Rasmussen's legacy: A paradigm change in engineering for safety

- System theory provides a formal foundation for much improved hazard analysis that includes humans as part of the system.
- STAMP, a new model of causation built on Rasmussen's ideas, provides a way to understand accidents in sociotechnical systems.
- Rasmussen's abstraction hierarchy underlies Intent Specifications, which ground specifications on psychological principles.
- Rasmussen's model of human-task mismatch can be used to extend engineering hazard analysis to include human error.

This paper describes three applications of Rasmussen's idea to systems engineering practice. The first is the application of the abstraction hierarchy to engineering specifications, particularly requirements specification. The second is the use of Rasmussen's ideas in safety modeling and analysis to create a new, more powerful type of accident causation model that extends traditional models to better handle human-operated, software-intensive, sociotechnical systems. Because this new model has a formal, mathematical foundation built on systems theory (as was Rasmussen's original model), new modeling and analysis tools become possible. The third application is to engineering hazard analysis. Engineers have traditionally either omitted human from consideration in system hazard analysis or have treated them rather superficially, for example, that they behave randomly. Applying Rasmussen's model of human error to a powerful new hazard analysis technique allows human behavior to be included in engineering hazard analysis.