1 Introduction—context of work and scope of replanning activities

Nuclear power plants, process control industries, airspace mission control, air traffic management and military command and control systems involve distributed supervisory control work. Despite their different objectives and personnel roles, these systems share similar supervisory control functions that include ‘remote supervisors who use a communication process to provide local actors with plans and procedures’ (Shattuck and Woods 2000). The responsibilities for controlling these systems are distributed across multiple human operators who must coordinate their tasks at several time periods, sometimes, from different physical locations. Coordination occurs through the use of plans developed by supervisors or procedures prepared by designers. However, plans and procedures often are inadequate to cope with unanticipated events and unexpected turns of the work situation (Hollnagel 2004; Dekker 2006). As a result, both supervisors and operating teams must revise their plans and adapt to the changing circumstances. The physical separation of supervisors and designers from local teams may, however, hinder adaptation. Replanning involves modifying a plan during execution and presents many challenges to teams working in situations of high uncertainty and urgency.

There are several situations that call for supervisory and teamwork skills in replanning such as (1) an unexpected turn of the situation that is not covered in the existing plans or procedures, (2) unavailability of human resources (e.g., injuries), safety back up systems, and communication means, (3) the need to involve new incoming operators and re-allocate tasks, (4) the detection of human errors and the need to correct earlier plans, and (5) the application of alternative recovery procedures requiring a change in goals and priorities. In all cases, supervisors and operators must coordinate and modify a course of action that is already in progress (e.g., shift goals, modify methods of work, choose other means, and re-allocate tasks).

The Contextual Control Model (COCOM in Hollnagel 1993) can be used to illustrate the different demands and contexts of work in the cases of planning and replanning and hence, the different modes of control associated with the two cases. Replanning presents many challenges because the original plan has failed its goal, the situation has got worse and the available time for reaction is running out. In addition, the demands increase as practitioners are required to come up with a better plan, while being in a situation that is even more prone to errors than when applying the initial plan at earlier states. Planning relies on a strategic control mode where team leaders develop a course of action in an analytical and top–down fashion. In replanning, the flow of control is reversed. It is usually the front-end members that discover the problem first and need to react quickly, sometimes, without getting an agreement from the team leader. Replanning requires a tactical mode of control whereby existing tactics are coordinated, possibly in new ways, as it is difficult to invent a new plan under time pressure and explain it to team members. While planning entails trading-off options and optimizing resources, replanning strives for a satisficing option that can be implemented within the limited time available. In general, the strategic control exercised in planning is more reliable than the tactical control required to modify plans from existing resources and actions.

The main proposal put forward in this article is that replanning can be facilitated in two ways, namely: (1) by including flexibility and adaptation as an essential feature of strategic control when there is more time for choosing criteria in plan selection and (2) by specifying recovery tactics that help tactical control to manage complexity and revise earlier actions when time is limited. In both cases, a thorough consideration should be made of features of plans that support their revision and repair. For instance, complex plans (e.g., overly detailed), tightly coupled plans (e.g., time delays are not tolerated, resources are highly optimized), or centralized plans (e.g., coordination is strictly top–down) may cater for efficiency and optimization but become very difficult to rehearse and revise (Klein 1998). These features of complexity, coupling, and control are likely to influence plans in ways that become increasingly difficult to modify in progress. In contrast, practitioners who are likely to succeed in replanning usually make less complex plans (e.g., focus on objectives rather than details), more loose or modular plans (e.g., devote more time and resources to tasks), and less centralized plans (e.g., delegate authority to adapt faster). These plan features of complexity, coupling, and control can be considered either ahead of time in the development of a plan or in the modification process.

This article examines task features and team dynamics of plans that make them easier to adapt to situations of high uncertainty, urgency, and critical consequences. A classification scheme is proposed that examines the potential of plans for on-line modification. The plan classification scheme has been based on models of system complexity and coupling (Perrow 1999), supervisory control (Rasmussen et al. 1990; Leveson 2002; Gauthereau and Hollnagel 2005), dynamic fault management (Chow et al. 2000; Mumaw et al. 2000), and dynamic decision making (DDM; Brehmer 1992, 2005).

To understand better the challenges of the work context, we need to consider the scope of replanning across the planning hierarchy. In the Extended Control Model (ECOM described fully in Hollnagel and Woods 2005), control of planning can be exercised at four levels:

  • Targeting—where overall goals are set up and prioritized according to expectations of how the problem may escalate.

  • Monitoring—where the controller keeps track of the situation with reference to the goals set from the higher levels; objectives and plans are produced on the basis of expectations from above and feedback from lower levels.

  • Regulating—where resources are managed in relation to goals set up at higher levels or changes of the situation reported at lower levels.

  • Tracking—where closed-loop activities are performed to implement plans.

According to ECOM, planning and replanning can take place on concurrent loops of activity in the sense that practitioners can simultaneously adjust objectives and targets on all levels of planning. In some cases, replanning at the targeting level may even conclude with a decision to tolerate an existing plan because changes may come at a high cost of coordination and implementation. Challenges at the monitoring level may include projecting forward how the situation evolves and rehearsing new methods to identify risks. At the regulation and tracking levels, practitioners have to reassess the status of available resources and cope with coordination problems and feedback delays. These replanning activities of reviewing goals, repairing plans, and coordinating plan execution have been included in a cognitive framework of replanning that has been based on an extensive literature survey.

2 Review of studies in dynamic decision making and adaptive planning

This section reviews selected studies on the challenges of dynamic work, the cognitive processes of changing plans, and the adaptive processes of team coordination. The review covers both simulated microworlds and field studies in a variety of domains such as emergency management (e.g., fire-fighting), command and control in military operations, dynamic fault management in process control and emergency medical care. Emphasis was placed on empirical and observational findings to build a framework of adaptive planning for supervisory work.

Studies of dynamic decision making (DDM) in simulated microwords may have some useful contributions to make since the situation (e.g., simulated fire) may evolve in ways that have not been foreseen in the original plan (for a review see Brehmer 1992). Research in simulated microworlds has explored the real-time DDM character and especially the time scales of the hierarchical levels of the controlling teams. Lower levels at the front line operate at a faster time scale as their control is affected by the time constants and feedback delays of the local context. In contrast, higher command levels operate at slower time scales as they have to integrate information from many sources and make decisions on the basis of global criteria and coordination needs (Artman 1999). This implies that the time characteristics of the situation can influence the type of coordination adopted between the hierarchical levels of control. Brehmer and Svenmarck (1995), for instance, found that a hierarchical organization was affected by time pressure to a greater extent than a fully connected organization since all messages would pass through a central leader in the former case as opposed to messages spreading to all members in the latter case.

Most features of DDM are encountered in military operations where commanders have to undertake multiple attempts and modify their plans in order to control the situation. Several studies have conducted research into how command and control teams manage to adapt their decision strategies and team coordination in the face of increasing demands and time pressure (Serfaty and Entin 1996; Klein and Miller 1999; Klein and Pierce 2001). Examples of adaptive strategies include: articulating plans at a high level to allow more degrees of freedom for local adaptation (decision strategy), communicating ‘intent’ behind plans to the front-end operators (top–down communication), and updating commanders without waiting for specific requests (bottom-up communication). Brehmer (2005) elaborated Boyd’s OODA Loop (Observation-Orientation-Decision-Action) and proposed that the commander’s concept or intent should provide orientation to the team on how to change their plans to respond to the situation.

Several studies of dynamic fault management in process control (Roth et al. 1994; Mumaw et al. 2000) have addressed the challenges that operators face in maintaining the integrity of a faulty process while modifying plans in progress. In the context of space mission control, Chow et al. (2000) presented a decision model of coordination among distant human controllers that has useful implications for the study of replanning. Their co-ladder decision model views replanning as cycling between recognizing process anomalies and plan disruptions, and modifying plans in the moment. Rasmussen’s decision ladder model was used as a basis for team coordination and was supplemented with the functions of ‘common team stance’. Different teams of practitioners, with their own scopes of authority and responsibility, are likely to have different interpretations and priorities for the recovery goals to be chosen. Establishing voice loops among practitioners and updating modes of incoming personnel (Patterson et al. 1999; Patterson and Woods 2001) are examples of mechanisms for building a mutually satisfactory stance to schedule activities for reviewing and improving plans. A common team stance, therefore, is important for converging the practitioners’ views and directing future plan changes.

Emergency medical care is another area where adaptive planning and coordination is required since medical staff have no control over the inputs of the environment and have to re-organize staff roles and resources (e.g., rearranging case order and priority, postponing scheduled treatment, re-assigning equipment) to provide good medical care to any number of arriving patients (Xiao et al. 1996). Medical personnel have been observed to devise several strategies to cope with this demand-resource mismatch (Miller and Xiao 2007), such as using compensatory buffers (e.g., shift overlaps, flexible staff schedules, and per diem staff), and creating role redundancy (e.g., senior staff not engaging fully in a procedure can create spare capacity to help others in different branches).

3 Cognitive processes of replanning

In this section, a framework of cognitive processes of replanning is proposed that integrates several findings of the literature on plan adaptation with the Extended Control Model (ECOM, Hollnagel and Woods 2005). A hierarchical view of planning is adopted on the basis of a simplified version of ECOM that integrates four fundamental replanning processes, namely: (1) recognizing plan disruptions, (2) reviewing and reframing the problem, (3) repairing plans and resolving new risks, and (4) reacting and coordinating the execution of plans. The 4R framework (see Fig. 1) views replanning as an emergent process where recognizing problems and reviewing challenges are interweaved with repairing plans and coordinating. A similar approach to replanning has been taken by Chow et al. (2000) in their co-ladder decision model.

Fig. 1
figure 1

The 4R framework of cognitive processes in replanning

Full size image

According to the 4R framework, the replanning process usually starts at the tracking level, where practitioners become aware of weaknesses in their plans or problems with team functions. In many cases, the problem may be resolved in action with minor changes in the sequence of action or allocation of resources; in familiar situations, a symptom may signify a specific problem which invokes a well-practiced response, without the need to engage any higher order processes. Sometimes, a more thorough investigation of the problem is undertaken which involves a mental rehearsal of potential problems and solutions, nevertheless, preserving the current frame and plan (see dotted by-pass lines of the regulating loop in Fig. 1).

Most challenges to replanning come at the monitoring level, where the problem symptom does not match the mental model or frame of practitioners; in this case, the symptom can be assigned to a class of problems rather than to a specific one. The monitoring and reviewing process involves re-assessing current perceptions and plans which may result in an elaborated or even new frame (i.e., mental construct) with implications for how to repair plans. The mental rehearsal of optional plans can help practitioners think of new solutions and foresee new risks; the outcome may be an elaborated plan or a new plan that serves the same goal. In the proposed framework, reframing constructs and balancing stances of different team members may question the steering goals and eventually create new strategies for replanning. This is shown as another control loop (at the top of Fig. 1) similar to the targeting loop of ECOM or the double-loop learning of organizational learning (Argyris and Schon 1996). The four replanning processes are further described below on the basis of earlier studies in replanning.

3.1 Recognize sources of disruption in plans and team functions

Practitioners integrate data into patterns that recognize as anomalous relative to their expectations that are set by their understanding of the situation (i.e., their mental models). Coordination with others may be required in order to synthesize data from diverse sources and evaluate progress toward the overall goal. If the evidence suggests a corruption of the current plan, it will become necessary to investigate the sources of disturbance and the impact on other processes and goals. An external disturbance may take the form of unexpected events (e.g., deteriorating weather) while an internal disturbance may be expressed as unsatisfactory performance of team members (e.g., fatigue, poor coordination, and errors). Therefore, there is a need to monitor changes not only of the technical system but also of the functions of the team. A recognition of the problem provides the basis for an analysis of the impact on the effectiveness of the current plan (Chow et al. 2000).

3.2 Review and reframe the situation

Adapting plans in progress involves a critical decision, that is, whether to continue with an existing plan (see bypass arrow that preserves the frame of the situation in the regulation loop, Fig. 1) or reframe the situation and change course of action (monitoring loop). Reviewing involves re-interpreting the situation and re-assessing the impact of events and actions on established goals and team functions. The outcome of reviewing could be an elaborated frame (i.e., mental construct) or a new frame with revised goals and responses (Klein et al. 2007) which has implications for how to modify the plan in progress. Furthermore, the delicate balance of different goals set by several working teams in large-scale coordination may have to be revised as the situation takes an unexpected turn. For instance, a weather deterioration that threatens a takeoff procedure would require that different groups of actors establish a common stance to balance their own goals and priorities—that is, pilots, air traffic controllers, and airline managers. Since the activities of different actors are interdependent, they will need to coordinate to come up with a common stance or mutually satisfactory perspective (Shattuck and Woods 2000). In the proposed framework, reframing constructs and balancing stances can question the steering goals and norms of the team that set the boundaries for the controlled process and in this way the boundaries for practitioners (see targeting loop, Fig. 1).

3.3 Repair plans to resolve new risks and aborting conditions

The modified or new goal will shape the changes that will be introduced to the existing plan. Making changes to a plan may result in new risks, especially when there is a deteriorating situation. Identifying risks and costs in replanning may require extensive communication with front-line operators which is very hard to achieve under time pressure. In some cases, a more efficient plan may be found but teams could be reluctant to change because of the time-consuming communications required to inform the affected team members (see Fig. 1, bypass arrow that preserves existing plan). Klein and Pierce (2001) presented the case of a battalion commander who realized that his plan was running into trouble and knew how the plan should be altered. However, he considered how many different groups would have to be notified and how unreliable the communications were, so he decided to continue with the plan. In complex technological systems, the process of changing to a new plan may be complicated by the amount and complexity of the precautions and extra safety steps required to abort the existing plan. For instance, operators may need to bring machines back to a safe state, or finish-up tasks that cannot be interrupted abruptly, before starting to carry out the new plan. Therefore, aborting a plan may require taking several precautions, or installing additional safeguards, to bring the system to a stable state before taking a new course of action.

3.4 React by coordinating the execution of plans

The approved plan modifications provide a structure for activities that different operators will have to coordinate. Several factors are likely to influence plan coordination such as task interruptions and delayed feedback, obstacles to team monitoring, failure to recover errors of others, propagation of adverse events to other work areas, and events occurring at the borders of lines of authority. These factors can be controlled by adjusting several aspects of plan complexity and coupling, as discussed in the following section. As part of their plans and orientations, local actors develop certain expectations about how the system may respond to their modifications or actions of other team members; expectations update mental models and set the context for scanning new information patterns (Chow et al. 2000).

4 Plan features of complexity and coupling

In the context of military command and control activities, Klein and Miller (1999) and Klein and Pierce (2001) commented that plans differ in terms of features of complexity and coupling which has implications for their degree of adaptation. Plan complexity can be perceived in terms of interactivity between parts, number of sub-tasks, types of task and team structures, and level of precision in the plan. On the other hand, coupling can be related to the dependencies between tasks and their degree of integration. Observations of expert performance in adapting plans in progress by Klein and Pierce (2001) have shown that detailed plans and highly integrated plans are more difficult to adapt in-the-moment relative to conceptual plans and modular plans. This section summarizes several views of complexity and coupling in order to propose a taxonomy of plan features that are likely to respond differently to replanning efforts.

4.1 Plan complexity

Complexity refers to the number of parts, their connections, and feedback loops that create a network of interacting parts. High complexity implies a system with many branching points and feedback loops that make interactions between components difficult to trace. Likewise, plans can be viewed as networks of parts or subtasks ranging on dimensions of complexity. Task networks may consist of many subtasks that impose an overload of information, have unintended feedback loops, and entail unfamiliar or hidden interactions. Perrow (1999) also refers to complexity that stems from components that are close to each other (or interwoven) and organizations that employ specialized material that is difficult to substitute. Hence, managing complexity may be achieved by chunking tasks (i.e., attenuating task variety) and allocating them to different operators with a range of skills (i.e., amplifying operator variety). Mapping task organization to team configuration may have practical implications for managing plan complexity. The complexity dimensions of technological systems (Perrow 1999) can provide valuable input in specifying dimensions for plan complexity, as shown below. It is also interesting to examine the tactics that practitioners come up with in coping with information overload (Hollnagel 1992) and complex plan structures (Kontogiannis and Hollnagel 1998). In this sense, some of the work-related Efficiency-Thoroughness Trade-Off (ETTO) rules proposed by Hollnagel (2009) can be seen as tactics for recovering problems in adapting plans on the fly.

4.1.1 Scope of task network

A plan consists of a network of tasks that are organized in a specified manner. As the number of subtasks, outcomes (e.g., attributes and qualities), and measures of success (e.g., speed, accuracy, flexibility) increase, so does the complexity of the task network or plan (Rothrock et al. 2005). In the context of nuclear power emergencies, complex plans and procedures were found difficult to rehearse and change when the situation took a turn (Roth et al. 1994; Jeffroy and Charron 1997). To adapt plans and procedures, operators have found several intelligent tactics such as flipping through the procedures in order to abstract the logic of operations, preview risks and think of alternative interventions. This use of procedures, which is difficult to foresee, may provide a guide for further information search and a basis for assessing the cost of changing a plan rather than simply follow instructions.

Plans also identify and communicate information or cues relevant to the performance of tasks or the interaction between tasks. Complex plans provide a large amount of information to consult to accomplish tasks which diverts attention from subtle events that may be appear unexpectedly in the environment. In other words, information overload in a plan may restrict the ‘horizon of observation’. Hence, operators can miss cues and events that may even be of little apparent relevance to their tasks but could help them assess the overall situation and prepare for adaptations. In this context of work, operators usually resort to a tactical model of control that relies on several tactics for reducing complexity. Hollnagel (1992) has presented several tactics for coping with information overload, either by reducing the accuracy of the main task to avoid missing any important cues or by reducing the processing of input information. Recovery tactics for the latter include filtering information (e.g., looking only for announcements of a specific type) and reducing the level of discrimination (e.g., noting only large variations or extreme values). Unfortunately, many plans assign this activity to junior staff who are less skilled and less likely to have mastered such recovery tactics (Klein et al. 2005a).

4.1.2 Structurability of task network

Task structurability refers to the visibility of task connections (i.e., contingency conditions and choice nodes) in a plan or procedure. Connections that are unusual, unexpected, hidden, or not immediately comprehensible are referred to as “complex” or “non-linear” ones. Connections that are normal or visible (even if unplanned) can be described as “linear” or “simple” ones. Non-linear plans are difficult to predict how they respond to local variations and are subject to fallacious causal reasoning (Hollnagel and Woods 2005). In some emergency procedures, a variation in one task may create cascade effects into other tasks because of hidden connections and feedback loops that exist (Roth et al. 1994; Mumaw et al. 2000). This makes it difficult for operators to follow emergency procedures as they cannot anticipate what tasks will be affected and how they should respond. This type of complexity can increase the burden on reviewing plans and procedures since operators may have difficulties in thinking how plans will play out into the future. In addition, overly detailed plans instill practitioners a false sense of security that they have anticipated and prepared for all eventualities. When things still go wrong or the situation takes an unexpected turn, however, operator confidence may be undermined much more than when they remain prepared for the unexpected and hope to find a way to deal with problems as they emerged (Dorner 1996). A review of control rooms in the nuclear industry (Kontogiannis and Hollnagel 1998) has shown that practitioners tend to resort to several tactics for dealing with complex procedures such as previewing work to be done, anticipating problems, deciding on important information to monitor, and assessing task progress (e.g., logging incomplete steps or delays). This ‘selective use’ of procedures is difficult to foresee in formal assessments of safety but constitutes an efficient tactic for previewing and adapting plans on the fly.

4.1.3 Task-team mapping

Complex tasks are managed by dividing them up into smaller chunks and assigning them to special team members that usually operate at the same time scale (Artman 1999). Inappropriate mappings of task types to team roles, however, can increase complexity and make it difficult to predict how team members would coordinate their work. There have been several studies of task organization and team allocation, but very few have examined them from the perspective of team or plan adaptability. Team organization can vary in a continuum across serial (or vertical) teams versus parallel (or horizontal) teams (Artman 1998). In the most simple form, a serial organization allocates tasks to different operators that are completed in a sequential fashion; hence, every person becomes a filter of information for the next person in the sequence. In the parallel mode, tasks can be carried out in parallel but on different workspaces or areas of responsibility. In a field study of military teams working on the same time scale, Artman (1998) found that serial teams tend to converge in their understanding while parallel teams build different perspectives of the problem. Ultimately, mapping tasks to teams and coping with filtering or divergent perspectives depend on the context of work.

4.2 Plan coupling

Coupling refers to the extent that any slack or buffer exists between two components that absorb disturbances from the first one or from the environment. There is a close relationship between components in the sense that their operation must be synchronized. Effective coordination is required because task components cannot work independently. Tight coupling implies that a disturbance in one part spreads out quickly at other parts because there is no slack or buffers in the system. Integrative plans with tight coupling between parts increase coordination demands as operators must know more about how activities in their scope of responsibility affect others. On the other hand, loosely coupled systems can accommodate shocks, failures, and pressures for change without destabilizing effects. Plans with many loosely coupled tasks are referred to as modular plans (Klein 1998)—that is, each task is relatively independent from the others (i.e., any task can be modified without affecting the others). This section draws upon earlier work of Hollnagel (2002, 2004) on barriers, constraints, and time dependencies in order to specify features of task coupling that are likely to affect the replanning processes.

Another form of coupling may be seen as ‘external’ to the operator tasks in the sense that other work activities that occur at the same time may affect the current plan (Hollnagel 2004). For instance, some airlines require that the takeoff checklist be accomplished on the active runway or just prior to the entry onto the runway. In this case, the takeoff checklist is tightly coupled with other tasks, such as receiving and monitoring traffic communications, sequencing with other aircraft on the final approach, and system monitoring, as well as with the pilot’s mental representation for takeoff (Dekker and Hollnagel 1999). External coupling forces plan execution to ‘keep in pace’ with many external activities. Several tactics for coping with external coupling have been reported (de Brito 2002) such as redefining the sequence of checklist items or changing the time at which the checklist is initiated (e.g., in less busy periods).

4.2.1 Buffers, barriers, and dependencies

The most obvious feature of task coupling is the lack of buffers that absorb disturbances, or stop the propagation of adverse effects, and cope with staff shortages. Miller and Xiao (2007) reported that medical staff in emergency care, in an effort to absorb increases in work demands, would resort to tactics that use compensatory buffers to preserve resources such as shift overlaps, flexible staff schedules, and per diem staff. On the other hand, barriers can prevent errors in the first instance. In the domain of anesthesiology, planning usually takes the form of configuring the workplace (e.g., arrangement of tools and positioning of drugs) so that certain actions are prevented under some circumstances (Xiao et al. 1996). In general, barriers and buffers in a plan can reduce coupling and make it easier to modify plans in progress. Although the efficiency of buffers and barriers has always captured the attention of planners, they should also be designed to be robust (i.e., withstand the variability of the environment). Hollnagel (2004) presents several examples of poor design or bad use of barriers. For instance, a barrier may prevent people not only from harmful inputs but also from useful ones. The use of barriers may become inappropriate over time when people bypass or over-trust their functioning and fail to check them out. Coupling is also affected by several dependencies that may creep up between barriers and tasks in a plan. Two tasks may share the same equipment, may be performed by the same person, or may rely on the same resources; any failure of the common resources will fail both tasks. A combination of redundant equipment, operators, and automated assistants can be used to minimize dependency (Clarke 2005).

4.2.2 Constraints on available means, degrees of freedom, and operator variety

Hollnagel (2004) has specified several types of constraints in a functional model of accident analysis, such as input and output constraints, pre-conditions, time dependencies, constraints on means and resources, and control constraints (e.g., degrees of freedom). To a certain extent, guidance on constraints can help operators to take preventive measures and implement plans in a safe manner. However, imposing too many resource and control constraints can limit the available methods/algorithms to a single option that may be efficient in the short-run but difficult to adapt to a varied context (Grote 2005). Increasing the number of constraints can produce tightly coupled plans with few degrees of freedom or options. Loosely coupled plans make provisions for alternative means to achieve the task goal. In air traffic control, for instance, there are important alternative methods to achieve the safety goal; it is possible to reroute aircraft, delay the departure from the ground, or increase separation distance to cope with system disturbances. To increase plan adaptability, alternative means and methods for achieving tasks should be identified, preferably in advance of task performance. Grote et al. (2009), however, warn that an increase in decision latitude and degrees of freedom may come at a coordination cost as team members must clearly communicate their preferred options and agree on certain deviations from the overall plan.

4.2.3 Time dependencies

Time is an important aspect of control and planning (Hollnagel 2002). It is not enough for practitioners to make a correct decision and implement it in the correct order; they also have to make a decision in a timely fashion and implement it within the required time window. Hollnagel (2002) has explored how time shapes the control modes and plans of practitioners. To maintain control under time pressure, practitioners often resort to a working style that is more efficient but less thorough and make plans that are tightly coupled. While this control mode works for the initial planning activities, tightly coupled plans are rather difficult to modify and adapt to the unfolding situation. For instance, unanticipated events and errors may introduce interruptions of tasks and changes of tasks due to changing priorities (Orasanu et al. 2001). As dependency on time becomes a feature of many dynamic situations, plans should make provisions for adaptations, including when and how to interrupt tasks or resume tasks when opportunities arise. In this sense, loosely coupled plans can tolerate more disruptions and become more robust.

Another challenge in replanning is how to evaluate task progress in view of delays encountered in dynamic work (e.g., delays in selecting and performing actions or getting and evaluating feedback). These task delays can create a lot of uncertainty how to proceed with further tasks in the sequence. A usual tactic, which builds some slack into the plan, is to withhold performance of the second task until feedback from the first task becomes available. Hence, loosely coupled plans can be more forgiving of delays and provide a better basis for replanning.

5 Plan features of control mechanisms

A review of planning across several domains (Hoc 2006) showed that planning is not an end in itself, but it is rather a means to control goals, generate action, and use feedback to update understanding of the problem. Hence, this regulation function that coordinates actions, supervises execution, and uses feedback to make further adjustments becomes an important feature of the proposed plan classification. This control mechanism is necessary for anticipating the need for change and making decisions during execution. In other words, the plan itself should contain the means for changing the plan. An overall framework for controlling tasks at several levels in an organization is presented to provide a basis for plan classification. In systems theory, organizations are viewed as hierarchical structures with control processes that operate at the interfaces between levels in order to regulate activities at the lower levels (Rasmussen et al. 1990). A control process entails an upper level imposing constraints upon the lower. At each level, inadequate control may result from constraints that may be missing, inadequately communicated or not correctly reinforced at the lower level in the hierarchy. Figure 2 shows different communication channels between hierarchical levels in organization. Specifically, downward arrows provide information with reference to goals and impose constraints on lower levels while upward arrows provide feedback to the higher levels and measure the degree of fulfillment of goals and constraints (Leveson 2002).

Fig. 2
figure 2

Controlling tasks and measuring feedback in hierarchical supervisory control

Full size image

The control process also includes an auditing function (see dotted arrow in Fig. 2) that allows supervisors to get a direct view of the system. The auditing function assures that the reports it receives are indeed an accurate reflection of the status of the technical activities. At a simplistic level, this is the ‘management by walking about’. Control at each level may be enforced either in a prescriptive mode as ‘rules to follow’ or in a loosely implemented mode as ‘performance objectives’ with many degrees of freedom to be satisfied according to the local context (Sheridan 1992). Attempts to delegate decisions and to manage by objectives require effective means of communicating value criteria down through the organization levels. In general, a common way to deal with time lags is to delegate authority to lower levels that are not subject to as great a delay in obtaining feedback. Several systems and control approaches are reviewed in this section to specify task features that affect the replanning processes. Of particular importance is recent work on decision rules for trading-off goals (ETTO rules in Hollnagel 2009) and for adapting the authority and control structures (Gauthereau and Hollnagel 2005).

5.1 Balancing multiple goals and conflicts

Supervisors have to make tradeoffs between interacting or conflicting goals, between values or costs placed on different possible outcomes, and between risks or errors likely to occur. They must make these tradeoffs while facing uncertainty and limited resources. In dynamic environments, the tradeoffs may be with respect to when to commit to a plan of action. Supervisors have to decide whether to take corrective action early in the incident with limited information (impulsive response) or delay the response and wait for more data to come in, to ponder additional hypotheses and become more reflective (Woods and Hollnagel 2006). In replanning strategies, the tradeoff between impulsiveness and reflection should be seen in the specific context of work (Hollnagel 2009). With the increase in traffic complexity, for instance, enroute controllers would tend to resolve new conflicts as soon as they arise while ground controllers would tend to wait for more data to confirm their hypotheses before changing their plans (Koros et al. 2006).

In many cases, goal conflicts remain hidden inside overly detailed procedures and create ‘double binds’ where practitioners could be trapped in: whether they adapt procedures or stick with them, with hindsight they could get blamed for not doing the other thing (Dekker 2006). Information about goal conflicts and measures taken to achieve a goal-balance should be communicated to operators because it provides a basis for local adaptation. Hollnagel (2009) has discussed several challenges in making tradeoffs among conflicting goals. For instance, setting criteria on tradeoffs may not be a conscious decision made by practitioners or some criteria may be less explicitly articulated; examples include reducing costs, avoiding actions that would increase the likelihood of being sued, or maintaining good relationships with other agencies. It should be kept in mind, however, that these decision tradeoffs are likely to influence adaptation of practitioners to dynamic situations. Many of the collective ETTO rules suggested by Hollnagel (2009) can be seen as tactics in balancing multiple-level goals to adapt their plans.

5.2 Elaboration and orientation

A plan is not only a sequence of actions to meet a goal but it is also a vehicle for abstracting representations for understanding the situation and guiding activity (Hoc 2006). A plan of action is usually associated with a mental model of the situation that explains how the plan can move the situation from the current state to a desired state. Construct is a term used by Hollnagel (1998) to describe the current understanding of the situation in which control is exercised by practitioners. The implication is that the plan should carry with it a construct about the rationale for moving to another state and explanations about the constraints for action. This facilitates adaptation as operators would be able to modify local plans without violating the rationale and constraints established in the overall plan. The mental model behind a plan can also offer orientation about how the plan fits with the overall mission or with the actions of other colleagues. The former aspect implies that plans should communicate the concept of operation (Brehmer 2005) so that practitioners can understand how they can adapt their plans to unexpected turns of the situation. The latter implies that plans should contain information how adaptations affect the work of other members. Hence, practitioner tactics—such as selecting plan repairs that require less coordination or have fewer influences on others—can be supported by deliberate efforts to abstract elaborations and concepts ahead of time. The question of how much an operator needs to know of the big picture depends on the context of work. The higher the uncertainty, the greater the need to calibrate individual constructs between hierarchical levels. Calibration refers to the intent and rationale of a plan, the constraints of actions, and the impact upon the work of others. When plans carry this information, then elaboration and orientation result in better adaptation.

5.3 Delegation of authority and control

Plans specify the authority structures and control modes required for the coordination between hierarchical levels with their own particular time scales (i.e., faster responses for the lower levels and slower time scales for the higher command levels; Artman 1999). In fast changing systems, the slow time scale of a leader may increase the cost involved in communicating upwards any situational changes and events observed at the front line (Brehmer and Svenmarck 1995). This may imply that centralized or prescribed plans may impede adaptation as situation updates and task agreements rely on a central processing unit or leader. Hence, prescribed plans can only deal with contingencies that have been thought out in advance and preventive measures have been built in the plan. In contrast, self-organizing behaviors require delegation of authority to the operators at the front line so that they are able to make rapid decisions without the need to notify and get agreement from their supervisors. When there are many unexpected changes of the situation or there is a demand for frequent shifting to alternative treatments, plans should be sensitive to feedback and local judgment (Dekker 2006). The flip side of decentralization and empowerment is that local plans may have trouble in synthesizing data from different sources to develop a picture of the situation (Klein et al. 2005b).

Adaptation can take the form of flexibility in changing between the two authority modes or the form of accommodation of both modes at different levels of control. A vital characteristic of high-reliability organizations is their ‘culture of reliability’ (Roberts 1993) that imposes a high degree of order and predictability in a team and thus, it can substitute formal rules of centralization. As study of how operators adapt outage procedures to the shut-down of nuclear power plants (Gauthereau and Hollnagel 2005) showed that adaptation was possible by a combination of central planning and local improvisation of individual actions. Central planning provided a common frame of reference for coordination so that decentralized decisions could be locally adapted without losing sight of the overall objectives. In fact, having centralization and decentralization at the same time is a problem only if we assume one type or one level of control. When control takes place at several levels (e.g., as in the ECOM or the 4R replanning model), we can have centralization at one level (e.g., targeting or monitoring) and decentralization at another one (e.g., monitoring or regulating). In this sense, replanning enables decentralized decisions to be taken ad hoc that consider the global situation.

6 A framework for studying influences of plan types on replanning

Characteristics of plan coupling, complexity, and control may facilitate or hinder the cognitive processes of replanning. For instance, an interactively complex plan can make it difficult to recognize disturbances and weak signals in team functions. A tightly coupled plan would increase coordination demands in the reaction phase of executing the modifications. This section puts forward some hypotheses for how plan features influence the processes of replanning on the basis of this framework (see Table 1 for a summary of earlier discussions).

Table 1 Challenges in analyzing the dimensions of complexity, coupling, and control
Full size table

6.1 Complexity influences on the replanning processes

Plans with a complex structure (e.g., many contingency checks) make it difficult to detect any sources of disruption because of the uncertainty effects and the information overload imposed on human monitoring capabilities (Mumaw et al. 2000). The scope and structure of a plan is also likely to influence the processes of reviewing and balancing goal tradeoffs. For instance, a complex plan with many task interactions may be difficult to review and project into the future; as a result, it may force operators to respond in a piece-meal fashion (i.e., take a series of small corrective actions) that increases the chances of side-effects (Klein 1998). On the other hand, team organization and expertise can affect monitoring of plan disruptions and coordination of plan repairs. A parallel team organization, for instance, can make plans more difficult to monitor especially in cases where events fall between the boundaries of different member responsibilities (Artman 1999). Parallel teams impose a higher demand for cross-checking between members which can be compensated with a higher degree of job broadening so that members have a wider perspective and can see early warnings of plan disruptions. On the contrary, a parallel team works faster which makes it easier to repair plans in a restricted time window (Artman 1999).

6.2 Coupling influences on the replanning processes

Tightly coupled plans have few redundancies in human and technical resources which makes it difficult to recognize errors and ineffective teamwork (Clarke 2005). In situations where role redundancy and expertise are high, modular or loosely coupled plans may be repaired without additional risks or side-effects. On the contrary, when the situation escalates, integrative plans are preferable because an optimum use of scare resources and expertise can be made (Klein 1998). In general, constraints in resources and means can affect detection of disturbances and execution of plan repairs. For instance, building some slack into a plan would make it easier to monitor signs of plan weaknesses and cope with interruptions and delayed feedback; also, higher degrees of freedom allowed to operators in executing a plan would increase adaptability to local events (Grote 2005).

6.3 Control mechanism influences on the replanning processes

In general, it may be argued that some degree of centralization is required in order to synthesize data from diverge sources and recognize weak areas in a plan. However, unexpected or hidden events may arise that threaten plan progress and this may call for decentralized but more elaborate plans. Klein et al. (2005b) have discussed similar coordination costs incurred in large-scale collaborations. Centralized and feed-forward control may be time-consuming during the repair phase of replanning (i.e., contingencies and coordination must be thought out in advance) but becomes easier to implement because their instructions are clear and over-specified. On the contrary, feedback control increases the demands of coordination but probably makes it easier to adapt to the local context (Grote 2005). In general, a plan that elaborates on information about how competing goals were resolved in the past would help with assessing new challenges. Elaboration and orientation in a plan can help maintain a shared mental model of the situation which supports the creation of a common team stance (Salas et al. 1997).

7 Adaptation through training and computerized decision aids

The framework can be used to explore several forms of support for adaptation and replanning by integrating findings of earlier studies and by putting forward new propositions for testing. Adaptation through training considers how operators can be trained to adjust features of plan complexity, coupling, and control so that their plans are easier to modify in progress. Valuable support for aiding operators in replanning can also be provided by computerized decision aids (CDAs) that may benefit from adjustments in the proposed plan features (i.e., adaptation through design). Hollnagel (1995) has warned that the efficient use of an interface or a support system depends not only on the systems in themselves but also on the team structure, the communication links, and the chains of authority. Adaptation through management refers to changes in organizing work to counterbalance design flaws or interaction problems and compensate for changes in the system that occur after the design has been completed (Hollnagel 1995). This form of adaptation has been beyond the scope of this article and received limited attention in adaptation through training.

7.1 Training for replanning

Training that assumes an adaptive model of planning should, first of all, covey to trainees the iterative nature of planning—from reviewing and reframing plans to repairing plans and back again. In this respect, training methods that help people view their plans from different perspectives and decenter from their current vision of the plan would be very valuable. Premortem training (Klein 1998) is a well-tested exercise that prompts people to examine possible reasons why their plans could have failed. Training methods should specify the core skills to be learned and the conditions of guidance and practice of tasks. The 4R framework can explore certain propositions for the specification of core skills such as managing task complexity and regulating coupling. It can also examine how conditions of practice (e.g., part-task vs. whole-task practice) and guidance (e.g., procedural guidance vs. abstract guidance on constraints) can influence the development of complexity–coupling management skills.

With respect to developing skills for managing complexity, several propositions can be put forth. First, one can often reduce plan complexity by grouping-related actions together. The groups must consist of logically related actions so that one action prompts the execution of another. For instance, non-flying pilots use to call out several items on the checklist as a group so that the flying pilot verifies them. This is done by making reference to a set of equipment involved rather than the specific details of the checks to be performed, as the latter is common knowledge (de Brito 2002). Second, plans can be simplified by avoiding to anticipate all possible contingencies and by building fewer decision branches. Finally, plans can be divided up into smaller chunks and allocated to appropriate team members; mapping task organization to team configuration is a very important training issue to be examined in this respect.

Another focus of training would be to enable people to manage task coupling and avoid tightly coupled plans that restrict opportunities for recognizing sources of disruption and for considering alternative methods to modify plans. The conditions of practice in training (e.g., part-task vs whole-task practice) are likely to influence the acquisition of skills in managing task coupling. Part-task training programs restrict the degrees of freedom allowed to people so that tasks are learned in an effortless and error-free mode. On the contrary, whole-task training allows practice with the whole task and requires mastering skills how to perform tasks in alternative ways and how to prioritize tasks (Means et al. 1993); this can increase the degrees of freedom for each task and facilitate the selection of alternative methods. Coupling also refers to aspects of time and resource constraints. The higher the time dependency, the greater the need of operators to master appropriate skills for allocating attention and manage time-sharing. To manage time dependencies, training should enable people to cope with task interruptions, shifts in goals, and resumption of tasks. Trainees may be required, for instance, to practice the same scenario under a variety of conditions such as multi-tasking, high time pressure, and many interruptions, in order to learn how to develop skills in controlling attention and task management (Gopher 1993).

The 4R framework can also put forward some suggestions for adaptation through management, especially through the delegation of authority and coordination of teams. It has been suggested that decentralized plans may provide a better basis for modifications because they provide access to what is actually happening on the front line; a provision here is that local operators do not lose sight of the overarching goals. In this respect, conditions of ‘strict guidance’, such as procedural training, are appropriate only for rote following of procedures. In contrast, another form of training that provides ‘broad guidance’ would allow trainees to develop their own solutions to local problems but constrain them to remain within the ‘intent’ of the supervisor or global plan. Broad guidance should map to the types of constraints considered by Hollnagel (2004)—i.e., action and resource constraints, pre-conditions, time availability, and requirements imposed by competing goals. Similarly, communication of ‘intent’ provides a context for team training so that operators can adapt the global plan at their discretion when pressed for time (Shattuck and Woods 2000).

Training methods can be viewed from the perspective of helping operators to maintain control of the replanning processes. For instance, managing the coupling aspects of planning may support operators in recognizing plan weaknesses and repairing them; abstracting and simplifying plans can make them easier to review and evaluate. Finally, controlling the degree of authority (e.g., directed paths vs. constaints for actions) and type of communication (e.g., explicit vs. implicit communication) should enable better coordination and adaptation of teams. Figure 3 summarizes the training propositions put forward in the framework of the replanning cycle.

Fig. 3
figure 3

Training aids to keep control of replanning

Full size image

7.2 Computerized decision aids (CDAs) for replanning

A well-known principle of joint cognitive systems is that ‘any form of system design or decision aid should support the natural human strategies of coping rather than enforce a particular strategy’ (Hollnagel and Woods 2005, p. 81). In other words, computerized decision aids should first consider the actual strategies that practitioners use in practice and then examine possible ways to support them. While the literature on CDAs is large, this section reviews CDAs designs that have taken seriously their compatibility with human decision strategies.

A decision aiding system should support operators in adjusting the level of plan complexity according to their expertise and the degree of unpredictability of the situation. For instance, computers can represent procedures graphically as multiple layers of goals and simpler plans. Since plan adaptation is often made at the level of intermediate goals, these can be represented as icons in a graphical tree. Direct manipulation facilities may enable supervisors and operators to rearrange the organization of goals or steer goals through a visual representation medium. Cox and Zhang (2007), for instance, have developed a goal manipulation interface to a CDA that portrayed the goals, constraints and resources available to manipulate, hiding the planning algorithms and knowledge structures from the users. Another way of reducing plan complexity involves changing the allocation of tasks between different team members or between humans and computers. There are several challenges involved in the dynamic task allocation between humans and computers—such as temporal and authority aspects of the task re-allocation (Hoc and Lemoine 1998)—that go beyond the scope of this paper.

Understanding and managing task coupling can also be supported by computerized decision aids. This requires facilities for examining task dependencies (e.g., shared resources, side-effects, pre-conditions for staring a task, and errors likely to occur) and time management strategies (e.g., interrupting tasks and changing priorities). CDAs could support these processes, for instance, by providing easy access to menus of time-horizons of tasks, their pre-conditions, and their impact. Furthermore, CDAs could help operators to visualize the side-effects of a selected plan by means of schematic diagrams, showing affected system areas that can be zoomed in. Another way to reduce coupling would be to use CDAs to create barriers and prevent operators from performing certain habitual routines that may be inappropriate in the context of the situation. For instance, operators may mark certain tasks on the computer pages and ask the system to lock their execution until the task pre-conditions have been fulfilled.

It has been argued that replanning is enhanced by a plan control mechanism that creates decentralized but elaborate plans. Decentralization relies on self-managing teams that could encounter difficulties in cross coordination. To overcome this problem, CDAs have been designed that display how individual activities and responsibilities affect the overall plan (Riley et al. 2006). Another way to enhance team coordination would be to develop elaborate plans that communicate the ‘intent’ of the supervisor and provide ‘context-specific’ explanations. Studies of human–human discourse in dynamic fault management tasks (Johannesen et al. 1994) argued that explanations of CDAs instructions should be cast as brief justifications, focusing on specific problem areas, and embedded in a context of correcting for uncertain data. Coordination can be expanded to consider how computers function as team mates in human–computer collaboration. The autonomy granted to computers as team mates has been attracted a lot of research in the recent past. An effective form of human–computer collaboration relates to the issue of ‘constrained autonomy’ where computers generate alternative plans on the basis of criteria and constraints set by humans. In a study of route replanning by on-flight computers (Layton et al. 1994), for instance, the computer would propose several options (i.e., possible flight routes following a problem) and recommend the best choice; however, the constraints for generating options were specified in advance by the crews.

Computerized decision aids can also be viewed from the perspective of helping operators to maintain control of the replanning cycle (Fig. 4). For instance, managing the coupling aspects of planning may support operators in recognizing and repairing plan weaknesses. A graphical representation of complex plans supported by context-specific explanations can make it easier to review plans. Finally, controlling the allocation of tasks between computers and teams, adjusting the level of user support, and making CDA decisions transparent to users can enable better coordination and adaptation of teams.

Fig. 4
figure 4

Computer decision aids (CDAs) to keep control of replanning

Full size image

8 Concluding remarks

For many years, distributed supervisory control systems have relied on the design of complex and detailed procedures aiming at coping with a variety of unanticipated situations (Hollnagel and Woods 2005). Although complex and tightly coupled plans provide optimized responses to a range of emergency situations, they seem to be difficult to revise and change during their execution. Reliance on old practices and over-specified plans makes for efficient and effortless performance but may act against the flexibility required for plan adaptability. Replanning processes require a lot more effort because practitioners should have to forgo standard plans in favor of what amounts to ‘reinventing the wheel’ every time that a plan of action is called for. Seeing old things in new ways, making simple plans without simplifying the problem, managing task coupling, anticipating the needs of local operators to provide elaborate plans are the last thing people would want to do every time they have to develop a course of action. However, managing plan complexity, coupling, and control may enable practitioners to adapt more effectively in a range of situations where unexpected events occur, safety backup systems fail, and errors have safety implications.

This article has sought to develop a framework of cognitive processes of replanning by integrating earlier research studies and theoretical models of human performance (most notably the COCOM and ECOM models of Erik Hollnagel). Replanning processes can work either at a strategic control mode (i.e., using the dimensions of complexity, coupling and control to prepare plans that are flexible and reconfigurable at later stages) or at the tactical control mode (i.e., specifying tactics that manage online the complexity and coupling of tasks in order to support their revision). In both cases, a thorough consideration should be made of features of plan that support their revision and repair (see Fig. 5 for an overview). The plan features have been presented in terms of a classification of plan complexity, coupling, and control dimensions. On the one hand, plans have been viewed as task networks sharing similar features of complexity and coupling to technical systems (Perrow 1999). On the other hand, plans have been viewed as control mechanisms that organize work distributed to different operating teams (Rasmussen et al. 1990; Leveson 2002; Gauthereau and Hollnagel 2005). Although several studies have examined how certain plan elements would affect adaptability, it is hoped that this paper has brought together the most essential elements of plan adaptability in the plan classification scheme.

Fig. 5
figure 5

An overview of plan features that affect how practitioners recognize plan disruptions, reframe concepts, repair plans, and react to obstacles

Full size image

The 4R framework has relied on earlier empirical and theoretical studies of replanning in complex systems. Most notably, the framework has drawn on the work of Erik Hollnagel in order to coordinate the four replanning processes into the ECOM and provide a multiple-level view of planning. The main thesis of the 4R framework has been that replanning can be facilitated in two ways, namely: (1) by including flexibility and adaptation as an essential feature of strategic control when there is more time for choosing criteria in plan selection and (2) by specifying recovery tactics that help tactical control to manage complexity and revise earlier actions when time is limited. The first aspect of replanning involves developing plans that have a greater capacity for adaptation by taking into account several feature of complexity, coupling, and control. In this endeavor of the author, the work of Hollnagel (2002, 2004) particularly on task coupling and time dependency had a strong impact on the classification scheme proposed in Sect. 4.2. The second aspect of replanning involves practitioner tactics that help tactical control of the replanning processes. These recovery tactics are similar to the ETTO rules proposed by Hollnagel (2009) either at the level of individual performance (e.g., tactics for coping with information overload and complex procedures in Sect. 4.1) or at the level ofcollective performance (e.g., tactics for trading-off goals and coping with conflicts in Sect. 5).

The main contribution of this article has been on providing a framework that integrates earlier studies of replanning with theoretical models of performance in a way that practical benefits can be illustrated especially in the areas of training and decision support. Making simple plans without simplifying, managing task coupling, and anticipating team needs to provide elaborate plans are mentally demanding processes. Clearly, there is a need for developing appropriate forms of training and decision aiding that would reduce the ‘cognitive burden’ on replanning. The last section has attempted to make some propositions and integrate findings of studies on the design of computerized decision aiding systems (CDAs) on the basis of the proposed framework. Ultimately, the benefits of training studies and CDA design would have to be evaluated in the context of field observation and simulated emergencies that provide realistic representations of distributed supervisory control work.