IEEE Technology and Society Magazine - June 2018 - 64

The coupling of the power grid is loosened by the substi-
tutability of generation: during times of low demand, the
electricity generated from hydropower or from coal is
equivalent. Interactions in a technological system may
be either linear and therefore more easily comprehensi-
ble and predictable, or nonlinear and complex, in which
seemingly disconnected parts of the system affect one
another [1]. Abrupt changes in generation and load in
one part of the power system affect the frequency of the
whole system - a disturbance in Atlanta, GA, could
appear in frequency measurements in Albany, NY. Nor-
mal accidents occur in tightly-coupled systems with
complex interactions.
Perrow studied nuclear power plants, chemical pro-
cessing facilities, and air traffic control to characterize
normal accidents [1]. After examining accident reports
blaming "operator error," Perrow cautions that "human
error" is a convenient catch-all for inexplicable acci-
dents and using such phrases may indicate a normal
accident has occurred [1]. After failures, it is natural to
fall back on the common engineering technique of add-
ing redundancy to ensure reliability. However, Perrow
argues that this adds to interactive complexity and
actually exacerbates the potential for normal accidents
[1]. He also notes that despite a veneer of safety-con-
sciousness by companies, production pressures usually
supersede safety considerations and operators are rare-
ly able to protest [1]. Normal accidents are less likely in
systems with strong employee representation, accord-
ing to Perrow [1].
In a later article, Perrow identifies characteristics of
"error-avoiding" systems. First, error-avoiding systems
are experienced with the scale of operation and activity
during the critical phase [2]. Error-avoiding systems also
collect information on errors and interact with elites; for
example, CEOs and Congresspeople make extensive
use of air travel [2]. On an organizational level, error-
avoiding systems exert control over their members and
the system environment is dense, with many different
firms, regulators, and interest groups [2]. Perrow argues
that the system becomes "error-neutral" or "error-inducing"
if any of these elements are absent [2].
The postscript to the 1999 edition of Normal Accidents discusses the electric power system and the
looming Y2K crisis. Perrow explains that "Y2K could be
the quintessential Normal Accident... small failures to
read the correct date cannot be fully anticipated, and
their interactions cannot be imagined; the tight coupling
of our highly interdependent systems can bring about a
cascade of failures" [1]. Perrow criticizes the optimism
of a North American Electric Reliability Corporation
(NERC) report asserting the industry was "ready" to deal
with Y2K, in the sense of "coping with" rather than avoid-
ing problems [1]. Perrow further disagreed with the report's

emphasis on continuing deregulation activities instead
of addressing Y2K problems [1]. In hindsight, the Y2K
problem was successfully remediated, despite predic-
tions to the contrary.
Ultimately, Perrow uses the framework of normal
accidents to argue that complex technological systems
can never be completely safe. He argues that hazardous
technological systems with unborn victims, like nuclear
power, should not be used because the inevitable fail-
ure far outweighs any economic gains.
Proponents of the HRO framework, on the other hand,
believe certain organizations experience failures less
often than expected and that technological systems can
be managed more-or-less safely. After a major accident
occurs, Roberts notes that solutions may include tech-
nological fixes or bans, but typically less attention is
devoted to improving the system management [3]. HRO
researchers explore why certain organizations have
higher reliability than others; they focus on organiza-
tions that have already achieved high levels of reliability
and work backwards to determine how. Early HRO case
studies focused on naval aircraft carriers, air traffic con-
trol, grid operations, and a nuclear power plant [3]-[7].
HRO researchers argue that the framework address-
es a gap in organizational theories based on dichoto-
mies: planning versus trial-and-error, certainty versus
uncertainty, and hierarchy versus decentralization [4].
LaPorte and Consolini believe that HROs, although hier-
archical and planning-oriented, bridge these categories
by allowing flexibility and decentralized decision mak-
ing in certain situations [4]. HROs use technologies that
are tightly coupled to the organization (technological
failure threatens organizational failure), have a strong
external preference for failure-free operations, and invest
heavily in reliability improvements [4]. For all HROs,
the cost of failure is much higher than the value of the
lessons learned [4].
HROs develop reliability through redundancy, fre-
quent training, emphasizing responsibility, and distribut-
ing decision-making throughout the group hierarchy, all
of which reduce the impacts of complexity and tight cou-
pling, as defined by Perrow [3]-[6], [8]. For example, con-
tinuous training allows operators to gain experience with
novel system behaviors and proficiency with complex
technology [5]. Redundancy reduces the impact of tight
coupling by responding to time-dependent processes and
creating multiple paths for success [5]. HROs try to
replace indirect information sources (complexity) with
many direct information sources [5]. Through all
these actions, HROs develop a "culture of reliability,"
described by Roberts as including interpersonal responsi-
bility, person-centeredness, strong feelings of credibility,
an emphasis on creativity, and being helpful and support-
ive [3], [6]. Because using total failure to learn is not

IEEE Technology and Society Magazine

∕

JUNE 2018

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2018