Springer Nature is making SARS-CoV-2 and COVID-19 research free. View research | View latest news | Sign up for updates

The theory of graceful extensibility: basic rules that govern adaptive systems


The paper introduces the theory of graceful extensibility which expresses fundamental characteristics of the adaptive universe that constrain the search for sustained adaptability. The theory explains the contrast between successful and unsuccessful cases of sustained adaptability for systems that serve human purposes. Sustained adaptability refers to the ability to continue to adapt to changing environments, stakeholders, demands, contexts, and constraints (in effect, to adapt how the system in question adapts). The key new concept at the heart of the theory is graceful extensibility. Graceful extensibility is the opposite of brittleness, where brittleness is a sudden collapse or failure when events push the system up to and beyond its boundaries for handling changing disturbances and variations. As the opposite of brittleness, graceful extensibility is the ability of a system to extend its capacity to adapt when surprise events challenge its boundaries. The theory is presented in the form of a set of 10 proto-theorems derived from just two assumptions—in the adaptive universe, resources are always finite and change continues. The theory contains three subsets of fundamentals: managing the risk of saturation, networks of adaptive units, and outmaneuvering constraints. The theory attempts to provide a formal base and common language that characterizes how complex systems sustain and fail to sustain adaptability as demands change.

This is a preview of subscription content, log in to check access.


  1. Alderson DL, Doyle JC (2010) Contrasting views of complexity and their implications for network-centric infrastructures. IEEE SMC A 40:839–852

  2. Alderson DL, Brown GG, Carlyle M (2015) Operational models of infrastructure resilience. Risk Anal 35:4. https://doi.org/10.1111/risa.12333

  3. Ashby (1956) An introduction to cybernetics. Chapman & Hall, London

  4. Astrom KJ, Murray RM (2008) Feedback systems. Princeton University Press, Princeton

  5. Attneave F (1954) Some informational aspects of visual perception. Psychol Rev 61:183–193

  6. Beaumont HJ, Gallie J, Kost C, Ferguson GC, Rainey PB (2009) Experimental evolution of bet hedging. Nature 462(5), 90–93. https://doi.org/10.1038/nature08504

  7. Bialek W, de Ruyter van Steveninck, RR, Tishby N (2007) Efficient representation as a design principle for neural coding and computation. Quant Biol. arXiv:0712.4381 [q-bio.NC]

  8. Bonner JT (1998) The origins of multicellularity. Integr Biol 1:27–36

  9. Brenner N, Bialek W, de Ruyter van Steveninck, R (2000) Adaptive rescaling maximizes information transmission. Neuron 26:695–702

  10. Bush SF, Hershey J, Vosburgh K (1999) Brittle system analysis. http://arxiv.org/pdf/cs/9904016.pdf downloaded 15 June 2006

  11. Caporale LH, Doyle JC (2013) In Darwinian evolution, feedback from natural selection leads to biased mutations. Annals of the New York Academy of Science special issue on evolutionary dynamics and information hierarchies in biological systems. Ann Rep 1305:18–28

  12. Carlson JM, Doyle JC (2000) Highly optimized tolerance: robustness and design in complex systems. Phys Rev Lett 84(11):2529–2532

  13. Chandra F, Buzi G, Doyle JC (2011) Glycolytic oscillations and limits on robust efficiency. Science 333:187–192

  14. Chen Y-Z, Huang Z-G, Zhang H-F, Eisenberg D, Seager TP, Lai Y-C (2015) Extreme events in multilayer, interdependent complex networks and control. Sci Rep 5:17277. https://doi.org/10.1038/srep17277

  15. Chuang S, Woods DD, Ting D, Cook RI, Hsu J-C (2018) Coping with Mass Casualties: Adaptations in a hospital without adequate capacity after the Formosa Fun Coast Dust Explosion. under review.

  16. Conant RC, Ashby WR (1970) Every good regulator of a system must be a model of that system. Int J Syst Sci 1:89–97

  17. Cook RI (2006) Being bumpable: consequences of resource saturation and near-saturation for cognitive demands on ICU practitioners. In: Woods DD, Hollnagel E (eds) Joint cognitive systems: patterns in cognitive systems engineering. Taylor & Francis/CRC Press, Boca Raton, pp 23–35

  18. Csete ME, Doyle JC (2002) Reverse engineering of biological complexity. Science 295:1664–1669

  19. Dai L, Vorselen D, Korolev K, Gore J (2012) Generic indicators for loss of resilience before a tipping point leading to population collapse. Science 336(6085):1175–1177. https://doi.org/10.1126/science.1219805

  20. Deary DS (2015) Sources of organizational resilience: Sustaining production and safety in a transportation firm. Unpublished dissertation, Ohio State University, Columbus OH

  21. Deary DS, Walker KE, Woods DD (2013) Resilience in the Face of a Superstorm: A Transportation Firm Confronts Hurricane Sandy. In Proceedings of the human factors and ergonomics society, 57th Annual Meeting (pp. 329–333). Human factors and ergonomics society, Santa Monica, CA. https://doi.org/10.1177/1541931213571072

  22. Dietz T, Ostrom E, Stern PC (2003) The struggle to govern the commons. Science 302(5652):1907

  23. Doyle JC, Csete ME (2011) Architecture, constraints, and behavior. Proc Natl Acad Sci USA 2011 108(Suppl. 3):S15624–S15630

  24. Doyle JC et al (2005) The “robust yet fragile” nature of the Internet. Proc Natl Acad Sci USA 102:14497–14502

  25. Fairhall AL, Lewen GD, Bialek W, Van Steveninck RR (2001) Efficiency and ambiguity in an adaptive neural code. Nature 412:787–792

  26. Fariadian AB, Annaswamy AM, Woods DD (2016) Towards a resilient control architecture: a demonstration of bumpless re-engagement following an anomaly in flight control. In: Choi J-K, Anctil A (eds) Sustainable conoscente network. Proceedings of the international symposium on sustainable systems and Technologies (ISSN 2329-9169)

  27. Finkel M (2011) On flexibility: recovery from technological and doctrinal surprise on the battlefield. Stanford Security Studies, Palo Alto

  28. Hoffman RR, Woods DD (2011) Beyond Simon’s slice: five fundamental tradeoffs that bound the performance of macrocognitive work systems. IEEE Intell Syst 26(6):67–71

  29. Hollnagel E (2009) The ETTO principle: efficiency-thoroughness trade-off: why things that go right sometimes go wrong. Ashgate, Farnham

  30. Hollnagel E, Woods DD, Leveson N (eds) (2006) Resilience engineering: concepts and precepts. Ashgate, Aldershot

  31. International Risk Governance Center (2016) Resource Guide on Resilience. Ecole Polytechnique Federale de Lausanne and International Risk Governance Center (IRGC). v29-07-2016, Lausanne. https://www.irgc.org/

  32. Kirschner M, Gerhart J (2005) The plausibility of life. Yale University, New Haven

  33. Lansing JS, Kremer JN (1993) Emergent properties of Balinese water temples. Am Anthropol 95:97–114

  34. Mendonça D, Wallace WA (2015) Factors underlying organizational resilience: the case of electric power restoration in New York City after 11 September 2001. Reliab Eng Syst Saf 141:83–91

  35. Meyers LA, Bull JJ (2002) Fighting change with change: adaptive variation in an uncertain world. Trends Ecol Evol 17(12):551–557

  36. Miller A, Xiao Y (2007) Multi-level strategies to achieve resilience for an organization operating at capacity: a case study at a trauma centre. Cognit Technol Work 9:51–66

  37. Morison A, Murphy TB, Woods DD (2015) Human-robot interaction as extending human perception to new scales. In: Hoffman RR, Hancock PA, Scerbo M, Parasuraman R, Szalma JR (eds) Handbook of applied perception research, vol 2. Cambridge University Press, New York, p. 848–868

  38. Narendra KS, Annaswamy AM (2005) Stable adaptive systems. Dover Publications, Mineola

  39. Nemeth CP, Nunnally M, O’Connor M, Brandwijk M, Kowalsky J, Cook RI (2007) Regularly irregular: how groups reconcile cross-cutting agendas and demand in healthcare. Cogni Technol Work 9:139–148

  40. Ormerod P, Colbaugh R (2006) Cascades of failure and extinction in evolving complex systems. J Artif Soc Soc Simul. http://jasss.soc.surrey.ac.uk/9/4/9.html

  41. Ostrom E (2003) Toward a behavioral theory linking trust, reciprocity, and reputation. In: Ostrom E, Walker J (eds) Trust and reciprocity: interdisciplinary lessons from experimental research. Russell Sage Foundation, New York

  42. Ostrom E (2012) Polycentric systems: multilevel governance involving a diversity of organizations. In: Brousseau E, Dedeurwaerdere T, Jouvet P-A, Willinger M (eds) Global environmental commons: analytical and political challenges in building governance mechanisms. Oxford University Press, Cambridge, pp 105–125

  43. Park J, Seager TP, Rao PSC, Convertino M, Linkov I (2013) Integrating risk and resilience approaches to catastrophe management in engineering systems. Risk Anal 33(3):356–367. https://doi.org/10.1111/j.1539-6924.2012.01885.x

  44. Patterson MD, Wears RL (2015) Resilience and precarious success. Reliab Eng Syst Saf 141:45–53

  45. Patterson ES, Watts-Perotti JC, Woods DD (1999) Voice loops as coordination aids in space shuttle mission control. Comput Support Coop Work 8:353–371

  46. Perry S, Wears R (2012) Underground adaptations: cases from health care. Cogn Technol Work 14:253–260. https://doi.org/10.1007/s10111-011-0207-2

  47. Rieger CG (2010) Notional examples and benchmark aspects of a resilient control system. In: Proceedings of the IEEE, 3rd international symposium on resilient control systems (ISRCS); 2010. p. 64–71

  48. Robbins J, Allspaw J, Krishnan K, Limoncelli T (2012) Resilience engineering: learning to embrace failure. Commun ACM, 55(11):40–47. https://doi.org/10.1145/2366316.2366331

  49. Roth A (2008) What have we learned from market design? Hahn Lecture. Econ J 1818(March):285–310

  50. Scheffer M, Bascompte J, Brock WA, Brovkin V, Carpenter SR, Dakos V et al (2009) Early-warning signals for critical transitions. Nature 461(7260):53–59

  51. Seager TP, Clark SS, Eisenberg DA, Thomas JE, Hinrichs MM, Kofron R, Jensen CN, McBurnett LR, Snell M, Alderson DL (2017) Redesigning resilient infrastructure research. In: Linkov I, Palma Oliveira J (eds) Resilience and risk: methods and application in environment, cyber and social domains, Springer, Dordrecht

  52. Stephens RJ, Woods DD, Patterson ES (2015) Patient boarding in the emergency department as a symptom of complexity-induced risks. In: Wears RL, Hollnagel E, Braithwaite J (eds) Resilience in everyday clinical work. Ashgate, Farnham, pp 129–144

  53. Vespignani A (2010) Complex networks: the fragility of interdependency. Nature 464(7291):984–985

  54. Wark B, Lundstrom BN, Fairhall A (2007) Sensory adaptation. Curr Opin Neurobiol 17:423–429

  55. Wark B, Fairhall A, Rieke F (2009) Timescales of inference in visual adaptation. Neuron 61:750–761. https://doi.org/10.1016/j.neuron.2009.01.019

  56. Watts-Perotti J, Woods DD (2009) Cooperative advocacy: a strategy for integrating diverse perspectives in anomaly response. Comput Support Coop Work 18:175–198

  57. Wears RL, Woods DD (2007) Always adapting. Ann Emerg Med 50:517–519

  58. Wears RL, Perry SJ, Anders S, Woods DD (2008) Resilience in the Emergency Department. In: Hollnagel E, Nemeth C, Dekker SWA (eds) Resilience engineering perspectives 1: remaining sensitive to the possibility of failure. Ashgate, Aldershot, pp 193–209

  59. Woods DD (2005) Creating foresight: lessons for resilience from Columbia. In: Starbuck WH, Farjoun M (eds) Organization at the limit: NASA and the Columbia disaster. Blackwell, Malden, pp 289–308

  60. Woods DD (2006) Essential characteristics of resilience. In: Hollnagel E, Woods D, Leveson. N (eds) Resilience engineering: concepts and precepts. Ashgate, Aldershot, pp 21–34

  61. Woods DD (2015) Four concepts for resilience and their implications for systems safety in the face of complexity. Reliab Eng Syst Saf 141:5–9. https://doi.org/10.1016/j.ress.2015.03.018

  62. Woods DD (2016) The risks of autonomy: Doyle’s catch. J Cognit Eng Decis Mak 10(2):131–133

  63. Woods DD (ed) (2017) STELLA report from the SNAFU catchers workshop on coping with complexity. SNAFU catchers consortium, October 4, 2017, downloaded from stella.report 10/05/2017

  64. Woods DD, Branlat M (2010) Hollnagel’s test: being ‘in control’ of highly interdependent multi- layered networked systems. Cogn Technol Work 12:95–101

  65. Woods DD, Branlat M (2011) Basic patterns in how adaptive systems fail. In: Hollnagel E, Pariès J, Woods DD, Wreathall J (eds) Resilience engineering in practice. Ashgate, Farnham, pp 127–144

  66. Woods DD, Hollnagel E (2006) Joint cognitive systems: patterns in cognitive systems engineering. CRC Press/Taylor & Francis Group, Boca Raton

  67. Woods DD, Shattuck LG (2000) Distant supervision—local action given the potential for surprise. Cognit Technol Work 2:242–245

  68. Woods DD, Wreathall J (2008) Stress–strain plot as a basis for assessing system resilience. In: Hollnagel E, Nemeth C, Dekker SWA (eds) Resilience engineering perspectives 1: remaining sensitive to the possibility of failure. Ashgate, Aldershot, pp 145–161

  69. Woods DD, Chan YJ, Wreathall J (2013) The stress–strain model of resilience operationalizes the four cornerstones of resilience engineering. In: Proceedings of the fifth international symposium on resilience engineering, resilience engineering association. Download from The Knowledge Bank. Columbus OH; http://hdl.handle.net/1811/60454 June 2013. p. 25–7

  70. Zhou K, Doyle JC, Glover K (1996) Robust and optimal control. Prentice Hall, Englewood Cliffs

Download references


The development of the theory has benefited from reactions, both positive and negative, from many people engaged in debates about complexity, safety, and resilience. I would like to thank the Resilience Engineering communities and all of those who have invited me to discuss and speak on the theory for stimulating inter-disciplinary lines of inquiry to make risky systems less brittle and more resilient. This research is supported in part by funding from National Science Foundation, Grant No. 1549815 and Department of Transportation DTRT13-G-UTC47.

Author information

Correspondence to David D. Woods.

Rights and permissions

Reprints and Permissions

About this article

Verify currency and authenticity via CrossMark

Cite this article

Woods, D.D. The theory of graceful extensibility: basic rules that govern adaptive systems. Environ Syst Decis 38, 433–457 (2018). https://doi.org/10.1007/s10669-018-9708-3

Download citation


  • Resilience
  • Resilience Engineering
  • Complex adaptive systems
  • Human systems integration
  • Adaptability
  • Complexity
  • Socio-technical systems
  • Agility
  • Resilient control
  • Sustainability
  • Robust yet fragile
  • Resilient infrastructures