Home <
Innovation <
High-Reliability 1
The Self-Designing High-Reliability Organization:
Aircraft Carrier Flight Operations at Sea
Part 3 of 4
Redundancy
"How does it work? On paper, it can't, and it don't. So you try it. After a
while, you figure out how to do it right and keep doing it that way. Then we
just get out there and train the guys to make it work. The ones that get it we
make POs. ‡ The rest just slog through their time."
--
Flight deck CPO
Operational redundancy--the ability to provide for the execution of a task if
the primary unit fails or falters--is necessary for high-reliability
organizations to manage activities that are sufficiently dangerous to cause
serious consequences in the event of operational failures. 27 In classic
organizational theory, redundancy is provided by some combination of duplication
(two units performing the same function) and overlap (two units with functional
areas in common). Its enemies are mechanistic management models that seek to
eliminate these valuable modes in the name of "efficiency." 28 For a carrier at
sea, several kinds of redundancy are necessary, even for normal peacetime
operations, each of which creates its own kinds of stress.
A primary form is technical redundancy involving operations-critical units or
components on board--computers, radar antennas, etc. In any fighting ship, as
much redundancy is built in as is practicable. This kind of redundancy is
traditional and well understood. Another form is supply redundancy. The ship
must carry as many aircraft and spares as possible to keep its power projection
and defensive capability at an effective level in the face of maintenance
requirements and possible operational or combat losses. Were deck and parts
loading reduced, many of the dangers and tensions involved in scheduling and
moving aircraft would be considerably lessened. Here is a clear case of a
trade-off between operational and safety reliability that must be made much
closer to the edge of the envelope than would be the case for other kinds of
organizations. Indeed, for a combat organization, the trade-off point is
generally taken as a measure of overall competence. 29
Most interesting to our research is a third form, decision/management
redundancy, which encompasses a number of organizational strategies to ensure
that critical decisions are timely and correct. This has two primary aspects:
(a) internal cross-checks on decisions, even at the micro level; and, (b)
fail-safe redundancy in case one management unit should fail or be put out of
operation. It is in this area that the rather unique Navy way of doing things is
the most interesting, theoretically as well as practically.
As an example of (a), almost everyone involved in bringing the aircraft [in for
a landing] on board is part of a constant loop of conversation and verification
taking place over several different channels at once. At first, little of this
chatter seems coherent, let alone substantive, to the outside observer. With
experience, one discovers that seasoned personnel do not "listen" so much as
monitor for deviations, reacting almost instantaneously to anything that does
not fit their expectations of the correct routine. This constant flow of
information about each safety-critical activity, monitored by many different
listeners on several different communications nets, is designed specifically to
assure that any critical element that is out of place will be discovered or
noticed by someone before it causes problems.
Setting the arresting gear, for example, requires that each incoming aircraft be
identified (as to speed and weight), and each of four independent arresting-gear
engines be set correctly. 30 At any given time, as many as a dozen people in
different parts of the ship may be monitoring the net, and the settings are
repeated in two different places (Pri-Fly [Primary Flight Control] and LSO
[Landing Signal Officer]). § During our trip aboard Enterprise (CVN 65) in April
1987, she took her 250,000th arrested landing, representing about a million
individual settings. 31 Because of the built-in redundancies and the personnel's
cross-familiarity with each other's jobs, there had not been a
single recorded
instance of a reportable error in setting that resulted in the loss of an
aircraft. 32
Fail-safe redundancy, (b), is achieved in a number of ways. Duplication and
overlap, the most familiar modes of error detection, are used to some
extent--for example, in checking mission weapons loading. Nevertheless, there
are limits to how they can be provided. Space and billets are tight at sea, even
on a nuclear-powered carrier, and unlike land-based organizations, the seagoing
Navy cannot simply add extra departments and ratings. Shipboard constraints and
demands require a considerable amount of redundancy at relatively small cost in
personnel. In addition to the classic "enlightened waste" approach of tolerance
for considerable duplication and overlap, other, more efficient strategies that
use existing units with other primary tasks as backups are required, such as
"stressing the survivor" and mobilizing organizational "reserves." 33
Stressing-the-survivor strategies require that each of the units normally
operate below capacity so that if one fails or is unavailable, its tasks can be
shifted to others without severely overloading them. Redundancy on the bridge is
a good example. 34 Mobilizing reserves entails the creation of a "shadow" unit
able to pick up the task if necessary. It is relatively efficient in terms of
both space and personnel but places higher demands on the training and
capability of individuals. What the Navy effects, through the combination of
generalist officers, high job mobility, constant negotiation, and perpetual
training, is a mix that leans heavily on reserve mobilization with some elements
of survivor stressing. Most of the officers and a fair proportion of senior
enlisted men are familiar with several tasks other than the ones they normally
perform and could execute them in an emergency.
The Combat Direction Center (CDC, or just "Combat"), for example, is the center
for fighting the ship. 35 Crucial decisions are thereby placed nominally in the
hands of relatively junior officers in a single, comparatively vulnerable
location. In this case we have noted several of the mechanisms described above.
There is a considerable amount of senior oversight, even in calm periods. A
number of people are "just watching," keeping track of each other's jobs or
monitoring the situation from other locations. There is no one place on the ship
that duplicates the organizational function of Combat, yet each of the tasks has
a backup somewhere--on the carrier or distributed among other elements of the
battle group. 36
In an "ordinary" organization these parameters would likely be characterized in
negative terms. Backup systems differ in pattern and structure from primary
ones. Those with task responsibility are constantly under the critical eyes of
others. Authority and responsibilities are distributed in different patterns and
may shift in contingencies. In naval circumstances, where reliability is
paramount, these are seen as positive and cooperative, for it is the task that
is of primary importance.
Thus, those elements of Navy "culture" that have the greatest potential for
creating confusion and uncertainty turn out to be major contributors to
organizational reliability and robustness under stress. We believe this to be an
example of adaptive organizational evolution to circumstance, for it responds
very well to the functional necessities of modern operations. In the days of
great, compact flotillas, loss of navigational or deck or gun capability by one
ship could be compensated for by shifting or sharing with another. There is only
one carrier in a battle group and only a handful of other ships spread over many
hundreds of square miles. Each, and most particularly the carrier, must
internalize its own processes and modalities for redundancy.
Some Preliminary Conclusions
"The job of this ship is to shoot the airplanes off the pointy end and catch them
back on the blunt end. The rest is detail."
--
Carrier commanding officer
Even though our research is far from complete, particularly with regard to
comparisons with other organizations, several interesting observations and
lessons have already been recorded.
First, the remarkable degree of personal and organizational flexibility we have
observed is essential for performing operational tasks that continue to increase
in complexity as technology advances. "Ordinary" organizational theory would
characterize aircraft carrier operations as confusing and inefficient,
especially for an organization with a strong and steep formal management
hierarchy (i.e., any "quasi-military" organization). However, the resulting
redundancy and flexibility are, in fact, remarkably efficient in terms of making
the best use of space-limited personnel.
Second, an effective fighting carrier is not a passive weapon that can be kept
on a shelf until it is needed. She is a living unit possessed of dynamic
processes of self-replication and self-reconstruction that can only be nurtured
by retaining experienced personnel, particularly among the chiefs, and by giving
her sufficient operational time at sea. This implies a certain minimum budgetary
cost for maintaining a first-line carrier force at the levels of operational
capability and safety demanded of the U.S. Navy.
The potential risk of attempting to operate at present levels under increasing
budgetary constraints arises because the Navy is a "can-do" organization,
visibly reluctant to say "we're not ready" until the situation is far into the
red zone. 37 In time of war, the trade-off point between safety and
effectiveness moves, and certain risks must be taken to get units deployed where
and when they are needed. In peacetime, the potential costs of deploying units
that are less than fully trained are not so easily tolerated. If reductions in
at-sea and flying time are to be taken out of workups to preserve operational
time on deployment, training and evaluation procedures will have to be adapted
to reduce stress--perhaps by overlapping final readiness evaluations into the
beginning of the deployment period.
Third, as long-term students of organizations, we are astounded at how little of
the existing literature is applicable to the study of ships at sea. Consider,
for example, the way in which the several units that make up a battle group
(carrier, air wing, supply ships, escorts) are in a continual process of
formation and reformation. Imagine any other organization performing effectively
when it is periodically separated from and then rejoins the unit that performs
its central technical function. 38 More importantly, most of the existing
literature was developed for failure-tolerant, civilian organizations with
definite and measurable outputs. The complementary body on public organizations
assumes not only a tolerance for failure, but at best an ambiguous definition of
what measures failure (or for that matter, success).
Fourth, we have been encouraged to reflect on the new large Soviet nuclear
carrier now being fitted out in the Black Sea. 39 The Soviet Navy is completely
without experience or tradition in large carrier operations. Their internal
structure is more rigid and more formal than ours and with far less on-the-job
training, especially for enlisted personnel. 40 It will be very interesting to
watch their workup time, deck loading, and casualty rates. Of course, it is not
clear that they will be trying to emulate U.S. carrier operations rather than
the somewhat different style and objectives of the British or French. 41 In
either case, we estimate a minimum of several workups (each taking perhaps two
or three years) before they begin to approach the deck loads and sortie rates of
comparable Western carriers and, unless they are remarkably lucky, there will be
some loss of lives in the learning process. 42
Copyright
©1987 Naval War College Review.
