The control versus resilience rationale for managing systems under uncertainty

We compare two rationales for the management of social-ecological systems under uncertainty: control and resilience. The first focuses at system performance, the second at system capacity to cope with change. The two schools of thought promote their own legitimacy, but undertake little effort to transcend their own perspective. Though, different scholars have pointed at the necessity of combining control and resilience for managing a system. We review the literature on control and resilience, synthesize the work in these fields into one coherent conceptual framework and reflect on the question whether control and resilience strategies can be reconciled or whether inevitable trade-offs are to be made. Based on a literature review, we develop a framework contrasting both rationales through their preferred (contrary) system attributes. Next, we discuss the operationalization of these system properties for policy development. Policies will generally reflect elements of both control and resilience. There will be trade-offs between preferred system attributes, where development of resilience restricts the development of possible control (and vice versa). The conceptual framework introduced provides a ‘language’ for contrasting and possibly (partly) reconciling the control and resilience rationales. Such a language is crucial for a meaningful policy discourse between actors, because it helps in understanding the implications of different rationales and in comparing alternative policies in terms of control and resilience.


Introduction
A social-ecological system is a system representing people and their environment, with complex interactions between its various subsystems. People adopt certain policies and strategies to influence the behaviour of the system that they are part of. In this way, they anticipate or respond to changes that occur within or outside the system. Our knowledge of a socialecological system and the effects of our actions is often characterized by uncertainty resulting from complexity in the system (Polasky et al 2011). As a result, our actions may lead to unintended consequences. Uncertainty refers to the absence of complete and shared understanding of the system to be managed (Brugnach et al 2008), of which actors may be either aware or unaware (Holling 1986). It may originate from diverse sources such as variability in natural processes and human behaviour within the social-ecological system or its environment, limited knowledge of actors about the system and ambiguity in actor's frames of reference of the system (Schön and Rein 1994) due to their different backgrounds, norms, values and interests (Van Asselt and Rotmans 2002, Brugnach et al 2008. A thoughtful consideration of uncertainty handling in policy development may result in a better anticipation of future developments and contribute to a more appropriate response (Van Asselt and Rotmans 2002, Walker et al 2002, Aerts et al 2008. The management of systems under uncertainty has been the subject of much scientific study. In general, we distinguish two main rationales (see Walker and Salt 2006, Wardekker et al 2010, Anderies et al 2013. In the control rationale, the focus is on managing system performance for one or a few variables of interest, which is based on a clearly defined system model with clearly defined (bounded) levels of uncertainty (Clark andKirkwood 1986, Morgan andHenrion 1990). In the resilience rationale, the focus is on managing a system's capacity to respond to change, which is based on an understanding of the interplay of system persistence and transformation , Folke 2006, Carpenter and Brock 2008. While the control rationale has its roots in engineering and economics, the resilience rationale is rooted in ecology. Whereas the control rationale has a strong history in computation and optimization, the resilience rationale is primarily focussed on considering the diversity of features of systems.
Each rationale has its own virtue. There is no consensus: scholars of both rationales operate rather isolated from one another. The mainstream controlbased policy and uncertainty analysis literature has limited attention for the concept of resilience (Morgan and Henrion 1990, Margules and Sarkar 2007, Dunn 2008). On the other hand, scholars working on resilience mainly refer to the control rationale to point at the failure of its practices in the past (e.g. Holling 1973). According to Anderies et al (2006), the theory of optimization served well in the early development phase of resource use industries, but we need to move on to an era in which something like a resilience framework forms the basis for policy and management. The application of robust control theory , Rodriguez et al 2011, methods to analyse control of dynamic systems using viability theory (Martin 2004, Rougé et al 2013, optimization techniques for resilience concepts (e.g. Van den Bergh 2008) and methods for robust decision-making (Polasky et al 2011) provide attempts to reconcile the two rationales, but until date there remains a schism between control for-resilience approaches (integrating goals of resilience under the control approach) and replace-control-by-resilience approaches.
A number of scholars explicitly point at the necessity of managing a system for both control (or performance) and resilience (or capacity to handle change) (Walker et al 2002, Aerts et al 2008. Anderies et al (2013) advocate a policy design framework in which ideas from control and resilience are used in a complementary fashion. Since both rationales value different system attributes (system properties) for management intervention, policies informed by either of these rationales will most likely differ. Therefore, policy development will involve a discussion on reconciling or balancing the control and resilience rationales for policy and require thorough debate when trade-offs are inevitable . Such a discussion could be facilitated by an overview of preferred system attributes in both rationales. However, a (recent) structured comparison of these attributes is missing. In the social sciences literature, some authors have compared the system attributes of both rationales (e.g. Ashmos et al 2002), but a comparison valid for both social and ecological systems can be found only in Wildavsky (1988).
In this article, we review the literature on control and resilience, synthesize the work in these fields into one coherent conceptual framework and reflect on the question whether control and resilience strategies can be reconciled or whether inevitable trade-offs are to be made. We develop an (updated) overview of preferred system attributes that are the focus of management intervention in a resilience or control rationale. We carry out a detailed side-by-side comparison of the contrary system attributes that are preferred in both rationales. The framework can serve as a 'language' for discussing and analysing control and resilience on the level of policy development and evaluation, which is currently missing. Based on this language, we seek to increase insight in the possibilities to simultaneously manage a system for performance and capacity to handle change.
In searching relevant publications we have used keywords characterizing either the control or resilience rationale. For the control rationale we used the following keywords: optimization, specialization, maximum sustainable yield, performance, robustness, and robust control. For the resilience rationale we looked for: diversity, redundancy, vulnerability, critical thresholds, tipping points, regimes shifts, coping capacity, flexibility, adaptation, adaptability, adaptive management, transformability, and societal transformation. In both cases-even more so in the case of the control rationale-the keywords are such general words-part of our daily vocabulary-that the catch of publications in a simple search on Web of Science, Scopus or Google Scholar is far too great to handle. We therefore used combinations of keywords and searched in titles only to reduce the numbers, looked for highly cited publications, particularly tracked a number of authors known in the field of resilience studies, and used our own experience to select relevant sources. As for the resilience literature, one major source to be mentioned in particular is the journal Ecology and Society. Regarding the control rationale, much of it is reflected in standard resource economics and engineering textbooks.
2. Contrasting the control and resilience rationales 2.1. The control rationale In the control rationale, the aim is to manage a system for performance of one or a few variables of interest (such as yield). Policy is developed under the assumption that system dynamics are sufficiently known, or related to bounded uncertainty levels that can be estimated. Optimal control theory starts with a clear formulation of a problem definition and policy objective followed by the optimization of policy strategies. This typically includes the quantitative solution of a well-defined objective function (model) for a set of variables, such as costs, benefits and constraints applying to alternative management actions , Reed 1979. It requires the definition of clear system boundaries and a simplified representation of system dynamics in order to be tractable and enable optimization. The system is decomposed into subsystems under responsibility of individual management institutions. Uncertainty in the system model may be estimated in a quantitative or qualitative way to investigate its influence on policy effectiveness (Clark and Kirkwood 1986, Funtowicz and Ravetz 1990, Morgan and Henrion 1990. A notion typically used in the control rationale is that of 'maximum sustainable yield' (Walker et al 2004, a concept widely used in resource economics, from agriculture and forestry to fisheries and groundwater abstraction.
The approach is based on optimal control theory (Pontryagin et al 1962), which originates in mathematics. The scope of application rapidly expanded to diverse types of systems in various fields (Miser and Quade 1988), such as economics, policy and decision analysis (Raiffa 1968, Dunn 2008) and natural resources management (Reed 1979, Clark and Kirkwood 1986, Margules and Sarkar 2007. More recently, for intrinsically uncertain systems, the optimal control approach is often replaced by a focus on robust control , Rodriguez et al 2011. Robust control seeks to identify policies that are robust to model misspecifications, i.e., perform well over a set of possible models and input ranges, thus accounting for uncertainties. The development of policy in the control rationale is primarily the task of government and academia (Scott 1998). Central coordination and task specialization are preferred for performance (Weber 1947), where procedural rules and bureaucratic institutionalization form the main strategy (Schwartz and Thompson 1990). Scott (1998) describes cases of extreme control at state level, where officials aim at transforming the population, space and/or nature under their jurisdiction into closed systems that offer no surprises and can best be observed and controlled. These attempts are based on (1) the positivist idea that science is capable of producing true, objective, and universal knowledge and (2) the assumption that actors behave rational. In most contemporary literature, these two ideas have been replaced by the idea of socially constructed knowledge and the idea of bounded rationality, respectively (Simon 1978, Jasanoff 1990, Dunn 2008). This has resulted in an increased focus on involving regional and local stakeholders in a process of policy development (Koppenjan andKlijn 2004, Knight et al 2006), but always within a framework of strong central regulation .
A typical policy strategy in the control rationale focuses on removing disturbances that decrease performance (Walker et al 2002, Blanchard andFabrycky 2014). In flood management, for example, one typically focusses on constructing and reinforcing embankments. The dike infrastructure controls the physical process of flooding, diminishing system dynamics (floods) and related uncertainty for the hinterland. The policy thus introduces benefits for economic functions, such as housing and industrial activity, increasing their performance.
In agriculture, as another example, one typically concentrates on creating optimal conditions to maximize crop yields and livestock production efficiency. In crop production this is done, amongst others, by improving crop varieties, increasing scale of operations, monoculture, optimal application of water and fertilizers, and pest and weed control. In livestock production this is done for instance by selecting for the most productive breeds, improving feed composition, increasing herd size, confining the animals, applying preventive antibiotics, and reducing animal mobility to minimize energy losses. Regions typically concentrate on specific crops or animal products and consumers and producers are linked through international trade.
Scholars of resilience argue that the downside of system control is a reduced potential of the system to adapt to change, which makes it more vulnerable for unforeseeable disturbances. At the same time, disturbances occur more often as a result of the alteration of the system dynamics (Beck 1999, Davidson-Hunt and.

The resilience rationale
In the resilience rationale, the aim is to manage a system's capacity to avoid or handle regime shifts that impede its continued functioning. A regime shift is understood here as a persistent change in system structure and functioning. The more resilient a system, the larger the disturbance it can absorb without shifting into an alternate regime . Climate change beyond a certain threshold can be considered as a regime shift, but also natural disaster, new technology, changing production or trade patterns, political revolution and war can cause a regime shift. Within the resilience rationale, the focus is on increasing system capacity to cope with, adapt to and shape change, thus developing a response to both expected and unexpected uncertain developments , Folke 2006. The rationale departs from the notion that knowledge is inevitably incomplete, change and surprise are more rule than exception, and attempts to control the system are bound to have unintended consequences (Taleb 2010). Resilience reflects the capacity of a system to absorb disturbance and re-organize while undergoing change so as to still retain essentially the same function, structure, identity and feedbacks (Walker et al 2004). System analysis for resilience typically focuses at understanding system change, such as nonlinearities and feedbacks and dynamics across temporal and spatial scales. Much research is also directed towards the study of critical thresholds-or tipping points (Milkoreit et al 2018)-that can lead to regime shifts (Rocha et al 2015) or system collapse (Cumming and Peterson 2017). The idea of system resilience finds its origin in ecology (Holling 1973) and was formulated as a reaction to system control. The resilience perspective began to influence fields outside ecology like ecological economics (Perrings et al 1992) and policy studies (King 1995). Early work on resilience focused on the capacity to absorb shocks and still maintain function, so-called engineering resilience focused on persistence and recovery (Hashimoto et al 1982). Over time, the scope of the resilience concept has gradually expanded. The focus changed from ecological to social-ecological systems, and scholars explicitly extended the resilience concept to include the capacity for renewal, re-organization and development Holling 2002, Berkes et al 2003). Current resilience thinking incorporates a dynamic interplay of persistence, adaptability and transformability (Folke et al 2010). Béné and Doyen (2018) distinguish a continuum of five resilience strategies. The strategy of resistance aims at stability. The strategy of coping aims at absorption and buffering; it allows temporary change in the parameters of control of the system. The strategy of adaptation aims at flexibility, allowing change in the parameters of the control of the system. The strategy of adaptive preference goes one step further, aiming at adjustment and changing expectations. Finally, the strategy of transformation allows for a change in the structure and functioning of the system. The five categories of resilience strategies essentially differ in terms of the degree or intensity of changes in the dynamics of a system, from no change in the resistance strategy to structural change in the transformation strategy.
Resilience thinking has strong connections to adaptive co-management and adaptive governance literature, a body of research aiming to understand the social dimension of ecosystem management. Scholars of resilience focus on linking this insight of social systems with insight on ecosystem dynamics to ensure the capacity of the combined socio-ecological system to sustain adaptation (Folke 2006). In the resilience rationale, the emphasis is on multi-level governance, with the participation of governmental and non-governmental actors in the management of social-ecological systems. Application of these concepts is expected to promote greater capacity to learn and cope with change (Huitema et al 2009). Whereas the control rationale has a strong focus on measurement, the resilience rationale addresses qualitative features like flexibility, adaptability and robustness. More recently, however, also within the resilience literature one can find a stream of publications with a more quantitative approach to resilience, aimed to find measurable indicators (Quinlan et al 2016).
A distinction can be made between 'general' and 'specified' resilience. The former refers to the resilience of any and all parts of a system to all kinds of shocks, including novel ones, while the latter refers more particularly to the resilience of some particular part of a system to one or more identified kinds of shocks (Folke et al 2010). Specified resilience requires the definition of system boundaries and a policy objective, focusing on a specific part of the system and specific disturbances. In this case, the question really is specifically 'resilience of what to what' (Carpenter et al 2001). Therefore, this more specific conception of resilience is close to the robustness concept used in robust control theory (see Anderies et al 2013).
A typical resilience policy in flood management combines different complementary strategies for flooding, such as evacuation plans, spatial planning aimed at low potential damage and (limited) embankment, as opposed to the focus on only one of these strategies in the control rationale. The complementary strategies provide a backup when embankments fail (surprise) and prevents a system lock-in for a single strategy by keeping options open for future adaptation or transformation. A resilience strategy to cope with floods may also be to shift dikes more land inward and thus give more room for the river, leaving more space for natural river dynamics, but also taking valuable land that could have been used more productively.
In the field of agriculture, resilience strategies typically focus on a diversity of (locally adapted) crop varieties and animal breeds, crop rotation, intercropping, extensive rather than intensive farming, farming practices adjusted to local conditions, and production for local consumption. From the control and performance perspective this approach is at the cost of achieving optimal yields and efficiency, but from the resilience perspective it improves long-term viability.

Conceptual framework
There is no generally agreed upon list of preferred system attributes for either control or resilience. Therefore, we compared and categorised system attributes discussed by various authors in the control and resilience literature (appendix tables A1-A2). We applied a number of criteria for the selection of the publications that were thoroughly scrutinized for this purpose. We favoured articles, books or other publications that: (1) are representative of or clearly describe one or the other rationale (or both); (2) present system attributes in a list; (3) are comprehensive, such as review articles that cover the social and ecological sciences; and (4) are or have been influential.
For the control rationale, fulfilling all four criteria simultaneously posed some difficulties. We explicitly wished to include some contributions representative of the control rationale (first criterion). However, we did not find scholars of the control rationale explicitly listing attributes (second criterion), since they generally take the rationale as an implicit point of departure. In addition, scholars of the control rationale often treat the social and ecological sciences separately (third criterion). Relaxing the second and third criterion, we selected standard works of system engineering (Blanchard and Fabrycky 2014), economics of natural resources (Clark 1976) and social sciences (Weber 1947). In addition, we selected a number of publications criticizing the control rationale, since these often provide considerable details on system attributes of control. We selected a specific contribution of resilience scholars  and two contributions of political science scholars (Wildavsky 1988, Scott 1998. Wildavsky (1988) is the only author explicitly presenting a list of system attributes of control; for the other authors we extracted the attributes from the text.
For the resilience rationale, we draw from four contributions that meet our criteria: Wildavsky (1988), Levin (1999), Walker and Salt (2006) and the Resilience Alliance (2007,2010). At first glance, the system properties for resilience listed by Wildavsky (1988) seem completely different from the system attributes listed by the other three contributions. At closer inspection, the sources differ mainly in terminology while the principles are similar. Since the publication of the above contributions, the resilience literature has further developed into the direction of adaptive co-management, which we feel is not fully reflected in the four sources selected. To ensure representation of the attributes related to adaptive co-management, we additionally included two review articles (Armitage et al 2009, Huitema et al 2009. These articles do not present a list of system attributes, so we extracted the attributes from the text. Based on the control and resilience literature analysed, we synthesized the system attributes preferred in the control and resilience rationales into one coherent conceptual framework (table 1). For clarity and conciseness, similar attributes have been clustered. For the clustering of attributes we searched for recurring themes in the cited references, which are often also indicated by the authors. We do not claim that the list of attributes shown in table 1 is exhaustive. The selection of publications, the extraction of presented attributes form the text (when no list of attributes was presented) and grouping of the attributes by theme necessarily involves subjectivity and interpretation. However, the list largely covers the important attributes discussed in literature. We have not found radically different attributes or themes in other literature sources.
2.4. Review of the system attributes 2.4.1. Specialization versus diversification Specialization in the control rationale serves to increase system performance. The control rationale is characterized by a focus on one best strategy (or best set of strategies), allocating all resources to optimize this strategy, and clearly demarcating tasks and responsibilities among social actors. The goal is to organize things in a cost-efficient manner based on detailed system knowledge. The focus on a limited set of strategies increases surveyability and therefore control. The sharp division of tasks and responsibilities facilitates control (Weber 1947), which may manifest in one responsible organization or an organizational order in which each unit has a clear task that fits in an all-embracing organizational scheme (Teisman and Edelenbos 2011). A sharp division does not necessarily exclude some overlap as advocated in the resilience rationale, but aims at eliminating fuzziness that comes with this overlap.
The resilience rationale assumes incomplete knowledge and the existence of different values and objectives. Diversity in a system is considered fundamental to the capability of coping with shocks to the system, avoiding lock-in. Diversity refers to a variety in elements (e.g. species, people, strategies, behaviours, organizations, institutions, etc) contributing to the same function. Since various elements will respond to change and disturbance in a different way, diversity enables the system to function under a wide range of conditions (Kinzig et al 2002, Walker and Salt 2006, Norberg et al 2008. Walker and Salt (2006) discuss diversification of response strategies in general, while Aerts et al (2008) more specifically discuss diversity by developing complementarity policy strategies. An overlap in tasks and responsibilities is a form of diversity where multiple non-identical agencies are responsible for the same task or function, which enables agencies to 'take over' the functions of other parts in case of disturbance (Low et al 2003, Walker andSalt 2006). Within the resilience rationale, it is wise to allocate resources and responsibilities to multiple agencies or organizations with overlapping tasks. Furthermore, there is a focus on developing a variety of (complementary) strategies, where the level of diversification increases with dissimilarity of strategies and a balanced resource allocation between strategies (Stirling 2007, Van den Bergh 2008).

Reducing versus valuing variability
Within the control rationale, natural and social variability are perceived as disturbance, reducing system performance, and should therefore preferably be reduced Meffe 1996, Blanchard andFabrycky 2014). Strategies are characterized by their attempt to confine natural and social dynamics by system modification to minimize disturbances and standardization of behaviour.
In the resilience rationale, variability and dynamics are valued rather than regarded as something to be reduced and controlled. Natural and social variability are supposed to be useful when faced with shocks to the system, because it increases the chance that not the whole system fails, since there will also be elements that are not vulnerable or that happen to be adaptive. This thinking is reflected in the appreciation and stimulation of natural and social variability in policy strategies (King 1995, Holling andMeffe 1996), for example by fine-tuning regulations to the local context, accounting for local knowledge, and by allowing for social and natural dynamics. The presence of variability is considered to have a stimulating effect on diversity in system response.

Optimization versus creating redundancy
An optimized system has limited redundancy and reserves, in order to obtain maximum benefits from resources for the formulated policy objectives. The control rationale focuses on economically efficient resource allocation. Reserves are limited to situations where reliability on elements is critically important (Blanchard and Fabrycky 2014) and are prescribed in procedures (e.g. as safety margins). System optimization to enhance performance is a logical step after natural and social dynamics have been confined. It implies the concentration of resources (Davidson-Hunt and Berkes 2003) in order to maximize resource productivity. This strategy practically translates to employing cost-benefit analysis to determine the most efficient use of resources.
Reserves and redundancy in the system does not fit the strategy of optimization, but are key elements in resilience thinking. Reserves are identical system elements that are redundant under expected conditions and therefore create buffer capacity to cope with change and surprise. Reserves may, for example, provide an increased encounter rate of elements in emergency situations (e.g. multiple emergency exits enlarge the likeliness of finding one quickly), extra response capacity when conditions exceed expectation and backup capacity in case of failure of an element. Having reserve capacity is to be distinguished from the concept of diversity, since it provides spare response capacity rather than a different response to surprise. Reserves may be in use or not during expected circumstances (Low et al 2003). Unused reserves point at over-dimensioning, such as land reservation for future flood management. When reserves are in use, this generally refers to extensive use, for example flood zones that are only used during flood. Over-dimensioning serves the purpose of coping with surprise (events going beyond expected uncertainty). Extensive resource use does not maximize (direct) benefits for the system under daily circumstances, but is considered to increase viability under extreme circumstances. De Bruijn et al (2017) interpret the availability of sufficient reserves in terms of the availability of different forms of capital. They consider recovery capacity as a key element of resilience and-in the context of resilience to flood events-point at the importance of the availability of sufficient social capital (the individual ability of people to respond), institutional capital (the ability to organise repair and reconstruction), and economic capital (the ability to finance repair and reconstruction).

Functional connectedness versus modularity
In the control rationale, the connections between system components are strictly functional. The ideal is a system with strong functional links between specialized sub-components. Separate system components are highly specialized in order to increase overall performance. Separate system components are isolated from outside disturbances (Blanchard and Fabrycky 2014). The connectivity between system components is maximized for aspects that positively affect performance. Other (non-functional) connections between system components are minimised. As for the mode of coordination, centralization is regarded as the best way to optimize overall system performance (Weber 1947, Janssen et al 2006. There is standardization and formalization of system design, tasks, responsibilities and interaction between actors in order to reduce the number of errors being made (Weber 1947). Policy intervention takes place on system scale, which is favoured for advantages of surveyability and cost-benefit ratio (Fiering 1982). In addition, this rationale tends to focus at single purpose planning.
Functionally connected and thus mutually dependent systems rapidly transmit shocks through the system, making them susceptible to disturbances with large consequences (Gunderson et al 1995). The resilience rationale prefers a modular system, whereby modules are (partly) independent. Modularity is to be balanced with some degree of connectedness (openness) (Resilience Alliance 2007, 2010, Webb and Bodin 2008), to avoid isolation, which could affect innovation and reduce the possibility for migration or support from outside in case of surprise. Levin and Lubchenco (2008) distinguish between modularity in space and organization. Modularity in space includes the presence of physical compartments and refuge possibilities; the balancing of modularity and connectedness results in loosely connected areas. Modularity in organization refers to decentralization and self-organization. For balancing modularity and connectedness, the adaptive co-management literature suggests a multi-level governance structure with multiple centres of power at different scales (with horizontal and asymmetric or vertical relationships). An example includes the 'nesting' of institutions where decentralized (self-organizing) modules are facilitated by rules and incentives of higher levels (Ostrom 1990). A third important subject in resilience literature is the interrelation between scales for policy intervention. Scholars emphasize the need to understand and manage a system at multiple scales (Resilience Alliance 2007, 2010), since processes at larger or smaller spatiotemporal scales can have a large influence on the results of policy intervention at a specific scale.
An example of functional connectedness in spatial sense is when different areas get specialised, whereby continued urbanization of large cities goes hand in hand with big industries and large-scale agriculture in other areas, with different countries specializing in different products and international trade linking distant producers and consumers. This creates strong interdependences and a certain vulnerability to extreme events (like a failed harvest in a major production area may affect remote consumers). The resilience rationale favours an approach in which activities are more spread out and less concentrated; local disaster can still affect people, but rather locally, and support can come from other areas not hit by the disaster.

Performance-oriented versus adaptation-oriented organization
In the control rationale, systems are to be organized efficiently to perform best under expected conditions. The rationale therefore focuses on establishing clear structures, formal role relationships, thereby minimizing connections between actors (Ashmos et al 2002). Decisions are best left to a limited number of actors (mostly state officials and scientists), who decide in the best interest of the rest of the population (Scott 1998). This (bounded) rational choice is based on a formalized representation of the system. The approach limits openness to actors and information outside the network addressed, in terms of local knowledge and other ways of doing things. Just as the resilience rationale, the control rationale values a good information infrastructure within the system. The difference is the actor involvement in information development and sharing, and the type of information aimed for in monitoring. Monitoring focuses on goal achievement and guarding system functioning (Holling and Meffe 1996).
The resilience rationale considers adaptive capacity as the most important trait of a system. Hence, the system must be organised to enlarge flexibility and adaptability, to ensure the system can handle disturbances and change. In the literature on adaptive comanagement, adaptability is referred to as the capacity of people in a social-ecological system to tolerate and deal with change through collective action. Adaptive processes that relate to this capacity emerge out of the system's self-organization (Folke 2006). Features of adaptive co-management that contribute to resilience include the existence of relevant networks and feedbacks, collaboration and shared knowledge and learning (Plummer et al 2012). For networks and feedbacks, the focus is on quick notification of and an appropriate response to disturbance and change. Favourable network characteristics mentioned in this respect (Huitema et al 2009) are flexibility (ability to manage issues with different scopes at different scales, which we call context-dependent structures) and reflection of local conditions and preferences (which suggests some form of decentralization (Janssen et al 2006)). Janssen et al (2006) relate these network characteristics to a high reachability of actors within a network, which is influenced by the connections between actors. The aspect of collaboration mentioned for adaptability refers to the participation of governmental and nongovernmental actors in the management of social-ecological systems (Huitema et al 2009). Finally, shared knowledge and learning refers to governmental and non-governmental actors, in which process multiple sources of knowledge and system representations (such as local knowledge) are incorporated. For the operationalization of the concept of adaptable system organization, polycentric or multi-level governance is suggested, but hard evidence of its effectiveness is lacking (Huitema et al 2009). These forms of governance offer advantages, but also a number of disadvantages such as complexity of decision-making. Despite missing knowledge on the conditions under which approaches work or do not work, we see some consensus among scholars, supported by evidence (Plummer et al 2012), on a number of aspects supporting adaptability including: actors meeting in multiple (contextdependent) configurations (stimulating reachability), opening up the policy arena for others than politicians, bureaucrats and scientists and valuing other information and representations than scientific information.

Exploiting current versus exploring new strategies
The control rationale builds on the exploitation of proven strategies. This approach creates reliability in experience through refinement, productivity and focused attention (Levinthal andMarch 1993, Holmqvist 2004). In the context of policy development in a social-ecological system, exploitation serves to increase yield of current strategies or compensate for change in the internal system and its environment that compromises their yield. Interventions to refine policy or increase productivity typically include intensifying resource use, increasing task specialization and routinization. To provide a response to expected uncertain developments, such as climate change, policy development in the control rationale typically includes an exante assessment of possible futures to evaluate policies and increase their robustness under this range of conditions (Walker 1988, Funtowicz and Ravetz 1990, Rotmans and de Vries 1997. The control rationale thus focusses on fine-tuning of existing policy strategies, optimization of policy for expected future developments (robustness) and sustaining or increasing policy yield.
The resilience rationale is more explorative, open to new, alternative strategies. The interest lies in renewal of strategies and transformability of the system in response to disturbances and change. Exploration implies that efforts are taken to create a variety in experiences through experimentation, trialing and free association (Holmqvist 2004). The conditions that facilitate exploring new strategies in a system are partly influenced by the other system attributes preferred in the resilience rationale, especially diversity and context-dependent network structures. For example, diversity stimulates innovation through possibilities for recombination and spill-over effects, while it avoids lock-in (Van den Bergh 2008). Transformability is the capacity of people to create a fundamentally new social-ecological system when ecological, political, social, or economic conditions make the existing system untenable (Walker et al 2004). The topic of transformation trajectories is the subject of a growing body of literature (Gunderson and Holling 2002, Geels and Kemp 2006, Feola 2015. A resilience perspective emphasizes an adaptive approach, facilitating different transformative experiments at small scales and allowing cross-learning and new initiatives to emerge (Folke et al 2010). The perspective draws in part from the socio-technical transitions literature (e.g. Loorbach 2007, Fischer-Kowalski andRotmans 2009). Case studies of social-ecological systems suggest that transformations consist of three phases: being prepared for or even preparing the socialecological systems for change, navigating the transition by making use of a crisis as a window of opportunity for change, and building resilience of the new social-ecological regime (Olsson et al 2004. Such transformations are never scale-independent, but draw on social-ecological sources of resilience across scales (Gunderson and Holling 2002).

Coherence between system attributes
The preferred system attributes in the control rationale show coherence and correlation, and similarly in case of the resilience rationale. For example, economically efficient resource allocation (in the control rationale) drives the intensification of resource use and division of tasks (specialization). Since these attributes refer to different components of the system, it is valuable though to list them separately. Besides, the complexity of socialecological systems implies that the extent to which they are controlled or show resilience can impossibly be captured by just one or a few system characteristics. Therefore, the sort of review as undertaken here inevitably results in lists of related system attributes necessary for either control or resilience.
Finally, it is worth noting that there is a difference between policy and strategy regarding the management, design and organization of a system and the actual state of a system. In other words, a system can be designed and managed according to either the control or resilience rationale, but this does not necessarily mean that the system is indeed either under control or resilient. The actual level of control or resiliency also depends on the specific characteristics of the social-ecological system at hand; there are limitations to both control and resilience.
3.1. 'What is best depends on the type of system' Policies in practice will generally reflect elements of both control and resilience to different degrees. The desired combination of control and resilience in a policy can be chosen in consideration of the characteristics of the system to be managed, like its complexity and the types of uncertainties. In addition, the desired combination of control and resilience is subject to subjective preferences; it depends for example on the level of risk seeking or avoidance.
According to Wildavsky (1988), building resilience is important in conditions of low predictability and/or weak knowledge about the system, conditions generally fulfilled in a social-ecological system, while strategies aimed at control are suitable for systems that we know well and where uncertainties are reasonably known as well. In the latter case, anticipation through control makes sense, while in the former case it is unclear what can best be anticipated, so that resilience, i.e. the capacity to cope with unexpected developments that cannot be anticipated, becomes important. Wildavsky asserts that anticipation through control is the best strategy when one can demonstrate that the worst risks we face are in fact the ones we can predict with high probability. For conditions of considerable system knowledge but low predictability of change, Wildavsky suggests considering controlling strategies to ward off the worst that can reasonably be expected together with developing system resilience.
This sort of reasoning requires an understanding of how a certain set of system characteristics (like the level of complexity and the presence of uncertainties and 'unknowns') translates to knowledge on whether a control or resilience strategy better fits the system considered. This sounds like a promising route and inevitably results in the general recommendation that resilience strategies become more important with increasing system complexity, lower predictability and increasing openness of the system (interactions with things outside the system), but it is doubtful whether this recommendation is very useful in practice, because all real-world social-ecological systems are complex, uncertain and open, so that measuring the 'degree' of complexity, uncertainty and openness becomes critically important, which is notably difficult. Whether thus we will ever be able to derive what rationale (or combination of rationales) is best as a function of 'the type of socialecological system' at hand, remains an open question. Besides, an interesting paradox here is that the characteristics of a system depend on whether the system is managed from a control or resilience rationale, so that it becomes doubtful to let the system characteristics determine the best rationale for its management.
3.2. Combining elements of control and resilience at system attribute or overall system level A relevant question is whether not forms of control and resilience can simply be combined. Such combination can be considered at the level of individual system attributes as well as the level of the system as a whole. The question at the level of one specific system attribute is: to which extent is it possible to combine contrary approaches at the level of one specific system attribute? This is about the possibility of horizontal combinations in table 1. For example: is it possible to combine striving for one best strategy (control) with applying complementary strategies (resilience)? Or: is it possible to allocate resources most economically (control) and simultaneously over-dimension and create reserves (resilience)? For each system attribute, the question is whether there is really a fundamental conflict that cannot be overcome or whether the conflict is illusionary and can be overcome by applying new integrative concepts and approaches. The question at the level of the system as a whole is: to which extent is it possible to shape some system attributes according to the control rationale and others according to the resilience rationale? This is about the possibility of vertical combinations in table 1. For instance: is it possible to combine specialization (control) with creating redundancy (resilience), or to combine the reduction of variability (control) with modularity (resilience)?
On attribute level, the overview of preferred system attributes intuitively shows that managing from the perspectives of both rationales is to a certain extent incompatible. For example: it is impossible to have high flood defences (confining dynamics) and still allow undisturbed dynamics in the hinterland (living with dynamics). Still, some balancing is possible. A flood defence may have openings through which the water flows under normal conditions, which are closed under flood conditions. Or a flood defence may have openings that allow water to overflow during flood conditions. The possibilities of balancing are however restricted by available (financial) resources and societal feasibility. Both preparing the hinterland to cope with dynamics and developing flood defences is costly, while resources are mostly limited.
These restrictions result in a trade-off between system attributes as preferred within the control and resilience rationales. The preferred system attributes in table 1 represent the ends of a spectrum of possibilities (complete resilience versus complete control). Table 2 shows how the full spectrum of possibilities could look like for the cases of strategic choice, task division and natural variability. Moving from left to right in the spectrum, the level of control decreases and the level of resilience increases. As it is shown, several intermediate positions between the two extreme positions are possible. The visualization of this spectrum of possibilities facilitates thinking about alternatives for policy.
Seeking intermediate positions on the spectrum seems logic and attractive. In many instances, the existing emphasis on control calls for including more characteristics that contribute to resilience. For example, in Dutch flood policy, in addition to the traditional focus on constructing strong dikes, there is increasing attention to developing complementary strategies, such as providing more room for natural river and coastal dynamics, floodproof spatial planning of the land behind the dikes, and disaster planning (all aimed at increasing resilience). At the same time, however, the traditional emphasis on control remains, with flood risk standards being increased and effects of resilience-oriented strategies internalized in control-oriented performance assessment, thus building on and reinforcing the control strategy. This combination implies several trade-offs. The investment costs for introducing both reinforcement of flood defences and truly complementary strategies for increasing resilience are high. Besides, the focus on a best strategy of flood protection likely reduces the societal support for complementary strategies. National-scale policy for flood protection removes the sense of urgency for complementary local strategies, and so impedes management at local scale required for their implementation (see Berkes 2002, effect of centralization of decisions making). Because of these implications, the question rises whether the combination is viable at all. On the overall system level, one can combine elements from the control and resilience rationales. Economic allocation of resources (control) can be combined with attention for stakeholder involvement and involvement of local and context-specific knowledge (resilience) and robustness (control) can be combined with creating reserves (resilience). There may be various combinations, which is an interesting aspect for future research.

Reconciliation efforts
Although elements of control and resilience can be combined to some degree, a relevant question is whether this means that both rationales can be reconciled at a fundamental level, achieving both optimal control and the greatest level of resilience. Reconciliation at a practical level is different from reconciliation at a fundamental level. If resolving the conflict is possible only at the practical, not the fundamental level, combining both rationales simply means a bit of control here and a bit of resilience there, like a compromise, thus giving up both some control and some resilience.
At a fundamental level, robust control theory and viability theory are two theories that have been suggested as ways to reconcile the control and resilience rationales. Control theory is a branch in engineering that considers how to control dynamic systems to yield a certain desired output. Robust control theory explicitly deals with uncertainties in system behaviour (Zhou and Doyle 1998). Robustness means that the output from a system, e.g. its performance, varies little when some of the inputs vary. Because shocks are specific examples of variation in inputs, robustness can be interpreted as reduced sensitivity of outputs to shocks; if outputs are related to the continued functioning of the system, then robustness and resilience are related (Anderies et al 2013). The concept of robustness thus provides a bridge between the control literature that focusses on optimizing performance and the resilience literature that centres around coping with disturbances and shocks. The idea that control can be aimed at increasing system resilience suggests reconciliation of the two rationales. Though, the concept of robustness is particularly close to the concept of specified resilience, whereby a specific system is studied, the policy objective (performance indicator) clear, and the disturbance of interest specified. Robust control cannot be equated with general resilience. While robustness refers to fail-safe systems within a defined range of uncertainty, resilience refers to safefail systems capable of learning, self-organizing, and adapting to change (Anderies et al 2013).
Viability theory, a branch of mathematics looking at the control of dynamic systems (Aubin 1991), has been put forward as a formal way to define resilience and analyse how to control for resilience (Martin 2004). In this approach, resilience is regarded as the possibility of a system, after a perturbation, to return to the 'viability kernel' of the system in a relevant time frame. This viability kernel can be interpreted as the sustainable zone, whereby a number of system properties remain within certain constraints (Béné and Doyen 2018). The approach is applicable to deterministic as well as stochastic dynamic models, and can thus be used to analyse ways to control for resilience under specified uncertainty (Rougé et al 2013). As in the case of robust control theory, viability theory can be used to analyse specified resilience. That means that it is applicable to analyse how to control for resilience of a specified system property to a specified disturbance at a specified spatial and temporal scale under specified uncertainties. One may wonder whether a strategy to control for this sort of specified resilience is a truly resilient strategy. General resilience requires capacity to cope with the unexpected and deal with unknown uncertainties.
While a theoretical framework to reconcile control and resilience is missing, in practice there are numerous attempts to enrich traditionally control-oriented strategies by approaches stemming from resilience thinking. The (implicit) suggestion in such attempts is often that the best of two worlds can be reached. An interesting example is the proposal for 'sustainable intensification' of agriculture, combining the traditional focus on increasing production, yields and efficiency with due attention for resilience (Foley et al 2011, Garnett et al 2013. According to Rockström et al (2017), sustainable intensification of agriculture is an approach that aims to meet rising human needs as well as contribute to resilience and sustainability. It remains unclear, however, what makes the proposed approach the fundamental paradigm shift as it is presented; when critically examined one can interpret the approach as just a smarter form of control as before. The key operational principles listed by Rockström et al (2017) still include things like 'maximize farm-level productivity' and 'utilize crop varieties and livestock breeds with a high ratio of productivity'. Admittedly, this is supplemented with important formulations that reflect ecological and social constraints and other requirements, but it is unclear what trade-offs are being made between optimizing production and building true resilience. This is not to criticize the type of changes proposed in the recent literature on sustainable intensification in agriculture; generally this new stream of publications builds on justified criticisms on conventional agriculture and points in directions that will definitely bring about improvements. However, it remains unclear whether the thinking really reconciles control and resilience at a fundamental level -achieving both-or rather creatively combines concepts from both rationales, avoiding clarity on precisely where and how trade-offs are made.
Another reconciliation effort can be seen in the literature on the 'safe and just operating space' for humanity, which refers to the need to manoeuvre in order to create good minimum living conditions for all while at the same time staying within the 'planetary boundaries' (Rockstrom et al 2009, Raworth 2017. In order to be safe, we need to reduce our environmental footprint well below critical thresholds, either at local level or global level (Hoekstra and Wiedmann 2014). The literature on environmental footprints, minimum needs, and local thresholds and planetary boundaries does a good effort in balancing the traditional focus on economic efficiency with the concerns of environmental sustainability and social equity, but it is not so obvious how this more comprehensive way of thinking on 'humans living with limited natural resources' balances control and resilience as well. Much of what is written in the planetary boundary literature is suggesting that control is to be replaced by resilience, that resilience is the core value. According to Rockstrom et al (2009), the planetary boundaries approach builds on three branches of scientific inquiry: (1) the study of the scale of human action in relation to Earth's capacity to sustain it; (2) the study of essential Earth system processes, including human actions; and (3) the study of resilience and its links to complex dynamics and self-regulation of living systems, emphasizing multiple basins of attraction and thresholds effects. The need to value resilience is thus intricately connected to the existence of planetary boundaries and the fact that humanity is surpassing these boundaries. Folke et al (2011) argue that dynamic and complex social-ecological systems require strategies that build resilience rather than attempting to control for optimal production and shortterm gain in environments assumed to be relatively stable. This leaves the question whether this indeed implies that the control rationale is to be completely replaced by the resilience rationale or whether some balance needs to be sought; and in case of the latter, where the balance should be, what trade-offs are involved, and what criteria are to be used to make these trade-offs?

Inevitable trade-offs
Several scholars have pointed out that increasing the capacity to handle change and reducing the sensitivity to uncertainty goes at the cost of a decreased performance of the system for core activities under expected conditions. Anderies et al (2007) and Rodriguez et al (2011) use robust control theory to illustrate such trade-offs, showing trade-offs between robustness and vulnerability (robustness to uncertainty in one set of parameters increases vulnerability to uncertainty in other parameters) and trade-offs between performance and robustness (performance can be sacrificed for increased robustness and vice versa). These robustness trade-offs likely also apply to resilience: any time a system becomes well adapted to handle a set of shocks this results in trade-offs for response to other shocks or performance (see Anderies et al 2013).
According to Janssen and Anderies (2007), managing social-ecological systems invariably involves tradeoffs: between different objectives, between risk and productivity, and between short-term and long-term goals. They argue that this is especially true in the case of robustness, i.e. the capacity to continue to meet a performance objective in the face of uncertainty and shocks, and that there are inevitable trade-offs between robustness and performance, and between investments in robustness to different types of perturbations. Similarly, Anderies et al (2006) argue that generating and maintaining the capacity to self-organize (to increase resilience) can be costly due to the required investments in human, natural, human-made, and social capital, and thus will go at the expense of foregone higher short-term returns. Wildavsky (1988) specifically contrasts anticipation in order to control with building resilience for the case of enhancing safety. We are used to think of control as increasing safety. Wildavsky, however, argues that safety and risks are intertwined, in the sense that enhancing safety introduces new risks. With control we try to increase safety by avoiding and eliminating risks, but while doing so we reduce resilience to respond to the unexpected, thus decreasing safety. This new risk may be at another scale, as Beck (1992) has argued in his influential book Risk Society. Control of the many (known) manageable risks at small scale may result at an increasing level of vulnerability at a larger scale. There are many examples at hand, from the large-scale risks of new technologies to the largescale risks of the way we manage our financial markets (Beck 1992, Taleb 2010. Thus, controlling small (manageable) risks can create big (unmanageable) risk.
Another interesting analysis of the working of control is the thesis of Tainter (1988) on the collapse of complex societies. Based on a thorough analysis of a range of civilizations of the past, he argues that civilizations develop through continued specialization, social differentiation, centralization, growing coordination, control and bureaucracies, more legitimizing activities and increasing functional interactions and information flows. Maintaining the rising level of socio-political organization requires increasing resources. With the increasing complexity that results from this, the marginal return on investments declines. To uphold the required level of investments, efficiencies are enlarged and reserves made smaller, thus contributing to the vulnerability to stress and the chance of collapse. Thus, according to Tainter (1988), increasing control comes with growing complexity and vulnerability. Growth can continue and collapse delayed by technological innovation or the discovery of new (energy) resources, thus temporarily raising again the marginal return on investments, but ultimately a new point will be reached on which returns decline and chances of collapse become realistic. Tainter's thesis does not offer the escape of building resilience to cope with this vulnerability. Whether this is too pessimistic or not, it is clear that the strategy of specialization, intensification of resource use and centralized control lies at the heart of societal vulnerability to collapse and that control thus conflicts with resilience. This is a recurring theme in studies of collapse of civilizations: the inability of a society to adapt is the ultimate reason for collapse, although at first sight it may be a more direct reason such as environmental deterioration, climate change or war (Diamond 2004).
The works of Wildavsky (1988), Beck (1992), Tainter (1988) and Diamond (2004) all suggest that control goes at the cost of resilience, that performance goes at the cost to adaptability. The studies by Wildavsky (1988) and Beck (1992) go even further by suggesting that the strategy of controlling risks creates new risks and therefore the need for resilience and adaptability. We thus end up in the paradoxical situation that the strategy of control brings us improved welfare, but digs its own grave by creating risks that threaten that welfare.
3.5. Do we need control or resilience for sustainability?
The broad idea of sustainability that has gotten shape during the past thirty years contains three focus concerns: environment, society and economy. The environmental concern is that humanity should live within the carrying capacity of the Earth in order to survive in the long run. The societal concern is that we need to share limited resources in a fair way. The economic concern is that we need to use limited resources efficiently. Sustainability is about creating welfare, sharing equitably and when doing so remain within the limits set by the planetary boundaries so that we can survive in the long run. Given the controversy between control and resilience approaches in managing our economy and environment under conditions of uncertainty, an important question is now what role the two approaches of control and resilience will have in aiming for sustainability.
Much of the resilience literature suggests that the classical focus on control has brought us on the path towards unsustainability and that we need to focus on resilience to bring about a societal transformation towards sustainability . As a counter-argument one can put forward that unsustainability typically follows from the focus on the economic pillar, neglecting the social and environmental pillars, and that the essence of sustainability is the addition of the other two pillars in decision-making. From this perspective, whether the three pillars are managed according to the control or resilience rationale is still another question, whereby just balancing control and resilience may be as appropriate or even more suitable than emphasizing resilience alone.
A lot of sustainability initiatives can even be characterized by the control rationale. An example is the plea to create forms of global governance with clear tasks and responsibilities delegated to new (democratic) global institutions, and close regulatory gaps at the global level (Biermann et al 2012). Interestingly, such proposals for enhanced control simultaneously speak about societal transformation, engaging all stakeholders and adaptation -which are all typical elements in the resilience rationale-but it generally remains unclear how control can be balanced with resilience or what sorts of trade-offs are to be made. The call for sustainability apparently results in both demand for greater control (measures to increase robust performance) and call for greater resilience (measures to increase adaptive capacity, i.e. our capability to handle change). Some make the bold claim that we need to replace control by resilience , while others make the more modest claim that we need to add more features of resilience , Restemeyer et al 2017. But honesty demands to say that the question on the balance between control and resilience for sustainability has not been sufficiently studied for providing a solid answer.

Conclusion
Based on a review of existing literature, we have provided a conceptual framework contrasting the control and resilience rationales for managing social-ecological systems. The framework provides a 'language' for discussing control versus resilience in policy development. We consider such a language to be crucial for a meaningful policy discussion between actors on the desired policy rationale and for a structured comparison of alternative policies in terms of control and resilience. The framework can be a point of departure in discussing trade-offs between and reconciliation of the control and resilience rationales for policy development. In this way, it may contribute to a richer policy design framework in which ideas from robust control theory and resilience theory are used in a complementary fashion.
Although scholars of control and resilience rationales have historically treated the two rationales as contrary and mutually exclusive, we observe recent initiatives to use them in a complementary fashion. In practice, policy strategies are often hybrid, reflecting elements of both control and resilience, in varying degrees. For using ideas from (robust) control and resilience in a complementary fashion, we contend that further research into the possibilities and impossibilities of combining attributes of resilience of control in policy is required.