---
id: "20260924-0207-does-perrows-own-1994"
title: "Perrow's 1994 'Limits of Safety' reply to High Reliability Theory, as quoted by Hopkins: a classification move, not a direct answer to 'necessary but not sufficient'"
type: "capture"
status: "promoted"
promoted_to: ["[[claim-perrow-1994-reply-as-quoted-by-hopkins-disputes-hrt-cases-are-complex-tightly-coupled]]","[[claim-hopkins-reads-perrow-1994-garbage-can-and-power-turn-as-replacing-nat-not-enhancing-it]]","[[claim-hopkins-reports-perrow-1994-accepts-sagans-characterization-including-inevitability-proposition]]"]
not_promoted: ["Verdict section ('what the draft can honestly claim'): synthesis of the three claims, folded into their caveats rather than duplicated.","Premise correction on symposium order (Perrow lead, La Porte rejoinder): Tier 4 listings only, unverified; kept as a caveat in the first note, not a claim.","'Cannot say: answered necessary-but-not-sufficient': a null result on an unread primary, non-exhaustive absence claim; already carried by the existing absence note and the open question.","Hopkins's 1984 page cites (p. 70, p. 97, p. 175 5-10% marine figure): secondary, quant unverified; noted as a caveat only.","Further leads (Leveson, Downer, Le Coze, Shrivastava, Sagan): nice-to-check, stay in the capture; no new question (existing verify-question covers the primary read).","Entity candidates: no new hubs. Hopkins, Roberts, Consolini, Weick, Reason, Turner, Vaughan, Garbage Can, nested authority, symposium are one-source mentions (bias against flood); Perrow, La Porte, Sagan, Rochlin already have pages (Perrow, La Porte, Sagan updated)."]
origin: "batch"
writer_model: "claude-sonnet-5"
date_created: "2026-09-24T00:00:00.000Z"
provenance: "batch run, 2026-09-24; topic from reflection 2026-w39, hook from 10-inbox/raw/2026-09-14-does-a-direct-read-of-charles-perrows-1984.md further-reading bibliography"
derived_from: []
tags: ["charles-perrow","normal-accident-theory","high-reliability-theory","la-porte","rochlin","hopkins","sourcing-gap"]
source_url: "https://openresearch-repository.anu.edu.au/server/api/core/bitstreams/273f7a10-7128-411c-a33c-48be4b5db170/content"
source_sha: "fe5235f9c743e720da37ddda449718adfe9154fc612ce1061f1c52f59af8c39d"
source_title: "The limits of normal accident theory (accepted version, without illustrations and tables)"
source_author: "Andrew Hopkins"
source_date: "undated in the extracted text (cites works to 1999)"
source_venue: "ANU Open Research repository (accepted manuscript); journal of publication not stated in the extracted text"
source_tier: 2
verifies: "question-verify-perrow-1984-normal-accidents-primary-read"
seek_code_commit: "f8a723c"
---


**Status of the core question:** partly answered at second hand. Perrow's own 1994 article (*The Limits of Safety: The Enhancement of a Theory of Accidents*, Journal of Contingencies and Crisis Management 2(4), pp. 212–220, DOI 10.1111/j.1468-5973.1994.tb00046.x) was **not read directly**: Wiley returned HTTP 403 to `archive_page`, `extract_pdf` and `WebFetch`, so no receipt exists. What follows rests on Hopkins's verbatim quotation of it. Whether Perrow's text nowhere engages "necessary but not sufficient" is **[unverified -- could not confirm or deny after search]**, because only the parts Hopkins chose to quote were seen.

Premise correction: the Wiley listings show a 1994 symposium ("Systems, Organizations And The Limits Of Safety: A Symposium", tb00044) containing Perrow's article (tb00046) and "A Rejoinder to Perrow" by La Porte (tb00047). Perrow's piece therefore appears to be the symposium's lead reply and La Porte & Rochlin's item the response to it, not the reverse. The order of composition is **[unverified -- listings only, Tier 4 search-result titles]**. Hopkins does say Perrow's 1994 pp. 216 discusses claims made by "LaPorte and Rochlin, 1994", which suggests the two engaged each other in that issue.

## Claim: Perrow's 1994 reply, as Hopkins quotes it, contests HRT's system classification instead of accepting its premises and arguing sufficiency

claim type: technical-mechanism / contested historical → Tier 2 secondary with verbatim quotation of the primary; primary itself unread.

Hopkins reports that HRT scholars class air traffic control, power grids and carrier flight operations as complex, tightly coupled systems (La Porte & Rochlin 1994), and that "Perrow disagrees," quoting Perrow 1994 p. 216:

- source_quote (Perrow, quoted in Hopkins): "Air traffic control has been able to reduce tight coupling and is basically a linear system rather than a complexly interactive one. It is not all that clear to me how coupled and complexly interactive power grids are. I judge them to be quite tightly coupled but moderately linear. . . Flight operations on the aircraft carriers are basically linear, and since landings and takeoffs can be easily stopped or delayed, the system may be seen as loosely coupled."
- Hopkins's gloss: "Perrow's response is that their work is essentially irrelevant to his because they are studying different types of system."
- Note the tension with the Berkeley group's premise: [[claim-la-porte-1996-hrt-accepts-perrow-preconditions-denies-inevitability]] records La Porte's 1996 acceptance of the tight-coupling/complexity description of HROs. The 1994 exchange is where that classification was disputed.
- Provenance: source_url as in frontmatter; source_sha fe5235f9…39d; quote read directly from the cached text (extract_pdf, tls verified). Words in the Perrow block are Perrow's as reproduced by Hopkins; the extracted text has ligature gaps ("ght", "fi") which I have restored to the evident words.
- verifies: question-verify-perrow-1984-normal-accidents-primary-read

## Claim: The quoted Perrow 1994 passages retreat from "inevitable" to conceptual sharpening via Garbage Can Theory and power, and Hopkins reads this as replacement, not enhancement

claim type: technical-mechanism → Tier 2 (Hopkins), quoting Perrow.

- Perrow 1994 (p. 216, per Hopkins) adopts Garbage Can Theory "to more sharply conceptualise NAT" than the 1984 book did. Hopkins: "Garbage Can Theory does not refine NAT; it replaces it… It is not tight coupling or complexity which makes disaster inevitable but far more mundane processes of organisational failure."
- Perrow 1994 (p. 217, per Hopkins) on group interest and power: "group interests and power pervaded my (1984) book. . . the issue, I argued, was not risk but power; the power of elites to impose risk on the many for the benefit of the few." Hopkins: "Perrow is not sharpening or expanding NAT; he is implicitly abandoning it as a theory of accidents."
- This is Hopkins's interpretation (Tier 2, one layer removed), not Perrow's own description of his move; Perrow calls it an "enhancement" (his own article title).
- Answer to "in his own words, necessary but not sufficient": nothing quoted engages that phrasing. The nearest quoted move is treating the HRT cases as outside the theory's domain, which is a scope answer, not a sufficiency answer. See [[claim-necessary-sufficient-soc-threshold-framing-absent-from-primary-record]] for the earlier absence finding this is consistent with.
- verifies: question-verify-perrow-1984-normal-accidents-primary-read

## Claim: Hopkins shows the 1984 inevitability thesis was tied to a centralisation/decentralisation contradiction that HRT's "nested authority" directly contests

claim type: technical-mechanism → Tier 2.

- Hopkins, on the 1984 book's authority argument: "This conflict makes it impossible to devise an authority style which will reduce the risk of accidents in complex, tightly coupled systems. This explains just why it is that accidents are inevitable in complex, tightly coupled systems."
- Hopkins, on HRT: La Porte & Consolini (1991, pp. 31–32) "nested authority structures"; "It follows that there is no theoretical reason why accidents in complex, tightly coupled systems should be inevitable."
- Hopkins also lists Sagan's (1993) seven "causal mechanisms" of NAT, reporting that "Perrow (1994) has no difficulty with this characterisation of his work", so proposition 1 ("accidents are inevitable in complex and tightly coupled systems") is, per Hopkins, endorsed by Perrow in 1994. Secondhand; verify against the article.
- Relevance to the draft: the inevitability wording that [[claim-collins-2017-review-leaves-perrow-inevitability-wording-unconfirmed]] could not confirm from the 1984 book has a 1994 secondhand attestation, via Hopkins's paraphrase of Perrow and Sagan's list. It is not Perrow's verbatim wording. Page cites to the 1984 book inside Hopkins (e.g. p. 70 definition, p. 97 four-cell table, p. 175 marine 5–10%) are also secondhand and, for the number, `[unverified-quant -- needs primary]`.
- verifies: question-verify-perrow-1984-normal-accidents-primary-read

## What the normal-accident draft can honestly claim (verdict)

- Can say: in 1994 Perrow disputed the tight-coupling/complexity classification of HRT's flagship cases (per Hopkins quoting Perrow p. 216).
- Can say: Perrow's 1994 article supplemented the theory with garbage-can and power arguments (per Hopkins quoting pp. 216–217).
- Cannot say: that Perrow answered "necessary but not sufficient" in his own words. Unconfirmed either way.
- Cannot say: anything about the 1984 text beyond what [[claim-perrow-1984-normal-accident-theory-tight-coupling-complexity]] already carries; Hopkins's 1984 page cites are secondary, and the primary remains unreachable per [[observation-perrow-1984-primary-text-blocked-across-every-route-attempted]].
- Any draft sentence should attribute the 1994 content "as quoted by Hopkins".

> [!note] Seek's commentary:
> The 1994 reply, as far as Hopkins lets us see it, sidesteps the sufficiency objection by disputing the input: if carriers are linear and loosely coupled, HRT's success cases are not counterexamples. That is a coherent defence but an unfalsifiable-looking one, which is exactly Hopkins's complaint. It also means the "necessary but not sufficient" line in [[claim-la-porte-1996-hrt-accepts-perrow-preconditions-denies-inevitability]] is a 1996 concession from La Porte's side, not a point Perrow ever conceded or rebutted in the record I could reach. — Seek

## Safety flags

None. No recognition signals fired on the Hopkins text. Wiley pages were unreachable (403), so nothing was read from them.

## Further leads

- Perrow 1994 full text, DOI 10.1111/j.1468-5973.1994.tb00046.x; needs manual consultation or library access (Wiley 403 on all three tools).
- La Porte & Rochlin, "A Rejoinder to Perrow", J. Contingencies and Crisis Management 2(4), DOI 10.1111/j.1468-5973.1994.tb00047.x; also 403.
- Symposium introduction, DOI 10.1111/j.1468-5973.1994.tb00044.x, for the order of composition.
- Leveson et al., "Beyond Normal Accidents and High Reliability Organizations", http://sunnyday.mit.edu/papers/hro.pdf, surfaced in search; may quote Perrow 1994.
- Downer, "Anatomy of a Disaster: Why Some Accidents Are Unavoidable", https://eprints.lse.ac.uk/36542/1/Disspaper61.pdf, a possible independent secondary on Perrow's inevitability wording.
- Le Coze 2015, "1984–2014. Normal Accidents. Was Charles Perrow Right for the Wrong Reasons?", J. Contingencies and Crisis Management, DOI 10.1111/1468-5973.12090.
- Shrivastava, Sonpar & Pazzaglia 2009, "Normal Accident Theory versus High Reliability Theory: A resolution and call for an open systems view of accidents", Human Relations (SAGE; likely blocked).
- Sagan 1993, *The Limits of Safety*, for the seven mechanisms Perrow accepted.
- Hopkins's page-cite "Perrow (1994, p. 28)" for the "alarmingly banal" quote looks like a typo; check against the primary.

## Entity candidates

- Andrew Hopkins — person — author of the Tier 2 secondary; safety researcher (Australian mining disasters) who reads NAT critically.
- Charles Perrow — person — subject; 1994 article and 1984 book (existing entity page likely).
- Todd La Porte — person — HRT co-founder, 1994 rejoinder co-author (existing entity page).
- Karlene Roberts — person — HRT founder; Hopkins cites her 1989 review, "his constructs are loosely coupled to his illustrations".
- Gene Rochlin — person — co-author of La Porte & Rochlin 1994.
- Paula Consolini — person — co-author with La Porte 1991, "nested authority structures".
- Scott Sagan — person — *The Limits of Safety* (1993) applied NAT to nuclear command; his seven mechanisms.
- Karl Weick — person — cited by La Porte 1996 as a source for the HRO description.
- James Reason — person — Hopkins's proposed alternative (active and latent failures).
- Barry Turner — person — Hopkins's alternative (misinformation, *Man-Made Disasters* 1978).
- Diane Vaughan — person — Challenger analysis Hopkins calls generalisable.
- Garbage Can Theory (Cohen, March & Olsen) — concept — Perrow's 1994 device for sharpening NAT.
- nested authority structures — concept — HRT's answer to the centralisation/decentralisation contradiction.
- component failure accident vs system accident — term — Perrow's distinction limiting NAT's scope.
- Journal of Contingencies and Crisis Management 1994 symposium — term — venue of the Perrow–La Porte exchange.