Looking for the Next Black Swan Instead of Chasing the Last One

Vicki Bier

University of Wisconsin

Looking for the Next Black Swan

• Anticipate adverse events that are not getting attention. • Take potential black swans seriously. • Manage the risk of black swans.

Anticipating Adverse Events That Are Not Getting Attention

• Identify events that bring lots of energy together with lots of people. • Focus on “existential threats.”• “Garden variety terrorism…does not constitute an existential threat.”

Was September 11 Unimaginable?

• Attempted jet attack on Eiffel Tower.• Employee tried to crash a plane into HQ of Federal Express.• Hijackers caused triple-digit death tolls.• Suicidal pilots crashed jets in the 1990s.• Terrorists tried to destroy U.S. jets.

Taking Black Swans Seriously

• Pathological safety culture: •Messengers are “shot.”

• Bureaucratic safety culture: •Messengers are compartmentalized.

• Generative safety culture: •Messengers are encouraged.  

Taking Black Swans Seriously• Bureaucratic organizations:

• Highly susceptible to “overload”.• Take on tasks that they can’t do well (e.g., NASA before Columbia disaster).

• Generative organizations:• Are alert for early signs of trouble. • Even warnings coming from outsiders.

Columbia Space Shuttle

• NASA had an impossible mission:– Operate safely with a difficult technology and an

inadequate budget

• Main lesson learned after Challenger:– Heed early warning signs of problems– Avoid “normalization of deviance”

• NASA could not AFFORD to do this:– Did not have enough money to fix its problems!

• Bureaucratic organizations: • Highly susceptible to “overload”• Take on tasks that they can’t do well

Columbia Space Shuttle

• Furthermore, preservation of budget required good public relations:– Schoolteachers in space– Science experiments for grade schools

• This required NASA to give “illusion” of safety

Design for Safety

• “Organizational culture” has at least as much effect on risk as design of components, subsystems, software!

• Examples:– Nuclear power– Railroad safety– Space shuttle– Gulf oil cleanup

Davis-Besse Nuclear Power Plant

• In March 2002, workers detected severe degradation of the reactor vessel head

• The degradation had gone on for years• Leakage from the reactor vessel head

flanges and nozzles had become a chronic problem, releasing boric acid

• A modification to improve the ability to inspect had been indefinitely deferred

Davis-Besse Cavity

Davis-Besse Nuclear Power Plant

• Many plants experienced problems with boric acid corrosion:– The NRC required a control program

• Nevertheless, rust stains and deposits were dismissed as coming from flange leakage:– Rust also caused fouling, filter plugging

Davis-Besse Nuclear Power Plant

• The staff “stumbled” onto the problem in the course of another repair:– When one of the nozzles “leaned over”

• Corrosion of the reactor vessel head had taken place from the outside:– Stopped when it hit the stainless steel liner

• The degradation covered about 30 square inches:– Removed about 70 pounds of material!

Davis-Besse

• Well known technical weaknesses caused reactor vessel head nozzle cracking

• The cracking allowed corrosive boric acid to attack the reactor vessel head

• Leadership defects caused: – Weak and ineffective protective measures– Missed opportunities to find the problem early

NRC Perspective

• Prior to the discovery of the reactor vessel head corrosion:– The performance indicators at the Davis-Besse facility were

“green”– The baseline inspections did not reveal any significant

findings

NRC Perspective

• The responsibility rests on the organization’s leadership:– To establish priorities – To make the commitment to safety real– To create a climate in which such a

commitment can flourish

Railroad Safety

• Organizational culture adversely affected safety after a merger– 3 fatal accidents and 7 fatalities in 7 months after the Union

Pacific/Southern Pacific merger– “Union Pacific’s by-the book culture clashed badly with

Southern Pacific’s, …making do with chewing gum and baling wire”

• (Peter Passell, 1998, New York Times)

Gulf Oil Cleanup

• “Most of BP's production and pipeline employees in the USA have attended at least one booming school. Many have attended two or three… BP's production employees have attended the best booming schools. I know this. I've seen them there.”

• “BP's drilling folks have mostly not attended booming school… Because for Drilling Hands, booming is for pussies. This is a generalization. Not all drilling hands think that…”

• “I guarantee BP's drilling executives think that booming is for pussies -- and that's if they think about booming at all or even know what it is…”

– http://www.dailykos.com/story/2010/5/11/865387/-Fishgrease:-DKos-Booming-School

Gulf Oil Cleanup

• “Generally, boom is long… It has a round floaty part that floats, and a flat ‘skirt’ that sinks.”

• “A RULE: the floaty part never floats high enough and the skirt never rides low enough. Some oil will ALWAYS go over the boom and some will ALWAYS go under it. Our task is to MINIMIZE both!”

– http://www.dailykos.com/story/2010/5/11/865387/-Fishgrease:-DKos-Booming-School

• “This picture teaches you almost 100% of what you'll learn in… Booming School…”

Gulf Oil Cleanup

Gulf Oil Cleanup

• “Boom is not meant to contain or catch oil. Boom is meant to divert oil.” • “Boom must always be at an angle to the prevailing wind-wave action or

surface current. Boom, at this angle, must always be layered in [an] overlapped sort-of way with another string of boom.”

• “Boom must always divert oil to a catch basin or other container, from where it can be REMOVED…”

• “…you can remove most, by far most of the oil from a shoreline and you can do it day after day, week after week, month after month.”

• “You can prevent most, by far most of the shoreline from ever being touched by more than a few transient molecules of oil.”

Gulf Oil Cleanup

“…if you understand it, and all these production employees understand it (we're talking tens of thousands of people here), then why is most or all of the booming along the Gulf... being done wrong?”1.“The booming is being run by a company that concentrates on drilling and booming is for pussies. Production employees were not invited because they would just cause trouble. This is a drilling operation…”2.“There's not enough boom, rope nor anchor on this planet to properly boom the Northern Gulf of Mexico. There should be! It's not that much an expense! Really! It's not! They said they were ready!”3.“…you can just lay a single line of…orange boom out parallel to the shore, for miles, with anchor points every quarter-mile to where a good part of it washes up onto the shore… Where it manages to stay off the bank, a little two-foot chop… will send all the oil either over or under it! …So what!”

Gulf Oil Cleanup

Gulf Oil Cleanup

Why the Problem Is Difficult

• There is no one “right” management style, corporate culture, or organizational structure.

• Rather, the various elements must be consistent with each other and the external environment.

• Example--Admiral Rickover’s nuclear navy:– Rickover’s management style is not recommended!

• Dictatorial, capricious, etc.– But, it combined inspirational leadership, hand-picked

personnel, coherent goals, attention to detail, technical expertise, etc.

• And achieved superlative performance!

Managing the Risk of Black Swans• Black swans are inherently rare:

•Can’t defend against every eventuality.

• Need overarching forms of protection: •Emergency preparedness, intelligence, border security, public health, etc.•All-hazards protection.

Scientific Protein Labs (SPL) and the Case of the Contaminated Heparin

• SPL identified the risk of contamination: • Due to “blue ear pig disease” in China.

• Tested for protein from sheep: • Not for a chemical additive.

• Similarly, the problem with melamine in formula was in part a reaction to the tests designed to protect from “swill milk.”