Thursday, January 17, 2013

Adm. Hyman Rickover – Systems Thinker

The TMI-2 accident occurred in 1979. In 1983 the plant owner, General Public Utilities Corp. (GPU), received a report* from Adm. Hyman Rickover (the “Father of the Nuclear Navy”) recommending that GPU be permitted by the NRC to restart the undamaged TMI Unit 1 reactor. We are not concerned with the report's details or conclusions but one part caught our attention.

The report begins by describing Rickover's seven principles for successful nuclear operation. One of these principles is the “Concept of Total Responsibility” which he explains as follows: “Operating nuclear plants safely requires adherence to a total concept wherein all elements are recognized as important and each is constantly reinforced. Training, equipment maintenance, technical support, radiological control, and quality control are essential elements but safety is achieved through integrating them effectively in operating decisions.” (p. 9, emphasis added)

We think the foregoing sounds like version 1.0 of points we have been emphasizing in this blog, namely:
  • Performance over time is the result of relationships and interactions among organizational components, in other words, the system is what's important.
  • Decisions are where the rubber meets the road in terms of goals, priorities and resource allocation; the extant safety culture provides a context for decision-making.
  • Safety performance is an emergent organizational property, a result of system activities, and cannot be predicted by examining individual system components.
We salute Adm. Rickover for his prescient insights.


* Adm. H.G. Rickover, “An Assessment of the GPU Nuclear Corporation Organization and Senior Management and Its Competence to Operate TMI-1” (Nov. 19, 1983). Available from Dickinson College library here.

1 comment:

  1. While I'm eager to draw attention to the Admiral's prescience in the GPU Nuclear Report - particularly as it evidences Systems Science insights, I'd like to offer a slightly different take on the meme description you highlighted.

    For me the phrase in that description that deserves the most attention is "Operating nuclear plants safely..." This sense of this phrase "do nuclear powering safely" provided the ground for the DOE Integrated Safety Management Policy's objective "Work done safely."

    The phrase construction (What, How) was chosen intentionally to distinguish from a more prevalent meme, "Do safety; work when safe enough." The importance of Work as the noun/subject - instead of Safety as the noun/subject (and "work" as a verb in the "then" portion of the commonplace "if/then" framing) cannot be overstated.

    Rickover's view couldn't be more clear, the "concept of total responsibility" is directed at accomplishing the mission - with balanced attention to all the contributing control features. I'm confident the Admiral would turn up his nose were he to hear of "nuclear safety is the overriding priority."

    In my study of the genesis of our current devotion to "Doing (nuclear) Safety First" it is precisely setting aside the systems integration benefit of the "total responsibility" concept that sets the stage for the notion that some memes, such as "safety culture" or "safety performance is an emergent organizational property" represent the whole of any state in reality.

    I can grant that there is some communications shorthand benefit in talking about safety performance as the indicated by some subset of a performance measure suite (dose, skin contamination events, lost-time accidents), but in any Performance Assurance sense-making context, such talk is but a cross-sectional view of the actual integrating whole of the Enterprise and the performance (set of all outcomes) it produces as a consequence of its self-organization around its mission.

    Safety performance can not comprise a whole in its own right; to believe so is the step just before the logic that "safety" is the work the Safety Department does. That is the slippery slope to false partitions we've been sliding down for 50 years in the nuclear industry.

    And lest anyone question; no, NRC (nor DNFSB, nor INPO) does not "Do Safety" either - they do independent oversight (i.e. including standards setting, licensing, operational oversight, etc.)

    In my take Rickover concluded, from his experience as a Program Manager, that the "unit of work" (i.e. the mission), not the "unit of concern" (i.e. radiological exposure) was the basis for systemizing about wholly effective performance.

    "Focus on the work; do it safely" provides the payoff from systems thinking and the gateway to non-linear systems consequences for Performance Assurance in complex, high-consequence circumstance enterprises.

    In this "whole-risk reckoning" framework incorporating a dynamic-balancing approach to the legitimate concerns of all stakeholders is most likely to result in work control systems that satisfice statutory duties (e.g. "adequate protection" or "environmental protection") while "meeting or exceeding, applicable requirements and expectations."

    The Naval Reactors Program remains vivid proof - to this day - that Safety First need not be the Prime Imperative in order that a high reliability organization be institutionalized.

    I encourage reading the whole of the Rickover Report - I've never read a more lucid description of how Performance Assurance is achieved and maintained.

    ReplyDelete

Thanks for your comment. We read them all. We'd like to display them under their respective posts on our main page but that's not how Blogger works.