Normal Accidents

Conceptual Overview

The notion of NA has been defined by C. Perrow in a book published in 1984, where the causes of several high-profile catastrophes were discussed. According to Perrow, minor accidents are typically component failures, which do not involve any unexpected interactions, while major accidents, or system accidents, involve the unanticipated interaction of several latent and active failures in a complex system that interact in unexpected ways. Some accidents are “waiting to happen.” Such accidents are difficult or impossible to anticipate, because of the combinatorial problem (the theoretical possible combinations of several component failures are far larger than the number of possible component failures) and because some systems have properties that make it difficult to predict how failures may interact.

Multiple failures are failures in design, equipment, procedures, operators, suppliers and materials, and environment, generically named the DEPOSE components by Perrow. Tightly coupled events are described by their dependence on each other. A failure in one part can determine failure in another part of the system, an event triggers another, changes in one component determine changes in related components, and this implies that disturbances propagate rapidly throughout the system, with no opportunity for containing disturbances through improvisation. Loosely coupled events are events that can occur independently, but within the same producing sequence, one not caused by the other.

The characteristics of a system can be seen in the interactions (linear or complex) between its elements and coupling (tight or loose). Complex systems have designed tightly built interactions and unplanned interactions (impossible to understand and unnoticed previous accidents). Given an unexpected event, the tight coupling between a system's elements is reduced and the redundant pathways designed in the system disappear. Sometimes the interactions between multiple failures and events are also incomprehensible for a [Page 990]critical period of time. Numerous problems in the systems are not documented; they are mapped and described only later, after catastrophic events, through accident investigations.

Perrow explained that some sociotechnical systems have structural properties that are conducive to system accidents. Major nuclear power plants, for example, are characterized by high interactive complexity. These are difficult to control because they consist of many components, but also because the interactions among components are nonlinear. Linear interactions lead to predictable and comprehensive event sequences, while nonlinear interactions lead to unexpected event sequences.

Nonlinear interactions are often related to feedback loops. A change in one component may escalate to a positive feedback loop, it may be suppressed by a negative feedback loop, or it may even return into its opposite by some combination of feedback loops. Some feedback loops may be introduced to increase efficiency in some systems, (e.g., safety systems), but they also may add to the interactive complexity of a system. The interactive complexity makes abnormal states difficult to diagnose, because the conditions they cause may be hidden by feedback controls designed to keep the system stable under normal operations. Moreover, the effect of possible control actions are difficult to predict, because positive and negative feedback loops may propagate, attenuate, or even reverse the effect in an unforeseeable manner, resulting in unknown side effects.

...