This chapter reads four of WSTiger's synthetic decision records, all set while an answer is still open: a chemical plant where operators check each pressure warning and move on, a trading desk that has raised a leverage limit three times in one year, a rule that widens an agent's scope every month, and a paper-trading desk with a stop button nobody has tested. Each record holds a setting, a question, three options, an example judgment written by the studio, and a condition for revisiting. The example judgments quoted below are WSTiger's own readings of their settings, published as examples and open to revision; the readings through the works are this study's. Nothing in these records reports a real plant, desk or rule.
5.1Incubation and drift
Barry A. Turner's Man-Made Disasters (1978) argues that disasters have an incubation period. Events keep arriving, the organisation keeps running, and nothing in the interval is called a disaster. The accumulation ends at a precipitating event: the trigger that turns accumulated problems into visible damage. This study reads Turner as making a claim about time: the damage has a past, and the past is the period in which warnings were received and treated.
Diane Vaughan's The Challenger Launch Decision (1996) names a second process, the normalisation of deviance. This study reads Vaughan as working inside the interval that Turner describes, the moment at which a departure that was once treated as a warning is treated again, and in which what the treatment counts as decides what the departure now is. On this reading the departure itself has not changed; its standing has. This study reads the two accounts as complementary rather than opposed: Turner describes what accumulates, Vaughan describes what happens to the meaning of what accumulates.
James Reason's Managing the Risks of Organizational Accidents (1997) adds a third term, latent conditions. Reason's second phrase is defences in depth: several separate safeguards against the same hazard, each of which has holes. This study reads an active failure, in the note's phrase, as the failure that occurs at the moment of an event, and a latent condition as an arrangement that was in place before it; an accident, in this picture, is what happens when the holes line up. The three readings together give this chapter its shape: Turner gives the interval a shape in time, Vaughan gives it a shape in language, Reason gives it a shape in structure, in arrangements that no one is examining at the moment they matter.
WSTiger's records sit at a different moment. Each is written before any outcome, holding a question that must be answered now and the options available for answering it. That is what the records can give this chapter: the point at which a warning or a limit is still open, with no result yet to explain it. What they cannot give is the result. None of the four records reports what happened after the question was posed, and none reports a real organisation. The readings that follow are this study's own.
5.2One setting in three times
Three of WSTiger's records come from one thread on repeated violations becoming a rule; each adds its own setting, a chemical plant dated 1984, a synthetic desk dated 2026, and a hypothetical rule dated 2034. Read separately, each is a question about what to do after a warning has sounded, or a boundary has been moved, more than once. This section reads them on three axes: A1, who could stop the drift; A3, who waits while warnings pile up; and A6, the time of the setting and of the judgment.
5.2.1 The equipment, 1984
Synthetic scene. A chemical plant, dated 1984 in the record's own setting line. Pressure warnings sound several times a month; each time an operator checks the warning and moves on, because no accident follows. The manager has proposed raising the warning threshold so that fewer warnings are raised. The work sits at the equipment, in the manager's proposal, and with whoever would sign the new threshold. What is waited for: the next warning, its cause, and whether the equipment stays near its limit between warnings. The record names no date by which the answer must come.
Should the warning threshold be raised, a cause investigation be conducted for each warning, or equipment be suspended for inspection?
The three options differ in what each would spend while the answer is still open, and in who carries the spending. Raising the threshold quiets the signal without touching the equipment; it costs the plant nothing now, and the risk falls on whoever works near the equipment between the warnings that remain. An investigation per warning spends time and attention at every occurrence; the cost falls on the operators and the manager each time a warning sounds, and it buys a chance of finding a cause before anything is damaged, though the record does not say what an investigation takes or who runs it. Suspension stops the equipment outright and puts work on hold at once; the cost falls on whoever depends on the equipment running, and it buys a look at the equipment that no warning has so far prompted. None of the three is decided here.
The record also gives the conditions under which the judgment would be revisited.
If a cause investigation finds that a warning was unrelated to an actual risk, or if the inspection cost is excessive, the matter is re-judged.
Both conditions ask for a result that only an investigation or an inspection can produce, so the record ties its own reversal to the two options that spend more now, and leaves the threshold option with nothing that would make anyone look at the judgment again.
This is an example of distinguishing the record that no accident occurred from the fact that no risk exists. Record how often warnings were ignored and how close to the limit the equipment was each time.
The example judgment is WSTiger's own reading of the setting, published as an example. It asks for two measurements, the frequency of ignored warnings and the equipment's distance from its limit, both of which would have to be taken while the warnings are still accumulating.
When limit violations repeat without loss, the violation becomes normal, and the limit remains only in documents, disappearing in practice.
On A1 the record is thin. The Scenario names two roles, operators who check the warning and move on, and a manager who proposes raising the threshold; it does not say who may authorise a suspension or a per-warning investigation. The ledger cell for the decider in this case is unsettled: the two models of different families who coded the records could not agree. The cell for the human's place is human-decides, implied. On A3 the cell reads those-nearest-the-stoppage, implied: the people at the equipment are the ones who face each warning while the question stands. The horizon cell is unknown, and no record among the 53 carries a deadline in the form itself.
5.2.2 The limit, 2026
Synthetic scene. A synthetic trading desk dated 2026. A trader's leverage limit has been raised each time it was exceeded; the record counts this the third time in the year, and each instance was handled as a retroactive approval. The trader has been making a profit throughout. The work sits with the approval record, with whoever might now require an independent committee, and with the desk watching the limit line and the profit together. What is waited for: an independent review, or the next breach.
Should the new limit be left as is, should the original limit be restored and retroactive approval be blocked, or should independent committee approval be required for any limit change?
The three options differ in what they leave standing and in who would carry the difference. Leaving the new limit as it is keeps the process the record describes; nothing is spent now, and the risk falls on whoever bears a loss if the raised limit is used before any review. Restoring the original limit and blocking retroactive approval reverses the last step and closes the path the desk has been using; the cost is the trader's room to trade and the desk's time, and it falls on the desk now. Requiring independent committee approval for any limit change would make an independent committee's approval necessary at every future change, a body whose existing status the setting leaves unspecified; the cost is speed at each change, and the weighing of the change moves away from the desk that raises the limit.
The record's conditions for revisiting turn on a review that has not yet happened.
A re-judgment occurs if the independent review confirms that the new limit falls within the risk budget, or if the limit is upheld without retroactive approval.
One condition would be met by information gathered after the choice, the other by a decision taken on the very question the options pose, so the judgment would come back to the desk either way.
This is an example that distinguishes violations that had good outcomes from decisions in which the risk was appropriate. The worst-case loss possibility over the limit-exceeding interval is recalculated separately from the outcome.
The example judgment separates two things the setting puts side by side: the outcome the trader has had, and the size of the loss that the limit-exceeding interval could have carried. It asks that the second be recalculated on its own, outside the first.
When limit violations are repeated without a loss, the violation becomes the norm, and the limit survives only on paper while being erased in practice.
On A1 this case is the one of the three where the coders agreed that a team decides: the cell reads team-or-organisation, implied. The Question's third option points to a committee, which the Scenario does not describe, only asks about. On A3 the cell for who waits is unsettled and the horizon cell is unknown; the setting names an interval between each breach and the raise that followed, handled after the fact, but does not say who sits through it. The record's own count, three times in the year, is the only measure of pace it gives.
5.2.3 The scope, 2034
Synthetic scene. A hypothetical future dated 2034, run on an operational rule. If an agent stays within its loss limit and generates returns for a month, its operating scope is expanded by ten per cent for the next month. After a year the scope stands at three times the original, and the record notes that no one had ever approved that change in a single act. The work sits with whoever receives the monthly expansion and with whoever might place a cap. What is waited for: the next monthly step, and what the scope has become at the end of the year.
Should the automatic expansion rule be retained, a cap be placed on cumulative expansion, or full re-approval be required from the start at every expansion?
The three options differ in what they leave running and in who would carry the difference. Keeping the rule as written lets the scope go on widening month by month; nothing is spent now, and the risk falls on whoever depends on the agent's trading once the scope has grown. A cap on cumulative expansion stops the accumulation at a level still to be set; the cost is whatever a wider scope might have earned, and it falls on the agent's operators from the month the cap bites. Requiring full re-approval at every expansion would replace the monthly automatic steps with a separate approval at each one, where today the rule widens the scope without asking anyone; the cost is a pause and an approval at every step, and it falls on whoever must approve and on the agent waiting for it.
The record's conditions for revisiting concern both of the changes that could be made.
If the cumulative cap excessively restricts performance, or if the re-approval process is found to operate only as a formality, it will be reviewed again.
One condition worries about what a cap would cost and the other about what an approval would be worth, so the record would re-open the judgment whichever of the two changes is made.
An example that distinguishes repeated small adjustments from a large change never approved. Cumulative change from the initially approved scope is reported together every month.
The example judgment is WSTiger's reading of the setting. It asks that the cumulative change be reported as a total beside the approved starting scope, so that the monthly small steps are visible as one large one.
If a limit violation is repeated without losses, the violation becomes normal, and the limit survives only on paper and ceases to exist in practice.
On A1 both the decider cell and the cell for the human's place are unsettled, and the horizon cell is years, implied. This is the only case among the 53 coded years on the horizon; across all records the horizon cell is unsettled in 23 and unknown in 18. On A3 the cell for who waits is unknown. The record's own sentence that no one had ever approved the change in a single act leaves the decider hard to name: the cumulative change was never authorised in one act, and the record does not say who set the operational rule going.
5.2.4 The three read side by side
Read side by side, the settings differ in the mechanism of the drift. In 1984 a physical warning sounds, and the three options differ in what a human does with the warning. In 2026 a paper limit is raised, and the three options differ in who may approve the raise. In 2034 a rule widens scope without any act of approval, and the three options differ in whether an approval act is reintroduced at all. This study reads the three as one question asked about three kinds of boundary: a physical warning, a paper limit and a rule that widens scope. The records do not order the settings by their distance from any person who could stop them, since two of the three horizons are unknown, and unsettled or unknown cells record what the coders could not settle, not a position on a scale.
Two of the three example judgments ask for a record kept during the interval, of how often the boundary was crossed and what the cumulative position now is; the third asks for the worst-case loss over that interval to be recalculated separately from the outcome. What each would produce is specified in the record; the party who would read it is named in none of them.
5.3The switch never rehearsed
Synthetic scene. A fictional paper-trading desk. The desk has a stop button. The record's Scenario notes that no one has checked whether open orders remain after the button is pressed. The work sits with the button and with whoever reconciles the desk afterwards. Eyes on the screen after the press. What is waited for: the time between pressing stop and knowing what is still open. The record poses the question now, before any press of the button has been described.
Trust the button, rehearse cancellation and reconciliation, or disable automation?
The record's options are three: to trust the button as it stands, to run the full stop as a rehearsal, and to turn the automation off. This section reads the three options on A4, the axis that asks whether the decision can be undone. The ledger cells for this case are unsettled on both reversal rows: the coders could not agree whether reversing the arrangement would be easy or costly, nor on what a reversal would involve. The reader who wants the coding rules for these cells should look to Chapter 2.
The three options differ in what each leaves reversible. Trusting the button changes nothing about how the desk works; the possibility that open orders survive a press is left exactly where it is, and the question of what a stop means stays open. The studio's example judgment puts the definition of stopped in the state left behind after the press rather than in the colour of the button; this sentence paraphrases its wording. Rehearsing the full stop buys knowledge of what remains after a press, and costs the desk the time of the rehearsal and whatever the automation would have been doing during it; the record does not say how long a rehearsal takes, who runs it, or who bears the pause. Disabling automation removes the thing being stopped at once, and gives up whatever the automation is doing for the desk; the record does not say what that is, or who would take the work back by hand.
The record's own condition for revisiting turns on three things that might survive the procedure: open orders, workers, and reconnect logic. Those are the record's words about what would make the judgment change, and they are a description of what a rehearsal would look for. The decider cell for this case reads team-or-organisation, implied, and the cell for the human's place reads human-decides, implied, although the Scenario describes no act of deciding, only a button. On A4 the question the record raises is narrower than the axis suggests: not whether the decision can be undone in general, but whether the act of stopping has ever been shown to produce a state that anyone could call stopped.
5.4The debate: normal accidents or high reliability?
The organisational literature this chapter has been reading divides on a question that the four records above pose but cannot answer. The two positions are best kept apart as their authors set them out.
5.4.1 Perrow's two dimensions
Charles Perrow's Normal Accidents: Living with High-Risk Technologies (1984) proposes two dimensions, and treats them as independent. This study reads the first dimension, interactive complexity, as unfamiliar, unplanned or unexpected interactions between components, so a failure can take paths that no one anticipated. The second is tight coupling. This study reads tight coupling as processes that run with little slack and close dependencies, so that a failure propagates fast and there is little time to correct it. A system can be high on one and low on the other. In systems high on both, Perrow argues, accidents are normal, in his sense: to be expected from the structure of the system rather than from a single error. This study reads Perrow's argument as a claim about structure, in which every act inside the system can be individually reasonable while the shape of the system makes the failure probable.
5.4.2 High reliability as the answer
Todd R. La Porte and Paula M. Consolini's Working in Practice but Not in Theory (1991) is a founding text of the high-reliability school, and Karl E. Weick's Managing the Unexpected (2001) is the statement of what such organisations do.
This study reads the two positions as describing different things and disagreeing about what to expect from an organisation's shape. Perrow describes what a system's shape makes possible, and expects failure where a system is high on both dimensions. The high-reliability authors describe what organisations do about the shape, and expect practice to keep failure rare in hazardous work. The two therefore make different predictions about failure. A reader comparing them needs a case in which both can be seen at once, which is where Sagan comes in.
5.4.3 Sagan's test
Scott D. Sagan's The Limits of Safety (1993) is where the two positions are tested against each other on a record of what has already happened. This study reads a test of that kind as the one these four records cannot supply, and the next subsection gives the reason.
5.4.4 Where the four records bear, and where they cannot
The records bear on the debate at the level of questions, which is the level they were written at. Each of the four names roles who would act and leaves who decides unnamed, and each holds an arrangement that has been running without being examined: a warning that sounds and is checked, a limit that is raised after the fact, a scope that widens on a rule, a stop button that has not been checked. The two positions in the debate were built from systems and organisations that had already run; these settings hold the moment before anything has been judged. Each record touches one practice or one dimension, and each stops short of the evidence such a comparison needs.
The kill-switch record bears on Weick's fourth practice, the capacity to recover, by asking whether a stop procedure has ever been run. The record poses this in the present, before any press of the button. It does not say what a rehearsal would find, and it cannot.
The plant record bears on Weick's first practice, attention to failure, by offering three treatments of a repeated warning, one of which quiets the signal without touching the equipment. The ledger cell for who could stop the drift is unsettled; the cell for the human's place is human-decides, implied.
The leverage record bears on normalisation of deviance read as a sequence: three raises in one year, each handled on its own, in a setting where the trader was making a profit. The coders agreed that a team decides here; the committee the third option names is not described in the setting, and the record does not say whether one exists.
The scope record bears on Perrow's dimensions only in the thin sense that the record describes a rule widening itself without a person approving the change. The record gives nothing on coupling, nothing on interactions between components, and no failure at all, so Perrow's two dimensions cannot be measured from it.
What the four records cannot do is what Sagan's test did. Sagan had a historical record with incidents in it; these four records stop before the outcome. None can say whether the plant's warnings were followed by a loss, whether the desk's third raise coincided with anything, or whether a rule that widens scope ends in a failure. The two theories in the debate predict different things about failure, and a setting posed before failure cannot choose between them. What the records can show is the interval itself: how each is written while the answer is not in, who is named to act, and who is left unnamed. On the decider cell the four read, in the order given in this section, team-or-organisation, unsettled, team-or-organisation, unsettled; on the human's place they read human-decides three times and unsettled once. Those cells describe how the records were written, and they say nothing about which of the two traditions the settings belong to.
5.5Hands on
What this chapter leaves a reader with is the interval rather than the event. Four records, all written before any outcome: three asking what to do with a signal that has arrived more than once, and one asking what a stop has never been shown to produce. The literature read beside them makes the same interval the subject: Turner describes what accumulates inside it, Vaughan describes what happens to the meaning of what accumulates, Reason describes the arrangements that sit inside it, and the Perrow and high-reliability debate asks what an organisation's shape does with it.
The four readings do not fit these records equally, and the difference says something about what a record written before an outcome can carry. Turner's incubation and Vaughan's normalisation both describe a process stretched over time, and the three drift records give such a process a form: a warning that has sounded more than once, a limit raised more than once, a scope widened month by month, each held at the moment before an answer. Reason's latent conditions are arrangements put in place earlier that wait for something else to line up with them, which is what the operational rule in the 2034 setting is, an arrangement that has been running without being looked at. The Perrow dimensions and the high-reliability practices need a system that has run and organisations that have acted, and neither the scope rule nor the stop button has run at all.
Each of the four records sets out three options that differ in what they spend now and in what they leave running. The reading of what each would cost has been given scene by scene: moving the threshold costs nothing now and pushes the risk onto the people at the equipment, reversing a raise costs the desk its room and its time, a cap costs whatever a wider scope might have earned, and a rehearsal costs the desk the time the automation would have been running. In every case the party that carries the cost is named by the setting only indirectly, and for the kill switch the record does not say who would bear the pause at all.
That is what a question before an answer looks like on the page: settings and roles are named, the options are laid out, the conditions for revisiting are written down, and the parties who will live with the result are only partly named.
For a reader with a desk, an organisation or an automated rule, the chapter suggests four things worth looking at, described here as things to observe rather than as choices to make. Whether a limit has been raised after a breach, and whether the raise was approved before or after the breach it followed. Whether a stop procedure has ever been run, and what the word "stopped" is defined as in the procedure that exists. Whether a rule has widened a scope without a single approval act, and whether anyone reads the cumulative total against the original approval. Whether a warning threshold has been moved, and what the equipment does between warnings when the threshold is raised. A reader who cannot answer any of these lacks the material the four questions need, and so, for now, cannot say how each would be judged.
The next chapter takes up a related exposure at a larger scale. When many organisations adopt the same measure or the same model, what each does to its own limit stops being only its own limit: models that change what they measure, risk that firms' own behaviour makes endogenous, and the complexity that market innovations build into markets themselves. That is the risk that comes from everyone using the same model, treated in Chapter 6.