key: cord-0698378-k7owe702
authors: Arcuri, Rodrigo; Bellas, Hugo Cesar; Ferreira, Denise de Souza; Bulhões, Bárbara; Vidal, Mario Cesar Rodríguez; Carvalho, Paulo Victor Rodrigues de; Jatobá, Alessandro; Hollnagel, Erik
title: On the brink of disruption: Applying Resilience Engineering to anticipate system performance under crisis
date: 2021-10-30
journal: Appl Ergon
DOI: 10.1016/j.apergo.2021.103632
sha: 6aafb87322dc33bba10e5c6e0adcbc7ea1bf362b
doc_id: 698378
cord_uid: k7owe702

As COVID-19 spread across Brazil, it quickly reached remote regions including Amazon's ultra-peripheral locations where patient transportation through rivers is added to the list of obstacles to overcome. This article analyses the pandemic's effects in the access of riverine communities to the prehospital emergency healthcare system in the Brazilian Upper Amazon River region. To do so, we present two studies that by using a Resilience Engineering approach aimed to predict the functioning of the Brazilian Mobile Emergency Medical Service (SAMU) for riverside and coastal areas during the COVID-19 pandemic, based on the normal system functioning. Study I, carried out before the pandemic, applied ethnographic methods for data collection and the Functional Resonance Analysis Method - FRAM for data analysis in order to develop a model of the mobile emergency care in the region during typical conditions of operation. Study II then estimated how changes in variability dynamics would alter system functioning during the pandemic, arriving at three trends that could lead the service to collapse. Finally, the accuracy of predictions is discussed after the pandemic first peaked in the region. Findings reveal that relatively small changes in variability dynamics can deliver strong implications to operating care and safety of expeditions aboard water ambulances. Also, important elements that add to the resilient capabilities of the system are extra-organizational, and thus during the pandemic safety became jeopardized as informal support networks grew fragile. Using FRAM for modelling regular operation enabled prospective scenario analysis that accurately predicted disruptions in providing emergency care to riverine population.

Prospective and retrospective analyses in safety management have been an important area of ergonomics & human factors research and applications. Within this scope, prospective risk assessment methods proactively identify risks that could hamper safety and performance.

While traditional risk assessment approaches require linearization, modern complex systems pose unique challenges for safety management, such as ever-growing interdependence between components, self-organization and emergent behaviour in variability (Vicente, 1999; Hollnagel, 2012; Leveson, 2017) . There is thus a need to develop approaches that can be used for complex systems, such as healthcare and others, which are dynamic, incompletely described, and therefore underspecified (Rosa et al., 2015) . However, while a systems thinking perspective has been extensively applied in the literature to understand the cause of adverse events (Hulme et al., 2019) , the development and application of systems thinking-based risk assessment has received relatively little attention (Dallat et al., 2019) . This research paper aims to assess how Resilience Engineering (Hollnagel et al., 2006) concepts and methods can be used to identify and predict the behaviour of complex systems after they are put under stressful situations, based solely on previous understanding of their normal functioning. With this purpose, the paper proposes and validates a way to incorporate in-depth data on work-as-done and system variability into a qualitative risk assessment method for crisis situations using the Functional Resonance Analysis Method (FRAM).

This research design was applied to predict the functioning of the Brazilian Mobile Emergency Medical Service (SAMU) for riverside and coastal areas during the COVID-19 pandemic. Specifically, the study analysed the pandemic's effects in access of riverine communities to the prehospital emergency healthcare system in Amazon's ultra-peripheral locations, where emergency care performed by a water ambulance service is the only gateway for riverine populations into the Brazilian National Public Health System (Jatobá et al., 2021) .

The COVID-19 pandemic was declared a public health emergency of national importance in Brazil on February 3rd, 2020 (Brasil, 2020; Garcia and Duarte, 2020) . It started in Brazilian Southeast region and soon spread throughout the entire country, including remote and less accessible regions like Amazonas State where patient transportation through rivers is added to the list of obstacles to overcome during the crisis. After the number of COVID-19 confirmed cases, hospitalizations and deaths first peaked in May 2020 in Amazonas State, the month of January 2021 proved even more challenging for the region as a second, higher and steeper peak in hospitalizations soared demand for oxygen, pushing healthcare services to a breaking point.

The addressed research question was how the Functional Resonance Analysis Method -FRAM (Hollnagel, 2012) can -by modelling activities under typical conditions -actually be used to predict system functioning under stressful situations, like the ones posed by the COVID-19 pandemic.

With this purpose, two studies were performed and are presented here. The first one, carried out in the middle of 2019 (before COVID-19), a FRAM model for the Upper Amazon River SAMU was developed using ethnographic methods. In the second study, which did not include additional data collection and was solely based on the variability already identified for normal functioning, a group of experts developed new models on how the system would function during the high demand imposed by COVID-19. Finally, the accuracy of predictions and the ways workers coped with challenges imposed by the crisis at the sharp end, during the first peak of the pandemic in the region, are discussed.

The Upper Amazon River (Alto Rio Solimões, in Portuguese) region, a part of the Brazilian state of Amazonas, is located at the tripoint between Brazil, Colombia and Peru. It comprises 213,000 km 2 and 9 municipalities with a total population estimated at 240,000 inhabitants. The region surrounds a stretch of about 900 km of the Amazon River (along with some of its tributaries) as it enters Brazil from Peru.

Due to local conditions -underdeveloped infrastructure, sparse population density and geography consisting of forested and floodable plains -the primary access to cities in the Upper Amazon River region is through the waterways of its rivers. The various risks for navigation include (Queiroz, 2019 ):

• Underwater sandbanks; • The collapse of riverbanks, forming waves that sometimes sink boats; • "Rebojos" -swirls formed at river confluences with different water speeds that can delay trips and sink small boats; • Shaping of several pathways due to the formation of numerous islands ("paranás"), impeding regular navigation paths; • Large concentration of debris on the surface of its waters, such as tree trunks, which often break boat propellers;

• Dangers and violence posed by illegal activities including illegal mining, drug and arms trafficking, and even river piracy. The region is one of the main gateways for drugs and illegal arms entering Brazil. Fig. 1 shows a map of the operation for emergency care service across the municipalities of Benjamin Constant and Tabatinga. This latter is the regional capital and holds the headquarters for the systemthe SAMU Dispatch Centre for the Upper Amazon River region.

Resilience Engineering emerged less than two decades ago (Hollnagel et al., 2006) with a proposal to better understand safety and general functioning of complex-socio-technical systems when performing close to their boundaries. Resilience has been defined as "the intrinsic ability of a system to adjust its functioning prior to, during, or following changes and disturbances so that it can sustain required operations, even after a major mishap or in the presence of continuous stress" (Hollnagel et al., 2006 (Hollnagel et al., , 2011 . Resilience has been considered an emergent property of systems, providing the means for organizations to target resource investments by integrating safety and productivity concerns (Nemeth et al., 2008) , and some if its contributions to the understanding, design and management of complex socio-technical systems are listed in Patriarca et al. (2018) . Fairbanks et al. (2014) discuss examples of resilience in healthcare in systems. The authors state that, for any scale of disturbances, resilient performance in these systems is dependent on their configuration permitting actors within it to effectively react to these disturbances by changing or trading off across goals. Resilient healthcare has been linked to both safety and quality in delivering care (Nemeth et al., 2008; Anderson et al., 2020) . However, most resilient healthcare research has focused on a descriptive approach on how work is achieved at the sharp end (Berg and Aase, 2019 ).

Resilience to system disturbances in healthcare is characterised by a high degree of adaptive capacity (Braithwaite et al., 2013) . Healthcare environments display high variability, and disturbances can be unpredictable in timing, magnitude, duration and character, meaning that healthcare professionals must be continually aware, flexible and ready to act (Braithwaite et al., 2013) .

To guide the representation and analysis of systems' interdependencies and performance variability in healthcare (and other complex domains), Resilience Engineering has produced methods of its own. Among these, the one that seems to be getting most attention from the Resilience Engineering community (and increasingly among communities of practice) in the past few years has been the Functional Resonance Analysis Method (FRAM) (Hollnagel, 2012; Patriarca et al., 2020) .

FRAM was conceived as a new analysis method based on Resilience Engineering concepts, initially as an alternative to accident analysis (Hollnagel, 2004) but later as a more general modelling method (Hollnagel, 2012) . It has been widely used for accident analysis based on Resilience Engineering principles (Woltjer and Hollnagel, 2007; Carvalho, 2011; Minami and Komatsubara, 2008; Hollnagel and Fujita, 2013) but is increasingly used to model system functioning as a prospective analysis method (Patriarca et al., 2020) . FRAM prospective analysis has been used to understand the consequences of misalignments of Work-As-Done (WAD) and Work-As-Imagined (WAI) (Li et al., 2019; Nakajima, 2015) , providing reflections on how sharp end adaptations due to system constraints may jeopardize system functioning (Jatobá et al., 2018; . However, such approach has so far been applied to assess scenarios and potential outcomes within close-to-typical working conditions.

In this work, a FRAM model for system functioning in normal conditions was used to predict system behaviour in a major stressful situation. The FRAM model for SAMU services in riverine areas is detailed in Study I and includes the complete system operation: from the call for assistance up to the arrival at the specialized care facility. This FRAM model enabled an in-depth understanding and reflection on system variability, providing the basis for the prospective analysis of its operation during COVID-19 pandemic's first peak, as described in Study II.

The goal of Study I was to develop a FRAM model for the mobile emergency care system, operated by the SAMU, in the Upper Amazon River region. It resulted in a systemic modelling of emergency care situations along three key processes and respective variability dynamics.

This study used an exploratory cross-sectional design, based on qualitative data collected following an ethnographic approach to map work activities into FRAM functions. Fieldwork was carried out in a participatory way and was based on semi-structured interviews, worksite technical description and naturalistic work observation whenever possible.

Participants spanned managers from Municipal Health Departments, SAMU, and other local healthcare facilities, as well as emergency care teams' professionals, such as doctors, nurses, health attendants and boat drivers. Research effort comprised over 140 h of fieldwork, in which 47 professionals were interviewed over a 12-day time period. Interviewees were classified into four different groups:

• Managers from the regional Dispatch Centre and decentralized bases (8); • Professionals from the Dispatch triage team (3); • Professionals from water ambulance crews (32); • Managers and professionals from healthcare facilities in the region which receive patients from SAMU mobile teams (4).

To map systems functions into FRAM, interviews focused on identifying the difficulties that participants face while carrying out their activities as well as the main problems concerning the boats and navigability in rivers in which they operate to reach riverine communities in the region. Interviews also included description of how variability unfolded during service operation and narratives of challenging cases in providing care and dealing with incidents during expeditions.

Data collection took into consideration this system's organizational context, related to its "blunt end" (administrative structure, relationship with municipal and state management, availability of human and material resources, and local protocols). Additionally, other elements of the work environment were considered, such as those related to its "sharp end" (communication instances, geographic and climatic factors, and population's epidemiological aspects).

Fieldwork was organized into the following steps:

1. Guided visits to the Dispatch Centre and decentralized operational bases that host the water ambulance crews in the Upper Amazon River region' municipalities; 2. Semi-structured interviews with Dispatch managers, health managers at the municipal level, Dispatch triage team, members of the water ambulance crews, and managers and professionals from healthcare units in the Upper Amazon River region; 3. Inspection, description and technical drawing of the water ambulances and their docking locations; 4. Navigation aboard water ambulances; and 5. Simulation of an emergency operation (available at one of the locations);

At all municipalities, guided visits to operational bases and interviews with local managers preceded the other steps, as a first point of contact between the research team and local professionals. The remaining steps were ordered according to availability of crews and other healthcare professionals.

Field notes and the transcription of interviews underwent content analysis (Bardin, 1989) looking for trends, characteristics, and interpretation of the data. Lastly, the operation was modelled based on systemic analysis using FRAM (Hollnagel, 2012) . Analysis focused on the key process executed by the emergency care service and interactions used to coordinate the tasks among the many system agents.

Functional variability for each function was modelled in terms of endogenous/exogenous disturbances, dampening mechanisms, and output variability according to the taxonomy described by Li et al. (2019) and Saldanha et al. (2020) . Therefore, from the standpoint of any specific function in the model, exogenous disturbances were modelled as the output variability from upstream functions, while endogenous disturbances were modelled as ones that emerge from within the reference functiongiven a chosen level of model resolution.

The variability taxonomy is illustrated in Fig. 2 . In this example, which pictures variability characterization for a generic Function C, dampening mechanisms within Function C are activated to cope with endogenous disturbances x,y,z, as well as with exogenous disturbance B.i via upstream-downstream coupling for Resources. The outcome of this variability dynamics is shown as potential output variability regarding output C.i. As we move on to characterize variability for Function D downstream, output variability C.i will then simply be accounted as exogenous disturbance C.i.

It is important to note that this variability taxonomy can accommodate changes at levels of model resolution while yielding the same results for characterization and analysis of functional variability. As an implication, it is suitable for conducting further analysis that extend model representation in this way, such as the FRAM Abstraction/Agency framework presented in Patriarca et al. (2017a,b) .

For example, we could consider the case of an increase in model resolution (i.e. an increase in granularity, thus exploding any general function into multiple specialized functions). In this case, a given disturbance that was considered endogenous for a general function would be now, from the standpoint of one of the new specialized functions that stemmed from it, be modelled as exogenous, since it is produced upstream. Nevertheless, the result of analysis would remain the same, as the interplays between disturbances, dampening mechanisms and output variability are accounted for in the same way. Dampening mechanisms within Function C-3 are activated to cope with endogenous disturbance z and exogenous disturbances C-1.k and B.i via upstream-downstream couplings for Control and Resources, respectively. At this higher level of resolution, disturbance y is revealed to be the outcome of the variability dynamics at Function C-1 and is exogenous from the standpoint of Function C-3. Nevertheless, the outcome of the variability dynamics encompassing Functions C-1, C-2 and C-3 is the same as the one shown at a lower level of resolutionresulting in potential output variability regarding output C.i.

Emergency healthcare to riverine communities in the Upper Amazon River region comprises three key processes:

A Rescue service for injured individuals (patients) at riverine communities (rural, indigenous, and non-indigenous populations), subdivided into: a.a Rescue near the coast of the Upper Amazon River, Içá River, and their extensions, streams, and boreholes; a.b Rescue within riverside communities, far from shore; or a.c Rescue of boats or patients adrift in the region's rivers. B Transfer of patients from healthcare facilities in other cities within the region to Tabatinga's hospital or emergency care clinic; C Transfer of patients from clinics in Tabatinga and other cities within the Upper Amazon River region to medium and high complexity healthcare facilities in Manaus, the state capital.

The water ambulance service ( Fig. 4) in Upper Amazon River is responsible for operating processes A and B. In contrast, process C is operated both by land SAMU (Upper Amazon River region' division)coordinated by the Municipal Health Department of the patient's hometownas well as by the State aeromedical service. The FRAM model, describing how the functions are activated along these three processes and carried out by different system agents, is shown in Fig. 5 .

The characterization functional variability as well as the description of some instantiations in typical conditions of operation are described in the next subsections for processes A, B and C.

This process typically begins when the operator receives a call by the patient, patient's family, local residents or by the local community health worker (CHW) called to the scene. The operator (TARM) then collects critical initial information about the event and routes the call to the triage/dispatcher physician, who uses the event/occurrence's information and SAMU protocols as controls to deepen knowledge about Fig. 2 . Illustration of the variability taxonomy adopted for modelling variability dynamics at Studies I and II, at a lower (less granular) level of model resolution. In this example, step 2 of FRAM -Characterization of functional variabilityis carried out for Function C. the occurrence and determine the appropriate response. The output of the functions "get basic info on event" and "detail event" tend to present output variability regarding precision -less accurate data -since they are provided by the requester. However, when the caller is the local CHW, the precision of such information is higher, and additional data such as blood pressure can be passed on to the dispatcher physician. In this case, the dispatcher then instructs the CHW on how to provide first aid to keep the patient's condition stable until the arrival of the water ambulance crew (which may take hours).

At the Dispatch, the radio operator allocates and activates the water ambulance crew for the event (function "transmit service order to water ambulance intervention team"). A disturbance related to this function is the impossibility of immediately sending the crew because it may be assisting another event. If so, it is necessary to wait for the water ambulance's return before proceeding with the dispatch.

Once the decentralized base is alerted, the water ambulance crew decides on the best place to dock the water ambulance nearby the occurrence/event scene. If the local CHW was the requester, the water ambulance crew attempts to contact them to assess the possibility of the patient being transported to a meeting point to ease extraction/ boarding.

The crew then prepares the water ambulance, carries out the boarding, and navigates to the occurrence. Upon arriving, they dock at any existing pier, in ravines, or on beaches. Beaches are the least recommended places for docking, as there is a higher chance of stranding the boat, and the subsequent boarding of the patient is hindered.

As the crew reaches the patient, the function "perform initial reanimation or assessment maneuvers" is triggered. During preparation for extraction, if the patient's health condition is more severe than imagined, the crew tries to contact the triage physician to update them and ask for guidance. If they can communicate with the Dispatch, the triage physician conducts a briefing with the first responders regarding possible scenarios for the evolution of the patient's condition, preauthorizing medical procedures in case communication is not available during the returning trip.

When the function "perform initial reanimation or assessment maneuverers" conveys the impression of a severe health condition, an early dampening mechanism is triggered: the CHW (or, in larger communities, a health attendant, nurse, or physician) might crew the water ambulance and provide extra support to the intervention team during victim transportation, anticipating possible complications.

The crew than maneuvers the patient to board the water ambulance. The driver must remain in control of the boat during boarding, be it on land or in water. Therefore, boarding often requires the aid of the local CHW or others (residents of the community, the patient's relatives, crew of the rescued boats, etc.).

With the patient aboard the water ambulance, the health attendant accompanies the patient and performs the tending measures. The procedures performed by the health attendant are essential, given that the journey may take hours. These measures can be limited, for instance, by the available equipment, the professional's expertise, and the possibility of communication and authorization by the triage physician.

When approaching the docking location, rescuers call the Dispatch and the decentralized base as soon as within phone and radio coverage to inform coordinates and report updates on the patient's conditions. The disembarking location -decided at this moment by the water ambulance's driver -is also informed so that the radio operator can dispatch a ground crew to pick up the patient.

On arrival, the water ambulance crew briefs the ground crew regarding the rescue. The patient is then taken to the local healthcare facility (usually a hospital or emergency clinic), where the screening and, lastly, assistance will be carried out.

Illustration of the variability taxonomy adopted for modelling variability dynamics at Studies I and II, at a higher (more granular) level of model resolution. In this example, step 2 of FRAM -Characterization of functional variabilityis carried out for Function C-3. 

This process begins with the local emergency clinic or hospital contacting SAMU Dispatch Centre to transfer the patient to Tabatinga, the largest municipality in the region and home to the most equipped hospital and emergency care clinic. Unlike process A, the Dispatch's operator (TARM), when receiving the request, forwards it directly to the triage physician, who will talk to the health professional of the requesting facility and decide on how to perform the transfer.

While the water ambulance crew goes to the water ambulance and prepares it for the trip, the ground crew picks up the patient at the health facility and transports them to the boarding point.

The water ambulance crew then transports the patient to Tabatinga, a journey that may take from approximately from one to six hours (depending on the municipality of departure). During the trip, the green functions (Fig. 5 ) take place as they do in process A. When approaching Tabatinga, the water ambulance crew informs the Dispatch of their proximity and the chosen disembarking point. The radio operator then activates a ground crew to pick the patient up and take them to the local hospital or emergency clinic.

This process starts with the hospital or emergency care clinic from one of the region's municipalities requesting the Municipal Health Department to transfer the patient to a more sophisticated healthcare facility in Manaus, the State capital, which lies about 1500 km down the Amazon River.

Since the aeromedical service is usually overworked, it is common for the Municipal Health Department to choose alternative transportations, such as express commercial carrier boats. These, however, take approximately 24 h to reach Manaus and are available only three to four times a week. Also, patient transportation using these boats occurs in an improvised manner -immobilized patients are carried in the boat's floor, besides passengers' seat rows.

Whether by aeromedical transport or commercial boat, the result of the function "negotiate patient's referral to Manaus" determines when the rest of the process will be triggered. When the triggering occurs, the local healthcare facility is advised to prepare the patient for transfer. In contrast, SAMU is called to deploy a ground crew to transport the patient to the location of departure, where they are relocated by aeromedical transport or commercial boat to Manaus. Once most of the region's SAMU bases hold each only one land ambulance, an endogenous disturbance to the function "transport patient from HC (Health Care) facility to pick-up spot for Manaus" is that this vehicle may be in another occurrence when requested. In this case, the dampening mechanism consists of the decentralized base negotiating with the local management the availability of an alternative vehicle to carry out the transportation.

Even under typical operation constraints, transferring patients through remote riverside regions is a fairly complicated task. Water ambulance units are affected by many variables, from operational context, equipment limitations (PPE, boat and docking locations), to availability of complete healthcare teams and communication issues due to the poor mobile phone and radio coverage in the region.

One interesting aspect the model displays is how the community health workers (Bellas et al., 2019; Wennerstrom and Rush, 2016 ) based on the riverine communitieswhen availableplay a fundamental role in addressing the emergencies in this region. They do so in three ways:

1 Mediating communication between the patient/community and the SAMU service, often requesting it themselves. Additional and more reliable information fed into the functions performed by the Dispatch team account for more accurate decision-making; 2 Performing first aid care to patients, before the SAMU crew arrives. The output-control coupling between functions "perform firstaid on patient" (by the CHW) and "perform initial reanimation or assessment maneuverers" (by the SAMU crew) might determine the degree of success of the latter, due to the long time needed for the crew to arrive; 3 Facilitating the patient's extraction by the water ambulance crew, from guiding the crew to the patient location to sometimes coordinating an early transfer of the patient's from the occurrence location to the water ambulance's docking location. Time needed to reach occurrence's location and safety of the SAMU crew during the route towards it (modelled as output-time and output-control couplings at the function "find patient") can be greatly impacted by previous contact and action by the CHW.

Study II was aimed at using FRAM as a prospective analysis tool to address the research question. Therefore, from the general FRAM model for the mobile emergency care operation in the Upper Amazon River region, we formulated a predictive model for estimating system behaviour during the COVID-19 pandemic.

Research steps were designed in order to calibrate the general FRAM model to accommodate instantiations considering the effect of the COVID-19 pandemic in the region.

In the first step of the proposed formulation, we analysed each previously modelled system function based on knowledge gathered from their behaviour and considered potential changes in their variability dynamics due to the pandemic. To this end, we reviewed published reports regarding the COVID-19 pandemic's general impacts on Brazil's National Health System (SUS) and on the studied region -especially the technical guidelines on dealing with COVID-19 and special weekly COVID-19 epidemiological bulletins issued both by the Brazilian Ministry of Health (available on routinely updated editions at https://antigo .saude.gov.br/boletins-epidemiologicos) and by the Health Secretary of Amazonas State (available on routinely updated editions at https:// www.fvs.am.gov.br/publicacoes).

From this analysis, we identified a group of directly impacted functions and produced estimations on the influence the pandemic would have over them. Impacts can be summarized as the increase in likelihood (↑L) or severity (↑S) of some endogenous disturbances, the rise of new endogenous disturbances (N) and the decrease in manoeuvrability of some dampening mechanisms (↓M).

In a second stage for the development of the predictive model we carried out the analysis of functional resonance. From it, we came to identify how variability couplings might drive three trends that lead to the collapse of the mobile emergency care system in the region. These three scenarios were each conveyed by a group of potential instantiations enabled within the pandemic influence.

For each scenario, a table and a figure were produced. The table details the changes in variability dynamics for the directly impacted functions, while the figure shows a zoomed-in graphical perspective of the predictive model for said scenario, highlighting the output variability produced by directly impacted functions. Conversely, functions and couplings that, due to the pandemic, do not insert additional output variability in the system were not highlighted and detailed in the respective figure and table. With regard to pandemic impacts, those play the sole role of carrying output variability generated by the highlighted functions further downstream along processes A, B and C.

Our analysis of potential instantiations of the system functioning under the pandemic influence defined three trends in which we estimated emergency healthcare to riverine communities in the Upper Amazon River region might come to collapse. The three scenarios that emerged from the analysis were:

1. Deterioration of Capability to Handle Processes' Demands; 2. Exposure to Infection and Reduction of Intervention teams Available; 3. Difficulties of Team Rescue.

We detail Scenario 1 in the next subsection.

The emergency care processes for the Upper Amazon River riverine population have been designed for a typically low demand. However, the COVID-19 crisis could potentially increase demand for emergency care in the region while simultaneously impacting processes' behaviour. Therefore, while the usual operation of the ambulance service already presents a considerable misalignment between demand (pressures exerted on the system) and capacity (resources available to deal with such pressures) (Anderson et al., 2017; Dekker, 2011, cap . 7), we estimated the COVID-19 pandemic would widen this gap, making the operation less able to cope with the critical conjuncture. The FRAM predictive model for this scenario is shown on Fig. 6 and detailed on Table 1 . Functions and couplings highlighted insert new delays into the system or conditions for delays in following functions. Couplings not highlighted still play a role of transmitting delays downstream.

For processes A and B, our analysis indicated that the impacts of the pandemic would make room for potential instantiations where delays resonated, turning effective emergency care unfeasible. This would happen through response times incompatible with the severity of the patients' conditions, either due to delays while delivering care or delays at dispatching the water ambulance crews (including delays accumulated from previous service orders). Our analysis pointed to a compound effect of these two dynamics.

Initially, the large number of service orders during the COVID-19 pandemic leads to an increase in the likelihood in which the function "transmit service order to water ambulance intervention team" delays. This is due to the water ambulance crew being continuously allocated to occurrences. Given the limited resources and a single ambulance available for each decentralized base, no dampening mechanisms are available to handle such disturbances.

In process A, the local CHW can usually provide first aid measures, which are essential for stabilizing the patient before the crew's arrival, as cited earlier. However, for severe COVID-19 cases, which involve symptoms such as respiratory failure, for example, the CHW does not have the means to handle such a situation from the outset. This, subsequently, affects downstream functions.

Still concerning process A, the function "find patient" is usually facilitated and sped up since the CHW receives information on the mooring point of the water ambulance (control element) and is able to transport the victim (with or without the residents' help) to mooring point's vicinity. However, during the pandemic, this transport is hindered due to CHWs being apprehensive on getting infected, as they do not have PPE or training for the safe management of COVID-19 patients. This aspect, originating from the function "take the patient to river shore," impacts the function "find patient" as a new exogenous disturbance. In turn, this disturbance could require -as a dampening mechanism -that rescuers traverse the community area, sometimes at night and through forest trails unknown to them, posing the risk of disorientation, falls, or encounters with dangerous wildlife (see Fig. 7 ).

The consequences of lack of adequate lighting equipment are then aggravated. The team then may end up having to use lighting from their personal cell phones. The success of using said damping mechanism would still delay the service, while failure could interrupt the operation and even create the need for the water ambulance crew to be rescued. The apprehensive attitude of CHWs and residents could also be observed during the function "remove patient from event-scene to water ambulance."

The functions performed by the land intervention team can also suffer delayssuch as transferring the patient from the water ambulance to local health facilities. Regarding process B, there can be a delay for the function "transmit service order to land ambulance intervention team." Once again, this is because a large number of rescues seen during the pandemic lead to increased frequency in which the only land ambulance present in each municipality would be unavailable. There is no dampening mechanism to deal with this disturbance.

Regarding process C, our analysis indicated the pandemic would simultaneously increase the likelihood of disturbances while decreasing the manoeuvrability of the dampening mechanisms for two key functions, executed by the Municipal Health Department management.

Firstly, for the function "negotiate patient referral to Manaus," the Health Department may not be able to provide aeromedical service in time, due to high demand. At the same time, it may be challenging to negotiate patient transportation with commercial speedboat services. Thus, the patient would need to rely exclusively on the availability of aeromedical transport to Manaus.

Secondly, the function "transport patient from HC facility to pick-up spot for Manaus" will be delayed if there is no SAMU ground crew available to transfer the patient to the pick-up spot. This may delay the transfer since the dampening mechanism (negotiating with the local Health Department for another vehicle) becomes fragile during the crisis. This would happen not only because of high demand over vehicles and resources in general from the local Health Department, but also because these alternative vehicles will only be used to transport COVID-19 patients if they present low-risk of infection to the crew, and if it is possible to sanitize the equipment and surfaces after use.

After the pandemic's first wave peaked in the region, which happened in the second trimester of 2020, the three scenarios described in the Results section were validated by supplementary interviews Fig. 6 . Prospective Analysis -Scenario I -Graphical model. Directly impacted functions and changes to their output variability are highlighted.

Prospective Analysis -Scenario I -Detailing of changes in variability dynamics for directly impacted functions. Code for pandemic's impacts over disturbances, dampening mechanisms and output variability: (↑L) = increase in likelihood; (↑S) = increase in severity; (N) = new; (↓M) = decrease in maneuverability. Fig. 7 . Riverine community in the Upper Amazon River region. Communities' populations range from several dozens to a few thousand residents, and may spread several kilometers inland.

carried out remotely with key members of SAMU's management and teams from the Upper Amazon River region. The interviews covered three topics: (1) validation of estimated changes in variability dynamics for directly impacted functions of the general model;

(2) validation of major disruptions in system functioning following the three scenarios; and (3) inquiry over additional changes in system functioning after the pandemic hit the region.

The changes in variability dynamics foreseen in the prospective analysis for the functions activated along the three processes were confirmed. We were also able to confirm that through functional resonance these changes led to: (1) delays on emergency care provided and difficulty in attending to demand (e.g., due to couplings between functions "take the patient to river shore" and "remove patient from eventscene to water ambulance"), (2) COVID-19 outbreak throughout a large part of the SAMU rescuers (e.g., due to couplings between navigation and care performing functions), and (3) difficulty in rescuing (e. g., due to couplings between functions "navigate to Tabatinga" and "request rescue"). During the validation phase we learned that as this research was developed many members of the SAMU teams had already been infected.

Thus, the FRAM modelling of the emergency care system during regular functioning enabled the risk analysis of its abnormal functioning during a crisis, namely the COVID-19 pandemic. Nevertheless, an additional (not predicted) change in the system's functioning during the pandemic has been reported. This concerned the operation of the water ambulance crew in coordination with the primary care strategy. In the Upper Amazon River region, each municipality has a mobile riverine (boat) primary care clinic that continuously travels throughout local riverside communities to provide primary care services.

During the first peak of the pandemic, the primary care teams identified, within communities, severe COVID-19 cases that required extraction to local specialized healthcare facilities. Thus, water ambulance crews started to monitor the mobile health clinic and its itinerary, to speed up the assistance, and sometimes even escort mobile riverine primary care clinics, to attend to patients as soon as possible. This shows the importance of coordination between local health operations at different levels during adverse events. Water ambulance crews have temporarily become, in fact, extensions of, and support to, primary care, in addition to their already established role from the standpoint of primary care: mitigating urgent care cases in riverine populations (Lança, 2017) .

Resilience means not only being able to adapt (latent capability) but also changing organizational behaviour to focus on adaptation (manifest behaviour) when necessary (Huber et al., 2012) . In extreme health events like the ongoing pandemic, healthcare teams encounter even higher demands than usual regarding the provision of care and aspects related to their safety (Doyle et al., 2017; Sjölin et al., 2015) .

The latent instantiations within the three found scenarios point out how extra-organizational elements to riverine emergency care drive resilient performance along processes A, B and C. One example is the essential role of CHWs from riverine communities in attending to emergencies while focusing on providing first aid measures to patients (Ozano et al., 2018) . Due to their experience and the nature of the epidemiological profile of the occurrences, the CHWs are generally able to provide first aid (Jatobá et al., 2020) . Typical examples are accidents with mowing tools (chainsaw, machetes, and others), heart attacks, snake bites, etc. However, CHWs do not have medical instruments or PPEs for primary care for critically ill COVID-19 patients. Thus, providing training and proper equipment to the CHWs could facilitate their jobs and improve the healthcare provided by them (Ballard and Montgomery, 2017) .

Another relevant aspect concerns the fact that the system has become accustomed to using commercial passenger boats to carry out extractions. However, during outbreaks this transportation method must be avoided when carrying out this activity, because it offers the risk of contamination for other passengers. This is especially relevant since processes B and C, which in typical situations are less representative, during the peak of the pandemic became the main processes.

The typical response to the COVID-19 pandemic across health systems has been to invest in infrastructure and expand the healthcare capacity to receive and treat patientswith an increase in the availability of beds, respirators, and health professionals (Chopra et al., 2020; Meares and Jones, 2020; White and Lo, 2020) . One major takeaway from our work is that this response might nevertheless miss the target for remote or peripheral locations, distant from state capitals. These locations pose a unique challenge to healthcare systems, which is to make sure patients can be physically brought to the systems and guarantee their access to healthcare. Crisis situations such as the COVID-19 pandemic essentially widen the gap between demand for care services and capacity to reach patients and bring them to where care can be delivered, putting system safety at stake as effective care becomes unfeasible.

The identification, description and finally successful validation of the three estimated scenarios in Study II would not be possible without the in-depth understanding of how emergency healthcare to riverine communities functioned under typical conditions. In this regard, the FRAM general model for the system, produced in Study I, was of fundamental importance, once it enabled a systematized registration of data collected regarding the operation of the three processes and also a focused forecast on how different system agents would be impacted under the pandemicfirst in terms of carrying out individual functions and then zooming out to the whole system. In this way, the principle of functional resonance (Hollnagel, 2012) came into prominence as we found that relatively small changes in variability dynamics (such as residents of riverine communities fearful of being in close contact with victims) could deliver strong implications to the processes (such as significant added delays to process A) and to the safety of expeditions (such as increased risk of accidents during the trip inland to reach the victim).

On the other hand, such knowledge of how the system works also shows opportunities for increasing resilient performance in processes A, B and C. For instance, Process A could benefit greatly from resizing the water ambulance crew in order to cope with transporting and boarding victims when help from residents and CHWs will not be possible. Process B could benefit from water ambulances more adapted to the harsh local navigation conditions, whereas Process C could benefit from negotiations (at a state level) between SAMU and commercial speedboat companies' so as to design cabins in these vessels to transport patients with COVID-19 when air ambulances are not available.

One important limitation of our work stems directly from its research design. Since all estimates produced during Study II are based on the roles established for the investigated system (riverine mobile emergency care) along their derived processes and respective functions as modelled in Study I, it is not possible to estimate fundamentally different roles and processes that come to briefly exist during crisis. In our application, this accounted for not being able to predict the extemporaneous new process of water ambulances escorting mobile riverine primary care clinics, which fell outside SAMU attributions while it took place in some locations at the height of the first pandemic wave. We believe that identifying such solutions in advance, although not impossible, would depend at least on in-depth knowledge on WAD regarding the services delivered within primary care to riverine populations.

Although the character of the studies presented in this paper is purely qualitative, the adopted research design could be coupled with a semiquantitative approach for variability modelling. Recent research on this topic has employed techniques such as Fuzzy Logic (Slim and Nadeau, 2019; Hirose and Sawaragi, 2020) , Monte Carlo simulation (Patriarca et al., 2017a,b) and Bayesian networks (Zinetullina et al., 2021) . Drawing from these proposals, we believe that a good aim for complementing a FRAM prospective analysis of system functioning during crisis situations would be an approach towards reducing subjectivity in the estimation of changes in variability dynamics of directly impacted functions. In this sense, the FRAM/AHP approach (Rosa et al., 2015) seems to be a good fit, once it enables the simultaneous participation of multiple domain experts and can lead to the reduction in subjectivity associated in the process of risk assessment in complex systems.

Our findings on the importance of including elements of overall system functioning into risk assessment can be related to a recent view on safety, labelled as Safety-II (Hollnagel, 2014 (Hollnagel, , 2018 and complementary to the traditional view (labelled as Safety-I). Safety-II poses system safety as a variability-based problem and was conceptualized from applying the Resilience Engineering perspective to understanding and managing safety in complex systems. According to this view, safety management is not only the product of rules and procedures, but it also develops mainly due to constant performance adjustments made by healthcare personnel to meet changing demands and deal with disturbances and surprises (Sujan et al., 2017; Kroeze and Wimmer, 2019; Merandi et al., 2018; Schutijser et al., 2019) .

In complex healthcare systems such as riverine mobile emergency care, the application of traditional risk assessment focused to deal only with identified hazards appears to be too reactive and limited, as it cannot for instance consider how extra-organizational elements play key roles in system performance, which in turn may lead to recommendations to solve the wrong problems -the error of the third kind (Mitroff, 1974; Woods, 2006) . A broader perspective, focused on understanding system interdependencies and describing deviations from the system's normal functioning based on effective practices, should be employed to help avoiding disturbances affecting SAMU professionals' work while supporting ways to dampen those disturbances, thus improving overall system safety and functioning.

Urgent care and transportation to riverine communities in the Upper Amazon River region are possible not only because SAMU professionals follow prescribed rules rigorously, but because they make performance adjustments based on available resources. The Resilience Engineering perspective, supported by participatory data collection that allows for modelling work-as-done and the changing variability dynamics in complex systems, shows how performance variabilitymanifested through functions' dampening mechanismsis vital to building safety while allowing urgent care to be delivered.

In light of these findings, others from this study rise in relevance, such as how extra-organizational elements to a public healthcare system can add to the resilient capabilities of its operation. A major takeaway from this study is that these extra-organizational elements can actually act as the main drivers of resilient performance. In turn, this sheds light on the importance of including such elements in risk assessment, once during crisis situations they can experience more brittle degradation. Particularly for riverine emergency care, these elements are exogenous to SAMU (when care depends on an initiative from the local CHW) and even to the whole public healthcare system (when care relies on an effort from the residents' actions). Therefore, since the intervention operation (and particularly process A) tends to depend on an ad hoc help from the population, safety becomes jeopardized as informal support networks become more fragile.

The use of the FRAM for modelling regular operation based on indepth data on work-as-done enabled a prospective scenario analysis that accurately predicted disruptions in system functioning during abnormal conditions. Domain-wise, this approach was able to predict how the delivery of emergency care to riverine population would be hindered as the COVID-19 pandemic first peaked. We believe that a Resilience Engineering approach should be considered as an important complement to traditional approaches in managing system safety. This is especially relevant in light of recent events, once risk management protocols based on traditional risk assessment methods, as employed by public managers from state and city-levels, have shown to not be effective enough to adequately predict how the second wave of the COVID-19 pandemic would hit the Amazonas state. In January 2021, as the pandemic peaked for the second time in the region, the healthcare system in the state was pushed to collapse as hospitals ran out of beds and oxygen tanks amid soaring coronavirus infections.

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Modelling resilience and researching the gap between work-as-imagined and work-as-done

Defining adaptive capacity in healthcare: a new framework for researching resilient performance

Systematic review of interventions for improving the performance of community health workers in low-income and middle-income countries

L' analyse de contenu (5. éd. rev. et augm)

Effects of urban violence on primary healthcare: the challenges of community health workers in performing house calls in dangerous areas

Resilient characteristics as described in empirical studies on health care

Portaria MS/GM no 188, de 3 de fevereiro de 2020. Declara Emergência em Saúde Pública de importância Nacional (ESPIN) em decorrência da Infecção Humana pelo novo Coronavírus (2019-nCoV)

Health care as a complex adaptive system

The use of Functional Resonance Analysis Method (FRAM) in a mid-air collision to understand some characteristics of the air traffic management system resilience

How should U.S. Hospitals prepare for coronavirus disease 2019 (COVID-19)?

Risky systems versus risky people: to what extent do risk assessment methods consider the systems approach to accident causation? A review of the literature

Drift into Failure: from Hunting Broken Components to Understanding Complex Systems

Uncovering waste in US healthcare

Resilience and resilience engineering in health care

Intervenções não farmacológicas para o enfrentamento à epidemia da COVID-19 no Brasil

Extended FRAM model based on cellular automaton to clarify complexity of socio-technical systems and improve their safety

FRAM: the Functional Resonance Analysis Method: Modelling Complex Socio-Technical Systems

Safety-I and Safety-II: the Past and Future of Safety Management

Safety-II in Practice: Developing the Resilience Potentials

Resilience Engineering: Concepts and Precepts

Resilience Engineering in Practice: A Guidebook

The Fukushima disaster -systemic failures as the lack of resilience

A program to support the construction and evaluation of resilience indicators

What do applications of systems thinking accident analysis methods tell us about accident causation? A systematic review of applications between

Water ambulances and the challenges of delivering mobile emergency healthcare to riverine and maritime communities

Assessing community health workers' conditions for delivering care to patients in low-income communities

Putting Safety-II into Practice by Using FRAM in the Dutch Hospitals

Serviço de Atendimento Móvel de Urgência Fluvial de Manaus: Perfil dos atendimentos, usuários e fatores relacionados ao agravamento dos atendidos

Rasmussen's legacy: a paradigm change in engineering for safety

A proactive operational risk identification and analysis framework based on the integration of ACAT and FRAM

When a system breaks: queueing theory model of intensive care bed needs during the COVID -19 pandemic

Safety II behavior in a pediatric intensive care unit

Analysis of organizational accidents by FRAM and classification of organizational accidents from the viewpoint of the occurrence form

On systemic problem solving and the error of the third kind

Blood transfusion with health information technology in emergency settings from a Safety-II perspective. In: Resilient Health Care

Minding the gaps: creating resilience in health care

Improving local health through community health workers in Cambodia: challenges and solutions

A Monte Carlo evolution of the Functional Resonance Analysis Method (FRAM) to assess performance variability in complex systems

Defining the functional resonance analysis space: combining Abstraction Hierarchy and FRAM

Resilience engineering: current status of the research and future challenges

Framing the FRAM: a literature review on the functional resonance analysis method

Transporte fluvial no Solimões -uma leitura a partir das lanchas Ajato no Amazonas

Assessing risk in sustainable construction using the functional resonance analysis method (FRAM)

Understanding and improving safety in artisanal fishing: a safety-II approach in raft fishing

Double checking injectable medication administration: does the protocol fit clinical practice?

What an ambulance nurse needs to know: a content analysis of curricula in the specialist nursing programme in prehospital emergency care

A proposal for a predictive performance assessment model in complex sociotechnical systems combining Fuzzy logic and the functional resonance analysis method (FRAM)

Learning from incidents in health care: critique from a Safety-II perspective

Cognitive Work Analysis: toward Safe, Productive, and Healthy Computer-Based Work

The terminology of community health workers

A framework for rationing ventilators and critical care beds during the COVID-19 pandemic

The Alaska Airlines Flight 261 Accident: A Systemic Analysis of Functional Resonance

Essential characteristics of resilience

Quantitative resilience assessment of chemical process systems using functional resonance analysis method and Dynamic Bayesian network

The authors gratefully acknowledge all healthcare professionals who participated in this study, and particularly the SAMU professionals for their availability and willingness to share their knowledge during such challenging times. Rodrigo Arcuri gratefully acknowledges Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq). Paulo V. R. de Carvalho gratefully acknowledges the Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq) grant number 304770/2020-5 and Fundação de Amparo a Pesquisa do Rio de Janeiro FAPERJ project number 260003/001186/2020.