In September 2013, a White Paper was released by EUROCONTROL on a different way of thinking about safety: Safety-II. For me, Safety-II is no less than a paradigm shift in safety, bringing together various strands of thought, by various different people, that have unfolded for some time. The juxtaposition of Safety-I and Safety-II has provided a way of comparing two ways of looking and thinking about safety and systems which have different implications.
The Safety-II perspective, developed and spearheaded by Prof. Erik Hollnagel, has taken up a lot of my time over last 12 months. I’ve been increasingly involved in the further development and implementation of Safety-II thinking, including a lot of discussion with many groups in aviation and other industries, in person and via correspondence and social media. Over the course of this time, I’ve come to an understanding of what Safety-II is, and also what it isn’t. I thought it might be worth a brief tour of – for me at least – ‘What Safety-II isn’t’, including some of the myths and misconceptions that I’ve encountered.
Safety-II isn’t about looking only at success or the positive
This is perhaps the most common misconception. Safety-II isn’t just about looking at successful performance. It is about this, but not just this. Safety-II is about all possible outcomes: involving normal, everyday, routine performance; exceptionally good performance: and near-misses accidents and disasters (see White Paper; Page 25, Fig 17). Our traditional approach, Safety-I, has largely limited itself to the latter – the accidents (actual or potential) at the tail end of the distribution. Safety-II is about the whole distribution, and its profile. But we normally ignore ‘normal performance’. To improve system performance, we need to focus more on normal performance and frequent events, which are easier to change and manage.
Safety-II isn’t a fad
Safety-II is built on a substantial theoretical foundation. Unlike many populist management fads, it is not a money-spinning package or trade-marked commercialism. It is built on decades of research and practice in safety, human factors and – over the past ten years – resilience engineering. Because it is not a fad, it will not disappear like a fad. Several major organisations and even regulators are starting to embrace the core ideas.
Safety-II isn’t ‘just theory’
While Safety-II isn’t an atheoretical fad, it isn’t ‘just theory’ either. Theory often has a bad name in business, partly because some do not understand what theory is, confusing it with a hypothesis or idea, along with a kind of anti-intellectualism or anti-innovation mindset that rejects new thinking. Safety-II does comprise theory – on performance variability, trade-offs, emergence, etc (and if didn’t, then it should be discarded immediately) – and unapologetically so: as the saying goes, there is nothing so practical as a good theory. Theory – of systems, people, and time – provides a way of explaining and making sense of the world. Without theory, we’re lost.
Safety-II isn’t the end of Safety-I
Safety-I has evolved over decades, and it would be very foolish to blindly discard practices based on Safety-I assumptions. Safety-I and Safety-II are complementary, and “Many of the existing practices can therefore continue to be used, although possibly with a different emphasis” (EUROCONTROL, 2013). But we must take the time to think through the core assumptions of Safety-I (focus on failure, causality credo, human as hazard, bimodality of outcomes and decomposability of systems), and the extent to which they are valid with respect to the systems and situations in which we work. This does not necessarily mean abandoning practices that are founded on these assumptions, but perhaps modifying them and including new types of practice (but not ‘best practice’).
Safety-II isn’t about ‘best practice’
In a complex system, there is no such thing as ‘best practice’, except perhaps practice that is best at a certain time in a certain context – the best that could reasonably be done given the demand, resources and constraints. The best practice we can hope for is contextual practice – practice that fits the context.
Safety-II isn’t what ‘we already do’
I have heard, several times, people say “Oh, yes, we already do that!”, having just been exposed to Safety-II thinking (perhaps a short presentation or a few pages of reading). “We already do that” often acts as a defensive shield to protect an existing paradigm, method or approach that is deep-rooted, cherished, and perhaps profitable. Often, “We already do that” practices are not really consistent with Safety-II thinking, though they may well be very useful and even progressive. But “We already do that” acts as a thought-stopper and prevents reflection about just exactly what it is that we already do, and – perhaps more to the point – why we do it.
Safety-II isn’t ‘them and us’
Safety-II isn’t about separating people into two camps. It is not about ‘Safety-I people’ and ‘Safety-II people’. I have spent much of my career to date in Safety-I contexts. Safety-II does, however, invite us to reflect on our core assumptions about people and systems. While people may prefer to identify more with one set of assumptions than another, the chances are that what we think aspects of both have validity in different contexts. How we combine aspects of Safety-I and Safety-II is a practical issue that we must address.
Safety-II isn’t just about safety
Safety-II is about safety, but not just safety. It is, for me at least, actually about effectiveness. Safety has always been a hard sell to management. It can even be a hard sell at the front-line level. Constant talk of accidents and disasters (actual or potential) and prevention of these does not chime with everyday goal-oriented work. Safety-I proposes a sort of anti-goal – accident prevention – and investments decisions in safety on this basis are difficult. Safety-II is more naturally aligned with business and front-line operational goals that emphasise effectiveness. And effectiveness – doing the right things right – is surely what it is all about.
Thanks for the post Steven. My first reaction was a sigh of relief actually in that I am not thinking that Safety-II is something that it isn’t. The most relevant statement to me though is the one – ‘Safety-II isn’t about safety’. I have long believed that ‘safety’ is merely a vehicle for improving operational performance and management. I have found in companies that are strong on safety that its not as hard to sell safety as long as it isn’t sold as just a safety solution but a business solution which improves performance for example. Those companies then see improvements in safety performance as a by-product of effective operational management.
Great article. Some very sound and valid arguments. As I reflect on your arguments I recognise that safety encompasses models of prevention and consequence from multidisciplinary streams and informs this into social mandate to apply these informed models into practice through regulation. But it is more than this as it in itself a democratic social anchoring process which works with the political and social context of an organisation or system – there is no such thing as best practice. It is about an evolutionary and adaptive informed application, which is open to the creativity and innovation of its people to achieve meaningful outcomes. The paradigm shift for an organisation to collectively shift towards a resilience stage is centred around health and safety being embedded into its democratic process, to open up the feedbacks loops between the interrelated and interconnected part of the system and its people to establish a sense of trust and social empathy and ultimately resilient outcomes.
Safety has always been a hard sell to management and to front-line workers because, as Karl Weick put forward, Safety is a dynamic non-event. Non-events are taken for granted. When people see nothing, they presume that nothing is happening and that nothing will continue to happen if they continue to act as before.
I’m now looking at Safety from a complexity science perspective as something that emerges when system agents interact. An example is aroma emerging when hot water interacts with dry coffee grinds. Emergence is a real world phenomenon that System Thinking does not address.
Safety-I and Safety-II do not create safety but provide the conditions for Safety to dynamically emerge. But as a non-event, it’s invisible and people see nothing.
Just as safety can emerge, so can danger as an invisible non-event. What we see is failure (e.g., accident, injury, fatality) when the tipping point is reached.
We can also reach a tipping point when we do much of a good thing. Safety rules are valuable but if a worker is overwhelmed by too many, danger in terms of confusion, distraction can emerge.
I see great promise in advancing the Safety-II paradigm to understand what are the right things people should be doing under varying conditions to enable safety to emerge.
Gary, apologies if I might have misunderstood your response. However I’ve heard emergence discussed in great detail within the context of systems thinking and in papers that predate the ‘Safety II’ paradigm by several decades. Are you possibly suggesting that systems thinking has failed to explain (mechanistically) the process of emergence in complex systems? I would be interested to learn more about how Safety II might address this gap. My (novice) understanding of the functional resonance analogy used by Hollnagel is that it really it is only an analogy (rather than explanatory theory) to model interactions and human performance variability using familiar concepts from signal detection theory.
A popular way of distinguishing Systems Thinking from Complexity is that ST is where “the whole is equal to the sum of its parts.” Reductionism applies – we can take things apart, analyze and fix separately, and then put them all back together. In Complexity Science, “the whole is greater than the sum of its parts.” New things emerge due to relationships and interactions amongst the parts that ST does not deal with well or chooses to ignore.
Typically Safety-I creates the conditions for safety or danger to emerge. Safety-II acknowledges the need to make adjustments due to unplanned conditions that emerge.
Erik Hollnagel’s FRAM can help understand why an accident occurred. I’m more interested in the proactive stance re how can a person detect an emerging dangerous situation and pull the operating point back from the edge of failure. Obviously being mentally and physically alert is imperative. We can also apply weak signal detection concepts such as mechanical and human sensors to heightened one’s state of awareness of the present.
Safety-I is big on collecting stories on near-miss incidents. The Safety-II comparative would be collecting stores on workarounds that led to getting the job done successfully and safely by adjusting performance behaviour. The key learning is what was done differently. Crucial conversations take place when front-liners explain their “Work as done” process to the “Work as imagined” designer/planner. Improvement emerges if a better solution can be mutually developed.
I believe this is where Safety Professionals acting as dialogue facilitators can make a huge difference. Spend more time here in Safety-II dialogically rather than in Safety-I diagnostically.
Hi Gary, I’ve just spotted this comment ((several years later) and thought it should be noted that systems thinking is strictly not what you describe. In fact, it is always associated with holism, interactions and to some degree emergence (to some degree only because the tactical utility is often unclear), by every major author in systems thinking. Central to a ystems thinking is that the whole is greater than the sum of its parts. This is clear throughout ‘Systems Thinkers’ by Ramage and Shipp, but also I’m individual works by Meadows, Ackoff, etc. in fact Ackoff talks about this in some of his talks, stressing that systems thinking is the antithesis of reductionism. So what you describe as complexity is actually what every systems thinker thinks of systems thinking.
Hi, Steven. Thanks for bringing this to my attention. You are correct – I did mix things up amongst Reductionism, Systems Thinking, and Complexity. Reductionism is “the whole is equal to the sum of its parts.” Both ST and Complexity recognize the whole is greater due to relationships, interactions and phenomena like emergence, feedback, self-organization.
I am aware there are those who think complexity comes under the ST umbrella. I’m from a camp who believes a complexity approach goes beyond ST and with it, the opportunity to change the safety paradigm. Here are some ST v Complexity differences I have learned: engineering v evolutionary metaphor, define ideal future state v evolve potential of the present, shared values v parables, pursue goals directly v adjacent possible, system drivers v modulators, causality v dispositionality, inductive v abductive reasoning, outcome targets v impact measures, adapting v enabling exaptation, rules v heuristics.
Steven,
I read this post shortly after you’d posted it on this site, but got sidetracked by something else. In re-reading it, I find that I still agree with all of it. In the last paragraph you said “Safety-II is about safety, but not just safety. It is, for me at least, actually about effectiveness.” I would modify that to say that it’s about companies making more money, which you call effectiveness. Having done Safety II investigations before the term existed (I’ve been a student of Dekker, Hollnagel and others as this term emerged), and working with Todd Conklin in the Department of Energy 15 years ago as we introduced Human Performance to DOE, I’ve come to understand that it’s less about safety, and more about reducing waste. If you can generate less waste for the same amount of expenditures, profit margins increase. This makes more sense to busy executives who are worried about the bottom line for their business. And make no mistake, they are the customers for Safety II, not the safety department. I often ask these company leaders what they would do differently if they didn’t have a Safety Department. While this makes safety professionals uneasy, it’s a pretty good exercise. It reinforces your assertion that Safety II doesn’t displace Safety I, it complements it. You still need safety professionals, but you really need to think differently about what makes you successful and what makes you fail.
I think any person trying to help companies think differently needs to keep your argument in the back of their head to be able to counter the natural resistance to Safety II thinking.
Nice job,
Bill Rigot
There is a book named as “Quality-I is Safety-II: The Integration of TWo Management Systems” issued in 2016 where the overall concept of Safety-I and Safety-II is elaborated. I do believe that you can find a lot of explanations there…
P.S. The book is written by me and it is issued by CRC Press. The meaning of this post is not sef-promotion! 🙂
Thanks for the post, Sasho. But I think the price of your book is something high (even despite the fall of the Sterling pound). Could be tomorrow…