7.1Hume beneath the debate
The two camps in the accident literature disagree about whether organisations can resist the drift that turns warnings into noise. Read through Sections IV and V of the Enquiry, the disagreement looks narrower than it first appears. Neither side, in the notes this article relies on, claims that a run of uneventful experience is good evidence of safety. The first side says that organisations treat it as such anyway; the second says that some organisations have learned not to. Hume explains why the first side's observation should be expected: custom forms expectations from runs, does so with the force of instinct, and is not open to correction by argument. He also explains the shape of what the second side must do if it is right: not persuade operators that the run proves nothing, which they may already accept as philosophers while continuing as agents, but change the facts that are present to them when they decide.
This reading has a consequence for how the evidence on each side should be weighed. If custom is as Hume describes it, an organisation that has not yet had an accident is not, by that fact, an organisation that has resisted custom; it may simply be one whose run has not yet ended. La Porte and Consolini's observation that some organisations run hazardous work with very few failures is compatible with either reading; on this article's reading, the high-reliability school's strongest case lies in its description of practices, not in the length of any quiet. Sagan's test, which set the two theories against each other and found dangerous near-accidents in the record of nuclear command and control, bears on this, as this article reads it: a record without accidents can still contain near-accidents. Hume's Section IV supplies the reason why the length of a quiet, by itself, cannot settle the matter.
7.2What the records add, and what they cannot
The two records are synthetic and written for study. They cannot show how real organisations behave, and nothing in this article treats them as if they could. What they can show is how a decision about a quiet warning is written down before its outcome. In both cases the writing is more Humean than one might expect: each record names the gap between a calm record and safety, and each proposes a measure that would put a different fact in front of the people deciding. Each also leaves unnamed the fact that would break the calm.
The parent study's ledger gives a wider context for that last observation, though it does not by itself explain it. Across its 53 records, every record carries a condition for revisiting, because WSTiger's form asks for one, and 5 of 53 (9%) of those conditions contain a number, a threshold or a time that code can detect. The pre-registered hypothesis that few decisions write in advance what would reverse them in words anyone could observe was supported on both readings, 48 cases for and 5 against (91%). Neither revisit line in the two records read here carries a number, a date or a threshold. That count is about the record form and about these synthetic records, not about organisations. It is consistent with the reading above, that the revisit lines name what would relax caution in terms that leave much to judgment.
The ledger also bears on the second record's raise-and-approve pattern. The study's hypothesis that a restriction outlives the memory of its reason went against, on both readings, because the reasons for restrictions are usually written. Across the 53 records, the coders agreed that a reason was recorded in 49 of 53 (92%). The desk record fits that pattern, but the pattern is not the one the record is about. The desk's problem is not that the reason for the limit was forgotten. It is that a narrower body of experience, gathered after the limit was set, came to outweigh the wider body that set it. Hume's footnote on the limits of government describes both bodies as experience. A ledger that asks whether the reason was recorded cannot see which experience the custom of a desk is being formed on.
7.3Custom and the four higher goals
The parent study also asked its coders which of four higher goals each option gains or gives up: resilience, long-term stability, ethical coherence and evolvability. Across the 159 options in the 53 records, both coders agreed that 44 reduce the immediate loss, and among what those options give up they recorded resilience 18 times, long-term stability 17, ethical coherence 13 and evolvability 7. In the two records here, the coders agreed that raising the plant's threshold and keeping the desk's new limit each reduce the immediate loss and each give up resilience, long-term stability and ethical coherence. In Humean terms, the options that let custom stand are the ones that relieve the present cost: fewer alarms to answer, no confrontation with a profitable trader. What they give up are goals that belong to the long run, which custom, by its nature, does not weigh. This is a reading of the coders' cells, not a finding the ledger itself makes.
7.4Who bears the quiet
One further point should be recorded without being pressed. In the plant record, both coders read the cost of waiting as falling on those nearest the stoppage: the operators who hear the alarms and stand nearest the equipment. Niklas Luhmann's distinction between risk, a possible loss attributed to one's own decision, and danger, a possible loss attributed to something outside one's control, applies here: the same loss is a risk to the one who decides and a danger to those affected who did not decide (Luhmann 1993). The operators in the scene did not choose the threshold, and the manager who proposes raising it is not the one who stands by the vessel. Custom works on both, but it works on different experience. The record does not say whose custom will govern the decision, and the coders did not agree on who decides.
7.5Alternative readings
Two other readings of the records deserve mention. The first takes them as illustrations of outcome bias and nothing more. On that reading, the desk record is about Baron and Hershey's finding, and Hume adds only a philosophical gloss. The reply is that outcome bias concerns how a single outcome colours the judgment of a single decision, while both records concern runs: several warnings a month, three breaches in a year. What matters in a run is the growth of a firm expectation over repetitions, which is what Section IV, §31 and Section V, §36 describe. The two readings are compatible, but the Humean one explains a feature the outcome-bias reading does not, namely why the hundredth harmless alarm is more persuasive than the first.
The second alternative takes the records as statements of Taleb's black swan: a rare event of extreme impact explained afterwards as if it had been predictable (Taleb 2007). The records do concern events that have not yet happened and could be severe. But neither record is written afterwards, and neither treats the possible accident as unforeseeable; both treat it as foreseeable and as hidden by the run. The plant record in particular asks for the margins to be recorded so that the approach to the limit would be visible. That is closer to Turner's incubation, a period in which signals are present but misread, than to a black swan.