Shouldering Risks: The Culture of Control in the Nuclear Power Industryby Constance Perin
"At the world's some 440 nuclear power plants, experts continually monitor their wide safety margins, and at signs of trouble seek out the sources and recommend changes. Too often for their comfort, and for ours, a subsequent problem reveals that these changes were ineffective or never made. Why this self-defeating pattern? What in this technology's culture of control… See more details below
"At the world's some 440 nuclear power plants, experts continually monitor their wide safety margins, and at signs of trouble seek out the sources and recommend changes. Too often for their comfort, and for ours, a subsequent problem reveals that these changes were ineffective or never made. Why this self-defeating pattern? What in this technology's culture of control might undermine experts' best intentions? What kind of problem is it to reduce operating risks?" Following brief highlights of this industry's history over the last twenty years of accidents, near-accidents, and institutional changes, Shouldering Risks presents excerpts from interviews with some sixty experts about four relatively recent events at three U.S. plants. Drawing also on her earlier field studies at eleven plants in America and abroad, on industry documents, and other's research.
Todd R. La Porte
Karl E. Weick
"[A]n impressive ethnographic study. . . . This book will prove valuable for readers in any discipline who wish to understand more about the functioning of complex systems."Charlotte Linde, Technology and Culture
"Perin has written what could be called a manifesto for the second generation of studies involving [high-reliability organizations]. . . . This book is a major, solidly grounded, agenda-setting piece of work held together by an amazing blend of concepts and evidence!"Karl E. Weick, Academy of Management Review
"Shouldering Risks is an impressive ethnographic study of the nuclear power industry. . . . This book will prove valuable for readers in any discipline who wish to understand more about the functioning of complex systems."Charlotte Linde, Technology and Culture
"Constance Perin's study is a penetrating and worrisome analysis of life in several nuclear-powered electricity production stations similar to those on which a number of industrial societies continue to depend. . . . I commend Shouldering Risks . . . because Perin's work tries to sort out the logics of control that arise in conducting operations judged by our society to be of such benefit that institutionalizing very hazardous systems seems justified."Todd R. La Porte, Administrative Science Quarterly
- Princeton University Press
- Publication date:
- Product dimensions:
- 6.10(w) x 9.20(h) x 1.10(d)
Read an Excerpt
Shouldering RisksThe Culture of Control in the Nuclear Power Industry
By Constance Perin
Princeton University PressConstance Perin
All right reserved.
PrefaceThe Culture of Control
SHOULDERING RISKS their designers have foreseen, bullet trains, jumbo jets, manned space capsules and stations, nuclear power plants, offshore oil rigs, and supertankers deliver services, goods, and knowledge we have come to rely on. Heroic in their ambitions, in the amazing materials making them possible, and in the immense amounts of money and the millions of people mobilized to design and operate them, these technologies maintain uncanny control over gravity, friction, and temperature to defeat known dangers. Their size, reach, beauty, and raw energies awe us. When accidents take or threaten lives and destroy or degrade ecologies, awe turns to anxiety, horror, grief, and mistrust. Wary of that possibility, designers devise worst-case scenarios and try to preclude them. Although that reduces the odds of accidents, the outcomes of any one are likely to be major-hence, "high consequence" or "high hazard" technologies, as they label themselves.
Shouldering risks no one has foreseen is left to those standing watch on the bridge between designers' intentions and how they are being realized. Even with wide safety margins and detailed operating procedures, missteps, missing resources, miscommunications, or mistakes have tobe found and put right before they can turn into a tragic flaw. More often than we hear about, and most of the time, those responsible for handling risks-boards of directors, engineers, executives, managers, operators, regulators-defuse worrisome situations, prevent surprises, and keep any that appear from becoming more serious.
Even so, short of an accident, missteps can have "high consequences" for public trust and for productivity. Testifying in October 2003 to their inability to stave off eight "severe incidents" in "just the last few years," presidents and other executives of nuclear utilities in Hungary, Germany, Japan, United Kingdom, and the United States told an audience of about four hundred "how their organizations descended unperceived into a situation where both plant staff and management failed to see disaster lurking." After "the degradation in safety was revealed," repairs and lost revenue cost "hundreds of millions and even billions of dollars." At this biennial meeting of the World Association of Nuclear Operators (WANO), whose theme was "transparency and openness," the audience "sat spellbound as their peers described, with the bitter benefit of hindsight, how this could happen, even to organizations that were once seen as industry stars," Nucleonics Week reported. Formed in 1989 as a global response to the 1986 accident at Chernobyl, WANO provides members with peer assessments and technical assistance. "The world nuclear power industry is in danger, threatened by the negligence and complacency" of those companies that "had not heeded earlier signs and, in many cases, are still suffering the financial, social, and political consequences," WANO executives cautioned at this Berlin meeting.
The reasons for these incidents, utility executives and WANO peer reviews said, were "negligence in cultivating a safety culture due to severe pressure to reduce costs following the deregulation of the power market"; not "paying attention to detail"; taking "safety culture for granted"; "overconfidence"; "production bias"; ignoring "significant operating experience"; engineers' "arrogance and complacency"; safety plans without "follow-through." WANO's chairman Hajimu Maeda "warned that even if the public understands that nuclear energy has advantages, 'that is not the same as public acceptance.'"
"Transparency and openness" are certainly remarkable and welcome in an industry not known for plain public speaking. Those reasons nevertheless recite a litany I have been hearing since 1990 when, as a member of a research group at the Massachusetts Institute of Technology and as a total outsider to this industry, I began to study the kinds of knowledge and ways of thinking its experts bring to bear in reducing operating risks. By 1996, I had been invited into eleven nuclear power stations and a few utility headquarters in the United States and abroad, and to national and international industry conferences and technical workshops. I also had joined two teams of experts on invited peer visits at two plants abroad, under the auspices of the International Atomic Energy Commission (IAEA). From men and women who are chemists, control room operators, design and system engineers, electricians and electrical engineers, executives, health physicists, human resource managers, line and middle managers, maintenance supervisors, occupational safety specialists, outage managers, risk analysts, station managers, and others, I heard what "operating safely" means to them and saw how they try to improve the ways they do that. More recently, at three other U.S. nuclear power stations I revisited four events occurring a few months earlier with those involved in them and in analyzing them. Of the many kinds of feedback that control relies on, experts' self-studies crystallize their understandings of how and why control is lost, recovered, and maintained.
Although not classified as "severe incidents," the reasons for these events not only echo that litany, but they also reveal a pattern long a concern of the nuclear power industry, its regulators, and the public. After analyzing an event designated "significant" for somehow threatening reactor safety margins, experts' best intentions to prevent repetition or further trouble go unrealized too often for comfort, theirs and ours. Standard practice is for an internal team to drill down to a "root cause," elaborate on "contributory causes," and, through reverse engineering from the unwanted outcome back through its inputs, develop recommendations to prevent recurrence. Annually, at plants in the United States and Canada experts make from two hundred to ten thousand self-reports of problematic conditions, ranging from housekeeping flaws to significant events, and of those, some thirty to fifty come under an internal review team's scrutiny. With this high volume of self-reports and self-analysis, the industry expects to ward off surprises and preclude repeats.
But not all event analyses turn out to have been sufficiently thorough, nor are all recommendations effective or carried out. In thirty-seven events involving safety-critical systems at U.S. nuclear power plants between 1992 and 1997, not only had previous errors not been identified earlier, but failures to correct already known problems came to light. These gaps were four times more numerous than errors involved in the event itself, according to a study the U.S. Nuclear Regulatory Commission (NRC) published in 2001. In those same events, previously recommended changes not carried out contributed to 41 percent of them, and in about 20 percent, utility and plant managers had not responded to industry notices of equipment defects nor to recommended revisions in operating practices. The longer problematic conditions persist, the less predictable and controllable system interactions become. Risk estimates that calculate the probabilities of equipment malfunctions do not also calculate the probabilities that these self-defeating patterns will be present.
The chance discovery in 2002 of long festering erosion on the head of the reactor vessel at the Davis-Besse plant in Ohio (one of the incidents discussed at that WANO meeting) revealed those same patterns. According to after-the-fact scenarios of the damage this could have triggered, the NRC and the International Atomic Energy Agency calculated that its severity would match that of the accident at Three Mile Island (1979). These patterns appear in other risky technologies, as for example, in the space shuttle program of the National Aeronautics and Space Administration. In its inquiry into the 2003 loss of the Columbia shuttle and its crew, the Columbia Accident Investigation Board found issues in NASA's work systems and analytic processes similar to those contributing to the 1986 Challenger accident.
At the same time as the nuclear power industry has made fundamental improvements in reducing operational risks, those self-defeating patterns persist and the reasons for serious trouble remain the same, across national borders. That is what Shouldering Risks tries to explain, by asking a back-to-basics question: What kind of problem is it to reduce the risks of operating a nuclear power plant? Early in my field studies, a station manager in the United States introduced me to about forty managers and supervisors at their "plan of the day" meeting. Unexpectedly, he added, "The reason I've welcomed her is that as a cultural anthropologist, she sees the things we take for granted around here in a different way. She might help us to do the same, so we can get even better at what we do." Despite the strengths of this industry's culture of control, I conclude, "getting better" is possible but not as a matter only of doing the same things better. To lessen the number of events occurring at all and to increase the frequency of sound analyses and effective recommendations-the most fruitful ways to prevent "severe incidents"-it is a more fundamental matter of reconsidering this industry's culture of control.
Like any culture, it is an intricate system of claims about how to understand the world and act in it. In this high hazard world, technologists' explicit claims pivot around the dynamics of control theory, meshed with productivity concepts such as optimization and efficiency, to produce protective bywords such as command and control, defense in depth, feedback, margins of safety, procedures, rules, system reliability, training. These technically correct claims before the fact cannot be the end of it, however. When the switch is turned to On and risks appear in real time, it becomes apparent that technologists do not-cannot-incorporate into their control calculations the contextual dynamics that inevitably accompany operations. That neglect is intentional, inspired by the goal of designing self-consistent, workable systems according to analyses and simulations that assure the lowest possible probability of an accident-workable, that is, under eventualities designers have imagined. A peopled technology operating in the world is, they claim, a source of variability and instability to be minimized by maximizing automation, standardization, and training. Once operating, when control is threatened or lost, however, assumptions underpinning those technical claims come to notice: assumptions about the relationships of humans to machines, models to reality, ambiguity to certainty, rationality to experience, facts to values. Those assumptions and the practices they support, Shouldering Risks proposes, are sources of persisting troubles and patterns.
To realize this industry's original promises-to mute the divisive and deadly politics of oil and to squelch the harmful consequences of burning wood and coal-remains a goal of many here and abroad. For others, the risks of operations and of those throughout the fuel cycle outweigh those promised benefits. In any case, promises to shoulder the risks of nuclear power production cannot be confused with the ways they are being kept, here and now and for the lifetimes of current plants and of those being built. That fact is not lost on the thousands of scientists, engineers, and industrialists worldwide searching for technical improvements to make good on them. At one U.S. station, however, an engineer sighed in frustration, "We're technical people, but most of our problems are cultural." To keep cultural promises-to turn "safety culture" into more than a catchphrase-far fewer analytic resources are at hand or called upon. Until up and running, risky technologies are sheltered from the influences of competition and downsizing, missing documentation and trend analyses, legal culpability and regulatory penalties. In designers' thinking there is little room for such worldly matters; they surface as those frustrating "cultural problems" for owners, operators, and regulators.
For real-time operations, the concepts and methods of the physical and engineering sciences lack sufficient scope. When machinery develops flaws, people make mistakes, or unexpected situations arise and going by the book becomes irrelevant, maintaining control depends, at the least, on situational intelligence, foresight, and, above all, on the interpretation of signals of many kinds. But relatively little engineering thought or other intellectual capital has been invested in analyzing the contextual dimensions of risk handling and risk reduction, compared to that invested in estimating risk probabilities. That neglect is one consequence of a hierarchy of credibility at the center of this culture of control, which esteems evidence deemed measurable and discounts that which is not. As pervasive as that hierarchy is across many domains of practice, it can work against realizing the very aims of this and other high hazard technologies. Noting "sharp limitations in the current state of knowledge about how risk is handled in human organizations," a British study group in The Royal Society calls for a more "robust knowledge base" for designing the "social and administrative" changes often recommended "in the aftermath of major accidents." The "research map is a bit like the population map of Australia, with almost everything clustered round the edges and hardly anything in the central conceptual areas." Shouldering Risks tries to fill in some of that vast space.
* * *
At the book's center are three chapters in which those responsible for daily operations at three plants discuss four events. At Arrow Station, a complicated repair of a critical component in containment displays a panoply of control dynamics. Station managers considered this event to be so serious that they put three review teams to work, each with somewhat different aims. At Bowie Station, each of two unrelated events, brought on by seemingly simple mistakes of experienced people, display some of the industry's demographic dynamics and its ambivalence toward the costs and benefits of outages for repair and refueling. At Charles Station, what turned out to be an ominously dangerous situation, found by chance, reveals the practical consequences of distinguishing "nuclear" and "nonnuclear" "sides" of plant design and operation.
These chapters sustain three perspectives on the events: reports of event review teams that analyzed each for the record; verbatim insights and observations of about ninety experts' excerpted from my transcripts of our taped discussions; and my queries, observations, and reflections on this and other kinds of evidence. Those, and my ordering of that evidence, represent my "different way" of seeing: concern with experts' ideas, concepts, knowledge, language; with their ways of thinking expressed in everyday practices; and with their understandings of their working relationships. Taking off from experts' reports and from their insights are excursions into wellsprings of the issues and themes they bring up, not to second-guess their analyses but to accumulate historical, technical, and conceptual sources of unrecognized elements in this culture of control. My excursions travel into the research of others and draw on my archive of other experts' observations and experiences as reported at workshops, technical meetings, and peer reviews, as well as on my discussions at other nuclear power stations (chiefly Overton Station, whose operations I had previously observed through its different operational phases). Maintaining the integrity of each perspective extends the spirit of my station visits: a collaborative critique toward understanding. As an Arrow Station expert said, heatedly objecting to a team report that compared its event with one more serious, "Events never die, they live on to be misinterpreted in the future!" Or reinterpreted along different lines, as I do in my reflections and as readers will through their own frames of reference.
Excerpted from Shouldering Risks by Constance Perin Excerpted by permission.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.
What People are saying about this
George E. Marcus, Chancellor's Professor of Anthropology, University of California, Irvine, and coauthor, "Anthropology as Cultural Critique"
Alfred Marcus, Carlson School of Management, University of Minnesota
and post it to your social network
Most Helpful Customer Reviews
See all customer reviews >