|
|
| Line 1: |
Line 1: |
| − | Topic Overview
| + | |
| − | The purpose of resilience engineering and architecting is to achieve the full or partial recovery of a system following the encounter with a threat resulting in the disruption of the functionality of that system. Threats can be natural, such as earthquakes, hurricanes, tornadoes, or tsunamis. Threats can be internal and human-made such as reliability flaws and human error. Threats can be external and human made, such as terrorist attacks. A single incident can often be the result of multiple threats, such a human error committed in the attempt to recover from another threat. The attached diagram depicts the loss and recovery of the functionality of a system. System types include product systems of a technological nature or enterprise systems, such as civil infrastruc-tures. They can be either individual systems or systems of systems. A resilient system possesses four attributes: capacity, flexibility, tolerance, and cohesion. These attributes are adapted from (Hollnagel, Woods, and Leveson 2006), There are 13 top level design principles identified that will achieve these attributes. They are extracted from Hollnagel et al and are elaborated on in (Jackson 2010).
| |
| − | The Capacity Attribute
| |
| − | Capacity is the attribute of a system that allows it to withstand a threat. Resilience allows that the capacity of a system may be exceeded forcing the system to rely on the remaining attributes to achieve recovery. The following design principles apply to the capacity attribute:
| |
| − | • The absorption design principle calls for the system to be designed to withstand a design level threat including adequate margin.
| |
| − | • The physical redundancy design principle states that the resilience of a system will be en-hanced when critical components are physically redundant.
| |
| − | • The functional redundancy design principle calls for critical functions to be duplicated using different means.
| |
| − | • The layered defense design principle states that single point failures should be avoided.
| |
| − | The Flexibility Attribute
| |
| − | Flexibility is the attribute of a system that allows it to restructure itself in the fact of a threat. The following design principles apply to the capacity attribute:
| |
| − | • The reorganization design principle says that the system should be able to change its own architecture before, during, or after the encounter with a threat. This design principle is ap-plicable particularly to human systems.
| |
| − | • The human backup design principle requires that humans be involved to back up automated systems especially when unprecedented threats are involved.
| |
| − | • The complexity avoidance design principle calls for the minimization of complex elements, such as software and humans, except where they are essential (see human backup design principle).
| |
| − | • The drift correction design principle states that detected threats or conditions should be cor-rected before the encounter with the threat. The condition can either be immediate as for ex-ample the approach of a threat, or they can be latent within the design or the organization..
| |
| − | The Tolerance Attribute
| |
| − | Tolerance is the attribute of a system that allows it to degrade gracefully following an encounter with a threat. The following design principles apply to the tolerance attribute:
| |
| − | • The localized capacity design principle states that, when possible, the functionality of a sys-tem should be concentrated in individual nodes of the system ansta independent of the other nodes.
| |
| − | • The loose coupling design principle states that cascading failures in systems should be checked by inserting pauses between the nodes. According to (Perrow 1999) humans at these nodes have been found to be the most effective.
| |
| − | • The neutral state design principle states that systems should be brought into a neutral state before actions are taken.
| |
| − | • The reparability design principle states that systems should be reparable to bring the system back to full or partial functionality.
| |
| − | The Cohesion Attribute
| |
| − | Cohesion is the attribute that allows it to operate as a system before, during, and after an encoun-ter with a threat. According to (Hitchins 2009), cohesion is a basic characteristic of a system. The following global design principle applies to the cohesion attribute.
| |
| − | • The inter-node interaction design principle requires that nodes (elements) of a system be ca-pable of communicating, cooperating, and collaborating with each other. This design principle also calls for all nodes to understand the intent of all the other nodes as described by (Billings 1991).
| |
| − | Application to Product Systems
| |
| − | Many of the design principles may be applied to product systems. These include, but are not li-mited to, the absorption, physical redundancy, and reparability design principles and others.
| |
| − | Application to Service Systems
| |
| − | Many of the design principles apply to service systems. The reparability design principle is par-ticularly applicable.
| |
| − | Application to Enterprise Systems
| |
| − | Many of the design principles apply to enterprise systems, such as civil infrastructure systems. The inter-node interaction and reorganization design principles are particularly applicable.
| |
| − | Linkages to other topics
| |
| − | The absorption design principle requires the implementation of traditional specialties, such as reliability and safety. Most resilience design principles affect the system design processes, such as architecting. The reparability design principle affects the design of the sustainment system.
| |
| − | Practical Considerations (Pitfalls, Good Practice, etc.)
| |
| − | Resilience is difficult to achieve for infrastructure systems because the nodes (cities, counties, states, and private entities) are reluctant to cooperate with each other. Another barrier to resi-lience is cost. Achieving redundancy in, for example, dams and levees can be prohibitively ex-pensive. Other aspects can be low or moderate cost, such as communicating on common fre-quencies, but even there cultural barriers have to be overcome for implementation.
| |