Efficiency pressure erodes safety boundaries
Aliases: ETTO principle · safety-margin erosion · production pressure
What it is
Under pressure from output targets, cost, and schedule, organizations narrow checks, buffers, and standby capacity to keep production going. Hollnagel calls this the efficiency–thoroughness trade-off (ETTO principle): the same time and resources spent making a task thorough cannot simultaneously be spent making it fast — the two cannot both be maximized. Efficiency pressure erodes the safety margin that has already been thinning out before an accident, rather than crossing one visible forbidden line in a single decision.
Why it happens
Rasmussen's boundary model draws the system's operating space as a region bounded by three edges: an economic-failure boundary (overspend, loss), an unacceptable-workload boundary, and a safety boundary (functional failure). Sustained cost and schedule pressure from management pushes the system away from the economic boundary, and resistance to overload pushes it away from the workload boundary; together, the only direction left to retreat is toward the safety boundary. This is migration toward boundaries.
The migration is called erosion rather than fluctuation because it is one-directional. Economic pressure is present every day, and so is workload pressure, but the safety boundary itself does not push back — it only produces feedback (an anomaly, an accident) once the system actually reaches or crosses it. Short of that, moving closer to the boundary looks like improvement (cheaper, faster), and there is no symmetric force pulling the system back toward the middle.
The ETTO principle explains why the trade-off looks reasonable in each individual decision. The payoff from thoroughness — one more check, one more margin of slack — is probabilistic: it guards against a problem that may never materialize, so most of the time it looks wasted. The payoff from efficiency is certain and immediate: finishing on time, using one fewer person, avoiding a shutdown. When one side is "maybe" and the other is "now," efficiency wins almost every single comparison. Erosion is therefore not the result of any one bad decision, but the accumulation of many individually "rational" choices pointing the same direction.
Studying it
Operationalize margin as measurable time series: interval and duration of checks, frequency and duration of bypass use, backlog of deferred maintenance, overtime and staffing ratios. Time-align these variables with production targets, order backlog, and cost-review cycles, and look for a systematic, sustained decline in margin variables around the point where review pressure rises — not just random noise.
Interviews should reconstruct concrete trade-off episodes — who decided to skip which check in a given week, and what the schedule pressure actually was — rather than asking vague attitude questions like "do you think safety matters," which measure attitude, not mechanism. Correlational analysis must rule out common causes such as demand swings or equipment aging that affect both production pressure and safety margin at once, or coincidence gets mistaken for causation.
Where it stops holding
Not every efficiency gain is erosion. Removing a redundant step that carries no real protective function, or replacing manual checking with more reliable automation, can raise both output and safety at once — the test is whether the compressed resource was actually performing a specific protective function, not whether the step count went down.
Genuine emergencies may justify a predefined trade-off (skipping a non-critical confirmation during a rescue), but such exceptions need a stated recovery condition and time limit. Margin must be restored once the situation ends, or the exception itself becomes the new normal and feeds the next round of migration.
Applying it
- Display current maintenance backlog, open anomalies, the list of active bypasses, and staffing-competence margin alongside — not hidden behind — the same interface used for production and schedule decisions.
- For every acceleration made in the name of efficiency, require a written record of which specific defense was compressed, who approved it, when it expires, and how it is restored — not a generic "temporary measure."
- Track cumulative time spent operating close to the boundary, time needed to recover from that state back to normal margin, and near-miss frequency, rather than accident counts alone — accidents are too rare to reveal erosion as it happens.