NORMAL ACCIDENTS: LIVING WITH HIGH-RISK TECHNOLOGIES. By Charles Perrow. New York, N.Y.: Basic Books, 1984. Pp. x, 386. Cloth $21.95. Shortly after midnight on December 3, 1984, a Union Carbide pesticide plant on the outskirts of Bhopal, India, experienced a gas leak. Within minutes of the event, dozens of nearby residents lay dead or dying. In the days that followed, thousands more died from the effects of the toxic gas.' It was, by all accounts, the worst industrial disaster since the onset of the industrial age three centuries ago. Months later, Union Carbide officials were still un- able to agree on what caused the accident. 2 Investigation of the astonishing series of human and mechanical breakdowns raised some troublesome questions: Who was responsible for designing and installing the faulty equipment which led to the discharge of deadly methyl isocyanate gas? As the accident unfolded, why were danger signals, such as rising pressure in the gas tanks, ig- nored by Union Carbide employees? When a supervisor was in- formed of the leaking gas, why did he postpone an investigation until after his tea break? Why were emergency procedures for evacuating the plant and nearby town completely ineffective? Perhaps most important, should an industrial calamity like Bhopal cause government agencies and other decision-makers to re-eval- uate their standards as to what risks are acceptable and what im- pacts on the environment might result from accidents involving various technologies? In NORMAL ACCIDENTS, Professor Charles Perrow provides some less than reassuring answers. Although NORMAL ACCIDENTS was published half a year before the tragedy in India, Perrow's analysis of why complex industrial systems fail demonstrates that man-made disasters, far from being unusual, are inevitable when high-risk technologies are involved. 3 This assertion is not merely alarmist hyperbole; it is an opinion formed after meticulous study of diverse industries and industrial settings. The author does not I. Iyer, India's Night of Death, TIME, Dec. 17, 1984, at 22. 2. Weisman, India Says Carbide Itself Is Responsible, N.Y. Times, Mar. 22, 1985, at D14, col. 1. 3. For a discussion of how likely the eventuality of disaster must be before a federal agency has to acknowledge the contingency, see Comment, CEQs "Worst Case Analysis" Rule for EISs: "Reasonable" Speculation or Crystal Ball Inquiry?, 13 ENVTL. L. REP. (ENVTL. L. INST.) 10,069 (March 1983). 296 COLUMBIA JOURNAL OF ENVIRONMENrAL LAW [Vol. 10:295 advocate closing down all high tech industries that are subject to unavoidable accidents. Rather, he searches for institutional flaws in each industry by examining its accidents, much as a computer analyst would look at output errors in order to "debug" a pro- gram. Once the flaws are identified they can be corrected by the specialists in each field so as to minimize future risks. After a thorough exposition of his findings, the author proposes his own methodology for risk-benefit analysis of technology-created dan- gers. He suggests that the unalterable fallibility of industrial sys- tems, considered with the relative potential for catastrophe and other elements such as the identity of future accident victims, must lead to the redesign of some systems and the eradication of others. In short, NORMAL ACCIDENTS is an explication of the au- thor's view of the proper philosophical focus of risk assessment. This volume provides a new perspective on the dilemma recog- nized by Philip Handler, former president of the National Re- search Council, when he asked in the particular context of energy alternatives: Are the estimated risks of nuclear power plants too great to be acceptable; are they more or less acceptable than those associ- ated with coal combustion? Is a very small probability of a very large catastrophe more or less acceptable than a much larger probability, indeed, almost a guarantee of a small number of casualties annually? 4 Professor Perrow, a Yale University sociologist, begins by briefly expounding his essential thesis. Nuclear power plants, chemical plants, air traffic control, genetic engineering and other advanced-technology enterprises should be viewed as integrated units, or "systems." Increasing populations impose ever-greater demands on existing systems and force new, more complicated systems to arise.5 New systems employ sophisticated technolo- gies and create new risks. Risks inherent in all these systems are often magnified by a system's structure and by the way in which failures or breakdowns can interact. The common feature of high-risk systems is that they are "tightly coupled": like individual 4. Handler, Some Comments on Risk Assessment, in National Research Council, THE NA- TIONAL RESEARCH COUNCIL IN 1979: CURRENT ISSUES AND STUDIES, Annual Report of the National Academy of Sciences (1979). 5. Perrow does not claim that this progression is the only impetus for technological growth; changes are as likely to come from "technology-push" as "demand-pull" (p. 39). steps in a computer program,6 there is a manifold interdepen- dence between various components that precludes isolated or dis- creet breakdowns. Once a breakdown occurs, affected components may react in ways that had not been (and often could not have been) anticipated by the operators, managers or design- ers of the system. Thus, interactions caused by the initial break- down "are not only unexpected, but incomprehensible for some critical period of time" (p. 9). Since humans and mechanical de- vices are not flawless, some failures must be expected. Because component parts and processes are tightly coupled, and because seemingly trivial breakdowns can lead to unforeseen interactions, a certain number of "system accidents" will be inevitable. System accidents, the "unanticipated interaction of multiple failures" (p. 70), are normal in the sense that there is no question whether they will happen, but only a question of how soon. In support of this conclusion, Perrow presents in Chapter 1 a technically detailed account of the accident at the Three Mile Is- land (TMI) nuclear facility. His description of the 1979 occur- rence reveals a highly interconnected system in which component malfunctions rapidly combined in unexpected ways to cripple the plant and nearly caused a meltdown. 7 Besides providing a ser- viceable paradigm for his basic thesis, the discussion of TMI al- lows Perrow to respond to some obvious objections. For example, accidents such as TMI are often blamed primarily on plant operators rather than the system itself. A retrospective view of the facts surrounding TMI makes plausible the beguilingly op- timistic suggestion that the mishap was an isolated one, brought about solely by human error in various aspects of plant opera- tions.8 Perhaps a different organizational structure or more 6. In a tightly coupled system, a breakdown in one part of the system leaves little time to prevent the failure from spreading to other parts. The microseconds between a computer response to a faulty program command obviously allows no time for correction. However, the author would point out that computer programs are "linear," i.e. they operate in a pre- determined sequence, while breakdowns in industrial situations are "complex" because the sequence of system dislocations cannot always be predicted, and may remain uncertain even after the event (pp. 72-79). 7. The Department of Energy recently disclosed that the core temperature was much higher than previously thought, and that some of nuclear fuel actually melted. N.Y. Times, Feb. 22, 1985, at B2, col. 2. 8. Representative of this view was the President's Commission Report, which concluded that the major cause of the accident was ". . .inappropriate operator action .. " Presi- dent's Commission on the Accident at Three Mile Island, THE NEED FOR CHANGE: THE LEGACY OF TMI, at 11 (1979). 1985] Book Review 297 298 COLUMBIA JOURNAL OF ENVIRONMENTAL LAW [Vol. 10:295 elaborate automatic safety devices could have prevented the en- tire occurrence, or at least contained it at an earlier stage. Perrow points out, however, that there is a built-in organizational para- dox in high-risk systems. Tight coupling dictates that control of operators must be centralized; any deviation by an individual op- erator from prescribed sequences would upset the system's deli- cate balance. But since system accidents develop from unforeseen interactions of component failures, system operators must be free to take independent and creative action. This para- dox cannot be resolved without changing the system altogether. Perrow also meets head-on the argument that employing more fail-safe mechanisms would have circumvented the accident. While additional back-up equipment ("technological fixes") or in- stitutionalized double-checks in the system ("redundancies") are reassuring, there is no reason to think that they can prevent every accident. First of all, he says, there is no guarantee that the "safety valves" will work. An automatic back-up device might it- self fail to function. Even if the device operates as planned, the magnitude of the accident may overwhelm it.9 Second, safety systems are designed to handle only exigencies which have been anticipated. A failure or series of failures may interact to produce wholly unexpected circumstances. The difficulty of determining beforehand what back-up systems or "defenses in depth" to in- stall is compounded by the lengthy design and construction lead times required for high technology plants. If Perrow's analysis is correct, why have there not been more nuclear accidents like the one at Three Mile Island? The author suggests that the accidents simply have not had time to occur. Nuclear power is a relatively young technology. Taking into ac- count differences in plant scale, types of reactor technology and manufacturer design further reduces the amount of actual operat- ing experience the nuclear industry can claim for each reactor. Lack of operating experience is not in itself a reason to discon- tinue further development of a technology. It proves to the au- 9. This was clearly illustrated by the events at Bhopal. A gas "scrubber" which would have neutralized toxic effects of escaping gas did not operate because the gas pressure exceeded the scrubber's design limits. Another device which did operate sprayed water into the air to form a curtain around the escaped gas. However, the curtain reached only one hundred feet into the air, while the gas floated about thirty feet higher. Finally, a number of buses which had been provided to evacuate the neighboring village in just such an emergency were totally forgotten in the heat of the crisis. The Disaster in Bhopal: Workers Recall Horror, N.Y. Times, Jan. 30, 1985, at AI, col. 1. Book Review thor, however, that not enough is known about nuclear power at present to allow construction of a facility that is perfectly "safe."' 0 In light of his view that tight coupling and complexity make some accidents unavoidable, and since nuclear accidents may have catastrophic results, Perrow concludes that nuclear technology, whether used in the production of energy or in weap- ons systems, should be abandoned (p. 304). Perrow's analysis of technological systems as organizational structures inherently vulnerable to failures resulting in accidents and possibly disaster is ground-breaking. However, his conclu- sion that nuclear power is an unacceptable risk is based not only on the inevitability of accidents but also on the identity of the victims: Most of the work concerned with safety and accidents deals, rightly enough, with what I call first-party victims, and to some extent second-party victims. But in this book we are concerned with third- and fourth-party victims. Briefly, first-party victims are the operators; second-party victims are non-operating per- sonnel or system users such as passengers on a ship; third-party victims are innocent bystanders; fourth-party victims are fe- tuses and future generations. Generally, as we move from op- erators to future generations, the number of persons involved rises geometrically, risky activities are less well compensated, and the risks taken are increasingly unknown ones. . . . With nuclear power, nuclear weapons, and arguably, recombinant DNA, we have entirely new systems with catastrophic potential for third- and fourth-party victims (pp. 67, 307). Although he is indignant about cost-benefit considerations that attach dollar values to human life, such as Ford Motor Company's decision not to buffer the Pinto fuel tank, Perrow himself has diffi- culty in balancing lofty concepts of human dignity with the need for a rational decision-making basis. His use of "catastrophic po- tential" as a criterion for judging that a technology is safe seems to be a euphemistic circumlocution for what is essentially a body count: I have ignored first-party victims entirely, assumed that for sec- ond-party victims (mostly passengers) that over 100 deaths would count as a catastrophe, but the following analysis would remain the same if the deaths totalled over 200. For third- and i0. This view is no longer heresy. The Nuclear Regulatory Commission recently stated that there is at least a fifty percent chance of a nuclear accident more severe than TMI before the year 2005. Wald, By 2005, Nuclear Unit Sees 50-50 Chance of Meltdown, N.Y. Times, Apr. 17, 1985, at AI6, col. 1. 1985] 300 COLUMBIA JOURNAL OF ENVIRONMENTAL LAW [Vol. 10:295 fourth-party victims the most catastrophic systems are esti- mated to be nuclear power plants, nuclear weapons systems, and DNA accidents; all of these could be very, very large in- deed. Somewhat further behind are chemical plants (largely vapor cloud explosions and release of such toxins as chlorine gas) and marine accidents with toxic chemicals at sea or in port, or explosions in port. Both chemical plants and marine acci- dents would involve third- and fourth-party victims, but in the hundreds, normally, rather than the thousands or millions (p. 343). Perrow is careful to exclude from his count of "victims" those who are injured by "run of the mill pollution" (p. 70). This points up a rather serious weakness in Perrow's proposed view. While he quite laudably adds a consideration of intergenerational interests often absent in discussions of risk assessment, he is re- grettably so absorbed in the analysis of systems that he devotes only a few pages to the issue of incremental damage, such as en- vironmental pollution, which represents only a minimal problem in any individual quantifiable step and which escapes altogether his definition of accidents. His lack of attention to the problem is demonstrated by the fact that he finds only the unconvincing term "externalities" under which he sweeps together "pollution, large accidents, enfeeble- ment of the working class" as well as "cleanup from toxic sub- stances" and "rebuilding after a dam failure" (p. 340). He identifies these "externalities" with "social costs of (system) activ- ities" (p. 341). Clearly, the thoroughness of his investigation and the clarity of his topology fails him here. He only suggests the problem in roughest outline: in reference to acid rain he says with curious detachment "the externalities drift over several states and the Canadian border - we are now beginning to acknowledge this" (p. 341). In light of the author's earlier concern with the extent to which accidents cause injuries to future generations, his cursory treatment of long-term environmental and social costs of "ordinary" pollution seems strangely myopic. Yet he does at least suggest that valuation of externality costs must play a role, along with technology reassessment and identification of poten- tial victims, in determining how high-risk systems should be redesigned. In delineating the elements that provide the touchstones for his proposed re-evaluation of high-risk systems, the author engages in an economic balancing that is admittedly "impressionistic" (p. Book Review 342). What sets Perrow's work apart from pure cost-benefit anal- ysis, which he bitterly reviles for "its . . .concern with the dollar as the ultimate solvent of all things social" (p. 310), and from risk assessment, which "all too frequently . . . conveniently supports the activities elites in the public and private sectors think we should engage in" (p. 3 14), is his elevation of public health as a public good to be protected from the Pareto optimality-seeking economists and the politically motivated risk assessors. Cata- strophic potential requires a much higher level of safety than that provided by the unrestricted play of market forces." In fact, where high-risk technologies are involved, Perrow finds no indication that public demand for a low-risk approach will be met by increased concern for safety on the part of industry. The author cites the record of the commercial air transport industry, which is "uniquely favored to support safety efforts" since "prof- its are tied to safety," but which has failed to improve its safety record (p. 167). Little change is to be expected as long as com- petitive pressures compel airlines and other industries to increase production, and treat safety as a mere variable cost. Imposing regulatory controls in the form of additional safety devices will not solve the problem, since the experience of the maritime in- dustry shows that "technology fixes" have "simply raised produc- tion pressures, increasing efficiency . . .but not reducing social costs" (p. 171). Perrow argues that regulation of dangerous technologies can and should be increased. In his view, most of the adverse impact of raising costs of risky technologies will fall only on private inter- ests, and will be outweighed by the benefit to overall public wel- 11. The author's view on the "market price" of risks to public health seems consonant with the forcefully articulated position of Professor Thomas McGarity, who observed that [F]or some kinds of transactions we are all probably ideological holdouts; there are some things that most of us are unwilling to sell at any price. Characteristic examples are our general reluctance to become prostitutes or to sell our votes. Risks to health probably belong to this category of "not-for-sale" aspects of personhood. I am un- willing to sell you my arm because I will not be the same person after the transaction is completed. Not only would I be a one-armed person, I would also be a person who has sold my arm. The same analysis applies to the sale of a high risk to my arm or to sale of a treasured environmental entity. In both cases the price I would demand for the sale would be higher than the amount that would compensate me if the arm or the entity were lost due to an act of God because there is an added cost attributable to the very act of selling something so intimately attached to self-identity. McGarity, Media-Quality, Technology, and Cost-benefit Balancing Strategies for Health and Environ- mental Regulation, 46 LAw & CONTEMP. PROBS. 159, 172 (1983). 1985] 302 COLUMBIA JOURNAL OF ENVIRONMENTAL LAW [Vol. 10:295 fare. As an example, he cites the race between the United States and Japan to market the products of genetic engineering. Private investors in the U.S. may argue that they can only win the com- petitive battle if they operate with looser safety standards which expedite research and development. Perrow responds by ex- panding on his populist view, stating that the same public benefits will accrue from genetic engineering regardless of whether those benefits are purchased from Japanese or American firms. Private corporate losses and any indirect losses to the economy due to stricter safety controls will be more than made up for by the sav- ings in public cost through a reduced risk of catastrophic acci- dents (pp. 310-311). This perspective reveals one of the themes which recurs and is developed throughout the book, viz., that economic gain as a spur to scientific advancement is a case of the tail wagging the dog: There is no technological imperative that says we must have power or weapons from nuclear fission or fusion, or that we must create and loose upon the earth organisms that will devour oil spills. We could reach for, and grasp, solar power or safe coal-fired plants, and the safe ship designs and industry con- trols that would virtually eliminate oil spills. No catastrophic potential flows from these (p. 11). Here again Perrow substitutes public health, rather than eco- nomic expansion or private monetary gain, as the good which sci- ence should serve. Perrow's concern with the motivation behind research and development is echoed by other commentators, par- ticularly with regard to private financial support of university-con- ducted DNA research.12 Perrow's discussion of economic consequences is vague and su- perficial. For example, he concludes that the economic disloca- tion that would result from abandoning nuclear power would be 'serious" but that it "might be better than a nuclear accident that contaminates a populated area of the earth" (p. 347). In addition, his political vision of public health as an overriding goal pays little heed to the realities of environmental policy-making that Profes- sor McGarity recognized: 12. See, e.g., New Genetics Industry Tests University Values, 16 THE CENTER MAGAZINE 43, Center for the Study of Democratic Institutions, U. Cal. at Santa Barbara (May - June 1983); Culliton, Pajaro Dunes, The Search for Consensus: University and Coporate Leaders Agree on Principles of Preserving Academic Values, Set Agenda for Debate on Commercialization of Biology, 216 SCIENCE 155, 158 (Apr. 9, 1982). Book Review Economic factors must inevitably play an important role in the actual implementation of the goals that society sets for itself. It is a simple economic reality that the unlimited pursuit of the clean-up and non-degradation goals that emerge from the political system would cost an enormous sum. . . . Cost is therefore an extremely important consideration, and those with a strong economic interest in continued discharge can be de- pended upon to raise the question of economic and technologi- cal feasibility at every possible opportunity in the political debate before Congress, the agencies and the courts. 13 However, regardless of the political viability of Perrow's views, new technologies will undoubtedly continue to develop with star- tling rapidity in the years to come. NORMAL ACCIDENTS is an im- portant work because it offers a novel view of past events, with insights on human organizations that help explain large-scale breakdowns such as the Union Carbide gas leak at Bhopal. But of still greater significance is the suggestion that these organiza- tional insights can and must be applied to the future, that they must enter into the calculus of judging the impact of proposed technologies on both the environment and the populace. Per- row's book is ultimately a common-sense plea that scientists, poli- ticians and lawmakers respect the enormous destructive potential of various technologies now in existence. As Bhopal demon- strated, seemingly slight mischances can have devastatingly lethal results. For the sake of a public which often lacks the political power or scientific knowledge to protect its own health and safety interests, assessments of risk in unknown or uncertain areas must be made with some regard for human fallibility, and with "a mea- sure of humility" on the part of the assessors. Where high-risk technologies are involved, overzealous expansion - with an eye to short term economic benefits at the cost of safety - is surely a foolish tradeoff. If . . . we but teach Bloody instructions, which, being taught, return To plague the inventor, this evenhanded justice Commends the ingredients of our poisoned chalice To our own lips. 14 Thomas R. Rus 13. McGarity, supra note 11, at 197-198. 14. Macbeth, Act I, scene 7. 19851