Jens Rasmussen (1997), Safety Science 27(2–3):183–213 — DOI-10.1016/S0925-7535(97)00052-0
Key takeaways
- Accidents are not coincidences. Court reports from Bhopal, Flixborough, Zeebrügge and Chernobyl show “a systematic migration of organisational behaviour toward accident under the influence of pressure toward cost-effectiveness in an aggressive, competitive environment” (pp. 8–9). At Zeebrügge, decision makers in different parts of one company, each optimising locally, “prepar[ed] the stage”, and a single act released it.
- Migration toward the boundary (Figure 3). Actors search freely within a work space bounded by administrative, functional and safety constraints. Management supplies a cost gradient and work itself an effort gradient. The result is “a systematic migration toward the boundary of functionally acceptable performance”.
- Defence in depth erodes itself. When defences are redundant, “a local violation of one of the defences has no immediate, visible effect”. Under cost pressure the defences “are likely to degenerate systematically through time”. Accidents are then “actually waiting for [their] release”.
- Control, not error removal. Risk management is a closed-loop control problem across all levels of the sociotechnical system. For each hazard one asks who the controllers are, their objectives, their information on the actual state, their competence and their commitment.
- What helps. Widening margins invites adaptation that consumes them, and safety campaigns must push forever against the cost gradient. The most promising approach is “an explicit identification of the boundaries of safe operation together with efforts to make these boundaries visible to the actors”.
Standing in the record
Filed on 2026-10-05 at the owner’s request, as a supplement to the essay on organizational will. It is the organizational counterpart of a shrinking viability kernel, from the same domain as the essay’s Northstar case. Its mechanism differs from Northstar’s lock-in. Northstar’s protective regime reproduces the emergency that justifies it, while Rasmussen’s drift comes from routine optimisation eroding margins nobody sees. The account is THEORY-144.