Drift to failure
Drift to failure is the gradual migration of a socio-technical system toward the boundaries of safe operation, driven by the continuous pressure to increase production efficiency and reduce costs. The concept was developed by Danish engineer and cognitive systems theorist Jens Rasmussen, who showed that organizations do not fail because they suddenly abandon safety; they fail because they slowly, incrementally, and invisibly erode the safety margins that once separated them from catastrophe.
The drift is not a consequence of negligence or malice. It is a consequence of rational local optimization. Every individual decision to increase production, cut costs, or relax a standard is rational from the perspective of the person making it. The operator who bypasses a procedure to meet a deadline is responding to production pressure. The manager who reduces maintenance staff is responding to budget pressure. The regulator who relaxes a standard is responding to political pressure. Each decision is small, each gain is real, and each erosion is invisible. The system drifts toward failure one rational decision at a time.
The Dynamics of Drift
Rasmussen modeled the drift as a dynamic process in which an organization operates within a space bounded by three constraints: economic viability, workload manageability, and safety. Under normal conditions, the organization maintains a comfortable margin from all three boundaries. But under competitive or production pressure, the operating point migrates toward the economic boundary. The migration is gradual because each small step is justified by the success of the previous step: we reduced maintenance last year and nothing bad happened, so we can reduce it a little more this year.
The critical feature of drift is that it is self-legitimizing. The absence of accidents after a safety margin has been reduced is taken as evidence that the margin was excessive, not as evidence that the system has been lucky. This is the logical fallacy that drives drift: past safety is treated as proof of future safety, and the safety margin is reinterpreted as waste. The result is a system that operates closer to the boundary with every production cycle, until a perturbation that would have been absorbed by the original margin triggers catastrophe.
The Space Shuttle Challenger disaster (1986) is the canonical case of drift to failure. The O-ring seals that failed had been performing with partial degradation for years. Each successful launch with partial degradation was taken as evidence that the seals were safe, and the safety margin was gradually eroded. The disaster did not occur because the seals failed on that particular day; it occurred because the system had drifted so close to the boundary that any significant deviation — cold weather, in this case — was sufficient to trigger failure.
Drift and Organizational Culture
Drift to failure is not merely a physical process; it is a cultural process. The gradual normalization of increasingly risky behavior is a form of organizational learning — but it is learning in the wrong direction. The organization learns that shortcuts are safe, that procedures are overly conservative, and that the people who enforce safety are obstacles to productivity. This learning is reinforced by success: every production target met, every deadline achieved, every cost reduction realized is a reward for the drift.
James Reason's Swiss cheese model of accidents captures the structure of drift: each layer of defense has holes, and the holes migrate over time. The drift is the migration of holes toward alignment. When the holes in successive layers align, an accident occurs. The alignment is not random; it is the result of systemic pressure that pushes holes in the same direction — toward the boundary of acceptable risk.
The countermeasure to drift is not more rules but more feedback. A system that drifts is a system that has lost the feedback loops that would detect the drift. The operators know that the procedures are unrealistic, but their knowledge does not reach the managers who design the procedures. The managers know that the budgets are tight, but their knowledge does not reach the regulators who set the standards. The drift is a failure of information flow, not a failure of individual judgment.
Drift and Resilience Engineering
The resilience engineering community, led by David Woods and Erik Hollnagel, has reframed drift to failure as the central problem of safety in complex adaptive systems. Where traditional safety science asks what went wrong? and seeks to eliminate error, resilience engineering asks what goes right? and seeks to understand how systems maintain safety under pressure. The drift is not a deviation from safety; it is the normal behavior of systems under production pressure. Safety is not a state to be achieved but a process to be maintained — a continuous negotiation between the system's need for production and its need for survival.
The resilience engineering response to drift is to create feedback loops that make the drift visible. This includes the monitoring of leading indicators (near-misses, workarounds, procedural deviations) rather than lagging indicators (accidents, injuries, fatalities). It includes the cultivation of high reliability organization practices: preoccupation with failure, reluctance to simplify, sensitivity to operations, commitment to resilience, and deference to expertise. And it includes the structural design of safety margins that cannot be eroded by local optimization — margins that are enforced by independent oversight, not by the same agents who benefit from their erosion.
Drift to failure is the normal behavior of systems under pressure. The question is not whether drift occurs but whether the system possesses the feedback mechanisms to detect it and the authority to arrest it. Most systems do not. Most systems are designed to drift until they fail, and then to blame the failure on the last person who touched the system. This is not accident causation; it is accident theater.