The Field Guide › Paper
The paper that reframed safety as a problem of dynamic control across an entire socio-technical system, and the origin of the 'migration to the boundary' model that underlies drift-into-failure and much of contemporary systems safety. Rasmussen argues that the traditional approach, decomposing a system into levels (legislators, regulators, company management, staff, the work itself) each studied by a separate discipline, and modelling behaviour as sequences of tasks and 'errors', cannot explain modern large-scale accidents. Rules are, in practice, never followed to the letter; 'human error' is largely an artefact of choosing a normative task description as the reference, so that after any accident it is easy to find someone who deviated from a procedure and expose them to blame. Instead he proposes a control-theoretic, closed-loop view built on functional abstraction: model the boundaries of safe operation and the mechanisms that shape behaviour, not the deviations. The central image is a space of possible behaviour bounded on three sides, by economic failure, by unacceptable workload, and by the boundary of functionally acceptable (safe) performance. Under a gradient toward least effort and constant management pressure toward cost-efficiency, everyday adaptive behaviour (a kind of Brownian motion of local optimisations) migrates systematically toward the safety boundary. Because defences are redundant, a single violation has no visible effect, so under sustained cost pressure the defence-in-depth degrades silently until an entirely normal variation releases an accident that was, in effect, waiting for its trigger: removing one 'root cause' merely means another releases it later. The prescription is not to fight deviations but to make the boundaries of safe operation visible and to help people develop the skill to work near them. The relevance to psychological safety and to the human-and-organisational-performance tradition this corpus draws on is deep. Rasmussen supplies the systemic, anti-blame account of failure (later developed by Dekker as drift into failure and echoed in the work-as-imagined versus work-as-done distinction) in which safety depends on whether the people closest to the boundary can see it, name their proximity to it, report the near-misses, and raise concern about the slow migration before it is crossed, exactly the disclosure that psychological safety governs. His framing in terms of boundaries, gradients, and adaptive behaviour drawn from Gibson's ecological psychology also resonates directly with the ecological vocabulary running through this map.