Most disasters don't happen to bad operators. They happen to good ones that were missing one thing.
That's an uncomfortable idea, so I'd like to earn it with three stories. A warning that was sent away for more study. A certificate signed by the calendar. Then a control room full of people doing exactly what their training said, which is where this one starts to bite.
Each was an operation that was good at two of the three things I've been writing about. From the inside, each one felt like success. I don't believe anyone in them was careless and I'd ask you to keep that in mind.
Where we are
Last time was about the third element, Evolutionary Transformation: transformational in what it changes, evolutionary in how it gets there. You get there by staying systematic and in control, so the change outlasts whoever championed it. This one is about the three places where two elements meet and the third is missing.
To recap: Total Awareness is looking in every direction and from every perspective, Integrated Signal Intelligence is the chain from sensor to decision and Evolutionary Transformation is the one I've just described.
Where two of these meet, we can find ourselves in a state that feels like winning, even when something is quietly missing. Where all three meet is what I call the Operational Apex - more on that next time.
Insight - clarity, but no change
What it feels like: Good, honestly. The picture is complete and the analysis is sound. The risk is on the register, the report is well written and everyone in the room agrees what the problem is. Meetings end with the risk "noted", "under review" or "for further study". What's missing doesn't show up until much later - it's the machinery that turns knowing into doing.
A warning on file: In 2008 the company running Fukushima Daiichi had its own subsidiary work out how high a tsunami on that coast could get. The answer came back: up to 15.7 metres, against a plant protected to 5.7 metres. At the trial years later, a witness said someone at headquarters asked whether the method could give a smaller number. It couldn't. So the estimate was sent to a learned society to review the method, rather than build higher defences. On 11 March 2011, on that part of the coast, a wave rolled in over 13 metres high.
What was missing: Evolutionary Transformation - being systematic and in control. Not more analysis - the analysis was close enough. What closes the gap is a system that turns a number saying "act" into an action, then keeps that action in place after the person who raised it has moved on. In other words, change that outlasts its champion. After an event, the Insight element is the one that hurts most because if it was the cause, nobody can claim they didn't know.
Momentum - action, but in silos
What it feels like: Energetic. Every team is disciplined and confident within its own patch, the milestones are being hit and there's a date everyone is working to. From the outside it looks like strong execution - and much of it is.
A certificate signed by the calendar: In 1930 Britain had two new airships, built to the same order, one privately and one by the state. Both crews were working at the edge of what anyone knew. The private ship, R100, found most of her faults on test flights near home: her fabric skin worked loose at speed and her tail cone collapsed in a high-speed run. Each fault went back to the same design team, who could see what the ship was telling them and fixed it as part of one integrated effort before she went any further: the skin was re-rigged, then the tail was cut off and rebuilt. I'm sure the project faced time pressures, every project does. If so, they didn't win: every fault was fixed before she went anywhere. On her first long flight she went to Canada - and returned.
The state ship, R101, was too heavy for the India route, so she was cut in half and an additional extension section was fitted. Then came her faults, from several directions at once. Her gas bags were found full of holes. The inspector at the works wrote that he could not recommend a certificate. The Zeppelin company in Germany sent word about chafing. This time there was a deadline, fixed around an Imperial Conference in London, with pressure from above to meet it. Each warning was answered where it was raised and closed, separately, by separate teams. The focus was the deadline, but although the warning signals were there, they were not viewed collectively. She flew one shortened test in her new form, got her certificate the same day she landed and left two days after that. She burned on a hillside in France. Forty-eight of the 54 people aboard died.
What was missing: Integrated Signal Intelligence. For R101, every one of those warnings was seen for what it was. Then it stopped. Nobody put the holes, the letter and the message from Germany side by side with the departure date and asked what they added up to. What closes the gap is a chain that runs all the way from each signal to the same decision, so the picture may then be judged on the collective evidence rather than on the date. Usually that means someone slowing down long enough to ask what the signals mean when they're taken together.
Precision - control, but blind spots
What it feels like: This one feels safe, which is exactly why it worries me most. The plant is well run and the people are competent. Within everything it can see, the operation really is in control.
Trained to do the wrong thing: Three Mile Island, Pennsylvania, four in the morning on 28 March 1979: A relief valve on the reactor stuck open - and the light on the control panel said it had shut. The crew did exactly what their training said. A level reading told them the system was filling up, so they cut back the emergency cooling. For more than two hours coolant drained away through a valve the crew believed was closed, while the alarm panel lit up faster than anyone could take in. Part of the core melted. A great deal fed into that morning and more than one inquiry followed, but I'd like to pull on one thread only: nothing in that room told them plainly about the one fact that mattered.
What was missing: Total Awareness. Follow the signals here and they never became a warning: the light reported what the valve had been told to do, not what it had done, so nothing in that room said plainly that the valve was open. Sometimes the signal is there but buried under a flood of others, which is the same noise problem I raised under Integrated Signal Intelligence.
To be clear, the industry learned from mornings like that one: alarm philosophies, indicator design and operator training have all moved on since, partly because of it. My worry is narrower. New technology is now arriving through channels where none of that was ever standard practice - and the people driving it forward, however good, may never have met it. Much of the guidance we need already exists, ironically, in another silo. What closes the gap is widening the frame on purpose and regularly - every direction, every perspective - then asking whose knowledge sits just outside it.
Which one are you in?
Here's the test I've ended up using, as much over a beer as at work (yep, you're right to feel sorry for the other guy with the beer!).
Think of your own operation. I'd argue that there's three quick questions that help identify the culprit, one for each:
- Does the same risk turn up in successive reports, worded a little differently each time? That's Insight.
- Does "it's certified" end conversations rather than start them? That's Momentum.
- When did someone last ask "what are we not looking at?" and get an answer instead of a puzzled silence? If you can't remember, that's Precision.
I've stood in all three at some point in my career (usually without noticing at the time!). The overlaps are good places to be - they're great indicators of progress. They're just not places to stay.
Over to you
Next time, back to that coast in Japan in 2011 - to a plant the same wave reached, which shut down safely, took in its neighbours and had all three elements working together long before anyone needed them. That's the centre of the diagram - the Operational Apex - and it gets the last word.
So until next time, wherever you sit, the crew room, the control room or the boardroom, I'd like your perspective on one thing: which of the three have you seen from the inside - and what got you out? As ever, I'm happy to be challenged or proven wrong on any part of this - that's what helps us reach that operational apex!
This article first appeared on LinkedIn, where the conversation carries on: join it there.