Contribution
It moved safety analysis from errors and task sequences to the mechanisms that shape behaviour: constraints, boundaries and the gradients that move activity within them. It also framed risk management as control distributed across government, regulators, companies, managers and operators.
Key insight
Nobody has to make a mistake for an organization to drift into an accident. Everyone adapting sensibly to the pressures they face will move the system toward its boundary, and redundancy hides how close it is.
Assumptions
- Work leaves many degrees of freedom, closed by adaptive search under local criteria (effort, cost, risk, interest).
- Boundaries of acceptable performance exist and can in principle be identified for a given hazard source.
Key results
Conceptual, drawn from accident analyses (Zeebrügge, Bhopal, Flixborough, Chernobyl, and ferry and tanker cases):
- Migration toward the boundary under cost and effort gradients (Figure 3).
- Systematic degeneration of defence in depth under cost pressure.
- The AcciMap: mapping the decision makers whose normal decisions together prepared an accident (Figures 5–6).
- Control requirements per hazard source: objectives, information on the actual state, competence, commitment.
- A taxonomy of hazards by frequency and magnitude, with different management strategies for each (Figure 7).
Claims
| id | claim | strength | support |
|---|---|---|---|
| C1 | Major accidents result from systematic migration, not coincident independent failures | moderate | court and investigation reports of several accidents |
| C2 | Redundant defences erode unobserved under cost pressure | moderate | argued from the structure of defence in depth, with cases |
| C3 | Widening margins invites adaptation that consumes them | moderate | risk-homeostasis findings in traffic, reinterpreted |
| C4 | Making boundaries visible is the most promising approach | weak | argued, not tested |
Concepts
- boundary of acceptable performance — the edge of the work space set by functional, administrative and safety constraints.
- gradient — the steady pressure (cost from management, effort from the work) that moves activity within the space.
- defence in depth — redundant independent protections, whose redundancy hides local breaches.
Connections
Draws on Gibson’s ecological psychology, naturalistic decision making, Wilde’s risk homeostasis and the closed-loop control view of management, and cites Leveson (1995) on predictive risk analysis.
Bearing on the record
Source of THEORY-144. Rasmussen’s work space bounded by constraints is an informal viability set, and his migration is a trajectory heading for the edge of it: THEORY-134 in organizational dress. For the owner’s essay, it supplies an empirical mechanism for §6’s precariousness that the essay currently lacks. It also offers a contrast for Northstar. Drift erodes the margins of a routine regime, while protective lock-in reproduces an emergency regime. Both degrade viability, by different routes.
Limitations
Qualitative and built from accident histories, so it is fitted to failures. It does not show how often drift occurs without an accident. Its remedies are argued, not evaluated.
Open questions
How to locate a boundary before it is crossed in systems that are not tightly coupled, which the paper calls “still a research issue”.