My friends Chris Clearfield and András Tilcsik literally wrote the book on complex failure and why it’s on the rise. Meltdown, their engaging, and at times terrifying, book explains the “shared DNA of nuclear accidents, Twitter disasters, oil spills, Wall Street failures, and even wrongdoing.” Like me, Chris and András were influenced by sociologist Charles Perrow, who identified risk factors that make certain kinds of systems vulnerable to breakdowns.

I turned to Perrow’s work to help me figure out the persistence of medical accidents. Perrow described a normal accident—a term intended to provoke—as a predictable (that is, normal) consequence of a system with interactive complexity and tight coupling. Interactive complexity means multiple parts interact in ways that make the consequences of actions difficult to predict. For instance, slightly altering his ship’s course put Captain Rugiati on a path where the sudden appearance of two lobster boats required a subsequent sudden and difficult-to-execute turn, culminating in a fatal accident. Tight coupling, a term borrowed from engineering, means that an action in one part of the system leads inexorably to a reaction in another part; it’s not possible to interrupt the chain of events.

For Perrow, calling an accident normal meant that certain systems function as accidents waiting to happen. Their design makes them dangerous. It is simply a matter of time before such systems fail. In contrast, a system with low interactive complexity and loose coupling—say, an elementary school—would not be prone to normal accidents. If a system had high complexity but lacked tight coupling (say, a large university with many academic departments that operate relatively independently), things could go wrong in one part without automatically triggering a major failure in the whole system.

The problem with Perrow’s idea that organizations could not safely function with interactive complexity and tight coupling was that so many such organizations did in fact function without mishap for years, even decades. Nuclear power plants operated without incident nearly all the time. So did air traffic control systems, nuclear aircraft carriers, and a host of other inherently risky operations. A small group of researchers led by Karlene Roberts at the University of California, Berkeley, set out to study how they did it. What they discovered was more behavioral than technical. The term high reliability organization, or HRO, captures the essence of the theory. HROs are reliably safe because of how they make everyone in them feel accountable to one another for practices that consistently catch and correct

deviations to prevent major harm. Vigilance is one word for it. But it’s more than that. To me the most interesting part of HRO research is the observation that rather than downplaying failure, people in HROs are obsessed with failure. My colleagues Karl Weick, Kathie Sutcliffe, and David Obstfeld wrote a seminal paper highlighting the culture of HROs as preoccupied with failure, reluctant to simplify, acutely sensitive to ongoing operations (quick to detect subtle unexpected changes), committed to resilience (catching and correcting error,

rather than expecting error-free operations), and valuing expertise over rank. In other words, HROs are weird places. Rather than holding back to see what the boss is thinking, people there don’t hesitate to speak up immediately. A frontline associate, to avert a crisis, can tell the CEO what to do. Failure is clearly seen as an ever-present risk that can nonetheless be consistently averted.

Flying Blind: The 737 MAX Tragedy and the Fall of Boeing by Peter Robinson (Penguin Business, 2021) is also an enthralling history of a massive accountability sink. I learned a huge amount from Gill Kernick’s Catastrophe and Systematic Change: Learning from Grenfell (London Publishing Partnership, 2021) about another case study in which interlocking systems combined to create a tragedy that couldn’t systematically be pinned on any single organisation, let alone an individual.