Aircraft Carrier Operations At Sea:

The Challenges of High Reliability Performance.

Final Report

Todd R. La Porte•00 Karlene Roberts0)Gene I. Rochlin

High Reliability Organization ProjectI University of California, Berkeley

15 July 1988

SAD-A 198 692 OCMENTATION PAGElb. RESTRICTIVE MARKINGS

2a. SECURITY CLASSIFICATION AUT Y AUG 0 8 1988 m 3 DISTRIBUTION/AVAILABILITY OF REPORTProved for public release; distribution2b. DECLASSIFICATION I DOWNGRA HEOULE unlimited

4. PERFORMING ORGANIZATION REPORT NUMBER(" .jif 5. MONITORING ORGANIZATION REPORT NUMBER(S)

IGS/OTP-1-88 ...

6a. NAME OF PERFORMING ORGANIZATION 6b. OFFICE SYMBOL 7a. NAME OF MONITORING ORGANIZATIONInst. of Govt. Studies (if applicable) Manpower, Personnel and Training ProgramUniversity of California Office of Naval Research (Code 222)

6c. ADDRESS (City, State, and ZIP Code) 7b. ADDRESS (City, State, and ZIP Code)University of California 800 North Quincy StreetUnierkeleyo Cali94720Berkeley, CA 94720 Arlington, VA 22217-5000

Sa. NAME OF FUNDING/SPONSORING 8b. OFFICE SYMBOL 9. PROCUREMENT INSTRUMENT IDENTIFICATION NUMBERORGANIZATION (if applicable)

N00014-86-K-03128c. ADDRESS (City, State, and ZIP Code) 10. SOURCE OF FUNDING NUMBERS

PROGRAM IPROJECT. ITASK IWORK UNITELEMENT NO, NO. NO.I .ACCESSION NO622334 RM33M20 I

I1. TITLE (Include Security Classfication)(U) Aircraft Carrier Operations At Sea: The Challenges of High Realiability

Performance12. PERSONAL AUTHOR(S)La Pol-rte, Todd R.; Roberts, Karlene. School of Buiness Adrmniqtrntinn. Roehlin: Pnp T_

13a. TYPE OF REPORT 13b. TIME COVERED 114. DATE OF REPORT (Year, Month, Day)' 15. PAGE COUNTFinal FROM 3-15-86 TO 1988/July/29 6816. SUPPLEMENTARY NOTATION

17. COSATI CODES 18. SUBJECT TERMS (Continue on reverse if necessary and identify by block number)FIELD I GROUP W B'-GROuP-- High Reliability Organizations; Aircraft Carriers Operation

v Technology and Organization; Organization Theory•i•D4%)\ 19. ABSTRACT (Contnue on reverse if necessary and identify by block number)

When organizations operate technologies that are beneficial, costly and hazardous, theyare pressed to achieve failure free operations. This is an extraordinary situation,one deemed Impossible in contemporary organization theoretic terms. This projectexamines one type of such organization - aircraft carrier operations at sea - that demonstraremarkable levels of operational reliability. The objective is to seek out the conditionsthat account for these very high levels, of operational perforrmairnce. This report includesthe conceptual perspective defining and focusing the researeh problem, a discussionof methodological processes, and a review of preliminary findings. An appendix includesan annotated bibliography of project papers. . )

20. DISTRIBUTION /AVAILABILITY OF ABSTRACT 21. ABSTRACT SECURITY CLASSIFICATION0"UNCLASSIFIED/JNLIMITED C9 SAME AS RPT. 0 DTIC USERS / co(U)

22a NAME OF RESPONSIBLE INDIVIDUAL 22b. TELEPHONE (Include Area Code) 722c. OFFICE SYMBOL'::-',z- Lester, James I (202) 696-4825 1 ONR Code 222

DO FORM 1473,84 MAR 83 APR edition may be used until exhausted. SECURITY CLASSIFICATION OF THIS PAGEAll other editions are obsolete.

Aircraft Carrier Operations At Sea:

The Challenges of High Reliability Performance.

Final Report

Todd R. La PorteKarlene RobertsGene I. Rochlin

High Reliability Organization ProjectUniversity of California, Berkeley

15 July 1988

This report was prepared under the Navy Manpower, Personnel,and Training R&D Program of the Office of Naval Researchunder Contract N00014-86-K-0312.

We wish to acknowledge the extraordinary welcome andcooperation of the officers and men of Carrier Group Three,USS Carl Vinson (CVN-70) and CVW-15, and USS Enterprise(CVN-65) and CVW-11 who have so ably oriented us to navalflight operations at sea. Without their interest andgenerosity this work would not have been possible. Of themany who participated, Capt. Thomas Mercer, CommandersRobert Williams, Robert Mantie, Rich Wolter and DavidWaggnor of Carl Vinson and Capt Robert Spane, CommandersMichael Samuels, George Root, Harry Hartsell, Tom White andA.J. Johnson of Enterprise were especially helpful.

88 S 106WI-mý 1-----ý2 .L-rwý-2ra.-tLl-p ý '!?I -21 --g-)l-.- q-_; w-ýp-I -- ý -ýý -

Table of Contents

1. Introduction and Overview

2. Concepts and Dimensions of the Research Problem.

3. Methodological Considerations

4. Findings[From "The Self-Designing High Reliability Organization:

Aircraft Carrier Flight Operations at Sea," Naval WarCollege Review, Autumn 1987.]

Appendix. Project Summary and Annotated Bibliography ofProject Papers.

CT)i

Acoesslon For

NTIS GRA&IDTT1 TARUnam~wointed fjJust If oati 0

By . ..

Distribution/Avallabillty Cod-ea9

. . ;Avmt i ar.jorItst Spboeal

-- _ -(r t .'~~' ~ -1

IiPart 1. Introduction and Overview.

When organizations operate technologies that arebeneficial, costly and hazardous, they are pressed to takeon goals of failure free operations. There is a class oforganizations that have accepted such goals and nearlyalways achieve them. This is an extraordinary situation,deemed impossible in contemporary organization theoreticterms. The research summarized here is part of a projectstudying the organizational patterns associated with veryhigh levels of operational reliability in three suchorganizations. One of them is aircraft carrier operationsat sea.

Our work with the Navy began informally summer of 1984with a meeting of representatives of Air Traffic Control,Federal Aviation Administration; Electric Operations,Pacific Gas and Electric Company. We met on-board USS CarlVinson, hosted by her Commanding Officer, Captain TomMercer, to explore some of the means and problems associatedwith attempting to achieve very high levels of reliabilityin complicated technological operations. It was anextraordinary meeting. Organizational representativesdiscussed something of the changes and problems theyencountered in seeking "failure free performance." Theyconveyed to each other and the academics there something ofthe complexity of the systems they led and the processesthey felt accounted, in part, for the very high levels ofoperational performance they effect. To our surprise thehint of common patterns emerged. Excitement rose and plansfor further exchanges were made.

Later, after a third meeting, Captain Mercer notedthat, "It's not enough to just talk about this. You(academics) have to come see for yourselves." This began aseries of informally arranged visits to USS Carl Vinson andthen to three weeks on board in far east. The University ofCalifornia, Berkeley, High Reliability Organization Projectwas off the ground. Subsequent work has been carried on inthe other organizations as well. (See a brief Projectsummary in the Appendix.]

After protracted discussion, ONR support was begun,March, 1986. The major portion of resources were spentthrough Dec. 1986. Very modest sums of ONR funds remained.Contract extensions, at no cost to the government, wereapproved through March, 1988. "his was tc assist incompleting the Navy portion outlined in the originalproposal (including work with USS Enterprise) which wasintended to cover 18 months of work. The necessaryadditional funds were provided by the NSF and the Universityof California, Berkeley. This report covers that portion of

3

research and writing carried on in supported by the Cfficeof Naval Research. Additional work, especially that basedon field work aboard USS Enterprise is reported elsewhere.(See annotated project papers in appendix.)

The rest of the report is organized as follows: Part 2is drawn from a conceptual paper defining and delimiting theresearch problem, Part 3 summarizes ths project's severalmethodological processes, and Part 4 re-prints an articlediscussing the ONR stage findings that appeared in the NavalWar College Review, Autumn, 1987. An appendix includes asummary of the overall three organization study and anannotated bibliography of project papers.

4

IIp!

Part 2. Dimensions of the Research Problem.

This section outlines the character of the researchproblem, identifies the underlying theories that inform it,and discusses several major aspects that have guided ourfield work. The section is an abridgement of HighReliability Organizations: The Research Challenge (T.R. LaPorte, K. Roberts, and G. I. Rochlin, 1987.) It is limitedto the Navy portion of the study; comparative aspects havebeen deleted. *

Introduction:

Many advanced technologies greatly increase theprospects for material and social benefit. They also carrythe potential for great biological, environmental, human,and social damage. Failures can be costly and hazardous.Both the prospects and the potential hazards increase astechnologies of great power are deployed, increasing theircapacity, organizational scale, and social complexity. Tosecure those benefits while controlling potential harm,industrial firms and governments -- as operators, promoters,and regulators -- impose conditions intended to make suchfailures rare. Nevertheless, for a number of such systems,the potential costs of operating failures rival the benefitsthey provide.

When technologies are rich enough in benefits towarrant development, yet must be operated reliably to avoidimposing unacceptable costs, the process is colored byefforts to proceed by trials without error, even at earlystages of development, lest the next error be the last"trial. If this is successful, and the technology becomeswidespread, operating organizations are expected to continuenearly failure-free organizational performance -- theavoidance altogether of certain classes of incidents oraccidents judged by overseers to result in absolutelyunacceptable consequences.* In effect, such organizationsattempt to operate so reliably that the risks of the hazardare radically reduced. Benefits, in effect, are conditioned

* Examples abound: the extraordinary problems ofoperating nuclear power plants; public wariness of theindustrialization of genetic engineering; demands that airS~traffic control be failure- free; insistence on accuracy in

identifyt ng dangerous drugs; alarm regarding the safety ofbridges and dams and the use of pesticides in agriculture;and, less dramatically, concerns that the distribution ofelectricity, on one hand, and computer based financial and3dministrative data, on the other, be quickly and veryaccurately effected over very large geographical regions.

5

on nearly failure-free operations. And demonstrating thathigh hazard, low risk operations can be realized over longperiods of time is often a requirement for Rblic support,government funding and regulatory approval.

Such a requirement is extraordinary. Achieving veryhigh levels of reliable individual or group performance evenfor short periods is difficult at best. Attempting tosustain such operations in large scale organizations facingthe contemporary pressures of increasing performancodemands, and technological complexity, poses verysubstantial managerial and intellectual challenges.

Systematic understanding of the dynamics and structureof "high reliability" organizations that successfully matchperformance with demand is quite limited. Repairing thissituation calls for improved understanding of the conditionsand costs associated with very high operational reliabilityin organizations that, in pursuing their primary missions,have also accepted the goal of always avoiding certainclasses of failures - and have almost always succeeded.***

** A note on terms: Hazard refers to the characteristicof a production technology such that if it failssignificantly, the damage to life and property can be veryconsiderable. Risk is taken in the engineering sense, i.e.,the magnitude of harmful consequences multiplied by theprobability of an event causing them. Error refers tomistakes or omission in procedure or operational decisionthat result in occurrences judged as undesirable andsometimes costly to remedy. Organizations continua'.lyexperience errors, those that result in consequences thatthreaten their viability in part or whole, result in a"system failure". A high hazard/low risk system would beone in which a dangerous technology is operated in such away as almost never to experience an operating failure ofgrievous consequence, i.e., to be nearly failure-free. (SeeW. W. Lowrance, Of Acceptable Risk: Science and theDetermination of Safety (Los Altos, CA.: Wm. Kaufmann, Inc.,1976), ch. 2, and C. Hohenemser, R. W. Kates and P. Slovic,"The Nature of Technological Risk," Science, 220 (22 April,1983), 378-384.

*** Organizational reliability is a condition in whichthe organization demonstrates continuously the capacity toprovide expected levels and quantity of services, withoutoff-setting failures of critical processes. Inorganizations that accept this challenge, four types ofreliability are involved. Each has distinctive operating,training and managerial implications.

6

Six central questions are prompted by these phenomenaand lay out their broader dimensions:

1. The Evolution of "High Reliability" Organizations.Organizations that exemplify successful highly reliableperformance do not emerge full blown into this state.What were the processes and circumstances that resultedin public and organizational consensus about failureavoidance? What was the pattern of external pressuresto attempt failure-free performance? Are theredistinctive patterns and/or political conditions whichfacilitate this consensus and prompt the allocation ofthe necessary resources to attempt the reduction ofoperational failures altogether?

2. Structural Patterns and the Management ofInterdependence. These organizations' centralday-to-day challenge is continuously to operatecomplex, demanding technologies without major failureswhile maintaining the capacity for meeting intermittentperiods of very high, peak production, e.g., peaktraffic/power demand loads, or maximum air operations.What patterns of formal organization structure andrules have developed in response to these requirementsunder conditions of constrained resources? Complextechnologies tend to increase the interdependencieswithin and among operating organizations. What are thepatterns of interdependencies associated with unitsrequiring reliability? What processes have emerged tocoordinate and manage them in meeting the demands ofreliability and potential peak pressures?

i) Reliability of Aggregate Supplv (of produce/rawmatrils: Assure continuous, unbroken flow ofproduction input.

ii) Reliability of (Physical) Infrastructure: Seekperfection in operation/physical integrity of parts,pieces and networks.

iii) Reliability of Signals: Seek to perfect accuracyand timeliness of communication signals.

iv) Reliability of Human Response (OperationalReliability): Seek to perfect performance of humanoperators.

All high reliable systems exhibit reliabilities ii -iv. Some also satisfy supply reliability themselves;most depend on other organizations for the productsused in operations.

7

3. Decision Dynamics in High Demand/High ReliabilityCgodii 2a. Top management seeks to commit theorganization to high levels of performance, whilesenior operating officials are committed to assuringsuperior reliability (and safety) in the face of oftenunexpected operating conditions. What decision makingand communication dynamics evolve in the processes ofday-to-day planning and operation when contingenciesare expected but their specifics are unpredictable?How are the operational constraints inevitably imposedby formal structure dealt with, especially inconfronting those activities from which unacceptablefailures may arise?

4. The "Oraanizational Culture" of High Reliability.Formal structure and rules (SOP's), or informaloperating rules, rarely provide guides for behaviorsufficient to account for the technical andcooperative skills or motivations necessary foreffective organizational performance. These "gaps"are filled variously in the development of anorganization's culture. In "hiqh reliability"organizations, the substance of this culture is likelyto be crucial for effective operations. What groupnorms are evident within and between units requiringreliability concerning relations with and obligationsto group members and to the organization as a whole?How are they created and maintained?

5. New Technologies' Promise: More or Less Than Expected.New, often computer-based, technologies are promoted inhigh reliability organizations as a solution to theproblems of expected demand and scarce resources.Where are such technologies now being considered, andfor what purposes? What experiences have organizationshad to date in incorporating technologies possessingdifferent operating properties into working groups?How have new technologies mixed with traditional,reliability trusted ones in day-to-day activities?How are organizational structure, culture andfunctions effected?

6. The Design of Consecyiential Organizational Systems.Improved answers to these questions are likely to shedconsiderable light on the conditions and costsassociated with a social dependence on bizardous,

consequential systems. What are the impiications ofthese answers for the design and management oftechnical systems and organizational processes in theinterests of moderating the costs and stress of "highreliability" operations? Is it possible to alter

8I_' ' A

technical design so that the social requirements ofattaining high reliability will be less surprising ordifficult to attain? Can technical systems be designed"in such a way that regulatory agencies faced with therequirement to oversee "high reliability" activitiesmay do so without encountering tasks of such difficultythat the regulation process itself is not called intoquestion due to the inability (perhaps impossibility)of reasonable overseeing efforts?

Addressing these questions requires: a conceptual basisfor defining the problem, including the theoreticalrequisites for high reliability operations; identifying thelimitatiois of current literature in addressing them; and anexplication of the central questions that should serve as abasis for intensive field observation, interviews and datacollection in units requiring high reliability....

[The larger project includes three organizations: theAir Traffic Control System, Federal Aviation Administration;the Electric Operations and Power Generation Departments,Pacific Gas and Electric Company (managers of northernCalifornia's electric power distribution grid;) and - theorganization of interest here - the U.S. Navy's CarrierGroup 3, and U.S.S. Enterprise (CVN 65) and U.S.S. CarlVinson (CVN 70,) its two nuclear aircraft carriers and theirrespective air wings, CVW-15 and 11. Each organization hasa particularly rigorous organizational setting that shouldbe taken into account in considering these questions.]

What the types of challenges do "high reliability"organizations confront? .... Each of these organizations islarge, and routinely engaged in managing often very intenseactivities, in which time sensitive decisions and decisiveactions are often crucial....

The Carrier Group involves up to ten ships, centered onan aircraft carrier manned by a crew of up to 3000,supporting an Air Wing of some 90 aircraft and another 2800men. During phases of high readiness (daily operations frommid-morning to mid-might), the Air Department may handle upto some 200 sorties per day/night, involving some 300 cyclesof aircraft preparation, positioning, launch, and arrestedlandings (often at about 55 sec. intervals). Over 600aircraft movements across portions of the deck are likelywith a "crunch rate," i.e., the number of times two aircraft"nick" each other," of about 1:7000 moves. At the sanetime, aircraft are re- fueled, serviced and ordinance loadedsometimes with engines still running. These periods of highperformance run continuously for up four weeks time withshort break for the duration of a 6-8 month deployment.

9

Pr 01 -u W 4.F.&......A.....IR *k 7

Another property of these organizations increases boththe difficulty of studying them and the theoretical value ofdoing so: each is embedded in a widely dispersed networklinking operating and coordinating units in a set oftightly-coupled, overlapping interdependent webs ofdirection, action and feedback. (The effects of failurespropagate quickly and often widely.) These organizations donot experience errors uniformly, nor are they everywhereequally tightly coupled. Rather they vary in ways thatallow theoretically interesting questions to be addressed:in the expected magnitude of failures' consequences, thedegree the functional interdependence among units requiringreliability, and the "tightness" of their technologicalsystems. ....

Failures on the aircraft carrier, are very critical.If any one of five activities fail significantly, the shipcan be disabled by fire or explosions, many men killed, veryvaluable equipment lost irretrievably and in the nuclearareas a major ecological and human catastrophe.

The degrees of interdependence among functional unitswithin these organizations [is also important.]2 .... On thecarrier there is intensive, often face-to-face, reciprocalinterdependence among those carrying out air operationsplanning and missions. A third [property] is alsoinstructive - the degree to which the operating technologyimpels, indeed, substitutes for coordinationrelationships.... (T]he units involved in air operationsaboard an aircraft carrier are (not so) technologicallytightly-coupled to each other. The technologies specific toindividual functions, e.g., catapult, arresting gear,landing signal operations, and foul weather radar, are eachas tightly coupled as for the ATC, but their necessarycoordination is not "hardwired" at all. This depends almostwholly on often continuous, face-to-face/phone-to-phonecontacts and negotiations among senior crewmen and officers.

Requisites for High Reliability Organizations

Strong challenges to public and/or corporate policiesarise when on-going or proposed programs require largescale, knowledge intensive organizations, and theconsequences of operational failures are very costly.Technological deployers and regulators strive: to improvepolicies in situations where trial and error learning is ofdiminished utility; to achieve nearly failure-freeoperations of large, complex public and industrialorganizations; and to design effective regulatory unitscharged with overseeing such operations. In effect,operational reliability rivals short-term efficiency as a

10

~i

Iidominant organizational value. The higher the perceivedhazard or costliness of failures, the more insistent thedemands for operational reliability. Nearly failure-freeoperaiions are difficult t3 achieve in any setting. Withintechnically complex, large scale organizations, thesechallenges are especially severe. Meeting them, orunderstanding the limits of such efforts, requires more thanskillful leadership and successful bureaucratic politics.Additional knowledge is necessary.

1

This requires a theoretical explication of theorganizational requisites for and limitations of attainingnearly failure-free operations in large scale organizations;and an improved empirical understanding of the technical,organizational and political conditions -- and theircosts--that satisfy these requisites.[3] What are thetheoretical properties and empirical conditions associatedJwith successfully attaining what appears on its face to be anearly impossible requirement?

I

Attaining nearly failure-free organizationaloperations, logically entails the satisfaction of at leastfive pairs of knowledge/behavioral conditions, each withmeasures to assure effective implementation.

1.K. Unambiguous, nearly complete casual knowledgeconcerning the necessary functioning of the technicaland organizational system in order to assure expectedoutcomes, both in the earlier stages of development andcertainly as the technology reaches operationalmaturity; and,

l.B. Nearly error-free performance from both personnel Iand machines, based on this knowledge, to ensure alevel of performance that maintains the consistentoperations of the system.

It is obviously not justified to assume that these twoconditions can be met without preparing for unexpecteddeviations within the system. Therefore:

2.K. Error regimes specifying the small deviations from joperational norms for both machines and operatingpersonnel behavior that signal the potential onset offailure for each critical component, under actualoperating conditions, rendered in quantitative terms;,and,

2.B. Detection vis-a-vis continuous erroridentification activities of people/units charged withalerting organizational leaders if critical componentsmalfunction or human perfcrmance flags. Deviations

1i

must be spotted, failure avoided and the sources oferror onset repaired or eliminated. 5

But detecting the early on-set of potential failures doesnot eliminate their eventuality. Therefore,

3.K. Improved knowledge of the character of failures'consequences, especially the potential for thepropagation of damage and dislocation through thesystem; and,

3B. "Error" (or failure) absorbing capabilities ingroups organized both to contain damage within theorganization, affecting only those closest to thebreakdown, 6 and to provide "redundant channels" ofoperation to insure that the system will continueperforming despite breakdown. 7

With "failure consequence absorbers" in place, societymight be assured of benign operations, particularlywhen failures are relatively limited and onlymoderately costly to remedy. But as the capacity ofthe technical/organizational enterprise to do both goodand ill rises, so does the urgency of systematicattention to the effects upon the surrounding region ofsignificant failures in the rare event they occur.

It is obvious that many organizations in modern society,may have failures of such severity that their consequencescannot be contained internally. There are also tworequisites for sensing the onset of and responding tofailures that spill outside of the organization parallel tothose just listed for internal operations.

4.K. Credible, exact knowledge of the effects of thetechnical operations upon the biological, environmentaland social world, necessary to establish a firm basisfor judging the full range of benefits and costs ofthese operations; and,

4.B. A continuous monitoring capability so that the

distribution of external effects may be detected as thetechnology spreads and "ages." This requires theinstitutionalization of expert groups holding theskills necessary to identify the changes in areasproximate to and caused by maalfunctions of thetechnical system.

For systems seen as potentially the cause of greatharm, it is unlikely that the public will be assured thatcontinuous failure-free performance will be forthcoming dueto efforts of the operators alone. Therefore, the finalrequisites:

12

5.K. Unambiguous "system error" specification regimescast in terms of those conditions tne public is seekingto enhance or avoid; and

5.B. Highly effective, continuously ready organizationsalert to the commission of "system errors" and preparedto take immediate steps to contain their consequences.

The logical knowledge requisites listed above have thering of an engineering view of the situation, i.e.,specifying the information necessary for "closing thesystem," then applying more technical solutions to areas ofuncertainty. The implicit "sociologic" is that human groupswill be able to operate the technical systems at the levelof reliability necessary to deliver their benefits. Wheneach knowledge requisite is paired with its behavioral mate,the magnitude of the demand becomes more apparent.

The requisites for seeking perfection in organizationalperformance would be very stringent for any technical ororganizational system. They are particularly rigorous fororganizations that have increased rapidly in size andinternal complexity, and which face considerable publicanxiety about the consequences of failures.

A growing number of organizations confront theseconditions. Some of them continue to achieve an enviablerecord of reliable performance. Now many are facingadditional changes - in technical design, organizationalscale and internal operations - that will substantiallyincrease the challenge. Yet the organizational andinstitutional means and social relations necessary torealize these requisites are scantily understood.

Limitations of Current Literature.

Organization theoretic and management literatures aresilent regarding such extraordinary requirements. 8 They areliteratures based almost exclusively on experience withorganizations, mainly in the private sector: 1) that are"loosely coupled" within and with their environments,(hence, the effects of operational failure rarely propagatemuch beyond the unit causing it;) 9 0) whose internaldynamics appear increasingly characterized by coalitionformation and "political behavior," where organizationalgoals and strategies are likely to be contested and wherecompromise, as well as more traditional analytical methods,play a major role in decision- taking; 1 0 3) whose decisionprocesses can be characterized as "incremental," trial and

13

IM %r

error, and sometimes as "organized anarchies," where groupswith problem solutions seek those with problems to solve;' 1

and 4) where failures of task technologies, though perhapscostly to replace, do not threaten the organization'sexistence or capacity to provide service.

Such organizations are, in a sense, "failure tolerant;"decision- making and policy improvements can be confidentlybased on incremental, trial and error procedures, where thevalue of the lessons learned from making an error is greaterthan its cost. And importantly, there is at least the tacitexpectation that if some actually fail badly - and dissolve- that the goods and services they provided would befurnished by competitors.

If organizational reliability is cast in terms ofimprovement in individual performance, some guidance can bederived from the literature. Increases in reliability ofperformance follows from: high levels of formalization withexplicit and specific definitions of rules and roles;cybernetic controls that provide feedback loops that conveytimely information on performance values to performers andto their supervisors; "stable sub-assemblies", i.e., unitscapable of retaining their form and performing theirfunctions without constant attention from superior units;strong organizational culture with shared cognitive andnormative beliefs and common commitments to goals and waysof working; great attention to personnel selection andtraining; and the greater the technical and environmentaluncertainties that more flexible the work system andorganizational buf.fers. 12 These properties andrelationships are posed with an implicit perspective ofperformance that is middling and needs improving somewhatrather than for nituations in which failure free performanceis stressed.

The Conceptual Challenge of High Reliability Organizations.

The organizations that interest us fall into an unusualcategory: they provide important public services whichinclude operating for periods of very high peak demands;failures of their task/production technology can becatastrophic; trial and error learning in some areas seems arisky business; and the costs of major failures appearpotentially much greater than the lessons learned from them.In organizations with these characteristics, what structuraland behavioral patterns have evolved that are associatedwith extraordinarily high levels of reliable performance andenable them to realize the demanding requisites of "nearlyfailure-free" management?

14

In addressing this question, we assume that thecharacter of the physical technologies serves strongly toshape a) the particular organizational forms, behaviors andeffort (in resources and information) necessary to operatethem, b) the character of the coordination and controldynamics, particularly in the face of expected butspecifically unpredictable heavy demands on operators, andc) the public and organizational insistence that failures beavoided altogether. This suggests that organizations arecomposed of a technical core, a managerial level thatcoordinates activities among technical units and betweenthem and an institutional level concerned mainly withanticipating, absorbing, and potentially shaping the demandsthrust upon the organization by elements in itsenvironment. 1 3 And we view high reliability organizationsas open, rational systems with considerable reenforcement tobehave like closed rational ones. At the work group level,we draw on conceptions of the dynamics of socio-technicalsystems, the rule making and following nature oforganizational behavior, organizational culture, and"negotiated order.",1 4

High reliability organizations, then, can becharacterized roughly as composed of three overlappingcommunities: operators, manager/coordinators, and seniorexecutives together attempting to maintain conditionsenabling 1) hazardous operations to be carried oncontinually at high levels of capacity, 2) safely with 3)the capability to adjust flexibly to peaked demands andsurprises from their external (institutional) environments.Thus, their main operating problems are twofold: to managecomplex, demanding technologies making sure to avoid majorfailures which could cripple, perhaps destroy, theorganization; and, at the same time, to maintain thecapacity for meeting intermittent, somewhat unpredictable,periods of very high peak production, e.g., ... maximum airoperations. A pervasive operating tension emanates from thepressures from top management to commit the organization tohigh levels of performance, and senior operating officials'insistence on investing in systems and processes whichenhance reliability (and safety) in the face of unexpectedoperating conditions. Each community shares much the samegoals, but their emphases are likely to differ as a functionof their "proximity" to the technical operations per se andthe scop4 and irreversibility of failures' consequences.

In returning to the central questions posed at theoutset of this Section, the challenge is to discover theeffects on the familiar patterns of complex, technicalorganizations occasioned by the perception that significantfailure in day-to-day operations could have potentially

15

catastrophic consequences. Four of the six sets ofquestions (sets 2-5) outlined above are taken up. Theyrequire attention before the evolutionary or designquestions can be addressed confidently.

Structural Patterns and the Management of Interdependence.

What patterns of formal structure and rules have developedin response to the requirements of very reliableperformance? This question would be reasonablystraightforward for the usual, failure-tolerantorganization. There is agreement on both the goals andmeans, the core technologies are well known. This is theclassical situation for bureaucratic, hierarchical structureand formal processes. 1 5 But these expectations tacitlyassume that errors in the production processes are notlikely to be large; trial and error learning can be theorder of the day.

In high reliability organizations, reliability-orientedallocation of responsibilities and control prc.:e.sses competewith production-oriented ones.**** What divisions ofresponsibility and distributions of formal authority emerge?To what degree is command responsibility vested mainly "atthe center" as contrasted to its distribution on the basisof critical function? Do leaders of the units requiringreliability, or seeking to assure it in other units, takeplaces formally in the "dominate coalition" of theorganization, as expected by the contingency theorists? 1 6

What are the formal relations between the technicallyskilled, reliability-oriented groups and leaders, usually inhigher status positions, charged with coordination andstrategic direction?

HY 1.1: As the severity of potential failure increases:the more likely the units directly involved will haveformal representatives in "ruling coalition;" the mostlikely centralized authority structures will be

**** We have not emphasized pressures due to demandsfor operating efficiency, a problem for most modernorganizations. Until recently, high reliabilityorganizations have operated with only a moderate concern forshort-term efficiency. Their social function has been soimportant that effectiveness and reliabilicy, even atsubstantial cost, that cost cutting measures have taken abackseat. The internal dynamics prompted by continuedresource constraints is an important topic for subsequentresearch.

16

moderated by formal and informal delegation of criticaloversight to the units directly involved; and the morelikely the implementation of harsh penalties for thoseformally responsible for the organization and thedirectly involved units. [P:I.B, 2.B]*****

Complex operating technologies tend to increase theinterdependencies within and among operatingorganizations. 1 7 In high reliability organizations,parallel, often redundant, sets of complex communication andcontrol technologies are also evident.' 8 Interdependenciesof control overlay those of production. Each type exertsvaried demands for watchfulness and interaction on operatorsand managers. What are the patterns of interdependenciesassociated with units requiring reliability, and whatprocesses have emerged to coordinate and manage them inmeeting the dual demands of reliability and peak loads?

HY 1.2: As the operating technologies become morefunctionally interdependent: the more fully formal andinformal mechanisms of communication and coordinationdevelop and overlay those of production; the moredense the channels of horizontal communication and themore frequent collegial authority processes; and themore likely the development of formal norms ofintervention in the production process from membershaving functional knowledge regardless of theirorganizational status. (P:2.B, 3.B]

An aircraft carrier and its air wing, for example, areeach highly interdependent operating units. For effectiveoperations, they must somehow mesh during periods of maximumreadiness, yet they are independent units during the timeswhen the ship is in home port. They must manage a kind oforganizational "quick connect and disconnect" - rapidlyintegrating some 2800 men and support machines for 90aircraft into an ongoing ship of 3000, then disconnect againfor training "on the beach," without incurring damage toeither group. And, during "at-sea" periods, reliableoperations require activities that assure rapid adjustmentto changes in tactical missions, aircraft status and seaconditions, and assure accuracy of communications and safetyinformation during the critical launch and recovery(landing) periods ...

Such organizations' formal structure is designed tofacilitate hierarchical direction and coordination; each has

***** Bracketed numbers, e.g., [P: l.B], the indicatesthe reliability requisite noted above to which thehypothesis is related.

17

developed formal structures of reliability assuring unitsand processes, as well. Due to the demands imposed bysophisticated technologies, it is likely that there will bepatterns of "horizontal, collegial" relationships of varyingintensity and formal intent among interdependent, highreliability units. These patterns of cross-cuttingauthority relationships can be described and compared, inpart, examining the degree to which they are formally orinformally designed and operated. 1 9

Decision Making in High Demand/High Reliability Conditions.

Research on decision-making in large organizations has beenrooted in some notion of technical rationality, the attemptto optimize some value, within the limits of human cognitivecapabilities and perceptual biases. 2 0 Studies of thereactions of decision-makers to contingencies, whereattaining optimality is problematic due to analyticcomplexity and uncertainty, reveal decision-makers as"satisfiers." 2 1 Incremental, trial and error learning isthe predominate, and recommended, behavior; strongdependence on comprehensive planning is criticized as astrategy leading to failures more grievous than the errorsresulting from pragmatic trials. Both these descriptions,and coping behaviors observed, involve accepting theconsequences of error and suboptimization and decisions ofonly moderate quality - the "best one can do." 2 2 Demandsfor reliability, the irreversibility of processes, the highcost of system failure, and the difficulty of decisions thatachieve failure-free results, pose analytical anddescriptive problems that strongly challenge the traditionalliterature. Much of it has only marginal relevance to theoperation of high reliability organizations.

When failures are fatal, knowledge of the system andits behavior is valued: the more complete the better.Comprehensive analysis is sought even if completeness isimpossible. What are the processes through which thetechnologies are exhaustively learned and that learningshared, corrected and expanded? What decision making andI communication dynamics characterize the processes ofday-to-day planning and operation when failures are verycostly, maximum performance may be required, andcontingencies are expected but their specifics areunpredictable? How are the constraints inevitably imposedby formal structure overcome, especially in confrontingthose activities from which unacceptable failures mayarise?2 3

HY 2.1: As the severity of potential failure increases:the more insistence on complete formalization of

18

decision rules related to technical apparatus; thegreater the pressure from hierarchies on subordinatesfor assurances of maximum performance without failure,and the greater the expressed need from managerialsubordinates for discretion in doing their work.[P:l.K, 1.B, 2.B]

As conditions became critical, communication anddecision making patterns are expected to cross formalchannels. 2 4 If they do, the extent of such informalrelations, and the degree of negotiations (almost continuousin the Navy case) between and across formal status levelsshould be chartered. Similarly, the structure ofinformation redundancy for purposes of maintainingindependent sources and for accuracy checks should beoutlined. 2 5

HY 2.2: Within a system of highly specific rules oftechnical operations and reporting relationships, asthe degree of uncertainty about external demandsincreases: ta more likely conflict will occurconcerning the degree to which such rules or reportingrelationships are inappropriately applied; the morelikely the sense of ambiguity and fear expressed byresponsible subordinates; and more likely responsiblesubordinates will act informally to compensate for whatthey perceive to be inappropriate or dangerous rules,procedures or directives from higher authority. [P:2.B,3.B]

In observations with the carrier, our team followed theconflicts that cascaded from the Carrier Group Commander, anAdmiral, through the ship's Captain, and his OperationOfficer and spread out to involve the Air Boss (tower), theAircraft (Deck) Handling Officer, the Operations Officers ofthe Air Wing, and three Squadrons when an order came at 8pmfor a 4am mission the next day. It was to carry out amission no one but the Admiral and his staff believed wasworth the disruption of prior plans and was expected togreatly increase the risk to pilots. Pressures mountedthrough the chain of command, increasing the stress on theoperating units. This was especially felt by the aircrafthandler, who believed attempting the mission as desiredwould put his people at even greater risk than usual.Several sharp encounters sessions occurred revealing apattern negotiation and interaction quite different from theapparent chain of command. The Admiral prevailed, linally,after a series of compromises were struck.

Tracking the networks of interdependence thatcharacterize these organizations provide clear reseatchoppor*unities. They also drive up the necessary research

19

effort. Decisions and acticns within these networks oftentrigger interactions that spread quickly through differentunits usually dispersed across the system. The mostinteresting evolutions - the patterns of reactions to thepotential onset of crises - happen with astonishing speed.To capture the dynamics requires the presence of a welltrained and experienced team coordinating their observationssimultaneously from different "locations."

The "Organizational Culture" of High Reliability.

These organizations present operators with substantialchallenges and very demanding circumstances. Successes andfailures are consequential. Individuals' involvement isseen as efficacious, if risks are met and overcome;foolhardy, if skills are wanting and working conditionsrisky. Full knowledge of the processes and high motivationto carry them out are requisites for reliability. Butformal structure and rules (SOP's), or informal operatingrules, rarely provide sufficient guides for behavior toaccount for all the technical and cooperative skills ormotivations necessary for effective performance. These"gaps" are filled variously in the development of anorganization's culture. 2 6

In "high reliability" organizations, the substance ofthis culture is likely to be crucial for effectiveoperation. What grotp norms are evident within and bstweenunits requiring reliability concerning relations with andobligations to group members and to the organization as awhole? This question is perhaps the most difficult and mostimportant of the several research areas. When one observesthe operators in these organizations for any length of time,one wonders why they would subject themselves to the rigorsand hazards inherent in these jobs and processes. Why theydo, the norms they come accept about their behavior, and theconditions which sustain them are important, and unknown.

HY 3.1: As the severity of potential failureincreases: the more likely formal and informal(on-the-job) training will intensify, and includepressures for new members to accept attitudes thatlegitimate self-sacrificing behavior and a sense ofpersonal responsibility for the welfare of the wholeworking eiroup. [P:l:B, 2.B, 3.B]

Top technical operators and upper-middle level managersstruggle to develop and maintain norms among their workersthat facilitate both ability for limited periods of maximumperformance and long term, highly reliable performance. Due

20

to the different operational demands of varioussub-organizations, we expect variations among the sub-groups. Successful "high reliability" organizations havesomehow been able to stimulate high commitment and intenseeffort from operators. Our initial work suggests thatmembers of high reliability groups develop a sense of trustin group members and take on an obligation of collectiveresponsibility for each other.

HY 3.2: As tensions between the requirements forstable technical operations and flexible responses tounexpected peaked demands and surprise increase (due inpart to perceived increases in the magnitude offailures' consequences,): organizational norms ofsubmission to rules AND to ignore them intensify; andinformal norms develop that specify what situationswarrant challenges to authority and moderate theapplication of sanctions in formalevaluation/inspection processes. [P:2.B, 3.B]

The Promise of New Technologies.

High reliability organizations ar'i the objects of efforts tointroduce new technologies, often computer-based. These arepromoted as a solution to the joint demands of increasedperformance, maintenance of safety and reliability, andcompetition for scarce resources. Faced with the prospectof budget reductions, or nearly constant budget levels, manyhigh reliability organizations are nevertheless pressured bymanagement to increase operational capacity and efficiency.Yet, the social environment remains az intolerant of majorfailures as before, holding the organization to an absolutestandard that effectively requires an increase in safetylevels per unit operation.

Under such circumstances, it is perhaps not surprisingthat the use of computer-assisted decision tachnologies in avariety of forms has been the subject of intense discussionin each of the organizations we are studying. .... T]hedevelopment of the U.S.S. Carl Vinson involved a variety ofon-board experimental computer systems designed to aid andaugment planning as well as operational functions. 2 7

Operators generally welcome the idea of beneficialchange. Many high reliability organizations are highlytechnical, and in the past they have themselves initiated agood deal of innovation. Yet, they remain wary of the newcomputer-aided technologies, particularly those that areintended supplement or supplant the human operator in anydimension rather than simply .iugmenting or facilitating the

21

flow and integration of information.

Selecting a variety of high reliability organizationswith a variety of circumstances in design, plan, andimplementation of new technologies enable us to ask avariety of questions about their effects. To what degree isa trend towards automating or replacing operators' judgmentsbeing considered? How and where is it being tried orimplemented? How are operators reacting, and how much inputdo they have to the process of innovation? What are theirexpectations of problems as well as benefits, and on whatexperience is this based?

HY 4.1: As the severity of potential failure increases:so does resistance to the replacement of a traditionaltechnology or technique by an advanced technologyunless, in the long term operation of the technology,greater reliability can be demonstrated in situationswhich are perceive to be associated with the earlyonset of operational failures. [P:1.B, 2.B)

This is another area where the interaction between theresearchers and operators produces far more than eithercould achieve separately. Operators often have no languageto describe their concerns. These are often based onperceived aspects of organizational design and complexitythat contribute critically to safety, yet have never beenformally described or analyzed. The research team has thelanguage, but only through the closest continual interactionwith operators in real-time conditions can the empirics ofeach situation be discerned.

Of particular interest are cases where new technologiesare mixed with traditional ones of proven reliability inactual day-to-day activities. 2 8 Experience shows thattechnologies said to offer increased flexibility oftenimpose instead new constraints to facilitate theiroperation. Technologies designed to reduce operatorworkload can instead increase demand for throughput, so thatoperator loads increase once again, while the margin forrecovery if the new technology should fail goes down. 2 9 Forordinary, failure-tolerant systems these are treated as"side-effects". For the systems the interest us, they arecrucial. What other surprises might lie in store for futurenew technologies? To what extent are operators aware ofand sensitive to the potential for surprise? What actions,if any, can they or the organization take to exert somecontrol?

HY 4B: The greater the supporting infrastructure andrelative increase in required operational knowledge

22

required to operate a technical innovation, the morelikely its implementation will require substantialworkgroup and organizational re-structuring, and, ifimplemented, the more likely the degradation of highreliability activities. (The time to recovery ofinitial reliable performance is indeterminant.)[P:l.K, 1.B, 2.K., 2.B, 3.K, 3.B]

Concluding Comments

Generalizing on the basis of both theoretic reflectionand a limited amount of empirical observation, "highreliability organizations" that pose the most interestingintellect,` And operational/policy challenges have thefollowing . racteristics: [Organizations demonstrating veryhigh levels if operational reliability are likely to hd\'ethe following characteristics:]

-- They have a strong, reasonably concrete sense of theirprimary missions, operational goals and the technical meansnecessary to accomplish them.

-- All operate quite powerful, knowledge intensivetechnologies with very few significant operational failures.These technical systems are well known; their mechanisms andprocesses can be nearly completely specified.

-- Their major production units, e.g., power station, ATCcenter, or naval vessel, are quite complex and linkedtogether, often in large, tightly coupled operatingnetworks, e.g., power grid, national system, or task force,that strongly effects levels of internal operating strainsand the capacity to adjust to surprise.

-- They manage activities for which external or internalconsequences of failure are perceived to be great. The rareoperational failure gravely threatens the organization'scapacity to operate, to deliver crucial services, and/orthreatens the lives of its members or those of the communityat large.

-- Recently, such organizations have seen their workloadsincrease while their resources bases have been in relativedecline; as a result, an additional level of sustainedstress has been added to the amount of stress operators areexpected to absorb in highly responsible time-urgent jobs,calling for maintaining absolute performance levels, in theface of increasing magnitude and complexity of the tasks.

-- Computers and other technical systems are used, often

23

extensively, but primarily as sources of information anddata -- inputs to human judgment. And recently suchorganizations have been pressed to turn to new computertechnologies in the hope of increasing their operationalcapacity without directly altering organizational size orstructure.

Somewhat more speculatively:

-- Organizational structures, authority relationships, anddecision- making dynamics appear to have evolved in commonpatterns: there is clear separation of operations fromsystem maintenance, substantial delegation of operatingauthority to subordinate units, and redundant informationsources to inform decision-making.

-- Despite the diversity of their tasks, operators in eachsystem have similar working environments, share similarresponsibilities, expectations, objectives, and goals, andshow similar manifestations of the stress of their jobs.

-- Their operating "cultures" are strongly failure averse.Internal dynamics and structures are predominantlyinfluenced by consistent efforts to eliminate certain typesof events, accidents or failures altogether.

24

ENDNOTES

1. We use "tightness" or "tight-coupling" in the samesense as, C. Perrow, Normal Accidents: Living withHigh-risk Technology, New York: Basic Books, 1984.,ch. 3. This term is used to characterize thephysical structural properties of the technologiesoperated by the organizations he studied thatexperienced "normal accidents," i.e., those thatcould/should be expected given the complexity andtightness of these technical systems. See alsoK.E. Weick, "Educational Organizations LooselyCoupled Systems," Admin. Science Quarterly, 21(March, 1976), 1-19;

2. J.D. Thompson, Organizations in Action, New York:McGraw- Hill, 1967, and the discussion in W.R.Scott, Organizations: Rational, Natural and OpenSystems, 2d ed. Englewood Cliffs, N.J.: Prentice-Hall, 1986, especially chs. 9 and 10.

3. For work that provides a conceptual pre-requisitea view of technology that forges a tighterintegration with concepts of organizationaldynamics and institutional change, see T.R. LaPorte, "Technology As Social Organization:Implications for Policy Analysis," Studies inPublic Organization, Institute of GovernmentalStudies, University of California, Berkeley, Jan.1984.

4. M. Landau, "On the Concept of Self-Correct.1 .ngOrganization," Public Administration Review, 33(Nov./Dec., 1973), 533-539.

5. D. Metlay, Error Correction in Bureaucracy, (Diss.University of California, Berkeley, 1978), Chs. 1and 9. See the revision and extension, TemptingFate, forthcoming, esp. ch. 1 and 9.

6. Cf. Perrow, op. cit., for his distinctionsI concerning different categories of the "victims" ofbreakdowns, i.e., those harmed as a consequence ofmajor accidents

7. M. Landau, "Redundancy, Rationality and the Problemof Duplication and Overlap," Public AdministrationReview, 39 (Nov./Dec., 1969), 346-358.

8. Landau's work on redundancy, ibid., comes closest,although he considers the question of reliableoutcomes in systems in which major internal

25

I

failures will not cripple them. Studies of"reliability" per me are typically productionoriented, focussing on the technical processesthat increase the reliability of products orcowponents within complex machines. Very littlehas been done on whole-system reliability, even inthe electric power industry where most reliabilitywork concerns the estimation of power demand sothat enough "reserve margin" in producing capacitywill be available to meet all consumer needs.

9. Weick, op.cit. and J. Meyer and B. Rowan,"Institutionalized Organizations: Formal Structureas Myth and Ceremony," American Journal ofSociology, 83 (Serit., 1977), 261-82.

10. S.B. Bacharach and E.J. Lawler, Power and Politicsin organizations, San Francisco: Jossey-Bass, 1980;J. Pfeffer, Power in Organizations, Boston Pitnam,1981; and D. Yates, The Politics of Management, SanFrancisco Jossey-Bass, 1985.

11. C.E. Lindbloom, The Intelligence of Dcm,.cracy, NewYork: Free Press, 1965; and "Still Muddlir,-, NotYet Through," Public Admin. Review, 39 Nov./Dec.),517-526; R.M. Cyert and J.G. March. A BehavioralTheory of the Firm, Englewood Cliffs, N.J.Prentice-Hall, 1963; M.D. Cohen, J.G. Mar-rh andJ.P. Olsen, "A Garbage Can Model of Orga.r41zationalChoice," Admin. Science Quarterly, 17 (March,1972), 1- 25; and J.G. March and J.P. Olsen, eds.Ambiguity and Choice in Organizations, Bergen,Norway: Universutetsforlaget, 1976.

12. W.R. Scott, Report to the High ReliabilityOrganization Project, (Stanford University, Aug.1987.)

13. Thompson, Organizations in Action, op. cit.

14. Scott, Organizations: Natural..., op.cit.; and T.E. Burns, The Shaping of Social Organization:Social Rules, Systems Theory with Applications.London: Sage Publications, 1987.

15. J.D. Thompson and A. Tuden, "Strategies,Structures, and Processes of OrganizationalDecision," in Comparative Studies in Organization,J.D.Thompson, et al, eds. Univ. of Pittsburgh,1959; and J.D. Thompson, Organizationsop.cit.

26

16. J.D. Thompson, op.cit.; P.R. Lawrence and J.W.Lorsch, Organization and Environment: ManagingDifferentiation and Integration, Boston: GraduateSchool of Business Administration, Harvard Univ.,1967; and J. Galbraith, Designing ComplexOrganizations, Reading, Mass: Addison-Wesley, 1973.

17. See especially, W.R. Scott, op.cit., chs. 9 and 10for a good summary of a disparate literatureaddressing this question.

18. See A.W. Lerner, "There Is More Than One Way To BeRedundant: A Comparison of Alternatives for theDesign and Use of Redundancy in Organizations,"Administration and Society, 18 (Nov., 1986),334-359.

19. ... This work draws from developments in social andcommunication network research. See H.E. Aldrichand D.A. Whetten, "Organization-Sets, Action-Sets,and Networks: Making the Most of Simplicity," in P.Nystrom and W. Starbuck, eds., Handbook ofOrganizational Design, Vol.1. New York: OxfordUniv. Press, 1981; J. A. Barnes, Social Networks,Reading, Mass: Addison-Wesley, 1972; R.S. Burt,"Models of Network Structure," Annual Rev. ofSociology, 1988, 6,79-141, and J.R. Lincoln,"Intra-(and Inter-) Organizational Networks," S. B.Bacharach, ed., Research in the Sociology ofOrganization, vol.1.' Greenwich, CT: JAI Press,1982, 1-38; and N. Tichy, M.L. Tushman and C.Fombron, "Social Network Analysis forOrganizations," Academy of Management Review, 4(Oct.,1979), 507-519.

20. H. Simon, Administrative Behavior, 2nd ed. NewYork: MacMillian, 1957.

21. H. Simon, op.cit.; J.G. March and H. Simon,Organizations, New York: John Wiley, 1958. Seealso J. Steinbrunner, Cybernetic Theory ofDecision-Making, Princeton, N.J.: Princeton Univ.,Pross, 1978.

22. Lindbloom, op.cit.

23. H. Wilensky, Organizational Intelligence, New York:Basic Books, 1967

24. C.A. O'Reilly and K.H. Roberts, "Task GroupStructure, Communication and Effectiveness in ThreeOrganizations," Journal of Applied Psychology, 62

27

(1977), 676-681; and R. Blair, K.H. Roberts, and P.McKechnie, "Vertical and Network Communication inOrganization: The present and the Future," in P.Thompkins and R. McPhee, eds., OrganizationCommunication: Traditional Themes and NewDirections, Beverly Hills, CA: Sage, in press.

25. ... See K.H. Roberts and C.A. O'Reilly,"Organizations as Communication Structures: AnEmpirical Approach," Human Communication Research,4 (Oct.,1978), 283-293.

26. L. Smircich, "Concepts of Culture andOrganizational Analysis," Admin. Science Quarterly,28 (Sept., 1983), 339-358, and "Is the Concept ofCulture a Paradigm for Understanding Organizationsand Ourselves?" in P.J. Frost, et al, eds.,Organizational Culture, Beverly Hills, CA.: Sage,1985; M.R. Lous, "Organizations as Culture- bearingMilieux," in L.. Pondy, et al eds., OrganizationalSymbolism, Greenwich, CT: JAI Press, 1983; and J.P.Spradley, Culture and Cognition: Rules, Maps andPlans, San Francisco: Chandler, 1972.

27. USS Carl Vinson was, for a time, a virtual testbedfor new computer systems and applications, some ofwhich are discussed in detail in G.I. Rochlin,"Command and Control" and other papers in theforthcoming volume from the Conference on StrategicComputing, U.C. Santa Cruz, March 1985. Thenow-defunct ZOG system is repeatedly cited inpopular texts on artificial intelligence asFeigenbaum and McCorduck's The Fifth Generation,New York: Signet, 1983, as one of the successes ofexpert systems.

28. See R.W. Bailey, Human Performance Engineering,Englewood Cliffs, NJ: Prentice-Hall, 1982, for andiscussion of the effects of parallel rather thansequential modes of introduction.

29. See, for example, W.M. Hoffman and J.M. Moore,eds., Ethics and the Management of ComputerTechnology, Cambridge MA: Oelgeschlager, Gunn &Hain, 1982. Traditional analyses are dominated byworker-oriented issues such as "de-skilling", jobdisplacement, and occupational morale, and, in somecases, on the resulting impact on the firm. Sincethe organization in question is almost alwaysfailure-tolerant and profit-oriented, morewidespread social effects and impacts are rarelytaken into consideration.

28

I

Part 3. Methodological Considerations.

The high reliability organizations in this project areextraordinarily complex, tightly coupled systems. Theyoperate technical systems that require continual attentionlest they malfunction and result in grievous consequences.They prompt public concern, sometimes media watchfulness,and occasionally fears for the national security. And thereare no earlier studies of these types of organizations, nostudy guidelines nor tested data collection instruments.These conditions suggest both considerable potential foradvance and substantial pressures on researchers both insorting out the research problem and in carrying outin-depth research.

The modern aircraft carrier battle group (BG) extremeexpression of this combination. There is no prior work onthe internal dynamics of carriers engaged in flightoperations at sea; none on the relations between elements onthe ship or within the Group. Due to the sensitive natureof BG operations, the highly classified status of some theweapon systems, and the demanding nature of the nuclearpropulsion plants, there is a deep seated reserve aboutallowing non- Navy people on board for extended periods oftime. Finally, the intensive nature of organizationalinteractions, particularly during fully developed flightoperation, present phenomena that overwhelm the naiveobserver with "buzzing confusion." This is a situation inwhich the researcher could become "part of the problem" ifhazardous conditions arise. Yet these times are likely tobe the most instructive in revealing the patterns ofrelations that enable such organizations to respondeffectively to the onset of potential failures.

The methodological challenge, then, is at least twofold: initially, to gain access and the trust oforganizational members, and then, to employ data collectingregimes appropriate to the stage of theoretical developmentand the constraints of the operating situation.

Access and establishing legitimacy within theorganization is addressed is an early project paper,"Research in Nearly Failure Free, High Reliabilityorganizations:...' 1 it outlines some of the conditionthat researchers should meet in order to do such researchand discusses something of the project teams perspectiveregarding our relationship with ship and air wing members.Suffice, here, to say that a central Aethodological premiseis that operators/managers in complex technological systemshave a deep intuitive sense of what they are doing, thoughthey may be unable to describe precisely how they do it, andare sometimes unaware of the relational activities they

29

carry out. Researchers are skilled in description, butnaive about how these organizations are run. The result isa research strategy in which the researchers andoperator/managers work together to clarify hypotheses abouthow nearly failure free operations are carried out. Therest of this section reviews the means used to collect data.

Within the conceptual perspective on the requisites forhigh reliability organizations outlined above, three mainsubstantive themes framed our data collecting requirements:patterns of organizational structure and interdependence,decision-making dynamics andauthority relations, andprofiles of organizational culture. The fourth substantivearea - the effects of technological change - drew fromaspects of each of these.

Organizational Structure and Interdependence. Threesources of research information were important. Documentswere reviewed for the formal picture, to furnish evidence ofperformance levels, and as a basis for discovering what islearned informally. Most necessary were intensive, on-siteobservation and interviews with people occupying importantcoordinating (and reliability related) roles (see decision-making questions.) A self-administered survey instrumentswas alsu used with the first ship and air wing in describingthe perceived patterns of dependence and interdependence.Operational difficulties and the discovery of an instrumentproblem limited us that case.

Decision-making dynamics and authority relations. Themost intensive part of the field research, our primaryresearch tools were interviews and observations. Operationsthat must be failure free are identified. After a period offamiliarization with them and the overall functions of theorganization, questions were developed to uncover decisionstrategies used in these operations. These interview weresupplemaented by self-administered questionnaires that inviterespondents to indicate those to whom communications aresent and from whom they are received. 2 Initially,typifications of routine decisions under normal operationswere made along with the network of people within the unitand across the organization that are likely to be involved.At the same time, circumstances which prompt high levels ofstress were outlined.

On-site, at sea observations of operators/managers werecarr 4ed out during portions of four increasingly complexoperational phases of ship and air wing training. Thesewere focussed on various critical functions to verify theexpected relationships and unexpected surprising ones. Withadditional resources from University of California,Berkeley, and the National Science Foundation made it

30

possible to spent considerable time on each ship. Thisenabled the team to be present when operational conditionsbrought on the stress of incipient failure. This revealedthe underlying operational norms and patterns of authorityin a ways often muted in normal tempo operations.

In all, the research team spend approximately thirty(30) working person weeks at sea with the two ships and airwings and numerous in- port and air station visits andinterviewing periods. Over 150 interviews were conductedwith 100 different ships's company and air wing personnelduring and after working hours on each ship. Some 20 shorebased support and command personnel were interviewed aswell.

Organizational Culture. An important research task wasto discover the profiles of an organization's cultures ofreliability and what sustains them. Survey of elements ofship's company and five air wing squadrons were administeredtool the Organizational Culture Inventory. This instrumentof 120 items (compressed into 12 scales) seeks the degreevarious attitudes are important in order to "fit into one'swork group." It treats culture as: "[A] set of cognitionsshared by members of a social unit... which are acquiredthrough social learning and socialization processes exposingindividuals to a variety of culture-bearing elements. Thesecognitions are acquired through social learning andsocialization processes exposing individuals to a variety ofculture-bearing elements.... In organizations, [these]patterns of activities and interactions members observe andcarry out (e.g., decision making, communicating) constitutemajor elements of the organization's structure, makingstructure itself an important culture-bearing mechanism inorganizations."' 3

Survey of those units in which high reliability isessential were sampled (from 50 to 80 percent of theirmembers) at a time when each ship and air wing was in a peakstate of readiness. Total returns neared 95 percent of the1750 questionnaires administered. Preliminary analyses havebeen completed on the data from USS Carl Vinson (CVN-70) andAir Wing 15.

31

I

Endnotes. Section 3.

1. K.H. Roberts and D. M Rousseau, "Research in NearlyFailure Free, High Reliability Organizations:Having the Bubble,"

2. See K.H. Roberts and C.A. O'Reilly, "Organizationsas Communication Structures: An EmpiricalApproach," Human Communication Research, 4(Oct.,1978), 283-293.

3. R. A. Cooke and D. M. Rousseau, "The OrganizationalCulture Inventory: A Quantitative Assessment ofCulture," Working Paper, School of BusinessAdministration, Northwestern University, 1984. Oneof the few scales of its kind, the instrument is inthe final stages of psychometric development. Ithas been used in over fifty organizations,including some Air Traffic Control Centers, FederalExpress, and numerous "failure tolerant"organizations.

32

The Self-Designing High-Reliability Organization:Aircraft Carrier Flight Operations at Sea

Gene I. Rochlin, Todd R. La Porte, and Karlene H. RobertsUniversity of California, Berkeley

July 28, 1988

"A modern ship of war is one of the most complicatedmachines in existence. It is filled with machinery ofvarious sorts from one end to the other. The finished ship,ready for service is of great cost and enormous value to thegovernment. It is worth nothing unless efficiently handled,cared for, and kept in readiness for immediate service."

Annual Report of the Secretary of the Navy, 1899

"The job of this ship is to shoot the airplanes off thepointy end and catch them back on the blunt end. The restis detail."

Carrier CO

"So you want to undeirstand an aircraft carrier? Well, justimagine that it's a busy day, and you shrink San FranciscoAirport to only one short runway and one ramp and gate.Make planes take off and land at the same time, at half thepresent time interval, rock the runway from side to side,and require that everyone who leaves in the morning returnsthat same day. Make sure the equipment is so close to theedge of the envelope that it's fragile. Then turn off theradar to avoid detection, impose strict controls on radios,fuel the aircraft in place with their engines running, putan enemy in the air, and scatter live bombs and rocketsaround. Now wet the whole thing down with salt water andoil, and man it with 20-year old's, half of whom have neverseen an airplane close-up. Oh, and by the way, try not tokill anyone."

Senior Officer, Air Division

"How does it work? On paper, it can't, and it don't. Soyou try it. After a while, you figure out how to do itright and keep doing it that way. Then we just get outthere and train tha guys to make it work. The ones that getit we make PO's. The rest just slog through their time."

Flight Deck Chief

"See that kid? He's only 19 and my best driver. Every dayhe picks up 40 million dollar, 40,000 lb. airplanes with anunderpowered, under-tractioned tractor and pushes them into

33

places you'd swear they never fit. He'd be a great parkinglot attendant back home. 'Course he'd have to get adriver's license first."

Hangar Deck Chief

"If you take all the parts of an F-14 and multiply them bytheir failure probability, there is no chance you'd ever getone up. We do it with mirrors."

Maintenance Chief

"Here I'm responsible for the lives of my gang. In civilianlife, I'm the kind of guy you wouldn't like to meet on adark street."

Deck Petty Officer

"The flight deck terrifies me. I never feel safe until I'mbuckled in and the canopy's down."

Attack Pilot

"As soon as you learn 90% of your job, it's time to move on.That's the Navy Way."

Junior Officer

"A hundred things I have no control over could go wrong andwreck my career ... but wherever I go from here, I'll neverhave a better job than this. ... This is the best job in theworld."

Carrier CO

Recent studies of large, formal organizations thatperform complex, inherently hazardous, and highly technicaltasks under conditions of tight coupling and severe timepressure have generally concluded that most will failspectacularly at some point, with attendant human and socialcosts of great severity. 1 The notion that atccidents inthece systems are "normal", that is, to be expected giventhe conditions and risks of operation, appears to be as wellgrounded in experience as in theory. 2 Yet, there are asmall group of organizations in American society that appearto succeed under similar circumstances, performing daily anumber of highly complex technical tasks for which theycannot afford to "fail." We are currently studying threeunusually salient examples whose devotion to a zero rate oferror is almost matched by their performance -- utility gridmanagement (Pacific Gas & Electric Company), air trafficcontrol, and flight operations aboard U.S. Navy aircraftcarriers.

Of all activities studied by our research group, flight

34

operations at sea is the closest to the "edge of theenvelope" -- operating under the most extreme conditions inthe least stable environment, and with the greatest tensionbetween preserving safety and reliability and attainingmaximum operational efficiency. 3 Both electrical utilitiesand air traffic control emphasize the importance of longtraining, careful selection, task and team stability, andcumulative experience. Yet, the Navy demonstrably performsvery well with a young and largely inexperienced crew, witha "management" staff of officers that turns over half itscomplement each year, and in a working environment that mustrel-uild itself from scratch approximately every 18 months.Such performance strongly challenges our theoretical under-standing of the Navy as an organization, its training andoperational processes, and the problem of high-reliabilityorganizations generally.

It will come as no surprise to this audience that theNavy has certain traditional ways of doing things thattranscend specifics of missions, ships, or technology. Muchof what we have to report interprets that which is "known"to Naval carrier personnel, yet seldom articulated oranalyzed. 4 We have been struck by the degree to which a setof highly unusual formal and informal rules andrelationships are "taken for granted", implicitly andalmost unconsciously incorporated into the organizationalstructure of the operational Navy.

Only those who have been privileged to participate inhigh-tempo flight operations aboard a modern aircraftcarrier at sea can appreciate the complexity, strain, andinherent hazard that underlie seemingly routine day-to-dayoperations. That naval personnel come to take the situationas more or less routine is yet another example of howadaptable people are to even the most difficult andstressful of circumstances.

Although we have now spent considerable time aboardseveral aircraft carriers in-port and at sea, our team ofnon-Navy academics retains a certain distance that allows usto recognize and report on the astonishing and uniqueorganizational structure and performance of carrier flightoperations. 5 We do not presume that our limited exposure toa few aspects of operations has given us a comprehensiveoverview. Nevertheless, we have already been able toidentify a set of causal factors that we believe are ofcentral importance to understanding how such organization3operate.

In an era of constant budgetary pressure, the Navyshares with other organizations the need to defend thosefactors most critical to maintaining performance without at

35

the same time sacrificing either operational reliability orsafety. Following many conversations with Naval personnelof all ranks, we are convinced that the rules and proceduresthat make up those factors are reasonably well-knowninternally, but are written down only in part, and generallynot expressed in a form that can be readily conveyed outsidethe confines of the Navy.

The purpose of this note is to report some of our morerelevant findings and observations to the Navy communitythat has been such a gracious host, to describe airoperations through the eyes of informed, yet detachedobservers, and to use our preliminary findings to reflectupon why carriers work as well as they do.

Self-Design and Self-Replication

Aircraft carrier flight operations as we know themtoday are as much a product of their history and continuityof operation as of their design. The complexity ofoperations aboard a large, modern carrier flying the latestaircraft is so great that no one, on or off the ship, canknow the content and sequence of every task needed to makesure the aircraft fly safely, reliably, and on schedule. Aswith many organizations of similar size and complexity,tasks are broken down internally into smaller and morehomogeneous units as well as task-oriented work groups. 6 Inthe case of the Navy, the decomposition rules are often ad-hoc and circumstantial: some tasks are organized bytechnical function (Navigation, Weapons), some by unit(Squadron), some by activity (Handler, Tower), and some bymission (Combat, Strike). Men may belong to and beevaluated by one unit (e.g., one of the squadrons), yet beassigned to another (e.g., aircraft maintenance).

In order to keep this network alive and coordinated, itmust be kept connected and integrated horizontally (e.g.,across squadrons), vertically (from maintenance and fuel upthrough operations), and across command structures (BattleGroup - Ship - AirWing). As in all large organizations,the responsible officer or chief has to know what to do ineach case, how to get it done, who to report to and why, andhow to coordinate with all units upon which he depends orwho depend upon him. This is complicated in the Navy caseby the requirement for many personnel, particularly the moresenior officers, to interact on a regular basis with thosefrom several separate orgmnizational hierarchies. Each hasseveral different roles to play depending upon which of thestructures is in effect at any given time. 7

Furthermore, these organizaticnal structures also shift

in time to adapt to varying circumstances. The evolution of

36

the separate units (e.g., ships, air wing, commandstructures), and their integration during work-up into afully-coordinated operational team, for example, has fewcounterparts in civilian organizations. 8 And there is nocivilian counterpart to the requirement to adapt to rapidshifts in role and authority during deployment in responseto changing tactical circumstances.

No armchair designer, even one with extensive carrierservice, could sit down and lay out all the relationshipsand interdependencies, let alone the criticality and timesequence of all the individual tasks. Both tasks andcoordination have evolved through the incrementalaccumulation of experience to the point where there probablyis no single person in the Navy who is familiar with themall. 9 Rather than going back to the Langle, consider, forthe moment, the year 1946, when the fleet retained the bestand newest of its remaining carriers, and had machines andcrews finely tuned for the use of propeller driven, gasolinefueled, Mach 0.5 aircraft on a straight deck.

Over the next few years, the straight flight deck wasto be replaced with the angle deck, requiring a complete re-learning of the procedures for launch and recovery, and for"spotting" aircraft on and below the deck. Theintroduction of jet aircraft required another set of newprocedures for launch, recovery, and spotting, and formaintenance, safety, handling, engine storage and support,aircraft servicing, and fueling. The introduction of theFresnel lens landing system and air traffic control radarput the approach and landing under centralized, positive on-board control. Anc, as the years went by, thelaunch/approach speed, weight, capability and complexity ofthe aircraft increased steadily, as did the capability andcomplexity of electronics of all kinds. There were no bookson the integration of this new "hardware" into existingroutines, and no other place to practice it but at sea; itwas all learned on the job. Moreover, little of the processwas written down, so that the ship in operation is the onlyreliable "manual".

For a variety of reasons, no two aircraft carriers,even of the same class, are quite alike. Even if nominallythe same, as are the recent Nimit class ships, each differsslightly in equipment, and develops a unique personalityduring its shake-down and first work-up and deployment.While it is true that each ship in made up of the same rangeof more or less standardized tasks at the micro-level, thequestion of how to do the job right involves anunderstanding of structure in which the job is embedded,and that is neither standardized across ships nor. in fact,written dbwn systematically and formally anywhere. If they

37

left the yards physically different, even such apparentlysimple matters as spotting aircraft properly on the deck hasto be learned through a process of trial and error. 1 1

What is more, even the same formal assignment will varyaccording to time and place. Carriers differ; missionsdiffer; requirements differ from Atlantic to Pacific, andfrom fleet to fleet; ships have different histories andtraditions, and different equipment; COs and Admirals retainthe discretion to run their ships and groups in differentways and to emphasize different aspects. Increasedstandardization of carriers, aircraft loadings, missions,tasks, and organizational structure would be difficult toobtain, and perhaps not wise. 1 2 There is a great deal tolearn in the Navy, and much of it is only available on thespot.

Shore-based school training for officers and crewprovides only basic instruction. 3 It includes a great dealabout what needs to be done and the formal rules for doingit, but this only provides generalized guidelines and astandardized framework to smooth the transition to the realjob of performing the same tasks on board as part of acomplex system. NATOPS and other written guidelinesrepresent the book of historical errors -- they provideboundaries to prevent certain actions known to have adverseoutcomes, but little guidance as to how to promote optimalones.

Operations manuals are full of detail of specific tasksat the micro-level, but rarely discuss integration into thewhole. There are other written rules or procedures, fromtraining manuals through SOPs, that describe and standardizethe process of integration. None of them explain how tomake the whole system operate smoothly, let alone at thelevel of performance that we have observed. 1 4 It is in thereal-world environment of work-ups and deployment, throughthe continual training and re-training of officers and crew,that the information needed for safe and efficientoperation is developed, transmitted, and maintained.Without that continuity, and without sufficient operationaltime at sea, both effectiveness and safety would suffer.

Moreover, the organization is not stable over time.Every 40 months or so there is an almost 100% turnover ofthe crew, and all of the officers will have rotated throughand gone on to other duty. Yet, the ship remains functionalat a high level. The Navy itself is of course theunderlying structural determinant. Uniforms, rank, rulesand regulations, codes of conduct, and specializedlanguages provide a world of extensive codification ofobjects, events, situations, and appropriate conduct;

38

members who deviate too far from the norm become"foreigners" within their own culture, and soon firdthemselves outside the group figuratively, if notliterally. 1 5

Behavioral and cultural norms, SOPs, and regulationsare necessary, but they are far from sufficient to preserveoperational structure and the character of the service. Wehave noted three mechanisms that act to maintain andtransmit operational factors in the face of rapid turnover.First, and in some ways most important, is the pool ofsenior chiefs, many of whom have long service in theirspecialty, and circulate around similar ships in thefleet. 1 6 Second, many of the officers and some of the crewwill have at some time served on other carriers, albeit inother jobs, and bring to the ship some of the sharedexperience of the entire force. Third, the process ofcontinual rotation and replacement, even while ondeployment, maintains a continuity that is broken onlyduring a major refit. These mechanisms are realized by acontinuous process of on-board training and re-training thatmakes the ship one huge and continuous school for its ownofficers and men.

When operational continuity is broken or non-existent,the effects are observable and dramatic. One of us has hadthe opportunity to observe a new Nimitz class aircraftcarrier as she emerged from the yard, and has remarked athow many things had to be learned before she could evenbegin to commence serious air operations. 1 7 Even for anolder and more experienced ship coming out of an ordinaryrefit, the work-up towards deployment is a long and arduousprocess. Many operational weeks are spent just qualifyingthe deck for taking and handling individual aircraft, andmany more at gradually increasing densities to perfectaircraft handling as well as the coordination needed fortight launch and recovery sequences. With safety andreliability as fixed boundary conditions, every moment ofprecious operational time before deployment is devoted toimproving capability and efficiency.

The importance of adequate work-up time, if flightoperations are to be conducted safely at present levels oftechnical and operational complexity at the tempo requiredfor demonstrating effectiveness, can not be over-emphasized. During our research, we followed one carrierthrough a work-up shortened by "only" two weeks for reasonsof economy. As a result, the ship was forced to completeits training during the middle of a difficult and demandingmid-ocean exercise, with resulting enormous and visiblestrain on all hands. Although she succeeded, and althoughreferees were willing to adapt evaluation procedures a bit

39

to compensate, risks to ship's personnel, to the equipment,and to the Navy were visibly higher. Moreover, officersand crew were openly unhappy with their own performance,with an attendant and continuing impact on morale.18

The Paradox of High Turnover

Because of the high turnover rate, a U.S. aircraftcarrier will begin its workup with a large percentage of newhands in the crew, ard with a high proportion of officersnew to the ship. The U.S. Navy's historical tradition oftraining generalist officers (which distinguishes it fromall other military services) assures that many of them willalso be new to their spenific jobs. Furthermore, tours ofduty are not coordinated with ship sailing schedules, sothat the continual replacement of experienced with greenpersonnel, in critical as well as routine jobs, continueseven during periods of actual deployment.

Continual rotation creates the potential for confusionand uncertainty even in relatively standardized militaryorganizations. Lewis Sorley has characterized the effectsof constant turnover in other military systems as"turbulence", and identified it as prime source of loss ofunit cohesion. 1 9 A student of Army institutional practiceshas remarked that the constant introduction of new soldiersinto a unit just reaching the level of competence to performin an integrated manner can result in poor evaluations,restarting the training cycle and keeping individualsperpetually frustrated at their "poor" job performance. 2 0

Negative effects in the Navy case are similar. Ittakes time and effort to turn a collection of men, even menwith the common training and common background of a tightly-knit peacetime military service, into a smoothlyfunctioning operations and management team. SOPs and otherformal rules help, but the organization must learn tofunction with minimal dependence upon team stability andpersonal factors. Even an officer with special aptitude orproficiency at a specific task may never perform it at seaagain. 2 1 Cumulative learning and improvement are also madeslow and difficult, and individual innovations and gains areoften lost to the system before they can be consolidated. 2 2

Yet, we regard this practice to contribute greatly tothe effectiveness of Naval organizations. Ther%. are twogeneral reasons for this piradox. First, the efforts thatmust be made to ease the resulting strain on theorganization seem to have positive effects that go beyondthe direct problem they address. And, second, officers mustdevelop authority and command respect from those senior

40

enlisted specialists upon whom they depend, and from whomthey must learn the specifics of task performance.

The Navy's training cycle is perforce dictated by theschedule of its ships, not its personnel. Because of highsocial costs of long tours of sea duty, the Navy has longhad to deal with such continual turnover, and attempts asbest it can to mitigate the negative effects. Mostimportant is the institutionalization of continual, cyclictraining as part of organizational and individual'expectations. This is designed to bring new people up tospeed with the current phase of the cycle, thus stabilizingthe environment just before and during deployment at thecost of pushing the turbulence down into individual units.Although the deployment cycle clearly distinguishes periodsof "training" from those of "operations", it is a measure ofcompetence and emphasis, not of procedural substance, thatapplies primarily to the ship as a unit, not its men asindividuals.

The result is a relatively open system, which exploitsthe process of training and re-training as a means forsocialization and acculturation. At any given moment, allbut the most junior of the officers and crew are acting asteacher as well as trainee. A typical Lt. Commander, forinstance, simuitaneously tries to master his present job,train his juniors, and learn about the next job he is likelyto hold. If he has just come aboard, he is also engaged intrying to master or transfer all the cumulated knowledgeabout the specifics of task, ship, and personnel in a timerarely exceeding a few weeks. 2 3 In addition to theseinformal officer-officer and officer-crew interactions,officers and crew alike are also likely to be engaged in oneor more courses of formal study to master new skills in theinterest of career advancement or rating.

As a result, the ship appears to us as one giganticschool, not in the sense of rote learning, but in thepositive sense of a genuine search for acquisition andimprovement of skills. One of the great enemies of highreliability is the usual "civilian" combination ofstability, routinization, and lack of challenge and variety,which predispose an organization to relax vigilance and sinkinto a dan erous complacency that can lead to carelessnessand error.24 The shipboard environment on a carrier isnever that stable. Traditional ways of doing things areboth accepted and constantly challenged. Young officersrotate in with new ideas and approaches; old chiefs remainaboard to argue for tradition and experience. The resultingdynamic can be the source of additional confusion anduncertainty at times, but at its best leads to a constantscrutiny and re-scrutiny of every detail, even for SOPs.

41

In general, the Navy has managed to turn the rapidturnover to advantage through a number of mechanisms thathave evolved by trial-and-error for the purpose ofinsulating against personnel changes. SOPs ani procedures,for example, are often unusually robust, which in turncontributes another increment to relialility. The continualmovement of people rapidly diffuses or,°anizational andtechnical innovation as well as "lessom. learned", often inthe form of "sea-stories", throughout the organization.Technical innovation is eagerly sought where it will clearlyincrease both reliability and effectiveness, yet resistedwhen suggested purely for its own sake. Operators readingsophisticated radar systems log data with grease pencils;indicators for the cables to arrest multi-million dollaraircraft are set and checked mechanically, by hand. Thingstend to be done in proven ways, and changed only when someunit has demonstrated and documented an improvement in thefield. The problem for the analyst, and for the Navy, isthe separation of functional conservatism from puretradition.

Authority Overlays

We also have noted with great amazement theadaptability and flexibility of what is, after all, amilitary organization in the day-to-day performance of itstasks. On paper, the ship is formally organized in a steephierarchy by rank, with clear chains of command and means toenforce authority far beyond that of any civilianorganization. We supposed it to be run by the book, with aconstant series of formal orders, salutes, and yes-sirs.Often it is. But flight operations are not conducted thatway.

Flight operations and planning are usually conducted asif the organization were relatively "flat" and collegial.This contributes greatly to the ability to seek the proper,immediate balance between the drive for safety andreliability and that for combat effectiveness. Events onthe flight deck, for example, can happen too quickly toallow for appeals through a chain of command to a formalauthority. Even the lowest rating on the deck has not onlythe authority, but the obligation to suspend flightoperations immediately, and without first clearing it withsuperiors, under the proper circumstances. Although hisJudgement may later be reviewed or even criticized, he willnot be penalized for being wrong, and .ll often bepublicly congratulated if he is right.

Coordination of planning for the next day's air

42

operations requires a series of involved tradeoffs betweenmission requirements and the demands of training, flighttime, maintenance, ordnance, and aircraft handling. It islargely done by a process of ongoing and continuing argumentand negotiation among personnel from many units, in personand via phone, which tend to be resolved by direct orderonly when the rare impasse develops that requires an appealto higher authority. In each negotiation, most officersplay a dual role, resisting excessive demands from othersthat would compromise the safety or future performance oftheir units, while maximizing demands on others foroperational and logistic support.

This does not mean that formal rank and hierarchy areunimportant. In fact, they are the lubricant that makes theinformal processes work. Unlike the situation in mostcivilian organizations, relative ranking in the hierarchy islargely stable, and shaped by regular expectations andformal rules and procedures. Although fitness reports andpromotion review boards are not free of abuses or paradoxes,the shipboard situation tends to promote cooperativebehavior, which tends to minimiz 16the negative effects ofjealousy and direct competition. Although officers of thesame rank are competitively rated, each stands to benefit ifjoint output is maximized and suffer if the unit is notperforming well. Thus, we rarely observe such strategies asthe hoarding of information, or the deliberate underminingof the ability of others to perform their jobs, thatcharacterize so many civilian organizations, particularly inthe public sector.

Redundancy

Operational redundancy -- the ability to provide forthe execution of a task if the primary unit fails or falters-- is a necessity for high-reliability organizationsmanaging activities sufficiently dangerous to cause seriousconsequences in the case of operational failures.2 7 Inclassic organization theory, redundancy is provided by somecombination of duplication (two units performing the samefunction] and overlap(two units with functional areas incommon]. Its enemies are mechanistic management models thatseek to eliminte these valuable modes in the name of"efficiency". For a carrier at sea, several kinds ofredundancy are necessary even for normal peacetimeoperations, each of which creates its own kinds of stress.

A primary form is technical redundancy, involvingoperations-critical units or components on board --computers, radar antennas, etc. In any fighting ship, asmuch redundancy is built is as in practicable. This kind

43

of redundancy is traditional, and well understood. Anotherform is supply redundancy. The ship must carry as manyaircraft and spares as possible to keep its power projectionand defensive capability at an effective level in the faceof maintenance requirements, and possible operational orcombat losses. Were deck and parts loading reduced, many ofthe dangers and tensions involved in scheduling and movingaircraft would be considerably lessened. Here is a clearcase of a tradeoff between operational and safetyreliability that must be made much closer to the edge of theenvelope than would be the case than for other kinds oforganizations. Indeed, for a comb&t organization, thetradeoff point is generally taken as a measure of overallcompetence. 2 9

Most interesting to our research is a third form,decision/manaaement redundancy, which encompasses a numberof organizational strategies to ensure that criticaldecisions are timely and correct. This has two primaryaspects: (a) internal cross-checks on decisions, even at themicro level; and, (b) fail-safe redundancy in case onemanagement unit should fail or be put out of operation. Itis in this area that the rather unique Navy way of doingthings is the most interesting theoretically as well aspractically.

As an example of (a), almost everyone involved inbringing the aircraft on board is part of a constant loop ofconversation and verification, taking place over severaldifferent channels at once. At first, little of thischatter seems coherent, let alone substantive, to theoutside observer. With experience, one discovers thatseasoned personnel do not "listen" so much as they monitorfor deviations, reacting almost instantaneously to anythingthat does not fit their expectations of the correct routine.This constant flow of information about each safety-criticalactivity, monitored by many different listeners on severaldifferent communications nets, is designed specifically toassure that any critical element that is out of place willbe discovered or noticed by someone before it causesproblems.

Setting the arresting gear, for example, requires thateach inccming aircraft be identified (for speed and weight),and each of four independent arresting gear engines setcorrectly. 3 0 At any given time, as many as a dozen peoplein different parts of the ship may be monitoring the net,and the settings are repeated in two different places (Pri-Fly and LSC). During a trip aboard Enterprise in April of1987, she took her 250,000th arrested landing, representingabout 1,000,000 individual settings. 3 1 Because of theredundancies built in, and the cross-familiarity of

44

personnel with each other's jobs, there had not been asingl recorded instance of a reportable error in settingthat resulted in the loss of an aircraft. 3 2

Fail-safe redundancy, (b), is achieved in a number ofways. Duplication and overlap, the most familiar modes oferror-detection, are used to some extent -- for example, inchecking mission weapons loading. Nevertheless, there arelimits to how they can be provided. Space and billets aretight at sea, even on a nuclear-powered carrier, and, unlikeland-based organizations, the sea-going Navy cannot simplyadd extra departments and ratings. Shipboard constraints anddemands require a considerable amount of redundancy atrelatively small cost in personnel. In addition to theclassic "enlightened waste" approach of tolerance forconsiderable duplication and overlap, other, more efficientstrategies that use existing units with other primary tasksas back-ups are required, such as "stzessing the survivor"and mobilizing organizational "reserves". 3 3

Stressing the survivor strategies require that each ofthe units normally operate below capacity, so that if onefails or is unavailable, its tasks can be shifted to otherswithout severely overloading them. Redundancy on the bridgeis a good example. 3 4 Mobilizing reserves entails thecreation of a "shadow" unit able to pick up the task ifnecessary. It is relatively efficient in terms of bothspace and personnel, but places higher demands on thetraining and capability of individuals. What the Navyeffects through the combination of generalist officers, highjob mobility, constant negotiation, and perpetual training,is a mix that leans heavily on reserve mobilization withsome elements of survivor stressing. Most of the officers,and a fair proportion of senior enlisted men, are familiarwith several tasks other than the ones they normallyperform, and could do them in an emergency.

The Combat Decision Center (CDC, or just "Combat"), forexample, is the center for fighting the ship. 3 5 Crucialdecisions are thereby placed nominally in the hands ofrelatively junior officers in a single, comparativelyvulnerable location. In this case we have noted several ofthe mechanisms described above. There is a considerableamount of senior oversight, even in calm periods. A numberof people are "just watching", keeping track of each other'sjobs or monitoring the situation from other locations.There is no one place on the ship that duplicates theorganizational function of combat, yet each of the tasks hasa back-up somewhere -- some on the carrier some distributedamong other elements of the Battle Group.36

In an "ordinary" organization, these parameters would

45

----I I- ---- ,-r-~

likely be characterized in negative terms. Back-up systemsdiffer in pattern and structure from primary ones. Thosewith task responsibility are constantly under the criticaleye of others. Authority and responsibilities aredistributed in different patterns, and may shift incontingencies. In naval circumstances where reliability isparamount, these are seen as positive and cooperative, forit is the tJak that is of primary importance.

Thus, those elements of Navy "culture" that have thegreatest potential for creating confusion and uncertaintyturn out to be major contributors to organizationalreliability and robustness under strain. We believe this tobe an example of adaptive organizational evolution tocircumstance, for it responds very well to the fv-'tionalnecessities of modern operations. In the days of great,compact flotillas, loss of navigational or deck or guncapability by one ship could be compensated for by shiftingor sharing with another. There is only one carrier in aBattle Group, and only a handful of other ships, spread overmany hundreds of square miles. Each, and most particularlythe carrier, must internalize its own processes andmodalities for redundancy.

4

D4

Soue Preli.inary Conclusions

Even though our research is far from complete,particularly with regard to comparisons with otherorganizations, several interesting observations and lessonshave already been recorded.

First, the remarkable degree of personal andorganizational flexibility we have observed is essential forperforming operational tasks that continue to increase incomplexity as technology advances. "Ordinary" organizationtheory would characterize aircraft carrier operations asconfusing and inefficient, especially for an organizationwith a strong and steep formal management hierarchy (i.e.,any "quasi-military" organization). However, the resultingredundancy and flexibility are in fact remarkably efficientin terms of making the best use of space-limited personnel.

Second, an effective fighting carrier is not a passiveweapon that can be kept on a shelf until it is needed. Sheis a living unit, possessed of dynamic processes of self-replication and self-reco'struction that can only benurtured by retaining experienced personnel, particularlyamong the chiefs, and by giving her sufficient operationaltime at sea. This implies a certain minimum budgetary costfor maintaining a first-line carrier force at the levels ofoperational capability and safety demanded of the U.S. Navy.

The potential risk of attempting to operate at presentlevels under increasing budgetary constraints arises becausethe Navy is a "can-do" organization, visibly reluctant tosay "we're not ready" until the situation is far into thered zone. 3 7 In time of war, the tradeoff point betweensafety and effectiveness moves, and certain risks must betaken to get units deployed where and when they are needed.In peacetime, the potential costs of deploying units thatare less than fully trained are not so easily tolerated. Ifreductions in at-sea and flying time are to be taken out ofwork-ups to preserve operational time on deployment,training and evaluation procedures will have to be adaptedto reduce stress -- perhaps by overlapping final readinessevaluations into the beginning of the deployment period.

Third, as long-term students of organizations, we areastounded at how little of the existing literature isapplicable to the study of ships at sea. Consider, forexample. the way in which the several units that make up aBattle iroup (carrier, air wing, supply ships, escorts) arein a continual process of formation and re-formation.Imagine any other organization performing effectively whenit is periodically separated from and then rej oins the unitthat performs its central technical function. 8 More

47

importantly, most of the existing literature was developedfor failure-tolerant, civilian, organizations with definiteand measurable outputs. The complementary body on publicorganizations assumes not only a tolerance for failure, butat best an ambiguous definition of what measures failure(or, for that matter, of success).

Fourth, we have been encouraged to reflect on the newlarge Soviet nuclear carrier now being fitted out in theBlack Sea. 3 9 The Soviet Navy is completely withoutexperience or tradition in large carrier operations. Theirinternal structure is more rigid and more formal than ours,and with far less on-the-job training, especially forenlisted personnel. 4 0 It will be very interesting to watchtheir work-up time, deck loading, and casualty rates. Ofcourse, it is not clear that they will be trying to emulateU.S. carrier operations rather than the rather differentstyle and objectives of the British or French. 4 1 In eithercase, we estimate a minimum of several work-ups (each takingperhaps 2-3 years) before they begin to approach the deckloads and sortie rates of comparable Western carriers, and,unless they are remarkably luck , the loss of not a fewlives in the learning process.4ý

1. See, for example, Charles Perrow, Normal Accidents (NewYork: Basic Books, 1984).

2. Examples that have attracted recent attention includeBhopal, Seveso, Three Mile Island, and Chernobyl. All fourmeet Pe:row's criteria for coupling, response time, andcomplexity. The essence of a "normal" accident is that thepotentiality inheres in the design of the system, and,despite attempts to fix "blame", is not primarily the resultof individual misbehavior, malfeasance, or negligence.

3. By comparison, civil air traffic controllersdeliberately stay far away from the edge. Such fixed rulesas maintaining five mile intervals are designed to errbroadly in the direction of safety. Moreover, the turnoverrate for controllers is relatively low (barringextraordinary events such as the recent strike), and evenequipment changes are few and far between.

4. From this point we refer to carrier personnel as "men",since as yet the Navy does not allow women to serve aboardcombat vessels.

5. We have followed both the U.S.S. Carl Vinson (CVN-70)and the U.S.S. E (CVN-65), under a total of fourdifferent Captains, through their training and work-up fromAlameda and San Diego and across the Pacific into the SouthChina Sea. In addition, one of us (Roberts) has been able

48

to observe the initial sea trials of the U.S.S. ThegdoreRoosevl (CVN-71).

6. In formal organization terms, we refer to this as"decomposability". The basic notion was introduced byHerbert A. Simon in "The Architecture of Complexity",Proceedings of the American Philosophical Society, 106(December 1962), 467-482; (reprinted in Herbert A. Simon,The Sciences of the Artificial (Cambridge MA: The MIT Press,1981).

7. During our interviews, one senior officer on Flag staffsuggested that the several different functional andhierarchical modes of organization might be viewed as a setof "overlay:s" that are superimposed upon the formalorganization at different times depending upon the task orcircumstance at hand. Many of the officers must shift rolesmany times during the course of a single active day offlight operations.

8. The few examples that come to mind are largeconstruction projects, e.g., nuclear power plants, theAlaskan pipeline, etc. However, these usually haveconsiderable oversight from a separate firm whose sole taskis to coordinate and schedule the work properly.

9. This point was brought home sharply by the effort tobring up the ZOG computer system on the USS Carl Vinson,which would have required that almost complete knowledgeabout all details of ship operations be known and enteredif the system were to function as originally intended. Inretrospect, this can be seen as a near-impossiblerequirement without the mounting of a considerable specialeffort to collect and organize the data.

10. Furthermore, a strong Captain is capable of alteringboth the character of a ship and the way it operates, if heso chooses.

11. Given the size of modern jet aircraft and the numbercarried at full load, the matter of spotting is far fromtrivial. Inefficient spotting can greatly reduce theability to move aircraft about quickly. Incorrect spottingcan lead to serious interference with operations, or even toa "locked" deck, in which it becomes impossible to moveaircraft at all. In a trial using the deck model in FlightDeck Control, one of us managed to lock the deck sothoroughly that an aircraft would have had to be pushed overthe side to free it.

49

12. Some non-functional variations are being reduced. Forexample, all LSO platforms will soon be located at the samelevel and position relative to the arresting gear wires.However, it is nearly impossible to upgrade all of theships at once when new equipment in introduced, so each isat a different stage of modification and upgrade at anygiven point in time.

13. To some extent this situation is improving. LandingSystem Officers (LSO), for example, now have a simulator towork with. Although this is no substitute for experiencewhen "eyeball" judgement is concerned, it helps.

14. As one Senior Chief remarked to us: "You have to knowit, but it rarely helps when you really need it."

15. Roger Evered, "The Language of Organizations: The Caseof the Navy", in Louis R. Pondy, Peter J. Frost, GarethMorgan, and Thomas C. Dandridge, eds., OraanizationalS (Greenwich CT: JAI Press, 1983), 125-144.

16. A very few stay on one ship for many years, but such"plank owners" ara rare in the modern Navy.

17. For example, the first crew was unable to spot the deckeffectively; Flight Deck Control was laid out with the deckmodel at right angles to the deck (interfering with spatialvisualization) and obstructing the Aircraft HandlingOfficer's direct view of the deck out of his only window.

18. The recent grounding of USS Enterprise on Bishop Rockoff San Diego may be at least partially due to her being ina difficult exercise combining elements of what were usuallytwo exercises. See Karlene H. Roberts, "Bishop Rock DeadAhead: The3 Grounding of U.S.S. Enterprise", submitted toNaval Institute Proceedinos. The effect on ship's moralewas very visible.

19. Lewis Sorley, "Prevailing Criteria: A Critique", in SamC. Sarkesian, ed., Combat Effectiveness (Beverly Hills: SagePublications, 1980), 57-93.

20. L.R. Giguet, "Coordinating Army Personnel AgenciesUsing Living Systems Theory: An Example," U.S. Army TRADOC,1979, as quoted by Sorley at p. 76-77.

21. The term "proficiency" is used in the s:ecial sense of

Hubert L. Dreyfus and Stuart E. Dreyfus, Mind Over Machine(New York: Free Press, 1986), who classify five steps ofskill acquisition: novice; advanced beginner; competence;proficiency; expertise. For most officers mastery of aspecific assignment means at most the acquisition of

50I6

proficiency -- the ability to identify situations and actupon them without having to systematically think through theprocedural steps involved. The most advanced stage,expertise, involves moving past "problem-solving" to"intuition" in decision-making. Examples of relevance hereinclude the flying skills of experienced pilots and thespecific expertise of senior chiefs -- in each caserepresenting many years of continuous practice of a smallrange of specific skills.

22. We have observed several mechanisms used by the Navy toprevent such loss, including incentives for reportingsuccessful innovation and formal procedures for theirdissemination. The most general mechanism, however, is theinformal dissemination of information by the movement ofpersonnel, and through those responsible for refresher andother forms of at-sea training. A most remarkablecombination of trainers and active personnel is therecently formed association of Air Bos'n's, which holdsannual meetings at which information is exchanged and formalpapers are presented.

23. Officers near the end of their tours, with newassignments in hand, are often also trying to learn as muchas they can about their future tasks and responsibilities.

24. K. Weick, "The Role of Interpretation in HighReliability Systems", California Management Review, 39,1987, 112-127.

25. Roberts (op.cit.) observes that similar rules wouldoperate to similar advantage on the Navigation Bridge, whichof necessity operates under more formal and traditional rules.

26. Even when fitness report ratings are based solely onmerit, they are necessarily subjective to some degree. Itis inherently difficult to compare ratings taken ondifferent ships, in different peer groups, by differentsuperiors, even in the best of circumstance. But thegeneral opinion among those we have interviewed is thatdirect abuses of the system are relatively rare. As withall hierarchical organizations, politics will begin to enteras one moves to higher rank, but is thought to be a minorfactor below the level of Captain.

27. We note that the kinds of redundancy required to assurecontinued effectiveness in combat -- e.g., in situationswhere physical damage to ship or command chains isanticipated -- are qualitatively different from redundancydirected primarily to assuring the performance of safety-critical tasks. Elements of the former, however, are oftenmajor contributors to the latter.

51

28. Martin Landau, "Redundancy, Rationality and the Problemof Duplication and Overlap," Public Administration Review,23 (Nov/Dec 1973), 316-351.

29. In this context, we note that the tempo and characterof U.S. carrier operations are so qualitatively differentfrom those of other navies -- including the French, British,and prospective Russian -- that the envelope itself can onlybe measured by our own expectations and capabilities.

30. The engines are in different compartments, and set byhand by separate operating teams, so that collectivefailures in setting can only occur at the command level,i.e., in the Tower, where a number of other independentmeasures for cross-checking and redundancy are in place.

31. During heavy flight operations, there may be anywherefrom 600 to 1000 settings of the engines during a singleday. A typical deployment will have 8,000 to 10,000arrested landings ("traps"), involving 30,000 to 40,O0Osettings over a six to eight month period.

32. Although the probabilities are low, the possibilitydoes exist. A minor error may simply result in too muchrunout, cable damage, or some damage to the aircraft. Butan engine set for too heavy a weight can pull a tail hookout, leading to aircraft loss; setting for too low anaircraft weight can result in its "trickling" over the endof the angle deck and into the sea. Experienced Air Bos'nsand Chiefs estimate that perhaps six or seven such seriouserrors have occurred throughout the entire U.S. fleet overthe past twenty years. Our estimate for the rate ofuncorrected wrong settings with serious consequences istherefore about one in a million -- roughly comparable tothe probability of a mid-air collision in a domesticcommercial airline flight. Setting errors that arecorrected are "non-reportable" incidents, and therefore notdocumented. We also note that on the USS Carl Vinson, amuch newer ship with a still unbroken memory, no reportableincident of any kind could be recalled in the first 70,000traps since its commissioning.

33. Allan W. Lerner, "There Is More Than One Way To BeRedundant", Administration & Society, 18, No. 3 (November1986), 334-359.

34. This was brought home to us during a General Quartersdrill, in which the bridge took simulated casualties.

52

35. During the period of observation, CDC was also thecenter for fighting the Battle Group, a task that willincreasingly be supervised by the new Tactical Ilag CommandCenters (TFCC) as they are installed. Depending upon thephysical arrangement of the ship, the CDC area contains theCombat Information Center (CIC), anti-air warfare controlconsoles, and perhaps air operations and ship air trafficcontrol (CATCC); other warfare modules, such as those foranti-submarine or anti-surface warfare, may alsi be includedor in physically adjacent spaces.

36. For example, control of fighter aircraft can be donefrom the carrier, from an E-2, cr from one of several otherships in the group.

37. Evered, op. cit., lists qualities of "responsiveness toauthority", "being ready", "can do", and "not fazed bysudden contingencies" as among the more 'obvious' charactertraits of Naval officer culture. These are transmitted bytraining programs, ceremonies, and historical models. Thelatter is particularly important for the 'can do' aspect ofculture.

38. Not only are the ship and its air wing parted, but theWing itself is split into component squadrons, which trainunder different functional commands.

39. No definite name for this 1000+', angle-deck, 65-70,000ton nuclear-powered carrier has been ascertained at this time.

40. Bruce W. Watson and Susan M. Watson, The Soviet Navy:Strenaths and Liabilities (Boulder: Westview, 1986).

41. Although it is currently believed that arresting gearand catapults will be fitted, and the deck mock-up at Sakiairfield in the Crimea is so equipped, ski-ramps for a totalloading of 60-70 STOL aircraft appear more likely in theshort term, with possible future retrofit of catapults intopre-existing deck slots at some future date. See, forexample, Normal Polmar, Guide to the Soviet Navy. 4thEdition (Annapolis: Naval Institute Press, 1986), 164-165.

42. As a group, we doubt they will be able to approach theoperating conditions and efficiency of U.S. carriers in thiscentury, if at all, even if they master the associated navaland aircraft technologies.

53

Appendix

Project Summary and Annotated Bibliography of Project Papers

1. Project Summary

HIGH RELIABILITY ORGANIZATION PROJECT

University of CaliforniaBerkeley, California

Project Overview - May 1988

Faculty Group:

Geoffrey Gosling, Transportation EngineeringAir Traffic Control; Computer Applications

Todd R. La Porte, Political Science - Co-chairOrganization Processes; Response to ComplexTechnologies

Karlene H. Roberts, Business Administration -Co-chair Organizational Behavior; Decisionand Group Processes

Gene I. Rochlin, Energy and ResourcesTechnology and Organizations; Energy andRegulation

Corresponding Member:

Charles Perrow, Department of Sociology, YaleUniversity - Organization Theory and RiskManagement

Den'.;e M. Rousseau, School of BusinessAaAinistration Northwestern University -Organizational Behaxior and Methodology.

W. Richard Scott, Department of Sociology,Stanford University - Organization Theory

Karl Weick, School of Business AdministrationUniversity of Texas; Austin, TexasSocial Psychology and Organizational Behavior

Student Participants

Paula Consolini, Political ScienceTed Lascher, Political ScienceJennifer Halprin, School of Business AdministrationSuzanne Stout, School of Business Administration,

Stanford University

Prepared by Todd R. La Porte

Institute of Governmental Studies

54

The project began, summer,1984, within a small gro'p ofBerkeley faculty [I and Note 1) who were meetinq regularlyto discuss an organizational problem of increasing salience- the performance of a growing class of organizations inboth the public and private sectors charged with tasks forwhich the societal and organizational costs of "errors" or"failures" are extremely high. [2] Few organizationsperform such tasks well, yet our society increasinglydemands that significant errors be avoided in organizationsperforming a host of critical tasks, e.g., toxic wastedisposal or nuclear power plant operation.(,)

A series of workshops brought together senior operatingofficials from three "high reliability" organizationslocated nearby: the FAA's Oakland Enroute Air TrafficControl Center, PG&E's Electric Operations Division, thesenior officers of the nuclear powered aircraft carrier,U.S.S. Carl Vinson. A strikingly similar set of problems -•nd solutions - emerged from these discussions. None ofthese organizations had been studied systematically. Eachwas quite interested in further study and opened itself tous. Fortuitously, we had had substantial experience witheach one in earlier and somewhat unrelated projects. Weeagerly took up the opportunity to study a small group oforganizations whose performance not only meets, but exceedscriteria and expectations based on other experiences.[31

Each of these organizations perform very complex anddemanding tasks under considerable time pressure, and do sowith a near-zero error rate and an almost total absence of

1 Current Berkeley Faculty Group: Geoffrey Gosling,Transportation Engineering - Air Traffic Control, ComputerApplications; Todd R. La Porte, Political Science -Organization Processes, Response to Complex Technologies;Karlene H. Roberts, Business Administration OrganizationalBehavior, Decision and Group Processes; Gene I. Rochlin,Energy and Resources - Technology and Organizations, Energyand Regulation. Corresponding Faculty: Karl Weick, Schoolof Business Administration, University of Texas, Austin,Social Psychology and Organizational Behavior; Denise M.Rousseau, Business Administration, Northwestern University -Organizational Behavior and Methodology; W. Richard Scott,Stanford University - Organization Theory; and CharlesPerrow, Yale University - Organization Theory.

2 Regrettably, NASA's space shuttle launch managementmust be placed in the category of organizations that"failed" under the joint stress of demands for very high

reliability and operational continuity.

55

catastrophic failure. Based on our work thus far, it isevident that they have a number of similar characteristics:

-- Each organization has a strong, reasonably concrete senseof its primary missions, operational goals and the technicalmeans necessary to accomplish them.

-- All operate quite powerful, knowledge intensivetechnologies with very few significant operational failures.These technical systems are well known; their mechanisms andprocesses can be nearly completely specified.

-- Their production units, e.g., power station, ATC center,or naval vessel, are quite complex and linked together intolarge operating networks, e.g., power grid, national system,or task force, that strongly effects levels of internaloperating strains and the capacity to adjust to surprise.

-- Trey manage activities for which external or internalc asequences of failure are perceived to be great. The rareoperational failure gravely threatens the organization'scapacity to operate, to deliver crucial services, and/orthreatens the lives of its members or those of the communityat large. As a result, "errors" such as near-misses betweenaircraft, partial blackouts, or damaged or diverted militaryaircraft are almost as difficult to tolerate as actualsystem failures, e.g., mid-air collisions, extensive systemshut downs, or loss of aircraft or lives.

-- There is a high degree of agreement in the societyregarding the events, accidents or failures to be avoided(and within the organization on the indications of theon-set of such failures.)

-- Each organization has accepted the signal importance ofreliable, safe operations as a major goal and there appearsto be an ethic of personal responsibility for the safeoperation of the whole. There is an operating "culture"that is strongly failure averse. Internal dynamics andstructures are predominantly influenced by the requirementto avoid certain types of events, accidents or failures.However formal the organization, the informal operatingstructure shares responsibility for maintaining safety in alargely non- hirerachical way.

-- Despite the diversity of their tasks, operators in eachsystem have similar working environments, share similarresponsibilities, expectations, objectives, and goals, andshow similar manifestations of the stress of their jobs.

-- In each case, it is the judgment, experience, and trained

intuition of seasoned operators that is most responsible for

56

maintaining systems reliability and safety. The historicallearning process has been one of trial and error, but in anunusual sense. Open acknowledgement of and acceptance ofresponsibility for past error is rewarded in the interest ofprompting future improvement.

-- Organizational structures, authority relationships, anddecision- making dynamics appear to have evolved in commonpatterns: there is clear separation of operating from systemmaintenance, substantial delegation of operating authorityto subordinate units, and redundant information sources toinform decision-making.

-- Each Q' these organizations has seen its workloadincrease whije its resources base has been in relativedecline in recant years: air traffic has increased in asystem still recovering from the controller's strike of afew years ago; utility grid management is becoming much morecomplex as large numbers of relatively small independentelectricity producers come on line; naval aircraft havebecome faster, heavier, and more complex and deck loaddensity has increased.

-- Due to increased relative demand, an additional level ofsustained stress has been added to the amount of stressoperators are expected to absorb in highly responsibletime-urgent jobs, calling for maintaining absoluteperformance levels, in the face of increasing magnitude andcomplexity of the tasks.

-- Computers and other technical systems are used, oftenextensively, but primarily as sources of information anddata -- inputs to human judgment. Recently, in the face ofincreasing demand, each organization has been pressed toturn to new computer technologies in the hope of increasingits operational capacity without directly alteringorganizational size or structure.

-- Finally, the organizations, by virtue of their highreliability, have been nearly invisible to the public. Themore failure-free their operation, the less opportunity for"outsiders" to learn about them. It appears likely thatpolicy makers and interested consumer groups aresystematically under-informed about the organizations'actual requirements and dynamics.

Two implications of this pattern of conditions follow:unexpected, subtle and unpredictable consequences are likelyto result from the introduction of powerful and demandingnew technical systems into organizations as large andcomplex as these; and criticisms and proposals for changeare likely to underestimate or misunderstand their

57

-, I- I I1?fl I~

consequences for organizational operations.

The research group has undertaking observations in eachof these organizations to answer questions about how theymanage to attain such high levels of reliable performancewhile maintaining the capacity for sustained peakperformance, and how they redesign themselves in the face ofcontingencies not considered by their original designers.It is already apparent that existing management andorganizational theory must be modified, indeed extended, toaddress design, management, training and related issues.When these modifications are made and tested, they can beused to derive policies to help insure that, as anincreasing numbers of complex systems are developed, theyare not accompanied by a raise the likelihood ofcatastrophic error.

Each of these studies, briefly described below, has adifferent technical focus and unqiue set of operational andinstrumental conditions. Each is directed to a specific setof immediate concerns identified by the particularorganization. Our common objective is to gain a deeperunderstanding of the conditions and costs to theorganizations and their personnel of those activities andstresses associated with maintaining such high levels ofreliable performance. This is enabling us to identify alarger set of specific operational issues and alert us tothe problems of at least maintaining or increasing theoperational reliability of a variety of very complexsystems.

Finally, an important aspect of this work has been aseries of workshops involving senior operating officers fromeach organization. To date eight day-long meeting have beenheld, first, on site in each organization to brief the groupon the reliability aspects of its operations, then toexamine cross-cutting and comparative issues, e.g., thefunction and surprises in training activities, problems offormal and informal control system management during theonset of operational stress, and variations of working groupcultures within high reliability organizations. Recentworkshops have centered on provisional findings from ourwork thus far.

Below is a brief description of our work with eachorganization. (Modest support for this work has come from anumber of sources indicated for each stud- area along withthose of the team that assume initial responsibility. InJune, we received a grant from the National ScienceFoundation to continue this work.)

1. U.S. Air Traffic Control. (La Porte and Gosling)

58

(UCB, Inst. of Transport. Studies J

Study of the evolution of ATC was begun in 1980,examining the technical, organizational and institutionalconditions which had resulted in a stunning level ofoperational reliability. Intensive examination of technicaland organizational changes were conducted through reviews ofdocuments and extensive interviewing at FAA headquarters inWashington, D.C., and at Washington and later Oakland AirRoute Traffic Control Centers. The PATCO strike sodisrupted the FAA that the study was "put on hold" fornearly two years after the strike, and was resumed when theorganization's equilibrium was regained. Subsequent work inWashington and at Oakland Center has been done to explore 1)the longer lasting effects of the strike, and 2) thepotential for surprise and personnel difficulties that couldaccompany the introduction of the newest technical proposalsfor automation of air control functions.

In fall 1985, further study in Washington and inseveral ATC centers was begun (by La Porte) to further thework begun in 1980. Other work has proceeded independently(by Gosling) on aspects of the use of "artificialintelligence" for various ATC functions. Both Gosling andLa Porte have familiarized themselves with the operation ofEuropean Air Traffic Control during visits to ERUOCONTROLfacilities near Paris and Brussels, by La Porte in June,1986, and both La Porte and Gosling in September 1987 withvisits to EUROCONTROL facilities near Paris, Brussels, andthe operational center at Maastricht, Netherlands. Threeweek were spend at the FAA facilities in Washington, D.C.,and Leesburg, VA, April 1988, to up-date the teamsinformation on changes in policies and operations during thepast three years anticipating moderately intensive in-siteobservations at Oakland Center, this summer.

Arrangements have been made to conduct on-siteobservations and interviewing at ATC enroute and terminalcontrol facilities, especially in periods of operationalstress.

2. The Electric Operations Department, Pacific Gas andElectric Company. (La Porte, Rochlin) (UC Energy

Research Group; PG&E]

Studies began in 1981-82 as part of a stu-1y on theeffects of dispersed energy supply on organizational change.To our surprise, we discovered that the management of theelectrical power distribution grid had many similarities towhat we had found in the FAA. In 1984, we resumedsystematic contacts with PG&E, with several briefings on

59

their operations and periodic discussions of the challengesthey face in the next decade.

In summer 1985, we continued charting the evolution ofthe grid management function and operating organizationalstructures, decision- making dynamics, the demands ofincreased conservation and load management efforts, and thechanges associated with new automated information controltechnologies may have within PG&E as they continue to be thepivotal actor in the Western States power grid. Thisgeneral phase included the beginning of systematic study ofthe past decade's development of the Electric OperationsDepartment and an examination of routine and emergencyswitching decision-making and performance.

Two more detailed studies were initiated in winter,1986: the first examined the organ.zational effects ofmanaging the growing number of widely dispersed,independently owned electric power producers. The secondstudied the political dynamics arising from a series ofpersistent major outages in a large Central Valleycommunity, and the utility's response to the difficulttechnical and operational problems involved is nearlycompleted. This paper will be submitted for publicationsoon. Workshops were devoted to each project.

Arrangements are being made; 1) to develop anorganizational history of PG&E's leadership and operationalinvolvement in establishing the California Power Pool, theassociation of utilities increasing tied together in powertransfers that greatly improves regional performance, and 2)to conduct on-site observations of several switchingcenters, especially in periods of operational stress.

3. Nuclear Aircraft Carriers. (Roberts, La Porte,Rochlin) [UCB, Inst. of Govt. Studies, Sch. of Bus.

Ad.; Office of Naval Research, U.S. Navy)

Over two years ago, initial acquaintance with thesevery complex, tightly-packed organizations was began atpier-side locally with U.S.S. Carl Vinson and continuedat-sea during an intensive period of her deployn,ent. Afterintensive briefings on the ship's operation, two of usboarded her for 17 days underway off Japan, December, 1984,to observe her management and technical teams. Duringflight operations at-sea, field data were collected from ourobservations and the results of interviews with her seniorofficers, about how various of her department are managed,how crucial decisions are made, and how her departments areinterlinked to carry out the overall functions of a modernaircraft carrier. These data and subsequent at-seaexperience provide foundation for understanding of the

60

conditions which have resulting in the Carl Vinson's verygood record, and the potential changes in operations thatshould or should not be seriously considered (including themounting of additional computerized decision making aids.)

During Summer, 1985, in addition to continued study ofCarl Vinson, we extended our work to include: a) a parallelstudy of U.S.S. Enterprise, the second nuclear carrier inCarrier Group Three (CARGRU 3); and b) the effects of a newcomputer based information system designed to aiddecision-making in the command of CARGRU 3, with particularattention to the effects on staff planning and subsequentrelationship to reliable carrier air operations, and theCARGRU coordination of the battle group underway. Thispresented the opportunity for a comparison of two carriers,in the same command, but with quite different histories -the Enterprise, a long established ship, first of her classand the much newer Vinson. We are observing the processeach goes through during her readiness "workup," i.e., theevolution from early preparations to full readiness fordeployment in the Pacific. There is also the opportunity toexamine the interaction of new technologies with establishedoperations on the performance of the ships

Research on Carl Vinson has been conducted periodicallyduring the ship's "work-up" to a full state of readinessafter undergoing overhaul and repair routinely carried outafter each major deployment. The team boarded the ship forfive at-sea periods, from mid-winter through mid-Sept.,1986.nata collected include observations of the ship'snavigation, air and combat coordination operations, andsurvey data on organizational culture, and communicationfrom both elements of the ship's Air, Operations andEngineering Departments and five squadrons and command staffof the Air Wing. The last at-sea period was at a time of"practiced readiness," just before starting battle patrol inthe Indian Ocean, when operations are intense and involvetightly interdependent decision-making dynamics.

A similar study began with U.S.S. Enterprise inFebruary, 1987, after she completed "overhaul and repair."The final field segment of three weeks of on-boardobservation was completed in Jan. Survey data was collectedfrom five squadrons and several ship's departments. Theteam observed operating dynamics during four separate at-seaperiods. In addition, several visits have been made toheadquarters, Navy Air Force Pacific, San Diego, togathering information on the quantity and character of shorebased support to ship board high reliability activities.

61

NOTES

1. The three senor resaarchers have the followingrelevant research and experience. T.R. La Porte:research and advisory experience on issues ofradioactive waste and nuclear power plantoperation; studies of California electric powersystem, and the national and European air trafficcontrol systems, and for a decade was sponsored bythe U.S. Marine Corps as a user of air traffic

•control and, for a short time, aircraft carrier-services. Karlene Roberts: research oncommunication and organization in the first NavalSquadron to receive the F-14 aircraft; advisoryand legal experience on personnel matter in complexorganization involving hazards to employees. GeneRochlin: research on radioactive waste managementand other aspects of nuclear technology and safety;nuclear, fossil fueled, and alternative energysystems, including distributional effects and gridmanagement; other advanced technological systemsincluding military technologies, nuclear weaponsand control systems.

2. See, for example: Todd R. La Porte, "The Design andManagement of Nearly Error-Free OrganizationalControl Systems," in D. Sills, C. Wolf, and V.Shelanski, eds. The Accident at Three-Mile Island:Human Dimensions (Boulder, CO.: Westview Press,1982); -- , "Managing Nuclear Wastes,"Society/Transactions, July/August, 1984; "NuclearWastes: Increasing Scale and SociopoliticalImpacts,: Science, 191 (7 July 1978), 22-29. For agood description of the problems organizations facewith low-probability, high consequence events, see.C. Perrow, Normal Accidents, (New York: BasicBooks, 1984.)

3. A striking example is air traffic control, whereserious errors can threaten lives or completelydisrupt commercial air traffic. See T.R. La Porte,"The Search for Nearly Error-Free Management:Lessons from Air Traffic Control for the Future ofNuclear Energy," for Colloquium Series, WoodrowWilson International Center for Scholars,Smithsonian Institution, Nov. 1980.

62

2. HIGH RELIABILITY ORGANIZATION PROJECT PAPERS

1. T.R. La Porte, "High Reliability Organization ProjectSummary," rev. 7, May 1988The latest in a series of short overview summaries ofthe UC Berkeley Project.

2. T.R. La Porte, "High Reliability Organizations: TheResearch Challenge." March 1987The conceptual paper that outlines the theoreticalproblem, the conceptual orientation and particulardefinitions informing the High Reliability organizationProject, including the requisites of high reliabilityorganizational dynamics.

Papers Drawn from Carrier and Navy Work.

3. K.H. Roberts and R. Boettger, D.W. Scott, and S.B.Sloane, "USS Carl Vinson: An Evaluative History."1985.The early development of USS Carl Vinson is discussed.Attention is focused on the ship's early use of anartificial intelligence system and its demise. Theenvironment of the ship is described along withproblems that developed and the way they were addressedis discussed. Finally, differences between the firstand second commanding officers of the ship arehighlighted. Used by US Navy for development of newships and ship's emerging from Ship's Life ExtensionProgram (SLEP.)

4. J.L. Eccles, Interdependence in a Highly ComplexOrganization." MBA Thesis, June 1986A study of on-board interactions between the CarrierAir Group and its host carrier, including the variouskinds of interdependence that characterize therelationship of nhip's company to her air wing aboardUSS Enterprise are the focus of this paper. A new kindof interdependence (flexiole reciprocalinterdependence) is defined.

5. G.I. Rochlin, "Technology Specification and Operator'Power' in Large Organizations: The Special Case ofNaval Aircraft Carrier Flight Operations"', July 1986.This paper discusses the unusual degree of authorityover technical specification that is possessed by thenaval carrier community, analyzing the degree to whichthis represents a recognition of the specialrequirements of high hazard operations.

6. G.I. Rochlin, "'High Reliability' Organizations andTechnical Change: Some Ethical Problems and Dilemmas,"

63

!

IEEE Technology and Society Magazine, Sept. 1986.Discusses the distribution of responsibilities in'high- reliability organizations, including aircraftcarriers at sea, with special attention given to theethical dimensions and assumptions of moralresponsibility for operational safety and reliability.

7. G.I. Rochlin, T.R. LaPorte, K.H. Roberts, "TheSelf-Designing High Reliability Organization: AircraftCarrier Flight Operations At Sea." Naval War CollegeReview, Autumn 1987, 76-90.Aircraft carrier flight operations at sea are besetwith a number of paradoxes if analyzed in terms used todescribe "conventional" organizations. This paperexplores organizational self-design as a response tooperational demands and the ways in which the Navymakes the best use of factors such as high turnover andstructural ambiguity, which are normally treated asnegative, counter-productive factors in analyzingorganizational performance.

8. G.I. Rochlin, "High-Tech, Low-Tech, and No-TechComplexity: Technoligy and Organizatiorn in U.S. NavalFlight Operations at Sea."Paper presented to Section on Military Studies,International Studies Association, Atlanta, GA, Sept.1987.This paper analyzes the peculiar mix of "high" and"low" technologies used in aircraft carrier flightoperations, discussing the balance chosen between theneed for very advanced technologies to meet externalthreats and the desire for simple, more robust newwhere the need for operational reliability is,paramount.

9. K. H. Roberts, "Some Characteristics of HighReliability Organizations". Submitted toOrganizational Sciences. Jan. 1988.This paper identifies some characteristics of highreliability organizations that are similar to ordifferent from those characteristics of high riskorganizations identified by Perrow (1984) andShrivastava (1987) c f their analysis of majororganizational catastrophes. The paper shows how highreliability organizations mediate against some of thedysfunctional characteristics of high riskorganizations. Examples are drawn from USS CarlVinson, USS Enterprise, USS Theodore Roosevelt and anAir Force phased array early warning system.

10. T.R. La Porte, "Operational Design for CVNs\CVWs inBattle Group Configuration: Feedback from the Field,"

64

February, 1988.Drawn from the final three weeKs of at seaobservations, this paper discusses three situationsthat might call for modest changes in the relations ofa CVN/CVW team to upper level units. Each changeresponds to the same underlying condition, increaseinterdependence and complexity among battle group andship board elements.

11. K.H. Roberts, J. Halpern, S. Stout. "Organizationaland Cognitive Factors Influencing Decision Making in aHigh Reliability Organization." Submitted to Academyof Management Journal. July 1988Individual decision making propensities, such as thetendency toward miserliness, the impact ofaccountability, and the effects of commitment on adecision makers behavior, are examined in the contextof organizational constraints on decision making (suchas the existence of SOPs and restriction in amount ofinformation flow). The operation of these propensitiesand constraints are illustrated with two decisionmaking scenarios drawn from two aircraft carriers.

12. K.H. Roberts and G. Gargano, "Redundancy andInterdependence in a High Reliability Organization."Submitted to Academy of Management Review. Aug. 1988.This paper extends on the previously mentionedinterdependence paper by examining components of atheory of interdependence and discussing therelationship of interdependence, complexity, and systemstability.

13. K.H. Roberts, D M. Rousseau and T.R. LaPorte, "TheCulture of High Reliability Organizations." workingpaper, Aug. 1988.Using a sample of approximately five hundredrespondents from USS Carl Vinson, this paper discussesthe culture of high reliability organizations along thetwelve scales of Cooke and Rousseau's (1986)organization culture inventory. It also examines therelationship of culture, communication, and commitmentin this organization.

14. T.R. La Porte and P. Consolini, "High ReliabilityOrganizations: Challenges to Organization Theory,"paper presented at the American Political ScienceAssociation meeting, Washington, D.C., Sept., 1988.Drawing from work on two high reliability organizations- air traffic control and aircraft carrier operationsat sea - this paper outlines phenomena that challengethe adequacy of contemporary organization theory toprovide explanation. Of particular interest is the

65

emphasis on extreme error avoidance - a theoreticallyimpossible condition - and the resulting patterns ofdecision-making and mix of authority relations andoperating modes.

15. G.I. Rochlin, "Organizational Structure and OperationalEffectiveness in Complex Military Organizations: NavalFlight Operations as a Case Study," paper presented atthe American Political Science Association meeting,Washington, D.C., Sept., 1988.During a typical flying day, the various command andoperational units aboard a U.S. aircraft carrier mayreorganize the lines of authority and negotiationseveral times, adapting in each case to the demands ofthe moment and the task at hand. Operational historyand high demand are shown to be determining in themaintenance of this fluidity structure in nominallyformal and hierarchical organization.

16. K.H. Roberts, "Bishop Rock Dead Ahead: The Grounding ofthe U.S.S. Enterprise," Naval Institute Proceedings,(in press).In November, 1985, USS Enterprise grounded on BishopRock shoal in the Navy's Southern California OperationsArea. This paper discusses the antecedents to thatgrounding.

17. K.H. Roberts and G. Gargano, "Managing a HighReliability Organization: A Case for Interdependence."In M.A. Von Glinow and S. Mohrmon, (Eds.), ManagingComplexity in High Technology Industries: Systems andPeople. New York: Oxford University Press, 1988.This paper defines five types of interdependence thatcan occur in high reliability organizations. It thenpresents a number of tensions that the organizationalliterature predicts about interdependence and relatedissues in high risk organizations. These paradoxes areillustrated through observational and questionnairedata collected aboard USS Enterprise and USS CarlVinson.

18. K. H. Roberts and S. Sloane, "An Aggregation Problemand Organizational Effectiveness," in B. Schneider andD. Schoornman, eds., Facilitating Work Effectiveness.Lexington, MA: Lexington Press, 1988.This paper briefly reviews the major aggregation issuesin organization research. It then focusses on thelinkage problem as an aggregation issue. Thesimultaneous presence of three kinds of linkages(function, communication, and authority) areillustrated by observations made aboard USS CarlVinson.

66

19. K.H. Roberts and D.M. Rousseau, "Research in NearlyFailure-Free, High Reliability Systems: 'Having theBubble'," IEES Transactions, (in press)The methodological challenges and problems of doingresearch in high reliability organizations aredescribed. The paper begins with a description of thedistinctiveness of high reliability organizations; thendiscusses issues of entre, problem identification,studying systems and events, data gathering andinterpretation.

20. K.H. Roberts, "An Evaluative Review of Perrow's NormalAccidents." Academy of Management Review, forthcoming1989.This review focusses on the influence of Perrow's bookinfluence on Robert's research on "high reliabilityorganizations" via her response to a number of issuesraised in the book.

Papers dealing with other Hi•h ReliabilityOrganizations,

21. T.R. La Porte, "The Search of Nearly Error-FreeManagement: Lessons from U.S. Air Traffic Control forthe Future of Nuclear Energy," Colloquium Series,Woodrow Wilson International Center for Schoiars,SmitDs-nian Institution, Washington, D.C., Nov. 1980.Rev. -L984.This gaper outlines the requisites for what we now call"high reliability organizations", and shows how theFAA's Air Traffic Control operations meets them.Comparisons are made to the U.S. nuclear powerindustry.

22. T.R. La Porte, "On the Design and Management of NearlyError-Free Organizational Control Systems", in D.Sills, C. Wolf and V. Shelanski, eds., The Accident andThree Mile Island: The Human Dimensions. WestviewPress, Boulder, CO., 1982Part of the Social Science Research Council's responseto the Three Mile Island Disaster, the paper discussesthe requisites for what we then called "nearlyerror-free" management in the context of the nuclearfuel cycle.

23. T.R. La Porte, "Technology-As-Social-Organization:Implications for Policy Analysis," Working Paper 84-1,Studies in Public Organization, Institute ofGovernmental Studies, University of California,Berkeley, Jan. 1984.This paper extends the conception of technology to

67

Q Q I QL QM6J• -. I . ' - -.

17

include various organizational properties necessary toexpress technologies in large scale form. Propertiesthat prompt the demand for high levels of operationalreliability are included.

24. T.R. La Porte and T. Lascher, "Cold Turkeys and TaskForces: Pursuing High (Electric Power) Reliability inCalifornia's Central Valley," July 1987.This is a case study of a district in which aboveaverage outages had been experienced for several years,the reasons why this was the case, and the remarkableresponse of the utility when the problem was finallypin-pointed. The case highlights several properties oflarge networked technical systems.

25. T.R. La Porte, "The United States Air Traffic System:Increasing Reliability in the Midst of Rapid Growth,"in T. Hughes, and R. Mayntz, eds., The Development ofLarge Technical Systems (New York: Martinus Vijhoff,1988.)This paper traces the evolution of U.S. Air TrafficControl from 1936-1980 and outlines a number ofimportant properties of high reliability, largenetworked technical systems.

6G

HIGH RELIABILITY ORGANIZATION PROJECT

University of CaliforniaBerkeley, California

Project Overview - February 1988

Faculty Group:

Geoffrey Gosling, Transportation EngineeringAir Traffic Control; Computer Applications

Todd R. La Porte, Political Science - Co-chairOrganization Processes; Response to Complex Technologies

Karlene H. Roberts, Business Administration - Co-chairOrganizational Behavior; Decision and Group Processes

Gene I. Rochlin, Energy and ResourcesTechnology and Organizations; Energy and Regulation

jrresponding Member:

Charles Perrow, Department of Sociology, Yale University -

Organization Theory and Risk ManagementDenise M. Rousseau, School of Business Administatlon

Northwestern University - Organizational Behavior

and Methodology.W. Richard Scott, Department of Sociology, Stanford

University - Organization TheoryKarl Weick, School of Business Adiinistration

University of Michigan, Ann Arbor;Social Psychology and Organizational Behavior

Student Participants:

Paula Consolini, Political ScienceChris Demchak, Political Science (Ph.D. Diss.)Ted Lascher, Political ScienceSuzanne Stout. School ot Business Administration,

Stanford University

Prepared by Todd R. La PorteInstitute of Governmental Studies

I I I I I I I I I I r I I i i i r i i i . . . .

The project began. summer,198 4 , within a small group of Berkeley faculty[ and Note 1] who were meeting regularly to discuss an organizationalproblem of increasing salience - the performance of a growing class oforganizations in both the public and private sectors charged with tasks forwhich the societal and organizational costs of "errors" or "failures" areextremely high.[2] Few organizations perform such tasks well, yet oursociety increasingly demands that significant errors be avoided inorganizations performing a host of critical tasks, e.g.. toxic waste disposalor nuclear power plant operation.[')*

A series of workshops brought together senior operating officials fromthree "high reliabilty" organizations located nearby: the FAA's OaklandEnroute Air Traffic Control Center, PG&E's Electric Operations Division. thesenior officers of the nuclear powered aircraft carrier, U.S.S. Carl Vinson.A strikingly similar set of problems - and solutions - emerged from thesediscussions. None of these organizations had been studied systematically.Each was quite interested in further study and opened itself to us.Fortuitously, we had had substantial experience with each one in earlier andsomewhat unrelated projects. We eagerly took up the opportunity to study asmall group of organizations whose performance not only meets, but exceeds

criteria and expectations based on other experiences. J3

Each of these organizations perform very complex and demanding tasksunder considerable time pressure, and do so with a near-zero error rate andan almost total absence of catastrophic failure. Based on our work thus far,it is evident that they have a number of similar characteristics:

-- Each organization has a strong, reasonably concrete sense of itsprimary missions, operational goals and the technical means necessary toaccomplish them.

-- All operate quite powerful, knowledge intensive technologies withvery few significant operational failures. These technical systems arewell known; their mechanisms and processes can be nearly completelyspecified.

*Currrent Berkeley Faculty Group: Geoffrey Gosling, Transportation

Engineering - Air Traffic Control, Computer Applications; Todd R. La Porte,Political Science - Organization Processes, Response to Complex Technologies;Karlene H. Roberts, Business Administration Organizational Behavior, Decisionand Group Processes; Gene I. Rochlin, Energy and Resources - Technology andOrganizations, Energy and Regulation. Corresponding Faculty: Karl Weick,School of Business Administration, University of Michigan, Ann Arbor - SocialPsychology and Organizational Behavior: Denise M. Rousseau. BusinessAdministation, Northwestern University - Organizational Behavior andMethodology; W. Richard Scott, Stanford University - Organization Theory; andCharles Perrow, Yale University - Organization Theory.

Regrettably, NASA's space shuttle launch management must be placed in thecategory of organizations that "failed" under the joint stress of demands forvery high reliability and operational continuity.

-- Their production units, e.g., power station, ATC center, or navalvessel, are quite complex and linked together into large operatingnetworks, e.g.. power grid, national system, or task force, thatstrongly effects levels of internal operating strains and the capacityto adjusL to surprise.

-- They manage activities for which external or internal consequences offailure are perceived to be great. The rare operational failure gravelythreatens the organization's capacity to operate, to deliver crucialservices, and/or threatens the lives of its members or those of thecommunity at large. As a result, "errors" such as near-misses betweenaircraft, partial blackouts, or damaged or diverted military aircraftare almost as difficult to tolerate as actual system failures, e.g.,mid-air collisions, extensive system shut downs, or loss of aircraft orlives.

-- There is a high degree of agreement in the society regarding theevents, accidents or failures to be avoided (and within the organizationon the indications of the on-set of such failures.)

-- Each organization has accepted the signal importance of reliable,safe operations as a major goal and there appears to be an ethic ofpersonal responsibility for the safe operation of the whole. There isan operating "culture" that is strongly failure averse. Internaldynamics and structures are predominantly influenced by the requirementto avoid certain types of events, accidents or failures. However formalthe organization, the informal operating structure shares responsibilityfor maintaining safety in a largely non-hirerachical way.

-- Despite the diversity of their tasks, operators in each system havesimilar working environments, share similar responsibilities,expectations, objectives, and goals, and show similar manifestations ofthe stress of their jobs.

-- Tn each case, it is the judgment, experience, and trained intuitionof seasoned operators that is most responsible for maintaining systewixsreliability and safety. The historical learning process has been one oftrial and error, but in an unusual sense. Open acknowledgement of andacceptance of responsiblity for past error is rewarded in the interestof prompting future improvement.

-- Organizational structures, authority relazionships, and decision-making dynamics appear to have evolved in ccmmon patterns: there isclear separation of operating from system maintanence, substantialdelegation of operating authority to subordinate units, and redundantinformation sources to inform decision-making.

-- Each of these organizations has seen its workload increase while itsresources base has been in relative decline in recent years: airtraffic has increased in a system still recovering from the controller'sstrike of a few years ago; utility grid management is becoming much morecomplex as large numbers of relatively small independent electricityproducers come on line: naval aircraft have become faster, heavier', andmore complex and deck load density has increased.

-- Due to increased relative demand, an additional level of sustainedstress has been added to the amount of stress operators are expected toabsorb in highly responsible time-urgent jobs, calling for maintainingabsolute performance levels, in the face of increasing magnitude andcomplexity of the tasks.

-- Computers and other technical systems are used, often extensively,but primarily as sources of information and data -- inputs to humanjudgment. Recently, in the face of increasing demand, each organizationhas been pressed to turn to new computer technologies in the hope ofincreasing its operational capa-city without directly alteringorganizational size or structure.

-- Finally, the organizations, by virtue of their high reliability, havebeen nearly invisible to the public. The more failure-free theiroperation, the less opportunity for "outsiders" to learn about them. Itappears likely that policy makers and interested consumer groups aresystematically under-informed about the organizations' actualrequirements and dynamics.

Two implications of this pattern of conditions follow: unexpected,subtle and unpredictable consequences are likely to result from theintroduction of powerful and demanding new technical systems intoorganizations as large and complex as these; and criticisms and proposals forchange are likely to underestimate or misunderstand their consequences fororganizational operations.

The research group has undertaking observations in each of theseorganizations to answer questions about how they manage to attain such highlevels of reliable performance while meintaining the capacity for sustainedpeak performance, and how they redesign themselves in the face ofcontingencies not considered by their original designers. It is alreadyapparent that existing management and organizational theory must be modified,indeed extended, to address design, management, training and related issues,When these modifications are made and tested, they can be used to derivepolicies to help insure that. as an increasing numbers of complex systems aredeveloped, they are not accompanied by a raise the likelihood of catastrophicerror.

Each of these studies, briefly described below, has a differenttechnical focus and unqiue set of operational and instrumental conditions.Each is directed to a specific set of immediate concerns identified by theparticular organization. Our common objective is to gain a deeperunderstanding of the conditions and costs to the organizations and theirpersonnel of those activities and stresses associated with maintaining suchhigh levels of reliable performance. This is enabling us to identify alarger set f specific operational issues and alert us to the p-oblems of atleast maintaining or increasing the operational reliability of a variety ofvery complex systems.

Finally, an important aspect of this work has been a series of workshopsinvolving senior operating officers from each organization. To date eight

day-long meeting have been held, first, on site in each organization to brief

mom"'

the group on the reliability aspects of its operations, then to examinecross-cutting and comparative issues, e.g., the function and surprises intraining activites, problems of formal and informal control system managementduring the onset of operational stress, and variations of working groupcultures within high reliability organizations. Recent workshops havecentered on provisional findings from our work thus far.

Below is a brief description of our work with each organization.(Modest support for this work has come from a number of sources indicated foreach study area along with those of the team that assume initialresponsibility. In June, we received a grant from the National ScienceFoundation to continue this work.)

1. U.S. Air Traffic Control. (La Porte and Gosling)[JCB, Institute of Transportation Studies]

Study of the evolution of ATC was begun in 1980, examining thetechnical, organizational and institutional conditions which had resulted ina stunning level of operational reliability. Intensive examination oftechnical and organizational changes were conducted through reviews ofdocuments and extensive interviewing at FAA headquarters in Washington, D.C.,and at Washington and later Oakland Air Route Traffic Control Centers. ThePATCO strike so disrupted the FAA that the study was "put on hold" for nearlytwo years after the strike, and was resumed when the organization'sequilibrium was regained. Subsequent work in Washington and at OaklandCenter has been done to explore 1) the longer lasting effects of the strike,and 2) the potential for surprise and personnel difficulties that couldaccompany the introduction of the newest techntal proposals for automationof air control functions.

In fall 1985, further study in Washington and in several ATC centers wasbegun (by La Porte) to further the work begun in 1980. Other work hasproceeded independently (by Gosling) on aspects of the use of "artificialintelligence" for various ATC functions. Both Gosling and La Porte havefamiliarized themselves with the operation of European Air Traffic Controlduring visits to ERUOCONTROL facilities near Paris and Brussels, by La Portein June, 1986, and both La Porte and'Gosling in September 1987 with visits toEUROCONTROL facilities near Paris, Brussels. and the operational center a,Maastricht, Netherlands. La Porte plans a two week visit to the FAAfacilities in Washington, D.C., spring 1988.

Arrangements have been made to conduct on-site observations andinterviewing at ATC enroute and terminal control facilities, especially inperiods of operational stress.

2. The Electric Operations Department, Pacific Gas and ElectricCompany. (La Porte, Rochlin) [UC Energy Research Group; PG&E]

Studies began in 1981-12 as part of a study on the effects of dispersedenergy supply on organizational change. To our surprise, we discovered thatthe management of the electical power distribution grid had many similaritiesto what we had found in the FAA. In 1984. we resumed systematic contacts

with PG&E, with several briefings on their operations and periodicdiscussions of the challenges they face in the next decade.

In summer 1985. we continued charting the evolution of the gridmanagement function and operating organizational structures, decis'ion- makingdynamics, the demands of increased conservation and load management efforts.and the changes associated with new automated information controltechnologies may have wit!.fn PG&E as they continue to be the pivotal actor inthe Western States power grid. This general phase included the beginning ofsystematic study of the past decade's development of the Electric OperationsDepartment and an examination of routine and emergency switchingdecision-making and performance.

Two more detailed studies were initiated in winter, 1986: the firstexamined the organizational effects of managing the growing number of widelydispersed, independently owned electric power producers. The second studiedthe political dynamics arising from a series of persistant major outages in alarge Central Valley community, and the utility's response to the difficulttechnical and operational problems involved is nearly completed. This paperwill be submitted for publication soon. Workshops were devoted to eachproject.

Arrangements are being made; 1) to develop an organizational history ofPG&E's leadership and operational involvement in establishing the CaliforniaPower Pool, the association of utilities increasing tied together in powertransfers that greatly improves regional performance, and 2) to conducton-site observations of several switching centers, especially in periods ofoperational stress.

3. Nuclear Aircraft Carriers. (Roberts, La Porte, Rochlin)CUCB, Inst. of Govt. Studies, Sch. of Bus. Ad.; Office ofNaval Research, U.S. Navy)

Over two years ago, initial acquaintance with these very complex,tightly-packed organizations was began at pier-side locally with U.S.S. CarlVinsoni and continued at-sea during an intensive period of her deployment.After intensive briefings on the ship's operation, two of us boarded her for17 days underway off Japan, December, 1984, to observe her management andtechnical teams. During flight operations at-sea, field data were collectedfrom our observations and the results of interviews with her senior officers,about how various of her department are managed, how crucial decisions aremade, and how her departments are interlinked to carry out the overallfunctions of a modern aircraft carrier. These data and subsequent at-seaexperience provide foundation for understanding of the conditions which haveresulting in the Carl Vinson's very good record, and the potential changes inoperations that should or should not be seriously considered (including themounting of additional computerized decision making aids.)

During Summer, 1985, in addition to continued study of Carl Vinson, weextended our work to include: a) a parallel study of U.S.S. Enterprise, thesecond nuclear carrier in Carrier Group Three (CARGRU 3); and b) the effectsof a new computer based information system designed to aid decision-making inthe command of CARGRU 3, with particular attention to the effects on staffplanning and subsequent relationship to reliable carrier air operations, and

i " ' i... i i 1 I ,- . •

the CARGRU coordination of the battle group underway. This presented theopportunity for a comparison of two carriers, in the same command, but withquite different histories - the Enterprise. a long established ship, first ofher class and the much newer Vinson. We are observing the process each goesthrough during her readiness "workup," i.e., the evolution from earlypreperations to full readiness for deployment in the Pacific. There is alsothe opportunity to examine the interaction of new technologies withestablished operations on the performance of the ships

Research on Carl Vinson has been conducted periodically during theship's "work-up" to a full state of readiness after undergoing overhaul andrepair routinely carried out after each major deployment. The team boardedthe ship for five at-sea periods, from mid-winter through mid-Sept.,1986.Data collected include observations of the ship's navigation, air and combatcoordination operations, and survey data on organizational culture, andcommunication from both elements of the ship's Air, Operations andEngineering Departments and five squadrons and command staff of the Air Wing.The last at-sea period was at a time of "practiced readiness," just beforestarting battle patrol in the Indian Ocean. when operations are intense andinvolve tightly interdependent decision-making dynamics.

A similar study began with U.S.S. Enterprise in Februray, 1987. aftershe completed "overhaul and repair." The final field segment of three wecksof on-board observation was completed in Jan. Survey data was collected fromfive squadrons and several ship's departments. The team observed operatingdynamics during four separate at-sea periods. In addition, several visithave been made to headquarters, Navy Air Force Pacific. San Diego, togathering information on the quantity and character of shore based support toship board high reliability activities.

NOTES

1. The three senor researchers have the following relevant research andexperience. T.R. La Porte: research and advisory experience on issues ofradioactive waste and nuclear power plant operation; studies of Californiaelectric power system, and the national and European air traffic controlsystems, and for a decade was sponsored by the U.S. Mlarine Corps as a user ofair traffic control and. for a short time, aircraft carrier services.Karlene Roberts: research on communication and organization in the firstNaval Squadron to receive the F-14 aircraft; advisory and legal experience onpersonnel matter in complex organization involving hazards to employees.Cene Rochlin: research on radioactive waste management and other aspects ofnuclear technology and safety; nuclear, fossil fueled, and alternative energysystems, including distributional effects and grid management; other advancedtechnological systems including military technologies, nuclear weapons andcontrol systems.

2. See, for example: Todd R. La Porte, "The Design and Management ofNearly Error-Free Organizational Control Systems." in D. Sills. C. Wolf, andV. Shelanski, eds. The Accident at Three-Mile Island: Human Dimensions(Boulder, CO.: Westview Press. 1982); -- , "Managing Nuclear Wastes,"Society/Transactions, July/Augu.st, 1984. "Nuclear Wastes: Increasing Scaleand Sociopolitical Impacts,: Science, 191 (7 July 1978). 22-29. For a gooddescription of the problems organizations face with low-probability, highconsequence events, see. C. Ferrow, Normal Accidents, (New York: Basic Books,198~4.)

3. A striking example is aiz traffic control, where serious errors canthreaten lives or completely disrupt commerical air traffic. See T.R. LaPorte, "The Search for Nearly Error-Free Management: Lessons from Air TrafficControl for the Future of Nuclear Energy," for Colloquim Series, WcodrowWilson International Center for Scholars, Smithsonian Institution, Nov. 1980.

High Reliaiblity Organization Papers

Listed below are the several papers and notres derived from this projectthus far.

1. T. R. La Porte, "High Reliability Organization Project Summary," rev. 6;July, 1987

2. T. R. La Porte, "High Reliability Organizations: The Dimensions of the

Research Challenge." March 1987

Papers Centrally on the Carrier work...

3. K. H. Roberts and D. M. Rousseau, "Research in Nearly Failure-Free, HighReliability Systems: 'Having the Bubble'," (submitted to Academy ofManagement Review)

4. G. I. Rochlin, T.R. LaPorte, K. H. Roberts, "The Self-Designing HighReliability Organization: Aircraft Carrier Flight Operations At Sea." NavalWar College Review. Autumn 1988.

5. K. H. Roberts, "Bishop Rock Dead Ahead: The Grounding of the U.S.S.Enterprise," Jan. 1987 (forthcoming, Naval Institute Proceedings)

6. K. H. Roberts and S. Sloane, "An Evaluative History of U.S.S. Carl

Vinson." March 1986.

Other papers drawning on the Navy work.

7. K. H. Roberts and S. Sloane, "An Aggregation Problem and OrganizationalEffectiveness," in B. Scheider and D. Schoornman, eds., Facilitating WorkEffectiveness. Lexington Press, 1987.

8. K. H. Roberts and S. Sloane, "Decision-Making in Conditions of Complexityand Tight Coupling." Feb. 1986 (submitted to Management Science Review)

9. C. I. Rochlin, "'High Reliability' Organizations and Technical Change:Some Ethical Problems and Dilemmas," IEEE Technology and Society Magazine,Sept. 1986.

10. G. Rochlin, "Technology Specification and Operator 'Power' in LargeOrganizations: The Special Case of Naval Aircraft Carrier FlightOperations'", July 1986.

11. K. Weick, "The Role of Irnterpretation in High Reliability Systems."California Management Review, 1987

12. J. L. Eccles, Interdependence in a Highly Complex Organization, N1BAThesis, June 1986 (Study of on-board interactions between the Carrier AirGroup and its host carrier.)

I - T ...1"• ..I ii~-

Papers dealing with High Reliability Organizations more generally.

13. T. R. La Porte and T. Lascher, "Cold Turkeys and Task Forces: PursuingHigh (Electric Power) Reliability in California's Central Valley," July 1987.

14. T. R. La Porte, "Technology-As-Social-Organization: Implications forPolicy Analysis," Working Paper 84-i. Studies in Public Organization,Institute of Governmental Studies. University of California, Berkeley, Jan.1984.

15. T. R. La Porte, "On the Design and Management of Nearly Error-FreeOrganizational Control Systems", in D. Sills. C. Wolf and V. Shelanski. eds..The Accident and Three Mile Island: The Human Dimensions. Westview Press,Boulder, CO., 1982

16. T. R. La Porte. "The Search of Nearly Error-Free Management: Lessonsfrom U.S. Air Traffic Control for the Future of Nuclear Energy," ColloquiumSeries, Woodrow Wilson International Center for Scholars, SmithsonianInstitution, Washington. D.C., Nov. 1980. Rev. 19 84 .

I.IManpower. Personnel, and Training R&D'Program

(One copy to each addressee except as otherwise noted)

Director Research ProgramsOffice of Naval Research (Code 11) PsychologistArlington, VA 22217-5000 Office of Naval Research Detachment

1030 East Green StreetChairman, M7r R&D Cmrmittee Pasadena, CA 91106-2485Office of the Chief of Naval ResearchCode 222 Office of the Deputy Assistant SecretaryArlington, VA 22217-5000 of the Navy (Manpower & Reserve Affairs)

5D800, The PentagonMathematics (Code l11lMA) Washington, DC 20350-1000Office of Naval ResearchArlington, VA 22217-5000 Assistant for Long Range Requirert-nts

CIl) Executive Panel (Op-OOK)Director, Life Sciences (Code 114) 4401 Ford AvenueOffice of Naval Research Alexandria, VA 22302-0268Arlington, VA 22217-5000

Head, Manpower, Personnel, andDirector, Cognitive & Neural Sciences Training Branch(Code 1142) Office of the CN (Op-81 3 )Office of Naval Research 4A478, The PentagonArlington, VA 22217-5000 Washington, DC 20350-1000

Cognitive Science (Code 1142CS) Assistant for Manpower and TrainingOffice of Naval Research Office of the CNO (Op-987H)Arlington, VA 22217-5000 5D772, The Pentagon

Washington, DC 20350Biological Intelligence (Code 1142BI)Office of Naval Research Assistant for Planning and TechnologyArlington, VA 22217-5000 Development

Office of the DCN(MPT) (Op-01B2)Director, Biological/Human Factors Department of the Navy

Division (Code 125) Washington, DC 20350-2000Office of the Chief of Naval ResearchArlington, VA 22217-5000 Deputy Director Total Force Training

and Education DivisionDefense Technical Information Center Office of the DCNO(MPT) (Op-llB)

(12 copies)* Department of the NavyDTIC/DDA-2 Washington, DC 20370-2000Cameron Station, Building 5Alexandria, VA 22314 Deputy Director Military Personnel

Policy DivisionScience and Technology Division Office of the DCNO(MPT) (Op-13B)Library of Congress Department of the NavyWashington, DC 20540 Washington, DC 20370-2000

Convanding Officer Head, Military Corpensation Policy BrancNaval Research Laboratory Office of the DCN00(rT) (Op-1 3 4 )Code 2627 Department of the NavyWashington, DC 20375 WashingLon, DC 20370-2000

• If report is ready for unlimited public distribution.

1/8

Director, Navy Family Support ProgramOffice of the DCNO(MPT) (Op-156) Commanding Officer1300 Wilson Boulevard, Room 828 Navy Personnel R&D CenterArlington, VA 22209 San Diego, CA 92152-6800

Headquarters U.S. Marine Corps Technical DirectorCode MA NPRDC (Code 01)Washington, DC 20380-0001 San Diego, CA 92152-6800

Head, Leadership Branch Head, Fleet Liaison DepartmentNaval Military Personnel Command D1NPRDC (Code 31)Attn: tZR E. Marits, NMPC-621 San Diego, CA 92152-6800Department of the NavyWashington, DC 20370-5620 Head, Human Factors Department

NPbWC (Code 41)Director, Recreational Services Department San Diego, CA 92152-6900Naval Military Personnel Command (N-651C)1300 Wilson Boulevard, Room 932 Head, Training Technology DepartmentArlington, VA 22209 IPMC (Code 51)

San Diego, CA 92152-6800Deputy Director Manpower, Personnel

and Training Division Head, Training Systems DepartmentNaval Sea Systems Command NPFOC (Code 52)Attn: Code CEL.-M63 San Diego, CA 92152-6800Washington, DC 20362

Head, Manpower Systers DepartmentDirector, Research & Analysis Division NPRDC (Code 61)Navy Recruiting Command (Code 223) San Diego, CA 92152-68004015 Wilson Boulevard, Room 215Arlington, VA 22203-1991 Head, Personnel Systems Department

NP•IC (Code 62)Naval School of Health Sciences San Diego, CA 92152-6800National Naval Medical Center (Bldg. 141)Washington, DC 20814-5033 Head, Testing Systems DepartmentAttn: CDR J. M. LaRocco NPRDC (Code 63)

San Diego, CA 92152-6800Technical DirectorNaval Health Research Center Chairman, Department of AdministrativeP.C. Box 85122 Sciences (Code 54)San Diego, CA 92138-9174 Naval Postgraduate School

Monterey, CA 93943-5100Dr. Al SmodeNaval Training Systems Center (Code 07A) Chairman, Department of OperationsOrlando, FL 32813-7100 Research (Code 55)

Naval Postgraduate SchoolHead, Human Factors Laboratory Monterey, CA 93943-5100Naval Training Systems Center (Code 71)Orlando, FL 32813-7100 Uirector, Instractional Devclom-et .i

Educational Program Support Ce£ar-_-en-_Dr. Eduardo Salas Naval Education and Tra.rn1-g PrcaramHuman Factors Division (Code 712) Malagernent Support.A-tin:i, •EP'S'Naval Training Systems Center Pensacola, cL 32509Orlando, FL 32813-7100

-2--

1/88

Academic Programs and Research BranchNaval Technical Training Command Program DirectorCode N-625 Manpower Research & Advisory ServicesHkS Memphis (75) Smithsonian InstitutionMillington, TN 38054 801 t5brth Pitt Street, Suite 120

Alexandria, VA 22314-1713Assistant for Training and

Personnel Te<hnology Dr. David BowersOffice of the Under Secretary of Rensis Likert Associates

Defense for Research and Engineering 3001 South State Street3D129, The Pentagon Ann Arbor, MI 48104-7352Washington, DC 20301-3080

Dr. Meg GerrardDirector, Center for Personnel Security Psychology Department

Research Iowa State UniversitySuite E, Building 455 Ames, Iowa 5001099 Pacific StreetMonterey, CA 93940-2481 Dr. Perry W. Thorndyke

FMC Central rigineering LabsPersonnel Analysis Division Box 580AF/DPXA Santa Clara, CA 950525C360, The PentagonWashington, DC 20330 Dr. T. Govindaraj

School of Industrial & Systems Engineer,Technical Director Georgia Institute of TechnologyU.S. Army Research Institute for the Atlanta, GA 30332-0205

Behavioral and Social Sciences5001 Eisenhower kAenue Prof. David W. JohnsonAlexandria, VA 22333-5600 Cooperative Learning Center

University :f MinnesotaDirector, Manpower Program 150 Pillsbury Drive, S.E.Center for Naval Analyses Minneapolis, MN 554554401 Ford AvenueP.O. Box 16268 Dr. Walter SclhneiderAlexandria, VA 22302-0268 Learning Research & Development Center

University of PittsburghTechnical Director Pittsburgh, PA 15620Air Force Hutan lResources LaboratoryBrooks Air Force Base, TX 78236-5601 Prof. George A. Miller

Department of PsychologyLibrary Princeton UniversityNaval Training Systems Center Princeton, ýU 08544Orlando, FL 32813

Dr. Jeffery L. KenningtonLibrary School of riqineering i Apolied SciencesNaval War College Southern Metxkdist Unive.-si:yNewport, RI 02940 Dallas, TX 75275

Chief, Survey and Market Prof. Clark GlymourAnalysis Division Department of Philosophy

Defense Manpower Data Center Carnegie-Mellon Universitv1600 Wilson Boulevard, 4400 Pittsburgh, PA 15213Arlington, VA 22209-2593

-3-

l"'88

I" L"~r~1