David D Woods

The Ohio State University | OSU · Department of Integrated Systems Engineering

Dr. Richard Cook was a physician, educator, scholar, and researcher. He was a brilliant thinker and writer. Richard's CV lists 41 peer reviewed publications, 39 conference proceedings, 6 technical reports, 30 books/book chapters that were cited about 10,000 times (as of September 2022). Richard has excelled in multiple careers and was remarkably gi...

Findings about high-reliability organizations (HRO) capture the efforts that people make, at all levels of an organization, to learn and adapt to ensure safe operations despite variability, increasing complexity, and changing risks. The HRO empirical research base shows how safety originates in the interactions between the operational and leadershi...

Following other contributions about the MAX accidents to this journal, this paper explores the role of betrayal and moral injury in safety engineering related to the U.S. federal regulator’s role in approving the Boeing 737MAX—a plane involved in two crashes that together killed 346 people. It discusses the tension between humility and hubris when...

One of the impacts of the pandemic has been a rapid increase in the development and offering of online courses focused on cognitive systems engineering. This presents opportunities to: • Identify and share alternative instructional design strategies and more specific instructional tactics tailored to the online environment and learn from each other...

One panelist's slides (Woods). One of the impacts of the pandemic has been a rapid increase in the development and offering of online courses focused on cognitive systems engineering. This presents opportunities to:  Identify and share alternative instructional design strategies and more specific instructional tactics tailored to the online envir...

Understanding and learning from hospitals’ resilient behavior or adequate responses to beyond-surge capacity incidents to be better prepare staff for offering patients the appropriate, timely care is imperative. The study adopted the previous findings from the Formosa-Fun-Coast-Dust-Explosion studies as the base of data analysis. We synthesized the...

The current strategy for achieving resilient infrastructures is making progress too slowly to keep up with the pace of change as evidenced by a continuing stream of “shock” events. How do we better anticipate changing threats and recognize emerging new vulnerabilities in an increasingly interconnected world? We are facing a Strategic Agility Gap th...

Background Large-scale burn disasters can produce casualties that threaten medical care systems. This study proposes a new approach for developing hospital readiness and preparedness plan for these challenging beyond-surge-capacity events. Methods The Formosa Fun Coast Dust Explosion (FFCDE) was studied. Data collection consisted of in-depth inter...

Zombie ideas plague much of the discussions on deploying AI and other autonomous machine capabilities into fields of human activity. People consistently mis-envision the impact of deploying these teclmologies by a wide mark. Because these oversimnplified & erroneos ideas about AI/autonomy reappear & persist even after repeated empirical & technical...

One of the impacts of the pandemic has been a rapid increase in the development and offering of online courses focused on cognitive systems engineering. This presents opportunities to: ● Identify and share alternative instructional design strategies and more specific instructional tactics tailored to the online environment and learn from each other...

We identify useful functions and usability characteristics of a historical cognitive artifact used by nurses working in a hospital unit, the Kardex. By identifying aspects of a widely used artifact, we uncover opportunities to improve the usefulness of current systems for hospital nurses. We conducted semi-structured interviews with registered nurs...

Covid-19 outbreaks present novel, uncertain, and changing situation to policy makers and the public. The uncertainty means that different strategic responses to the pandemic are bets about the future. There are three bets circulating in the US: 1. The act early, act aggressively bet; 2. The density bet; 3. The natural course bet, which has 2 versio...

It's time to appreciate the human side of Internet-facing software systems.

Examines what is needed to be able to move forward as the initial Covid-19 outbreaks begin to subside. Based on our work in Disaster Resilience, Sustainability and Resilience Engineering we highlight four action capabilities that need to be working at scale to facilitate relaxing current activity restrictions. Building these capabilities require re...

How health care systems adapt to generate and mobilize the response capability for Covid-19 patient surges.The patterns connect to findings in Resilience Engineering. See https://www.resilience-engineering-association.org for associated talk and discussions.

Ten points to cut through the noise, uncertainty and variety of communications as we are stakeholders and participants in reducing excessive deaths as we struggle through the Covid-19 pandemic.

We address the problem of flight control in the presence of actuator anomalies. A supervisory control architecture that includes the actions of both a human pilot and an autopilot is proposed to ensure resilient tracking performance in the presence of anomalies. The pilot is tasked with supervisory, higher level decision-making tasks, such as anoma...

Understanding, supporting, and sustaining the capabilities above the line of representation require all stakeholders to be able to continuously update and revise their models of how the system is messy and yet usually manages to work. This kind of openness to continually reexamine how the system really works requires expanding the efforts to learn...

a set of 5 short articles on human performance and business critical software infrastructure including: 1. It’s time to revise our appreciation of the human side of Internet-facing software systems. 2. Above the Line, Below the Line. 3. Cognitive Work of Hypothesis Exploration during Anomaly Response. 4. Managing the Hidden Costs of Coordination. 5...

The safety management literature describes two distinct modes through which safety is achieved. These can be described as safety management through centralized control, or safety management through guided adaptability. Safety management through centralized control, labelled by Hollnagel as ‘Safety-I’, aims to align and control the organization and...

Objective The study provides a comprehensive insight into how an initial receiving hospital without adequate capacity adapted to coping with a mass casualty incident after the Formosa Fun Coast Dust Explosion (FFCDE). Methods Data collection was via in-depth interviews with 11 key participants. This was combined with information from medical recor...

En 10 ans, l’émulation scientifique autour de « l’ingénierie de la résilience » a suscité de nombreux débats et mobilisé une diversité de concepts : décisions de sacrifices, compromis, marge de manœuvre, adaptabilité / variabilité, culture de sécurité… Ces différentes notions ont toutes en commun leur lien fort avec les concepts développés depuis l...

We identify the value and usage of a cognitive artifact used by hospital nurses. By analyzing the value and usage of workaround artifacts, unmet needs using intended systems can be uncovered. A descriptive study employed direct observations of registered nurses at two hospitals using a paper workaround (“brains”) and the Electronic Health Record. F...

Distribution électronique Cairn.info pour Presses Universitaires de France. © Presses Universitaires de France. Tous droits réservés pour tous pays. La reproduction ou représentation de cet article, notamment par photocopie, n'est autorisée que dans les limites des conditions générales d'utilisation du site ou, le cas échéant, des conditions généra...

The paper introduces the theory of graceful extensibility which expresses fundamental characteristics of the adaptive universe that constrain the search for sustained adaptability. The theory explains the contrast between successful and unsuccessful cases of sustained adaptability for systems that serve human purposes. Sustained adaptability refers...

Purpose: To provide an insight into the challenges faced by the closest hospital to the Formosa Fun Coast Dust Explosion (FFCDE) disaster scene, and to examine how the hospital staff adapted to cope with the mass burn casualty (MBC) in their overcrowded emergency department (ED) after the disaster. Material and methods: The critical incident tec...

SNAFU is natural state of systems & SNAFU Catching is essential for viability of systems in complex worlds. But organizations rationalize this core finding away. Available on irgc.epfl.ch and irgc.org.

The Formosa Fun Coast Dust Explosion (FFCDE) occurred on 27 June 2015. It is the largest man-made disaster in Taiwan's history. The paper explores how participating actors dealt with the communication challenges to rescue 499 burn victims from the disaster scene and provide resuscitation and life support for mass burn casualties in hospitals follow...

In 2016, we examined the connection between naturalistic decision making and the trend toward best practice compliance; we used evidence-based medicine (EBM) in health care as an exemplar. Paul Falzer’s lead paper in this issue describes the historical underpinnings of how and why EBM came into vogue in health care. Falzer also highlights the epist...

How can organizations cope with accelerating change in more complex worlds? The growth of capabilities produces expanded scales of operation, extensive interdependencies, new vulnerabilities, and puzzling failures. The result is the Strategic Agility Gap where organizations are slow and stale in recognizing changing risks and fall behind the pace o...

Regulatory agencies have long adopted a three‐tier framework for risk assessment. We build on this structure to propose a tiered approach for resilience assessment that can be integrated into the existing regulatory processes. Comprehensive approaches to assessing resilience at appropriate and operational scales, reconciling analytical complexity a...

Regulatory agencies have long adopted a three-tier framework for risk assessment. We build on this structure to propose a tiered approach for resilience assessment that can be integrated into the existing regulatory processes. Comprehensive approaches to assessing resilience at appropriate and operational scales, reconciling analytical complexity a...

The continued development of Cognitive Systems Engineering (CSE) as both an academic discipline and as a field of practice requires constant and continuous reconsideration of the types of techniques used in research. Currently, all CSE research is conducted in one of three research settings: experimental/spartan laboratory studies, simulation/stage...

In this paper, we consider a flight control problem subjected to actuator anomalies. We propose a shared control architecture that includes actions of both a human pilot and an adaptive autopilot that achieves bumpless performance while retaining a Capacity for Maneuver (CfM) following the anomaly. The shared controller distributes the critical tas...

The National Academy of Sciences (NAS) definition of resilience is used here to organize common concepts and synthesize a set of key features of resilience that can be used across diverse application domains. The features in common include critical functions (services), thresholds, cross-scale (both space and time) interactions, and memory and adap...

Vehicles and platforms with multiple sensors connect people in multiple roles with different responsibilities to scenes of interest. For many of these human–sensor systems there are a variety of algorithms that transform, select, and filter the sensor data prior to human intervention. Emergency response, precision agriculture, and intelligence, sur...

In 2013 NASA nearly drowned an astronaut during an Extravehicular Activity (EVA 23) on the International Space Station due to spacesuit water leakage. Indicators of trouble on the preceding EVA (22) were discounted. NASA carried out an investigation of the near miss event that is a sample of how root cause analysis is carried out in actual organiza...

Sensors are being attached to almost every device and vehicle and integrated together to form sensor systems that extend human reach into distant environments. This means human stakeholders have the potential to see into previously inaccessible environments and to take new vantage points and perspectives. However, current designs of these human-sen...

There is a growing popularity of data-driven best practices in a variety of fields. Although we applaud the impulse to replace anecdotes with evidence, it is important to appreciate some of the cognitive constraints on promulgating best practices to be used by practitioners. We use the evidence-based medicine (EBM) framework that has become popular...

abstract for new paper coming out soon

Despite the desire to utilize proactive safety metrics, research results indicate imbalances can arise between economic performance metrics and safety metrics. Imbalances can arise, first, because there are fewer proactive metrics available relative to the data an organization can compile to build reactive metrics. Second, there are a number of fac...

Exploring Distant Scenes Human perception functions so well that we do not even notice how quickly, accurately, and efficiently we directly apprehend the three-dimensional (3D) structure of the world around us. These perceptual skills allow us to notice quickly what is informative and how to navigate in that world across the huge array of human pur...

From the earliest days of experimental psychology in the United States, there were a few who appreciated the fact that human thinking and behavior involve a closed-loop coupling between perception and action that cannot be fully understood using models based on simple causal (i.e., S-R) interactions. For example, Dewey wrote: The discussion up to t...

This article plays counterpoint to our previous discussions of the “seven deadly myths” of autonomous systems. The seven deadly myths are common design misconceptions to be acknowledged and avoided for the ills they breed. Here, we present seven design principles to be understood and embraced for the virtues they engender. The cardinal virtues of c...

A resilient system is able to adjust its functioning prior to, during, or following changes and disturbances, so that it can continue to perform as required after a disruption or a major mishap, and in the presence of continuous stresses. This paper examines decision making in a large transportation firm as it anticipated and dealt with major disru...

Out-of-hospital care is becoming more complex, thus placing greater reliance on the cognitive abilities of paramedics to manage difficult situations. In adapting to the challenges in their work, paramedics develop expertise. We study the cognitive strategies used by expert paramedics to contribute to understanding how paramedics and the EMS system...

This paper presents the latest results on the Stress-­‐Strain model of resilience and shows how the model provides a means to operaJonalize the four cornerstones of Resilience Engineering as proposed by Hollnagel and uJlized in the Resilience Analysis Grid. The Stress-­‐Strain model of resilience, originally proposed by Woods and Wreathall in 2006,...

In today's rapidly changing, highly interconnected global business environment, small disturbances can quickly produce a cascade of further disruptions that challenge an organization's plans and ability to respond. This paper reports results on the strategies used by one organization to recognize where cascades may develop, to build a readiness to...

As designers conceive and implement what are commonly (but mistakenly) called autonomous systems, they adhere to certain myths of autonomy that are not only damaging in their own right, but also by their continued propagation. This article busts such myths and gives reasons why each of these myths should be called out and cast aside.

Submarine commanders must make decisions rapidly to carry out increasingly complex missions. However, the rate of information delivery has outpaced the capacity of the command and control systems that prioritize and filter it. Technology could help commanders filter through data to make decisions, but this decision support must be carefully enginee...

Longitudinal studies exploring the evolution of health information technology functions provide valuable information about how technology systems are integrated and exploited in situ. This study reports changes in the distribution of functions for a specific health information technology, the tele-ICU, over time. The studied tele-ICU provided care...

Introduces the 3 fundamental forms of breakdown that apply to all adaptive systems at all scales. Resilient systems develop means to mitigate the risk of these 3. Also introduces the puzzle that adaptive systems are always & simultaneously mal-adapted, well-adapted, and under-adapted.

In this article we describe how we apply the concept of coactive emergence as a phenomenon of complexity that has implications for the design of sensemaking support tools involving a combination of human analysts and software agents. We apply this concept in the design of work methods for distributed sensemaking in cyber operations. Sensemaking is...

Beginning with the question "what is human error?" misleads stakeholders into a thicket of difficulties where answers seem always just around the corner but never actually come into view. The efforts to answer this seemingly simple question -- efforts that inevitably become entangled with hindsight bias, social factors and lose sight of the researc...

Macrocognitive work systems are complex adaptive systems designed to support near-continuous interdependencies among humans and intelligent machines to carry out joint cognitive work that includes functions such as sensemaking, replanning, mental projection to the future, and coordination. The effort to identify empirical laws and use them to const...

Plenary Address Annual Meeting of the Cognitive Science Society August 10, 2002 "Now all scientific prediction consists in discovering in the data of the distant past and of the immediate past (which we incorrectly call the present), laws or formulae which apply also to the future, so that if we act in accordance with those laws our behavior will b...

The goal of this article is to explore ways to keep elderly individuals independent longer and able to remain in their own homes. Caregivers – whether professionals, family, or friends – are an integral facet in enabling elderly persons to be independent. One of the most challenging aspects of maintaining independence is the complex issue of medica...

Reprint of Sarter N. and Woods, D.D. (1994). Pilot Interaction with Cockpit Automation II: An Experimental Study of Pilot's Model and Awareness of the Flight Management System. International Journal of Aviation Psychology, 4:1—28.

reprint of N. Sarter and D.D. Woods. Pilot Interaction with Cockpit Automation I: Operational Experiences with the Flight Management System. International Journal of Aviation Psychology, 2:303--321, 1992.

One strategy that systems employ to remain resilient in the face of shifting demands is the creation and maintenance of margins of maneuver, cushions of potential actions and additional resources that allows the system to continue functioning despite unexpected demands. Systems are often comprised of units which have partial authority and autonomy...