Some nuclear power plant operators have to periodically go to a simulator and pass a certification test. The purpose of the test is to make sure that operators have the expertise that is required to operate the plant safely and effectively. The focus during testing is on evaluating whether operators can deal effectively with severe, abnormal events. These fault situations rarely occur on the job, but they can seriously threaten the integrity of the plant and the welfare of the public. During these events, operators are supposed to follow a set of written procedures that tell them what actions to take to cope with different kinds of abnormalities.
At one plant, operators would not always follow the written procedures when they went to the simulator for recertification. They deviated from them for one of two reasons. In some cases, operators achieved the same goal using a different, but equally safe and efficient, set of actions. In complex sociotechnical systems, like nuclear power plants, there is rarely one best way of achieving a particular goal. In other cases, the operators would deviate from the procedures because the desired goal would not be achieved if the procedures were followed. It is very difficult to write a procedure to encompass all possible situations. A small change in context might require different actions to achieve the very same goal. In either case, the operators' actions seemed justifiable, particularly in the latter set of circumstances. The people who were evaluating the operators in the simulator did not agree, however. They criticized the operators for "lack of procedural compliance." Despite this admonishment, the operators got their licenses renewed.
This happened several times. Eventually, the operators became frustrated with the evaluators' repeated criticism because they felt it was unwarranted. The operators decided that, the next time they had to go into the simulator for recertification, they would do exactly what the procedure said--no matter what. One team of operators followed this "work-to-rule" approach in the simulator and became stuck in an infinite loop. At one point, an emergency procedure told operators to switch to another procedure, but then that procedure eventually sent operators back to the first one. The operators dutifully followed the procedures, and thus wound up in a cycle, repeating the same set of actions several times. The evaluators were not amused. They eventually turned off the simulator, ending that particular test.
Later, the evaluators wrote a letter to the utility that employed this group of operators. In that letter, the evaluators criticized the operators yet again, this time for "malicious procedural compliance."