B UILDING R ESEARCH & I NFORMATION 2014 Vol. 42, No. 2, 221 228, http://dx.doi.org/10.1080/09613218.2014.

862607

INFORMATION PAPER

Resilience engineering and the built environment

Erik Hollnagel1,2
1

Institute of Regional Health Research, University of Southern Denmark, J.B.Winslwsparken 19, DK-5000 Odense, Denmark E-mail: erik.hollnagel@rsyd.dk
2

Centre for Quality, Region of Southern Denmark, P .V. Tuxensvej 3^ 5, DK-5500 Middelfart, Denmark

The possible relations between resilience engineering and built environments are explored. Resilience engineering has been concerned with the safe and efcient functioning of large and small industrial systems. These may be described as built systems or artefacts. The resilience engineering approach argues that if the performance of systems is to be resilient, then they must be able to respond, monitor, learn and anticipate. The last ability in particular means that ` -vis their environment, i.e. be sentient and reective systems. In they must be able to consider themselves vis-a practice, this means people individually or collectively can adjust what they do to match conditions, identify and overcome aws and function glitches, recognize actual demands and make appropriate adjustments, detect when something goes wrong and intervene before the situation becomes serious. It is particularly important to understand the range of conditions about why and how the system functions in the desired mode as well as unwanted modes. Resilience is the capacity to sustain operations under both expected and unexpected conditions. The unexpected conditions are not only threats but also opportunities. Keywords: anticipate, built environment, cognitive systems engineering, outcomes, proactive, resilience, resilience engineering, system performance

Introduction
Resilience is a term that has been used for a long time and in several different ways. According to McAslan (2010), the term was rst used by Tredgold (1818) to describe a property of timber, and to explain why some types of wood were able to accommodate sudden and severe loads without breaking. Almost four decades later, Mallet, in a report to the Admiralty, referred to a measure called the modulus of resilience as a means of assessing the ability of materials to withstand severe conditions (Mallet, 1856). Many years later, Holling (1973) referred to the resilience of an ecosystem as the measure of its ability to absorb changes and still exist. He further contrasted resilience with stability, dened as the ability of a system to return to its equilibrium state after a temporary disturbance, but also argued that resilience and stability were two important properties of ecological systems. This later led to a distinction between
# 2013 Taylor & Francis

engineering resilience and ecological resilience (Gunderson, Holling, Pritchard, & Peterson, 2002). Engineering resilience considers ecological systems to exist close to a stable steady-state. Resilience is here the ability to return to the steady-state following a perturbation. Ecological resilience emphasizes conditions far from any stable steady-state, where instabilities can ip a system from one regime of behaviour into another. Resilience is here the systems ability to absorb disturbances before it changes the variables and processes that control behaviour. In the early 1970s, the term resilience began to be used as a synonym for stress resistance in psychological studies of children. It soon became a frequently used term in psychology, and many years later Tisseron dened resilience as: The capacity to withstand traumatic situations and the ability to use a trauma as the start of something new (Tisseron, 2007, p. 7).1 At the beginning of the 21st century, it was picked up

Hollnagel

by the business community. Hamel & Va likangas (2003) referred to resilience as the ability dynamically to reinvent business models and strategies as circumstances change, and went on to explain: Strategic resilience is not about responding to a onetime crisis. Its not about rebounding from a setback. Its about continuously anticipating and adjusting to deep, secular trends that can permanently impair the earning power of a core business. Its about having the capacity to change before the case for change becomes desperately obvious. (p. 53) Last but not least, around the turn of the century safety specialists started to use resilience engineering to describe an alternative approach dealing with safety issues, accidents as well as risks (Woods, 2000). Resilience engineering quickly became accepted as a viable approach to safety management, and was dened as: the intrinsic ability of a system to adjust its functioning prior to, during, or following changes and disturbances, so that it can sustain required operations under both expected and unexpected conditions. (Hollnagel, Paries, Woods, & Wreathall, 2011, p. xxxvi) The various ways in which the term has been used clearly demonstrate a practical need in several domains of practice, if not in several sciences, of a way to characterize a certain type of system performance. The practical needs may vary and the different denitions show that there are at least four different meanings of resilience: Resilience as a property of materials. This was the original meaning. Here resilience is used to characterize an inherent quality of a material, hence of a static system. Resilience as a property of ecological systems. This introduces the concept of living or dynamic systems. Ecological systems are reactive in the sense that they may be able to respond and even change their mode of operation (cf. the notion of ecological resilience), but can neither anticipate nor have any intentions. Resilience as a property of psychological systems. Here the system can in principle reect on its experience and use that to shape how it responds, and can also anticipate. Resilience as a property of dynamic and intentional systems. This usage is found both in the

case of business systems (and organizations in general) and in the case of resilience engineering. In both cases the ability to anticipate plays an important role. The situations where resilience is needed are usually ones that develop rapidly, sometimes even abruptly. The focus of this paper is on the fourth meaning of resilience. While business survival and safety management may seem to be different, the similarities are more important than the differences (Sundstro m & Hollnagel, 2011). Risk management, for instance, is a term used in both domains. For business as well as for safety it is also important for the system to survive and to sustain its operations although not necessarily exactly as before (cf. ecological resilience). It is also essential to be prepared to respond, to be able to respond quickly and effectively, and even in some cases to respond pre-emptively. The question is how well this fourth meaning of resilience is suited to the problems of built environments (BEs). In order to determine that, it is necessary to consider whether a built environment is a unique concept, or whether it can have several interpretations.

What is a built environment?

One denition of the BE is that it includes man-made buildings, infrastructures and cultural landscapes that constitute the physical, natural, economic, social and cultural capital of a society.2 In other words, the physical structures and artefacts that enable and facilitate certain kinds of activity. The Built Environment Professions Bill put forward by the Parliament of the Republic of South Africa in 2008 dened the BE as The physical world that has been intentionally created through science and technology for the benet of mankind. Further clarication can be found in Wikipedia, which helpfully notices that the BE is The man-made surroundings that provide the setting for human activity, ranging from the largescale civic surroundings to personal places. There is, however, a problem with these denitions. The problem is not with the term built, which clearly refers to something that is created or manmade, i.e. artefacts usually of considerable size. The problem is with the term environment. The reason is that resilience refers to a property of a system (except, perhaps, in the original interpretation), but a system cannot be considered without including its relation to its environment (or to a general environment) (cf. Mumford, 2006). Indeed, resilience can be described as a central unifying concept in disaster risk management and sustainability science. However, if the built environment constitutes the system (which constitutes resilience as an aspect of

222

Resilience engineering and the built environment

safety, risk management and sustainability), then what is the environment of this system, i.e. the environment of the built environment? Systems have traditionally been dened with reference to their structure in terms of their parts and how they are connected or put together. Thus, Hall & Fagen (1968, p. 81) dened a system as a set of objects together with relationships between the objects and between their attributes, while Beer (1959, p. 9) declared that a system simply is anything that consists of parts connected together. The parts that are connected together must, however, exist within some kind of boundary beyond which lies the systems environment. This follows from the basic denitions of open and closed systems, as systems that allow interactions between their internal elements and the environment and systems that are isolated from their environment, respectively (von Bertalanffy, 1969). The boundary has more precisely been dened as: the area within which the decision-taking process of the system has power to make things happen, or prevent them from happening. More generally, a boundary is a distinction made by an observer which marks the difference between an entity he takes to be a system and its environment. (Checkland, 1999, p. 312) Given this denition, the BE must clearly be considered as a system. Below, the resilience of this system will be considered relative to its environment, the external conditions that affect how the system performs but which it is unable to control. In order to avoid cumbersome linguistic constructions such as the built environments environment, the term built system will be used instead of BE. Any reference to an environment is therefore to the environment of a system, rather than to the environment that is the system in the traditional meaning of BE.3

There are, of course, many systems that match this denition, including the various denitions of BE given above. As with all denitions, it is worthwhile not only to look at the typical exemplars, but also to consider the borderline cases. The main concern of resilience engineering is with industrial systems, which means systems that have the purpose of producing or transforming something. Rather than the usual types of BEs such as buildings, parks, neighbourhoods and cities, this means built systems that are smaller and intended to serve a specic rather than a general purpose. Resilience engineering is also more concerned with the functioning of systems than with their structure. A refugee camp is an example of a built system. It is a system not only in the sense that it consists of parts connected together, but also in the sense that the parts are organized to serve a general purpose. It is deliberately constructed and intended to exist for a limited time only although that intention often is unfullled. There is clearly an environment outside the refugee camp that may be considered a risk to the sustainability or even survival of the people in the camp. A nuclear power plant is also an example of a built system. Although it is a place of work rather than for living, it is of considerable scale and is usually intended to exist for many decades. It is clearly also a built system where the possibility of disasters is very real. Nuclear installations at Three Mile Island, Chernobyl and Fukushima all illustrate that. And it is a built system that must be resilient to both internal and external challenges. A hospital is also a built system, but one where the structure (i.e. the buildings and the service networks) as well as the organization must be very exible. The reason is that patient care and patient treatment change over time, so much that hospitals, unlike nuclear power plants, usually are being rebuilt (physically and organizationally) more or less continually. A large international airport, such as Heathrow (UK), Incheon (Korea), Los Angeles International (US) or Narita (Japan), must also be considered as a built system in every meaning of the term. They are large, structurally heterogeneous, longlived, and built to provide a specic main service, in addition to several subsidiary services. They are also more or less continuously being changed. (This inevitably leads to the question of whether it is possible for an airport to be so small that it no longer is a built system?) Could a large aeroplane, such as an A380, be a built system? This is clearly something that is
223

A multitude of built systems

The sample denitions of BEs have in common that they refer to something that is of large scale, often with long duration, and meant to facilitate or enable human activities or endeavours in one way or another. From the perspective of resilience engineering, this might be interpreted to suggest that a built system is a setting created for human activity. To be even more precise, in this paper a built system is interpreted as something that has been designed and constructed in order to enable a specic function (or set of functions) to be carried out in a specic manner efcient, safe, durable, economical, etc. Resilience is similarly dened to denote the ability of the built system to sustain its functioning under expected and unexpected conditions alike.

Hollnagel

built, and it provides space for up to 853 passengers for a period up to 14 16 hours. It serves a denite purpose and is in addition a place of work for 20 or so people. It is undoubtedly a man-made surrounding that provides the setting for human activity, even though both the passengers and the crew will be different from ight to ight. And there are unquestionably issues of disasters and sustainability.
.

If a large aeroplane is not deemed acceptable as a built system because it is too small and only exists for a limited period of time, although repeatedly, then would a cruise liner (such as the Carnival Triumph) be acceptable? This is certainly a built system; it can take about 4400 people (passengers and crew) for a cruise of 14 days or more; and it certainly serves a purpose, leisure for the passengers and work for the crew. (It is not even the largest cruise ship, but currently only the 24th largest.) And it is, as recent events have shown, a built system where a disaster is waiting to happen either from within the systems boundary or from the environment.

In less elevated language this means that a built system must include or embody some form of sentience intelligence or cognition in order to be resilient. Despite more than 50 years of hopes and promises from articial intelligence, this still requires the presence of humans. The physical parts of a built system may possibly be able to resist the decay of time, but they cannot be resilient. Technology can possibly respond and monitor on its own, at least to some degree, but cannot yet learn and anticipate. Built systems may be able to withstand the onslaught of forces, but cannot overcome them. Until Kurzweils (2005) prophecies become fact, the only sentience of a built system is therefore that provided by people.

What makes a built system resilient?

Resilience engineering denes resilience as: the intrinsic ability of a system to adjust its functioning prior to, during, or following changes and disturbances, so that it can sustain required operations under both expected and unexpected conditions. (Hollnagel et al., 2011, p. xxxvi) In this denition, it is the emphasis on the ability to adjust performance prior to something happening that excludes non-sentient systems. The denition also makes clear that resilience is a characteristic of the systems performance or behaviour, rather than a quality or feature of the system as such. This denition of resilience can be made more operational by noticing that it implies four main abilities, namely: Knowing what to do: how to respond to regular and irregular disruptions and disturbances either by implementing a prepared set of responses or by adjusting normal functioning. This is the ability to address the actual. Knowing what to look for: how to monitor that which is or can become a threat in the near term. The monitoring must cover both events in the environment and the performance of the system itself. This is the ability to address the critical. Knowing what has happened: how to learn from experience, in particular how to learn the right lessons from the right experience successes as well as failures. This is the ability to address the factual. Knowing what to expect: how to anticipate developments, threats, and opportunities further into the future, such as potential changes, disruptions,

Resilience engineering is relevant for all these built systems, in the sense that their performance must be resilient as per the resilience engineering denition given above. Because resilience refers to the performance or functioning of a built system, the concept can be applied regardless of the scale or size of the system. If it is relevant for a hospital, it is also relevant for a clinic, and for a single general practitioner. If it is relevant for a nuclear power plant, it is also relevant for an offshore oil eld comprising multiple installations, for a windmill farm and for a local power generating plant. In general, resilience is a quality of the performance of a built system regardless of its size, nature and longevity.

Built systems as joint systems

While the original meaning of resilience referred to materials and structures, the later uses of the term in ecology, psychology, nance and the safety sciences refer to the functioning or performance of the built system. Resilience is, in other words, something that is associated with the dynamics of a built system, hence with what it does rather than what it is. And so far, built systems have only been able to behave or do something because they are socio-technical systems or joint systems. Socio-technical systems can be dened as systems that involve a complex interaction between humans, technology and workplaces (Emery & Trist, 1960), whereas joint cognitive systems can be dened as two or more systems considered together, where at least one is able locally to modify its behaviour so as to achieve specic antientropic ends (Hollnagel & Woods, 2005).
224

Resilience engineering and the built environment

pressures and their consequences. This is the ability to address the potential. A resilient system is not just an active or responding system, but also a proactive system. It must, of course, be a reactive system but if it only responds to what has happened it cannot be considered as resilient. (It may, however, be seen as robust.) A built system that is reactive only will sooner or later succumb. That even goes for the traditional BEs such as cities or communities and even empires. The importance of the ability to anticipate can be summarized:4 Potential threats appear both as disruptions (over short time horizons) and slow moving, diffuse threats (over longer time horizons). An effective response may need to include a combination of anticipation (precaution) and resilience. However the evolution and interaction of multiple and largely unknown threats makes it extremely difcult to develop proactive interventions with regard to exposure, sensitivity and adaptive capacity. Anticipation and its close cousin, planning is necessary for several reasons as a part of resilience rather than in addition to it. Anticipation is needed to develop new responses over and above learning from the past. Anticipation is needed to develop foci for monitoring. And anticipation is nally needed as a basis for the long-term, proactive strategies that are indispensable for any system to sustain its existence.

not enough. The accident brought to the fore the role of human factors and made it necessary to consider human failure and malfunctioning as potential risks. Seven years later, in 1986, the Challenger space shuttle and Chernobyl accidents led to another extension, this time by introducing the inuences of organizational failures and safety culture. Throughout the ages, the starting point for safety concerns has been the potential or actual occurrence of adverse outcomes. New forms of accidents have been accounted for by introducing new types of causes. This has fostered a causality credo, which is the belief that adverse outcomes happen because something has gone wrong; adverse outcomes therefore have causes, which can be found and treated. The logic underpinning this states that because the causes can be identied and treated, all accidents are preventable. This approach has also led to the bias that civil society only pays attention to something that goes wrong. In relation to built systems it makes sense to focus on situations where things go wrong, both because such situations by denition are unexpected and because they may lead to harm or loss of life and property. But it does not make sense to limit attention to adverse outcomes. That this nevertheless is so is illustrated by the conventional risk matrix, used in many different domains. This matrix describes or represents adverse outcomes in terms of their probability and severity. Yet when possible outcomes of an activity or a function are considered, it is clear that things can go right as well as wrong. Furthermore, it is reasonable to expect that things will go right most of the time, because that is the purpose of designing, constructing and operation built systems. In view of this, it seems reasonable to propose that a description of possible outcomes should include positive (wanted) as well as negative (unwanted) outcomes. If outcomes continue to be described in terms of their probability and value, then the following four characteristic subsets are observed: Positive outcomes that have a high probability. This subset represents the successes or normal actions, i.e. the things that not only go right, but also that are expected to go right. In other words, everyday work or everyday functioning. These are essential for resilience, but rarely if ever considered by safety. Positive outcomes that have a low probability. This subset represents the good things that happen unexpectedly. There is no commonly recognized terminology for these; when they happen they are simply accepted with gratitude. Negative or unwanted outcomes that have a low probability, i.e. things that go wrong and which
225

Safety of built systems

The common, and intuitive, understanding of safety is that it represents a condition where the number of things that go wrong, or can go wrong, is acceptably small. The American National Standards Institute (ANSI) (2012, p. 12), for instance, denes safety as the freedom from unacceptable risk. As a consequence of this denition, safety is measured indirectly, not by the presence of safety or as a quality in itself, but by the consequences of the absence of safety. The number of adverse outcomes (i.e. cases where safety somehow failed or were missing) is always highlighted and emphasized. However, the regular outcomes are often ignored, although these represent the presence of safety. Safety concerns were at the beginning directed at risks related to passive technology and structures such as buildings, bridges, ships, etc. This focus was reinforced by the needs of the second industrial revolution and the rapid mechanization of work that followed. The belief that a focus on technology was sufcient to explain problems and generate solutions was successfully maintained until 1979, when the accident at the Three Mile Island nuclear power plant demonstrated that safeguarding technology was

Hollnagel

are unexpected although not unimaginable. This is the subset of outcomes that traditionally is associated with safety (or rather, the lack of safety), particularly outcomes that cause signicant losses and are hard to predict.
.

Negative or unwanted outcomes that have a high probability. This basically means adverse outcomes that realistically must be expected to happen frequently or even regularly. The purpose of risk assessment and risk management is to identify how such outcomes can arise and prevent them from happening. This is usually done successfully; cf. the ANSI denition of safety as the freedom from unacceptable risks. In practice this subset is therefore very small.

the sense that the number of adverse outcomes is acceptably small. But when something goes wrong, when there is some kind of malfunctioning, this will lead to a failure (an unacceptable outcome). The issue is therefore how the transition from normal to abnormal (or malfunction) takes place, e.g. whether it happens through an abrupt or sudden transition or through a gradual drift into failure. According to the traditional safety logic, safety and efciency can be achieved if this transition can be blocked. The background for the traditional safety view is found in well-understood, well-tested and well-behaved systems. It is therefore tacitly assumed that systems work because they are well designed and scrupulously maintained, because procedures are complete and correct, because designers can foresee and anticipate even minor contingencies, and because people behave as they are expected to and more importantly as they have been taught or trained to do. This unavoidably leads to an emphasis on compliance as a way of ensuring that the system functions as intended by the design. As technical and socio-technical systems have continued to develop, systems and work environments have gradually become more intractable (Hollnagel, 2010). Since the models and methods of the traditional safety view assume that systems are well-understood and well-behaved, they are increasingly unable to bring about the required state of safety. This problem can be alleviated by focusing on what goes right in addition to what goes wrong and by changing the denition of safety from avoiding that something goes wrong to ensuring that everything goes right. More precisely, this is the ability to succeed under varying conditions, so that the number of intended and acceptable outcomes is as high as possible. The consequence of this denition is that the basis for safety and resilience now becomes an understanding why things go right, which means an understanding of everyday activities (Hollnagel, Leonhardt, Licu, & Shorrock, 2013). Resilience engineering explicitly assumes that built systems work because people, individually or collectively, are able to adjust what they do to match the conditions of work. They learn to identify and overcome design aws and functional glitches, they can recognize actual demands and adjust their performance accordingly, they can interpret and apply procedures to match the conditions. They can also detect when something goes wrong, or is about to go wrong, and intervene before the situation becomes serious. The result of that is performance variability, not in the negative sense where variability is seen as a deviation from some norm or standard, but in the positive sense that variability represents the adjustments that are the indispensable basis for safety and productivity. One

The common understanding is that a system is safe if accidents, incidents (and mishaps) (1) can be prevented so that their number or frequency can be reduced or (2) people or the built system itself can be protected against the negative outcomes. The traditional approaches to safety thus disregard the things that go right. This is due to the unspoken assumption that learning about failure is only accomplished by studying only things that go wrong. It is nice when things go right, but it is often assumed that there is no need to pay much attention to these occurrences precisely because they go right. However, the concept of resilience engineering posits that the things that go wrong are the inverse of the things that go right, and therefore assumes that both are a result of the same underlying processes. A consequence is that both can be explained in basically the same way. In resilience engineering it makes as much sense to try to understand why things go right as to understand why they go wrong. In fact, it makes more sense because there are very many more things that go right than things that go wrong. Resilience engineering argues that a systems performance should be understood in general, rather than be limited to cases when something goes wrong, i.e. to understand all the outcomes rather than only the negative ones.

Traditional safety and resilience engineering

The traditional safety view can be contrasted with resilience engineering. According to the traditional safety view, safety is dened as a condition where the number of adverse outcomes (accidents/incidents/near misses) is as low as possible. The purpose of system design and safety management is consequently to achieve and maintain that state. A traditional safety view promotes a binary view of functioning, according to which something either succeeds or fails. When everything works as it should (normal functioning), the outcomes will be acceptable: things go right, in
226

Resilience engineering and the built environment

consequence is that it is impossible to ensure safe and efcient performance by insisting on compliance with design assumptions or work-as-imagined, since the actual conditions never completely match the intended conditions. This is demonstrated by the simple fact that working-to-rule is a recognized way of creating disruptions.

Conclusions
Built systems are artefacts or socio-technical habitats designed to enable and facilitate a particular kind of activity (regardless of whether it is a hospital, an airport or a nuclear power plant). The ability of a built system to be resilient, to survive, requires that it is able to respond, to monitor, to learn and to anticipate. Considering each of the four abilities from a more operational perspective will quickly point to a number of issues that can become the starting point for more concrete measures for how to think about resilience engineering in a practical manner. Starting from the level of a built system as a whole, resilience engineering can be used to propose specic steps for improvement, depending, of course, on the characteristics of the specic domain or eld of activity. For any given domain or organization it will be necessary to determine the relative weight or importance of the four main abilities, i.e. how much of each is needed. The right proportion cannot be determined analytically, but must be based on expert knowledge of the system under consideration and with due consideration of the characteristics of the core business. Yet the minimum requirement is that none of the four can be left out if a system wants to call itself resilient. The practical use of resilience engineering also requires an understanding of how the four abilities are coupled and therefore depend upon each other. This underlines the importance of thinking of the built system as a whole, and to provide effective concepts and methods for managing overall performance. Without going into details, the dependencies can be illustrated as shown in Figure 1, where the arrows connecting the four abilities suggest how each depends on one or more of the others (Hollnagel, 2011). All four abilities must be able to address both what happens in the system itself and what happens in the environment what happens outside the systems boundary. A built system can or should be able to control itself, but by denition it is not able to control the environment. As there are few cases where environments can be assumed to be benign and stable, the ability to anticipate what may happen in the environment, now and in the future, is essential for the systems survival. This highlights the importance of understanding how the systems function,
Figure 1 Dependencies among resilience abilities

rather than how they are structured or what they are made of, and to focus on their ability to use opportunities as well as withstand threats. For resilience engineering, the understanding of the everyday acceptable functioning of a built system is the necessary and sufcient basis for understanding how something can go wrong. It is argued that it is both easier and more effective to manage risks and sustain existence by improving the number of things that go right, than by reducing the number of things that go wrong. For built systems, which in this paper means sociotechnical systems that have been built in order to provide a certain service or functionality, resilience is therefore not just an issue of disaster risk management and sustainability. Resilience is an issue of being able to sustain required operations under both expected and unexpected conditions. But the unexpected conditions are not only threats, but also opportunities. A built system that is unable to recognize and utilize opportunities will in the long run be no better off than a system that cannot respond to threats and disruptions.

References
American National Standards Institute. (2012). Prevention through design: Guidelines for addressing occupational hazards and risks in design and redesign processes. Des Plaines, IL: American Society of Safety Engineers. Beer, S. (1959). Cybernetics and management. New York: Science Editions. von Bertalanffy, L. (1969). General system theory. New York: G. Braziller. Checkland, P. (1999). Systems thinking, systems practice. New York: Wiley. Emery, F. E., & Trist, E. L. (1960). Socio-technical systems. In C. W. Churchman & M. Verhulst (Eds.), Management science models and techniques (Vol. 2, pp. 83 97). Oxford, UK: Pergamon. Gunderson, L., Holling, C. S., Pritchard, L., & Peterson, G. D. (2002). Resilience. In H. A. Mooney & J. G. Canadell (Eds.), Encyclopedia of global environmental change; Volume 2, The earth system: Biological and ecological 227

Hollnagel

dimensions of global environmental change (pp. 530 531). Paris: UNESCO/SCOPE. Hall, A. D., & Fagen, R. E. (1968). Denition of system. In W. Buckley (Ed.), Modern systems research for the behavioural scientist. Chicago: Aldine Publishing Company. Hamel, G., & Va likangas, L. (2003). The quest for resilience. Harvard Business Review, 81(9), 52 65. Holling, C. S. (1973). Resilience and stability of ecological systems. Annual Review of Ecology and Systematics, 4, 123. Hollnagel, E. (Ed.) (2010). Safer complex industrial environments. Boca Raton, FL: CRC Press. Hollnagel, E. (2011). Epilogue: RAG The resilience analysis grid. In E. Hollnagel, J. Paries, D. D. Woods, & J. Wreathall (Eds.), Resilience engineering in practice: A guidebook. Farnham, UK: Ashgate. Hollnagel, E., Leonhardt, J., Licu, T., & Shorrock, S. (2013). From safety-I to safety-II: A white paper. Brussels: Eurocontrol. (http://www.skybrary.aero/bookshelf/books/2437.pdf) Hollnagel, E., Paries, J., Woods, D. D., & Wreathall, J. (Eds.) (2011). Resilience engineering in practice: A guidebook. Farnham, UK: Ashgate. Hollnagel, E., & Woods, D. D. (2005). Joint cognitive systems: Foundations of cognitive systems engineering. Boca Raton, FL: CRC Press. Kurzweil, R. (2005). The singularity is near. New York: Viking Press. Mallet, M. (1856). On the physical conditions involved in the construction of artillery: An investigation of the relative and absolute values of the materials principally employed and of some hitherto unexplained causes of the destruction of the canon in service. London: Longman, Brown, Green, Longmans and Roberts. McAslan, A. (2010). The concept of resilience. Understanding its origins, meaning and utility. Adelaide, Australia: The Torrens Resilience Institute.

Mumford, E. (2006). The story of socio-technical design: Reections on its successes, failures and potential. Journal of Information Systems, 16, 317 342. Sundstro m, G., & Hollnagel, E. (Eds.) (2011). Governance and control of nancial systems: A resilience engineering approach. Farnham, UK: Ashgate. Tisseron, S. (2007). La Re silience. Paris: PUF. Tredgold, T. (1818). On the transverse strength of timber. Philosophical Magazine: A Journal of Theoretical, Experimental and Applied Science, Chapter XXXXVII. London: Taylor and Francis. Woods, D. D. (2000). Designing for resilience in the face of change and surprise: Creating safety under pressure. Plenary Talk, Design for Safety Workshop, NASA Ames Research Center, October 10.

Endnotes
1

La capacite de re sister a ` des situations traumatiques et la possibilite de transformer un traumatisme pour en faire un noveau de part. A workshop held at ETH Zurich in January 2013 on Built Environment Resilience provided this denition in its invitation to workshop participants. This may clash with the established terminology, so apologies are offered to readers for any agony this may cause. A workshop invitation held at ETH Zurich in January 2013 on Built Environment Resilience provided this statement.

228