PGS - lezione 63 - robustness.pdf

6/21/2023 Structural Robustness of Bridges and Viaducts 1
Structural Robustness of Bridges and Viaducts
Prof. Ing. Franco Bontempi
Docente di: TEORIA E PROGETTO DI PONTI - GESTIONE DI PONTI E GRANDI STRUTTURE
Facoltà di Ingegneria Civile e Industriale
Università degli Studi di Roma La Sapienza
franco.bontempi@uniroma1.it

Contenuti delle lezioni
• Si parte dall’osservazione di cose che non hanno funzionato.
• Si individuano le cause che hanno portato al non
funzionamento e al collasso strutturale: ingegneria forense.
• Si generalizza distillando i principi strutturali che guidano la
concezione strutturale.
• IDEE BASE/ARCHETIPI – GENERALIZZAZIONI – ADATTAMENTI
6/21/2023 Evidences of Failures of Bridges and Viaducts 3

6/21/2023 Evidences of Failures of Bridges and Viaducts 4
I – BEGINING
1. Structural system and environment context
2. Structural failures
3. Secondary elements failures
4. Bases for understanding structural crises
5. Causes
III – LESSONS
1. Forensic
2. Holes
II – COLLAPSES
A – Before
1. Failure during construction
2. Failure of falsework
3. Failure in service without external action
B – After
1. Failure due to flooding, ice floes, floating timber
2. Failure due to seismic activity
3. Failure due to traffic
C - After Accidental
1. Failure due to impact of ship collision
2. Failure due to impact from traffic under the bridge
3. Failure due to impact from traffic above the bridge
4. Failure due to fire or explosions

Index
• DISASTROUS FAILURES
• STRUCTURAL ROBUSTNESS IN THE NARROW SENSE
• STRUCTURAL ROBUSTNESS IN A GENERAL SENSE
• HUMAN ERROR
• MANAGING THE UNEXPECTED
- Unexpected events
- HRO
- HRO principles
- People
- Culture

NTC 2018

La scoperta dell’acqua calda

1846

The
Downfall
of
British
Modernist
Architecture
-
Failed
Architecture

2005

https://www.slideshare.net/FrancoBontempi/robustezza-strutturale-113343022

DISASTROUS FAILURES

Can an airplane crash because it
punctured a tire?
1

6/21/2023 23

6/21/2023 24

6/21/2023 25

6/21/2023 26

1. During takeoff from runway 26 right at Roissy
Charles de Gaulle Airport, shortly before
rotation, the front right tyre (tyre No 2) of the
left landing gear ran over a strip of metal, which
had fallen from another aircraft, and was
damaged.
2. Debris was thrown against the wing structure
leading to a rupture of tank 5.
3. A major fire, fuelled by the leak, broke out
almost immediately under the left wing.
4. Problems appeared shortly afterwards on engine
2 and for a brief period on engine 1.
5. The aircraft took off. The crew shut down engine
2, then only operating at near idle power,
following an engine fire alarm.
6. They noticed that the landing gear would not
retract.
7. The aircraft flew for around a minute at a speed
of 200 kt and at a radio altitude of 200 feet, but
was unable to gain height or speed. Engine 1
then lost thrust, the aircraftªs angle of attack
and bank increased sharply. The thrust on
engines 3 and 4 fell suddenly.
8. The aircraft crashed onto a hotel. 27
6/21/2023 Structural Robustness of Bridges and Viaducts

1
0
2
3
6/21/2023 28

How will this bridge die?
2

Es.: genetics

https://en.wikipedia.org/wiki/Alm%C3%B6_Bridge

The Almö Bridge (inaugurated in 1960), that connected the island of
Tjörn (Sweden's 7th largest island) to the mainland. The bridge collapsed
January 18th 1980, when the bulk carrier MS Star Clipper struck the
bridge arch. Eight people died that night as they drove over the edge
until the road on the Tjörn side was closed 40 minutes after the
accident. A new cable-stayed bridge, Tjörn Bridge, was built and
inaugurated in 1981.

Minnesota I-35W Bridge
3

Downtown
District
I-35W Bridge
Source: Google Earth

Bridge Scheme (1)
DNA - INTRINSIC NATURE OF THE BRIDGE STRUCTURE:
Load Path – Redundancy – Robustness – Survaivability
Reliability - Availability – Maintenability - Safety

The fixed bearing assemblies were located at piers 1, 3, 7, 9, 12, and 13.
Expansion (sliding) bearings were used at the south and north abutments and at piers 2,
4, 10, and 11.
Expansion roller bearings were used at piers 5, 6, and 8.
Bridge Scheme (2)
6/21/2023 56

4, 10, and 11.
Bridge Scheme (3)
+
6/21/2023 58

Roller #5

• Structural integrity is the term used for the performance
characteristic applied to a component, a single structure,
or a structure consisting of different components.
• Structural integrity is the ability of an item to hold
together under a load, including its own weight, resisting
breakage or bending. It assures that the construction will
perform its designed function, during reasonable use, for
as long as the designed life of the structure.
• Items are constructed with structural integrity to ensure
that catastrophic failure does not occur, which can result
in injuries, severe damage, death, or monetary losses.
Structural Integrity

1
Roller #4

4, 10, and 11.
Bridge Scheme (3)
+
6/21/2023 62

Bridge Scheme (4)
-
6/21/2023 63

2

6/21/2023 66

Time (not scaled)
Critical
load
(not
scaled)
Original
design
2007
modification
1998
modification
1977 modification
Instantaneous load
Lower bound of load
Upper bound of load
Failure
level
Precise moment
of failure
3
Crossing the Threshold of Failure

6/21/2023 69

Compression
diagonal
Tension
diagonal
Orange and red shading:
exceeds yield stress
Stress
Yield
stress
0
Allowable
Dead Load of Original 1967 Bridge

Compression
diagonal
Tension
diagonal
Stress
Yield
stress
0
Allowable
After 1977 and 1998 Modifications

Compression
diagonal
Tension
diagonal
Stress
Yield
stress
0
Allowable
Loads at Time of Accident

6/21/2023 74

4
5

HAZARD
I
N
-
D
E
P
T
H
D
E
F
E
N
C
E
HOLES DUE TO
ACTIVE ERRORS
HOLES DUE TO
HIDDEN ERRORS
Failure Logic

6/21/2023 82

NTSB
TT

15/67
Sub-structured model
6/21/2023 85

FORWARD
ANALYSIS
BACK
ANALYSIS

COSE – STRUTTURE - SISTEMI
THINGS – STRUCTURES - SYSTEMS
PERSONE – COMPORTAMENTI
PEOPLE – HUMAN BEHAVIOR
COSA
WHAT
CHI
WHO
ROTTURA – COLLASSO - CRISI
FAILURES – COLLPASE - CRISIS
PERCHE’
WHY
SPIEGAZIONE – CAUSE
REASONS - DISCLOSURE
CONOSCENZA
KONWLEDGE
Forensic Engineering

Knowledge Development

RESISTANCE OF GUSSET PLATES:
✓GUSSET PLATES IN TENSION
✓GUSSET PLATES SUBJECT TO SHEAR
✓GUSSET PLATES IN COMPRESSION
FHWA GUIDELINES, (2009)
26/67
RESISTANCE OF FASTENERS
✓SHEAR RESISTANCE OF FASTENERS
✓PLATE BEARING RESISTANCE AT FASTENERS
http://bridges.transportation.org/Documents/FHWA-IF-09
014LoadRatingGuidanceandExamplesforGussetsFebruary2009rev3.pdf

After this tragedy, the Federal Highway Administration (FHWA) focused its attention on all the
465 steel deck truss bridges present in the National Bridge Inventory [NTSB, 2008].
“The term “fracture critical” indicates that if one main component of a bridge fails, the entire
structure could collapse. Therefore, a fracture critical bridge is a steel structure that is designed
with little or no load path redundancy. Load path redundancy is a characteristic of the design that
allows the bridge to redistribute load to other structural members on the bridge if any one member
loses capacity. “

I-35W SAINT ANTHONY FALLS BRIDGE (September 2008)
There are 323 sensors that regularly measure bridge conditions
such as deck movement, stress, and temperature

http://www.startribune.com/new-35w-bridge-already-is-
aging/268746561/
6/21/2023 97

Opening day was six years ago, and the I-35W bridge is needing repairs — some that come
from our harsh winters, but some from improper installations.

Examples
4

Es.

For six days in January 1998, freezing rain coated
Ontario, Quebec and New Brunswick with 7-11
cm (3-4 in) of ice. Trees and hydro wires fell and
utility poles and transmission towers came
down causing massive power outages, some for
as long as a month. It was the most expensive
natural disaster in Canada. According to
Environment Canada, the ice storm of 1998
directly affected more people than any other
previous weather event in Canadian history.

Es.

https://californiawaterblog.com/2
016/05/01/the-collapse-of-water-
exports-los-angeles-1914/

Es.

http://urbanplanet.info/architecture/par
is-air-terminal-collapse-report-france/
6/21/2023 122

6/21/2023 124

Es.

Accoppiamento in serie o in parallelo
In parallelo
(possibilità di avere risorse extra – robustezza)
In serie
(possibile fragilità e collasso progressivo)

http://www.wise-uranium.org/img/stavaa.gif

System Complexity (Perrow)
6/21/2023 130

Es.

Seismic Action

Critical Node

FAR FIELD ZONE
EXCHAGE ZONE
STRUCTURE
FAR FIELD ZONE
EXCHAGE ZONE
STRUCTURE
INFRASTRUCTURE
OBJECT
NET
Local / Punctual
Scale
Global / Regional
Scale
Structural
System
Infrastructural
System
Also if artificial,
these systems
need to have
necessarily
evolutive soundness,
ecological coherence
and sustainability
characteristics
Structure / Infrastructure

Node Congestion

(0,0) (92,0)
(92,29)
(0,29)
(0,54)
(0,62) (28.5,62)
(53,56)
(63,45)
(92,32)
(92,34)
System with Element connected in Series

System with Element connected in Parallel

Structural System Degradation

Damage at Local Level

Damage at Element Level

Damage at Structural Level

Accoppiamento in serie o in parallelo
In parallelo
(possibilità di avere risorse extra – robustezza)
In serie
(possibile fragilità e collasso progressivo)

6/21/2023 145

Es.

6/21/2023 149

6/21/2023 150

6/21/2023 151

Note: Events
• Two categories of named events take place, respectively:
• HPLC - High Probability Low Consequences Events -
Frequent Events with Limited Consequences.
• LPHC - Low Probability High Consequences Events - Rare
events with High Consequences.

Events HPLC LPHC
Energy release Low High
Number of failures Low High
Number of people involved Low High
Structural behaviour Linear Nonlinear
Interactions Soft Strict
Uncertainty Low High
Breakdown of the event High Low
Predictability of the event High Low

Events
• The table summarizes, in broad terms, the peculiarities of
the two categories of events:
a. the first three lines consider the amounts of energy,
breakdowns and people that may be involved;
b. the next three lines describe the problems in terms of
event analysis;
c. the last two refer to the ease or difficulty of predicting
the dynamics of the event.

Events HPLC LPHC
Breakdown of the event High Low
Predictability of the event High Low

Possible runaway over time of an LPHC event

Setting the structural problem in a deterministic or stochastic framework as a function of complexity. HPLC
= High Probability - Low Consequences; LPHC = Low Probability - High Consequences.

Black Swan Events
• In this consideration of unforeseen events and unpredictable
effects, the theme of the so-called Black-Swan Events has
recently been added.
• These events are characterized:
A. from being singular events, outside the normal expectation as
nothing from past experience seems to have prefigured their
possibility.
B. from having an extreme impact in terms of consequences on
people, things, the environment, the economy.
C. from being, despite their non-prediction and their unexpected
occurrence, once they have occurred, retrospectively
conceivable and explainable.

STRUCTURAL ROBUSTNESS
IN THE NARROW SENSE

OBJECT
NET
Structural
System
Infrastructural
System
USE
SAFETY
INTEGRITY
f(D)
D
Mean
Frequent
Maximum
Rare
Accidental
Exceptional
Black
Swan
Events
Service Limit States
Ultimate Limit States
Integrity Limit States
Performance, Safety and Integrity Levels

Structural Integrity
• Structural integrity is the ability of an item—either a
structural component or a structure consisting of many
components—to hold together under a load, including its
own weight, without breaking or deforming excessively.
• It assures that the construction will perform its designed
function during reasonable use, for as long as its intended
life span.
• Items are constructed with structural integrity to prevent
catastrophic failure, which can result in injuries, severe
damage, death, and/or monetary losses.

Structural Robustness
• Capacity of a structure (structural system) to show regular
decrease of its structural quality (integrity) due to negative
causes.
• It implies:
a) some smoothness of the decrease of structural
performance due to negative events
(intensive feature);
a) some limited spatial spread of the ruptures
(extensive feature).

Structural Robustness: Intensity Feature
ATTRIBUTES
RELIABILITY
AVAILABILITY
SAFETY
MAINTAINABILITY
INTEGRITY
SECURITY
FAILURE
ERROR
FAULT
permanent interruption of a system ability
to perform a required function
under specified operating conditions
the system is in an incorrect state:
it may or may not cause failure
it is a defect and represents a
potential cause of error, active or dormant
THREATS
NEGATIVE CAUSE
STRUCTURAL
QUALITY
less robust
more robust
Nominal
configuration
Damaged
configuration

Usual
ULS
&
SLS
Verification
Format
Structural Robustness
Assessment
1st level:
Material
Point
2nd level:
Element
Section
3rd level:
Structural
Element
4th level:
Structural
System
Level of Structural Failures

“IMPLOSION”
OF THE
STRUCTURE
“EXPLOSION”
OF THE
STRUCTURE
is a process in which
objects are destroyed by
collapsing on themselves
is a process
NOT CONFINED
STRUCTURE
& LOADS
Collapse
Mechanism
NO SWAY
SWAY
Bad vs Good Collapse: Extensive Feature

Fail-Safe (ITA)
• Nella tecnica, denominazione dei sistemi (apparati,
componenti, strutture ecc.) progettati in modo da evitare
che eventuali avarie arrechino danni a persone o ad altri
sistemi a loro interconnessi od operanti in prossimità.
• In particolare, nelle costruzioni meccaniche, e specialmente
in quelle aeronautiche, sono così chiamate le strutture
capaci ancora di notevole resistenza, benché affette da
incrinature o rotture di qualche parte o elemento (anche di
parti nascoste o non immediatamente visibili). Le incrinature
e rotture vengono riparate o rimosse in occasione delle
ispezioni e delle revisioni obbligatorie periodiche.

Fail-Safe (ENG)
• A fail-safe in engineering is a design feature or practice that
in the event of a specific type of failure, inherently
responds in a way that will cause no or minimal harm to
other equipment, the environment or to people.
• Unlike inherent safety to a particular hazard, a system being
"fail-safe" does not mean that failure is impossible or
improbable, but rather that the system's design prevents or
mitigates unsafe consequences of the system's failure. That
is, if and when a "fail-safe" system "fails", it is "safe" or at
least no less safe than when it was operating correctly.

Synonym: Damage Tolerance
• Property of a structure relating to its ability to sustain
defects safely until repair can be effected.
• The approach to engineering design to account for damage
tolerance is based on the assumption that flaws can exist in
any structure and such flaws propagate with usage.
• In engineering, structure is considered to be damage tolerant
if a maintenance program has been implemented that will
result in the detection and repair of accidental damage,
corrosion and fatigue cracking before such damage reduces
the residual strength of the structure below an acceptable
limit.

Synonym: Graceful Degradation
• Ability of a computer, machine, electronic system or network
to maintain limited functionality even when a large portion
of it has been destroyed or rendered inoperative. The
purpose of graceful degradation is to prevent catastrophic
failure.
• Ideally, even the simultaneous loss of multiple components
does not cause downtime in a system with this feature.
• In graceful degradation, the operating efficiency or speed
declines gradually as an increasing number of components
fail.

6/21/2023 175

Design for Robustness
5

Design Strategy #1: CONTINUITY

Nipigon River Bridge

New Haengju Bridge

Design Strategy #2: SEGMENTATION

Es.

The collision of Esso Maracaibo
https://www.venezuelatu
ya.com/occidente/puente
rafaelurdanetaeng.htm

http://www.aukevisser.nl/others/id1337.htm

Progressive collapse
6

Cascade Effect / Chain Reaction
• A cascade effect is an inevitable and sometimes unforeseen
chain of events due to an act affecting a system.
• In biology, the term cascade refers to a process that, once
started, proceeds stepwise to its full, seemingly inevitable,
conclusion.
• A chain reaction is the cumulative effect produced when
one event sets off a chain of similar events.
• It typically refers to a linked sequence of events where the
time between successive events is relatively small.

effect
time
decomposability
course predictability
Runaway: Progressive Collapse

Pancake
Type
Collapse

Domino
Like
Collapse

Tauern Superhighway Bridge, Austria 1975

Zipping
Like
Collapse

Long span suspension bridges

Progressive collapse

2002

1) Minimum number of removed hangers and most sensitive location for
the triggering of the progressive collapse: the bridge results to be more
sensible to the damage at mid-span, where the removal of just 5 hanger
for the symmetrical rupture and 7 hangers for the asymmetrical rupture is
needed in order to trigger the collapse propagation.
Shifting the initial damage location aside (about at 1/3 of the span) the
asymmetrical rupture of 9 hangers is required for the collapse propagation,
while moving the initial damage near the tower even the asymmetrical
removal of 12 hangers has no global effects on the structure and very 7
hangers must be symmetrically removed on both sides in order to trigger
the propagation of the ruptures on the adjoining hangers.

2) Preferential direction for the collapse propagation: to the higher damage sensibility of
the bridge central zone counterpoises a lower acceleration of the collapse progression
triggered by central ruptures, with respect to that one triggered by lateral ruptures.
This effect is due to the particular configuration of the structural system that requires a
growing hanger length from the centre to the sides of the bridge: when a chain rupture
trigger, the ultimate elongation required to the hangers adjoining the failed ones increases
as the collapse propagates (because the unsupported deck length also increases).
If the initial damage occurs at mid-span, it involves the shortest hangers and the collapse
propagation is partially slowed down from the growing element ductility of sideward
hangers. On the contrary, a more intense initial damage is required sideways to trigger
chain ruptures, but then the hanger breakdowns speeds up when moving toward the
centre, where the hanger length decreases.

3) Qualitative measure that could possibly lead the collapse to an halt: in the case of a
central rupture a closer increment in the section of the hangers (that remain instead the
same for about 5/6 of the span length) could possibly provide for a collapse standstill. In
the case of a chain rupture triggered in a lateral zone the preferential direction showed by
the progressive collapse would probably make less effective such a measure.
3) Qualitative measure that could possibly lead the collapse to an halt: in the case of a
central rupture a closer increment in the section of the hangers (that remain instead the
same for about 5/6 of the span length) could possibly provide for a collapse standstill. In
the case of a chain rupture triggered in a lateral zone the preferential direction showed
by the progressive collapse would probably make less effective such a measure.

4) Sensibility to modality of damage (asymmetrical or symmetrical failure): another
consideration about the possible collapse standstill concerns the higher susceptibility of
the bridge to an unsymmetrical hanger failure than to a symmetrical one: in the last case
the symmetrical hinge formations determines a symmetrical moment increment on the
deck box-girders, thus possibly allowing for an early deck segment detachment that would
arrest the collapse
4) Sensibility to modality of damage (asymmetrical or
symmetrical failure): another consideration about the
possible collapse standstill concerns the higher susceptibility
of the bridge to an unsymmetrical hanger failure than to a
symmetrical one: in the last case the symmetrical hinge
formations determines a symmetrical moment increment
on the deck box-girders, thus possibly allowing for an early
deck segment detachment that would arrest the collapse

6/21/2023 221

Es.

https://www.tuhh.de/sdb/starossek/Ver
oeffentlichungen/Dateien/Progressive%2
0collapse%20of%20bridges%20(Uwe%20
Starossek).pdf
6/21/2023 233

http://www.confederationbridge.com/ab
out/confederation-bridge/design.html
6/21/2023 234

6/21/2023 235

Threat from continuity

https://www.tuhh.de/sdb/starossek/Veroeffentlichungen/Dateien/Progressive%20collapse%20of%20bridges%20(Uwe%20Starossek).pdf
Need of discontinuity

6/21/2023 238

STRUCTURAL ROBUSTNESS
IN THE GENERAL SENSE

DESIGN
a

Design as Foresight

Design as Decision and Synthesis

Evolutive vs Innovative Design (1)

Evolutive vs Innovative Design (2)
Il principio di precauzione si applica
non a pericoli già identificati, ma a
pericoli potenziali, di cui non si ha
ancora conoscenza certa.
design
clima

Es.: design clima

Ponte sul Rio Sinigo
L’industria Italiana del
Cemento 1983;12:759–72.

Cemento 1983;12:759–72.

6/21/2023 252

HUMAN ERROR
b

100%
Time
%
of
failure Unknown phenomena
Known phenomena
Research level Design code level
past present future
A
B
B B
C
Human
errors
Causes of System Failure

Errors by Reason
conoscenza
valutazione
scelta
decisione
esecuzione

conoscenza
valutazione
scelta
decisione
esecuzione

Factors (1)

Factors (2)

Errors by Rasmussen

Eccesso di Norme Tecniche
• «Ma un numero di regole eccessivo comporta vari degli inconvenienti
dianzi citati e in particolare:
- l'impoverimento dell'autonomia e della creatività, in quanto l'opera
del progettista è irretita dalle norme;
- la difficoltà di discernere ciò che veramente conta;
- la sensazione di avere, al riparo delle norme, responsabilità assai
alleviate;
- la difficoltà non infrequente di rendersi conto dei ragionamenti che
giustificano certe regole, rischiando di considerare queste alla stregua
di algoritmi, ossia di schemi operativi che, una volta appresi, il
pensiero non è più chiamato a giustificare.»
- Proliferazione delle normative e tecnicismo. Ultima lezione ufficiale del corso di Tecnica delle costruzioni tenuta dal prof.Piero Pozzati
- nell'a.a. 1991-'92, presso la Facoltà di Ingegneria dell'Università di Bologna (3 giugno 1992).

Judgement Errors
• Context dependence
• Contrast effect
• Recency effect
• Halo effect
• Plasticity
• Order effects
• Pseudo-opinions
• Vividness
• Wishful thinking
• Anchoring
• Social loafing
• Conformity
• The representativeness heuristic
• Law of small numbers
• Hot hand
• Neglecting base rates
• Nonregressive prediction
• Synchronicity
• Causalation
• Salience
• Minority influence
• Groupthink

MANAGING
THE UNEXPECTED
c

Unexpected events

Brutal audit
• The ability to deal with a crisis is largely dependent on the
structures that have been developed before chaos arrives.
• The event can in some ways be considered as an abrupt and
brutal audit: at a moment’s notice, everything that was left
unprepared becomes a complex problem, and every
weakness comes rushing to the forefront.

Small events
• Small events have large consequences.
• Small discrepancies give off small clues that are hard to spot
but easy to treat if they are spotted.
• When clues become much more visible, they are that much
harder to treat.
• Managing the unexpected often means that people have to
make strong responses to weak signals, something that is
counterintuitive and not very heroic.
• Normally, we make weak responses to weak signals and
strong responses to strong signals.

Sensitivity to initial conditions

Butterfly Effect
• The meteorologist Edward Lorenz discovered that a simple
model of heat convection possesses intrinsic unpredictability,
a circumstance he called the “butterfly effect,” suggesting
that the mere flapping of a butterfly’s wing can change the
weather.
• A more homely example is the pinball machine: the ball’s
movements are precisely governed by laws of gravitational
rolling and elastic collisions—both fully understood—yet the
final outcome is unpredictable.

Chaos Theory (1)
• Chaos theory concerns deterministic systems whose
behavior can in principle be predicted. Chaotic systems are
predictable for a while and then 'appear' to become random.
• The amount of time that the behavior of a chaotic system
can be effectively predicted depends on three things:
❑how much uncertainty can be tolerated in the forecast,
❑how accurately its current state can be measured,
❑and a time scale depending on the dynamics of the system,
called the Lyapunov time.

Chaos Theory (2)
• In chaotic systems, the uncertainty in a forecast increases
exponentially with elapsed time. Hence, mathematically,
doubling the forecast time more than squares the
proportional uncertainty in the forecast. This means, in
practice, a meaningful prediction cannot be made over an
interval of more than two or three times the Lyapunov time.
• When meaningful predictions cannot be made, the system
appears random.

http://abyss.uoregon.edu/~js/21st_century_science/lectures/lec08.html

Authorities vs Experts
•Systems that mismanage the unexpected tend to
ignore small failures, accept simple diagnoses, take
frontline operations for granted, neglect capabilities
for resilience, and defer to authorities rather than
experts

How to handle unexpected events
1. Tracks small failures
2. Resists oversimplification
3. Remains sensitive to operations
4. Maintains capabilities for resilience
5. Takes advantage of shifting locations of
expertise

HRO
d

High Reliability Organization (HRO)
• A high reliability organization (HRO) is an organization that
has succeeded in avoiding catastrophes in an environment
where normal accidents can be expected due to risk factors
and complexity.
• Important case studies in HRO research include both studies
of disasters (e.g., Three Mile Island nuclear incident, the
Challenger explosion and Columbia explosion, the Bhopal
chemical leak, the Tenerife air crash, the Mann Gulch forest
fire, the Black Hawk friendly fire incident in Iraq) and cases
like the air traffic control system, naval aircraft carriers, and
nuclear power operations.

2 - Resists
oversimplification
3 - Remains sensitive to operations
5 - Takes advantage of
shifting locations of
expertise
4 - Maintains capabilities for
resilience
1 - Tracks small failures

Mindfulness (1)
•Mindfulness – a rich awareness of discriminatory
detail and an enhanced ability to discover and correct
errors that could escalate into a crisis.
•By mindful, one also means striving to maintain an
underlying style of mental functioning that is
distinguished by continuous updating and deepening
of increasingly plausible interpretations of the
context, what problems define it, and what remedies
it contains.

Mindfulness (2)
• The big difference between functioning in HROs and in other
organizations is often most evident in the early stages when
the unexpected gives off only weak signals of trouble.
• The overwhelming tendency is to respond to weak signals
with a weak response. Mindfulness preserves the capability
to see the significance of weak signals and to respond
vigorously.

Mindfulness Defined
1. combination of ongoing scrutiny of existing expectations,
2. continuous refinement and differentiation of expectations
based on newer experiences,
3. willingness and capability to invent new expectations that
make sense of unprecedented events,
4. a more nuanced appreciation of context and ways to deal
with it,
5. and identification of new dimensions of context that
improve foresight and current functioning.

Detection, Containment, Resilience
• One attributes the success of HROs in managing the
unexpected to their determined efforts to act mindfully.
1) By this one means that they organize themselves in such a
way that they are better able to notice the unexpected in
the making and halt its development.
2) If they have difficulty halting the development of the
unexpected, they focus on containing it.
3) And if the unexpected breaks through the containment,
they focus on resilience and swift restoration of system
functioning.

Resilience
• To be resilient is to be mindful about errors that have
already occurred and to correct them before they worsen
and cause more serious harm.
• Resilience encourages people to act while thinking or to act
in order to think more clearly.
• Resilience is about bouncing back from errors and about
coping with surprises in the moment.
• Achieved through an extensive action repertoire and skills
with improvisation.

Note
• Mindfulness also involves preferences that are diverse; close
attention to situations; resilience in the face of events; sensemaking
that shows whether a decision is necessary; people with diverse
interests who debate, speak up, and listen to one another; and
designs that are malleable rather than fixed.
• When you try to move toward mindfulness, there is resistance, partly
because of threats to psychology safety.
• After all, it’s a whole lot easier to bask in success, keep it simple,
follow routines, avoid trouble, and do an adequate job. I know how to
do those things. But dwell on failure? Question my assumptions?
Linger over details? Fight fires creatively? Ask for help? No thanks. Or
more likely, “You first!”

Mindlessness (1)
• When people function mindlessly, they don’t understand
either themselves or their environments, but they feel as
though they do.
• A silent contributor to mindlessness is the zeal found in most
firms for planning. Plans act the same way as expectations.
They guide people to search narrowly for confirmation that
the plan is correct.
• Mindlessness is more likely when people are distracted,
hurried, or overloaded.

Mindlessness (2)
• A tendency toward mindlessness is characterized by a style
of mental functioning in which people follow recipes, impose
old categories to classify what they see, act with some
rigidity, operate on automatic pilot, and mislabel unfamiliar
new contexts as familiar old ones.
• A mindless mental style works to conceal problems that are
worsening.

Mindless Control Systems
• It is impossible to manage any organization solely by means
of mindless control systems that depend on rules, plans,
routines, stable categories, and fixed criteria for correct
performance.
• No one knows enough to design such a system so that it can
cope with a dynamic environment.
• Instead, designers who want to hold dynamic systems
together must organize in ways that evoke mindful work.

Plans, visions and forecast
• Plans and visions and forecasts are inaccurate and gain much
of their power from efforts to avoid disconfirmation.
• You’ll also discover that plans and visions and forecasts
create blind spots.
• Corrections to those inaccuracies lie in the hands of those
who have a deeper grasp of how things really work. And that
grasp comes from mindfulness.
• People who act mindfully notice and pursue that rich,
neglected remainder of information that mindless actors
leave unnoticed and untouched. Mindful people hold
complex projects together because they understand what is
happening.

Mindless/Mindful Investments
• To manage the unexpected is to be reliably mindful, not
reliably mindless.
• Obvious as that may sound, those who invest heavily in
plans, standard operating procedures, protocols, recipes, and
routines tend to invest more heavily in mindlessness than in
mindfulness.

John Boyd

Principles of HRO

HRO Principle 1: Preoccupation with failure.
•HROs are distinctive because they are preoccupied
with failure.
•They treat any lapse as a symptom that something
may be wrong with the system, something that could
have severe consequences if several separate small
errors happened to coincide.

Note
• HROs encourage reporting of errors, they elaborate
experiences of a near miss for what can be learned, and they
are wary of the potential liabilities of success, including
complacency, the temptation to reduce margins of safety,
and the drift into automatic processing.
• They also make a continuing effort to articulate mistakes
they don’t want to make and assess the likelihood that
strategies increase the risk of triggering these mistakes.

HRO Principle 2: Reluctance to simplify.
•Another way HROs manage for the unexpected is by
being reluctant to accept simplifications.
•It is certainly true that success in any coordinated
activity requires that people simplify in order to stay
focused on a handful of key issues and key indicators.
But it is also true that less simplification allows you to
see more. HROs take deliberate steps to create more
complete and nuanced pictures of what they face and
who they are as they face it.

Note
• Knowing that the world they face is complex, unstable,
unknowable, and unpredictable, HROs position themselves to
see as much as possible.
• They welcome diverse experience, skepticism toward received
wisdom, and negotiating tactics that reconcile differences of
opinion without destroying the nuances that diverse people
detect.
• When they “recognize” an event as something they have
experienced before and understood, that recognition is a source
of concern rather than comfort. The concern is that superficial
similarities between the present and the past mask deeper
differences that could prove fatal.

HRO Principle 3: Sensitivity to operations.
•HROs are sensitive to operations.
•They are attentive to the front line, where the real
work gets done. The “big picture” in HROs is less
strategic and more situational than is true of most
other organizations.
•When people have well-developed situational
awareness, they can make the continuous
adjustments that prevent errors from accumulating
and enlarging.

Note
• Anomalies are noticed while they are still tractable and can
still be isolated.
• All of this is made possible because HROs are aware of the
close ties between sensitivity to operations and sensitivity to
relationships.
• People who refuse to speak up out of fear undermine the
system, which knows less than it needs to know to work
effectively.
• People in HROs know that you can’t develop a big picture of
operations if the symptoms of those operations are
withheld.

HRO Principle 4: Commitment to resilience.
•No system is perfect. HROs know this as well as
anyone.
•This is why they complement their anticipatory
activities of learning from failure, complicating their
perceptions, and remaining sensitive to operations
with a commitment to resilience.

Note
• The essence of resilience is therefore the intrinsic ability of
an organization (system) to maintain or regain a dynamically
stable state, which allows it to continue operations after a
major mishap and/or in the presence of a continuous stress.
• HROs develop capabilities to detect, contain, and bounce
back from those inevitable errors that are part of an
indeterminate world.
• The hallmark of an HRO is not that it is error-free but that
errors don’t disable it.

Note
• Resilience is a combination of keeping errors small and of
improvising workarounds that allow the system to keep
functioning.
• Both pathways to resilience demand deep knowledge of the
technology, the system, one’s coworkers, and most of all,
oneself.
• HROs put a premium on training, personnel with deep and
varied experience, and skills of recombination and making do
with whatever is at hand. They imagine worst-case
conditions and practice their own equivalent of fire drills.

HRO Principle 5: Deference to Expertise.
•HROs is deferent to expertise.
•HROs cultivate diversity, not just because it helps
them notice more in complex environments, but also
because it helps them do more with the complexities.
•Rigid hierarchies have their own special vulnerability
to error. Errors at higher levels tend to pick up and
combine with errors at lower levels, thereby making
the resulting problem bigger, harder to comprehend,
and more prone to escalation.

Note
• Decisions are made on the front line, and authority migrates
to the people with the most expertise, regardless of their
rank. This is not simply a case of people deferring to the
person with the “most experience.”
• Experience by itself is no guarantee of expertise, since all too
often people have the same experience over and over and
do little to elaborate those repetitions. The pattern of
decisions “migrating” to expertise is found in flight
operations on aircraft carriers, where “uniqueness coupled
with the need for accurate decisions leads to decisions that
‘search’ for the expert and migrate around the organization.

People

Error is pervasive. The unexpected is pervasive.
• Nowhere one finds any mention of perfection, zero errors,
flawless performance, or infallible humans.
• Error is pervasive.
• The unexpected is pervasive.
• By now that message should be clear. What is not pervasive
are well-developed skills to detect and contain these errors
at their early stages.
1

Expectations (1)
• The basic argument is that expectations are built into
organizational roles, routines, and strategies. These
expectations create the orderliness and predictability that
count on when one organizes.
• Expectations, however, are a mixed blessing because they
create blind spots.
• Blind spots sometimes take the form of belated recognition
of unexpected threatening events. And frequently blind
spots get larger simply because one does a biased search for
evidence that confirms the accuracy of original expectations.

Expectations (2)
• To have an expectation is to envision something, usually for
good reasons, that is reasonably certain to come about.
• To expect something is to be mentally ready for it. Every
deliberate action you take is based on assumptions about
how the world will react to what you do.
• Expectancies form the basis for virtually all deliberate actions
because expectancies about how the world operates serve as
implicit assumptions that guide behavioral choices.
• Expectations provide a significant infrastructure for everyday
life. They are like a planning function that suggests the likely
course of events…

Blind spots
• The problem with blind spots is that they often conceal small
errors that are getting bigger and can produce disabling
brutal audits.
• To counteract these blind spots, organizations try to develop
a greater awareness of discriminatory detail.
• This enriched awareness, which we call mindfulness,
uncovers early signs that expectations are inadequate, that
unexpected events are unfolding, and that recovery needs to
be implemented.
• Recovery requires updating both of one’s understanding of
what is happening and of the lines of action that were tied to
the earlier expectations.

Detection / Not Error-Free
• It is the failure both to articulate important mistakes that
must not occur and to organize in order to detect them that
allows unexpected events to spin out of control.
• HROs develop capabilities to detect, contain, and bounce
back from those inevitable errors that are part of an
indeterminate world.
• The signature of an HRO is not that it is error-free, but that
errors don’t disable it.
• Resilience is a combination of keeping errors small and of
improvising workarounds that keep the system functioning.

Error Reporting
• A necessary component of an incident review is the
reporting of an incident. And research shows that people
need to feel safe to report incidents or they will ignore them
or cover them up.
• HROs increase their knowledge base by encouraging and
rewarding error reporting.

Assumptions
• Every deliberate action you take is based on assumptions
about how the world will react to what you do.
• Expectancies form the basis for virtually all deliberate actions
because expectancies about how the world operates serve as
implicit assumptions that guide behavioral choices.
• Expectations provide a significant infrastructure for everyday
life. They are like a routine that suggests the probable course
of events. They direct your attention to certain features of
events, which means that they affect what you notice, mull
over, and remember. When you expect that something will
happen, that is a lot like testing a hypothesis.
2

Self-fulfilling prophecy (1)
• A self-fulfilling prophecy is the sociopsychological
phenomenon of someone "predicting" or expecting
something, and this "prediction" or expectation coming true
simply because the person believes it will and the person's
resulting behaviors aligning to fulfill the belief.
• This suggests that people's beliefs influence their actions.
• The principle behind this phenomenon is that people create
consequences regarding people or events, based on previous
knowledge of the subject.
• A self-fulfilling prophecy is applicable to either negative or
positive outcomes.

Self-fulfilling prophecy (2)
• American sociologist William Isaac Thomas was the first to
discover this phenomenon. In 1928 he developed the
Thomas theorem (also known as the Thomas dictum), stating
that,
If men define situations as real,
they are real in their consequences.
• In other words, the consequence will come to fruition based
on how one interprets the situation. Using Thomas' idea,
another American sociologist, Robert K. Merton, coined the
term "self-fulfilling prophecy", popularizing the idea that “a
belief or expectation, correct or incorrect, could bring about
a desired or expected outcome.”

Note
• Self-fulfilling theory can be divided into two behaviors, one would be the
Pygmalion effect which is when “one person has expectations of another, changes
her behavior in accordance with these expectations, and the object of the
expectations then also changes her behavior as a result.”
• Additionally, philosopher Karl Popper called the self-fulfilling prophecy the
Oedipus effect:
• One of the ideas I had discussed in The Poverty of Historicism was the influence
of a prediction upon the event predicted. I had called this the "Oedipus effect",
because the oracle played a most important role in the sequence of events which
led to the fulfilment of its prophecy. [...] For a time I thought that the existence of
the Oedipus effect distinguished the social from the natural sciences. But in
biology, too—even in molecular biology—expectations often play a role in
bringing about what has been expected.
• An early precursor of the concept appears in Edward Gibbon’s Decline and Fall of
the Roman Empire: "During many ages, the prediction, as it is usual, contributed
to its own accomplishment" (chapter I, part II).

Confirmations
• Many of expectations are reasonably accurate. They tend to
be confirmed, partly because they are based on experience
and partly because one corrects those that have negative
consequences.
• The tricky part is that all of us tend to be awfully generous in
what we accept as evidence that our expectations are
confirmed.
• Furthermore, we actively seek out evidence that confirms
our expectations and avoid evidence that disconfirms them.

Unpleasant Feelings
• Evidence shows that when something unexpected happens,
this is an unpleasant experience. Part of managing the
unexpected involves anticipating these feelings of
unpleasantness and taking steps to minimize their impact.

Cognitive dissonance
• A person who experiences internal inconsistency tends to
become psychologically uncomfortable and is motivated to
reduce the cognitive dissonance. They tend to make changes to
justify the stressful behavior, either by adding new parts to the
cognition causing the psychological dissonance or by avoiding
circumstances and contradictory information likely to increase
the magnitude of the cognitive dissonance.
• Coping with the nuances of contradictory ideas or experiences is
mentally stressful. It requires energy and effort to sit with those
seemingly opposite things that all seem true. Festinger argued
that some people would inevitably resolve dissonance by blindly
believing whatever they wanted to believe.

Routines and planes
• People also search for confirmation in other forms of
expecting such as routines and plans.
• Organizations often presume that because they have
routines to deal with problems, this proves that they
understand those problems.
• Although there is a grain of truth to that inference, what
they fail to see is that their routines are also expectations
that are subject to the very same traps as any other
expectations.
3

Kahneman and Tversky
• We actively seek out evidence that confirms our
expectations and avoid evidence that disconfirms them.
• We tend to overestimate the validity of expectations
currently held.
• The continuing search for confirming evidence postpones
your realization that something unexpected is developing.

Updating
• Whenever a routine is activated, people assume that the
world today is pretty much like the world that existed at the
time the routine was first learned.
• Furthermore, people tend to look for confirmation that their
existing routines are correct. And over time, they come to
see more and more confirmation based on fewer and fewer
data.
• What is missing are continuing efforts to update the routines
and expectations and to act in ways that would compel such
updating.

Plans
• This same pattern of confirmation seeking is associated with
plans.
• Plans guide people to search narrowly for confirmation that
the plans are correct.
• Disconfirming evidence is avoided, and plans lure you into
overlooking a buildup of the unexpected.
• This is not surprising since much of the imagery used to
describe plans is like the imagery people use when they talk
about expectations.

Counteract to seek confirmation
• People in HROs work hard to counteract the tendency to
seek confirmation by designing practices that incorporate
the five principles.
• They understand that their expectations are incomplete and
that they can come closer to getting it right if they doubt
those expectations that seem to be confirmed most often.

Alertness
• The tendencies to seek confirmation and avoid
disconfirmation are well-honed, well-practiced human
tendencies.
• That’s why HROs have to work so hard and so continuously
to override these tendencies and remain alert. And that’s
why you may have to work just as hard.
• All of us face an ongoing struggle for alertness because we
face an ongoing preference for information that confirms.

Expectations and Planning
• If you understand the problems that expectations create, you
understand the problems that plans create. And you may
begin to understand why a preoccupation with plans and
planning makes it that much harder for you to act mindfully.
• By contrast, mindfulness is essentially a preoccupation with
updating. It is grounded in an understanding that knowledge
and ignorance grow together.

Redirecting Attention
• The power of a mindful orientation is that it redirects
attention from the expected to the irrelevant, from the
confirming to the disconfirming, from the pleasant to the
unpleasant, from the more certain to the less certain, from
the explicit to the implicit, from the factual to the probable,
and from the consensual to the contested.
4

Believing is Seeing
• Trouble starts when I fail to notice that I see only whatever
confirms my categories and expectations but nothing else.
The trouble deepens even further if I kid myself that seeing is
believing. That’s wrong. It’s the other way around. Believing
is seeing. You see what you expect to see. You see what you
have the labels to see. You see what you have the skills to
manage.

L'occhio vede solo ciò
che la mente è preparata
a comprendere
(Henri Bergson)
Henri-Louis Bergson (Parigi, 18 ottobre 1859 – Parigi, 4 gennaio 1941) è stato un filosofo francese. La sua opera superò le tradizioni ottocentesche dello Spiritualismo e
del Positivismo ed ebbe una forte influenza nei campi della psicologia, della biologia, dell'arte, della letteratura e della teologia. Fu insignito del Premio Nobel per la
letteratura nel 1927 sia «per le sue ricche e feconde idee» sia «per la brillante abilità con cui ha saputo presentarle».
Occhio clinico

Forms of unexpected
I. The first form of the unexpected occurs when an
event that was expected to happen fails to occur.
II. A second form of the unexpected occurs when an
event that was not expected to happen does
happen.
III. The third form of the unexpected occurs when an
event that was simply unthought of happens.

Start
• In each of these three cases, the surprise starts with an
expectation.
• Presumably, if you hold these expectations, you look for
evidence that confirms them rather than evidence that
disconfirms them.
• If you find confirming evidence, this “proves” that your
hunches about the world are accurate, that you are in
control, that you know what’s up, and that you are safe.
• The continuing search for confirming evidence postpones
your realization that your model has its limits.

Finally
• If you are slow to realize that things are not the way you
expected them to be, the problem worsens and becomes
harder to solve and gets entangled with other problems.
• When it finally becomes clear that your expectation is
wrong, there may be few options left to resolve the problem.
• In the meantime, efficiency and effectiveness have declined,
the system is now vulnerable to further collapse, and safety,
reputations, and production are in jeopardy.

Imaginations
• A significant goal of HROs is to increase their understanding
of the third form of the unexpected and to expand
knowledge of “the imagined deemed possible.”
• HRO principles steer people toward mindful practices that
encourage imagination.
• The crucial nature of imagination is reflected in the report of
the commission investigating the terrorist attacks on
September 11, 2001. It found shortfalls in imagination prior
to the collapse of the twin towers.

WTC
•The commission’s report contains this striking
assertion:
“Imagination is not a gift usually associated with
bureaucracies. ... It is therefore crucial to find a way of
routinizing, even bureaucratizing the exercise of
imagination. Doing so requires more than finding an
expert who can imagine that aircraft could be used as
weapons.”

Alertness
• It takes more than a shrewd expert to forestall the
unexpected in most situations.
• It takes mindful practices that encourage imagination, foster
enriched expectations, raise doubts about all expectations,
increase the ability to make novel sense of small
interruptions in expectations, and facilitate learning that
intensifies and deepens alertness.
4

Trivialize
• People sometimes inadvertently trivialize the importance of
imagination. For example, these days we keep hearing the
hollow maxim “Expect the unexpected.” That well-meaning
sentiment assumes that people can live their lives while
assuming that their expectations are misleading.
• The problem is, they can’t afford to. They live, instead, as if
their expectations are basically correct and as if there is little
that can surprise them. To do otherwise would be to forgo
any feeling of control or predictability.

Virginity
• Once you’ve accepted an anomaly or something less than
perfect, you know, you’ve given up your virginity. You can’t
go back. You’re at the point that it’s very hard to draw the
line. You know, next time they say it’s the same problem, it’s
just eroded 5 mils more. Once you accepted it, where do you
draw the line? Once you’ve done it, it’s very difficult to go
back now and get very hard-nosed and say I’m not going to
accept that.

Leemers
• You’ll probably know when something unexpected happens
because you’ll feel surprised, puzzled, or anxious. Aviators
call these feelings leemers (probably derived from leery), the
feeling that something is not quite right, but you can’t put
your finger on it. Trust those feelings. They are a solid clue
that your model of the world is in error.
• More important, try to hold on to those feelings and resist
the temptation to gloss over what has just happened and
treat it as normal. In that brief interval between surprise and
successful normalizing lies one of your few opportunities to
discover what you don’t know.

Learning moment
• This is one of those rare moments when you can significantly
improve your understanding.
• If you wait too long, normalizing will take over, and you’ll be
convinced that there is nothing to learn.
• Most opportunities for learning come in the form of brief
moments.
• And one of the best moments for learning, a moment of the
unexpected, is also one of the shortest-lived moments.

Sustained High Performance
• If you update and differentiate the labels you impose on the
world, the unexpected will be spotted earlier and dealt with
more fully, and sustained high performance will be more
assured.
• Reliability is a dynamic event and gets compromised by
distraction and ignorance.
• Mindfulness is about staying attuned to what is happening
and about a deepening grasp of what those events mean.

Culture

Importance of Doctrine
• When you think about mindful culture as a means to manage
the unexpected, keep the following picture of culture in front
of you.
• Culture is about the assumptions that influence the people
who manage the unexpected. Culture can hold large systems
together. Culture is unspoken, implicit, taken for granted. You
feel culture when what you do feels appropriate or
inappropriate. You feel the unexpected when something
surprises you.
• Culture produces simultaneous centralization-
decentralization by binding people to a small set of core
values and allowing them discretion over everything else.

Churchill’s Audit
•Why didn’t I know?
•Why didn’t my
advisors know?
•Why wasn’t I told?
•Why didn’t I ask?
•Perché non lo sapevo?
•Perché i miei
consulenti non lo
sapevano?
•Perché non me l'hanno
detto?
•Perché non l'ho
chiesto?

Culture
• Culture is a pattern of shared beliefs and expectations that
shape how individuals and groups act.
• Descriptions of safety culture often read like lists of banal
injunctions to “do good.”
• Culture will affect what you see and how you interpret it.
• Culture change takes a long time.

Culture - Schein
• Culture is defined by six formal properties:
(1) shared basic assumptions that are
(2) invented, discovered, or developed by a given group as it
(3) learns to cope with its problem of external adaptation and
internal integration in ways that
(4) have worked well enough to be considered valid and,
therefore,
(5) can be taught to new members of the group as the
(6) correct way to perceive, think, and feel in relation to those
problems.

Building on strengths
• Never start with the idea of changing culture.
• Try to build on existing cultural strengths rather than
attempting to change those elements that may be
weaknesses.

Four Subcultures
• The problem is that candid reporting of errors takes trust and
trustworthiness. Both are hard to develop, easy to destroy,
and hard to institutionalize.
1. Reporting Culture
2. Just Culture
3. Flexible Culture
4. Learning Culture
James Reason

Reason (James)
• Reason (James) argues that it takes four subcultures to ensure an
informed culture. Assumptions, values, and artifacts must line up
consistently around the issues of
1. What gets reported when people make errors or experience near
misses (reporting culture)
2. How people apportion blame when something goes wrong (just
culture)
3. How readily people can adapt to sudden and radical increments in
pressure, pacing, and intensity (flexible culture)
4. How adequately people can convert the lessons that they have
learned into reconfigurations of assumptions, frameworks, and
action (learning culture).

1 - Reporting Culture
• Since safety cultures are dependent on the knowledge
gained from rare incidents, mistakes, near misses, and other
“free lessons,” they need to be structured so that people feel
willing to “confess” their own errors.
• A reporting culture is about protection of people who report.
• It is also about what kinds of reports are trusted.

2 - Just Culture
• An organization is defined by how it handles blame and
punishment, and that in turn can affect what gets reported
in the first place.

3 - Flexible Culture
• Adapts to changing demands
• Deference to expertise – decisions migrate to expertise
during periods of high-tempo activity
• Collect multiple signals from a variety of sources
• HROs assume that the system is endangered until there is
conclusive proof that it is not

4 - Learning Culture
• An informed culture learns by means of ongoing debates
about constantly shifting discrepancies. These debates
promote learning because they identify new sources of
hazard and danger and new ways to cope.
• Culture shapes actions largely without people being aware of
how little they see and how many options they overlook.
• When people are drawn into a culture that is partly of their
own making, it is very hard for them to see that what they
take for granted hides the beginnings of trouble.

Mindful Culture
• To be mindful is to become susceptible to learning anxiety.
And anxious people need what Edgar Schein calls
“psychological safety.”
• Mindfulness requires continuous ongoing activity.
• We are not talking about a “safety war” that ends in victory.
We are talking instead about an endless guerilla conflict.

Index
• DISASTROUS FAILURES
• STRUCTURAL ROBUSTNESS IN THE NARROW SENSE
• STRUCTURAL ROBUSTNESS IN A GENERAL SENSE
• HUMAN ERROR
• MANAGING THE UNEXPECTED
- Unexpected events
- HRO
- HRO principles
- People
- Culture

https://www.stradeeautostrade.it/ponti-e-viadotti/i-
concetti-elementari-alla-base-della-robustezza-strutturale-
di-ponti-e-viadotti-prima-parte/
https://www.stradeeautostrade.it/ponti-e-viadotti/i-
concetti-elementari-alla-base-della-robustezza-strutturale-
di-ponti-e-viadotti-seconda-parte/
Robustezza strutturale

https://www.slideshare.net/FrancoBontempi/lineeguida
-fb-3-red-pres

https://www.slideshare.net/FrancoBontempi/la-valutazione-
analitica-della-sicurezza-e-della-robustezza-di-ponti-e-
viadotti-123599445

https://www.slideshare.net/franco_bontempi_org_didattica/
structural-robustness-against-accidents

https://sitES.google.com/a/uniroma1.it/francobontempi/

https://www.youtube.com/c/FrancoBontempi

https://fr.linkedin.com/in/francobontempi

Prof. Ing. Franco Bontempi
Docente di: TEORIA E PROGETTO DI PONTI - GESTIONE DI PONTI E GRANDI STRUTTURE
Facoltà di Ingegneria Civile e Industriale
Università degli Studi di Roma La Sapienza
franco.bontempi@uniroma1.it

PGS - lezione 63 - robustness.pdf

Recommended

Recommended

More Related Content

Similar to PGS - lezione 63 - robustness.pdf

Similar to PGS - lezione 63 - robustness.pdf (20)

More from Franco Bontempi

More from Franco Bontempi (20)

Recently uploaded

Recently uploaded (20)

PGS - lezione 63 - robustness.pdf