THEORY-144: Under steady cost and effort pressure, an organization's activity migrates toward the boundary of acceptable performance, and redundant defences erode unobserved because a breach of one shows no effect, so that major accidents arise from many locally reasonable decisions rather than from coincident errors

Source

Rasmussen (1997), LIT-743, read in NOTE-584.

What was actually shown

Rasmussen (LIT-743) argues from investigations of major accidents and from a model of adaptive behaviour.

• The pattern. The court and investigation reports from Bhopal, Flixborough, Zeebrügge and Chernobyl show “a systematic migration of organisational behaviour toward accident under the influence of pressure toward cost-effectiveness”. They do not show a coincidence of independent failures. At Zeebrügge, decisions in separate departments, each sensible locally, together prepared the capsize, and one act released it.
• The mechanism. Work leaves degrees of freedom that actors close by adaptive search. Management supplies a cost gradient and the work an effort gradient, and activity moves toward the boundary of acceptable performance.
• Why it is invisible. Under defence in depth, breaching one defence “has no immediate, visible effect”. One actor’s safe boundary depends on what other actors have breached, so the defences “degenerate systematically through time”.
• The consequence for control. Widening margins invites adaptation that uses them up, and safety campaigns only work as a permanent counter-pressure. Rasmussen proposes making the boundaries visible.

What this does not say

• Not that individuals are blameless or that errors do not occur. The claim is that error-centred analysis misses the shaping mechanism.
• Not quantitative. The gradients and boundaries are a functional description, not measured fields.
• Not shown in organizations that did not have accidents. The evidence is reconstructions of failures, so drift may be over-represented.

Connections

• Viability (THEORY-134). The work space bounded by constraints is an informal viability set, and migration is a trajectory heading for its edge. Rasmussen’s remedy, making the boundary visible, amounts to letting the actors see where the viability kernel ends.
• Resilience (THEORY-132). Eroded margins are lost resilience in Holling’s sense: the system looks the same and fails under a smaller shock.
• The owner’s essay. It gives §6 an empirical mechanism of precariousness, and a contrast for Northstar. Drift erodes a routine regime’s margins through ordinary optimisation, while protective lock-in reproduces an emergency regime. Both degrade viability, by different routes.