Mind your Mindset: Safety-I and Safety-II

During the last few years, different ways of thinking about safety have challenged prevailing worldviews in safety-related professions. Many of the emerging ideas actually have clear roots in writings going back into the early 1980s (particularly by Jens Rasmussen, Erik Hollnagel and David Woods), and much earlier if we go outside of the safety domain. But the ideas have only gained traction more recently via particular thinkers who have managed to make a broader connection, outside of the bounds of academic journals and conferences. If Kurt Lewin’s epigram “There is nothing more practical than a good theory” (1952, p.169) is true*, then there is little more tragic than a good theory ignored. It appears that safety theory might be helping to rescue safety from over-bureaucratic Safety Management System-isation.

The bitter-sweet binary

As per Marketing 101, the success formula for these new ideas has involved simplification, specifically the binary delineation of a newer way of thinking from an older way of thinking. This was the case with the ‘Old View’ and ‘New View’ of human error (e.g. Sidney Dekker’s popular 2002 ‘Field guide to human error investigations’; now in its third edition as the ‘Field guide to understanding ‘human error” [2014]; see also Erik Hollnagel’s NO View of human error). And we have seen this in the last couple of years with Hollnagel’s ‘Safety-I and ‘Safety-II’ , following several presentations plus the publication of a White Paper and his book.

The emergence of the notion of Safety-II has attracted significant enthusiasm from many who previously felt uninvolved in, or disconnected from, traditional safety management, which is often seen as another management function and ‘something for the safety department’. Various professional associations and industry associations (e.g. in aviation and healthcare) want to know more about Safety-II. It seems to offer a different way of thinking that resonates more closely with their views of the human, human work, and the system – its purpose, structure and behaviour.

What Safety-II does, in my eyes at least, is reconnect safety as something that is studied, assessed, investigated, ‘measured’ and ‘managed’, with safety as something that emerges from the work and the system. (I use the words ‘measured’ and ‘managed’ reservedly – as so many ‘measures’ of safety seem not to reflect the health of the system, and safety as an emergent property cannot be ‘managed’ in the way that most people seem to use the term.)

So far so good. But this development has not been without problems. The separation and comparison of Safety-I and Safety-II has also prompted wringing of hands and gnashing of teeth from some safety management practitioners who feel somehow castigated. This is perhaps an unintended consequence of labelling two views as ‘I’ and ‘II’. But this is a notation that follows several other examples to help clearly distinguish two states of affairs. These include Science 1.0 and Science 2.0 as approaches to science, Mode 1 and Mode 2 in knowledge production, System 1 and System 2 in psychology (in Kahnemann’s Thinking Fast and Slow, redefining and popularising William James’ associative and true reasoning), and Web 1.0 and Web 2.0 in the world wide web.

Buzzwords and bandwagons

The concept of Web 2.0 was reportedly popularised via a conference brainstorming session between O’Reilly and MediaLive International. In an O’Reilly article from 2005 called “What Is Web 2.0“, CEO and President Tim O’ Reilly noted several points about Web 2.0, concerning definition, originality, substance and added value. These seem to resonate with Safety-II.

In its early days, the concept of Web 2.0 attracted scorn as well as enthusiasm. This can also be said of Safety-II (and similarly ‘New View’, and even Theory Y half a century ago [rarely criticised now, except in its more utopian and manipulative forms]). O’Reilly observed that “there’s still a huge amount of disagreement about just what Web 2.0 means, with some people decrying it as a meaningless marketing buzzword, and others accepting it as the new conventional wisdom.” Some have also decried Safety-II as a buzzword (something that has probably been applied at some point to every addition to industry vocabulary that has gained some acceptance), and others have overstated its acceptance. O’Reilly added that “companies are now pasting it on as a marketing buzzword, with no real understanding of just what it means”. Safety-II may also be subject to this sort of zealous hop-on bandwagonery, especially dangerous with scant reading (more commonly associated with scorn; see What are you reading for?).

Like Web 2.0 and Science 2.0, Safety-II, emphasises phenomena such as emergence, adaptation and trust. A key difference, however, is that Web 2.0 (and Science 2.0) was already coming into fruition at a rapid pace when it was ‘called’. The bursting of the dot-com bubble in late 2001, and the emergence of Google, Wikipedia, flickr, Gmail, Google AdSense, BitTorrent, tagging, blogging and participation, redefined what the web was and how it worked. In the case of Safety-II, the redefinition was called before safety management practice had changed. When compared to the web (and most activity), safety management is incredibly conservative. We would have had to wait for a long time in order to call Safety-II on the basis of its observation in the wild. While aspects of Safety-II existed in sundry practice, the more holistic worldview did not, and so there was no significant and coherent shift in practice. Safety-II had to be called in advance of its popular development in order for it to come into existence at all. We are still coming to understand what Safety-II is. O’Reilly noted that Web 1.0 and Web 2.0 do not have hard boundaries, but gravitational cores (see the meme map here). This is probably a useful way of thinking about Safety-I and Safety-II. We will develop a better understanding of these as time goes on.

“Show me the data!”

This ‘early call’ of Safety-II led to an obvious response. Those critical of the notion of Safety-II said, “Show me the proof!” and “There are no methods!”. As a relatively new way of seeing, it is unfair to expect results so quickly, when traditional approaches associated with Safety-I have had generations to demonstrate value (and even so, it is hard to ‘prove’ how Safety-I methods have prevented accidents since that would call on counterfactual reasoning). The question for Safety-II is not anyway, “Does it prevent accidents?”, but “Does it improve effectiveness?”, which means improving work and helping to ensure that things go right. This requires studying ordinary work, modelling the system, being proactive, as well as investigating unwanted events. By and large, many of the methods for that are there already (and have long been) in human factors, ethnography and social science generally (e.g. interviews, focus groups, observation), systems thinking, as well as accident analysis and synthesis.

“It’s nothing new!”

Another cry is that Safety-II was already here; that it already existed in various forms, for instance, in certain types of safety assessment, safety observation schemes, safety investigations, or in other guises in previous academic papers and talks. Again, the writing on Safety-I and Safety-II does not deny that some elements of it are already in place. But what is in place is usually one aspect of Safety-II or a combination of Safety-I and Safety-II, either as an eclectic mix of clearly identifiable elements of both, or as a mayonnaise-eque mélange. Examples include decompositional approaches that also examine success, investigations that also look at what went right, and observation that audits adherence to (what is thought to be) ‘good practice’. These developments often indicate clear progress, but the examples are not usually instantiations of Safety-II, and need not claim to be either. They do not form sets of assumptions about people, work, systems, safety and management, which cluster together as relatively coherent ways of thinking, and therefore acting. It is these sets of assumptions that characterise Safety-I and Safety-II.

The pain of a new idea

Some feel that Safety-II is an affront, or even a threat, and that what they do (which, interestingly enough, is what they think Hollnagel is talking about) has been unfairly characterised. Most of my work has been in Safety-I, so I could feel this too – if I chose to. The writing on Safety-I, however, is about a particular way of thinking about safety characterised by a pattern of common assumptions.

Underlying the more personal reactions are, I believe six personal barriers: Lack of knowledge (of Safety-II, see also here); Fear (of the possible consequences for one’s own practice); Pride (loss of status); Habit (need for change in routines and habits of thought, language and method); Conformity (with others); and Obedience (to superiors and protocol). What are claimed to be technical issues are often more personal.

Walter Bagehot, a British journalist and writer editor-in-chief of The Economist, put it this way in 1869:

“One of the greatest pains to human nature is the pain of a new idea. It is, as common people say, so ‘upsetting;’ it makes you think that, after all, your favourite notions may be wrong, your firmest beliefs ill-founded; it is certain that till now there was no place allotted in your mind to the new and startling inhabitant, and now that it has conquered an entrance you do not at once see which of your old ideas it will or will not turn out, with which of them it can be reconciled, and with which it is at essential enmity.”

Is Safety-II a threat to Safety-I?

Some have expressed concerns that all the good work ‘done by Safety-I’ is at risk of being undone by Safety-II. This, to me, is not a well thought-out claim. For a start, if Safety-I thinking, data, methods and products were so flimsy that they could be blown away so easily by seeing things from an alternative perspective, then they deserve to be. Second, most safety work has been, and will be for a long time, done through the lens of Safety-I. I don’t think that anyone seriously expects a wholesale movement towards the sorts of ideas that Hollnagel and others have expressed. No. 99% (or more) of safety work will continue to be done from a Safety-I perspective for a while yet. So what is the problem? The problem is that any deviation from an established and unquestioned way of thinking, even forming just a 1% contribution, has a personal impact on those invested in a particular mindset. This is reinforced by, and reinforces, personal, social and system barriers to new thinking.

A way of seeing, not the way of seeing

The ‘I’ and ‘II’ notation could be perceived as denoting ‘worse than/better than’ or as an ‘either/or’, but these interpretations are unhelpful. I prefer to see Safety-I and Safety-II as an alternative ways of seeing, understanding and acting (for different purposes and situations). They could equally, at risk of being equated with McGreggor’s Theory X and Y, be ‘Safety X’ and ‘Safety Y ‘ (but not, I think, ‘Safety Plus’ or ‘Positive Safety’, as have been suggested). ‘I’ and ‘II’ does at least indicate chronological order, like Web 1.0 and Web 2.0. It is also, in a sense, a very good marketing tool, as many other terms for the same set of ideas would not have attracted interest.

Of course, in the efforts needed to encourage a new way of thinking, there has to be some clear differentiation. This was the case with the emergence of humanistic psychology, as the ‘third force of psychology’. Humanistic psychology had to express itself not as a subtle evolution of behaviourism or psychoanalysis, but as a very different way of seeing. There also has to be some promotion – some concerted effort to express and spread new thinking.

But we need to resist the idea that one worldview is fundamentally better than another. I would not want to fly on an aeroplane which had not been subject to a thorough Safety-I analysis. But similarly, and increasingly, I would not want to be on the receiving end of a human system or socio-technical system that was designed and managed only from a Safety-I viewpoint. My theory of people, work and systems influences what I want from systems.

Paradigms and ranges of convenience

Kuhn defined a scientific paradigm as: “universally recognized scientific achievements that, for a time, provide model problems and solutions for a community of practitioners“. Safety-II may not be universally recognised but is becoming more so, and can be seen as ‘paradigmatic’ in nature, or at least as an alternative worldview that is becoming, or will become, a collective mindset. This “for a time“-ness is important, as is the set of problems and solutions. The psychologist George Kelly (1955) talked about a ‘range of convenience’ to refer to the range of things or events to which a construct may be applied with maximum predictive efficiency. Humanistic psychologist John Rowan (1973) commented that we use a theory outside that range “at our peril”.

Kelly provided a definition of anxiety that may help to understand the pain of a new idea: “Anxiety is the recognition that events with which one is confronted lie outside the range of convenience of one’s construct system” (Kelly, 1955, p. 495). Some of the phenomena that we observe in the world today – a very different world to that from which traditional safety management emerged – cannot readily be interpreted through a Safety-I lens. We can’t make sense of them, and anxiety results. In a sense, it can seem better not to see – out of pure or wilful ignorance – than to see but not understand…or know what to do. But if our worldview does not help us to make sense of the world, we can look elsewhere.

Transcending paradigms

Paradigms are important – more important than we imagine, because we don’t often question them. Meadows (2009) listed paradigms in her 12 leverage points to intervene in a system. These include, moving toward the most powerful end of the spectrum: … 6. information flows (the structure of who does and does not have access to information); 5. rules (incentives, punishments, constraints); 4. self-organisation (the power to add, change, or evolve system structure); 3. goals (the purpose or function of the system); and 2. paradigms (the mindset pout of which the system — its goals, structure, rules, delays, parameters — arises).

As she refined her ideas, she came upon one leverage point that was greater than paradigms — 1. transcending paradigms. On this, she stated:

“There is yet one leverage point that is even higher than changing a paradigm. That is to keep oneself unattached in the arena of paradigms, to stay flexible, to realize that NO paradigm is “true,” that every one, including the one that sweetly shapes your own worldview, is a tremendously limited understanding of an immense and amazing universe that is far beyond human comprehension. It is to “get” at a gut level the paradigm that there are paradigms, and to see that that itself is a paradigm, and to regard that whole realization as devastatingly funny. It is to let go into Not Knowing, into what the Buddhists call enlightenment.

People who cling to paradigms (which means just about all of us) take one look at the spacious possibility that everything they think is guaranteed to be nonsense and pedal rapidly in the opposite direction. Surely there is no power, no control, no understanding, not even a reason for being, much less acting, in the notion or experience that there is no certainty in any worldview. But, in fact, everyone who has managed to entertain that idea, for a moment or for a lifetime, has found it to be the basis for radical empowerment.

It is in this space of mastery over paradigms that people throw off addictions, live in constant joy, bring down empires, get locked up or burned at the stake or crucified or shot, and have impacts that last for millennia.

There remains a need, then, to stay above different safety worldviews. Firstly, we cannot be certain of any. Secondly, as John Rowan (1973) remarked, “Any theory can be made oppressive”. Theory Y has been subject to manipulative managerialism. Stewart wrote that “one does not have to spend much time in the cubicles these days to appreciate how the jargon of Theory Y has evolved into an Orwellian Newspeak that often serves as cover for the kind of exploitation and manipulation that would make even the most chauvinist X-ist quiver)” (p. 3). While Safety-I conceives of the human as a hazard, Safety-II conceives of the human as a resource; but this view is not immune from manipulation.

Be mindful of your mindset

We need self-awareness to recognise our own mindset, wisdom to see its limits, and mentally agility to choose another when appropriate. This means we have to try to remain unattached. Transcending paradigms allows us to choose a worldview that fits the needs of the situation. Many psychotherapists refuse to stick with one paradigm (psychodynamic, cognitive-behavioural, person-centred, etc), and instead practice integratively or eclectically, depending on the situation, the client’s needs, and the therapist’s preferences and capabilities. In safety, similar sorts of considerations will come into play, including the system under consideration, the needs of stakeholders (e.g. customers, authorities), and the practitioner’s capabilities. For complicated mechanical systems, a Safety-I view may be most appropriate. But as it becomes ever more complex with increasing human interaction, a Safety-II view will be needed, perhaps not instead of but certainly as well as (decomposition of mechanical parts, and of some human-machine interactions, will still be necessary, e.g. for design). The question is, which worldview makes sense given our needs and the demands of the situation? This leads to further questions, such as:

• How can we conceive of the complexity of the system? Is it possible and meaningful to decompose the system? Or is the whole greater than the sum of its parts, with system behaviour emerging from a variable and constantly changing circumstances and interactions?
• What way of understanding the human makes sense? Does it make sense to conceive of the human as a hazard, at least for the needs of the situation? Or is it more meaningful and productive to conceive of the human as a resource?
• To what extent is functioning bimodal? Is it valid to assume that the components of a system are either functioning correctly or malfunctioning, and that this bimodal functioning leads to acceptable and unacceptable outcomes? Or are outcomes best understood as associated with complex patterns of variability arising from everyday work?
• How do we conceive of causation, for this situation? Can we (ethically) conceive of causation as being relatively simple? Or does the complexity of the situation make causal assumptions tenuous?
• What is our safety management principle? Is it acceptable to respond when something happens or is categorised as an unacceptable risk? Or do we need to constantly anticipate developments?
• What outcomes should we focus on? Does it make sense to focus only on unwanted outcomes (e.g. accidents), and try to minimise those? Or do we need to pay attention to ordinary work, and improve all outcomes?
• Practically, what can we do? Do we only have access to documents, system descriptions, accident data, etc, or do we also have access to the real environment and the people who do (or will do) the work? Also, how much time to we have, and what kind of expertise

We then need to be mindful of what we might gain and lose by choosing a particular worldview, and remain curious as to how things might look from the other worldview. Again, for largely technological systems, the decompositional and bimodal functioning assumptions of Safety-I might make most sense. For human and socio-technical systems, these assumptions will usually make less sense (in extemis, consider a football team).

The pragmatist’s perspective

In practice, it may make most sense to be integrative , combining the two ways of thinking in ways that are (hopefully) non-contradictory, or to be eclectic, using what experience tells us will work best in the situation. This is the most likely state of affairs in the medium term. After all, the fast-changing web is, 10 years on, still a mix of Web 1.0 (e.g. mp3s, personal websites, publishing) and Web 2.0 (e.g. music streaming, blogging, participation).

Sometimes, we may have to go with a worldview that we do not really believe in, either because of the demands of the situation (e.g. regulations, customer requirements, safety management system), or because it is a trade-off that is acceptable in the circumstances. We can then at least make our working assumptions more expicit. But where we use a worldview that is clearly outside of its range of convenience, then we do so at our peril.

The point is to remain aware of one’s worldview, unattached in the dogmatic sense, and agile enough to choose the right worldview for the needs of the situation, within its range of convenience. It took her some time to find the most powerful places to intervene in the system, but I think Donella Meadows was right. Paradigms are the most powerful places to intervene in a system. But there is no One True Ring. The world changes, and transcending paradigms allows us to adapt to the changing world.

References

Bagehot, W. (1869). Physics and Politics.

Dekker, S. (2014). A Field guide to understanding ‘human error’. Third edition. Ashgate.

Hollnagel, E. (2014a). Safety-I and Safety-II. The past and future of safety management. Ashgate.

Meadows, D. & Wright. (2009). Thinking in systems: A primer. Routledge.

Rowan, J. (1973). Humanistic psychology and the revolution. Self & Society, 1(6), 1-3.

Stewart, M. (2010) Theories X and Y, revisited. Oxford Leadership Journal, 1(3), June, 1-5.

* Note that Lewin’s epigram has been disputed, e.g. see Sandelands, L. E. (1990). What is so practical about theory? Lewin revisited. Journal for the Theory of Social Behavior, 20 (3), 235-262. http://bit.ly/1KUUC8E