ashgate.
190. Woods, D. (2006a). Epilogue: Resilience engineering precepts.In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 347-348). Aldershot, UK: Ashgate.
191. Woods, D. (2006b). Essential characteristics of resilience.In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 21-34). Aldershot, UK: Ashgate.
192. Woods, D. (2006c). Laws that govern joint cognitive systems at work. Ohio State University. Retrieved March 26, 2009, from http://csel.eng.ohio-state.edu/productions/laws/laws_flash1.swf
193. Woods, D. (2007). Navigating complexity [video file]. Lecture at Almaden Research Center, CA, April 11-12. Retrieved on March 8, 2009, from http://csel.eng.ohiostate.edu/productions/ibm/
194. Woods, D., & Cook, R. (2006). Incidents-markers of resilience or brittleness?In E. Hollnagel, D. Woods, & N. Leveson (Eds.). Resilience engineering: Concepts and precepts. (pp. 69-76). Aldershot, UK: Ashgate.
195. Woods, D.,Wreathall, J., & Anders, S. (2006). Stress-strain plots as a model of an organization's resilience. Proceedings of the Second Symposium on Resilience Engineering, (pp. 342-349). 8-10 November, Juan-les-Pins, France.
196. Wright, L., & Van der Schaaf, T. (2004). Accident versus near-miss causation: A critical review of the literature, an empirical test in the UK railway domain, and their implications for other sectors. Journal of Hazardous Materials, 111, 105-110.
197. Zachman, J. (2007). Enterprise design objectives: Complexity and change [PowerPoint slides]. Retrieved March 26, 2009, from http://www.ndia.org/DoDEntArchitecture/Documents/HalfDay092Up.pdf
198. Zarboutis, N., & Wright, P. (2006). Using complexity theories to reveal emerged patterns that erode the resilience of complex systems. Proceedings of the Second Symposium on Resilience Engineering, (pp. 359-368). 8-10 November, Juan-les-Pins, France.