It looks manageable, until it isn’t

It’s easy, in hindsight, to imagine the Three Mile Island accident as the kind of event that would have felt obvious while it was unfolding. It didn’t. Inside the control room, things looked busy, but familiar. Panels alive with data, alarms chiming in uneven bursts, operators moving between stations, doing what they had done hundreds of times before. Anyone who has spent time around complex systems knows the feeling. Noise is part of the job. You learn to filter it, or you don’t last long.

The sequence that matters begins quietly. A relief valve opens to bring pressure down. Routine. Then it sticks. Less routine, but still not dramatic on its face. Coolant starts to escape from the primary loop, gradually, without spectacle. Meanwhile, the panel reports that the valve has been closed. Technically, that signal is accurate, the command was issued. What it doesn’t tell you is whether the hardware obeyed. So from the operators’ vantage point, the system still holds together.

Then another piece enters the picture. The pressurizer level climbs. Under ordinary circumstances, that reading would point toward excess water in the system. The response follows that logic. You ease back on emergency cooling, because pushing more water into a system that already appears full makes little sense. It’s a measured decision, not a reckless one. And that’s where it becomes uncomfortable. Because nothing in that chain feels careless. Each step has a rationale. Each move is anchored in training. If you sit in that chair, with those instruments, you probably do the same thing.

What’s harder to grasp, even now, is how long that picture holds together. There’s no single moment where everything snaps into focus and announces that something deeper is wrong. Instead, the system drifts, almost politely, staying just coherent enough to support the next decision. Later, of course, it all looks neat. A valve that never closed. Coolant leaving the system. An indicator that reflected intent rather than reality. A set of responses built on that mismatch. You can draw a straight line through it. But that line didn’t exist at the time.

The plant itself, in a narrow sense, performs. Containment holds. The release of radiation remains limited. No one dies. No one is acutely injured. If you stopped the story there, you might even call it a success of engineering safeguards. The story doesn’t stop there. Outside the plant, the consequences take on a life of their own. Projects stall. Regulations tighten. Public confidence shifts, quickly at first, then more permanently. The name “Three Mile Island” becomes shorthand, even for people who have never looked at a diagram of a reactor. Once that association sets in, it’s stubborn. You can fix hardware. Reputation is a different kind of system.

When systems become harder to see clearly

Charles Perrow tried to make sense of events like this by stepping back from the specifics. In Normal Accident Theory, he describes systems where complexity and tight coupling make certain failures part of how the system behaves over time. In those environments, small disturbances don’t sit still. They travel. They combine with other conditions. They show up in places that feel disconnected from where they started. The system behaves less like a collection of parts and more like a web of relationships that shift under load.

At Three Mile Island, information wasn’t missing. If anything, there was too much of it. Instruments were reporting continuously, each one with its own assumptions built in. Some values came straight from physical measurements. Others reflected commands. A few were derived, stitched together from multiple inputs. Most of the time, those differences don’t cause trouble. The system is stable, and the signals line up well enough. Under stress, those small distinctions begin to matter. Not all at once. Just enough.

You follow one reading because it makes sense, then another interrupts it, and by the time you circle back, the context has shifted. It’s a subtle experience, but a familiar one if you’ve ever tried to diagnose something complex while it’s still changing under your hands. And no one is holding the entire system in their head. That’s not how these environments are built. Work is divided, necessarily, across teams and specialties. Each group understands its slice well. Bringing those slices together into something coherent takes time, and time is exactly what tightly coupled systems tend to remove when something starts to go sideways.

Aviation offers a version of the same dynamic. In 2009, Air France Flight 447 lost reliable airspeed data after ice crystals interfered with its sensors. The aircraft itself remained structurally sound. The crew kept working the problem. What shifted was their footing. The cues they relied on no longer lined up cleanly with the aircraft’s behavior. Automation disengaged, and suddenly the relationship between input and response felt less predictable. Each action made sense in isolation. The overall picture was harder to stabilize. Again, the reconstruction afterward reads cleanly. The experience in the moment does not.

You can see something similar, in a quieter form, in how large companies lose their edge. For years, BlackBerry Limited had what most firms chase for decades, dominant market share, loyal customers, products that fit their users’ needs with almost surgical precision. The data reflected that strength. The feedback loops reinforced it. From the inside, the system looked healthy. At the same time, other shifts were picking up speed. Touch interfaces were improving faster than expected. Software ecosystems were becoming central rather than peripheral. Phones were turning into something broader, less a communication tool and more a platform for everything else.

None of those changes, taken alone, forced a break from what had worked. Together, they changed the ground under everyone’s feet. Inside the company, decisions followed the signals that felt most reliable, because that’s what you do when you’re operating in uncertainty. The harder part, always, is recognizing when those signals are part of a larger pattern that doesn’t resemble anything you’ve seen before. By the time that pattern becomes obvious, the system has already reorganized around it.

What this leaves us with

Across these examples, the thread is consistent, even if the settings are wildly different. People are paying attention. Systems are instrumented. Decisions are being made continuously. The difficulty sits in how things connect. A system can feel understandable, even as it moves into a configuration that calls for a different response. By the time that need becomes clear, some of the easier options have already slipped away.

That shift doesn’t arrive with a headline. It builds, quietly, in the background, until the shape of it is hard to ignore. And by then, you’re no longer choosing from the same set of possibilities you thought you had. Which leaves a question that’s harder than it sounds. When all the pieces are visible from the start, what allows them to come together early enough to change what happens next?

Why Smart Teams Miss Obvious Failures