Designing for self-organisation in sociotechnical systems: resilience engineering, cognitive work analysis, and the diagram of work organisation possibilities

In designing sociotechnical systems, accounting for the phenomenon of self-organisation is critical. Empirical studies show that workers in these systems adapt not just their individual behaviours, but also their collective structures to deal with complex work environments. The concept of self-organisation can explain how such adaptations can be achieved spontaneously, continuously, and relatively seamlessly, and why this phenomenon is important for dealing with instability, uncertainty, and unpredictability in the task demands. However, existing design approaches such as resilience engineering and cognitive work analysis are limited in their capacity to design for self-organisation. This paper demonstrates that the diagram of work organisation possibilities, a recent addition to cognitive work analysis, provides a sound theoretical basis for designing for self-organisation. That is, it shows how essential components of the diagram are aligned with the concept of self-organisation and are well-grounded in empirical observations of adaptation in a variety of sociotechnical systems, specifically emergency management, military, and healthcare systems. Consequently, designs based on this diagram should have the potential to facilitate the emergence of new spatial, temporal, and functional organisational structures from the flexible actions of individual, interacting actors, thereby enhancing a system’s capacity for dealing with a dynamic, ambiguous work environment. Future research should focus on validating these ideas and demonstrating their value in industrial settings.


Introduction
In developing designs for sociotechnical systems, it is important to account for how work is achieved in complex settings, so that the fundamental bases of successful, or safe and productive, performance in these contexts are preserved by the designs. Accordingly, models of work, on which designs are based, must provide faithful representations of the phenomena of work in natural contexts. Otherwise, the resulting designs may compromise performance in the workplace, perhaps catastrophically, as many industrial accidents highlight Building on earlier work (Naikar 2018;Naikar and Brady 2019;, this paper develops the case that the phenomenon of self-organisation in sociotechnical systems is important for dealing with complex work environments and that, therefore, we must deliberately design systems to preserve their inherent capacities for self-organisation. First, this paper demonstrates that workers in sociotechnical systems adapt both their behaviours and structures in line with an evolving work environment and that the concept of self-organisation can provide a plausible explanation of how such adaptation occurs in these systems and why these processes are important for dealing with complexity in the task demands. Following that, this paper examines the capacity of two existing frameworks concerned with adaptation in the workplace, namely, resilience engineering and cognitive work analysis, to support the design of selforganising systems, observing that they have some limitations in this regard. Accordingly, this paper puts forward the 1 3 diagram of work organisation possibilities as a means for designing for self-organisation, demonstrating how critical components of the diagram correspond with the concept of self-organisation and are richly grounded in empirical observations of how work is achieved in a variety of complex settings. On this basis, it is argued that the diagram provides a solid theoretical foundation for design that is consistent with how the phenomenon of self-organisation manifests in these workplaces. Finally, this paper considers some key directions for future research in view of the goal of designing for self-organisation.

Adaptation
Undertaking work in sociotechnical systems is challenging because the task demands represent very complex problem spaces characterised by high levels of instability, uncertainty, and unpredictability (Naikar and Brady 2019;Vicente 1999;Woods 1988). Workers must contend with dynamic operating conditions, which means that their task demands may change or evolve constantly. For instance, the particular challenges posed by a wildfire to emergency management workers may vary continuously depending on the weather conditions, the areas to which the fire is spreading, and the habitation and infrastructure in those areas. Moreover, the task demands are characterised by significant uncertainty. In a naval context, imperfections in acoustic sensors may mean that the true underwater environment can never be established with certainty. Finally, the work environment is demanding because of its unpredictability. Workers may be faced with events that have not been, and cannot be, foreseen or specified fully a priori (e.g., Leveson 1995;Perrow 1984;Rasmussen 1969;Reason 1990;Vicente 1999). Examples of such events include a novel military threat (Herzog 2011;Reich et al. 2010), an unexpected reaction of a patient to an anaesthetic during a surgical procedure (Hoppe and Popham 2007), and an unanticipated chain of supplier collapses triggered by a natural disaster (Park et al. 2013).
Given these characteristics of the work environment, adaptation in the workplace is critical (Rasmussen 1986;Rasmussen et al. 1994;Vicente 1999). Workers cannot rely solely on fulfilling their job demands by implementing well-established procedures or stable task sequences or by applying familiar solutions that have worked on prior occasions. Instead, workers must be capable of continuously and reliably fine-tuning their actions to the local context, to achieve a proper balance between competing safety and productivity imperatives. Moreover, when dealing with unusual or unforeseen events, workers may have to demonstrate considerable ingenuity, so that novel work patterns may be created in the circumstances.
Empirical studies demonstrate that workers in sociotechnical systems adapt not just their individual behaviours, or actions, but also their collective structures, or relationships, in response to evolving work demands (Naikar and Brady 2019;Naikar and Elix 2016b). Such adaptations have been observed in a variety of domains, including emergency management (e.g., Bigley and Roberts 2001;Lundberg and Johansson 2015;Lundberg and Rankin 2014), military (e.g., Militello et al. 2015;Rochlin et al. 1987), and healthcare (e.g., Barth et al. 2015;Bogdanovic et al. 2015).
In a field study of emergency management, specifically of a large fire department, Bigley and Roberts (2001) observed that workers frequently adapt their behaviours, demonstrating flexibility in the application of tools, rules, and routines. When a fire truck arrives at the scene of an incident, workers often have no choice but to improvise with the tools available on the truck to handle the emergency. In addition, workers may find it necessary to breach standard operating procedures or rules. As an example, a fire fighter described a situation in which 'opposing hose streams' was used as the primary tactic for a rescue operation, despite the fact that this procedure is prohibited because one group can push the fire into another. Third, the execution of standard routines, such as those for 'hose laying' or 'ladder throwing', also may be tailored to specific circumstances.
Similarly, in a field study of naval aircraft carriers, Rochlin et al. (1987) observed considerable flexibility in the work structure. The formal organisation of the aircraft carrier is rigid, hierarchical, and centralised, with clear chains of command and means to enforce authority, and much of the time, this structure governs operations on a ship. However, the informal organisation, which is revealed during complex operations, is flat and distributed. For instance, lower ranked personnel can make critical decisions without the approval of officials with higher rankings, given that events on the flight deck can occur too quickly for appeals through a chain of command. The work organisation is flexible, as there is no pre-specified plan for when the shifts in structure will occur. Moreover, the informal structure is emergent, as there is no simple, fixed mapping between people and roles. Instead, the work organisation varies as a function of the circumstances.

Self-organisation
Drawing on empirical studies, the preceding section demonstrates that adaptations in sociotechnical systems can be observed at two levels-in the behaviours of individual actors and the structures of multiple actors. In this context, it is proposed that the concept of self-organisation is important. This concept can explain how adaptations in actors' behaviours and structures can be achieved spontaneously, continuously, and relatively seamlessly, particularly in wellestablished systems, and why this process of self-organisation is necessary for dealing with instability, uncertainty, and unpredictability in the task environment (Naikar 2018;Naikar and Brady 2019;. Accordingly, the phenomenon of self-organisation has significant implications for design. Specifically, the concept of self-organisation (e.g., Haken 1988;Heylighen 2001;Hofkirchner 1998), when analysed in the context of sociotechnical systems (Naikar 2018;Naikar and Brady 2019;, suggests that a system's structure may limit its response in ways that are unsuitable or ineffective in particular situations (Fig. 1). Nevertheless, individual, interacting actors may engage in spontaneous behaviours, in view of the local conditions, from which a novel structure emerges that enables the system to respond satisfactorily in the circumstances. The new structure may remain appropriate for a time in that it constrains and enables actors' behaviours in ways that are suited to the conditions, until the situation alters in some fundamental respect and the flexible actions of individual, interacting actors result in further structural variations.
The interplay between the structures of multiple actors and the behaviours of individual actors is integral to the process of a system adapting to its environment. The structures constrain and enable actors' behaviours as well as emerge from their behaviours in ways that become fitted to the circumstances. Thus, structural properties, which are observed at the system level, vary with the behaviours of individual, interacting actors, and vice versa. Actors' behaviours and structures then are closely interconnected, or correlated, and vary continuously in ways that become fitted, or adapted, to the demands of a constantly evolving work environment.
The processes of self-organisation in sociotechnical systems are not without its challenges and may not be regarded as perfect or flawless, at least when considered against normative benchmarks (Naikar and Brady 2019). That is, actors' performance may be judged as falling short if it is assessed against idealised task sequences or goals. On the other hand, their performance may be regarded as reasonable or sufficient, and perhaps even critical or masterful, if it is assessed in terms of the spontaneity demanded of them in the circumstances, which may be unfamiliar or unforeseen. For example, Lundberg and Rankin (2014) found that although role improvisations by workers in crisis response teams sometimes meant that jobs were performed less effectively or efficiently compared with specialists performing the same roles, the spontaneous arrangements were regarded as being better than having nobody performing the work or having workers sitting idle. Moreover, many sociotechnical systems are regarded as high-reliability organisations (La Porte 1996;Rochlin 1993;Weick and Sutcliffe 2001) because of their capacity to balance safety and productivity goals continuously in the face of considerable instability, uncertainty, and unpredictability. Clearly, then, the processes of self-organisation can be relatively seamless, particularly in systems that are well-established, and the fact is they are necessary. Critical events can occur too quickly and conditions can be too unstable, uncertain, and unpredictable for alternative strategies, such as a priori planning, centralised coordination, or external intervention, to be feasible always. Instead, flexibility and adaptation are required to resolve-in time and in situ-the "proper, immediate balance" between a system's safety and productivity imperatives (Rochlin et al. 1987, pp. 83-84).
The phenomenon of self-organisation, therefore, has significant implications for the design of sociotechnical systems. Designs focused either on behaviour or on structure will not be sufficient. That is, designs concerned primarily with the behaviours of individual actors may have undesirable consequences for the structural configurations of multiple actors, and the converse is also true (cf. Fig. 1). Instead, designs must be conceived in the context of both actors' structures and behaviours-in an integrated manner-if we are to recognise that self-organisation occurs in sociotechnical systems and that this phenomenon is important for dealing with change and ambiguity in the work environment.

Existing design frameworks
Existing frameworks concerned with promoting adaptation in sociotechnical systems have the potential to support the design of self-organising systems. Two such frameworks are resilience engineering and cognitive work analysis (CWA). In the following discussion, the strengths and limitations of these frameworks for designing for self-organisation are examined.

Resilience engineering
Resilience engineering is a paradigm for safety management in complex systems (Hollnagel et al. 2011; Hofkirchner 1998, with permission) 2006), which appears to integrate ideas from a number of different fields or perspectives. Some (e.g., Costella et al. 2009;Moorkamp et al. 2014) consider the framework to have roots in Jens Rasmussen's ideas (e.g., Rasmussen 1986;Rasmussen et al. 1994) about the importance of adaptation in managing uncertainty in work settings. Others (e.g., Hale and Heijer 2006;Hopkins 2009Hopkins , 2014 recognise the influence of the work of organisational theorists, such as Roberts (1990), Rochlin (1993), La Porte (1996), and Weick and Sutcliffe (2001), on high-reliability organisations.
A recent inspection of 60 journal papers on resilience engineering, which were published between 2006 and 2017, showed that almost all adopted a definition of resilience that encompassed the concept of adaptation , signifying that research on resilience is concerned fundamentally with adaptation and, therefore, could provide a basis for designing for self-organisation. However, so far, this research appears to have placed little emphasis on design. In a systematic review of this literature by Righi et al. (2015), which encompassed 237 studies published between 2006 and 2014, design was not identified as a research category in its own right. Instead, the majority of research focused on theory, or on understanding and describing the concept of resilience, with some of the studies in this category based on empirical data.
Empirical studies of sociotechnical systems can be useful for both theory and method development, as they may offer a rich understanding of how effective performance is achieved in complex settings. However, descriptive methods may not provide a suitable basis for design. As Vicente (1999) argues, when applied to individual cases, such methods result in designs that accommodate specific work practices observed under particular conditions. By definition, these are conditions that have been experienced, even if they were novel when they occurred. At best, these methods may be extended to conditions that can be anticipated. Thus, the capacity of resulting designs to promote effective performance in unforeseen situations, or situations that cannot be fully predicted a priori, is limited by the extent to which observed or anticipated practices are relevant to novel conditions. References to self-organisation in the resilience-engineering literature are uncommon. Some exceptions are the reports of Lundberg and Johansson (2015) and Lundberg and Rankin (2014), who refer to self-organisation in providing a descriptive account of the improvisations of Swedish emergency management workers in responding to crisis situations. This study provides detailed insight into some of the strategies and challenges for self-organisation observed in two major incidents. However, as noted above, deriving insights for design from limited cases may be problematic.
Some researchers have examined resilience-engineering methods, which could be used as a basis for design, for their capacity to account for self-organising systems. A substantial analysis is provided by Moorkamp et al. (2014), who focus their assessment on the functional resonance analysis method, or FRAM (Hollnagel 2012), as an exemplar of the resilience-engineering approach. This method seeks to describe a system in terms of its functions or activities; to examine the performance variability associated with particular functions and with couplings of functions, or resonating functions, when the system is in a specific state; and to propose ways of managing the performance variability identified. Moorkamp et al. call attention to the fact that FRAM focuses on describing a system's functions independently of its structure. According to Hollnagel and Goteman (2004), this approach is taken because representations of a system's structure would necessarily signify a normative arrangement of functions, which is not how many organisations are structured in reality. However, Moorkamp et al. point out that an approach that examines a system's functions independently of the structures required for conducting those functions ignores the relevance of interactions between actors, or social interactions, for design. Moreover, it seems that in actual applications of FRAM (e.g., Hollnagel and Goteman 2004;Praetorius et al. 2015), the analysis of functions is not in fact independent of structure. Rather, assumptions of structure appear necessary, so that in Hollnagel and Goteman's study, the existing organisational structure was considered to be "acceptable as it is" (p. 160). Therefore, Moorkamp et al. contend that FRAM cannot accommodate systems with dynamic work organisation or self-organising systems.

Cognitive work analysis
CWA is concerned with the analysis, design, and evaluation of work in complex sociotechnical systems, with the goal of fostering safety, productivity, and workers' health (Rasmussen et al. 1994;Vicente 1999). Given its formative orientation, this framework defines the constraints that must be respected by actors in a range of circumstances, including those that cannot be predicted a priori, for effective performance. Within these constraints, actors still have many degrees of freedom for action. Therefore, designs tailored to these constraints can provide workers with the flexibility to adapt their work practices to a variety of situations, even those that have not been previously observed or anticipated, without crossing the boundaries of effective performance. The five dimensions of CWA address different types of constraint, specifically those pertaining to the work domain (work domain analysis); activity (activity analysis); strategies (strategies analysis); work organisation (social organisation and cooperation analysis); and workers (worker competencies analysis).
Significant evidence exists for the value of CWA for design, including an extensive body of experimental investigations that demonstrates that ecological interfaces lead to better performance by workers than do conventional displays (Vicente 2002) and detailed industrial case studies that show that CWA can be used for designing teams and training systems that promote flexibility (Naikar 2013). However, although it is clear that CWA can lead to designs that foster adaptation and the standard texts on CWA (Rasmussen et al. 1994;Vicente 1999) recognise the importance of selforganisation in sociotechnical systems , this very phenomenon draws attention to the fact that the standard framework may result in designs that restrict a system's capacity for adaptation relative to its inherent capacity.
Specifically, as CWA has the intent of accommodating worker adaptation in a broad range of situations, including novel or unforeseen events, work domain analysis, one of the most powerful features of the framework, offers an eventindependent representation of a system's work demands, or constraints. Furthermore, activity analysis and strategies analysis are concerned with the work demands of recurring classes of situation, rather than particular events or circumstances. All three dimensions of analysis are deliberately kept independent of specific actors, so that collectively, the three dimensions model the constraints inherent to the work context, capturing the action possibilities afforded by the environment, whether in novel or recurring circumstances.
Nevertheless, by definition, sociotechnical systems have very large and complex problem spaces (Naikar and Brady 2019;Vicente 1999;Woods 1988), so that many, and often numerous, actors are necessary for dealing with the range of work demands. This means that, at some point, it is necessary to take account of how a system's work demands can be distributed across actors, so that within the CWA framework, the value of the first three dimensions may be limited by social organisation and cooperation analysis, the fourth dimension. In this dimension, the work demands of the system are distributed across actors in a way that is restricted to recurring classes of situation, so that unforeseen events may not be accommodated (Naikar and Elix 2016a, b). In addition, the analysis may be limited even further to organisational structures that have been observed or are judged to be reasonable in these situations, so that other feasible structures may be excluded. As a result, the standard framework does not account for the range of work organisation possibilities in a system, especially those that may emerge in unforeseen circumstances.
A clear consequence of the standard framework, therefore, is that it limits unnecessarily the structures of multiple actors in a system. However, the phenomenon of self-organisation draws attention to the fact that this framework may limit the behaviours of individual actors as well. As highlighted in Fig. 1, in self-organising systems, the structures of multiple actors constrain and enable the behaviours of individual actors, as well as emerge from their behaviours. Accordingly, by limiting the structural possibilities of actors in a system, the standard framework may restrict actors' behavioural opportunities as well, thereby ultimately compromising a system's capacity for self-organisation-or means by which a system adapts to its work environment.

Diagram of work organisation possibilities
The diagram of work organisation possibilities is a modelling tool that was recently proposed as an extension to CWA (Naikar and Elix 2016a, b). In an earlier paper , the relevance of this diagram for designing for selforganisation was considered. This paper further analyses the relationship between the work organisation possibilities diagram and the phenomenon of self-organisation, as it manifests in sociotechnical systems. It deconstructs the diagram into its constituent parts to demonstrate in greater depth how these are aligned with the concept of self-organisation. In addition, it shows how each component is wellfounded in empirical observations of adaptation in a variety of sociotechnical systems. In that the diagram corresponds with the concept of self-organisation, and is richly supported by empirical observations, it is argued that this modelling tool provides a sound theoretical basis for designing for self-organisation.

Description of work organisation possibilities diagram
The work organisation possibilities diagram accommodates the set of possibilities for work organisation in a system, irrespective of particular events or circumstances (Fig. 2). This diagram is produced by defining the constraints on the possibilities for work organisation, or organisational constraints,  (Naikar and Elix 2016b) 1 3 rather than by specifying the possibilities themselves. The organisational constraints are limits on the distribution of the work demands of the environment across actors (i.e., human workers and automation), which cannot be broken under any circumstances, even those that cannot be foreseen or anticipated. Thus, these limits differentiate distributions that are possible or acceptable from those that are never suitable. Nevertheless, within these constraints, there are usually numerous possibilities for work organisation. For instance, in the case of a future military system for airborne maritime surveillance, the number of structural possibilities was calculated to be roughly in the order of 10 27 (Naikar and Elix 2016b). The work organisation possibilities diagram is developed within the fourth dimension of CWA, namely, social organisation and cooperation analysis (Naikar and Elix 2016b). As indicated above, the diagram shows the organisational constraints, or limits on the distribution of the work demands of the environment across actors. For instance, Fig. 2 shows that work demand 1 is limited to actors A and C, whereas work demand 3 is limited to actor B; these are examples of organisational constraints. The work demands of the environment, or environmental constraints, are defined in the first three dimensions of CWA, specifically work domain analysis, activity analysis, and strategies analysis. The terms 'constraint' and 'work demand' are used interchangeably in CWA (Vicente 1999), as constraints place demands on actors by defining boundaries that must be respected in their actions for effective performance. Accordingly, the constraints collectively demarcate a field of possibilities for successful action.
Once the work demands of the environment have been identified using one or more of the first three CWA dimensions (Naikar 2017;Naikar and Elix 2016b), the set of possibilities for work organisation in a system is circumscribed by utilising a number of criteria, which have been found to govern shifts in work organisation dynamically in sociotechnical systems (Rasmussen et al. 1994;Vicente 1999), to define the organisational constraints. As observed by Naikar and Elix (2016b), the criteria also rule out certain organisational structures outright. Specifically, these criteria relate to the need for compliance with policies or regulations; the requirements for safety and reliability; the access actors have to information or controls; and the need for feasible coordination demands, competencies, and workload.
As an example, in the case of the future maritime surveillance aircraft mentioned above, the criterion of compliance limits the captaincy of the aircraft to one of the flying crew, rather than the tactical crew. Therefore, those work demands requiring the captain's authority, such as the arming of weapons, must be limited to one of the flight deck actors. Similarly, the safety and reliability criterion constrains the work demands of piloting the aircraft to two flight deck actors, even though this responsibility could be undertaken by a single actor. The criterion of access to information or controls limits the work demands associated with sighting targets to actors on the flight deck and at observer stations in the aircraft's cabin, who have access to windows. In addition, this criterion constrains the work demands associated with detecting, tracking, and identifying targets with any of five sensors to actors at six workstations in the cabin. Finally, while the coordination criterion could constrain the operation of all of the sensors to a single actor, the requirements for feasible competencies and workload would result instead in the distribution of these work demands to more than one actor.
Ultimately, this process of applying the criteria to the environmental work demands to identify the limits on their distribution, or organisational constraints, results in a diagram of work organisation possibilities for the actors in the system. Figure 3 presents a modified version of the resulting diagram for the future maritime surveillance aircraft, which depicts its organisational constraints, and thus how the work demands of this system can be distributed across flight deck actors, observer station actors, and workstation actors. The actual version of this diagram cannot be reproduced here because of organisational restrictions. However, the conceptual and methodological nuances of the diagram are discussed in depth by Naikar and Elix (2016a, b) and a step-by-step procedure and case study of the application of the diagram to design are described by Elix and Naikar (2019); see also Naikar (2017Naikar ( , 2018 and Naikar and Brady (2019). The critical features of the diagram with respect to the self-organisation phenomenon are considered in the following discussion.

Relationship of work organisation possibilities diagram to self-organisation
The organisational constraints encapsulated in a work organisation possibilities diagram establish relationships between the action possibilities afforded by the work context, or the environment in which actors are situated, and the actors themselves. Therefore, whereas the three earlier dimensions of CWA identify the action possibilities of the work context without consideration of specific actors, the diagram reveals the relationships between those action possibilities and the actors (Fig. 4). As a result, the diagram simultaneously portrays the action possibilities of the work context at the levels of the behaviours of individual actors and the structures of multiple actors (Fig. 5) in a manner that is compatible with the phenomenon of self-organisation in sociotechnical systems (cf. Fig. 1).
The following sections develop this argument in more depth by demonstrating how key features of the diagram are aligned with the concept of self-organisation and are 1 3 well-founded in empirical evidence. Detailed case studies involving field observations and interviews of personnel in emergency management, military, and healthcare systems are drawn on for this purpose. The future maritime surveillance aircraft discussed above could not be utilised in this way, since observations cannot be conducted of a system that does not yet exist. However, the work organisation possibilities diagram for this aircraft (Fig. 3) is used in the following discussion to demonstrate that this modelling tool can accommodate the kinds of adaptations in workers' behaviours and structures observed in existing systems, signifying that this tool is well-grounded empirically.

Behaviours of individual actors
The work organisation possibilities diagram models the behaviours of individual actors in a way that is consistent with the concept of self-organisation in sociotechnical systems. Specifically, this diagram recognises that actors in sociotechnical systems engage in spontaneous action or action that is closely fitted to evolving circumstances, which cannot be fully specified a priori (Naikar and Brady 2019). Sometimes, significant shifts or improvisations in behaviour may be necessary, for instance, when dealing with novel or unforeseen situations. Otherwise, ongoing, open-ended fine-tuning of behaviours is essential to accommodate the inevitable flux of everyday work. Such behavioural spontaneity occurs in view of a system's constraints, or boundaries on safe and productive action, whether these are based in social values, such as organisational goals, or in natural laws, such as those governing technical, physical, or biological processes.
For example, in Bigley and Roberts's (2001) field study of emergency management, which was mentioned earlier in this paper, it was observed that workers may employ tools in novel ways, execute and coordinate routines in different ways, and even violate standard operating procedures if it is necessary in the circumstances. In fact, most of the fire fighters described cases when they found it necessary to breach procedures. Workers, therefore, have considerable discretion to adapt their actions to local conditions, and a captain remarked that every incident may require a different approach because of its unique characteristics. Bigley and Roberts observed that the improvisations are regarded as legitimate within the system provided they are consistent with organisational goals and are unlikely to harm personnel or other people.
Similarly, in a study of surgical teams, Bogdanovic et al. (2015) found that the situational variability inherent to surgical practice requires team members to behave adaptively. Although planning takes place primarily on the day before surgery, specific details of the patient's state, such as the condition of blood vessels or amount of damage to cartilage, can only be determined during the procedure. Furthermore, although potential challenges may be anticipated and planned for in advance, unforeseen complications may arise during surgery, such as anaesthetic problems, the presence of tumours or infection, or the accidental cutting of a blood vessel. Consequently, the surgical plan may be fine-tuned throughout surgery and even modified significantly or formulated anew. If the patient's condition is deteriorating, for instance, tasks to stabilise the patient will become the priority over continuing with the procedure. Decisions during surgery are influenced by a variety of considerations including the patient's condition and the corresponding constraints on the amount of operative time, blood loss, and pain the patient can sustain; the limits of equipment functionality; and the need to fulfil interns' training requirements while ensuring patient safety.
In the same way, in a field study of naval aircraft carriers, which was mentioned earlier in this paper, Rochlin et al. (1987) observed considerable flexibility in the organisation's day-to-day performance, with tasks, procedures, and missions executed with significant discretion. Even the same formal assignment varies depending on its local context. In addition, Rochlin et al. found that shore-based training only provides personnel with basic instruction and generalised guidelines and that although rules and procedures present boundaries to prevent actions known to have adverse consequences, these frameworks do not provide guidance for optimal action. Rochlin et al. concluded that increased standardisation "would be difficult to obtain, and perhaps not even wise" (p. 101). Flexibility on these ships is a key mechanism for balancing the requirements between preserving safety and reliability, which impose "fixed boundary conditions" on performance, and attaining maximum operational efficiency and combat effectiveness (p. 102).
In line with the preceding observations, the work organisation possibilities diagram represents the behaviours of individual actors in the form of a constraint-based space within which actors have many degrees of freedom for action. In Fig. 5, the constraint-based space of each actor is demarcated by a set of work demands that are inherent to the work context, or environmental constraints, which are defined in the first three CWA dimensions. These constraints place limits on behaviour in that they must be respected by actors, irrespective of the situation. However, the constraints do not uniquely specify the behaviours of actors, so that   within those constraints, actors still have many possibilities for behaviour. Consequently, actors may safely and productively engage in spontaneous action in fulfilling the work demands of the system without violating the boundaries of effective performance. Thus, the diagram reveals the action possibilities of the work context at the level of the behavioural opportunities of individual actors.
In the case of the future maritime surveillance aircraft discussed above, the behavioural spaces of actors at the two flight deck stations encompass the constraints of flight; navigation; weapons authorisation; weapons release; tactical communications; air traffic control communications; observations of targets; detection, tracking, and identification of targets; mission planning; and so on (Fig. 3). These work demands collectively necessitate certain kinds of behaviours, but within these constraints, there is considerable freedom for spontaneous action. Therefore, in routine situations, pilots may follow pre-specified procedures for navigating the aircraft to a target without any exceptions, but under significant time pressure, certain tasks may be 'shed' (Goteman and Dekker 2001) or postponed or offloaded to other actors. Furthermore, even in 'everyday'  or recurring situations, minor fluctuations in the environmental conditions may produce relatively different behavioural patterns. For instance, the durations of behaviours and the ways in which behaviours are interleaved or sequenced may vary considerably as a function of the local conditions, without violating the constraints of the system.

Structures of multiple actors
The work organisation possibilities diagram also models the structures of multiple actors in a way that corresponds with the concept of self-organisation in sociotechnical systems. That is, the diagram recognises that, in sociotechnical systems, there is usually no single, best way of organising work. Instead, structural flexibility is necessary for dealing with the requirements of a range of situations, including unforeseen events. Accordingly, actors in sociotechnical systems may spontaneously exhibit many different structural forms or configurations, some of which may not have been anticipated or observed previously, in line with local contingencies.
In Rochlin et al.'s (1987) study of naval aircraft carriers, it was observed that the work organisation on these ships shifts between formal and informal structures as a function of operational demands. Moreover, the work organisation is flexible, in that there is no pre-specified plan for when these shifts will occur, and the informal structures exhibited are emergent, in that they do not reflect a simple or fixed mapping between people and roles. Many high-ranking officers and senior personnel can perform several tasks other than those for which they are normally responsible and, therefore, can perform alternative tasks in an emergency. Hence, rapid transitions in roles and authority can, and do, occur in response to changing tactical circumstances. Rochlin et al. argue that no one, not even Navy personnel with extensive carrier experience, could "lay out all the relationships and interdependencies, let alone the criticality and time sequence of all the individual tasks" (p. 100). Similar findings were obtained by Bigley and Roberts (2001) in their field study of the fire department. Although this system is highly formalised and hierarchically organised, with an extensive set of rules, policies, procedures, and instructions, this rigid organisational structure is rapidly converted into highly flexible configurations suited to specific emergencies through a number of mechanisms, which Bigley and Roberts called structure elaborating, role switching, authority migrating, and system resetting. Structure elaborating involves assembling an organisation at the scene of an incident with the first captain arriving becoming the incident commander, at least temporarily, and allocating roles and tasks to inbound resources. Pre-existing positions are only populated with people to the extent necessary in the circumstances, and personnel may be responsible for multiple functions, rather than having specialised roles. Role switching also occurs, whereby personnel are moved into different positions or discharged, as does authority migrating, whereby informal decision-making authority passes to personnel possessing the most relevant expertise given the specific problem characteristics. Finally, system resetting involves disengaging from the task environment so that the team can be reconfigured or redirected, for instance, if the current strategy appears ineffective or if an unexpected event is encountered. As Bigley and Roberts observe, "The organisational approach must continually map to the requisite variety of a dynamic and risky situation… with hazardous task contingencies that may not have been previously experienced or predicted" (p. 1286).
Likewise, in their study of surgical teams, Bogdanovic et al. (2015) found that the task distribution varies as a function of specific occurrences during surgery. Although the general distribution is established prior to surgery, based on such criteria as team members' professions, levels of training, and experience, tasks that can be fulfilled by any person are not pre-assigned, but are assumed ad-hoc throughout the procedure depending on situational demands. In addition, team members may undertake tasks beyond their professional demarcations to manage the workload within the group. For example, the anaesthetist may assist the scrub nurse if the circulating nurse is occupied with other tasks. Moreover, the planned distribution is assessed constantly and changed if necessary, for instance, if the team experiences flow disruptions or perceives stress in one of its members, if there are deviations from the intended procedure, or if complications arise for which a team member does not 1 3 possess the necessary skills. Thus, a senior physician may take over a step of a procedure initially assigned to an intern, tasks may be swapped between team members depending on their levels of experience, or a clinician on standby may be called into the team. Finally, Bogdanovic et al. found that the leadership is adaptable as well, varying according to situational occurrences, including the different phases of a procedure. If the patient is in pain, for example, an anaesthetist may take the lead from a surgeon, subsequently delegating tasks to the surgeon and stopping the procedure if necessary.
To account for such observations of the nature of work practice in sociotechnical systems, the work organisation possibilities diagram models the structures of multiple actors in the form of the set of possibilities for work organisation in a system irrespective of the circumstances. The set of possibilities are demarcated by defining the constraints on the possibilities, rather than by specifying the possibilities themselves, which are generally innumerable. As a simplified illustration, Fig. 5 shows that actors B and C can each take responsibility for work demand 4, which collectively signifies constraints on the possibilities for work organisation. Given these constraints, the fundamental possibilities are that actor B has this responsibility, actor C has this responsibility, or actors B and C share this responsibility. While the organisational constraints are relevant regardless of the situation, the structural possibilities that are enacted will depend on local details, which usually cannot be fully specified a priori, such that the problem can only be resolved in situ by actors. Thus, the task distribution will vary as a function of the circumstances, perhaps with novel or previously unobserved structural forms demonstrated. In this way, the diagram signifies the action possibilities of the work context at the level of the structural possibilities of multiple actors.
In the case of the future maritime surveillance aircraft, the work organisation possibilities diagram portrays that each of the six workstation actors can be involved in several work demands including mission planning; aircraft positioning; sensor management; stores management; detection, tracking, and identification of targets; and tactics (Fig. 3). Accordingly, there are numerous possibilities for how these work demands might be distributed across the six actors, so that the work organisation may shift or vary spontaneously in line with the situational demands. For instance, it may be the case that a single actor is typically responsible for mission planning, aircraft positioning, and sensor management, but in situations involving high workload for this actor, some of these responsibilities may be shared with, or offloaded to, one or more of the other workstation actors. Furthermore, the responsibility for mission planning, as an example, may be assumed by one or more of the actors at the observer stations and flight deck stations as well, so that the possibilities are considerably greater if the full set of stations on the aircraft is considered. As noted above, the structural possibilities for this aircraft were calculated roughly to be in the order of 10 27 .

Interconnection between actors' behaviours and structures
The work organisation possibilities diagram models the relationship between actors' behaviours and structures in a manner that corresponds with the concept of self-organisation in sociotechnical systems. Specifically, the diagram accommodates the idea that the structures of multiple actors emerge from the flexible behaviours of individual, interacting actors, as well as constrain and enable their behaviours, in ways that are fitted to the circumstances. Furthermore, the emergent structural forms may exhibit new spatial, temporal, or functional properties. In Bogdanovic et al.'s (2015) study of surgical teams, it was observed that team members may undertake tasks beyond their professional boundaries to balance the workload within the group, so that the anaesthetist may assist the scrub nurse if the circulating nurse is busy with other tasks. Therefore, a new functional structure emerges from this spontaneous behaviour, which allows the circulating nurse to continue with the current activities, but removes the anaesthetist from his or her standard duties, such that this structure constrains and enables actors' behaviours, while it remains in place. Similarly, incidental findings during surgery often require strategic changes to the surgical plan. As a result, the surgeon may interrupt the procedure, perhaps to reformulate the next steps with the team or to seek the advice of a more experienced clinician, so that different temporal relationships among actors emerge as a consequence. New spatial structures also may be manifested, for instance, as a result of team members offering or requesting assistance during the procedure. Examples include team members passing equipment to colleagues, assisting with re-positioning the patient, offering the surgeon a chair, or fetching equipment or medication from outside the operating room.
In Rochlin et al.'s (1987) study of naval aircraft carriers, several observations highlight that the flexible actions of crew can give rise to different structural forms within the organisation, sometimes shifting it from strongly hierarchical to relatively flat. For example, under exacting time constraints, low ranking officers can make significant decisions without first clearing it with their superiors. Furthermore, many personnel are familiar with several tasks other than those they are expected to perform normally, such that they can carry out alternative tasks if necessary. In addition, units on the ship tend to operate below their full capacity. Therefore, if a unit fails or becomes unavailable, its tasks can be readily transferred to other units without overloading them excessively. Alternatively, reserves may be mobilised to pick up tasks.
Finally, in Bigley and Roberts's (2001) field study of emergency management, new functional structures are demonstrated in a variety of ways, for example, when the first captain at the scene of an emergency becomes the incident commander and starts delegating roles and tasks to incoming resources. Personnel accept the resulting leadership roles and organisation, such that the active structural form shapes their behaviours accordingly. In addition, new functional structures are created as a result of incident commanders delegating authority for performing certain functions to other personnel or workers finding it necessary to take immediate action without instruction from their supervisors. Similarly, new spatial or temporal structures may emerge from actors' flexible behaviours. For instance, the use of 'opposing hose streams' to fight a fire, contrary to standard operating procedures, represents a spatial structure in which teams approach a fire from facing positions. In addition, ongoing adjustments in the coordination of standard routines to accommodate unexpected occurrences, such as fine-tuning the routines for fighting a fire from inside a building while ventilating it from the outside in the case of a peculiar building construction, may constantly renew the temporal relationships among actors.
The work organisation possibilities diagram accommodates this interplay between actors' behaviours and structures by representing the behavioural opportunities of individual actors and the structural possibilities of multiple actors within a single, integrated model. As a simplified example, Fig. 5 shows that the behavioural spaces of both actors A and C, though not B, encompass work demand 1. Therefore, some of the structural forms that may emerge from these behavioural opportunities are: actor A is engaged in behaviours relating to work demand 1, while actors B and C are occupied in other behaviours; actor C is involved in behaviours relating to work demand 1, while actors A and B are engaged in other behaviours; or both actors A and C are occupied in behaviours relating to work demand 1, while actor B is involved in other behaviours.
The structural forms constrain and enable the behaviours of individual actors, as well as emerge from their behaviours. Accordingly, when the first structural form is in place, only actor A may be observed to be engaged in behaviours relating to work demand 1, whereas when the third structural form is active, both actors A and C may be observed to be involved in such behaviours. However, all of the structural forms are possible. Therefore, depending on local contingencies, the structural forms may vary in accordance with the spontaneous behaviours of individual actors. For instance, the first structural form may be in place routinely, constraining and enabling actors' behaviours in ways that are shaped by the circumstances, so that only actor A is seen to be engaged in behaviours relating to work demand 1. However, if the circumstances change sufficiently, so that it is necessary or beneficial for actor C to assist actor A with work demand 1, then a different structural form emerges from this flexible behaviour, which may remain in place until the situation changes further.
In the case of the future maritime surveillance aircraft, the work organisation possibilities diagram shows that the behavioural opportunities in relation to the work demand of navigation specifically are available to actors at the two flight deck stations as well as to actors at the two observer stations and six workstations in the aircraft's cabin (Fig. 3). Accordingly, the emergent structural forms in relation to this function may encompass any one or more of the actors at these stations on the aircraft, with the active structural form varying opportunistically as a function of the circumstances and constraining and enabling actors' behaviours accordingly. Similarly, the behavioural opportunities in sighting targets out of a window are limited to actors located at the two flight deck stations and two observer stations. However, if there is an equipment failure, so that the actors at the six workstations can no longer use some of the sensors for detecting, tracking, or identifying targets, then some of these actors might relocate to the stations with a window to increase the chances of sighting the target. Thus, the emergent structural forms may exhibit new spatial properties as well as temporal or functional characteristics, and shape actors' behaviours accordingly. For instance, if one of the workstation actors who relocates to an observer station or flight deck station is the commander of the mission, then some of the tasks for employing the aircraft tactically may shift temporarily to one of the remaining workstation actors, with the other actors also still at the workstations assisting this actor with his or her original responsibilities, while the new structure is in place.

Design
The preceding discussion demonstrates that the work organisation possibilities diagram models actors' behaviours and structures within a single, integrated representation in a manner that is compatible with the phenomenon of selforganisation in sociotechnical systems. Therefore, the diagram provides a means for accommodating this phenomenon in design. Accordingly, designs based on this diagram should facilitate the emergence of novel temporal, spatial, or functional structures from the flexible behaviours of individual, interacting actors, with the structures also constraining and enabling actors' behaviours, in ways that become fitted to the circumstances. Consequently, the system should have greater capacity for adapting to a continually evolving task environment.
Specifically, designs based on the work organisation possibilities diagram should have the intent of accommodating the system's organisational constraints, so that actors' full set of possibilities for behavioural spontaneity and structural flexibility is retained. In other words, the aim is to preserve 1 the action possibilities afforded by the work context at the levels of both actors' behaviours and structures. As these work organisation possibilities are derived from the constraints of the system, or boundaries on safe and productive action, this design approach has the overarching philosophy of providing actors with constrained flexibility in the workplace, so that the system's inherent capacity for effective self-organisation can be preserved.
As an example, interface designs should seek to accommodate the information requirements associated with the full range of work demands, or constraints, relevant to each actor, as revealed in a work organisation possibilities diagram, rather than restricting them unnecessarily to a comparatively narrow range of tasks based on idealised, observed, or anticipated jobs or roles. Designs that incorporate effectively the information requirements of the set of work organisation possibilities should support actors in shifting seamlessly between the demands of different jobs, in attending to the demands of multiple jobs, and in adjusting or changing how jobs are carried out to fit the circumstances. Thus, by providing greater capacity for behavioural and structural variability, designs based on the diagram should have the potential to foster levels of system flexibility that can match the complexity of the work environment.
One potential concern with this approach is that workers may become overloaded with information. However, as discussed above (see also Naikar and Brady 2019), field studies show that workers may need to-and do-perform tasks that are not considered to be part of their usual jobs because of situational demands (Bigley and Roberts 2001;Bogdanovic et al. 2015;Lundberg and Rankin 2014;Rochlin et al. 1987). Clearly, then, workers should not be required to do so without adequate support. Instead, it makes sense to consider design strategies for providing workers with the necessary information in a way that accounts for the inherent cognitive capabilities and limitations of humans.
A potential strategy is offered by ecological interface design (Bennett and Flach 2011;Burns and Hajdukiewicz 2004;Rasmussen and Vicente 1989;Rasmussen 1990, 1992). This design approach recognises that workers may engage in flexible action, in both routine and novel circumstances, exploiting multiple means or resources to achieve multiple ends or purposes. For this reason, an ecological interface organises information according to means-ends relations, and a significant body of controlled experimental investigations has demonstrated that ecological interfaces lead to better performance by workers relative to conventional displays (Vicente 2002).
In designing for self-organisation, the ecological interface design approach may be extended to account for the full set of work demands for which actors can be responsible, based on a work organisation possibilities diagram. The resulting interface, which would be organised according to means-ends relations, would have the potential to support workers in attending to multiple system functions, in a consolidated fashion, so that the information-processing burden on workers is reduced. Nevertheless, it is possible that, for some or all of the actors, the cognitive load still cannot be reduced sufficiently. In this case, the diagram provides a systematic basis for creating overlapping information spaces for actors to foster greater flexibility within the system than would likely be achieved with conventional approaches, including the standard ecological interface design approach. For instance, in the case of the future maritime surveillance aircraft, the work organisation possibilities diagram may be utilised to provide the six workstation actors with a coordinated set of overlapping information spaces to preserve, to the extent possible, the system's inherent capacity for selforganisation. This approach is consistent with field studies that demonstrate that workers create overlapping operational representations, and shift or nest responsibilities for situational understanding, to manage the cognitive load within the system (Bigley and Roberts 2001; Weick and Roberts 1993;Weick et al. 1999).
Similar ideas are applicable in developing designs for teams, training, and human-automation interaction using the work organisation possibilities diagram. The ultimate objective is to create an integrated system design (Naikar 2018;Naikar and Elix 2016a, b) that is compatible with how complex cognitive work is carried out in sociotechnical systems. Such systems are necessarily self-organising, at least some of the time, to deal with dynamic, ambiguous work environments. Therefore, providing actors with constrained flexibility in the workplace through the system design is essential.

Discussion
This paper has demonstrated that the diagram of work organisation possibilities provides a means for design that recognises the importance of the phenomenon of self-organisation in sociotechnical systems for dealing with instability, uncertainty, and unpredictability in the task environment. That is, the diagram models actors' behaviours and structures, including the dynamic between these elements of work performance, in a way that is attuned to the self-organisation phenomenon, as it manifests in sociotechnical systems. In that the diagram corresponds with the concept of self-organisation, and is richly grounded in empirical observations, the diagram provides a sound theoretical basis for designing for self-organisation.
A significant feature of the work organisation possibilities diagram is that it provides a consolidated representation of actors' behaviours and structures. As noted earlier, the dynamic between behaviour and structure is integral to the process of a system adapting to its work environment. Also important is that the diagram encapsulates actors' full set of behavioural opportunities and structural possibilities, as afforded by the work context, which is demarcated by the system's constraints. Accordingly, the diagram should facilitate designs that promote constrained flexibility in the workplace, so that novel work structures can emerge from actors' spontaneous behaviours, safely and productively, in response to situational demands that cannot be defined completely a priori. Consequently, the system's intrinsic capacity for self-organisation, and thus for adapting to a continuously evolving work environment, should be upheld.
It is worth noting that the work organisation possibilities diagram was developed without explicit consideration, and significant knowledge, of the self-organisation phenomenon (Naikar and Elix 2016a, b). Instead, the diagram was motivated predominantly by the recognition that sociotechnical systems are characterised by flexible work structures, which can be adapted to local contingencies. In addition, the case studies of military, healthcare, and emergency management systems discussed in this paper, which did inform the development of the diagram, were not directed at the self-organisation phenomenon. Rather, they were aimed at understanding adaptive coordination strategies in teams (Bogdanovic et al. 2015) and how organisations are able to achieve high levels of reliability in extremely complex, demanding circumstances (Bigley and Roberts 2001;Rochlin et al. 1987). The unintended correspondence of the work organisation possibilities diagram to self-organisation theory underscores the universality of this phenomenon in complex settings.
This work extends current perspectives of the design of sociotechnical systems, particularly within the resilience engineering and CWA paradigms. Contrary to Hollnagel and Goteman's (2004) view that representations of organisational structure are necessarily normative, the work organisation possibilities diagram demonstrates that it is possible to capture the dynamic, flexible aspects of work organisation. In addition, in contrast to the standard CWA framework (Rasmussen et al. 1994;Vicente 1999), the diagram establishes that it is possible to accommodate work distributions that are relevant to a broad range of circumstances, including unforeseen events. While work domain analysis, one of the most powerful features of CWA, offers an event-independent representation of work demands, the value of this analysis is limited if the work demands are then distributed across actors in a way that is restricted to recurring classes of situation, or events that are known or can be anticipated, and even further to organisational structures that have been observed or are judged to be reasonable in these circumstances.
The appraisals of resilience engineering and CWA in this paper also highlight that the two frameworks may be used in a complementary fashion, especially since both are concerned with promoting adaptation. In particular, resilience engineering can contribute descriptive studies that enrich our understanding of how effective performance occurs in sociotechnical systems, while CWA can provide a formative approach to design that is informed by contemporary knowledge of how work can be achieved successfully in complex settings. For example, Lundberg and Johansson (2015) and Lundberg and Rankin (2014) provide detailed descriptions of the challenges and strategies for self-organisation experienced by Swedish crisis response teams during two major incidents, which should be taken into consideration in theory and method development, albeit cautiously. More case studies of this kind are needed to permit effective generalisation across a variety of systems and environmental conditions. Other complementary uses of resilience engineering and CWA are illustrated by Hassall et al. (2014).
Finally, considerable further research is necessary to realise the objective of designing for effective self-organisation, with the work organisation possibilities diagram presenting a suitable starting point. Future research on the diagram should be concerned with empirical validation, specifically with establishing its validity for modelling the work organisation possibilities of a range of systems and substantiating its value for creating designs that promote self-organisation.
Furthermore, future research on the diagram should investigate its applicability to large-scale as well as loosely bound systems. While this paper has demonstrated the application of the diagram to a military aircraft for maritime surveillance, arguably, this is a relatively small-scale and tightly-bound system. Applications to larger scale systems, such as an entire Air Force, are conceivable if the actors in a work organisation possibilities diagram are seen as representing collections of individuals within the organisation, at least initially, with the analysis becoming more focused and fine-grained as specific design problems are identified or targeted. Similarly, applications to more loosely bound systems, such as emergency response, whereby actors may be globally distributed or members of the public (e.g., Grabowski and Roberts 2011), are feasible if the actors in a work organisation possibilities diagram are not seen as being co-located or as belonging to the same organisation.
Finally, beyond the diagram, there are a number of avenues for future research. First, more empirical studies are needed to develop a deeper appreciation of the nature of self-organisation in sociotechnical systems. Among other things, it would be useful to investigate the specific cognitive and social strategies that enable workers to self-organise effectively under extremely demanding conditions. In addition, techniques for analysing and modelling self-organising sociotechnical systems require greater attention. While the work organisation possibilities diagram, and more broadly the CWA framework, appear to provide a useful foundation, additional research in this area would be worthwhile. Moreover, further investigation of design strategies for promoting effective self-organisation in sociotechnical systems is necessary.