COMPLEXITY, TIGHT-COUPLING AND RELIABILITY: CONNECTING NORMAL ACCIDENTS THEORY AND HIGH RELIABILITY THEORY 15

Complexity, Tight-Coupling and

Reliability: Connecting Normal
Accidents Theory and High Reliability
Theory
Jos A. Rijpma*

In this article, the theoretical debate between two dominant schools on the origins of accidents
and reliability, Normal Accident Theory and High Reliability Theory, is continued and
evaluated. Normal Accident Theory holds that, no matter what organizations do, accidents are
inevitable in complex, tightly-coupled systems. High Reliability Theory asserts that
organizations can contribute significantly to the prevention of accidents. To break through
this deadlock, the mutual effects of complexity and tight-coupling, on the one hand, and
reliability-enhancing strategies, on the other, are examined. It becomes clear that the theories
are sometimes in conflict but that sometimes they also reach similar conclusions when applied
to case events or generic safety problems. Cross-fertilization is, therefore, possible.

Introduction1 organizations (HROs) centralize the design of

decision premises in order to allow de-

IMilenaspects
1981, a book was published on the human
of the nuclear meltdown at Three
Island in 1979 (Sills, Wolf and Shelanski,
1981). One contributor to this book was Charles
Perrow, whose work later culminated in the
seminal book Normal Accidents (1984). Another
was Todd La Porte, who founded a research
group at Berkeley, which has since conducted
research on highly reliable organizational
performance under very trying conditions. Both
authors laid the foundations for two major ways
of thinking about accidents and reliability which,
subsequently, were pitched against one another.
The basic thesis of Perrow's (1984) Normal
Accident Theory (NAT) holds that accidents are
inevitable in complex, tightly-coupled
technological systems, such as nuclear power
plants. Complexity inevitably yields unexpected
interactions between independent failures. By
means of tight-coupling, these initial interactions
escalate rapidly and almost unobstructedly into a
system breakdown. The combination of
complexity and tight-coupling makes accidents
inevitable. Perrow (1984), therefore, called such
accidents `normal' accidents.
The Berkeley school on High Reliability
Theory (HRT), however, claims to have
discovered organizational strategies with which
organizations facing complexity and tight-
coupling, have achieved outstanding safety
records (Roberts, 1993). Highly reliable
centralized decision making (Weick, 1987);
HROs use redundancy in their organization in
order to back-up failing parts and persons (La
Porte and Consolini, 1991); HROs maintain
several theories ± conceptual slack ± on the
technology and the production processes in
order to avoid blindspots and hasty action
(Schulman, 1993); and, finally, HROs learn to
comprehend the complexities of the technology
and the production processes (Rochlin, La Porte
and Roberts, 1987).
These two views on safety performance have
been contrasted by Sagan (1993), who applied
both theories in an analysis of accidents and
near-misses in the US nuclear weapons system.
He concluded that, although the US nuclear
weapons system did not experience a major
accident, NAT, nevertheless, offered the best
explanation for the system's safety record. He
underpinned this conclusion by a list of near-
misses which occurred despite the presence of
the high-reliability strategies mentioned in
HRT. These near-misses, Sagan claimed, could
easily have escalated into large-scale nuclear
catastrophes or even accidental nuclear war had
the circumstances been slightly different: '[I]t
was less good design than good fortune that
prevented many of the accidents from *Jos A. Rijpma, Crisis Research
escalating out of control' (Sagan, 1993: 267- Center, Leiden University,
Department of Public
268). Administration, P.O. Box
In a symposium published in this journal, both 9555, 2300 RB Leiden.

ß Blackwell Publishers Ltd 1997, 108 Cowley Road, Oxford OX4 1JF, UK and
350 Main Street, Malden, MA 02148, USA. Volume 5 Number 1 March 1997
16 JOURNAL OF CONTINGENCIES AND CRISIS MANAGEMENT
Perrow (NAT) and La Porte cum Rochlin (HRT)
were invited to comment on the theoretical
review by Sagan. Perrow (1994) argued that it is
possible and valuable to contrast the two
theories; La Porte and his Berkeley colleague
Rochlin disagreed (La Porte, 1994; La Porte and
Rochlin, 1994). They argued that the two
theories are complementary rather than
competitive. Stalemate is the debate's current
half-time score.
Underlying this debate is a difference between
the levels of aggregation of the two theories.
NAT discerns causes of a certain type of
accidents, whereas HRT distinguishes
organizational strategies promoting overall
reliability. The conflict between Perrow and
Sagan, on the one hand, and La Porte and
Rochlin, on the other, is partly due to these
diverging levels of aggregation.
As long as stalemate reigns, the two bodies
of knowledge are likely to go their own way,
as they did until Sagan (1993) contrasted them.
The consequence is that the limits of high-
reliability strategies will remain obscure,
because the role of these strategies in the
development of particular accidents is not
examined. Also, the reach of complexity and
tight-coupling remains unknown, because their
effects on overall reliability are not assessed.
Both theories are worse off, and, since each
theory may have implications for technological
policies and organizational design, strategic
decisions on safety in complex organizations
lack the benefit of a balanced, integrated
prescriptive approach. Therefore, the aim of
this article is to go beyond the current state of
the debate and explore the possibilities for
creative dialogue between the two schools of
thought. Specifically, this article shall examine
how one theory's independent variables affect
the other theory's dependent variable. What are
the effects of complexity and tight-coupling on
overall reliability? How prone to normal
accidents are organizations applying the
reliability-enhancing strategies discerned by
HRT?
Since NAT is a theory on the causation of a
specific type of accidents, it is hard to assess
directly the impact of complexity and tight-
coupling on overall reliability. Since HRT
discerns strategies enhancing overall reliability,
it is difficult to evaluate directly the proneness of
these strategies to specific, normal accidents.
Therefore, the effects of one theory's
independent variables on the other theory's
dependent variable will be assessed indirectly.
The questions asked become: Which effects do
complexity and tight-coupling have on the
effectiveness of reliability-enhancing strategies
discerned by HRT and, hence, on overall
reliability? How do HROs' reliability-promoting
Volume 5 Number 1 March 1997
strategies impinge on complexity and tight-
coupling and, hence, on normal-accident
proneness?
Normal Accidents Theory and High
Reliability Theory will be briefly summarized
in the next two sections. Thereupon, the effects
of complexity and tight-coupling on HRT's
reliability-enhancing strategies, and indirectly
on overall reliability, will be assessed. Next,
the consequences of the reliability-promoting
strategies on complexity and tight-coupling, and
indirectly normal-accident proneness, will be
examined. A discussion on the possibilities of
NAT's and HRT's co-existence will conclude this
article.
Complexity and Tight-Coupling
Some accidents are inevitable, according to
Perrow (1984). Where an organization must
cope with a complex technology, unexpected
interactions between failures will occur sooner or
later. Members of the organization do not
anticipate these interactions and, once they
occur, do not comprehend them, and, therefore,
do not immediately know how to respond to
them. If the technology is also tightly-coupled,
that is, if interacting failures propagate swiftly
and unobstructedly throughout the system, the
failures will escalate into a system accident,
before comprehension and recovery are possible.
If a system is both complex and tightly-coupled,
accidents are inevitable; they are endemic in the
system. Hence, Perrow called them `normal
accidents' (Perrow, 1984).
Some systems are more prone to such normal
accidents than others, because some are more
complex and tightly-coupled than others.
Complex interactions are especially likely in
systems where components have multiple
functions and, therefore, may fail in more
directions at once; in systems where components
are close to each other; in systems with many
control parameters and inferential information;
and in systems transforming material into other
states by means of non-linear, incomprehensible
processes, such as in chemistry and nuclear
energy.
Tight-coupling is especially likely in systems
operating unifinal, invariant, time-dependent
production processes; in organizations
employing specialized personnel; in systems
where materials cannot easily be substituted;
where safety devices are built-in and
improvization is hardly possible. Recovery from
failure is unlikely in such systems, because
processes cannot be turned off and because
there are hardly any fortuitous recovery aids
available. In tightly-coupled systems, the initial
ß Blackwell Publishers Ltd 1997
COMPLEXITY, TIGHT-COUPLING AND RELIABILITY: CONNECTING NORMAL ACCIDENTS THEORY AND HIGH RELIABILITY THEORY
interacting failures are likely to escalate into
disaster.
Reliability-Enhancing Strategies
Highly reliable organizations apply several
strategies so as to operate as reliably as they
do. First, HROs apply a strategy of redundancy:
if one component fails, another backs it up; if one
operator fails to carry out his task, another one
takes over his position; if danger lurks, multiple
channels are used to transmit warnings. By
means of redundancy, the probability of
consequential failure is reduced and as little
information as possible is lost (Rochlin, La Porte
and Roberts, 1987).
Secondly, HROs decentralize the authority to
make decisions. This is done in order to enable
those closest to the problem at hand to solve
problems as they emerge. In this way, rapid
problem solving is ensured. There is one
problem, however. How do low-level operators
know how to solve such problems when they
lack the oversight necessary to predict the
consequences of their actions in a complex,
tightly-coupled system? The answer given by
HRT is that HROs are pervaded by a distinctive
culture of reliability. Such a culture imbues
members of the organization with clear
operational goals, decision premises and
assumptions. It gives them the autonomy and
the competence to respond to complex
interactions, once these reach the surface, and
correct them before tightly-coupled processes
are set in motion which might lead to disaster.
So, on the one hand, decision making is de-
centralized; but, on the other hand, the decision
premises used by operators through the system
are centralized (Weick, 1987).
Thirdly, to prevent undue, hasty action based
upon rigid beliefs as to the proper course of
action, HROs apply a strategy of conceptual
slack: a number of diverging theories pertaining
to the organization's technology and production
processes are maintained simultaneously. Only
after intense discussion and negotiation does the
organization reach a decision upon the course of
action to be pursued. In this way, complex
interactions which might have been overlooked
when seen from one perspective are taken into
account (Schulman, 1993).
Finally, from the outset, no organization has
perfect knowledge of its technology and
production processes. HROs have accomplished
their extremely reliable performances only after a
long, trying, costly and, sometimes, lethal trial-
and-error learning process. Trial-and-error
learning is supplemented by constant training,
operations and simulations in order to maintain
ß Blackwell Publishers Ltd 1997
17
and improve standards (Rochlin, 1989; La Porte
and Consolini, 1991).
The Reliability of Complex, Tightly-
Coupled Systems
Complexity and tight-coupling cause system
accidents. But, how complexity and tight-
coupling impinge on overall reliability is not
clear. One way to examine the consequences of
complexity and tight-coupling for overall
reliability is to study their effects on redundancy,
decentralized decision making within a
framework of centralized decision premises,
conceptual slack and organizational learning.
This is discussed next.
Complexity and Redundancy
Complexity both enhances and subverts
redundancy. On the one hand, complex systems
are often characterized by redundancy. Complex
systems simply need redundancy to keep track
of all the possible interactions between the
various parts of the system (Perrow, 1984). Since
redundancy, on average, improves the reliability
of systems, complexity enhances reliability by
promoting redundancy.
On the other hand, complexity may reduce
the reliability of redundancy. Redundant
components sometimes depend on common
determinants, such as weather conditions.
Common determinants ± or common-mode
failures ± are often a source of complexity
(Perrow, 1984). The design of the Challenger
space shuttle's Solid Rocket Booster's sealing, for
instance, was redundant. Two O-rings were
designed-in, so that if one would be eroded and,
therefore, not seal properly, it would be backed
up. However, both rings were dependent on
weather conditions. If one would fail, the
probability of the other one failing as well,
increased. Both O-rings failed during the 1986
launch of the Challenger, causing a space shuttle
disaster (Vaughan, 1996).
Put differently, a common-mode `failure' (the
weather) ruled out the redundancy of
components; the two O-rings were no longer
redundant. Other sources of complexity may
have the same effect. If two redundant parts are
very close to each other, for instance, both parts
may be knocked out by one blow. Complexity
may subvert redundancy and, thereby, have a
negative impact on overall reliability.
Complexity, Tight-Coupling and the Balance
Between Centralization and Decentralization
According to Perrow (1984), decentralization is
Volume 5 Number 1 March 1997
18 JOURNAL OF CONTINGENCIES AND CRISIS MANAGEMENT
necessary to cope with complexity;
centralization is necessary to ensure rapid
recovery from failure before tightly-coupled
processes push the system over the brink. He
argued that it is impossible to centralize and de-
centralize organizations simultaneously. It is
impossible, he stated, to allow operators
considerable decision making authority, on the
one hand, and ensure rigid command and
control, on the other. According to Weick
(1987), however, it is possible to give low-level
operators the autonomy to respond to emerging
problems, as long as these operators have been
imbued with centrally determined goals, decision
premises and assumptions. Rigid command and
control are not necessary if people have been
imbued with the same outlook, a `culture of
reliability'. Operators will behave as central
authorities want them to behave without having
to be told so.
Sagan (1993) observed that in complex
systems, it is impossible for members at both
higher and lower levels in the organizational
hierarchy to anticipate every contingency. This
implies that it is also impossible to account for
every unexpected situation in the decision
premises and assumptions that are part of the
operators' action repertoires. In complex
systems, unexpected situations will, inevitably,
emerge (Perrow, 1984; Rochlin, 1993). Hence,
complexity subverts the reliability of decision
premises designed to ensure speedy detection
and effective correction of initial failures.
Complexity may subvert the effectiveness of
the culture of reliability and, hence, have
negative effects on reliability.
Complexity, Tight-Coupling, Conceptual Slack
and Informal Networks
If decentralized decision making within a
framework of centrally determined premises is
insufficient to cope with unexpected situations,
the question becomes how operators do, in fact,
respond to such unexpected situations. First,
they may be simply confused, as was the case
during the near-disaster in the nuclear reactor at
Three Mile Island (Perrow, 1984). The chances
for recovery are, then, seriously reduced.
Secondly, they may follow the rules, even if
these rules no longer apply to the situation at
hand. Vaughan (1996) noted that hardly
anybody at NASA violated rules; instead, people
followed rules that had become inadequate.
The third possibility, and the strategy applied
in HROs, is to switch from one mode of decision
making to another. When confronted with
unexpected situations, HROs no longer rely
upon decentralized decision making within a
framework of centralized decision premises.
Instead, decision making becomes very flexible
Volume 5 Number 1 March 1997
(Roberts, Stout and Halpern, 1994). Authority
patterns change from hierarchical to collegial;
informal networks supplement the formal
organizational structure (Rochlin, La Porte and
Roberts, 1987). Operators do not blindly follow
the rules, but negotiate a course of action in a
collegial fashion, based on trust and credibility
(Schulman, 1993). In these negotiations, the most
experienced operators and supervisors are at the
centre of the decision networks (Roberts, Stout
and Halpern, 1994).
Moreover, instead of relying upon decision
premises prescribing the steps to be taken, a
strategy of conceptual slack becomes operative:
multiple theories on the technology and the
production processes are maintained
simultaneously. In this way, more potential
complexities are accounted for. Besides,
`collective sins of hubris' are avoided by
conceptual slack (Schulman, 1993): one dominant
theory on the technology and the production
processes may easily lead to hasty, undue action
and blindspots (Turner, 1978). This strategy
works particularly well when an organization
wants to change from a state of inaction to a
state of action, if it wants to start production
processes. As long as all the complexities are not
ruled out beforehand, the organization does not
act. Numerous veto powers have been
established at the Diablo Canyon nuclear power
plant ± which Schulman (1993) examined ± to
ensure that undue action would not be pursued.
To put it differently, the system is loosely-
coupled. As long as the system is loosely-
coupled, complexity does not impair the
reliability of conceptual slack.
If, however, the production processes are
already running, and unforeseen contingencies
arise at a moment when these processes cannot
easily be blocked, this strategy becomes
problematic. If a system is very tightly-coupled,
time may be too short to negotiate the proper
course of action and HROs still rely upon rigid
adherence to prescribed rules. When the
shutdown was required of a reactor at the
Diablo Canyon nuclear plant, instead of
negotiating its way out of the crisis, the
organization relied upon technological fixes
(automatic shutdown) and non-negotiable intra-
departmental autonomy (Schulman, 1993). Such
tight-coupling subverts the conceptual slack
needed to cope with complex situations.
Complexity has a dual effect on the reliability
of conceptual slack. On the one hand,
complexity creates a need for diverging
perspectives. Even linear systems sometimes
yield unexpected situations, but because the
need for multiple perspectives is smaller in linear
systems, conceptual slack is less likely to occur.
This means that organizations operating linear
technologies are more likely to develop rigid
ß Blackwell Publishers Ltd 1997
COMPLEXITY, TIGHT-COUPLING AND RELIABILITY: CONNECTING NORMAL ACCIDENTS THEORY AND HIGH RELIABILITY THEORY
perceptions and are not capable of meeting any
unexpected situation (Turner, 1978). By creating
a need for conceptual slack, complexity broadens
organizational perspectives, making rigid
perceptions less likely and enhancing overall
reliability. On the other hand, in combination
with tight-coupling, complexity is likely to
subvert the reliability of conceptual slack.
Complexity, Tight-Coupling and Organizational
Learning
Much of what has been said on the effects of
complexity and tight-coupling on conceptual
slack, applies to the effects of complexity and
tight-coupling on organizational learning. Again,
there is a paradox: complexity creates a need for
learning, and, hence, complacency is less likely,
while tight-coupling limits the range for trial-
and-error learning because the first error may be
fatal.
Complexity simultaneously requires and
complicates learning. Learning from complex
past events is a highly ambiguous activity
(Sagan, 1993). Initially, learning may progress
rapidly, as the easy lessons are learned. But when
accidents and near-accidents become more
complex, reconstruction of what exactly
happened becomes more difficult.2 The causes
of accidents and near-accidents are often many,
so there are many `hooks' to hang lessons on,
and many hooks not to hang lessons on.
Diverging interpretations lead to conflicting
perspectives on how to improve activities. These
conflicts may result in one-sided solutions or
even deadlocks (Bovens and `t Hart, 1996).
Thus, learning, which starts off as a difficult
cognitive process, becomes more of a political
process as time goes by. Comprehensive
learning, leading to a breakthrough in reliability,
is more often a process of learning to build
coalitions than a process of learning to
understand certain events. For instance, in the
1950s and 1960s, the Dutch Railways were
regularly confronted with accidents due to
engine drivers missing or ignoring red signs. It
took years, and a very serious accident, to
convince the Dutch Railways of the need for
some kind of Railway Traffic Control system.
The implementation of the system also took
many years and some accidents at railway tracks
where the system had not yet been implemented
(Van Duin, 1992). Because making systems more
loosely-coupled is expensive and time-
consuming, tight-coupling may seriously thwart
the learning potential of organizations and,
hence, the reliability of their operations.
So, complexity may, on the one hand, inspire
learning, but, on the other hand, make learning a
very difficult and ambiguous process. In tightly-
coupled systems, accidents remain inevitable for
ß Blackwell Publishers Ltd 1997
19
extended periods of time before learning
processes are sufficiently completed to prevent
accidents from happening.
The Normal-Accident Proneness of
Reliability-Enhancing Strategies
Having discussed the effects of complexity and
tight-coupling on reliability enhancing strategies,
it is necessary to consider the reverse impact, for
example, the effects of HRO strategies on the
level of complexity and of tight-coupling.
Redundancy and Complexity
Redundancy may both reduce and increase
complexity. On the one hand, if an organization
has redundant means to receive and transmit
warnings of impending dangers, more adequate
information is available to base decisions and
actions upon. By increasing the probability of
getting adequate information, redundancy
reduces a system's complexity.
On the other hand, redundancy increases
complexity in several ways. First, redundancy
makes a system more opaque and, hence, more
complex (Perrow, 1984; Sagan, 1993).
Component and operator failures may be less
visible because they have been compensated for
by backups. These failures may, therefore, go
unnoticed for a long time (Turner, 1978).
Eventually, one of the backup systems may also
fail. The operators expected that system to be
backed up by the first system, but the first
system was already out of order. This actually
happened in the development of the near-
disaster at Three Mile Island. The nuclear reactor
had several cooling systems: one basic system;
emergency feedwater pumps; and high-pressure
injection. When the basic system failed, the
emergency pumps were set in motion. The
pumps did work, but the pipes through which
the water was supposed to flow were sealed
inadvertently. So, two redundant systems failed
simultaneously and unexpectedly. Consequently,
the reactor was heated even more. The operators
were confused when they noticed that the
temperature was still rising, because they were
unaware of the simultaneous failures (Perrow,
1984).
Secondly, backup systems may not be as
independent as they are supposed to be and can
therefore fail simultaneously (Sagan, 1993).
Simultaneous failure is likely to be unexpected,
and, therefore, interdependence makes a system
more complex. Boeing 747s, for instance, are
designed with four engines, two attached to each
wing. When one fails, the airplane supposedly
does not lose its balance, because the failing
engine is backed up by another. During the crash
Volume 5 Number 1 March 1997
20 JOURNAL OF CONTINGENCIES AND CRISIS MANAGEMENT
Figure 1: The Law of Perverting Redundancy
of a Boeing 747 cargo plane in Amsterdam (4
October 1992), however, the engines proved not
as independent as had been presupposed. When
one engine ruptured and broke off, it hit the
other engine on the wing, which also ruptured
and fell. With two engines missing from one
wing, the manoeuverability of the airplane was
seriously reduced (Netherlands Aviation Safety
Board, 1994).
Redundancy may increase complexity for
another reason: redundant information gathering
may lead to ambiguity and conflicting
perceptions. Consider a system with
independent observers; each observer has an
individual reliability of 0.8. This means that in a
system with one observer, the probability of
transmitting adequate information is 0.8,
whereas the probability of transmitting
inadequate information is 0.2. Add one
redundant observer, and the chance of failure is
reduced to 0.2 times 0.2, which equals 0.04.
However, the chance of getting adequate,
uniform information is also reduced: to 0.8 times
0.8 which equals 0.64. The remaining 32 per cent
is left for ambiguous information. The
probability of one observer providing
inadequate and the other providing adequate
information is 0.2 times 0.8 which equals 0.16. In
a system with two observers, the total
probability of yielding ambiguous information
is, therefore, 0.32. When more redundant
Volume 5 Number 1 March 1997
observers are added, the probability of
completely inadequate information almost
diminishes, but the probability of inducing
ambiguous information increases (see Figure 1).
Decision Premises and Tight-Coupling
Decision premises are established to ensure
rapid, coordinated responses to certain
anticipated situations (Weick, 1987). Decisions
guided by such premises ensure rapid recovery
from initial failures before these failures escalate
along tightly-coupled lines. However, rapid
response, based on pre-programmed decision
premises, is inappropriate when a situation
emerges which has not been anticipated (Sagan,
1993). Still, decision premises are not always de-
activated in situations they have not been
designed for. Standard operating procedures
and daily routines generally prove to be very
tenacious (Allison, 1971). Sagan (1993) has
provided extensive documentation on
organizational units continuing their daily jobs
in situations where doing so could have had
serious consequences. During the Cuban missile
crisis in 1962, for instance, test-launching
continued, even though such tests could have
been perceived by the USSR as hostile attacks,
provoking them to retaliate. This meant that the
system became more tightly-coupled. Decision
premises and routine activities could have been
ß Blackwell Publishers Ltd 1997
COMPLEXITY, TIGHT-COUPLING AND RELIABILITY: CONNECTING NORMAL ACCIDENTS THEORY AND HIGH RELIABILITY THEORY
the starting point of nuclear war. Decision
premises may take up a life of their own,
tightening system-coupling and increasing a
system's escalation potential.
Conceptual Slack and Complexity
Conceptual slack has a dual effect on complexity.
On the one hand, if a problem is perceived
through several divergent lenses, the probability
of spotting hidden contingencies increases.
Complex interactions can be detected earlier,
may even be anticipated before they arise. Such
hidden contingencies are very likely to remain
hidden if an organization, or even a network of
organizations, is imbued with a common
outlook. This point is best illustrated by the
disaster at Aberfan, Wales, in 1966. A tip of
mine dust slid into the village, killing 144
citizens. The investigation revealed that the
entire industry's attention was drawn towards
mining safety and that tip safety was hardly on
the agenda. Mining safety worked as a `decoy
problem', obscuring the more serious problems
looming in the background (Turner, 1978). Some
level of conceptual slack might have prevented
this disaster.
On the other hand, if many diverging, even
conflicting, perspectives are around, confusion
may infuse the organization and complexity is
increased instead of reduced. Turner (1978)
called this pathological kind of conceptual slack
`a state of variable disjunction of information'.
Many different stakeholders are involved in a
complex, ambiguous task. Responsibilities are
unclear and divided. Each one of the
stakeholders has a slightly different perception
of the situation. Information is shattered, not
communicated or sent to the wrong persons.
Reaching some sort of common perspective is
only possible after extended periods of trial
and error. In tightly-coupled systems, the first
error may be fatal. For instance, in 1968, a
large and very slow transporter carrying a
heavy transformer hit a train on a new type of
railway crossing near Hixon, UK, killing eleven
persons. A similar incident, with no loss of life,
had occurred before. Information about this
previous incident was distributed among
several divisions of British Railways, police
and municipal authorities. It never occurred to
any one of them that extremely slow vehicles
might be too slow to pass a crossing before
the arrival of a rapidly proceeding train. No
warnings were issued to the policemen
escorting the vehicle or the engine driver of
the train (Turner, 1978).
Perhaps some break-even point exists at which
the capacity to anticipate complex interactions is
increased sufficiently, yet the number of
diverging perspectives does not confuse and
ß Blackwell Publishers Ltd 1997
21
paralyze the organization. This break-even point
has not yet been discovered.
Learning, Complexity and Tight-Coupling
Learning may reduce complexity, not because
learning alters the configuration of a
technological system, but because the potential
for surprising interactions may be reduced as
experience grows. In the start-up phase of a
technology, many interactions are unexpected,
but, as time goes by, the technology becomes
more familiar and more interactions are
understood (Rochlin, La Porte and Roberts,
1987). However, learning does not necessarily
imply that anticipated interactions between
failures can be stopped from escalating,
especially not in tightly-coupled systems. Sagan
(1993) has provided documentation on accidents
recurring despite the experience with previous,
similar accidents. So, although learning may
contribute to the understanding of complex
technological systems, it does not automatically
help organizations to prevent accidents. The
record on the effects of learning on accident
prevention is ambiguous.
Conclusion
Complexity and tight-coupling have mixed
effects on overall reliability. Complexity and
tight-coupling enhance reliability by increasing
the need for redundancy, conceptual slack and
organizational learning. On the other hand,
complexity and tight-coupling sometimes
decrease the reliability of these organizational
strategies. Complexity may neutralize the
beneficial effects of redundancy and it impairs
organizational learning. Tight-coupling renders
conceptual slack ineffective and also thwarts the
learning potential of organizations.
The strategies discerned in HRT affect the
potential for normal accidents. These strategies
can be considered mixed blessings. On the one
hand, redundancy increases the amount of
information generated; the anticipation of a
higher number of complex interactions is
improved when conceptual slack is maintained;
and learning may reduce the level of complexity.
On the other hand, redundancy increases the
level of complexity by inducing ambiguity,
opaqueness and the occurrence of simultaneous
failures; conceptual slack may create confusion;
and, finally, decision premises increase the level
of tight-coupling.
NAT does not only explain normal accidents:
it can also be used to explain overall reliability.
HRT explains more than overall highly reliable
performance: it also highlights factors which
contribute to an organization's proneness to
Volume 5 Number 1 March 1997
22 JOURNAL OF CONTINGENCIES AND CRISIS MANAGEMENT
system accidents. Therefore, it can be concluded
that NAT and HRT may gain much from cross-
fertilization. Not only may theoretical discourse
be enriched, but cross-fertilization is also
important to provide practitioners with more
comprehensive and balanced answers to
strategic questions pertaining to accident
prevention and reliability. HRT may prevent
practitioners from over-pessimism induced by
NAT. NAT may reduce over-optimism with
regard to the success of reliability-enhancing
strategies.
To foster both cooperation and competition
between NAT and HRT, and to advance
progress in accident and reliability theory at
large, a modest research agenda may suffice.
First, it is not entirely clear to what extent
accident prevention and reliability pose
conflicting demands on organizational design
and decision making. A trade-off seems to exist
between enhancing reliability and preventing
normal accidents. For instance, should an
organization apply redundancy to promote
reliability, or should it refrain from doing so
because it increases complexity and, hence, the
potential for accidents? From a practitioners
point of view, it would be interesting to examine
the potential consequences ± in terms of number
of victims and amount of damage ± of various
alternative solutions proposed.
Secondly, some strategies may both promote
overall reliability and prevent normal accidents.
Learning could be such a strategy, although it is
hard to accomplish and the effects of learning are
ambiguous (Sagan, 1993). As was shown in the
case of Railway Traffic Control in the
Netherlands, efforts to un-couple tightly-coupled
systems provide another possible direction for
both promoting reliability and preventing
normal accidents. However, un-coupling is often
expensive, time consuming and, sometimes,
almost impossible given technological
constraints (Perrow, 1984). Research on the
processes of learning and de-coupling ±
especially on the limitations of these processes
± is called for.
Finally, the current debate on accidents and
reliability is biased towards accidents and
reliability in complex, tightly-coupled systems.
Yet, a large number of accidents still occur in
fairly linear, loosely-coupled systems. Such
accidents run the risk of being neglected. An
important body of knowledge has been erected
by the late Barry Turner, in which such accidents
have been examined and explained (Turner,
1978). Future research should take account of
Turner's so-called Disaster Incubation Theory
(DIT), which deserves a place in the current
debate (see Pidgeon, 1997) for an exploration of
the connections between NAT and HRT, on the
one hand, and DIT, on the other).
Volume 5 Number 1 March 1997
Notes
1 The author gratefully acknowledges the
comments and suggestions by Todd La Porte,
Charles Perrow, Nick Pidgeon, Paul Schulman,
Arjen Boin, Menno van Duin, Paul 't Hart,
Yvonne Kleistra, Marc Otten, and Ab van
Poortvliet.
2 I am grateful to Professor Schulman for
suggesting to me this distinction between `easy'
and complex lessons (personal communication,
1996).
References
Allison, G.T. (1971), Essence of Decision, Little Brown,
Boston.
Bovens, M.A.P. and `t Hart, P. (1996), Understanding
Policy Fiascoes, Transaction Books, New Brunswick.
Journal of Contingencies and Crisis Management (1994),
`Systems, Organizations and the Limits of Safety:
A Symposium', Volume 2, Number 4, December,
pp. 205±240.
La Porte, T.R. (1994), `A Strawman Speaks Up:
Comments on The Limits of Safety', Journal of
Contingencies and Crisis Management, Volume 2,
Number 4, December, pp. 207±211.
La Porte, T.R. and Consolini, P.M. (1991), `Working
in Practice But Not in Theory: Theoretical
Challenges of `High Reliability Organizations'',
Journal of Public Administration Research and Theory,
Volume 1, Number 1, Winter, pp. 19±47.
La Porte, T.R. and Rochlin, G.I. (1994), `A Rejoinder
to Perrow', Journal of Contingencies and Crisis
Management, Volume 2, Number 4, December, pp.
221±227.
Netherlands Aviation Safety Board (1994), Final
Report on the Accident with El Al 1862 on October
4, 1992 at Amsterdam, Bijlmermeer, SDU, The
Hague.
Perrow, C. (1984), Normal Accidents: Living with High-
Risk Technologies, Basic Books, New York.
Perrow, C. (1994), `The Limits of Safety: The
Enhancement of a Theory of Accidents', Journal
of Contingencies and Crisis Management, Volume 2,
Number 4, December, pp. 212±220.
Pidgeon, N.F. (1997), `The Limits to Safety? Culture,
Politics, Learning and Man-Made Disasters',
Journal of Contingencies and Crisis Management,
Volume 5, Number 1, March, pp. 1±14.
Roberts, K.H. (1993), `Introduction', in Roberts, K.H.
(Ed.), New Challenges to Understanding
Organizations, Macmillan, New York , pp. 1±10.
Roberts, K.H., Stout, S.K. and Halpern, J.J. (1994),
`Decision Dynamics in Two High Reliability
Military Organizations', Management Science,
Volume 40, Number 5, pp. 614±624.
Rochlin, G.I. (1989), `Informal Organizational
Networking as a Crisis-Avoidance Strategy: US
Naval Flight Operations as a Case Study',
Industrial Crisis Quarterly, Volume 3, Number 2,
pp. 159±176.
Rochlin, G.I. (1993), `Defining `High-Reliability'
Organizations in Practice: A Taxonomic
Prologue', in Roberts, K.H. (Ed.), New Challenges
ß Blackwell Publishers Ltd 1997
COMPLEXITY, TIGHT-COUPLING AND RELIABILITY: CONNECTING NORMAL ACCIDENTS THEORY AND HIGH RELIABILITY THEORY
to Understanding Organizations, Macmillan, New
York, pp. 11±32.
Rochlin, G.I., La Porte, T.R. and Roberts K.H. (1987),
`The Self-Designing High-Reliability Organization:
Aircraft Carrier Flight Operations at Sea', Naval
War College Review, Volume 40, Number 4,
Autumn, pp. 76±90.
Sagan, S.D. (1993), The Limits of Safety: Organizations,
Accidents and Nuclear Weapons, Princeton
University Press, Princeton.
Schulman, P.R. (1993), `The Negotiated Order of
Organizational Reliability', Administration and
Society, Volume 25, Number 3, November, pp.
353±372.
Sills, D., Wolf, C. and Shelanski, V. (Eds) (1981), The
ß Blackwell Publishers Ltd 1997
23
Accident at Three Miles Island: The Human
Dimensions, Westview Press, Boulder.
Turner, B.A. (1978), Man-made Disasters, Wykeham,
London.
Van Duin, M.J. (1992), Van Rampen Leren (Learning
from Disasters), Haagse Drukkerij en
Uitgeversmaatschappij, Den Haag (in Dutch;
Summary in English).
Vaughan, D. (1996), The Challenger Launch Decision:
Risky Technology, Culture, and Deviance at NASA,
Chicago University Press, Chicago.
Weick, K.E. (1987), `Organizational Culture as a
Source of High Reliability', California Management
Review, Volume 29, Number 2, Winter, pp. 112±
127.
Volume 5 Number 1 March 1997