Networked reliability
Networked reliability
Institutional fragmentation and the reliability of service
provision in critical infrastructures
Proefschrift
ter verkrijging van de graad van doctor
aan de Technische Universiteit Delft,
op gezag van de Rector Magnificus prof. dr. ir. J.T. Fokkema,
voorzitter van het College voor Promoties,
in het openbaar te verdedigen op maandag 19 juni 2006 om 12:30 uur
door Markus Leonard Christiaan DE BRUIJNE
Prof. mr. dr. E.F. ten Heuvelhof
Samenstelling promotiecommissie:
Rector Magnificus, voorzitter
Prof. mr. dr. E.F. ten Heuvelhof, Technische Universiteit Delft, promotor Prof. dr. J.C. Arnbak, Technische Universiteit Delft
Prof. dr. A.R. Hale, Technische Universiteit Delft Prof. dr. U. Rosenthal, Universiteit Leiden Prof. dr. P.R. Schulman, Mills College
Prof. dr. ir. M.P.C. Weijnen, Technische Universiteit Delft Dr. M.J.G. van Eeten, Technische Universiteit Delft
ISBN-10: 90-5638-151-2 ISBN-13: 978-90-5638-151-6
Cover photo: Control Room Map Board at the California Independent System Operator (CAISO) Photo by Donald Satterlee, printed with permission from the CAISO
Printing and binding: Febodruk BV, Enschede, The Netherlands © 2006, M.L.C. de Bruijne
This dissertation marks the end of six(!) years of research conducted at the Faculty of Technology, Policy and Management at Delft University of Technology. The research was funded by the Next Generation Infrastructures Foundation and Delft University of Technology. Throughout these years I have received the generous help and encouragement of many people. However, before I can thank all those who contributed to this work, I would like to emphasize that the standard disclaimer applies, meaning that any errors, omissions or faults are attributable only to me.
First, I would like to express my gratitude to the companies that allowed me to undertake this research inside their organizations. The California Independent System Operator (CAISO or ISO) and KPN Mobile in the Netherlands provided fascinating and hospitable environments and gave unlimited access for this research. However, this work could not have been completed in this form without the generous help of all those who participated and contributed their valuable time to talk to me. The interviewees provided a very detailed and coherent analysis of what happened and how they experienced the sweeping changes in these industries. I would like to thank all of them for their willingness to share these insights with me. They provided information and knowledge on the basis of anonymity, yet their contribution is greatly appreciated. Appendix C provides a complete list of all those who participated in this research.
In particular, I would like to use the opportunity to thank all the CAISO and KPN Mobile control room operators who allowed me to ‘look over the shoulders’ and experience the world of infrastructure control room ops.
At CAISO, David Hawkins deserves special thanks for his invaluable help and encouragement throughout these years. Jim Detmers and Jim McIntosh allowed unrestrained access to the CAISO control room during operations in the spring and summer of 2001. At KPN Mobile, special thanks are due to Michiel Valk and Alrik Hohman, who, in their capacity as NMCC managers provided admittance to the KPN Mobile control room and continuously supported this research.
of my work. Emery Roe deserves special thanks for his help and hospitality during my visits to the Bay Area. I cherish your role in this research! Steffen Verbist and Evelien van Rij assisted in obtaining data on the KPN Mobile case. Steffen unearthed data from KPN Mobile’s operations and Evelien retraced some important documents on the history of mobile telecommunications in the Netherlands.
Apart from the members of the Networked Reliability Group, I would like to thank my colleagues at the Policy, Organization & Management group at the Faculty of Technology, Policy and Management in Delft. I really enjoy working with and among you. Many of you contributed to this work in various ways. Michel van Eeten and Ernst ten Heuvelhof deserve special thanks for their continuous support and help throughout these years. They deserve much credit for the end-result. Heleen Weening, my roommate put up with me for the better part and shared the ups and downs of being a Ph.D with me from the beginning to the end. Ruben van Wendel de Joode, I admire your drive, enjoy working with you and value your friendship! Haiko van der Voort was always around to provide help and stimulated my interest in card games and whisky. Bauke Steenhuizen, meticulously read and checked my manuscript. I am indebted to the peer-review group members Alexander, Linda, Leon, Mirjam, Maura and Sonja and coaches Cees van Beers, Vincent Marcheau and Pieter Bots, for their valuable comments and interesting discussions.
Two people are thanked for their help in shaping my manuscript into this dissertation. Michelle Luijben, did a great job on editing the manuscript and Susan Wevers designed the beautiful cover.
Then, there are my friends and relatives who stood by me these past six years. Max, although you may not know it, you are to me the roll-model of the true academic researcher. Gerdie, thanks for being my friend through thick and thin. All board members and personnel at Dumas. Thanks for reminding me that there is more than just (academic) work every once in a while. Erik deserves to be thanked for his efforts to occasionally see some soccer at Feyenoord! Leenke, I admire your dedication to music. You broaden my horizon to other worlds. Remco and Lotte, I really enjoy your company and the fact that you always want to have dinner with Janne and me. Krijn, Tineke, Jos and Melanie, thanks for your unconditional support throughout these years. My parents, thank you for your never-ending love, support and belief in me. You were the ones that stimulated me and enabled me to do what I like best. I thank you for that.
ACKNOWLEDGEMENTS ...I TABLE OF CONTENTS ...III LIST OF TABLES AND FIGURES ... IX
PROLOGUE:FAILING RESTRUCTURED INFRASTRUCTURES ...1
The public debate: Does restructuring affect safety and reliability?...2
A first stab: Outlining the contours of the research problem...6
Empirical research: Does restructuring affect reliability? ... 12
Opening the black box: How do infrastructures cope with restructuring?... 17
Reader’s guide... 19
Notes on the Prologue... 21
PART I:THEORY CHAPTER 1:INTERCONNECTED, YET FRAGMENTED...29
Introduction... 29
§ 1: On the development of critical infrastructures ... 29
§ 2: The end of the era of infrastructure expansion and central, vertically integrated infrastructure management ... 37
§ 3: The new infrastructure paradigm: Networks of organizations... 44
CHAPTER 2:HOW TO ORGANIZE FOR RELIABILITY? ... 51
Introduction... 51
§ 1: Reliability, organizations and disasters... 52
§ 2: Normal Accident Theory ... 53
§ 3: High-Reliability Theory ... 61
§ 4: NAT versus HRT... 70
§ 5: Beyond organizations: How networks organize for reliability... 71
Notes on Chapter 2 ... 76
CHAPTER 3:RESEARCH ON CRITICAL INFRASTRUCTURES ... 81
Introduction... 81
§ 1: Towards a research framework... 82
§ 2: Research strategy ... 84
§ 3: Methods of data collection ... 89
§ 4: Methods of data analysis and case study outline... 91
Notes on Chapter 3 ... 92
PART II:CASE ELECTRICITY CHAPTER 4:THEN …THE LIGHTS WENT OUT ...97
Introduction... 97
§ 1: Pre-restructuring... 98
§ 2: Restructuring California’s electricity industry (1994-1998) ... 106
§ 3: The first years of California’s restructured electricity industry (1998-2000) ... 118
§ 4: California’s electricity crisis (2000-2001) ... 122
CHAPTER 5:THE CRITICS’ CASE ...151
Introduction... 151
§ 1: The vulnerability of California’s new electricity industry ... 152
§ 2: How reliability-enhancing is California’s new electricity industry structure? ... 166
§ 3: Conclusion... 188
Notes on Chapter 5 ... 190
CHAPTER 6:POWERING THE GRID ... 195
Introduction... 195
§ 1: Conditions supporting reliability ... 197
§ 2: Other sources of reliability... 208
§ 3: Conclusion... 237
Notes on Chapter 6 ... 237
PART III:CASE MOBILE TELEPHONY CHAPTER 7:THE WIRELESS REVOLUTION ... 243
Introduction... 243
§ 1: Mobile telephony in the world of the public PTTs (1980-1989)... 244
§ 2: From analogue monopoly to digital oligopoly (1989-1998)... 250
§ 3: Expansion and full-scale competition (1998- July 2000) ... 261
§ 4: After the dot-com crash (September 2000-2004) ... 266
§ 5: Was the reliability of mobile telephony services affected? ... 270
CHAPTER 8:THE CRITICS’ CASE ... 281
Introduction... 281
§ 1: A more vulnerable Dutch mobile telecommunications industry?... 282
§ 2: How reliability-enhancing is the Dutch mobile telephony industry structure?... 298
§ 3: Conclusion... 319
Notes on Chapter 8 ... 321
CHAPTER 9:RELIABLE MOBILE SERVICES... 325
Introduction... 325
§ 1: Conditions supporting reliability ... 327
§ 2: Conclusion... 360
Notes on Chapter 9 ... 361
PART IV: CONCLUSION CHAPTER 10:CONCLUSION... 367
Introduction... 367
§ 1: Does institutional fragmentation threaten the reliability of service provision? ... 368
§ 2: Theoretical assumptions on institutional fragmentation and reliability ... 369
§ 3: Defying bad luck: Coping with institutional fragmentation in critical infrastructures ... 372
§ 4: Real-time, networked reliability and its theoretical implications ... 386
§ 5: Wider implications and relevance for restructured critical infrastructures? ... 391
§ 6: Reliability and institutionally fragmented critical infrastructures ... 393
§ 7: The fundamental problem with restructured critical infrastructures: Increased unpredictability ... 399
§ 8: Why real-time networked reliability is here to stay... 401
APPENDIX A:CONTROL ROOM OPERATIONS ...411
Introduction... 411
Operations in and around the control room of the California ISO... 411
Operations in and around KPN’s National Monitoring and Coordination Center ... 419
Notes on Appendix A... 424
APPENDIX B:LIST OF ACRONYMS... 427
APPENDIX C:LIST OF INTERVIEWEES ... 433
California ISO Case (April 2001-December 2001) ... 433
KPN Mobile Case (October 2001-October 2002)... 434
REFERENCES... 435
SUMMARY (IN DUTCH)... 463
TABLE P-1: RELIABILITY OF SERVICE PROVISION... 15
TABLE 1-1: TECHNOLOGY AND DECENTRALIZED OPERATION... 38
TABLE 1-2: MILESTONES IN INFRASTRUCTURE REFORM... 43
TABLE 1-3: EFFECT OF THE PARADIGM SHIFT... 45
TABLE 2-1: AUTHORITY STRUCTURE FOR THE MANAGEMENT OF LARGE-SCALE COMPLEX SYSTEMS... 57
TABLE 2-2: ERROR-INDUCING CHARACTERISTICS... 59
TABLE 2-3: HRO-CHARACTERISTICS AND RELIABILITY-ENHANCING CONDITIONS... 63
TABLE 3-1: ANALYTICAL FRAMEWORK TO DETERMINE THE EFFECTS OF INSTITUTIONAL FRAGMENTATION ON THE ABILITY TO PROVIDE HIGHLY RELIABLE SERVICES (ORGANIZATIONAL PERSPECTIVE) ... 83
TABLE 3-2: NUMBER OF CONDUCTED CASE STUDY INTERVIEWS... 91
TABLE 4-1: CHANGES IN CALIFORNIA’S ELECTRICITY INDUSTRY STRUCTURE AS A RESULT OF RESTRUCTURING... 110
TABLE 4-2: A CHRONOLOGICAL OUTLINE OF CALIFORNIA’S ELECTRICITY RESTRUCTURING PROCESS... 114
TABLE 4-3: CALIFORNIA PX DAY-AHEAD PRICES... 120
TABLE 4-4: MERCHANT GENERATION IN CALIFORNIA... 123
TABLE 4-5: VOLUME PURCHASED OUT-OF-MARKET... 126
TABLE 4-7: TOTAL COSTS OF CALIFORNIA’S ELECTRICITY MARKET... 130
TABLE 4-8: CALIFORNIA’S ELECTRICITY STRUCTURE AFTER THE CRISIS... 131
TABLE 4-9: ADDED GENERATION CAPACITY AND LOAD GROWTH (1996-1999) ... 135
TABLE 4-10: CALIFORNIA’S PEAK LOAD GROWTH... 135
TABLE 4-11: CALIFORNIA’S AVERAGE ELECTRICITY DEMAND GROWTH... 136
TABLE 4-12: AGE OF POWER PLANTS IN CALIFORNIA... 137
TABLE 4-13: NET IMPORTS INTO CALIFORNIA... 138
TABLE 4-14: COMPARISON OF CALIFORNIA’S STAGE 1,2 AND 3 EMERGENCIES... 142
TABLE 4-15: NUMBER OF DAYS ON WHICH ISO WAS FORCED TO DROP LOAD... 142
TABLE 4-16: FIRM LOAD SHEDDING INCIDENTS AS A RESULT OF RESTRUCTURING... 143
TABLE 4-17: ISO DISTURBANCE AND KEY RELIABILITY PERFORMANCE INDICATORS. 144 TABLE 5-1: PRE-RESTRUCTRUING UTILITY RELIABILITY PROCEDURES... 179
TABLE 5-2: EFFECTS OF CALIFORNIA’S ELECTRICITY RESTRUCTURING ON THE THEORETICALLY DEDUCED RELIABILITY CONDITIONS... 189
TABLE 6-1: ISONETWORKED RELIABILITY CONDITIONS IN CALIFORNIA’S ELECTRICITY INDUSTRY... 196
TABLE 7-1: MOBILE TELEPHONY NETWORKS IN THE NETHERLANDS (1945-1995).... 247
TABLE 7-2: MOBILE CELLULAR TELEPHONE SUBSCRIBERS IN THE NETHERLANDS... 251
TABLE 7-3: CELLULAR MOBILE SUBSCRIBERS IN THE NETHERLANDS (1990-1999) ... 253
TABLE 7-4: NUMBER OF MOBILE TELEPHONE CONNECTIONS IN THE DUTCH MARKET,1998-2001... 262
TABLE 7-5: MOBILE TELEPHONY OPERATOR OWNERSHIP STRUCTURE IN THE NETHERLANDS (NOVEMBER 2001)... 263
TABLE 7-6: RESULT OF DUTCH UMTS AUCTION... 263
TABLE 7-7: DEBTS OF MAJOR EUROPEAN TELECOMMUNICATIONS COMPANIES... 267
TABLE 7-8: NUMBER OF DISTURBANCES IN KPN MOBILE’S ANALOGUE NETWORKS (JANUARY 1995-JANUARY 2000)... 271
TABLE 8-1: EUROPEAN MOBILE TELECOMMUNICATIONS ENVIRONMENT... 282
TABLE 8-2: NUMBERS OF BTSS IN USE BY KPNMOBILE (1995-2002) AND BY
LIBERTEL/VODAFONE (1999-2002) ... 283
TABLE 8-3: KPNMOBILE CUSTOMERS AND TRAFFIC VOLUME... 283 TABLE 8-4: LIBERTEL/VODAFONE CUSTOMER BASE AND TRAFFIC VOLUME... 284
TABLE 8-5: VOLUME OF SMS MESSAGES SENT BY THE TWO LARGEST MOBILE
OPERATORS IN THE NETHERLANDS... 284 TABLE 8-6: EFFECTS OF DUTCH MOBILE TELEPHONY LIBERALIZATION ON THE
THEORETICALLY DEDUCED RELIABILITY CONDITIONS... 320
TABLE 9-1: NETWORKED RELIABILITY CONDITIONS IN THE DUTCH MOBILE
TELEPHONY INDUSTRY AT KPNMOBILE... 326
TABLE 10-1: KEY INDICATORS OF HIGHLY RELIABLE PERFORMANCE... 370 TABLE 10-2: CONDITIONS FACILITATING NETWORKED RELIABILITY AT THE
CALIFORNIA ISO AND/OR KPNMOBILE... 372 TABLE 10-3: SHIFTS RESULTING FROM THE CLUSTERING OF CONDITIONS THAT
SUPPORT THE RELIABLE PROVISION OF SERVICES IN NETWORKS OF
ORGANIZATIONS...374 TABLE 10-4: CONDITIONS FACILITATING THE MANAGEMENT OF RELIABILITY IN
NETWORKED, INSTITUTIONALLY FRAGMENTED SYSTEMS... 389
TABLE A-1: FUNCTIONS WITHIN THE ISOCONTROL ROOM TEAMS... 412 TABLE A-2: AN OVERVIEW OF THE FUNCTIONS WITHIN THE NMCCCONTROL
ROOM TEAMS... 419 TABEL S-1: ANALYTISCH KADER OM DE GEVOLGEN VAN INSTITUTIONELE
FRAGMENTATIE OP HET VERMOGEN OM BETROUWBARE DIENSTEN TE VERLENEN VAST TE STELLEN... 467
TABLE S-2: CONDITIES DIE BETROUWBAARHEID IN NETWERKEN POSITIEF
FIGURE P-1: READERS’ GUIDE AND RESEARCH OUTLINE... 20
FIGURE 1-1: THE EXPANSION OF HOUSEHOLD ACCESS TO URBAN INFRASTRUCTURE SERVICES IN WESTERN COUNTRIES... 32
FIGURE 2-1: PERROW’S SYSTEM CHARACTERISTICS: COMPLEXITY AND COUPLING... 55
FIGURE 4-1: CALIFORNIA’S HIGH-VOLTAGE ELECTRICITY GRID... 102
FIGURE 4-2: CALIFORNIA’S NEW ELECTRICITY MARKET STRUCTURE ESTABLISHED BY ASSEMBLY BILL 1890 ... 110
FIGURE 4-3: CALIFORNIA’S ELECTRICITY MARKET DESIGN... 113
FIGURE 4-4: CALIFORNIA’S MARKET DESIGN AND MARKET REALITY IN 2000... 125
FIGURE 4-5: AVERAGE PRICES PAID BY UTILITIES FOR ELECTRICITY IN THE CAL-PX DAY-AHEAD (APRIL 1998 THROUGH DECEMBER 2000)... 126
FIGURE 4-6: SYSTEM AVERAGE INTERRUPTION DURATION INDEX OF CALIFORNIA’S UTILITIES (1987-1999)(MAJOR EVENTS EXCLUDED)... 141
FIGURE 4-7: SYSTEM AVERAGE INTERRUPTION FREQUENCY INDEX OF CALIFORNIA’S UTILITIES (1987-1999) ... 141
FIGURE 5-1: CALIFORNIA’S NEW ELECTRICITY SYSTEM OPERATIONS DESIGN... 179
FIGURE 7-1: A SCHEMATIC OUTLINE OF A GSM NETWORK... 259
BOX 7-1: THE NAME OF THE GAME... 268
FIGURE A-1: A SCHEMATIC DISPLAY OF THE ISOCONTROL ROOM IN FOLSOM... 413
FIGURE A-2: ISOFOLSOM AND ALHAMBRA CONTROL ROOM ROLES AND RESPONSIBILITIES (JANUARY,2002)... 418
FIGURE A-3: MOBILE TELECOMMUNICATIONS NETWORK MANAGEMENT MODEL... 420
Are critical infrastructure industries still
reliable?
“C ha n ges in t he w o rl d’ s p o l it ic al , e c on om ic an d tec hn o lo gical re al ms in t he p a st c en tu ry hav e p l ace d great st re ss on ap p roac he s t o m a na gem ent and syste m de s ign. T he c ha nge s t hat hav e ha d t he grea test imp act a re t he inc re ase in s ize a n d c om pl exit y of t he human orga nizat ions a n d t ec hn ic al sy st ems n ee de d in t he w o rl d t o da y , an d t he rate o f c ha n ge in the e xte rn al
e nv ironm ent w it h w hic h t he se orga nizat ions and s yst ems m ust cope . ”
Joel Moss, Prov ost, MIT1
On October 5, 1999, disaster struck at Ladbroke Grove near Paddington station in London. A passenger train passed a red signal and drove right into the path of a high-speed train coming from the opposite direction. The two trains crashed at an estimated speed of at least 220 kilometers per hour,2 making it “[p]robably the highest speed collision between two passenger trains in history.”3 As a result of the collision and the subsequent fires, 31 people died and 227 were taken to hospital.4 The accident was the worst in 10 years on the British railway network.
As a potential explanation for these problems, critics refer to the major changes that have taken place in these infrastructures, such as privatization, liberalization and deregulation. Infrastructures that were subjected to waves of restructuring often seem incapable of delivering all of the benefits that they once offered the public. In fact, recently restructured infrastructures seem to experience more than their fair share of problems, in addition to the promised benefits of more choice, a better fit between demand and supply, more and better service quality and lower rates. Infrastructures and the industries that provide services through them have been the focal point of press reports and scandals about reduced levels of safety and service, bankruptcies, exploding prices and problems in achieving a proper form of competition in newly created markets. The public debate: Does restructuring affect safety and reliability? Public unease about the severity and the societal impact of both the Ladbroke Grove accident and the Northeastern American blackout prompted authorities in the United Kingdom and the United States to conduct large-scale public inquiries into the causes of both incidents. In the United Kingdom, the tragic accident at Ladbroke Grove resulted in extensive media reporting and a public inquiry by the Cullen Commission was initiated to investigate the cause of the events (Cullen, 2001a; 2001b).
Similarly, the large-scale blackout in Northeastern America led to the establishment of an independent investigative board to report on the causes of the accident and provide recommendations to prevent future large-scale blackouts (U.S.-Canada Power System Outage Task Force, 2003; 2004).
In both cases, public unease about the incidents led to serious attention to the abovementioned criticisms of restructuring, with specific emphasis on recent changes in both infrastructure industries.
The Cullen inquiry specifically examined the safety regime of the British railways and how the recent privatization program had affected its organization and functioning. Many analyses mention the fragmented nature of the recently restructured rail industry as a cause of reduced levels of safety and increased numbers of accidents (e.g. Jack, 2001; Mathieu, 2003; Muttram, 2003; Smith, 2003). The inquiry that investigated the 2003 Northeastern blackout was explicitly ordered to address the wider issues leading to the blackout. A number of analyses from different sources described the new, decentralized nature of the restructured electricity industry as an important cause.7 In the days immediately after the accident, Michael R. Gent, president of the North American Electric Reliability Council (NERC), the organization responsible for the reliability of the U.S. electricity system, hinted at the importance of this factor when he claimed that the extensive set of rules that had guided the operation of the electrical grid was either broken or rendered inadequate as a result of the institutional changes that had taken place in the electric industry.8
Growing numbers of large-scale failures?
The large-scale accidents and incidents in the U.K. railway and the U.S. electricity industries are by no means unique. A string of incidents in recently restructured industries have fed public unrest and highlighted an apparent connection between restructuring and deteriorating levels of safety and reliability. The accidents in the United Kingdom and the United States seem to be prime examples of infrastructures in which safety and reliability were adversely affected.
The list of crashes on the British railways since privatization9 includes, among others, Southall (1997), Hatfield (2000), Paddington (1999) and Potters Bar (2002). All these accidents resulted in loss of life. Following the Hatfield derailment, which was caused by a defunct track element that should have been replaced, the privatized railway owner Railtrack instituted nationwide speed restrictions on pieces of track that were in need of repair (e.g. Smith, 2003). The consequences were enormous. The speed restrictions resulted in massive delays and the virtual collapse of the train timetables, which in turn evoked widespread public indignation as passengers were advised to travel “only if your journey is really necessary” (Jack, 2001:13). Customers complained about the poor reliability of service and the fact that trains were running with enormous delays – sometimes doubling or even trebling journey times – in the new privatized setting (Mathieu, 2003; Smith, 2003). Furthermore, the Hatfield accident and subsequent developments all but financially bankrupted Railtrack. The company faced compensation claims from independent, private train operating companies (TOCs) for failing to deliver the contracted train slots. Huge sums were necessary to redress the maintenance backlog that was found to be the key cause of the Hatfield derailment. Total estimated costs of the Hatfield crash for Railtrack were more than GB£1 billion (Jack, 2001:85).
The list of large-scale blackouts in the restructured U.S. electricity industry included West Coast blackouts on July 2 and August 10, 1996, and a number of smaller (near-) outages in 1999 (POST, 2000a; 2000b). The West Coast blackout of August 10 set off a rapidly cascading failure throughout the system that eventually broke apart the entire synchronized and interconnected Western U.S. electricity system and caused blackouts in 11 U.S. states and two Canadian provinces (Amin, 2001). The power failure affected an estimated 12 million customers for up to eight hours and cost some US$2 billion (Budhraja, 2002:7).
But by far the most infamous event to occur in the restructured U.S. electricity industry was California’s electricity crisis. In the fall and winter of 2000 and 2001 the Golden State experienced unprecedented power shortages and sky-rocketing electricity prices, ultimately resulting in rolling blackouts. Furthermore, the crisis left key actors in the electricity sector nearly bankrupted, not to mention the State of California itself (e.g. Sweeney, 2002).
Criticism of infrastructure restructuring
the world’s largest power failure, which blacked out the entire Italian peninsula and affected more than 57 million Italians (Bialek, 2003; Eurelectric, 2004).10
Globally, the list of large-scale accidents, crises and near failures in restructured infrastructures is long and includes nearly every type of infrastructure. Albeit on a smaller scale than the Northeastern blackout and fortunately often without inflicting the magnitude of death and destruction of the Paddington train crash, other infrastructures such as water and sewerage systems, natural gas systems and air traffic control systems have experienced crises and large-scale disruptions as well. In all of these infrastructures, linkages have been made to the effects of restructuring (Letza et al., 2004; Shiel, 2004). Since the restructuring of the airline industry, concerns have been raised over the effects on passenger safety after several crashes and the fining of a number of airlines for violations of maintenance and safety regulations (Oster et al., 1992; Savage, 1999). Although fatality rates have declined, accident rates did not change after airline industry restructuring, and there is tentative evidence that financial pressures may have led to reduced safety precautions in areas such as maintenance and training (Savage, 1999:101-102; Button & Stough, 2000:320).
Furthermore, apart from physical infrastructures connected through wires, pipes and ducts, other less tangible but nonetheless vital infrastructures such as the banking industry seem to have experienced problems as a result of restructuring as well. Consider for example that since restructuring and liberalization of the financial industry in the 1980s, the frequency of financial (banking) crises has increased (Benink, 1996; Bordo et al., 2001; Demirgüç-Kunt & Detragiache, 2005).11 The latest well-known incident in the liberalized financial industry was the Long-Term Capital Management (LTCM) crisis, which threatened to lead to a worldwide financial market meltdown (Jorion, 2000; Lowenstein, 2000).12
Based on these and other events, critics claim that restructuring reduces safety and reliability and diminishes the quality of services provided by infrastructures. Although markets might be able to better, and more efficiently, match supply and demand, markets are relatively ‘intolerant’ to errors and therefore less safe and reliable (Landau & Chisholm, 1995). Safety scientist Jens Rasmussen argues that reliability conflicts with efficiency:
Commercial success in a competitive environment implies exploitation of the benefit from operating at the fringes of the usual, accepted practice. Closing in on and exploring the boundaries of the normal and functionally acceptable boundaries of established practice during critical situations necessarily implies the risk of crossing the limits of safe practices.13
Proponents of infrastructure restructuring
On the other hand, there are those who suggest that concerns about safety and reliability are unwarranted when talking about restructuring or market reforms in critical infrastructures. According to these proponents of restructuring, overall, infrastructure reforms display a pretty good track record with regard to issues of safety and reliability. The vast majority of restructured industries across the world did not experience large-scale disasters, nor was the provision of services severely disrupted.
For example, in all countries that restructured the airline industry, safety statistics show no statistically significant declining safety level (e.g. OECD, 1992:33; Rose, 1992; Button & Stough, 2000: 99-100; Gonenc & Nicoletti, 2001). Rather, the opposite seems true. Overall, the death rate in the deregulated U.S. airline business has followed a declining trend since the early 1970s, and nothing suggests that “[d]eregulation has resulted in a worsening safety record or that the air traffic control system has been thus far unable to cope with post-deregulation growth” (Oster et al., 1992:5).
Similar observations have been made in the rail industry. Privatized rail industries in Japan, the United Kingdom and the United States and their safety records seem to show that “[i]t is wrong to argue that the private sector does not care as much about safety as the public” (Thompson, 2003:351). Recent research found that the actual number of fatalities since the U.K. rail privatization actually decreased (Muttram, 2003; Thompson, 2003; Evans, 2004). In his inquiry into the Ladbroke Grove accident, Lord Cullen found:
While there has been a gradual increase in overall safety levels, there is a perception that there has been a decrease in safety.… There was no evidence from which I could conclude that, whatever the way in which privatisation was carried into effect, it would be detrimental to safety. However, some parties and witnesses maintained that the way privatisation had been carried out had had a wide range of consequences that were, directly or indirectly, detrimental to safety.14
Furthermore, proponents of market reform claim that some infrastructures, like for example the Internet and mobile telephony, have blossomed in an environment that resembles those of the most fundamentally restructured infrastructure industries (i.e. liberalized, deregulated and privatized). Bankruptcies and the shutdown of infrastructure operations of large Internet backbone providers such as KPNQwest, UUnet and Global Crossing proved that markets automatically solve threats to the reliability of service provision. Proponents assert that critics of infrastructure restructuring and market reforms tend to highlight only the single events that resulted in large-scale failure and flawed examples of infrastructure reforms. For all large-scale failures and crises that have occurred in restructured infrastructures, alternative explanations exist that have nothing to do with restructuring, market reforms or their underlying principles.
[F]rom 1993-1999 eight near-misses, or ‘signals passed at danger’ (SPADS), had occurred at the location (Signal 109) where the eventual collision and explosion occurred.… At the time of the crash, the signal was one of the 22 signals with the greatest number of SPADS.15
The deteriorating state of the tracks, which was the direct cause of the Hatfield derailment, could be attributed to a systematic lack of investment in track maintenance and replacements traced back to British Rail before privatization (Cullen 2001b:43; Smith, 2003; NAO, 2004). According to the Health and Safety Executive (HSE), numbers of rail breaks reported on the tracks have fallen from a high of 952 in 1998/99 to just 334 in 2003/2004 (HSE, 2004:64). Furthermore, delays per train mile fell significantly after privatization prior to the Hatfield derailment and again dropped after the year 2001/02 (Kennedy & Smith, 2004:174).
Similarly, the investigators found the start of the massive Northeastern power blackout to be partially caused by deficient human decisions (U.S.-Canada Power System Outage Task Force, 2004:18). A failure to adhere to industry policies and operator errors contributed to the scale and damage of the power outage. The situation was aggravated by a long-term lack of investment in the high-voltage transmission grid that had failed to keep pace with rising energy demands, a trend that started long before restructuring (U.S.-Canada Power System Outage Task Force, 2003; 2004). California’s electricity crisis was rapidly condemned by experts and policymakers as an example of how not to restructure electricity industries (Sioshansi, 2000; Besant-Jones & Tenenbaum, 2001; CBO, 2001; CSA, 2001; Joskow, 2001a; Sweeney, 2002). The half-hearted attempts at restructuring in California figured prominently among the factors listed as direct causes or sources contributing to the rolling blackouts and skyrocketing prices. Overall, the California electricity crisis, therefore, has gone down in history as a prime example of botched restructuring, not as a failure of restructuring itself.
A first stab: Outlining the contours of the research problem
The question of whether restructuring affected the safety and reliability of infrastructure services, combined with the apparent controversy that surrounds this discussion, makes this problem important enough to be researched in detail. This dissertation specifically focuses on the effects of restructuring in critical infrastructures on the reliability of service provision for end-consumers. The initial research problem therefore may be formulated as follows:
How does critical infrastructure restructuring affect the reliability of service provision?
Critical infrastructures
The two infrastructures that figured in the description of the accidents at the start of this prologue may be viewed as classical examples of so-called ‘critical infrastructures’. Although there is no universal description of critical infrastructures (Moteff et al., 2003; Farrell et al., 2004:439), this research views critical infrastructures as part of a larger set of services and products that are considered essential to the functioning of our modern economies and societies (Little, 2002; DHS, 2003a; 2003b; NRC, 2002; Luiijf et al., 2003a). We can distinguish an amazingly heterogeneous and large set of so-called ‘large technical systems’16 providing services and commodities that may be considered vital.17 Our modern Western society simply cannot function without those services. Among the vital systems are those for energy, information technology, telecommunications, health care, transport, water, government and law enforcement, and banking and finance.18 The failure to reliably provide such important services may be disastrous for whole economies.19 A specific subset of these large-scale systems is formed by services provided through complex, large-scale technical infrastructures and the organizations involved in their management. It is this subset that we refer to in the remainder of this study as ‘critical infrastructures’, ‘infrastructures’ or ‘infrastructure industries’:
[G]rid-based socio-technical systems, organized around a specific distribution channel that has been built solely for the purpose of delivering the system’s specific commodity to its final destination.20
Among these systems are road and rail networks, electricity networks, telecommunications networks, oil and natural gas networks and water supply networks.21 These infrastructures may be considered the arteries and veins of Western, urbanized societies and are also usually referred to as “critical infrastructures” (Zimmerman, 2001; Little, 2002; Moteff et al., 2003). The specific characteristics these systems display make them, according to LaPorte:
- tightly coupled technically, with complex organizational and management ‘imperatives’ prompted by operating requirements designed into the system, that is, unless operations are carried out in specific ways, there are no benefits and perhaps great harm can be imagined;
- prone to the operational tendencies or logic of network systems, that is, exhibit a drive to achieve maximum coverage of infrastructure and internal activity or traffic within the network;
- non-substitutionable services to the public, with few competing networks delivering the same service (the more effective the system, the more likely its monopoly);
- the objects of public anxiety about the possible wide-spread loss of capacity and interrupted service (the more effective it is, the more likely the anxiety); and …
Reliability
Previous sections extensively elaborated on reliability in infrastructure industries. However, so far no proper definition of reliability has been provided. To engineers, reliability is a key attribute of the quality of a product and is defined as “the probability that an item will perform a required function without failure under stated conditions for a stated period of time” (Landau & Chisholm, 1995:72).
To assess the effects of restructuring on the reliability of critical infrastructures, a stated period of time would have to be determined, and specification would have to be made of the stated conditions and the required functions to be performed. In short, measures of reliability are in the end subjective and political in nature (Weick, 1990; Rochlin, 1993b). But since the research problem questions the effects of restructuring on reliability in different critical infrastructure industries, a technology-independent and uniformly applicable measurement of reliability is needed.
Another problematic issue about reliability is that it may be described as a ‘dynamic non-event’ (Weick, 1987). Reliability is dynamic in the sense that it is an ongoing condition. Reliability indicators, however, are static and only indicate that a system is
momentarily under control. Reliability necessitates constant attention, and ensuring that a
system is reliable necessitates continuous feedback. Reliability is actually a non-event, because the outcome, the reliable provision of services, is virtually constant (Weick, 1987:118; Hofmann, et al., 1995:144). Large-scale failures, disruptions of service provision, occur rarely in critical infrastructures. Consequently, using accident and reliability statistics to extrapolate decreasing or increasing levels of safety or reliability is problematic, if not downright impossible. Because of the very success of technology development and the ability to operate infrastructures, reliability is an almost hidden characteristic. It is an attribute of service provision that is noticeable only when it is absent, i.e. when the provision of services is interrupted or disrupted.23
Nevertheless, a classification can be constructed of the disruptive or interruptive events that affect the reliability of services from critical infrastructures. First, there are the routine events that, although disruptive, are largely taken for granted by society. Among these are disruptions and delays suffered in transportation networks, such as traffic and flight jams, small departures from railway schedules, occasional ‘spikes’ or disruptions in the provision of electricity and telephony services and the ‘cannot find server’ messages or slow Internet connections. Since these disruptions rarely block access to critical services (for long), society seems to take them for granted.
Second are interruptions of services due to small-scale failures in critical infrastructures. Although these failures occur perhaps less often than the routine disruptions, their effects are larger, as services from critical infrastructure to (small) groups of people are temporarily interrupted. Nevertheless, the overall impact and societal disruption of small-scale failures is usually limited.
At the far end of the reliability spectrum are the large-scale critical infrastructure failures that severely disrupt society, generally because of their magnitude or persistence.
The importance of reliable critical infrastructures
Infrastructure reliability has become a priority issue. In the past, critical infrastructure reliability was studied as an integrated element of preparations for Cold War conflicts (Farrell et al., 2004:438-439). Widespread policy attention and concern about the dependence of modern day Western societies on such things as electricity and transportation infrastructure only (re)surfaced in the late 1990s, gaining new vigor in the wake of the Y2K problem (Perrow, 1999c) and the terrorist attacks of September 11, 2001 (NRC, 2002; Wallace et al., 2002).24 The reason for this is that one of the unfortunate paradoxes of policymaking seems to be that mitigating policies are only ordered after previous policies have failed to prevent large-scale disruptions, disasters or major loss of life (cf. Farrell et al., 2004). In the wake of terrorism, Y2K and large-scale failures such as California’s electricity crisis or Railtrack’s bankruptcy new concerns were raised about the potential vulnerability of key infrastructures. The possible unreliability of infrastructures proved to be a socially sensitive issue.
The increased attention to the criticality of these infrastructures and their services is based on at least three interrelated trends. First, it bears repeating that humans and organizations in Western, urbanized societies increasingly depend on the services that are provided through these infrastructures. The second half of the 20th century saw the rapid acceleration of this societal dependence on infrastructure services (e.g. Graham & Marvin, 1996; 2001).25 For example, electricity use as a percentage of total energy use in the United States economy rose from 25 percent in 1970 to nearly 40 percent in 2002 (Samotyj et al., 2002). The increasing use of infrastructures and the services provided through them has given rise to increasing demands with regard to quality and reliability of service provision. To accommodate these demands, the systems that provide these services have grown in size and complexity into today’s enormous, large-scale infrastructure industries to “[g]uarantee the ongoing production, distribution, use and disposal of almost all goods in almost all organizations of a society” (Joerges, 1988:25).26
Each and every one of our modern-day critical infrastructures can truly be called an engineering marvel. Few of us comprehend just what it takes to get our drinking water out of the tap or how a (mobile) telephone call is actually made. Think only of the complexity of the telephone network with its thousands of interconnected computers and wires that enable us to talk to the person at the other end of the line;27 or the intricate system of pipes, pumps and storage facilities through which fresh water is somehow collected, transported and distributed to your doorstep. Another intricate network of sewers and wastewater purifiers then disposes the dirty water.28 Then there is the electricity network. The U.S. electricity system – hailed by the U.S. National Academy of Engineering as the 20th-century engineering innovation most beneficial to our civilization (Amin, 2005) – has been described as the world’s largest and most complex machine: “[A] very complex system. It’s probably the most complex system ever invented by man, more complicated than a moon shot.”29
United States. Together this system represents an estimated value of US$800 billion.The U.S.-Canada Power System Outage Task Force (2004:5) estimates the U.S. electricity system represents more than US$1 trillion in asset value, consisting of some 320,000 kilometers30 of high-voltage transmission lines, which interconnect nearly 3,500 utility organizations that jointly serve well over 100 million customers and 283 million people. Overall, large-scale critical infrastructures have achieved impressive levels of reliability. Most of the time we take the services we obtain from these infrastructures for granted. The level of reliability they have achieved far outclasses the performance of ordinary production technologies and organizations. An extreme example of the reliability performance of our critical infrastructures is provided by the Dutch natural gas infrastructure, which registers service disruptions of only 10 to 15 seconds per year (EnergieNed, 2003a:13).
Indeed, the second reason for the increased attention to reliability of critical infrastructures lies in the extremely high, near-continuous levels of reliability that are currently provided. Critical infrastructures have performed so reliably and have remained invisible to society to such a degree that the reliability of service provision has become something that society mostly takes for granted (Graham, 2000:184; Jacobson, 2000:1). When we push the light switch we expect the lights to go on. When we turn the tap we expect clean drinking water. We complain and may feel severely inconvenienced in our daily routines when these services are somehow not instantly available. Boin et al. (2003:100) describe how our dependence has resulted in “[a] widespread loss of patience with glitches and breakdowns that interrupt service delivery.” Society is no longer accustomed to coping with unreliability in the provision of vital services, implying a dependence on the nearly constant availability of these services that might have even larger impacts than any (threatened) disruption.
A final factor underlying the current attention to the criticality of a number of vital services is that modern Western societies still continue to increase their dependence on the provision of services from critical infrastructures (e.g. Steetskamp & Van Wijk, 1994; PCCIP, 1997; Boin et al., 2003; Herder & Thissen, 2003; Luiijf et al., 2003a). With this growing use of and dependence on critical infrastructures comes an increased need for higher levels of reliability. Society demands that the commodities and services provided through networked infrastructures are available 24 hours a day seven days a week, year-round in an always-on global information economy (Castells, 2000).
With this level of dependence comes a need for higher levels of reliability and quality, as the potential for damage resulting from unreliability increases. The sophistication and sensitivity of new technologies and products, for example, inflates the need for reliable, high quality electricity provision (Amin, 2001). High-value critical processes in data processing systems, server farms, financial institutions and telecommunications providers demand a continuous, reliable power supply (Samotyj et al., 2002). Similarly, computer users demand unprecedented levels of reliability from high-speed Internet connections and from mobile telephones, as society increasingly relies on the availability of such services, anywhere, anytime (Noam, 2001:203). In short, the current levels of reliability are simply not good enough for the services we will demand from them in the near future (e.g. Israel, 1992).
Restructuring: Increasingly interconnected…and fragmented
The increased awareness of the potential vulnerability of our critical infrastructures has focused attention on the reliability of our so-called ‘critical infrastructures’. Recent studies and reports show that all critical infrastructures are not only complex in themselves, but are also (increasingly) complexly interrelated and dependent on each other’s constant availability (Rinaldi et al., 2001; Zimmerman, 2001; Boin et al., 2003; DHS, 2003a; 2003b; Luiijf et al., 2003a; Little, 2002; Mussington, 2002).31
However, at the same time, we witness another development. Restructuring has thoroughly changed critical infrastructure industries. Strangely enough, “[t]he change in the institutional organization of many infrastructures that has occurred over the last two decades is closely related to the increasing importance of infrastructures to modern societies” (Schneider & Jäger, 2003:101). The formerly vertically integrated monopoly services have been ‘unbundled’ and in most of these segments, competition has been introduced. Under the label of ‘economic restructuring’ or ‘market reform’, developments such as privatization, liberalization and deregulation have figured prominently. The 1980s and 1990s were the hallmark of what we call ‘market reforms’ or the ‘restructuring’ of our critical infrastructures:
As the term implies, ‘restructuring’ entails a clean break with past public choice practices, corporate governance protocols, management methods, and institutional arrangements. It implies as well, a fundamental recalibration of service expectations and service delivery standards.32
These changes also affected large-scale critical infrastructure industries (Vickers & Yarrow, 1988; Bouttes & Leban, 1995; Graham & Marvin, 1996; Beesley, 1997; Newbery, 1999). Until recently, most of these industries were largely embedded in the public sector (Rochlin, 2001:72). The environments in which the systems operated were relatively stable and the large-scale infrastructures and organizations that provided the services were largely invisible to the public. However, the last decades of the 20th century significantly altered these characteristics.
With the privatization, liberalization and deregulation of infrastructure industries, societies also witnessed an increased fragmentation in infrastructure organization and management (Graham & Marvin, 2001). Infrastructure industries “[a]re no longer organisationally unified or integrated, even though they may technologically be based around, say one single, large electricity or gas network” (Guy et al., 1997:192).
highly competitive markets to areas of strict regulation) with differing responsibilities and goals (ranging from short-term profit maximization to attainment of public goals). For example, within 15 years (between 1985 and 1999), the U.K. telecommunications industry witnessed an increase in the number of licensed fixed-line operators from two to more than 150 in an extremely competitive and dynamic market (Stern & Trillas, 2003:191). Thus, the very forces responsible for the increased integration and interdependence of the technology at the same time may be considered the prime causes of institutional fragmentation – which occurred concurrent with a swiftly rising demand for reliable service provision. The question that could be asked is how the changes resulting from restructuring have affected the reliability of critical infrastructures.
Empirical research: Does restructuring affect reliability?
The question of whether restructuring of critical infrastructure affects the reliability of the services provided at first appears highly relevant and relatively easy to answer. However, no unambiguous answer can be provided.
First of all, there is a lack of uniform reliability performance data. If provided at all, reliability data is fragmented and scarcely comparable across specific industries or countries, let alone across different types of critical infrastructures. Most infrastructure industries simply have not kept track of long-term reliability trends. Furthermore, publicly accessible sources of information on infrastructure industries fail to provide adequate longitudinal historical data that allows comparisons of reliability performance before and after restructuring.35 Consequently, there are few comprehensive scientific studies that provide an overall and integrated assessment of the effects of restructuring or the reliability performance of any infrastructure industry, let alone a comparison of different infrastructures (e.g. Héritier, 2002).
Secondly, as described in more detail below, a small and non-representative sample of key reliability performance indicators yielded findings that support both sides of the policy debate.
Restructuring reduces the reliability of service provision
[T]here have been increasing incidences of power outages in the United States. Major power outages used to occur every 10 to twenty years, but, in recent years, power outages or near misses are being experienced around the country almost every year. There is concern about understanding factors that are contributing to increasing power outages.36
In 1999 the United States was hit by a number of large-scale power failures, which were subsequently investigated by a team of electricity experts (POST, 2000a; 2000b). Then, in 2003, the massive Northeastern blackout occurred.
Similar problems have been reported in other countries that have restructured their electricity industries. For example, in the Netherlands electricity provision to end-customers between 1976 and 2002 was interrupted only 14 to 37 minutes per customer per year on average (EnergieNed 2003a; 2003b). However, newspapers report a rising number of electricity outages in 2002 and 2003 (up 13 percent), leading to an increase in the average annual interruption from 28 minutes in 2002 to 31 minutes in 2003.37 Long-term data provided by the Dutch energy industry show a rising trend in annual interruption figures since restructuring, which contrasts with the lower figures, which were achieved throughout the 1980s and early 1990s.38
Other critical infrastructures have been affected by a reduced reliability of services as well. Britain’s restructured railway industry, for example, witnessed a structural reduction in the percentage of trains arriving on time, which fell from 89.7 percent in 1997/98 to 79.2 percent in 2002/03 (Crompton & Jupe, 2004:16; NAO, 2004:14). These numbers contrast sharply with the steadily increasing punctuality when rail transportation throughout the United Kingdom was provided by British Railways (BR). According to Crompton and Jupe (2004), the proportion of intercity trains arriving on time rose from 77 percent in 1986/87 to 91 percent in 1993/94, and the proportion of all trains arriving on time reached 90 percent in 1993/94. Similarly in the Netherlands, the restructured railways experienced declining punctuality standards since the management and operation of the system was cut up into five parts. Punctuality rates dropped from over 85 percent in 1999 to 79.9 percent in 2002, leading to the resignation of the CEO of the Dutch national rail transport company (the NS) (Vromans, 2005:3).
Restructuring does not affect the reliability of service provision
According to Pollitt and Smith (2001:25-27), the reliability of service provision of the United Kingdom’s restructured railway industry actually increased “[s]ignificantly since privatization” before the Hatfield accident compared to before privatization. Train punctuality improved by 2.7 percent compared to the 1 percent during the BR period. Sweden’s restructured railway industry also showed a slightly positive trend in reliability since restructuring (Kopicki & Thompson, 1995:198-199).
the average number of power cuts per 100 customers and a reduction of more than 30 percent in the average duration of power cuts per customer (De Joode et al., 2004:121). Similar findings are reported for the telecommunications sector. In 2002 and 2003 annual reports, the Network Reliability Steering Committee (NRSC) commented on the increased reliability of the U.S. Public Switched Telephone Network (PSTN) (NRSC, 2003; 2004). The total outage frequency fell by 16 percent, contributing to the lowest reported outage frequencies since the NRSC started reporting in 1993 (NRSC, 2003:i). Especially considering the fact that the public telecommunications network grew significantly in this period, these achievements seem to prove the claim that restructuring does not affect the reliability of service provision.39
Conclusion: An inconclusive empirical puzzle
An intriguing observation can be made when comparing the results of studies that try to measure the reliability performance of infrastructures in the wake of market reforms. The empirical data presents a theoretical and empirical anomaly. If it is true that the consequences of restructuring of our critical infrastructures diminish the reliability of the services provided, as opponents of restructuring claim, why haven’t we witnessed more disastrous and crippling large-scale interruptions in our infrastructures? The majority of our restructured infrastructures appear as reliable as ever, with continued high levels of service. Luckily, as we have already noticed, large-scale failures and disruptions occur only rarely. Are the critics then overstating their case and addressing a non-issue? Are the recorded large-scale failures just unfortunate incidents in no way connected to the restructuring efforts in these industries?
On the other hand, large-scale failures have happened in restructured infrastructures. If restructuring – as proponents assert – allows for the provision of highly reliable services in competitive markets and restructured industries, why have large-scale interruptions occurred in infrastructures that had achieved a highly reliable performance record in the past? And, why do some research findings point towards reduced reliability performance? Even if, based on the present data,40 it can be assumed that market reforms and restructuring in no way influence the reliability of infrastructures, the examples above are compelling enough to warrant further caution in restructuring processes. The problem is that we simply do not know what effects restructuring has on the reliability of services from critical infrastructures. We lack a single index or value to describe or define the reliability of service provision of infrastructures or vital services.
Performance as a key indicator of reliability
To judge the effects of restructuring on the ability of infrastructure industries to provide reliable services, this research uses a technology-independent performance indicator. This indicator expresses previously achieved levels of reliability “in terms of frequency and length of (total) disruptions of service” per customer per year (Thissen & Herder, 2003:291).41 This means that the research focus is naturally on events that significantly contribute to the disruption and interruption of the provision of services and includes large-scale critical infrastructure failures. However it also explicitly includes the small-scale failures and routine disruptions that have a cumulative effect on service reliability.
critical infrastructures. Whether restructured or not, they can be described with an impressive number of nines (Table P-1). It thus bears repeating that even what we term ‘modest’ reliability of service provision in our critical infrastructures, of say 90 percent, is far more reliable than any of the services provided by ‘regular’ technologies and organizations we encounter in our daily lives.
A list can be compiled based on reliability percentages reported for the services provided by different critical infrastructures. At the bottom of the list are transportation infrastructures, such as road, air and rail transportation.42 For example, various railway industries achieve reliability percentages – otherwise known as punctuality percentages – of around 90 percent compared to their scheduled services. Wolmar (2002:221) describes how the London metro achieved a reliability percentage of 92.9 percent in 2001/02, while the National Audit Office (NAO) showed that the reliability of the privatized British railways ranged from 92 percent in October 1997 to an unusually low 65 percent in the winter of 2000 as a result of the Ladbroke Grove accident and the subsequently enforced speed restrictions (NAO, 2004:14). A comparison of punctuality percentages across European countries confirms that punctuality in 2000, with a delay of five minutes constituting lateness, varies between 90 and 95 percent (Vromans, 2005:11).
TABLE P-1: RELIABILITY OF SERVICE PROVISION Level of reliability Downtime per year
90.00% 36 days
95.00% 18 days, 6 hours
99.00% 3 days, 15 hours, 40 minutes 99.50% 1 day, 19 hours, 48 minutes 99.90% 8 hours, 46 minutes 99.95% 4 hours, 23 minutes 99.99% 52 minutes, 36 seconds 99.999% 5 minutes, 15 seconds 99.9999% 32 seconds 99.99999% 3 seconds
Source: based on: Audin, G. (2002), p. 23, Table 1
According to Barabási (2002:111) (critical) infrastructures provide reliable services because of their inherent properties; their highly interconnected, networked structure. This robustness is further increased by decades of engineering efforts to improve this robustness and deal with everyday failures and problems. Infrastructure architecture, for example, employs ring- or star-type systems to enhance reliability and ensure that resource centers (e.g. power plants or telephone switches) are evenly distributed across infrastructures. Another frequently applied reliability design principle is the famous N-1 design criterion, which prescribes that a system, composed of N components, be resistant to random failures of a single component. Some parts of vital infrastructures, such as the high-voltage grid in the Netherlands, apply an N-2 design criterion, while certain core elements in mobile telephony networks are even triply redundant.
Furthermore, infrastructure management employs elaborate routines and procedures to maintain reliability (e.g. operational procedures and preventive maintenance). Thanks to the effectiveness of engineered safety measures, large-scale infrastructures are largely impervious to small, isolated failures (e.g. Reason, 1997; Perrow, 1999a).44 This is just as well. For despite all of the abovementioned measures, “[s]mall failures abound in big systems” (Perrow, 1999a:9). The sheer magnitude and number of parts that encompasses national critical infrastructures is staggering and failures occur in many of these parts due to malfunctions or simply because of fatigue or wear.
Nevertheless, as argued before, societies appear to need high levels of reliability from the vital services provided through critical infrastructures, to sustain the information and network society. “While efficiency was the hallmark of deterministic industrial-era technology, reliability is the hallmark of stochastic, continuous technology and is associated with the postindustrial era” (Weick, 1990:11). This means that the reliability of advanced critical infrastructure industries in urbanized Western countries is increasingly dependent on complex organizational structures that manage the information needed to maintain the reliability of service provision (LaPorte, 1996).
Effects of large-scale infrastructure failures on restructuring policies
The lack of a clear scientific verdict on the effects of restructuring on the performance of critical infrastructures has also affected the policy domain. Although restructuring was initially embraced as the panacea for all problems involving most infrastructures, the enthusiasm for restructuring slackened in the late 1990s.
Following large-scale failures in restructured infrastructures such as the Hatfield accident and the subsequent Railtrack crisis, the LTCM episode in the finance industry and California’s electricity crisis, politicians and policymakers have responded to growing public unrest and media reports about fears of reduced reliability and compromised safety. Thus reliability in restructured infrastructure industries now figures prominently in policy-level market reform debates (e.g. CPB, 2004).
The British government largely stopped funding Railtrack after Hatfield and applied to the courts for an administrative order alleging Railtrack was all but bankrupt. The government then commissioned a not-for-profit limited-by-guarantee company, Network Rail, to take over the role of national rail network operator for GB£9 billion (Wolmar, 2002:114). The government is currently investing over GB£33.5 billion to improve the safety and reliability of the British rail network in the next decade (Thompson, 2003:350). Finally, it should be noted that “[s]ince rail privatization, ten of the 25 train operators have returned to the government to ask for more subsidy and all have received it” (Wolmar, 2002:219).
The U.S. Federal Reserve Bank brokered a bail-out of LTCM and the government undertook a study on the lessons learned from the crisis (President’s Working Group on Financial Markets, 1999; Lowenstein, 2000).
Because of these events, major planned restructuring projects in various infrastructure industries have been tempered or even reversed in the last few years. The Dutch Parliament, for example, prohibited the privatization and liberalization of drinking water utilities, postponed privatization of Amsterdam Airport Schiphol (AAS) and invested over €3.5 billion to (re)acquire public ownership of the Dutch high-voltage grid (Tennet) and the national gas distribution network.45
We may characterize the initial research problem of whether critical infrastructure restructuring affects the reliability of service provision as a typical ‘wicked’ problem, one for which there seems to be no clear-cut answer. We lack the non-objectifiable information we need to establish whether critical infrastructures were more reliable before or after they were restructured; and there are currently two conflicting views on the effects of restructuring on the reliability of service provision. Thus, we seem to have reached a deadlock.
Opening the black box: How do infrastructures cope with restructuring?
considering how organizations that manage critical infrastructures are affected by restructuring and how they cope with the effects of restructuring. Starting from the assumption of the opponents in the restructuring debate, the central research question is formulated as follows:
Has increased institutional fragmentation undermined the preconditions for reliable service provision and how have organizations that manage critical infrastructures coped with these changes?
This research takes us beyond the world of reliability performance figures to address how reliable service provision is actually achieved in infrastructure industries that employ large-scale technologies.
The research question is divided into two distinct parts that are guided by separate sub-questions. The first part reads:
Has increased institutional fragmentation undermined the preconditions for reliable service provision in critical infrastructures?
Strangely, this question is rarely asked in debates concerning infrastructure restructuring, as neither proponents nor antagonists of restructuring display detailed knowledge and understanding of the consequences of restructuring for the organization and reliable management of critical infrastructures. Few people have an overall knowledge of how infrastructures actually provide reliable services. Although large-scale technical systems such as critical infrastructures provide the framework in which modern society functions, relatively little is known about their functioning as social systems consisting of networks of interdependent organizations and complex, linked technical systems.
The second part of the research question aims to explain the mixed performance of restructured critical infrastructure industries with regard to the provision of reliable services:
How have organizations that manage critical infrastructures coped with the changes resulting from institutional fragmentation?
Thus, the research looks specifically at the ability of organizations that manage infrastructures to cope with the effects of institutional fragmentation. The lack of a coherent explanation for reliability performance records reveals a fundamental lack of knowledge about the impact of organizational fragmentation on reliability. So far, no explicit theories have been developed that address this issue. This is remarkable considering that scholars have formulated explicit arguments about how society deals or should deal with the risks and rewards of modern-day large-scale complex technologies, many of which are provided in an institutionally fragmented environment (Morone & Woodhouse, 1986; Wildavsky, 1991; Beck, 1992; Perrow, 1999a).
the way in which the organizational structure and the management of systems influences their safety and reliability (Hale et al., 1998:1).
In policy debates about restructuring – even the more recent ones – in which issues of reliability and continuity of service appear as core values, none of the arguments by either proponents or opponents of restructuring display more than a superficial analysis of a highly select set of (expected) effects that may result from restructuring efforts. In the past decades it would seem that we have been radically changing our large-scale critical infrastructures without fully understanding what makes these systems work and what makes them fail.
What essential coordination mechanisms, which were previously provided through hierarchical structures in the vertically integrated network industries, disappeared and are now provided under market conditions to ensure the reliable operation of critical infrastructures? What mechanisms replaced them and how have these performed so far? According to Roberts and Gargano (1990:148), “[s]ocietal problems are increasingly framed in inter-organizational terms,” and this research is no exception. After all, we live in a networked society (Castells, 2000). This knowledge may help us to gain a different view and understanding of critical infrastructures and how they function, as networks of interrelated organizations. Critical infrastructures over the decades have become so large and interconnected that many organizations contribute to them. No infrastructure is controlled through a single organization that is solely responsible for the reliable provision of services to end-consumers. Instead, infrastructures are controlled by multiple organizations which assume responsibility for the reliable provision of services in a certain geographically or technically defined area. For example, the U.S. electricity system consists of some 140 major control areas that manage portions of the electricity system (U.S.-Canada Power System Outage Task Force, 2004:11).
Most infrastructures existed long before restructuring and the current situation in which reliability is provided by scores of organizations is not particularly new (cf. Barabási, 2002). Nevertheless, we viewed critical infrastructures as large-scale machines controlled by large, vertically integrated utilities because they remained relatively self-sufficient, rather than as technologies that could provide services through interconnected webs of organizations.47 Liberalization changed that. We speak of new infrastructure markets in terms of competitiveness, price and services, yet few of us have even a remote clue as to how these markets and technologies actually function and how these recent innovations – if at all – influence the reliability with which services are delivered.
This research aims to remedy this lack of knowledge. The key to studying the effects of restructuring on the reliability of service provision in our critical infrastructures may be found in the context that has transformed the world of critical infrastructures from large-scale hierarchical organizations into networks of organizations.
Reader’s guide
Chapter 4: Then ...the lights went out California’s electricity restructuring
Chapter 5: The critic’s case Why California’s electricity restructuring should have failed
Chapter 8: The critic’s case
Why KPN Mobile’s services should have failed
Chapter 3: Research on critical infrastructures An introduction to the cases
Chapter 7: The wireless revolution Mobile telephony in the Netherlands Part II: Case electricity
Chapter 6: Powering the grid How the electricity kept flowing
Chapter 10: Conclusion
Networked reliability in infrastructures
Chapter 9: Reliable mobile services High performance in the mobile industry
Part IV: Conclusion
Part III: Case mobile telephony Chapter 2: How to organize for reliability
Theories of reliability
Chapter 1: Interconnected, yet fragmented A short study of critical infrastructures
Part I: Theory
reader beyond the virtual markets that now dominate our restructured critical infrastructures to focus on the control and management of the physical flows and services that speed through our infrastructures. We enter the world of control rooms, where rows of screens display the tools of operations and management.
The study is composed of four parts (Figure P-1), each of which can be read separately. Part I provides the theory that guides this research and consists of chapters one through three. Chapter one traces the history of infrastructures and looks into the predominant pattern by which these systems developed over time. Furthermore, the chapter describes in some detail how and why critical infrastructures were restructured and how this affected their organization and management.
Chapter two describes the organizational theories used to assess the effects of restructuring on the ability of organizations that manage infrastructures to provide highly reliable services to end-consumers. Two different organizational theories are explored but found wanting with regard to their applicability in an environment consisting of networks of organizations.
