Normal Accidents

1. Interaction Complexity Versus Coupling Matrix

   Systems can be classified along two independent axes: whether interactions are linear or complex (unexpected, invisible, non-sequential interactions between components), and whether coupling is loose or tight (whether processes allow slack, delay, and improvisation or demand immediate, precise sequencing). The dangerous quadrant combines high interactive complexity with tight coupling, because operators cannot understand what is happening fast enough to intervene before cascading.

2. Catastrophic Failure Is Structurally Inevitable

   In systems that are both interactively complex and tightly coupled, serious accidents are not aberrations caused by negligence but normal properties of the system's architecture: given enough time, multiple small failures will interact in ways no designer anticipated. This makes such accidents a predictable statistical certainty rather than a matter of fault or carelessness.

3. Hidden Interactions Between Independent Failures

   A normal accident originates not in a single large failure but in two or more small failures, each individually trivial and often invisible, that interact through unexpected pathways the designers never connected. Because the interaction is unforeseen, operators lack any mental model to diagnose it while it unfolds.

4. Safety Devices As New Failure Sources

   Adding redundancy and safety systems to a complex, tightly coupled system does not simply reduce risk; each added component introduces new interactions and new ways to fail, often increasing the opacity operators face during a crisis. More protective technology can therefore make a system more accident-prone rather than less.

5. Three Mile Island As Normal Accident

   At Three Mile Island, a minor maintenance error combined with a stuck relief valve and a misleading indicator light to convince operators coolant levels were high when they were dangerously low, so their corrective actions worsened the meltdown. The point is that competent operators acted reasonably on the information available; the system's complexity, not their incompetence, produced the disaster.

6. Centralization And Decentralization Both Fail

   Tight coupling demands centralized, obedient response to manage fast cascades, while interactive complexity demands decentralized, improvising operators who understand local conditions, so systems with both properties impose contradictory organizational requirements that cannot be simultaneously satisfied. No management structure can resolve this bind, which is why some technologies should be abandoned rather than reformed.

Save ideas and give them a thumbs up or down in the app