4.1The claim
Section IV, Part II of the Enquiry argues that a run of uniform experience, however long, provides no argument for expecting it to continue. The claim is not that such expectations are foolish. It is that whatever carries the mind from what has held so far to what will hold next time is not reasoning. The argument is read closely below, with the chemical plant of WSTiger's 1984 record set beside it: a plant whose operators have heard the pressure warning many times and have stopped treating it as one. The contribution here goes to the first side of the debate. Hume's argument shows that Turner's misread events and Vaughan's normalised departures need no error of reasoning to explain them, because there was no reasoning available to make the reading correct.
4.2Hume's question
Hume opens the section by dividing the objects of enquiry into relations of ideas and matters of fact. The second kind admits no demonstration, because its contrary is always conceivable:
The contrary of every matter of fact is still possible; because it can never imply a contradiction, and is conceived by the mind with the same facility and distinctness, as if ever so conformable to reality.
Everything that follows depends on this. A warning that has sounded harmlessly a hundred times could sound harmfully on the next occasion without any contradiction, and a mind can conceive that occasion as easily as the others. What cannot be conceived is the contrary of an arithmetic truth. The future of a plant is not that kind of truth.
Hume adds, in the same paragraph, why the enquiry is worth making at all. It may be useful, he says, by
exciting curiosity, and destroying that implicit faith and security, which is the bane of all reasoning and free enquiry.
The phrase "implicit faith and security" is one a safety engineer might use about operators who have stopped looking at a gauge. Hume meant it of philosophers, but the target is the same habit of mind.
He then observes something that bears directly on the warning that has lost its force. Where a causal connection was learned late, people know they learned it by experience. Where it was learned so early that no one remembers learning it, people imagine they could have worked it out by reason alone:
Such is the influence of custom, that, where it is strongest, it not only covers our natural ignorance, but even conceals itself, and seems not to take place, merely because it is found in the highest degree.
This sentence is the hinge of the article's reading. Custom, at its strongest, does not feel like custom. It feels like knowledge. An operator who has heard the alarm sound without consequence through many shifts does not experience a belief that the next alarm will be harmless. The operator experiences a fact about the alarm: this is the one that goes off. The belief has hidden itself inside the perception.
4.3The bread and the next loaf
Part II of Section IV asks the harder question. Granting that knowledge of causes comes from experience, what is the foundation of conclusions from experience? Hume's example is bread:
The bread, which I formerly eat, nourished me; that is, a body of such sensible qualities was, at that time, endued with such secret powers: but does it follow, that other bread must also nourish me at another time, and that like sensible qualities must always be attended with like secret powers? The consequence seems nowise necessary.
Replace the bread with a pressure reading. The reading that formerly crossed the threshold did no harm; that is, a state of the equipment with such visible qualities was, at that time, attended by no damage. Does it follow that the next crossing must also be harmless? The consequence, in Hume's word, seems nowise necessary. Hume does not say the inference is wrong. He says it is a step, and a step needs a ground:
At least, it must be acknowledged that there is here a consequence drawn by the mind; that there is a certain step taken; a process of thought, and an inference, which wants to be explained.
He then looks for the ground and finds none. Demonstrative reasoning cannot supply it, because the contrary is conceivable:
That there are no demonstrative arguments in the case seems evident; since it implies no contradiction that the course of nature may change, and that an object, seemingly like those which we have experienced, may be attended with different or contrary effects.
Reasoning from experience cannot supply it either, because it would assume what it sets out to prove:
To endeavour, therefore, the proof of this last supposition by probable arguments, or arguments regarding existence, must be evidently going in a circle, and taking that for granted, which is the very point in question.
The core of the argument follows a page later, in the passage the parent study also uses:
For all inferences from experience suppose, as their foundation, that the future will resemble the past, and that similar powers will be conjoined with similar sensible qualities. If there be any suspicion that the course of nature may change, and that the past may be no rule for the future, all experience becomes useless, and can give rise to no inference or conclusion. It is impossible, therefore, that any arguments from experience can prove this resemblance of the past to the future; since all these arguments are founded on the supposition of that resemblance. Let the course of things be allowed hitherto ever so regular; that alone, without some new argument or inference, proves not that, for the future, it will continue so. In vain do you pretend to have learned the nature of bodies from your past experience. Their secret nature, and consequently all their effects and influence, may change, without any change in their sensible qualities. This happens sometimes, and with regard to some objects: Why may it not happen always, and with regard to all objects?
Two clauses in this passage do the work for a reader of accident studies. The first is "Let the course of things be allowed hitherto ever so regular; that alone, without some new argument or inference, proves not that, for the future, it will continue so." The second is "Their secret nature, and consequently all their effects and influence, may change, without any change in their sensible qualities." This article sets the second clause beside Perrow's structural account and Reason's latent conditions. In principle, a piece of equipment can present the same sensible qualities while what Hume calls its "secret nature" has changed. The sensible quality, an alarm that sounds and then stops, can stay constant while what lies behind it moves.
4.4Why a hundred instances persuade where one does not
Hume adds a further observation that sharpens the point for anyone who manages warnings. If confidence came from reason, he says, one instance would be as good as a hundred. It is not:
It is only after a long course of uniform experiments in any kind, that we attain a firm reliance and security with regard to a particular event. Now where is that process of reasoning which, from one instance, draws a conclusion, so different from that which it infers from a hundred instances that are nowise different from that single one?
This is the shape of normalised deviance stated as a puzzle about the mind. The first time a pressure alarm sounds without a cause anyone can find, it is a warning. By the hundredth time it is part of how the equipment behaves. Nothing about the hundredth instance differs from the first; what differs is the length of the run behind it. Hume's point is that reason has no way to give the hundredth instance more authority than the first, and yet the mind does give it more. Vaughan's account of an organisation accepting as normal what it once treated as a warning is, read through this paragraph, an account of a run growing long enough to change what the organisation feels it knows.
Hume also anticipates the practical objection. A plant manager might say: whatever the philosophy, experience works, and the plant has run on it. Hume grants the point and declines it at once:
My practice, you say, refutes my doubts. But you mistake the purport of my question. As an agent, I am quite satisfied in the point; but as a philosopher, who has some share of curiosity, I will not say scepticism, I want to learn the foundation of this inference.
The distinction between the agent and the philosopher maps onto a distinction that the records below draw in their own terms: between the record that nothing happened and the claim that nothing will.
4.5The record: a plant that has heard its alarm before
WSTiger's record sets the scene in a synthetic chemical plant in 1984. The setting is invented; the plant, its operators and its manager are roles in a scene written for the platform, not people or places that existed.
In the synthetic chemical plant, pressure warnings sound several times a month, yet no accident occurs, so operators check the warning and move on. The manager proposes raising the warning threshold to reduce the number of warnings.
The record's first sentence contains Hume's whole sequence in compressed form. The words "pressure warnings sound several times a month, yet no accident occurs" describe a run of uniform experience. In "so operators check the warning and move on", the run has produced an expectation, and the expectation now governs conduct. The word "so" is where custom enters. Nothing in the record says the operators reasoned their way to moving on. The record presents their behaviour as following from the run, which is precisely the relation Hume says reasoning cannot supply and custom does.
The second sentence turns the custom into a proposal. The manager wants to raise the threshold "to reduce the number of warnings". On a Humean reading this is an attempt to make the written rule agree with what the mind already expects. The operators' practice has already raised the threshold in effect; the manager's proposal would raise it on paper. Hume's remark that custom at its strongest "conceals itself" is visible here: the proposal is framed as a matter of alarm management, of reducing noise, and not as a decision to believe that the alarms carry no information.
The record then asks:
Should the warning threshold be raised, a cause investigation be conducted for each warning, or equipment be suspended for inspection?
The three options correspond to three attitudes towards the run. Raising the threshold accepts the run as evidence. Investigating each warning treats every instance as a new question, refusing to let the hundredth carry more weight than the first until a cause is found. Suspending the equipment for inspection goes behind the sensible qualities to the "secret nature" of the equipment directly. The record does not choose among them, and this article does not either.
What the record does do, in its example judgment, is draw Hume's distinction in its own words:
This is an example of distinguishing the record that no accident occurred from the fact that no risk exists. Record how often warnings were ignored and how close to the limit the equipment was each time.
The first sentence is the agent and the philosopher of §32 restated for a plant. What the record calls "the record that no accident occurred" is what experience gives: in Hume's own account in §29, past experience informs the mind directly and certainly only about the objects and the period that fell under it. What it calls "the fact that no risk exists" is the inference to the future that experience cannot ground. WSTiger's example judgment separates the two exactly where Hume separates them.
The second sentence is more interesting, because it goes past Hume in one direction and stays within him in another. It asks for two things to be written down: how often warnings were ignored, and how close to the limit the equipment was each time. The first count measures the custom itself. It turns the operators' moving on, which the scenario presents as a consequence of the calm, into an object of record. The second measure looks behind the warning to the margin that remained when it sounded. Both are still experience. Neither escapes the supposition Hume says all inference from experience rests on. What they change is which experience the organisation keeps in front of itself. A plant that records how close each warning came to the limit will have, after a run of quiet, a different set of facts present to its memory than a plant that records only that no accident occurred. If those margins have been narrowing, the record will show a trend that the bare word "quiet" hides.
This is where the record speaks to the debate. Turner's incubation period is a time in which misread events accumulate unnoticed. The example judgment proposes a way of making them noticed: of writing the near things down as near things, rather than letting them be absorbed into the run. That proposal is close in spirit to Weick's first practice, attention to failure, and to the high-reliability school's claim that an organisation can keep itself from settling. It does not answer Sagan's finding that learning from near-accidents is limited by secrecy and blame, because the record says nothing about who would read the counts, or what would happen to the operators whose ignored warnings were now on paper.
4.6What the case adds
Read through Section IV, the plant record shows that the drift Vaughan names needs no failure of reasoning to explain it. The run of harmless warnings is not misinterpreted evidence; it is evidence that never had the authority the mind gives it. The record's own example judgment states the distinction Hume drew, and proposes to change what is kept in memory rather than to argue the operators out of their expectation. For the first side of the debate, the case adds a reason why the drift is so stable: there is no argument available to stop it. For the second side, it suggests that whatever reliable organisations do, they do it by changing the facts in front of people, not by improving the inference people draw from them.