), as macro social configuration (7). I come back in the first section of this article on this in order to situate Hopkins' argument. To do so, I use the insights from organisation theory on the complex relationships between structure, culture, power, technology, goal and environment. Hopkins' view is that "structure creates culture" which depends on the degree of centralisation (6). In a second section, I go one step further to situate Hopkins' argument, coming back on four decades of publications in order to bring the distance needed to characterise his message, its context (in particular, its rejection of safety culture) and retrospective rational. One conclusion is that his argument allows safety research to explicitly target top management decisions while offering a sociological and practical perspective. However, to elaborate his argument, Hopkins makes a certain number of simplifications which are discussed. I finally add that structure as a degree of centralisation is an opportunity to move one step closer to strategy. This complementary move is needed when one studies empirically daily operations of high-risk systems.

Introduction

Structure is an important feature of organisations. Weber described bureaucracies at the beginning of the 20 th century based on division of labour, hierarchy of authority and formalisation of rules (Weber, 1919) 1 . This description remains the classical approach of structure in organisation theory from which alternative and complementary topics have been developed. Structure is indeed systematically introduced as one core category in the widely read manuals of this field, along other equally fundamental ones such as technology, environment, culture, goals or power (e.g. [START_REF] Perrow | Complex organizations. A critical essay[END_REF][START_REF] Scott | Organization, rational, natural and open systems[END_REF][START_REF] Hatch | Organization Theory Modern, Symbolic, and Postmodern Perspectives[END_REF].

Each of these various themes (e.g. culture, power, environment, structure, goal) can be independently studied, or targeted as the main focus of researchers. There are authors specialising in culture, power or structure but organisation theorists also investigate the relationship between these dimensions. In fact, studying culture came partly (history is always more complex) as an opposition to a strong emphasis on technology/structure at the expense of the symbolic dimension of organisations (see for instance [START_REF] Turner | Exploring the industrial subcultures[END_REF].

Similarly, a focus on power can also be a reaction or an alternative to what appears to be an excessive focus on culture [START_REF] Perrow | Complex organizations. A critical essay[END_REF]. So these themes are never developed in isolation to each other, quite the opposite, they develop in relation to each other, and researchers can also discuss therefore their relationships.

What is the relationship between these different dimensions altogether (structure, power, culture, etc) ? Or, more narrowly framed…how is power shaped by structure? Does structure create culture? How technology shapes structure? Does culture shape power? Is it the other way around? Etc. This background in organisation theory, which considers structure as one core topic among others but also interacting with other topics, is an important starting point and strong argument of this article.

And there appears to have no definite answer. Responses to such questions translate intellectual sensitivities of authors instead. Whether one prefers emphasising the notion of power over culture, of structure over culture or environment over goals (strategy) reflects preferences linked to deeper assumptions about a range of fundamental issues about human nature, knowledge and reality but also society.

The topic of structure in safety research can be turned into a wide range of questions which mirrors those found in organisation theory as mentioned above. In fact, structure as an analytical category has been introduced in different studies but there is no overview of this diversity (this is a very different situation when compared with safety culture, Le Coze, 2019a), and little systematic investigation of its relation to other dimensions (power, culture, etc).

In a first section, I remedy the situation and come back on several perspectives in the field. I argue that it is possible to distinguish structure as coupling and complexity (1), as redundancy (2), as self-correcting (3), as underspecified (4), as management system (5), as degree of centralisation (6), as macro social configuration (7). Each meaning covers a different angle, but complementarities exist.

In a second section, I discuss Hopkins' view. The sociologist has developed perspective number (6) above, arguing about the importance of structure understood as a degree of centralisation. He asserts in a book that there is a causal relationship between structure and culture in the context of disaster prevention [START_REF] Hopkins | Organising for safety. How structure creates culture[END_REF]. I interpret this proposition by situating Hopkins' contribution to safety research over 40 years of work.

I explain his opposition to safety culture as a rejection of some practices of consultants and companies (i.e. hearts & minds programs2 ) and conclude this second section with a discussion of the implications of his retrospective sociology on his ideas. In the last section, I argue that strategy is an important notion needed to complement Hopkins' view of structure, when studying daily operations.

Several views of structure in safety research

In this first section, I bring an overview of some of the insights from safety research on the topic of structure. I contend that it is possible to distinguish several approaches and differentiate then succinctly introduce structure as coupling and complexity (1), as redundancy (2), as self-correcting (3), as underspecified (4), as management system (5), as degree of centralisation (6), as social configuration (7). Each meaning covers a different angle, but complementarities do exist and are discussed.

Structure as coupling and complexity

One first view of structure is Perrow's argument of normal accident [START_REF] Perrow | Normal Accidents[END_REF].

Perhaps that it is best to define it as 'structural' because of its blend of technology and organisational structure together, consistently following his mindset of a sociologist of organisation (Perrow, 1970) who was close to the contingency school of organisation.

This school looked at the connection between technology, structure and environment of organisations [START_REF] Lawrence | Differentiation and Integration in Complex Organizations[END_REF].

His argument is well known, tight coupling and interactive complexity create opportunities for unexpected events, and catastrophes. This is a first view of structure, structure as coupling and complexity (1). What is known is also the rejection of this thesis, most notoriously by Hopkins who disagreed with the main thesis of the book, and that much could be done despite inherent coupling and complexity to prevent major events (Hopkins, 2001).

Structure as redundancy

A second view of structure is developed by the high-reliability school, partly as a response to Perrow's deterministic argument. Roberts indicates, among other properties of organisations (i.e. learning, culture, safety as priority, [START_REF] Roberts | New challenges in organisational research: high reliability organizations[END_REF] facing unforgiving technologies and environments, the category of (organisational) redundancy. While Perrow argued indeed that technical redundancy could bring more complexity to high-risk systems, and therefore more opportunities for unexpected failures, organisational redundancy brings the opposite, more reliability and a response to Perrow's challenge. This response consists in making sure that a task is performed under the supervision of not one but two (or more) operators. According to this principle, if one fails to see a problem, another might. Organisational redundancy, when consciously designed, brings therefore a higher level of reliability. Snook challenged this proposition while pointing at the issue that when everyone is responsible, no one is [START_REF] Snook | Friendly Fire, The Accidental Shootdown of US Black Hawks Over Northern Irak[END_REF], questioning the relevance of a translation of reliability from technical to organisational aspects3 . This is a second view of structure, structure as organisational redundancy (2).

Structure as self-correcting

A third view of structure is developed by Bourrier (1995Bourrier ( , 1999)). Based on the comparison of French and US nuclear power plants, Bourrier shows that what makes a difference between the plants in the two countries when it comes to rules compliance is the design of their organisational structures. One strong thesis is that it is not national cultures (French or American) which plays a determining role in the way operators behave, but choice of work principles, the resources and expertise available for operators to consult engineers when doubting about the rules they must implement. Indeed, the gap between practices and procedures is more openly discussed when engineering expertise is available and respond in a timely manner to operators' concerns. This represents the design of what Landau defined as a self-correcting organisation [START_REF] Landau | On the Concept of a Self-Correcting Organization[END_REF], which allows itself to adjust its operating principles to constraints which can never be entirely foreseen in advance. This is a third view of organisational structure, structure as self-correcting (3).

Structure as underspecified

A fourth view derives from other observations of the HRO researchers in the 1980s (Rochlin, Laporte and Roberts, 1987) and refers to the dynamic properties of organisations when confronted to problems which requires for expertise to take the lead over hierarchy. They described it this way. "On paper, the ship is formally organized in a steep hierarchy by rank with clear chains of command and means to enforce authority (…) flight operations are not conducted that way. (…) events on the flight desk, for example, can happen too quickly to allow for appeals through a chain of command" [START_REF] Rochlin | The Self-Designing High-Reliability Organization: Aircraft Carrier Flight Operations at Sea[END_REF].

The idea that structure does not necessarily dictate practices but is flexible when needed in order to cope with situations was later captured and combined with other characteristics of HRO in the first version of the collective mindfulness model (Weick, Obstfeld, Sutcliffe, 1999). These authors named "underspecification of structure" this deviation from a standard view of structure which usually implies formal and hierarchical principles4 . This is a fourth view of structure, structure as underspecified (4).

Structure as safety management system

In safety research, a fifth view of structure is defined as the safety management systems to be distinguished from (safety) culture [START_REF] Hale | Cultures confusions. Editorial to a special issue on safety culture and climate[END_REF][START_REF] Hale | Safety management in production[END_REF]. Safety management systems are built on the principles of several articulated activities (or processes) such as risk analysis, learning from experience or management of change which must channel behaviour of employees, and organisations. Risk analysis anticipates unwanted event and lead to the design of barriers, management of change anticipate the effect of modifying installations or organisations to prevent negative consequences, procedures must be written in a way that is useful to practice, etc.

For Hale, because safety culture is a more ambiguous or confusing notion, it makes sense to differentiate and associate it with safety management system which represents the structure dimension of safety. "In terms of the structure of safety management systems this consensus is undeniable (…) Safety culture can then be seen as the way in which different companies drive and use the essential functional elements of that structure". (Hale, 2000, 12). This is a fifth view of structure, structure as safety management system (5).

Structure as degree of centralisation

The sixth view of structure is Hopkins' advocacy of a centralised safety function which is independent from other functions and with a voice at the highest level of corporations [START_REF] Hopkins | Organising for safety. How structure creates culture[END_REF]. Organisations are based on the concrete activities of departments such as maintenance, human resources, finance, quality, production, logistics, IT or safety and environment, which represent specific areas of expertise needed. An organisation consists of making sure that their interactions (e.g. coordination, cooperation and communication) contribute to the performance of daily operations.

In this respect, safety issues should be raised at the highest level of organisations, and not buried at the bottom of complex organisational structures of multinational corporations because priority is given to one or other functions (e.g. finance). When lower level experts cannot make their voices heard because they are filtered along the way from bottom (e.g. a site) to top (e.g. top management team), problems can be left unsolved. Hopkins' solution is therefore to design authority channels to allow messages to travel up by ensuring proper structural arrangements (Hopkins also argues that structure drives safety culture, more detail about this below). This is the sixth view of structure, structure as degree of centralisation (6).

Structure as macro social configuration

Another possible view of structure is found in Perrow's analysis of high-risk systems which consists in discriminating between "error prone" and "error avoiding" ones (Perrow, 1999). Based on the type of interactions between professions, unions, regulators, industries, insurance and civil society, Perrow establishes a continuum of less safe to safer organisations, starting at the lower level with maritime industry and at the highest-level, aviation. In this case, structure is understood as the social configuration of actors and institutions shaping the conditions of high-risk systems performance. This is a seventh view of structure, structure as social configuration (7), although this time the notion of structure is stretched to encompass what could be described as the environment of organisations in organisation theory.

Complementarities between the views

With this brief historical analysis, it appears that structure in safety research can be conceptualised in many ways (table 1), and I make four comments before moving on.

First, it is relevant to note that many of them are design issues. Whether creating redundancy by adequately staffing teams (allowing slack in daily practices), providing engineering expertise to help operators address procedural shortcomings or centralising the safety function with access at the highest levels of corporations, these are potential design choices of organisations by management.

Second, it is important to stress that these descriptions of structure in safety research are rarely offered independently of other features of organisations. In the HRO case, such features concern aspects of technology, culture but also environment of high-risk systems. In the description of the self-correcting properties by [START_REF] Bourrier | Elements for designing a Self-correcting Organisation: examples from nuclear power plants[END_REF] structure is presented as an argument against national cultures as an explanation of informal practices of operators in relation to compliance. Type of interactions between actors and institutions of high-risk systems defining the degree of importance granted to safety Third, these varying views of structure can be developed from various conceptual backgrounds, or combinations of backgrounds. Let's take three examples. In Bourrier's study [START_REF] Bourrier | Elements for designing a Self-correcting Organisation: examples from nuclear power plants[END_REF], the question of reliability is explored through the problem of the gap between prescribed and real work but also through the problem of the relationship between national cultures and organisations, then of self-correcting properties [START_REF] Landau | On the Concept of a Self-Correcting Organization[END_REF].

For [START_REF] Hale | Cultures confusions. Editorial to a special issue on safety culture and climate[END_REF], the question of safety is explored through the combination of problem resolution, feedback principles and system view of organisations. For Hopkins, the problem of centralisation is linked to the idea of communication flows from the bottom to the top of organisations, with the problem of compliance with the health and safety law in mind. So, there are many different conceptual backgrounds.

A fourth comment is that, despite this diversity, many of these views are quite complementary options of structure (if one excludes (1) and ( 7) which are blends of structure-technology-environment useful for later discussions in section 4). Structure as redundancy (2), as self-correcting (3) and as degree of centralisation (6) seem to be highly compatible in the sense that they all contribute to enhance the conditions for safe operations.

They have additive properties. Redundancy can strengthen the outcome of selfcorrecting properties of organisation by increasing compliance while centralisation can support at the highest levels the importance of (organisational) redundancy and selfcorrecting properties.

Complementarity also seems to be the case of the view of structure as safety management system (5) and as degree of centralisation ( 6). Both imply that structure, as defined each differently, drives (safety) culture. And, one can easily imagine that a centralised safety function is likely to play a role in supporting the implementation of safety management system, therefore amplifying the conditions favourable to safe performances.

Perhaps one view of structure is more ambiguous in this respect than others: structure as underspecified. Many views of structure identified above are based on formal description of principles to be applied to make organisation work. The notion of 'underspecification' moves away from the idea (and ideal) of structure as a rational mechanism.

In the HRO descriptions, underspecified structure, turned later into deference to expertise, is a highly positive feature. It supports fast resolution of problem when required. But informal practices can also have negative consequences. What if a centralised structure does not function as intended because it has underspecified, or informal, practices which do not follow the intended design? Could these informal practices have negative implications too?

This of course are speculative and theoretical comments at this stage which would need to be empirically discussed. However, it is beyond the scope of this article to systematically investigate and compare these different views. One lead could be Landau's thesis on the relationship between redundancy, reliability and errors of type II5 [START_REF] Landau | Redundancy, Rationality, and the Problem of Duplication and Overlap[END_REF][START_REF] Landau | On the Concept of a Self-Correcting Organization[END_REF], Laudau, Stout, 1989, Landau, Chisolm, 1995).

But it is Hopkins' argument which will serve instead as an opportunity (because of its extent, an entire book) to explore some of these relationships, and to narrow down the range of options which could be discussed in this area. The purpose of this section was to bring a first historical and conceptual overview to indicate that structure has been investigated in safety research. The next section provides another historical and conceptual clarification, from the point of view, this time, of Hopkins' work.

"Structure creates culture"

In this section, I come back on Hopkins' contribution to safety research. I mention his way of writing and conceptualising disasters in order to understand better his argument that structure creates culture. I introduce first his research posture, then discuss the history of his interest in structure, then summarises his argument.

Background: 40 years of research on major hazards

Hopkins is a prolific sociological writer in the field of safety. His books are primarily written with practitioners in mind, with the intention to build persuasive narratives which can help design safer practices, based on sociological insights [START_REF] Hopkins | Quiet Outrage. The way of a sociologist[END_REF].

Looking closely, on can see an approach that follows a pattern over 40 years consisting in refining his account of disasters (Le [START_REF] Coze | Andrew Hopkins and the sociology of safety. Quiet outrage. The way of a sociologist[END_REF]Coze, , 2019b)). This cycle of confronting case studies with concepts and concepts with case studies started with the Appin disaster [START_REF] Hopkins | Crime without Punishment: The Appin Mine Disaster[END_REF] then pursued with Moura [START_REF] Hopkins | Managing Major Hazards: the Lessons of the Moura Mine Disaster[END_REF], Longford [START_REF] Hopkins | Lessons from Longford: The ESSO Gas Plant Explosion[END_REF], Texas City [START_REF] Hopkins | Failure to learn: the BP Texas City refinery disaster[END_REF], Macondo [START_REF] Hopkins | Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout[END_REF] and San Bruno [START_REF] Hayes | Nightmare Pipeline Failures[END_REF].

A pattern of refinement introduced over the years can be seen in the disaster books themselves, but also quite clearly in books published in between his disasters' accounts (e.g. [START_REF] Hopkins | Safety, culture and risk. The organizational causes of accidents[END_REF], 2007, 2019, Hopkins, Malsen, 2014) 6 . In these books, Hopkins' explore various topics (e.g. safety culture, mindful leadership, financial rewards, indicators and bonuses), structure being one of this last series of refinements [START_REF] Hopkins | Organising for safety. How structure creates culture[END_REF]. The emphasis on structure can therefore be seen both as an addition to previous productions, but also as an achievement.

History of Hopkins' interest in structure

Let's start with saying that as a sociologist, it is central for Hopkins to distinguish the individual versus the system view. "Theories about the causes of industrial accidents can be classified into two broad types: those which emphasize the personal characteristics of the worker themselves and those which locate the causes in the wider social organisational and technological environment. The former in conveniently termed blaming-the-victim and the latter, blaming the system." (Hopkins, Palser, 1987, 26).

And this is the basic ingredient of a view of structure as strongly influencing behaviour.

He combines this with a strong managerial take. One influence and inspiration of Hopkins back then are found in the white-collar crime -crime of the powerful literature, which elaborates a macro sociological system view of safety, targeting top management of corporations while situating it in a wider legal, behavioural and societal dimension (Wilson, Braithwaite, 1978).

In this respect, one source of inspiration in the 1980s for Hopkins is not Turner (1978) or [START_REF] Perrow | Normal Accidents[END_REF] but key writers in the white-collar crime scene applied to safety, such as [START_REF] Stone | Where the law ends. The social control of corporate behavior[END_REF], or [START_REF] Braithwaite | To Punish or Persuade: Enforcement of Coal Mine Safety[END_REF]. The idea that structure of organisation is an important feature for the prevention of major events is already a core principle for these writers, who study corporations with a strong emphasis at their very top, where one finds the most influential decision makings processes.

Stone develops for instance this idea thoroughly throughout the chapters of his book published in 1975. "One of the most effective ways to make a corporation more responsible (in this sense of being more deliberative and reflective) is to take decisions of large social concern out of the hands of lower-levels functionaries and insist they be put in the hands of others higher in the organization" (Stone, 1975, 217).

Braithwaite has a similar strategy when it comes to corporations' compliance with the law (Braithwaite, Frisse, 1988). "Most fundamentally, then, clout for internal compliance groups comes from their control of resources which are important to those who must be made to comply (…) It is important for top management clearly to communicate the message to the organisation that, in any dispute, it is likely to stand behind its compliance staff" (Braithwaite, Frisse, 1988, 18).

Hopkins also mentions this idea early in his writings in the 1980s. He notes in one of his analysis of safety in mines that "the design of this study does not allow is to draw firm conclusions about the reasons for the failure of safety officials to influence accident rates.

However, it is relevant to note that colliery safety officers occupy lowly positions in the structure of mine management and wield relatively little influence. It is thus not surprising that their presence has no discernable impact on mine safety. Were they answerable to higher management, not just the colliery manager, their views and recommendations might carry greater clout and their presence might be expected to have a greater impact on accident rates." (Hopkins, Palser, 1987, 35).

Then, in his interpretations of the disasters of Moura and Longford, he devotes paragraphs in chapters to the role of corporate and organisation structures, "the role of BHP" (Hopkins, 1999, chapter 9) and "The failure to identify hazards" (Hopkins, 2000, chapter 3). He writes about centralisation in 1999, as follows. "The logic of this argument is that head office should maintain large safety departments, whose prime concern is the management of catastrophic risk and who are in a position to give detailed technical advice on such matters, to issue instructions or advise chief executives officers on instructions to be issued, and to scrutinise closely the level of compliance with these instructions." (Hopkins, 1999, 103).

Such paragraphs become dedicated chapters in his analysis of Texas city and Macondo, with far more explicit titles about the issues discussed, "The problem of decentralisation" (Hopkins, 2008, chapter 10) and "Organisational structure" (Hopkins, 2012, chapter 7).

In these chapters, he addresses the problem of centralisation for multinationals. "The challenge is to find ways in which a very large corporation can organise itself into separate business units which are responsible for their own business decisions, while at the same time the corporation maintains effective control over standards of operation." (Hopkins, 2008, 96) So, since the 1980s, the idea of centralised structure is central in Hopkins discourse, and become fully articulated as an independent theme and further advocated in the book to which we turn now [START_REF] Hopkins | Organising for safety. How structure creates culture[END_REF].

The argument for centralised structures

With this brief historical overview of Hopkins' work, the pattern of refinement mentioned earlier appears now in full light. Hopkins' interest in structure started in 1987 as a remark in an article (see quote above, extracted from [START_REF] Hopkins | The cause of coal mine accidents[END_REF], and ends up, more than 30 years later, as a book entirely dedicated to the topic [START_REF] Hopkins | Organising for safety. How structure creates culture[END_REF]. In the meantime, he interpreted several disasters while working on conceptual developments (e.g. safety culture, mindful leadership, rewards, bonuses and indicators).

How to explain the importance granted to structure? I think first that the pattern of refinement described is fuelled by at least two motives. One is knowledge, which corresponds to Hopkins' own need to understand (whether empirically or theoretically) more some aspects which he stumbles upon. Another one is a reaction to what he observes in companies and which seems to him to be unsatisfactory, hence the need to position himself and try to make a change by offering practical alternatives.

One of these observations is how safety culture is very often promoted in companies.

This goes back to the difference between the individual versus the system view of safety (see quote above). For Hopkins, safety culture is not sufficiently considered from a sociological standpoint (versus psychological) which supports the system view, but he also challenges the concept of safety culture as existing independently of organisational cultures [START_REF] Hopkins | Studying organisational cultures and their effects on safety[END_REF]. For these reasons and others (there is a list of 7 of them,

Hopkins, 2016), he rejects safety culture as promoted by consultants and companies through educational programs or behavioural-based safety methods (Hopkins, 2019, chapter 3).

This does not mean that he rejects culture entirely which would not make sense for a sociologist, and Hopkins' approach to culture applied to safety derives from Schein's contention that organisation cultures are the product of their leaders (Schein,1992).

Culture must be understood as 'how we do things around here', which is a description of practices (not values), which, in turn, must be explained. Culture is not an explanation for an accident, culture is the start of a sociological inquiry of why it is manifested the way it is manifested in practice. This, for Hopkins, following Schein, can only be understood by paying attention to what leaders pay attention to.

What leaders pay attention to is a result of their financial, legal, moral and industrial context, topics that he has explored in several books [START_REF] Hopkins | Safety, culture and risk. The organizational causes of accidents[END_REF], 2007, Hopkins, Maslen, 2014). But organisational structure is one of the most concrete or visible translation of this degree of attention to safety granted by leaders according to Hopkins.

His argument is that a higher degree of centralisation of the safety (or engineering) function leads to a higher level of safety performance.

One reason is that practices must not be deviate from safety standards and built-in safety margins, shortcuts must be avoided or limited, and expertise is required in a company. But deviations or shortcuts are always likely to occur because of the realities of work constraints. Companies face indeed challenging contexts and have an intrinsic drive for profit, which is constitutive to their reason to be. It is by making sure that the power to stop when needed is available in an organisation that the highest level of safety can be achieved.

This ability is not to be found exclusively in the quality of individuals but in the environment in which they operate. Cultures supportive of safety, of this ability not to deviate from standards derive not from individuals' quality but from a structure in place which empower people to do so. In this respect, Hopkins' argument is probably equally well described in power terms, something he acknowledges. "The culture change industry tends not to talk about power. In contrast, this book assumes that power and organisational culture are closely interrelated. The creation of a particular organisational structure is an exercise of power by the CEO and perhaps even the board of a company (…) in short, understanding an organisation's culture requires us to understand how power is distributed within the organisation" (Hopkins, 2019, 2).

Of course, Hopkins also stresses that to operate as expected, such centralised structures must be served by competent people. "Structure will only determine culture if positions specified in organisational charts are occupied by people with requisite competence" (Hopkins, 2019, 19). They also must not be altered in their orientation by incentives or rewards which would be opposite to their intended purposes. "The beneficial impact of a particular organisational structure can be undermined if the organisation establishes perverse financial incentives. (Hopkins, 2019, 20).

In other words, structures do not function within an organisation vacuum, and there are required conditions for these centralised structures to operate as expected. He also notes that structures come in various shapes, and the degree of centralisation can only be expressed along a continuum which opens a space for various configurations. The ultimate version of a centralised structure is the matrix which supports hierarchical links (the plain line versus the dotted one) between sites and non-operational functions (such as hse departments) (see figure 1). However, such a centralised structure should not be undermined by lack of competence or by perverse incentives at the highest levels."

Note that this argument is a macro statement, a simplification which replaces the other simplification that Hopkins opposes to, namely that safety culture is an individual's characteristics to be improved through educational programs (e.g. "hearts & minds").

Clearly, applied retrospectively to disasters, this proposition works quite well. First, it is very often possible to show that, had messages of bad news been properly passed on to top management, actions w/could have been taken to avoid a catastrophe. Only a centralised structure seems to offer this guarantee.

Second, following a major event which threatened their survival, companies most often centralise their structure to make sure that they empower safety at the highest levels.

There are many examples of this, from NASA to BP7 . Why would top managers of companies do so if they thought it didn't solve their problem? Third, in the case of a disaster occurring despite an existing centralised structure, it must be that the structure has been diverted from its intended purpose.

Discussing Hopkin's argument

I now discuss Hopkins' argument in three points. First I notice the absence of stronger connection to the literature dealing with structure in safety research; second, I describe the kind of simplification it entails considering in turn aspects such as exclusion, causation and conditions and third, I argue that this simplification is a product of Hopkins' normative and retrospective stance combined with his rejection of an educational view of safety culture.

Connecting with other structure studies

What appears, as discussed in the previous section about structure studies in the field, is that Hopkins' approach is, first, a design one, second, it is not developed independently of other dimensions (power, culture), third, it is anchored in a specific conceptual background and fourth, it is compatible with other perspectives on structure. To connect this section with the previous one on studies of structure and further discuss Hopkins' argument, let's recall some of the questions derived from organisation theory applied to safety.

What is the relationship between different dimensions of organisations (structure, power, culture, goal, environment, technology)? More narrowly framed…how is power shaped by structure? How is power shaped by culture? Does structure create culture? Is the safe performance of high-risk systems a question of structure? Can a disaster be the result of a flawed structure?

In relation to this set of question, we see that Hopkins considers that structure drives culture, that power (of top leaders) shapes choice of structure which in turn provide individuals with and empowers them to apply standards. In case of the absence of these structure principles, events are more likely to happen. This expresses Hopkins' intellectual and sociological sensitivity (in which power plays an important role) and translates a practical concern for improving organisations.

Another comment is that his argument could be developed in relation to other attempts in the field to link structure to safety, whether through redundancy (2), self-correcting

(3) or safety management systems (5) as briefly presented in the first section. This could strengthen and anchor Hopkins' work in existing research on this topic. Bourrier for instance discussed structure in relation to culture, preferring, as Hopkins does, the structural explanation rather than the cultural one when it comes to compliance [START_REF] Bourrier | Elements for designing a Self-correcting Organisation: examples from nuclear power plants[END_REF].

One difference is that Hopkins postulates rather than studies empirically culture as done in Bourrier. He postulates that culture will be strongly influenced by the power structure created by the centralisation of safety. It is not shown with the help of ethnographic data which would corroborate that claim but is to be understood in the context of his opposition to the educational mindset often promoted when it comes to safety culture.

More about this simplification below.

A second possibility of connection is Heiman's proposition to combine structure with likelihood of events (Heiman, 1997(Heiman, , 2005). Heimann's contention is that different organisational structures (i.e. serial, parallel) prevent different type of errors (type I and type II). Heimann contends that organisations evolve cyclically from serial to parallel configurations as a response to their political environment (Heimann, 2005), something

Hopkins refers to but does not fully integrate in his rational "organisational structures are seldom static. They regularly change, depending on the needs of the organisation and the skills and capacities of the available people." (Hopkins, 2019, 2).

Simplifying: exclusions, causation and conditions

Another comment concerns indeed the choice of simplification operated by Hopkins, and the kind of relationships between structure, culture, power, goal, technology and environment that it entails. Any model or argument is a simplification of some sort.

Three elements of such simplification can be identified and commented: exclusions, causation and conditions.

Exclusions

Exclusions are approached in this discussion with the help of the dimensions indicated in the first section through organisation theory (i.e. structure, power, culture, goal, environment, technology), and which are not included in Hopkins argument. There are three of them, technology (e.g. aircraft submarine, refinery, nuclear power plant), environment (e.g. regulators, industry, professions) or goals (strategy) of organisations (e.g. new vision, merger, acquisition, new projects, adaptation to markets).

The absence of these dimensions becomes obvious when studying the causation built in his argument. But before looking into it, let's briefly comment that it is not the only option to discuss what Hopkins excludes from his reasoning. One example is the decision not to include a dynamic perspective of organisations as just commented above when Hopkins admits that organisations are seldom static. I will develop this idea when introducing strategy in the last section.

Causation

Causation can be analysed from an excerpt of the summary proposed above "leaders should use their power to design centralised organisational structures which lead to the appropriate level of implementation and control of safety standards and practices across the company, in another word, to a culture conducive to safety."

In this argument, causation is thought in a specific linear order as one of power leading to choice of structure, which in turn generates culture conducive to safety. Technology is not causal, environment is not causal and goal is only partly causal (more about this in the third section) when considering such important dimensions. Is this the only possibility? Not necessarily.

In contrast, Perrow's perspective (table 1) as complexity and coupling (1) and structure as macro social configuration (6) gives both to technology and environment a far more causal role in safety performance, so it is not the only possible option. Other suggestions of slightly different causal combination of structure, culture and power, perhaps less linear than Hopkins suggests, exist in safety research as for instance with Caroll.

This author advocates structure, power and culture as complementary lenses but in a looser fashion than Hopkins'. "The three lenses are distinct enough that they cannot directly compete or combine: one will not win a contest among lenses nor will have the three joined in a happy union or comprehensive model". (Caroll, 2018, 39). Causation in terms of power, structure and culture in this statement appears less mechanical.

Conditions

Conditions in the argument are competence and incentives. They participate to/in the process of simplifying because they relieve the analyst from investigating further different combinations and gradation of competence and incentives in the way structures operate. They are distinct forms of exclusions because they are made explicit, but the difference stops here.

One issue is that excluding competence for instance neglects the current problem of the bureaucratised and standardised approach of safety which has colonised companies for now 20 years (see [START_REF] Power | The audit society: rituals of verification[END_REF] for the early general statement, and [START_REF] Almklov | When safety science meets the practitioners: Does safety science contribute to marginalization of practical knowledge?[END_REF][START_REF] Dekker | The bureaucratization of safety[END_REF] when applied to safety). This phenomenon, also called paperwork approach of safety, can be a real problem for the effectiveness of centralised structures.

Surprisingly, it is something Hopkins' has a clear view of when criticising paperwork audits in his first accounts of disasters [START_REF] Hopkins | Managing Major Hazards: the Lessons of the Moura Mine Disaster[END_REF][START_REF] Hopkins | Lessons from Longford: The ESSO Gas Plant Explosion[END_REF].

He then develops strategies to counteract their limitations in more detail with the proposition of sceptical audits [START_REF] Hopkins | Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout[END_REF] 8 . Hopkins clearly knows. So is it so surprising that he does not develop this in his argument then? I think in fact not. The fact that he leaves out several dimensions through exclusions and conditions can be explained by his intention but also experience of studying and writing, tightly connected to his normative and retrospective methodology, to which we turn next.

The retrospective and normative stance

The success of Hopkins' books is also the result of a normative style intertwined with his retrospective method (see Le Coze, 2019b). Readers feel that there were many possibilities of preventing the events if only companies involved had applied practices which proved their worth elsewhere and that Hopkins introduces in his narrative. But retrospective narrations with normative intents remain fictions in the sense that they apply in the past expectations which were not met before the accidents. Whether these expectations were plain applicable is left to readers to make up their minds about it, but in the context of catastrophic events, most of the time, it is very tempting to conclude that companies sh/could have done much better.

The same writing strategy is applied to the argument that structure creates culture, which has to be understood as an opposite sociological alternative to the educational "hearts and minds" version of safety culture. It is a normative discourse, mostly built on retrospective case studies (of incidents and major events) and intended to convince readers about the value of centralising safety/engineering functions.

In this case however, in comparison with his disaster accounts, Hopkins further simplifies his view through exclusions and conditions. The main reason is that he is constrained by the need to be persuasive while not losing his readers. He has to produce an argument easily graspable as a plausible alternative. So, finally, it is not a surprise that Hopkins simplifies, and does not develop topics he is aware of. These exclusions, causation and conditions raise indeed thorny issues for case studies of companies which are found not to operate according to such normative principles, while not experiencing catastrophic events. I have been involved in several in-depth studies in the past 10 to 15 years mostly in the chemical industry and witnessed only moderately centralised, sometimes even decentralised organisations.

But none of these organisations ever suffered major events, although they did experience events of smaller scale. They didn't change their structure following these events, but never experienced a major event (at least so far) that I know of after either. I believe Hopkins' argument can be slightly adjusted when confronted to daily operations in the chemical industry where I am most empirically experienced and knowledgeable. It helps introduce strategy as a core topic (and therefore keeping the centrality of Hopkins' focus on top management decisions). Let's explore this further.

Safety as strategy

Among the different dimensions characterised and discussed in organisation theory, Hopkins excludes technology, goal (strategy) and environment of organisations in his view that "structure creates culture" argument. My experience of studying safety critical organisations is that the exclusion of these is much of a problem when observing and interviewing a wide range of actors in daily practices.

More specifically, I have come to the conclusion that strategy should be considered as a prominent dimension of any safety research with a sociotechnical angle of analysis. This argument, safety as strategy, cannot be fully repeated in this article (see Le Coze, 2019c).

The basic idea should be easily understood. My contention is that major events are strategic failures. Because top management decides about a great number of things when it comes to organisations, a disaster is always inevitably a strategic failure of some sort.

However, this simple idea is not really at the heart of safety research, excepting for a few

writers. Yet, examples abound, when spending time in companies (or reading reports of accidents), of safety problems which can be traced back to decisions made by top managers. Such an observation must of course remain detached from moral and legal considerations. BP is one of these examples [START_REF] Bergin | Spin and Spill. The inside story of BP[END_REF], although quite an extreme one, unlikely to be observed frequently in most organisations.

BP serves as an important case study in Hopkins' demonstration [START_REF] Hopkins | Organising for safety. How structure creates culture[END_REF], so it could be argued that Hopkins discusses about strategy, but I claim that he does so only partially. BP indeed went too far, under Browne (then Hayward leadership), into decentralising its mode of operating, the opposite of what Hopkins recommends.

Yet, I contend that structure is only one part of the problem in this case. BP went too far in decentralising indeed but in conjunction with strong operating constraints following several merger and acquisitions (M&A) in the years preceding the series of disasters.

M&A led to a need for cost-cutting.

Considering strategy as a combination of what could be defined as operational constraints (e.g. cost cutting) and choice of structure (degree of centralisation) can help understand why Hopkins observation of the reluctance with which companies seem to move towards more centralised structure (figure 2).

Figure 2. Strategy as a combination of operational constraints and degree of centralisation "I was left with the feeling that this company would not take matters much further until it had suffered a catastrophic event that killed numerous people and did real financial damage to the company (…) unless a company is in crisis, recommending changes to organisation structure is likely to be met with resistance." (Hopkins, 2019, 86, 90).

The reason is that very often top managers of companies which perform their activities with decentralised or moderately centralised structures (figure 1) do not push their systems beyond reasonable operational constraints (figure 2). They don't see as a result the need to implement strong, costly and burdensome, centralised structures.

As long as they are not creating unrealistic operational constraints, the value of centralisation might not be obvious to them. Their experience shows them that it is not necessary to go beyond the degree of centralisation they have chosen. Of course, they could be safer, and perhaps also could also filter and avoid moderate incidents and accidents (which are different from "near-death ones").

But very often these small-scale events do not threaten top management of corporations enough to trigger the need to change their structures (as commented by Hopkins in the quote above). This is I believe one explanation for the many companies that I have observed in the chemical industry which do not suffer major events despite the absence of strong centralised structures (at the right of figure 1).

Clearly, looking retrospectively into major events can justify the need for centralised structure because operational constraints were too high and degraded safe practices in at least one site of a multinational (e.g. the Texas City refinery in the case of BP). They

Strategy

Operational constraints practices

Degree of centralisation

Ability to influence and hear back from practices were pushed to their limits as a result of top strategic decision-making processes (Farjoun, Starbuck, 2007).

But major accidents remain exceptional events, and many companies are careful not to create unrealistic operational constraints, and do not need the strong centralised structure advocated by Hopkins to counter balance unrealistic pressures. If other highrisk systems are highly centralised such as in the case of military submarines and civil aircrafts it is because of their unforgiving operating contexts.

A small-scale event can escalate into a disaster when a submarine travels hundreds of meters below the sea surface and the same applies to an aircraft flying several kilometres up in the sky. This is different for chemical plants, events happen but rarely escalate to create disasters. Of course, this doesn't invalidate Hopkins' argument. It is safer to have a competent, non-perverted, centralised structure.

It is just that the trade-off, at least in the chemical industry, in favour of a moderate degree of centralisation rather than a strong one prevails. I realise this additional or rather complementary input remains within the kind of condition, causation and exclusions of Hopkins' argument. To repeat it once more, it is a simplification which is justified by the need to provide an alternative discourse to targeting lower level individuals in companies through "hearts and minds" educational programs.

Conclusion

In this article, structure is introduced as an important feature of organisations, among others (power, culture, environment, goal, technology). It is shown that structure has been discussed in safety research using various angles and lenses, structure as coupling and complexity (1), as redundancy (2), as self-correcting (3), as underspecified (4), as management system (5), as degree of centralisation (6), as macro social configuration (7). These views sometimes developed independently are not exclusive and can complement each other. This historical perspective allows the reader to situate Hopkins' argument that "structure creates culture", an argument developed as an alternative to the educationally oriented program of safety culture promoted by consultants and companies. Hopkins' argument is built on a long-time interest in safety and disaster from a normative, retrospective and practical point of view.

His argument can be framed as follows. "Leaders should use their power to design centralised organisational structures which lead to the appropriate level of implementation and control of safety standards and practices across the company, in another word, to a culture conducive to safety. A centralised structure allows messages to travel up from the bottom to the top of corporations to avert disasters. However, such a centralised structure should not be undermined by lack of competence or by perverse incentives at the highest levels" This alternative to safety culture combining power, structure and culture is then discussed. First, it seems highly plausible that many views of structure introduced in this article are highly compatible rather than exclusive versions of the same topic. Hopkins' argument could be connected more explicitly to existing research on structure. Second, comparing Hopkins' position with these other options of approaching structures highlights some of the simplifications incorporated in his rational.

Simplifications can be categorised as exclusions, causation and conditions which aim at proposing to readers a credible and persuasive alternative to educational orientation of safety culture. Exclusions correspond to features not included in the argument (e.g. technology, goal or environment), causation describes the implied causal relationships between selected features (e.g. power, structure and culture) and conditions what is needed for centralised structure to function as intended.

If Hopkins achieves his purpose, namely, convinces readers to shift from individuals' behaviour at the sharp-end to structural (degree of centralisation of the safety function) choices of organisations by top managers, empirical studies of high-risk systems requires to include this emphasis on structure within a strategic analysis in order to explain the variability observed in practice. Indeed, ethnographic studies performed in the chemical industry shows that highly centralised structures as advocated by Hopkins are far from the norm.

To make sense of this in the absence of disasters in the companies observed requires introducing another dimension: operational constraints exerted by strategies of top managers on daily operations. Hence, the reason why moderately centralised organisational structures is so pervasive in this industry is explained by the existence, in most cases, of a reasonable balance between these two dimensions based on a trade-off adjusted to frequency, severity and nature of events. Disasters would be an extreme case of loss of balance.

Figure 1 .

 1 Figure 1. Degree of (safety) centralisation in organisational structure

Table 1 .

 1 several view on structure in safety research

	View of structure	Description
	Coupling and complexity (1)	Blend of technology and organisational characteristics determining likelihood of unexpected events
	Redundancy (2)	Double checking of tasks performance by operators to increase reliability of practices
		Revision of procedures based on engineering
	Self-correcting (3)	resources available to discuss problem of
		compliance

  It is most likely intended. Conditions are there to remind the readers that the model can only work if these conditions are present. Exclusions are not explicit in his text (technology, goal-strategy, environment) but refer to this intention to frame the problem in a satisfactory manner for his readers and not to lose them. It is a design proposition, to propose an alternative, and the argument is convincing. But what, however, if we step outside this set of constraints? What if we apply Hopkins'argument to the empirical study of daily operations? It is one thing to be retrospective, normative, to propose an alternative while making sure to persuade readers, it is another to provide adequate sensitising tools for the empirical and descriptive studies of daily operations.

Fayol introduced, in one of the first management classics, organisations' graphical representation: the organigrams(Fayol, 1925).

The "hearts and mind" approach is a behavioural view of safety which targets individuals to improve safety, a method derived from a branch of psychology.

Similarly, in security, Sagan analysed the problem of the limit of redundancy when translated from engineering to organisational issues(Sagan, 1993).

In second version, this item was changed as "deference to expertise"(Weick, Sutcliffe, 2001). One hypothesis for this change is that it is stresses the positive dimension of this informal side of work.

Type II error corresponds to maintaining a hypothesis that is wrong (type I error is the opposite, namely giving up a hypothesis which is right).

Between Appin[START_REF] Hopkins | Crime without Punishment: The Appin Mine Disaster[END_REF] and Moura[START_REF] Hopkins | Managing Major Hazards: the Lessons of the Moura Mine Disaster[END_REF], Hopkins wrote articles developing and refining his ideas of safety in mines[START_REF] Hopkins | Blood Money? The Effect of Bonus Pay on Safety in Coal Mines[END_REF][START_REF] Hopkins | Why coal mine safety regulations in Australia are not enforced[END_REF][START_REF] Hopkins | The cause of coal mine accidents[END_REF].

Hopkins recognises that only when companies are faced with such "near-death" experience are they willing to make the changes required.

His solution of sceptical audit is different than the anarchist proposition ofDekker (2018), which he considers to be dangerous[START_REF] Hopkins | Organising for safety. How structure creates culture[END_REF].