Title:Author(s):Source:Document Type:

The negotiated order of organizational reliabilityPaul R. SchulmanAdministration & Society. 25.3 (Nov. 1993): p353.Article

Full Text:

"Slack." The term reeks of inefficiency. It implies a looseness in the organization of things--one part of a system trailingbadly the activity of another. Yet slack is a critical, if underappreciated, managerial resource. It is slack that provides amargin for error between a lapse in one aspect of an organization's performance and harmful consequences in every other. Itis slack that allows managers the freedom to maneuver--to act decisively on one part of a problem without having theirdecisions ramify quickly, widely, and unexpectedly to every other part.

In its analysis by organization and management theorists, slack has generally been defined in two varieties. Resource slack,in time, money, personnel, and so on, is the surplus of these values withheld from commitment to ongoing organizationalprojects or activities. Resource slack can be viewed negatively as a nonproductive inefficiency in the organization, asuboptimal allocation of available means to desired ends. Alternately, acknowledging something less than globalorganizational rationality, resource slack can be depicted positively as a hedge against the unexpected (March & Simon,1958).

Control slack, the second variety, implies individual degrees of freedom in organizational activity, some range of individualaction unconstrained by formal structures of coordination or command. Control slack has been viewed negatively as a lack of"crispness" in the response capacity of an organization, or more fundamentally, as a limit to the coordinative power of anorganization (Fayol, 1949). But control slack has also been viewed positively, as a source of organizational flexibility and aprotection against the dysfunctions of centralized authority (Merton, 1952).

In both forms, slack has been depleting as surely as any natural resource in the latter part of the 20th century. On a variety offronts, extremely narrow performance margins have descended on organizations and their managers, with respect toresources and control. Discretionary resources are scarce for both public- and private-sector organizations. These resourcescan be overwhelmed in many cases by the cost of performance lapses or error. Adaptive competitors stand ready to capitalizequickly on design, production, or marketing errors, and regulatory agencies police a complex and precarious mine fieldbetween legal and illegal organizational practices.

As resource margins diminish, so too does tolerance for lapses in organizational control. Modern communications andcomputer networks generate pressure for rapid-fire organizational responses and time-critical decisions. A number oforganizations are entrusted with the management of powerful new technologies--nuclear power, brain surgery, or highspeedaircraft, to name a few--of significant hazard if not operated within sharply limited control tolerances.

With the decline of slack, modern managers face severe challenges to maintain high levels of efficient and reliableperformance in their organizations, to keep them functioning within narrow margins of allowable error. Reliability inparticular has become an important requirement for organizations. Managers attempt to "lock in" practices they can count onto hold their organizations within the bounds of "safe" operation.

Yet attaining highly reliable performance is very different from simple quality control measures or exhortations that "Qualityis Job One." Reliability is a complex and difficult organizational trait to achieve. In pursuit of it, many managerial instinctspush precisely toward strategies that threaten even the last vestiges of organizational slack.

What follows is a profile of one organization confronted with the highest imaginable demands for reliability in themanagement of a hazardous technology. The organization, a nuclear power plant,(1) has adopted some very unusualapproaches to this challenge. It is a case with important implications for managers everywhere, especially those concernedabout upgrading performance reliability in the face of diminished reservoirs of organizational slack.

A SURPRISING STRATEGY FOR HIGH RELIABILITY

The Diablo Canyon nuclear power plant, located just west of San Luis Obispo, California, commands a view of the PacificOcean that would be a tourist's delight. The access road from the outer gate to the plant site winds 7 miles through 10,120

acres of beautiful ocean-front canyonland. There is a farm along the way, complete with beef cattle and crops undercultivation. But all of the land is fenced, monitored, and protected by Pacific Gas and Electric Company (PG&E), theCalifornia utility that owns and operates the Diablo Canyon plant. Managing the land is simply one part of a complextechnical and organizational challenge connected with the nuclear generation of electric power.

It is accepted by everyone that nuclear power plants are a complex and inherently hazardous technology. But what is not aswidely appreciated is just how daunting an administrative and organizational task it is to manage them safely.

Some statistics may help. The Diablo Canyon plant has two separate units, each of which is capable of generatingapproximately 1,100 MW of electricity for a combined total at full output of 2,190 MW (enough to meet the electric powerneeds of an American city of 2 million). There are 1,250 employees on site at the plant plus over 1,100 outside consultants,staff augmentation, and service contract workers employed during scheduled maintenance overhauls or "outages."

By way of contrast, the same utility, PG&E, has a conventional fossil-fueled steam generating plant located near Pittsburg,California, approximately 35 miles east of San Francisco. This plant has seven generating units that together can produce2,007 MW of electricity, quite close to that of Diablo Canyon. Yet it has 287 employees on site--less than one fourth that ofDiablo Canyon, and typically needs no more than 25 additional employees under contract to do its largest overhaul job.

The functions of the extra 800 or so full-time Diablo Canyon employees gives some indication of just what is involved forPG&E in managing the technology of nuclear power. Both plants have the same rudiments of organization. There areOperations, Maintenance, and Engineering departments. Each plant has senior control operators, control operators, andassistant and auxiliary operators. Each has Maintenance personnel divided into Mechanical, Electrical, and Instrument andControl departments. But compare the numbers in each plant as detailed in Table 1.

[TABULAR DATA OMITTED]

Not only are the numbers of employees in operations, maintenance, and engineering departments up to four times higher thanat Pittsburg, but at Diablo Canyon, an additional 580 employees (18 at Pittsburg) have administrative and technical tasksbeyond operations, maintenance, and engineering. These tasks are related to reliability and safety. There are 115 employeesin security, 64 in radiation protection, 36 in quality control, 68 in work planning, and 27 for document services--typing,filing, distributing, and checking the accuracy of the procedures and drawings that govern operation of the plant.

In addition, the Diablo Canyon plant has a Nuclear Power Generation support group in the general office of PG&E in SanFrancisco (NPG/GO). Despite its location 300 miles to the north, this group is actively involved in the plant's operations. Itsdirector is a senior vice president of the company.(2) NPG/GO has approximately 711 employees, 387 alone in NuclearEngineering and Construction Services (NECS), which does construction work at the plant on an assignment basis. It alsohas a wide variety of nuclear engineers, systems analysts, regulatory compliance specialists, and emergency planners.

The numbers are daunting. That they are at least four orders of magnitude larger than a fossil fuel plant that can produce aroughly comparable amount of electric power is the consequence of several factors: the added complexity of nucleartechnology, the current political and regulatory climate surrounding nuclear power generation, and specific organizationalstrategies adopted for the management of this technology at Diablo Canyon.

ADDED PRESSURES FOR RELIABILITY

Beyond the basic technical and regulatory constraints, a number of strong, special forces pressure the Diablo Canyon plant toperform reliably. The plant has been under relentless public scrutiny since before its groundbreaking, in fact from the day ofthe initial licensing proposal. It took more than 10 years of continuous battle--in regulatory hearings, in the courts, in thestreets, and at the gate--before the plant was brought on-line in 1984. This turbulent political history has placed and continuesto place the Diablo Canyon plant under many organized and suspicious eyes as its day-to-day operations are conducted.

Further, the PG&E utility estimates that the daily gross revenue derived from the sale of electric power from each of theDiablo Canyon units is $2.4 million. At $100,000 per hour, one unit off-line for even a short period can have dramaticfinancial implications.

Finally, in 1988, the utility concluded an unprecedented agreement with the California Public Utilities Commission regarding

the electric power rates chargeable to northern California electricity consumers. This agreement allows the utility to setelectric power rates at a level that, with operation of Diablo Canyon at 58% of its average generating capacity over a 30-yearperiod, would allow the company to break even on the recovery of its $5.9 billion plant investment cost. Anything above thatcapacity factor means the company makes additional profits on the operation of the plant. Currently, the capacity average forDiablo Canyon, since both units were brought on-line in 1986, is 74%. In 1990-91, (excluding refueling outages), thecapacity factor averaged 91% for the two units.

With the close scrutiny and stringent operating reliability requirements to which the Diablo Canyon plant is subject, it isreasonable to expect a high degree of rigidity and formality in rules, regulations, and chain of command. Much of theliterature in organization theory argues for this, both theoretically and descriptively. When confronted with a hostile externalenvironment and an intensely focused set of internal goals, a high degree of organizational centralization and formality isusual (Mintzberg, 1979; Simpson & Gulley, 1962).

At Diablo Canyon, there is indeed a high degree of formality, much of it occurring in a myriad of written technical andadministrative procedures. But interestingly, these procedures do not support the centralization of authority. In fact, much ofthe formalization at the plant is meant to document and reinforce an elaborate balance, even fractionation, of administrativepower.

Sorting out this complex set of administrative powers proved to be a very challenging task. It was hard even for employees ofDiablo Canyon to describe organizational responsibilities and authority relations in a summary statement. It took scores ofinterviews and an extended set of observations over many different activities to begin to understand the complexinterdepartmental relationships.

The most differentiated set of administrative actors and the most frequent intersection of responsibilities occurred within thebroad domain of safety. Where error, oversight, or failure had foreseeable consequences that threatened individual orenvironmental safety, the administrative procedures were likely to be most elaborated and the interdepartmental interactionsmost intense.

SORTING OUT THE UNITS

It is helpful to describe some of the departments. There is a Safety and Emergency Services (SES) department at the plant. Itsdepartment head is responsible for traditional industrial safety--reporting and reducing employee injuries requiring medicalattention (IRMAs). The department consists of 7 contracted medical professionals, a hygienist, safety specialist fire marshal,3 safety assistants, and 6 fire watch employees who roam the plant every hour checking, among other things, to see that firedoors are closed.

The SES department has a responsibility for employee safety. Its members could actually shut down a job within the plant ifthey considered it to be an immediate threat to health and safety. There is also a plant Safety Committee, composed ofmembers appointed from each department. The committee can call attention to safety issues and lobby for their correction.

Besides the SES department, there is an On-Site Safety Review Group (OSRG) at the plant. OSRG has as its concern thelarger issues of public safety connected with the operation of the plant. Under Nuclear Regulatory Commission requirements,the OSRG has reporting responsibilities outside of the plant, to a manager of Nuclear Safety Assessment and RegulatoryAffairs in the utility's general office. An outgrowth of the Three Mile Island accident, OSRG is an attempt to establish asafety review process separate from the line of managerial authority at an individual plant. OSRG can examine plantoperating practices, plant design, and reportable events that might indicate the need for improved plant safety. In addition,OSRG representatives review and must sign off on individual work orders from a plant safety perspective.

Add to this the Radiation Protection department, responsible for radiation safety at the plant. The Radiation Protectiondepartment reviews and must sign off on all work orders executed inside the Radiological Control Area or "containment" (forwhich a special work permit is issued). This department is the official plant advocate for the "As Low As ReasonablyAchievable" (ALARA) radiation exposure control program required by the NRC. In addition, the department implements aForeign Materials Exclusion (FME) program that requires establishment of a controlled perimeter around any job site fromwhich materials could accidentally be dropped into the reactor vessel. It also must set up lead shielding where needed at jobsites and compile data on overall plant exposure levels. Radiation Protection can also stop a job on the basis of a measured or

projected radiation hazard.

The Chemistry department at Diablo Canyon monitors specified regulatory maximums of liquid and airborn effluents. Itsexternal regulatory overseers include the California Department of Health Services and the State Water Board. (Theprocedures for confined-space air sampling were drawn up jointly by Chemistry, Radiation Protection, and the Safety andEmergency Services departments.) Chemistry is responsible for the plant's inventory of hazardous materials. It givesguidelines to the other departments for their handling, storage, and inspection. Chemistry must issue a permit to theOperations department for the discharge of any batch of liquid radioactive waste as well as permits for continuous dischargesof nonradioactive wastes. The Chemistry department is responsible for monitoring and maintaining chemical control over allfluid systems in the plant.

In addition to these primary departments, there are other units at the plant that have safety concerns and internal regulatoryfunctions with respect to them. The Quality Control department conducts inspections of all jobs. Its inspectors must sign offon all work orders as well as the satisfactory completion of maintenance work. There is a separate Quality Assurancedepartment whose manager reports to the senior vice president of the utility. This unit is responsible for maintaining theoverall effectiveness of management controls at the plant. Specifically, it conducts "surveillance" inspections of work beingdone at the plant from a quality and safety perspective and oversees the quality level of all materials coming into the plant.(3)Both the QC and QA departments have the ability to stop jobs if their inspections reveal work practices contrary toestablished safety or quality standards.

Then there is the On-Site Regulatory Compliance (OSRC) group. This organization, which reports to the Nuclear SafetyAssessment and Regulatory Affairs manager in the general office, functions in many respects as a friendly surrogateregulator. It helps facilitate the plant's response to regulatory requirements, organizes the plant's internal reviews ofregulatory nonconformances, and coordinates the writing of reports to the Nuclear Regulatory Commission.

Further, there is an On-Site Planning and Engineering Group (OPEG). Also reporting to the general office, OPEG maintainsan independent surveillance of plant operations and maintenance activities to verify that these activities are performedproperly and that human errors are being reduced as far as practicable. OPEG advises utility management of overall safety atthe plant. In addition, it reviews technical procedure revisions and proposed equipment modifications.

The In-Service Inspection/Non-Destructive Examination department (ISI/NDE) is responsible for, among other things,maintaining compliance with the boiler inspection regulations established by the state's Division of Industrial Safety and thefederal regulations based on the American Society of Mechanical Engineers' Pressure Vessel Code. In its safety inspectionsISI and QC work in parallel. By agreement, ISI examines welds on pressure vessels and valves and QC looks at thecleanliness of the work setting. The nondestructive testing component is required by NRC regulation and uses suchtechniques as ultrasonic, x-ray, or eddycurrent testing to determine the existence of cracks or wear on metal surfacesthroughout the plant.

There are a host of other organizations that address issues of plant safety in their operation: a Technical and EnvironmentalServices Group (TES), part of a PG&E enterprise called ENCON, which, under a contractual arrangement to Diablo Canyon,monitors external radiation levels at sites removed from the plant, including monitoring the milk produced by cows at theranch within the plant's perimeter. TES also provides analytic expertise on a special projects basis to supplement the analyticcapabilities on site. In addition, there is the NECS organization, mentioned earlier, which is assigned to Diablo Canyon on amatrix basis for construction work and consultation.

Not only is there this multiplicity of organizations at Diablo Canyon, but a variety of interorganizational committees andgroups function to coordinate their activities and gain the necessary clearances required for work to proceed. A weeklymanagers meeting is held at the plant, combining not only department managers from Diablo Canyon but also seniormanagers from the nuclear power support group in the general office (NGP/GO). A Plant Staff Review Committee (PSRC)meets at least weekly to approve procedural and equipment modification and design changes. Its membership includesrepresentatives from all of Diablo Canyon's subunits. Technical Review Groups (TRGs) are investigative groups formed todiscover the cause of any regulatory nonconformances that occur at the plant. Their membership typically includesrepresentatives from the major groups. The same occurs for Event Investigation Teams (EITs), formed to investigate andreport on forced outages or "trips" that occur in either of the units, and in Safety System Outage Modification Inspectiongroups (SSOMIs), which meet to appraise proposed design changes from the standpoint of their potential impact on unit

shutdown and other plant safety systems.

Additionally, for scheduled outages, an Outage Control Center (OCC) coordinates maintenance work, materials, andclearances. There are representatives from each of the departments assigned to the center. Finally, there is a Work Planningunit that is responsible for planning jobs, gaining necessary clearances, and distributing relevant procedures to appropriateforemen. The assembling of a work "package," although coordinated by the Work Planning department, requires the reviewand sign-off by many of the departments noted above, giving them veto power over work performed at the plant.

NEGOTIATING THE COMPLEXITY

A classic organizational study entitled "The Hospital and Its Negotiated Order" (Strauss, Schatzman, Ehrlich, Bucher, &Sabsin, 1963) once described a complex pattern of reciprocal yet unstated agreements among doctors, nurses, aides,orderlies, and even patients themselves that governed operation of a psychiatric wing of a large urban hospital. This "order"was undergoing continual renegotiation--renewal, revision, or rejection--as day-to-day life at the hospital proceeded.

The authors of the hospital study attributed most of these fluctuations to the medical indeterminacy associated withpsychiatric care. The uncertainty was sufficient that each patient needed to be treated as a special case.

Yet the same phenomenon can be observed within the Diablo Canyon plant, a radically different setting in which technicalknowledge is hard, not soft, and where the need for standardization in the character and quality of job performance is apreeminent organizational requirement. Here, not only are a wide range of informal interorganizational agreementsobservable, their negotiation and continual renewal are recognized and embraced formally in the organization as an integralfoundation of its safe and reliable operation.

To understand this process, first understand that a major element in the order at Diablo Canyon is a remarkably elaborated setof formal procedures. As of May 1990, there were 4,303 separate written procedures at Diablo Canyon coveringadministration, operations, maintenance, radiation protection, and chemical and radiological analysis as well as thesurveillance and other testing activities conducted by OSRG, QC, QA, and OPEG.(4) Each procedure in turn has amultiplicity of specified steps. The average procedure has undergone well over 3 revisions (one has 27). There are formalprocedures for the drafting of procedures as well as separate procedures for altering procedures.

The number and growth of procedures at Diablo Canyon has been startling. Indeed no one at the plant could remember asuccessful case of procedural simplification, despite numerous attempts. Typically, efforts to simplify have required thatrewritten procedures be reconciled with other existing procedures, with the result that there are more specified proceduralsteps afterward than before. Importantly, the greatest rise in procedural complexity centers around those tasks that crossdepartmental lines or that require interdepartmental coordination and participation.

The procedural density at Diablo Canyon appears to be self-generating to a significant degree. The more detailed thespecification of one task, the greater the pressure to similarly formalize its associated tasks. There is a zealotry associatedwith proceduralization at the plant. From department managers down to technician-level employees, individuals seem attimes to vie with one another for initiatives in the drafting of new procedures. This is a means of demonstrating technicalvirtuosity for all to see, but it also appears to be part of a wider commitment to "perfect" the management of theorganization's technology.

Each procedure encapsulates new experience (often won the hard way through error) in a form that will guarantee itsapplication, irrespective of the personnel who must apply it. In this respect, the procedures are a hoped-for cumulative path tolearning, a way of specifying all possible conditions that can be assumed by the technology under plant control. Admittedly,procedures are a way to "person proof" task performance, to standardize work so as to reduce the possibility of error.Additionally, as one manager argued, formalized procedures are also a method of employee self-protection--if workersfollow procedural guidelines to the letter they can escape blame for any problems that later develop.

It is well known that in organizations with elaborate sets of formal procedures, informal adjustments typically occur thatsoften their application, even to the point of ignoring given procedures altogether in favor of employee convenience orgreater organizational flexibility and responsiveness (Simon, Smithburg, & Thompson, 1950). These adjustments are likelyto happen whether recognized or not by higher management.(5)

But at Diablo Canyon, work-to-rule is the established norm for operations--not only formally but informally. Scores ofinterviews, both formal and informal, uncovered practically no admitted examples of procedural bypasses or informalmodifications. Although there was considerable complaint about the mass of procedures and their detail, particularly amongshop- or craft-level employees, literally no informal culture could be detected that embraced a softened application ofprocedural prescriptions in actual work.

In fact, the interdepartmental accommodation and adjustment process is itself represented quite formally in proceduralrevision processes. Many people referred to the procedures at Diablo Canyon as a "living document." Before an outage,particularly, hundreds of new procedures and procedural revisions are written and approved in a streamlined process. Inaddition, even faster "on-the-spot changes" can be made and approved as work may require. However, these changes allfollow formal procedural guidelines. They must all be formally approved by the Plant Staff Review Committee.

NEGOTIATED ORDER AND THE PROMOTION OF SLACK

Why, with so many formal procedures, does an organization attempting to maintain high degrees of reliability need to havecontinual negotiation and renegotiation among its components? Moreover, how does an organization allow for negotiatedagreement under a web of such formalized procedures? The answers to these questions lie in an evolved strategy pursued atDiablo Canyon for the achievement of a special type of slack deemed crucial to the maintenance of operational reliability.

At the outset of this article, two types of slack were distinguished--resource and control. But there is a third kind, what wewill term conceptual slack. Conceptual slack is a divergence in analytical perspectives among members of an organizationover theories, models, or causal assumptions pertaining to its technology or production processes. This divergence is notabout what an organization is doing but about how it is doing it. Conceptual slack can be assessed negatively as confusion orambiguity in an organization's knowledge base. But it can also be assessed positively, as protection against what organizationtheorist Karl Weick has termed "errors of rendition," a form of integrated organizational illusion (Weick, 1987). It is just thissort of protection that has been sought at Diablo Canyon through the promotion of conceptual slack. The foundation of thisslack is an institutionalized aversion to what might be termed errors of "aggressive hubris."

At Diablo Canyon, there is a widespread recognition that all of the potential failure modes into which highly complextechnological systems could resolve themselves have yet to be experienced. Nor have they been exhaustively deduced. In thisrespect, the technology is still capable of surprises. In the face of this potential for surprise, there is a fundamental reluctanceamong higher management to put decision or action frameworks in place that are not sensitive to the possibilities of analyticerror. A comprehensive or rigidly coordinated chain-of-command, after all, might well err comprehensively.

The culture of the organization supports this aversion and it is reflected even in an "organizational personality" thatpredominates at the plant. Repeatedly mentioned as personality traits desirable among employees or co-workers werecoolness and caution. "People who are not excitable, who analyze before they act" or "people who are willing to back off attimes" were cited as desirable "types" for Diablo Canyon.

Perhaps more importantly, a surprising variety of interviewees specifically volunteered the undesirability of one trait: hubrisor "bullheadedness." A Radiation Protection general foreman asserted, for example: "There is a real danger in having veryheadstrong people intent on their own way." A Quality Control inspector volunteered that "people who have a belief they areinfallible can have a very negative impact here."

What is sought in personality is expressed in organizational structure. The division of organizational authority is a structuralinsurance against thoughtless or hasty action. The variety of veto powers distributed at the plant make it less likely that sinsof hubris will be committed, particularly where inaction is an inherently safer state than action. Importantly, under thosecircumstances where fast action is required to attain a safe condition--such as when the shutdown of a reactor is required--either automated systems (such as an automated "trip") or intradepartmental autonomy (such as operator discretion) arepreeeminent.

But the array of veto or delaying powers throughout the plant make it essential that constant adjustment and accommodationbe sought to make the system work. The accommodations and renegotiations address the continual reinforcement of threekey values at the plant: credibility, trust, and attentiveness. These are constantly mentioned in all departments as essentialsfor successful operation of Diablo Canyon. They are also acknowledged to be exceedingly perishable and evanescent.

Credibility between departments means that skill levels must be mutually recognized. It also means that a given department'sinconveniences to another must be understood to be based on a legitimate concern and not the result of arbitrariness orincompetence. For example, it took some time for the Non-Destructive Examination department to establish credibility for itsindirect method of testing, particularly before it could confront plant managers with proposals for costly or time-consumingrepairs or replacements, the need for which could be established at times only on the basis of probabilistic measurements. Asone of its members noted, "At best I'm going to cost them money and impact their schedule."

Similarly, Chemistry has to maintain credibility of instrumentation to get rapid responses from operators when indicatorsreveal impurities or imbalances in water or condensate chemistry. Quality Control needs Maintenance to accept that QCinspectors know what they are talking about when they question the way a job is done. Maintenance has to establish its owncredibility with Operations so that preventive maintenance that requires operator clearances can be done in a timely manner.Operations, in turn, has had to convince Maintenance and the outage manager that their reactor unit shutdown procedures areright and cannot be hurried. Regulatory Compliance has had to establish a credible image that it is attempting to solidify theplant's position vis-a-vis its regulators and has not become a hostile regulator itself.

"Trust," described by one assistant plant manager as "the lubricant of the organization," refers to the expectation that prioragreements and negotiated arrangements will be upheld and honored over time. The importance and fragility of such trustwas amply demonstrated in one incident during a refueling outage. A Radiation Protection inspector stopped a maintenancejob because the scaffolding erected for it protruded over the reactor vessel in violation of the NRC's Foreign MaterialsExclusion (FME) regulations. The Maintenance foreman accused the Radiation Protection department of reneging on itsagreement that the scaffolding design would be acceptable. "They're changing the rules in the middle of the game," hecomplained bitterly.

Later it was discovered that a new agreement had been negotiated between the Radiation Protection officer and the nightshift foreman to make minor modifications in the design of the scaffolding in order to comply with FME requirements. Thenight shift foreman had neglected to update the day shift foreman. Seeing the scaffolding, the Radiation Protection inspectorfor his part believed that Maintenance had reneged on the agreement. Both the Radiation Protection and Maintenance generalforeman took special pains to clarify the situation and restore amicable relations between the two departments.

Credibility and trust are perishable properties within any organization. They have to be continually nurtured and renewed ifthey are to survive. As the Diablo Canyon Operations manager put it, "Trust is important. You have to talk to people a lot tohold it." The Chemistry department manager agreed: "Every day is a new day in interrelationships and in holding on to trust.It never gets institutionalized."

Credibility can vanish with departmental error, misunderstanding, or miscommunication. The constant stream of meetingstaking place at the plant seems to nurture credibility and trust. Every Friday there is a plant manager's meeting at 10 a.m. andPSRC meetings at 1 p.m. (often running several hours). There are almost daily Technical Review Group meetings to conducterror investigations at the plant. A given TRG may meet several times before it is able to draft a Non-Conformance Report, aLicense Event Report or a Justification for Continued Operation. There are Event Response Team meetings after anautomatic plant shutdown as well as briefings conducted for special visits by general office officials or external officials suchas Institute of Nuclear Power Operators (INPO) representatives. During outages, there are outage updates and briefings twicea day for all departmental representatives as well as interdisciplinary work team meetings throughout the day.

These are all interdepartmental meetings (there are also a variety of departmental meetings such as the crew briefings or"tailboards" held at the start of each shift). They serve not only to help coordinate interdepartmental activities but to maintainlines of communication, clarify or redress misunderstandings, and ease strain that might have developed between two ormore departments in the course of everyday work.

It is perhaps no surprise that two qualities frequently mentioned as highly valuable for plant personnel were friendliness andskill in interpersonal relations. These qualities facilitate the development of credibility and trust needed between departmentsto effect the coordination of complex tasks. They are important elements in preventing jurisdictional antagonisms that couldparalyze operations at the plant.

Besides trust and credibility, watchfulness is another perishable quality constantly nurtured by the management of the plant.A major enemy to high reliability is thoughtless action or mindlessness in job performance. It is dangerous in two respects: It

can lead to carelessness in carrying out a prescribed task and it can deny the organization an important resource with whichto detect the unexpected. Unfortunately, mindlessness tends to be a default state for human beings confronted with routine.Its opposite, mindfulness, requires a positive and varying set of stimuli (Langer, 1989).

One example of the erosion of attentiveness is the recurring incidents of "wrong-unit" errors among maintenance workers.The two reactor units at Diablo Canyon have nearly identical components and displays. Without watchfulness, it is possiblefor a maintenance technician accidentally to begin work on the wrong unit, or forget the unit on which he is actuallyworking. There is an ebb and flow to these incidents of what has been termed "wrong-unit-itis." During one period, a majorreduction of wrong-unit errors occurred with a new procedure requiring maintenance technicians to sign a form declaring theunit on which they were working. There was a great deal of anger expressed about this seemingly trivial and demeaningprocedure, but the incidents of error were dramatically reduced. More recently, however, this procedural item is now itselftaken for granted and incidences of wrong-unit error are again on the rise. As an assistant plant manager put it, "The angerhas subsided; now we need to renew the fervor."

A similar example of fluctuating attentiveness can be found in injuries requiring medical attention (IRMAs) at the plant.There has been for some time an established statistical pattern in which IRMAs decline in absolute numbers during outageperiods and rise during more routine nonoutage periods. This despite the fact that outages are high-intensity periods for theplant, with hundreds of extra people brought in under contract, many of whom might be unfamiliar with the plant, and tens ofthousands more maintenance jobs (over 90,000 individual action items) to be done than under normal operations. That therate of injury actually declines over this vastly increased number of jobs conducted under far more explicit time pressure isgenerally regarded to be a result of the extra attention and care expended during this high-intensity period.

"Renewing the fervor" is a constant challenge to an organization seeking to maintain high reliability in its performance. Extraeffort and attentiveness are, after all, extra. They are beyond the levels attained at psychological and cultural equilibria forhuman beings. As a consequence, there is a fluctuation in this kind of organizational property. Sometimes errors or incidentsthemselves heighten watchfulness. In other cases, a new procedure or managerial campaign is required. But each renewal issubject to its own inevitable decay.

MANAGERIAL STRATEGY AND THE THEORY OF RELIABILITY

Out of the analysis of these processes of decay and renewal emerges an important proposition about the pursuit of reliabilityat Diablo Canyon. Consider briefly two theories of reliability that could be applied to the performance of complex, hazardousoperations (Wildavsky, 1989). Under one theory, reliability would stem from a constant, certain, predictable set ofperformances. All system conditions would be fully specified and anticipated. Term this the "anticipatory model" ofreliability--an approach that equates reliability to invariance. Here an organization ought to determine its functions, or at leaststrive to determine them, unambiguously and completely. Once "correct" job performance is specified, it should be "lockedin" once and for all through formal procedures, unvaryingly applied. A unified chain of command guarantees swift action andpreserves the "perfect" model.

But a second approach to reliability is possible. Here reliability would be equated not with invariance but with resilience.Being responsive to, rather than trying to weed out, the unexpected would be the ultimate safeguard of stable performance.Despite the knowledge and elaborate procedures of an organization, its technology, it would be believed, is still capable ofsurprises. This expectation of surprise would not only be a state of mind, it would be recognized as an importantorganizational resource. Under this model or reliability, an organization would value its capacity for real-time discovery asmuch as its ability to control by anticipation.

Diablo Canyon is by no means a pure example of this second theory in operation. There is a great deal of formalizaiton,hierarchy, and anticipatory analysis. There seems to be no limit to the commitment to understand and predict everything thatcould go wrong (through risk assessment) or that has gone wrong (through "root cause" analysis).

At the same time, it is recognized that these efforts are as yet incomplete and that the technology of the organization is stillcapable of significant surprise. This recognition has moved Diablo Canyon managers to adopt important features of thesecond approach to reliability. The negotiated order of the plant is part of a process of constant tending that wards offcomplacency and rigidity and promotes a protective conceptual slack.

The proposition that emerges from analyzing Diablo Canyon is that reliability is not the outcome of organizationalinvariance, but, quite the contrary, results from a continuous management of fluctuations both in job performance and inoverall departmental interaction. It is the containment of these fluctuations, rather than their elimination, that promotesoverall reliability at Diablo Canyon.(6)

RELIABILITY, ORGANIZATION, AND POLITY

There are important parallels between Diablo Canyon's strategy of error prevention and the organization of a political systemto prevent the abuse of power.(7) The differentiated yet overlapping authority of the plant is equivalent to the separation ofpowers. Maintaining credibility and trust are equivalent to "constitutionalism" (the voluntary restraint on the exercise ofpower) within a polity.

Initially, it might be supposed that elaborately formalized procedures would introduce rigidity that would underminenegotiation and adjustment. Ironically, the writing of procedures is the negotiation process and their revision part of anongoing interdepartmental system of signaling and bargaining. Like legislation in the polity, the procedures function tolegitimate and protect political agreements. They are in important respects a scorecard of adjustments and accommodationsreached, not a threat to them.

Although the elaborate distribution of veto powers at Diablo Canyon and the negotiated agreements reached between thepower-holders might seem quite familiar within the context of a democratic polity, it is decidedly not the norm in the cultureof most organizations. This is especially true of organizations that must cope with danger or threat as part of their technicaloperation. There is a constant temptation under these conditions to "engineer" everything--to establish once and for allconsistent, unambiguous guidelines and to tolerate no competing organizational perspectives or objectives. This temptationexists for Diablo Canyon as well. Whether the organization will be able to retain its complex and fluctuating configuration isunclear.

The system at Diablo Canyon, like the American political system, evolved under conditions of abundance. There were few, ifany, resource constraints applied to the plant. Its budget since start-up has grown an average of 20% a year. But throughoutthe PG&E utility, stricter market-based accounting has tightened resources and more closely tied their allocation to marketreturn. What impact budgetary stringency will have on organizational negotiations is unknown. Already, interdepartmentalfrictions reportedly have increased with the successful effort to reduce the duration of scheduled outages.

Surprisingly, one of the strongest challenges to the internal separation of powers at the plant comes not internally but fromexternal regulatory organizations. As the plant manager describes it, Diablo Canyon is under continual pressure from theNuclear Regulatory Commission and the California Public Utilities Commission to tighten up its chain of command andclarify lines of responsibility and accountability at the plant. This pressure results from a demand for greater responsivenessto regulatory requests and commitments. Unambiguous lines of responsibility would clarify accountability for the regulators."It's hard to get anyone here to own up to anything" was the exasperated complaint of an NRC resident inspector stationed atDiablo Canyon.

But yielding to this pressure might well deny Diablo Canyon some very important organizational protections from an overlyrigid approach to reliability. Too much clarity in organizational authority might well increase the potential for "authoritative"error. Well-integrated organizations, with fully consistent authoritative relationships, can become vulnerable to a form of"resonance" in which even quite small unexpected events are magnified into aberrant outcomes (Schulman, 1989). It wouldbe painfully ironic if, while trying to improve regulatory responsiveness, regulating agencies themselves were to decrease theorganizational slack used to promote reliability in a nuclear power plant.

IMPLICATIONS FOR AN ERA OF DECLINING SLACK

The Diablo Canyon case is an important example to other organizations that, under diminished slack, attempt to lock in"safe" levels of performance. As managers attempt to engineer this reliability through formalized procedures and hierarchicalcontrol systems that seek to promote invariant behavior, they reduce even further some forms of organizational slack thatmay well help to promote the very reliability they seek. Unless managers can be sure there are no hidden uncertainties in theknowledge base from which they derive procedures and are confident that no surprises lie in wait, efforts to insureorganizational invariance are undertaken at considerable peril (Landau & Stout, 1979; Schulman, 1993).

Instead, the toleration, even the protection, of key organizational ambiguities allows an organization to learn and cope withthe unforeseen. The lesson from Diablo Canyon is that a core capability of adaptation and resilience is the key to maintainingorganizational reliability at the highest levels. Managers work against this objective when they associate reliability withinvariance and organize as if nothing remained to be learned about even repetitive, routine tasks. Then, ironically, it ismanagers themselves who conspire to deplete even the last vestiges of their protective slack.

NOTES

(1.)Recently, a group of researchers was given the rare opportunity to observe this organization, the Diablo Canyon nuclearpower plant, closely over an extended period. The researchers were part of the High Reliability Organizations group of theUniversity of California, Berkeley, studying in addition to Diablo Canyon, a nuclear aircraft carrier, the air traffic controlsystem of the Federal Aviation Administration, and the management of a major electric power grid for northern California.The research techniques included direct observation, interviews, and survey research. In addition to the author, otherparticipants in Diablo Canyon research were Todd LaPorte, Karlene Roberts, Gene Rochlin, and Alexandra Suchard, all ofthe University of California. For a general statement of the work of this research group, see LaPorte and Consolini (1991),and for further findings, see Roberts (1993).

(2.)In addition, the plant manager at Diablo Canyon has been appointed a vice president at PG&E and the plant has beendesignated a separate "business unit" of the company.

(3.)There is a uniform set of "nuclear grade" manufacturing standards that apply to all equipment used at nuclear powerplants.

(4.)It is typical of the elaborate computerized management information system at the plant that all of the procedures are on-line and that an actual count is kept of procedure totals. Few other organizations, even those with high reliability objectives,would have either as many or as organized a system for keeping count. By way of contrast, for example, a hospital in the SanFrancisco area with 1,700 employees, roughly similar in size to Diablo Canyon, has, by best estimate, less than half itsnumber of written procedures.

(5.)They are particularly likely when procedures are drawn to the point where they are mutually contradictory or threaten theachievement of competing goals if adhered to religiously. These excesses are one reason why "work-to-rule" can be such adevastatingly effective labor tactic when used against an organization by workers in labor-management disputes.

(6.)There are interesting theoretical correspondences to this conclusion in the literature pertaining to the evolution ofcomplex systems in nature. In physics, Prigogine and Stengers (1984) have described a process of "stability throughflucturation" by which more highly integrated systems evolve from simpler ones. In ecology, C. S. Hollings (1973) haswritten about the importance of resiliency over invariance in the overal survival of species within ecological niches.

(7.)For a classic discussion of error prevention and political organization, see Landau (1969).

REFERENCES

Fayol, H. (1949). General industrial management. New York: Pitman.

Hollings, C. S. (1973). Stability and resilience. Annual Review of Ecology and Systematics, 4, 1-23.

Landau, M. (1969). Redundancy, rationality and the problem of duplication and overlap. Public Administration Review, 29,346-358.

Landau, M., & Stout, R. (1979). To manage is not to control: Or the folly of Type-II error. Public Administration Review,39, 148-156.

Langer, E. J. (1989). Mindfulness. New York: Addison-Wesley.

LaPorte, T. R., & Consolini, P. (1991). High reliability organizations: Challenges to organization theory. PublicAdministration Research and Theory, 1, 19-47.

March, J. G., & Simon, H. (1958). Organizations. New York: Wiley.

Merton, R. K. (1952). Bureaucratic structure and personality. In R. K. Merton (Ed.), Reader in bureaucracy (pp. 361-371).New York: Free Press.

Mintzberg, H. (1979). The structure of organizations. Englewood Cliffs, NJ: Prentice-Hall.

Prigogine, I., & Stengers, I. (1984). Order out of chaos. New York: Bantam.

Roberts, K. H. (Ed.). (1993). New challenges to organizations. New York: Macmillan.

Schulman, P.R. (1989). The "logic" of organizational irrationality. Administration & Society, 21, 31-53.

Schulman, P. R. (1993). A comparative framework for the analysis of high reliability organizations. In K. H. Roberts (Ed.),New challenges to organizations. New York: Macmillan.

Simon, H. A., Smithburg, D. W., & Thompson, V. A. (1950). Public administration. New York: Knopf.

Simpson, R., & Gulley, W. (1962). Goals, environmental pressure and organizational characteristics. American SociologicalReview, 27, 344-351.

Strauss, A. L., Schatzman, D., Ehrlich, R., Bucher, R., & Sabsin, M. (1963). The hospital and its negotiated order. In E.Friedson (Ed.), The hospital in modern society (pp. 147-169). New York: Macmillan.

Weick, K. (1987). Organizational culture as a source of high reliability. California Management Review, 29, 112-127.

Wildavsky, A. (1989). Searching for safety. New Brunswick, NJ: Transaction Books.

Abstract:

A study of reliability factors in organizational settings was made based on the admnistrative and working set-up in a nuclearpower plant. The case study offers an alternative model for organizational performance requiring high reliability. Instead ofmaintaining rigid and formal authority positions, management efficiency in this case is associated with handling changes inorganizational relationships and practices.

Source CitationSchulman, Paul R. "The negotiated order of organizational reliability." Administration & Society Nov. 1993: 353+. AcademicOneFile. Web. 27 Jan. 2012.

Document URLhttp://go.galegroup.com/ps/i.do?id=GALE%7CA14525754&v=2.1&u=s8888903&it=r&p=AONE&sw=w

Gale Document Number: GALE|A14525754