IEEE Technology and Society Magazine - June 2018 - 69

responded well to the unfolding events and which exac-
erbated the problem? The report cited above focuses on
violations of voluntary reliability standards rather than
delving into the company culture(s) responsible for
those violations [37].
Digital relays for protection and control offer another
fascinating comparison of normal accidents and HROs.
In substation design, most protection and control sys-
tems are fully redundant. Yet, relay misoperations per-
sist and are most commonly caused by 1) incorrect
settings, logic, or design error, 2) relay failure or malfunc-
tion, and 3) communication failure [38]. The dominant
relaying philosophy is to isolate stressed equipment
and protect it from damage. The authors in [27] believe
relays should be set considering the cost of an outage
to the system, rather than only the cost of the protected
component. Considering the system implications of iso-
lating equipment may allow transmission lines to be
overloaded, but prevent a cascading outage. Are group
interests at play in protecting equipment at the expense
of the system?
The authors in [39] argue that the most troublesome
relay misoperations are "hidden failures" and believe that
changing relays from an "OR" selection to a voting sys-
tem would help reduce misoperations [39]. However, with
misoperations spread between design, equipment, and
communication, it is fair to say that the fundamental rea-
sons for persistent misoperations have not yet been iden-
tified. Is the problem in the protection philosophy, as
argued in [39]? Or is it with the management and engi-
neering design of the system? The normal accident
framework could help identify whether tradeoffs between
redundancy and complexity are causing problems in this
application. The HRO framework could help to identify
management issues and offer advice on how to change.
In the arena of cybersecurity, the number of vulnera-
bilities is countless [40], partially due to complexity and
tight coupling. Even so, many vulnerabilities are known
[41]-[43] and cyberattacks are already common in power
systems [44]. How much effort should be taken to pro-
tect the power system from these? Some researchers
promote "resiliency" as the best way to deal with cyber-
security issues. Resiliency is nothing but the ability to
bounce back from failure(s) quickly. Can the HRO frame-
work teach us something about resiliency and how
organizational design can promote it? Normal accident
researchers may suggest how to manage the political
and social issues surrounding cybersecurity violations.

Making Progress in Understanding Failure
Overall, the power systems literature has relatively few
mentions of insights to be gained from either the nor-
mal accident or HRO frameworks. This absence indicates
an area where progress could be made in understanding
JUNE 2018

∕

If we want trustworthy complex
technological systems, then
we must know why they fail and
how (or whether) those failures
can be avoided.
failures. Studies of cascading blackouts illustrate ways in
which both frameworks would aid analysis. Similar stud-
ies of other power systems topics, like digital relays and
cybersecurity, could also benefit from attention to both
frameworks. From the normal accident framework, engi-
neers can determine the point where benefits from
redundancy are offset by increased complexity and
closely examine hierarchical power structures and mar-
ket pressures to determine whether any of these ele-
ments are undermining their quest for reliability. From
the HRO framework, engineers can acknowledge that
sometimes the fix is not a fancy new technology, but
rather changing organizational culture. None of this will
be easy, but if we want to have trustworthy complex
technological systems, then we must know why they fail
and how (or whether) those failures can be avoided.

Acknowledgment
This research was supported by the U.S. Department of
Energy Lawrence Berkeley National Laboratory, through
the project "Algorithmic/Computational Research within
Power System Vulnerability," under a prime contract No.
DE-AC02- 05CH11231.

Author Information
Hilary Brown was with the University of Wisconsin-Madi-
son, where she received her Ph.D. degree in electrical
engineering, with a doctoral minor from the Holtz Cen-
ter for Science and Technology Studies. She now works
in transmission planning in Minnesota. Email: brown
.hilary@ieee.org.

References

[1] C. Perrow, Normal Accidents: Living with High-Risk Technologies. Princeton, NJ: Princeton Univ. Press, 1999.
[2] C. Perrow, "The limits of safety: The enhancement of a theory of
accidents," J. Contingencies and Crisis Management, vol. 2, pp. 212-
220, Dec. 1994.
[3] K. H. Roberts, "Cultural characteristics of reliability enhancing orga-
nizations," J. Managerial Issues, vol. 5, pp. 165-181, 1993.
[4] T.R. LaPorte and P.M. Consolini, "Working in practice but not in the-
ory: Theoretical challenges of high-reliability organizations," J. Public
Administration Research and Theory, vol. 1, pp. 19-48, 1991.
[5] K. H. Roberts, "Managing high reliability organizations," California
Management Rev. vol. 33, pp. 101-113, Sum. 1990.

IEEE Technology and Society Magazine

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2018