Normal Accidents

Normal accident theory, from Charles Perrow, says that in systems that are both complex (many parts interacting in non-obvious ways) and tightly coupled (little slack, fast propagation), serious accidents are not the result of rare failures but the normal outcome of the system's design. They are "normal" in the sense that they are to be expected given the system's structure. No amount of trying harder or adding more safety systems can make them fully avoidable — the complexity and coupling create failure modes that are hard to foresee and hard to control. The strategic implication: in such systems, the goal shifts from "prevent all accidents" to "reduce the likelihood and limit the damage," and sometimes to "avoid the system" or "simplify and decouple." The discipline is identifying which of your systems are complex and tightly coupled, and then either accepting residual risk, adding buffers and redundancy, or redesigning to reduce complexity or coupling.

Perrow's two dimensions are interactive complexity (many parts, non-linear interactions, unfamiliar or unintended feedback) and tight coupling (little slack in time or space, sequences are fixed, little room for recovery). Nuclear plants, air traffic, and some financial systems score high on both. When they fail, the failure can cascade in unexpected ways because the interactions are too many to anticipate and the coupling doesn't allow time to intervene. Redundancy and safety systems can help, but they can also add complexity and new failure modes. The paradox: more safety systems can make the system more complex and thus more prone to a different kind of accident. The response is not only more layers but also simplification and decoupling where possible.

The model appears in engineering (nuclear, aerospace), in finance (flash crashes, contagion), and in organisations (complex processes that fail in surprising ways). Where you see "we did everything right and it still went wrong," or "the failure was unforeseeable," normal accident theory suggests the system may be inherently prone to such failures. The question is whether to harden, simplify, or exit.