ML20083N812

Testimony of C Perrow.Nuclear Power Plant Production Sys Characteristics Force Inevitable Conclusion That Serious Accidents Will Occur Which Design Engineers Could Not Anticipate & Which Operators Cannot Avoid

ML20083N812
Person / Time
Site:	Indian Point
Issue date:	01/31/1983
From:	Perrow C FRIENDS OF THE EARTH, NEW YORK CITY AUDUBON SOCIETY, YALE UNIV., NEW HAVEN, CT
To:
References
ISSUANCES-SP, NUDOCS 8302030184
Download: ML20083N812 (15)

Text

...-.

UNITED STATES OF AMERICA NUCLEAR REGULATORY C0fMISSION ' oc$ETED t

c^

BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of )

)

CONSOLIDATED EDISON COMPANY OF NEW YORK ) Docket Nos. 50-247 SP (Indian Point Unit 2) ) 50-286 SP POWER AUTHORITY OF THE STATE OF NEW YORK January 31, 1983 (Indian Point Unit 3)

DIRECT TESTIMONY Of CHARLES PERROW, Ph. D.

On Behalf Of FRIENDS OF THE EARTH, INC.

And THE NEW YORK CITY AUDUBON SOCIETY ON COMMISSION QUESTION 1 kDOC 0 000247 T PDR .

4

-w ww&. -

_g_

Testimony of Charles Perrow In the matter of the Indian Point, N.Y. Nuclear Power Stations I am a tenured professor of sociology at Yale University.

I received my Ph.D. In 1960 from the University of California at Berkeley. My field is organizational theory"an.d analysis. I am the author of four books and about 30 chapters or articles in professional journals. I first studied nuclear plants when the Social Science Research Council commissioned a paper on the o'r g ani z a t i onal aspects of the Three Mile Island accident, as a part of their contract with the President's Commission on the Accident at Three Mile Island; the paper was made available to the Commissioners. Subsequently I have studied nuclear power plants more extensively as a member of the National Research Council's Committee on Human Factors; as a member of the Nuclear Regulatory Commission's Reactor Safety Goals panell as a consultant under contract to the Battelle .Memori al Institute in connection with their contract with the Nuclear Regulatory Commission regarding organizational forms that best promote safety (NUREG 0731); as a result of a two year grant from the National Science Foundations as a result of a grant from the Office of Naval Research to study the organizational context of human factors; and in connection with a book I am preparing under contract. with Basic Books, Inc., on accidents in high risk systems.

Nuclear power plants are one of a handful of systems that-have low probability accidents with high catastrophic potential.

Some others are chemical plants, recombinant DNA engineering and

research, and nuclear weapons systems. In rommon with these other systems, nuclear . power- plants have a production system which is both highly interactive and tightly coupled. I argue that these characteristics, defined below, make it inevitable that serious accidents will occur which design engineers could not anticipate, and which operators cannot avoid. Accidents in systems where the linkages between the parts are complex rather than linear, and where the coupling.is tight rather than loose, are inevitable, and no amouunt of engineered safety devices nor operator training can prevent them. The reason for this is as follows:

Most industrial and other systems are primarily limited to linear interactions--those that occur in expected production sequence. Complex interactions are those of unfamiliar sequences, or unplanned and unexpected sequences, and are either not visible to designers or operators or not immediately comprehensible.

Systems which transform things abound in complex interactions; those that maunufacture, fabricate or assemble things can be limited to linear interactions, i.e. those that are visible, expected and planned.

Linear systems are safer because they can easily separate subsystems, install buffers between them, isolate failed parts, substitute materials or personnel, and have direct, on-line control and information sources. This means that when something fails, diagnosis is easy, natural buffers exist, and recovery is easily made. Component failures are inevitable because nothing is perfect, neither designs, equipment, procedures, operators, supplies and materials, or environment, (cal l ed the DEPOSE components of any

-. m n e

system)

However, in systems with complex interactions, even though safety devices and' buffers are intentionally designed in, there will occasionally be multiglg failures in iQdtRE0dRQt units or subsystems which can interact in unforeseen and unexpected ways.

There are connections which are unplanned, unexpected and probably invisible. The designer cannot anticipate all the interconnections of possibse failure sources, and the operators cannot comprehend them when they occur.

If, in addition, such a system is also tightly coupled--that is, its functioning is. highly dependent upon precise timing, its sequences are invariant, there is no slack in resources, and there is only one way to make the thing--then the operator cannot intervene to prevent an incident from propagating into a serious accident. In linear systems, loos's coupling means that delays are possible, alternative sequences are available, various methods can be used to achieve the goal, there is slack in supplies, equipment, personnel, quality standards etc., and there are fortuitous recovery aids available. Thus, even if a system has complex interactions, if it if loosely couplad the consequences of the interaction of multiple, independent failures are not severe.

Recovery is possible. When complex interactions exist with tight coupling, the possibility of " system accidents" is greatly increased.

A system accident is one that is, in effect, caused by the system itself, in contrast to a component failure accident which is simply caused by the component failure. DEPOSE components are bound

to fail at some time, and one may trigger another in a domino fashion (expected production sequence). We guard against component failures with redundant components, buffers, circuit breakers, shutdowns, isolation etc. This limits the number of accidents resulting from component failurest the failure remains an incident.

In complex systems, the interac' tion of failures can defeat these safety devices. One important safety device is operator intervention, -but if the interaction of failures is incomprehensible to the operator. (and . unanticipated by the designer), he or she cannot intervene successfully. If the system is also tightly coupled, the time frame makes comprehension and then intervention even more difficult.

For these reasons the usual calculations of expected failure, or risk assessments, are inappropriate for systems that are complexly interactive and tightly coupled. These risk analyses emphasize single failures, or common mode failures that are anticipated and understandable, and virtually ignore the interaction of small failures in independent subsystems that can mysteriously or unexpectedly become linked together. Thus, many of '

the accidents that have occurred in nuclear plants are truely

" incredible" in the sense of having f~antastically low probabilities according to conventional calculations of failure, yet may have occurred several times.

Three Mile Island was such an accident. Four independent failures occurred, and the operators could not be expected to be aware of any of these. Most other serious accidents, such as the fire at Browns Ferry, the Fermi accident near Detroit, and the

^

$N Ac

e - - -

. .s

_5_

Dresden 2 accidents, as well as'some at government reactors, have been system accidents. I have identified several others in the literature, drawn from the NRC-sponsored journal, Nugleat Safetyt One study found that most accidents that led to scram (dropping the control rods in the reactor and ending the fissioning) have multiple causes that involve separate subsystems. Niclear plants, I I conclud'e, are prone to system accidents, even if they are quite infrequent. Most failures do not cause accidents; most accidents are simple component failure accidents; but there appear to be at least a few every year that are system accidents.

Indian Point Unit 2 and 3 nuclear plants are no different from other nuclear plants in this respect. Indeed, if these plants should have a history of above average Licensee Event Reports or outages, or particularly poor management, the opportunities for component failures would be higher, and thus the opportunities for unanticipated interactions or failed attempts at recovery (that i s, for system accidents) would be even higher. The evaluation of Unit l

2 by the Systematic Assessmont of Licensee Performance Review Group of the NRC is not encouraging in this respect. It found " evidence of weaknesses in five functional areas. These areas were plant 1

operations, maintenance, reporting, committee activities, and management control." It " received a relatively large number of items of noncompliance, including escalated enforcement action, I

l when compared with other facilities." It was ranked in the lowest group.

Fortunately, no system accidents have led to significant emissions of harmful materials as yet, but this is because we have M n?TFS@fMbbfE T E d K M d 2Y"*a@:RWfnm

I

-b- l had only a few hundred years experience.with each of our various types of reactors. There are roughly three size categories, two major types (PWR and BWR), and three different manufacturers. This means that our experience with, say, a 1000 mw range PWR built by Westinghouse, is very ' l i mi ted . Given the size and complex'ity of these installations, we would need perhaps 1000 plant / years experience with each type and manufacturer to be able to say that all the unexpected thi.ngs that could happen have happened, and that ,

in view of the changes we have made, that we can say the system is mature. Even then, system accidents will still appear. Ammonia production, for example, is a very mature system in the chemical industry, yet ammonia plants experience one serious fire every 11 months, some of which are quite baffling and of unknown origin.

These plants are also tightly coupled and ccmplexly interac.tive.

Nor are we likely to learn enough from experience to prevent system accidents. Experience teaches us that one type of unexpected interaction may occur, and we can guard against that one, but with millions of parts there are millons of others we have not experienced. Indeed, as the result of the " experience" at TMI, the operating regulations on similar plants were changed. Yet within a few months at least two plants had accidents that were more serious than they- needed to be because the operators were required to follow the- new regulations (regarding High Pressure Injection), despite their better judgement. The new rule was then greatly relaxed, and we are not.much better off, in terms of one part'icular failure, than we were before this " experience" that one might think we could have learned from. System accidents are, in a

sense, the result of unique combinations of factorst changes.made on the basis of one of.these unique' combinations may not affect another one.

Better corporate and bett'er plant management would certainly help reduce the number of component failures in plants; so will better operator training, better equipment, designs and so on. There is a great, great deal that can be done to'make nuclear power plants somewhat safer. But there will always be component failures be'cause nothing is ger f'ect--d esi gn s, operators, environments or whatever. Thus, in complex systems we can expect a system accident in a reasonable period of time. With tight coupling, there is a high probability ,that intervention and recovery cannot be quick enough and thorough enough to' prevent the propagation of the failures until it results in a catastrophe.

Charles Perrow Professor of Sociology.

1 Yale University l l

January 25,-1983

Curriculum Vitae Char'les B. P'e rrow

,2ducation University of California, Berkeley

5. A.,1953, M. A.1955, Ph.D.1960, all in Sociology Present Position Professor, Departnent of Sociology Fellow, Center for Advanced Yale University Study in the Behavioral Sciences New Haven, Connecticut 06520 Stanford, California 1981-82 Personal Born 1925, Tacoma, Washington Married, Two children Social Security No. 532-18-4107 Teaching Positions-1959-1963 ' Instructor to Assis t ant- Professor, Department of Sociology, University' of Michigan, Ann Arbor.

1963-1966 Assistant to ' Associate Professor, Department of Sociology, and the School of Public and International Affairs, and the Administrative Science Center, University of Pittsburg.

1966-1970 Associate Professor to . Professor, Department of Sociology, University. of Wisconsin; Head, Social Organization Center, 1966-1970.

1966-1969 Visiting Professor, Institute of Industrial Relations and School of Business Administration, University of California, Berkeley.

1970-1981 Professor, Department of Sociology, State University of New York at Stony 3 rook.

1972-1973 Visiting Professor, London Graduate School of Business, London.

19E1-1982 Fellow, Center for Advanced Study in the Behavioral Sciences, Palo Alto, California.

Major Research Grants l l

17.~ 7-195 f NIMM. Predoctoral Fello.wship. Coals and authority in j general hospitel. . 1

1Ry .y ,,

<2 Major Research Grants (continued) t, 1958-1962 N!MS Grant. ' Associate Study Director, compcrative study of seven juvenile correctional institutior.s.

1963 NIMH Grant. Panel study ofva correctional institution.

1965-1967 NSF Grant. Comparative study. of eight industrial corporations.

1967-1968 .NSF Grant and Vocational Rehabilitation Grant, Comparative study of fourteen industrial corporations.

1971-1972 NIMH Gra'nt. Insurgency and social change in U.S.,

1948-1970.

1973-1976 NIMH Grant. Insurgency and social change in U.S.,.

1948-1972.

1978 NSF Grant. Origins of industrial bureaucracy in the U.S.

. i

'980-1982

_ NSF Grant. Accidents in HighaRisk Systems.

Consultancies and Minor Grants i

1956-1958 Evaluation study for OVR of Home Care Program, Mount Zion Hospital; Evaluation study of alcoholic rehabilitation progra=, California State Alcoholism Commission.

1963-1964 Evaluar. ion study of half-way home program for Federal Bureau of Prisons (with other co-investigators);

Censultant and research role for City Youvi Commission.

1974-1975 Consultant to"Philips Industries, Eindhoven, Holland, on work structuring program.

1972-1973 Consultant on various projects in public sector for Imperial Ce.lege of Science and Technology, London.

1972-1975 Verkshop leader, for Dalv '.oveluck Associates, running two-day workshops for executives in !andon.

!!'3-1974 Evaluation study of administrative practices in student services at Stony Broo'<.

i

3 Coesultancie= an? Minor Grants (continued) le?5 Consultant on evaluation strategies for AlD rural health programs; Consultant, Office of Tele-communications Policy, electronic funds transfer.

1979 Background paper for President's Commission on the Three Mile Island Accident, "TM1--A Normal Accident."

1981-1982 Dioxin in the Office Building: the Generation of Risk Assessment in Te rms .o f Personal Tragedy and Organizational Dileanas. Russell Sage Foundation, small grant.

Teach'.ng Interests Ccmplex Organizations, industrial Society, Technology and Social Change, Social Movements, Research Design, Sociological Theory.

Current Research and Writing My long term project is a volume titled "A Society of Organizations" which considers the development of the industrial bureaucratic form in the U.S. free about' 1820 to the present. The first part, which is f airly well researched to date and partly drafted, deals with the origins of factory bureaucracy from 1820 to 1890, with attention to the creation of a wage dependent population, forms of opposition, and alternative paths that were tried but did not succeed. The second part details the solidification of the industrial system at the turn of the Century, the development of an appropriate rationale in the form of bureaucratic theory, and the spread of this form of bureaucracy to government, welfare and voluntary organizations up to World War II.

The third part deals with the transformation of the system after the war into a highly interdependent society of organizations which

, consumes most of the non-organizational society, producing dynamics which present theory cannot comprehend. An alternative theory is presented.

Work on this book was interrupted by a request to prepare a paper for the President's Com=ission on the Accident at Three Mile Island, as a part of a Seeial Selence Research Council package. The issue of uncontrolled interactions in social systems was to be a major them: of I

t%: above book, and this turned'out to be a chance to explore it i.a single system, analyzed as a synergistic accident or "nornci accident." Since then I have developed the notion more fully er.d systematically and am currently investigating accidents in a variety of systems, part '.cularly high, risk ones 'such as chemical plants, cir and sea transportation, DNA. research, medicine (adverse drug reactions), the World Wide Defense Command System, the space program, anc' military adventures. A two year NSF grant will allow considerable field work in these and in other systems used for comparison purpoe"s (assembly and fabricating plants, government bureaucracies,

4 Current Resecrch.and Writing (continued) -

universities), and will result 'in a book, hopefully, at the end of the '

two year trant (fall,1982). ' . Thus, a particular case of the larger

' book will be expanded ' considerably because of -its policy es ~well as theoretical relevance.

Memberships and Honors Phi Beta ' appa; Newhouse Fellowship (University of _ California)

Public Health Pre-Doctoral Fellowship Public Health Service, Special Fellowship Editorial Board Membership American Sociological Review, Adelnistrative Science Quarterly, American Journal of. Health and Social Behavior, Administration and Society Council Member, Section on Professions and Organizations:

American Soc _ological Association Vice-President: Eastern Sociological Society Sociology Panel: National Science Foundation Senior Research Fellow: Center for Policy Research Fellow: American Sociological Association American Association for the. Advancement of Science Industrial P41ations A.sociation Eastern Sociological Society International Sociological Association National Research Council, Committee on Human Factor.Research Books and Published Mo::ograohs i .'. Study on the Non-Segregated Hospitalization of Alcoholic Patients i- c_ General Hospital, (American Hospital'Associati 7, Hospital

[

Monograph Series 7, 1959) with Mark Berke, Jack D. Cerdon, M.D.,

and Robert I. Levy, M.D., 120 pages.

2. Organization for Treatment:- A Comparative Study of Juvenile Correctiont'. Institutions, (!ne Free Press, 1966) with David Street cdd Robert L. Vinter, 330 pages.

3. Organizational Analysis: A Sociological View, (Wadsworth Pub'ishing Co.) 197Q, .192 pages. (Chapters have been reprinted).

4. Complex Oreenizations: A Critical Essay, Scott, Foresman, 1972, 224 -ages. (Chapters have been . , reprinted. ) Revised edition, 1978.

5. The Radical Attack on Business. 'Harcourt Brace Jovanovich,1972, 276 pages.

l I

t

5 Research Artie'.es or Chapters

1. "Are Retirement Adjustment Programs ' Necessary?," _ Harvard - Buciners Review, 35:4 (July-August, 1957), 109-154 4 2. "Gemeinschaf t and Gesel1schaf t: A Critical? Analysis of the Use of a Polar Typology," Berkeley Publications in Institutions and Society, l 2:1 (Spring, 1956), 20-43. Also reprinted in Autonomous Group Bulletin, XIII:1, 2 (Autumn-Winter, 1957), 10-16.

3. "Research in a Home Care Program," American Journal of Public Health, 49:1 (January, 1959), 34-44.

4. " Nonsegregated Hospitalization of Alcohoi'ic Patients . in a General Hospital," Hospitals, Journal of the American Hospital Association,

• ol. 33 (Nov.16,1959), 45-48, with Mark Berke, Jack D. Gordon, M.D. ,

and Rcbert I. Levy, M.D.

! 5. " Organizational Prestige Some Functions and Dysfunctions," American l Journal of Sociology, 66:4 (January, 1961), 335-41. Reprinted in 3 books.

6. " Analysis of Coals in Complex Organizations," American Sociological Review, 26:6 (December, 1961) 859-66.

Reprinted several times and in BOSS: verrill Reorint Series.

7. . " Reality Shock: A New Organization Confronts. the Custody-Treatment Dilemma," Socirl Problems, 10:4'(Spring, 1963), 374-82.

B. " Coals and Authority Structures, A Historical Case Study," Chapter 4 '

in ,7; Mosoital' in Modern Society, Eliot Freidson, (ed.), (The Free P-ess, 1963), 112-46. ,

9. " Sociological Perspective and Political Pluralism," Social Research, 31:4 (Winter, 1964-65), 411-22. Reprinted.

10. "The Reluctant Organization and the Aggressive Environment," (with John Manihe), Administrative Seier.ce Quarterly, 10:2 (September, 1955), 238 .~7. Reprinted.

' ._ ' . " Hospitals: Technology, Goals and Structure, Chapter 22 in Handbook t -

ef Orrr.eizatio*.s, James March (ed.), Rand McNally, 1965), 910-71.

12. " Reality Adjustment: A Young Institution Settles for Humane Care,"

Socia'. Preblems, 14:1 (Sumr c, 1966), 69-79.

i

13. " organizational Goals," International Encyclopedia of the Social Scien:es, revised edition, (X.cMillan Co., 1968), Vol. 11, 305-11.

~

l o

O

• 6 Research Ar.tieles or Chapters (continued) 14 " Technology and Organizational Structure," Proceedings of the 19th Annual heet'n3 of the Industrial Relations .- Research Association, Iecember 1966, 156-63.

15. "A Framework for the Comparatise Analysis of Organizations," American

~

Soci ologic a'. . Review,. ( April, 196 7) , 194-208. Reprinted several times anc in 3chbs-yerri Series..

16. "The Professional Army in the War on Poverty," " Focus Article" in Poverty and Human Resources Abstracts, (January-February, 1968).

17. " Technology and Structural Changes in Business Firms," Industrial Reletions! Contemporary Issues, B.C. Roberts, (ed.), (MacMillan Co.,

196E), 2C5-19.

18. "Some Reflections on Techrology and Organizations," in A. R. Negandhi, i

et al. (eds.), Comparative Administration and Management, Comparative Administration Research Series, No.1 (Kent. State University Press, Kent, Ohio, 1969).

~

19. "Membere as a Resource in Voluntary Organization," in Organization and Clients, W. Rosengren and M. :,ef ton, (eds.), Charles E. Merrill,1970, i 93-116.

20. " Departmental Power and Perspective in Industrial Firms," in Power in Organizations, edited by Mayer Zald (Vanderbilt University Press, i 1970), 59-89.

I

21. "The Short. and Clorious History of Organizational Theory,"

Organizational Dynacles, (Summer 1973), 2-16. (Reprinted)

'22. " Zoo Story or Life in the Orgen*zational Sandpit," Chapter in course text, People and Organ *zetiers, Open University (England), 1974.

, Revisien for 1930 editie-

23. "Is Business Really Changing?" Organizational Dynamics ( Sunnser ,

1974). (Reprinted) 24 "The Bureaucratic Paradox: The Efficient Organization Centralizes in Order- to Decentrali.ne," Organizational Dynamics, Spring, 1977, ap. 2-14. (Reprinted)

25. "Three Types of Organizational-Effectiveness," in Paul S. Goodman and Johannes M. .ennings, ed. New Perspectives- on Organizational

'Effe:tiveness, Jossey-Bass, 1977, pp.96-105. ,

26. "Insurge-tcy of the Powerless: Farm T'orker Movements , 1946-1972" (with Craig Je n'<.i n s ) , Ame ric i n Sociological Revie.1 42, (April, 1977),

pp. 249-53.

i 7 I Research Articles or Chapters (continued)

27. "Demystifying organizations" in Rosemary C. Sarri and Yeheskel Hasenfeld eds. The Management of Human Services, (New York: Columbia University Press, 1978).

29. "The Sixties Observed," in Mayer M. Zald and John D. McCarthy, eds.,

The Dynamics of social Movements,. Cambridge, Mass., Winthrop Publishers, 1979, pp. 192-211.

29. "The President's Commission and the Normal Accident," in David Sills, et al. (eds.) The' Accident at Three Mile Island: The Human Dimensions, Boulder, Colorado: The Westview Press, 1981.

30. " Disintegrating Social Sciences," New York University Education Quarterly, vol. 12, no. 2 (Winter , 19 8 '.) , pp. 2-9.

31. " Markets, Hierarchies and Hegem9ny: A Critique of Chandler ar.d Williamson," in Andrew van de ven and William Joyce, eds. Perspectiver on Organization Design and Behavior, New York: Wiley Interscienc'.',

198?.,371-366, 403-404.

32. "This Week's Citation Classic," Current contents, 14 (April 6, 1981), p. 14 (A reflection on item 15 " Framework . ..) "

33. " Normal Accident at Three Mile Island," Society, vol. 18, no. r.

(July /Augus t , IM1) , pp. 17-26.

9 9t