This book*, originally published in 1984, is a regular reference for authors writing about complex socio-technical systems.** Perrow's model for classifying such systems is intuitively appealing; it appears to reflect the reality of complexity without forcing the reader to digest a deliberately abstruse academic construct. We will briefly describe the model then spend most of our space discussing our problems with Perrow's inferences and assertions, focusing on nuclear power.
The model is a 2x2 matrix with axes of coupling and interactions. Not surprisingly, it is called the Interaction/Coupling (IC) chart.
“Coupling” refers to the amount of slack, buffer or give between two items in a system. Loosely coupled systems can accommodate shocks, failures and pressures without destabilizing. Tightly coupled systems have a higher risk of disastrous failure because their processes are more time-dependent, with invariant sequences and a single way of achieving the production goal, and have little slack. (pp. 89-94)
“Interactions” may be linear or complex. Linear interactions are between a system component and one or more other components that immediately precede or follow it in the production sequence. These interactions are familiar and, if something unplanned occurs, the results are easily visible. Complex interactions are between a system component and one or more other components outside the normal production sequence. If unfamiliar, unplanned or unexpected sequences occur, the results may not be visible or immediately comprehensible. (pp. 77-78)
Nuclear plants have the tightest coupling and most complex interactions of the two dozen systems Perrow shows on the I/C chart, a population that included chemical plants, space missions and nuclear weapons accidents. (p. 97)
Perrow on Nuclear Power
Let's get one thing out of the way immediately: Normal Accidents is an anti-nuke screed. Perrow started the book in 1979 and it was published in 1984. He was motivated to write the book by the TMI accident and it obviously colored his forecast for the industry. He reviews the TMI accident in detail, then describes nuclear industry characteristics and incidents at other plants, all of which paint an unfavorable portrait of the industry. He concludes: “We have not had more serious accidents of the scope of Three Mile Island simply because we have not given them enough time to appear.” (p. 60, emphasis added) While he is concerned with design, construction and operating problems, his primary fear is “the potential for unexpected interactions of small failures in that system that makes it prone to the system accident.” (p. 61)
Why has his prediction of such serious accidents not come to pass, at least in the U.S.?
Our Perspective on Normal Accidents
We have several issues with this book and the author's “analysis.”
Nuclear is not as complex as Perrow asserts
There is no question that the U.S. nuclear industry grew quickly, with upsized plants and utilities specifying custom design combinations (in other words, limited standardization). The utilities were focused on meeting significant load growth forecasts and saw nuclear baseload capacity as an efficient way to produce electric power. However, actually operating a large nuclear plant was probably more complex than the utilities realized. But not any more. Learning curve effects, more detailed procedures and improved analytic methods are a few of the factors that led to a greater knowledge basis for plant decision making. The serious operational issues at the “problem plants” (circa 1997) forced operators to confront the reality that identifying and permanently resolving plant problems was necessary for survival. This era also saw the beginning of industry consolidation, with major operators applying best methods throughout their fleets. All of these changes have led to our view that nuclear plants are certainly complicated but no longer complex and haven't been for some time.
This is a good place to point out that Perrow's designation of nuclear plants as the most complex and tightest coupled systems he evaluated has no basis in any real science. In his own words, “The placement of systems [on the interaction/coupling chart] is based entirely on subjective judgments on my part; at present there is no reliable way to measure these two variables, interaction and coupling.” (p. 96)
System failures with incomprehensible consequences are not the primary problem in the nuclear industry
The 1986 Chernobyl disaster was arguably a system failure: poor plant design, personnel non-compliance with rules and a deficient safety culture. It was a serious accident but not a catastrophe.***
But other significant industry events have not arisen from interactions deep within the system; they have come from negligence, hubris, incompetence or selective ignorance. For example, Fukushima was overwhelmed by a tsunami that was known to be possible but was ignored by the owners. At Davis-Besse, personnel ignored increasingly stronger signals of a nascent problem but managers argued that in-depth investigation could wait until the next outage (production trumps safety) and the NRC agreed (with no solid justification).
Important system dynamics are ignored
Perrow has some recognition of what a system is and how threats can arise within it: “. . . it is the way the parts fit together, interact, that is important. The dangerous accidents lie in the system, not in the components.” (p. 351) However, he is/was focused on interactions and couplings as they currently exist. But a socio-technical system is constantly changing (evolving, learning) in response to internal and external stimuli. Internal stimuli include management decisions and the reactions to performance feedback signals; external stimuli include environmental demands, constraints, threats and opportunities. Complacency and normalization of deviance can seep in but systems can also bolster their defenses and become more robust and resilient.**** It would be a stretch to say that nuclear power has always learned from its mistakes (especially if they occur at someone else's plant) but steps have been taken to make operations less complex.
My own bias is Perrow doesn't really appreciate the technical side of a socio-technical system. He recounts incidents in great detail, but not at great depth and is often recounting the work of others. Although he claims the book is about technology (the socio side, aka culture, is never mentioned), the fact remains that he is not an engineer or physicist; he is a sociologist.
Notwithstanding all my carping, this is a significant book. It is highly readable. Perrow's discussion of accidents, incidents and issues in various contexts, including petrochemical plants, air transport, marine shipping and space exploration, is fascinating reading. His interaction/coupling chart is a useful mental model to help grasp relative system complexity although one must be careful about over-inferring from such a simple representation.
There are some useful suggestions, e.g., establishing an anonymous reporting system, similar to the one used in the air transport industry, for nuclear near-misses. (p. 169) There is a good discussion of decentralization vs centralization in nuclear plant organizations. (pp. 334-5) But he says that neither is best all the time, which he considers a contradiction. The possibility of contingency management, i.e., using a decentralized approach for normal times and tightening up during challenging conditions, is regarded as infeasible.
Ultimately, he includes nuclear power with “systems that are hopeless and should be abandoned because the inevitable risks outweigh any reasonable benefits . . .” (p. 304)***** As further support for this conclusion, he reviews three different ways of evaluating the world: absolute, bounded and social rationality. Absolute rationality is the province of experts; bounded rationality recognizes resource and cognitive limitations in the search for solutions. But Perrow favors social rationality (which we might unkindly call crowdsourced opinions) because it is the most democratic and, not coincidentally, he can cite a study that shows an industry's “dread risk” is highly correlated with its position on the I/C chart. (p. 326) In other words, if lots of people are fearful of nuclear power, no matter how unreasonable those fears are, that is further evidence to shut it down.
The 1999 edition of Normal Accidents has an Afterword that updates the original version. Perrow continues to condemn nuclear power but without much new data. Much of his disapprobation is directed at the petrochemical industry. He highlights writers who have advanced his ideas and also presents his (dis)agreements with high reliability theory and Vaughn's interpretation of the Challenger accident.
You don't need this book in your library but you do need to be aware that it is a foundation stone for the work of many other authors.
* C. Perrow, Normal Accidents: Living with High-Risk Technologies (Princeton Univ. Press, Princeton, NJ: 1999).
** For example, see Erik Hollnagel, The ETTO Principle: Efficiency-Thoroughness Trade-Off (reviewed here); Woods, Dekker et al, Behind Human Error (reviewed here); and Weick and Sutcliffe, Managing the Unexpected: Resilient Performance in an Age of Uncertainty (reviewed here). It's ironic that Perrow set out to write a readable book without references to the “sacred texts” (p. 11) but it appears Normal Accidents has become one.
*** Perrow's criteria for catastrophe appear to be: “kill many people, irradiate others, and poison some acres of land.” (p. 348) While any death is a tragedy, reputable Chernobyl studies report fewer than 100 deaths from radiation and project 4,000 radiation-induced cancers in a population of 600,000 people who were exposed. The same population is expected to suffer 100,000 cancer deaths from all other causes. Approximately 40,000 square miles of land was significantly contaminated. Data from Chernobyl Forum, "Chernobyl's Legacy: Health, Environmental and Socio-Economic Impacts" 2nd rev. ed. Retrieved Aug. 27, 2013. Wikipedia, “Chernobyl disaster.” Retrieved Aug. 27, 2013.
In his 1999 Afterword to Normal Accidents, Perrow mentions Chernobyl in passing and his comments suggest he does not consider it a catastrophe but could have been had the wind blown the radioactive materials over the city of Kiev.
**** A truly complex system can drift into failure (Dekker) or experience incidents from performance excursions outside the safety boundaries (Hollnagel).
***** It's not just nuclear power, Perrow also supports unilateral nuclear disarmament. (p. 347)