Version classiqueVersion mobile

Proceedings of the fourth Resilience Engineering Symposium

Erik Hollnagel
Éric Rigaud
Denis Besnard

Unwritten Rules For Safety And Performance In An Oncology Day Care Unit: Testing The Resilience Markers Framework

Dominic Furniss, Jonathan Back et Ann Blandford


This paper has two complementary objectives: 1) exploring resilience behaviours in an Oncology Day Care Unit; and 2) testing the Resilience Markers Framework as a tool for facilitating resilience analysis. Data gathering in the Day Care Unit took place over five days, which included observing 31 infusion pump interactions. With specific use of the framework we identify and describe six resilience episodes that impacted on the potential for error in the system. The framework’s focus and elements allowed us to explore the details of these resilience episodes. This analysis demonstrates the framework’s utility in facilitating an empirical resilience analysis. We consider how we should utilise these results to foster resilience in the system, and we point to areas where the framework can be developed for future use.

Texte intégral

1 Introduction

1“To Err is human…” (Kohn, Corrigan & Donaldson, 2000) is a widely cited report that makes clear the need to study avoidable error in healthcare. The report asserts that at least 44,000 Americans die each year from medical errors, which is more than deaths separately attributable to motor-vehicle accidents, breast cancer, and AIDS. Errors involving devices are a subset of this picture, with infusion devices being one of the most frequently cited device in adverse incidents: “Between Jan. 1, 2005, and Dec. 31, 2009, more than 56,000 adverse events and 710 deaths associated with infusion devices were reported to the FDA – more than for any other medical technology.” (AAMI/FDA, 2010). To understand these adverse incidents we also need to understand near misses and normal work. We report a workplace study looking at the normal work of an Oncology Day Care Unit which uses infusion pumps frequently.

2Different approaches are available for conducting workplace or contextual studies, e.g. Distributed Cognition, Computer Supported Cooperative Work, Human Factors, and Situated Action. These complementary approaches focus on some aspect of performance but have different emphases. For example, Distributed Cognition is couched in cognitive science concepts and emphasises the propagation and transformation of information at a system level (e.g. Hutchins, 1995). For our study we chose a Resilience Engineering approach because we wanted to explore the positive strategies people employ to reduce error. More specifically, we wanted to understand the ways in which the system has evolved to ‘go right’, and the strategies that people adopt to balance risk and efficiency. Resilience Engineering affords this type of investigation and has its own cloud of concepts to facilitate this study e.g. performance deviations, functional resonance, local rationality, adaptations, sharp-end and blunt-end considerations (e.g. Hollnagel, 2004).

2 Background

3Previously, we have reported low-level disturbances that we observed in the normal work of the Day Care Unit (Furniss, Blandford & Mayer, 2011). We found that low-level disturbances that deviate from the theoretical ‘golden path’ do not happen infrequently, but the system still works efficiently, effectively and safely. All low-level errors that were observed were recovered from. These observations raise questions that include whether one should try to eliminate these low-level disturbances, whether it is even possible to eliminate all error, or should we try and facilitate error detection and recovery rather than eliminate it per se?

4In this paper we explore the resilience behaviours that are inherent in the normal work of Oncology Day Care Unit. These behaviours are likely to be employed to keep the system behaving resiliently despite errors and poor circumstances. Here we focus on behaviours that are ‘outside design-basis’ (Furniss, Back, Blandford, Hildebrandt & Borberg, 2011). This is preferred to ‘beyond safety’ and ‘beyond design-basis’ because it allows a more complementary relationship with safety and its broader conception of resilience better accommodates looking at resilience as part of normal work rather than emphasising analyses of unexampled events beyond what designers and safety specialists have thought of (Westrum, 2006). We still believe that these extreme events are of key interest to resilience but not at the exclusion of everyday disturbances and the slow erosion of resilience. We introduce the Resilience Markers Framework which has been proposed to facilitate the study of resilience strategies in practice.

3 Resilience markers framework

5The Resilience Markers Framework was developed by Furniss, Back, et al. (2011) to facilitate empirical studies of resilience in different team working contexts. The framework has three hierarchical levels linking a higher level of resilience markers, to an intermediary level of resilience strategies, to a lower level of observations (see Figure 1).

6Importantly, the framework tries to make resilience traceable from the high level resilience principles to the low level observations (i.e. vertical traceability) and across contexts (i.e. horizontal traceability). For example, Furniss, Back, et al. (2011) recognise using a paper clip as a bookmark in nuclear power plant operating procedures as a low level resilience behaviour. They relate this to strategies that had previously been identified in the literature: ‘create a new indicator’ (Mumaw, Roth, Vicente & Burns, 2000) and ‘cue creation in action’ (Back, Furniss & Blandford, 2007). Furthermore, they relate this to a more abstract marker ‘strategies that maximise information extraction’ (Mumaw, et al. 2000). This hierarchy provides an example of vertical traceability. Horizontal traceability is demonstrated when the same abstract markers and strategies can be recognised in other contexts. For example, ‘creating a new indicator’ has been noted in alarm system management through changing the parameters that trigger the alarms in nuclear power (Mumaw et al. 2000) and can also be recognised in Intensive Care Units (Randell, 2004). In both of these contexts operators will manage alarm parameters to give themselves timely information required for system control whilst minimising the activity of unnecessary alarms. Through horizontal traceability we can see how similar resilience strategies are realised in different contexts. This is already desired by practitioners interested in transferring lessons from one domain to another, e.g. from the aviation to the healthcare domain.

7To add context in which the resilience behaviour was situated the intermediary strategy level has four main categories (see Figure 1): (i) a resilience repertoire of behaviours that can be employed in response to an opportunity or threat e.g. an A&E department may cancel planned surgery and recall staff from other wards to deal with many critically ill admissions; (ii) a mode of operation that details the type of situation that the system is in e.g. A&E may have different states of emergency depending on the quantity and type of critically ill admissions; (iii) resources and enabling conditions which are the things needed to allow the resilience strategy to be performed e.g. A&E may have spill-over areas to accommodate patients and emergency communication channels with staff and other services for organisation purposes; and (iv) a threat or opportunity that the system should try to adapt to for performance advantage e.g. a terrorist attack or a flu epidemic may lead to far more critically ill patients than an A&E department usually deals with.

Figure 1. Resilience Markers Framework. The three-levelled hierarchy can be seen from 1 markers level, 2 strategy level, and 3 observation level. Level 2, strategy level, is expanded into four elements which are explained in the text.

8This paper represents a first attempt to test the Resilience Markers Framework outside of the domain in which it was developed. Here we are moving from the nuclear power to the healthcare domain, and more specifically from control room operation to an Oncology Day Care Unit. Consequentially, there are specific questions that we ask of the approach whilst we explore the resilience in this context: 1) Does the framework facilitate the recognition of resilience in practice? 2) Are all the elements in the framework used, or are elements missing? 3) Are there difficulties in using the framework? 4) What additional steps are needed to improve the framework?

4 Method

9Our observations lasted five days; 31 infusion pump interactions were observed alongside more general observations of the Day Care Unit. To analyse our data we follow the three stages in the method: familiarisation, identification and categorisation (Furniss, Back, et al., 2011). The familiarisation stage took place whilst doing the fieldwork: making observations and talking to staff. A prior analysis was also performed following a Distributed Cognition approach (Furniss, Blandford, et al., 2011) which alluded to resilience properties of the system. The more dedicated resilience analysis that follows provides quite a different perspective of the data through the Resilience Markers Framework, which has been populated in the identification and categorisation phases.

5 Results

10Following the Resilience Markers Framework paper we present our results as episodes of resilience, with framework categories in bold type, and with reference to markers and strategies in the literature. The six examples we report here reflect a variety of resilience strategies including reducing errors in administering treatment, managing workload, and guarding against internal and external disturbances:

Resilience Episode 1: The trolley as a unit of work

11The principal work of the Day Care Unit is to administer the right treatment to the right patient. One threat is that the details of the treatment may be mishandled and incorrect treatment may be given to a patient in this busy environment. We observed unwritten rules come to the fore when a new member of agency staff failed to tidy their trolley after administering treatment. An experienced member of staff said they should keep their trolleys tidy, which was important for the treatment routine: the trolley should be fully prepared before a patient’s treatment, the treatment should be administered, and then the trolley should be tidy to return it to its resting state. We recognise this behaviour as treating the trolley as a unit of work. The resilience strategy of ‘preparation’ reduces the likelihood of error, and the tidying allows for better ‘monitoring’ of activities and errors, e.g. everything and only those things needed for treatment should be on a properly prepared trolley and nothing should be unused after.

Resilience Episode 2: Monitoring community practice

12Episode 1 above recognises the trolley as a unit of work but within telling that story another resilience strategy is witnessed: the ‘monitoring of community practice to protect accepted behaviour’. In a different episode there was a further threat when a healthcare worker who was stocking the trolleys noticed that when they were replacing some connectors it was not exactly like with like, i.e. they were different brands. She asked a nurse to check it was OK, the agency nurse confirmed they were the same, but later a more experienced nurse noticed and explained that one brand had the potential to leak so should only be used as a last resort. This relates to a broader marker of ‘monitoring’, which can be eroded if more experienced staff are not present.

Resilience Episode 3: Reducing error when using two infusion pumps in parallel

13When in the mode of using two different pumps at the same time there is the threat of confusing treatments and numbers e.g. infusion rates, time and volumes. We observed nurses setting up one pump, then set up the other pump, but pressing START at the same time; and grouping the fluids for each pump on separate arms of the stand. We relate these to the resilience strategy of ‘separating information streams’. We relate this behaviour to the broader marker ‘preparation’.

Resilience Episode 4: Workload management

14Heavy demand and resource pressure meant that the normal mode of operation was on the verge of going overcapacity, both for individual nurse workload and the workload of the Unit. The further threat of staff going off sick could make these conditions worse; and overwork could lead to less rigour as efficiency is traded with thoroughness. We observed nurses take on more patients than they were meant to, the nurse manager helped take on treatment workload, new patients were turned away, and agency staff were hired to help out. We relate these to the resilience strategies of ‘employing additional operators’ (Mumaw et al., 2000) and ‘team coordination’ (Malakis & Kontogiannis, 2008). We relate this behaviour to the broader marker ‘managing workload’ (Malakis & Kontogiannis, 2008).

Resilience Episode 5: Swapping pumps when battery power is low

15Patients on long chemotherapy regimes that lasted from morning until evening seemed to represent a specific mode of operation or circumstances for the nurses. The vulnerability or threat here was that the infusion pump’s battery would not last for the last program. If this happened an alert would sound so the nurse could plug in the pump to an electric socket which would limit the movement of the patient, or change the pump part way through an infusion which was described as frustrating because of the partial calculations that would need to be entered into the new pump. The strategy was to be aware of this threat and try to remember to check the battery level at the point of programming. The marker would be ‘awareness of performance vulnerabilities’.

Resilience Episode 6: Preparing for a power outage

16Part way through the day I observed a senior nurse come into the Day Care Unit with news that there would be the possible threat of a power outage sometime that afternoon. Only red emergency electric sockets would be able to supply power. There was a quick assessment of the potential consequences of this threat and a plan of action was made, which included phoning pharmacy to check that the chemotherapy in the fridges would not be adversely affected by the power outage and to inform the administrators in case their systems would be affected. The nurses thought the infusion pumps should last the length of the outage because they are all fully charged overnight. There was no power outage but the staff had prepared for this threat had it occurred. The resilience strategy was ‘planning for a novel threat’ and the marker would be ‘preparation’.

6 Discussion

17The analysis has revealed a variety of resilience strategies that are employed in the Day Care Unit to keep it working efficiently, effectively and safely despite vulnerabilities and threats. Managing these vulnerabilities and threats is in effect managing performance deviations to keep in control of the system (Hollangel, 2004). These have included resilience against errors when administering treatment to patients e.g. when programming two pumps in parallel and preparing the trolley; resilience in managing workload pressures with finite resources e.g. in refusing new patients; resilience in managing internal performance deviations e.g. from agency staff unaware of ‘normal’ practice; and resilience in planning for potential external threats e.g. potential power outage. These resilience episodes each give an insight into part of the system that could pose a threat if it were managed differently. Part of future work includes comparing resilience strategies here with those in observed in other contexts.

18Returning to the four questions that were asked of the Resilience Markers Framework approach earlier in the paper we find that the framework has been useful in facilitating the identification of resilience behaviours in practice. Furthermore, it has allowed exploration and description of these behaviours through the framework’s elements so the resilience behaviour can be situated and understood within its context.

19When we first started to populate the framework in this case study we were trying to account for all of the elements within it. However, some were more easily identified than others. Pairs of vulnerabilities and strategies were most easily identifiable, and it seemed that the mode of operation and the enabling conditions would be included in the story if they played a significant role. This highlights the potential for a leaner framework that focuses on ‘threat – strategy pairs’ or ‘opportunity – strategy pairs’. However, we still believe that the mode of operation and enabling conditions could play a major role in enhancing and protecting strategies. For example, in Resilience Episode 3 we observed nurses grouping fluids on separate arms of the stand so they were physically separated for treatments requiring two pumps. If new stands were purchased with only one arm this strategy would be obsolete, so it is important to appreciate the impact of resources and enabling conditions as they could have a significant impact on behaviour.

20The mode of operation has become clearer through its use in this case study. It is best conceptualised as a difference in circumstance that affords different behaviours. For example, a short versus long treatment cycle or a routine versus non-routine treatment suggest requirements to consider the situation differently. It makes less sense to talk about a mode of operation when there are not alternative ways of doing things.

21The main difficulty with using the framework was that there is not yet a developed taxonomy of markers, strategies, and associated observations to refer to. These should be grounded in the literature and appropriately organised so they fit together well.

22Furniss, Back et al. (2011) have started this taxonomy which has been useful for this study, but it needs to be far more extensive. For example, Resilience Episode 4 refers to these resilience strategies: ‘employing additional operators’ (Mumaw et al., 2000) and ‘team coordination’ (Malakis & Kontogiannis, 2008); and relates these to the broader marker ‘managing workload’ (Malakis & Kontogiannis, 2008). This seems much more grounded than Resilience Episode 3 which refers to the strategy of ‘separating information streams’; and relates this to the broader marker ‘preparation’. A more developed taxonomy built up through a succession of case studies, an extensive literature review or a workshop would benefit the framework’s use.

7 Acknowledgements

23We would like to thank Dr. Astrid Mayer, the participants, and the referees for their contributions to this study. This work is funded by EPSRC grant EP/G059063/1.


8 References

AAMI/FDA. (2010). Infusing Patients Safely: Priority Issues from the AAMI/FDA Infusion Device Summit. AAMI.

Back, J., Furniss, D., & Blandford, A. (2007). Cognitive Resilience: Reflection-in-action and on-action. In R. Woltjer, B. Johansson, J. Lundberg. (Eds). Proceedings of Resilience Engineering Workshop, Vadstena, Sweden; 23(1): 1-6.

Furniss, D., Back, J., Blandford, A., Hildebrandt, M. & Borberg, H. (2011). A Resilience Markers Framework for Small Teams. Reliability Engineering and System Safety. 96 (1).

Furniss, D., Blandford, A. & Mayer, A. (2011). Unremarkable Errors: Low-level disturbances in infusion pump use. Proc. British HCI 2011. Newcastle, UK. 4-8 July.

Hollnagel, E. (2004). Barriers and Accident Prevention. Ashgate.

Hutchins, E. (1995). Cognition in the Wild. MIT.

Kohn, L., Corrigan, J. & Donaldson, M. (2000). To Err is Human. National Acad. Press.

Malakis, S. & Kontogiannis, T. (2008). Cognitive Strategies in Emergency and Abnormal Training: Implications for Resilience in Air Traffic Control. In Proc. of the Third Symposium on Resilience Engineering, Juan-les-Pins, France, Oct 28-30.

Mumaw R., Roth, E., Vicente, K., & Burns, C. (2000). There is more to monitoring a Nuclear Power Plant than meets the eye. In Human Factors; 42 (1): 36-55.

Randell, R. (2004). Accountability in an alarming environment. Proc. CSWC 2004. Chicago, US. 6-10 November 2004.

Westrum, R. (2006). A typology of Resilience Situations. In E. Hollnagel, D. Woods, N. Leveson, (Eds.). Resilience Engineering Concepts and Precepts. Ashgate; 55-65.

Table des illustrations

Légende Figure 1. Resilience Markers Framework. The three-levelled hierarchy can be seen from 1 markers level, 2 strategy level, and 3 observation level. Level 2, strategy level, is expanded into four elements which are explained in the text.
Fichier image/jpeg, 160k


University College London, MPEB 8th Floor, Gower St, London, UK. WC1E 6BT

University College London, MPEB 8th Floor, Gower St, London, UK. WC1E 6BT

University College London, MPEB 8th Floor, Gower St, London, UK. WC1E 6BT

© Presses des Mines, 2011

Licence OpenEdition Books

Rechercher dans OpenEdition Search

Vous allez être redirigé vers OpenEdition Search