What Safety-II Isn’t

Last summer, a White Paper was released on a different way of thinking about safety: Safety-II. For me, Safety-II is no less than a paradigm shift in safety, bringing together various strands of thought, by various different people, that have unfolded for some time. The juxtaposition of Safety-I and Safety-II has provided a way of comparing two ways of looking and thinking about safety and systems which have different implications.

The Safety-II perspective, developed and spearheaded by Prof. Erik Hollnagel, has taken up a lot of my time over last 12 months. I’ve been increasingly involved in the further development and implementation of Safety-II thinking, including a lot of discussion with many groups in aviation and other industries, in person and via correspondence and  social media. Over the course of this time, I’ve come to an understanding of what Safety-II is, and also what it isn’t. I thought it might be worth a brief tour of – for me at least – ‘What Safety-II isn’t’, including some of the myths and misconceptions that I’ve encountered:

Safety-II isn’t about looking only at success or the positive

This is perhaps the most common misconception. Safety-II isn’t just about looking at successful performance. It is about this, but not just this. Safety-II is about all possible outcomes: involving normal, everyday, routine performance; exceptionally good performance: and near-misses accidents and disasters (see White Paper; Page 25, Fig 17). Our traditional approach, Safety-I, has largely limited itself to the latter – the accidents (actual or potential) at the tail end of the distribution. Safety-II is about the whole distribution, and its profile. But we normally ignore ‘normal performance’. To improve system performance, we need to focus more on normal performance and frequent events, which are easier to change and manage.

Safety-II isn’t a fad

Safety-II is built on a substantial theoretical foundation. Unlike many populist management fads, it is not a money-spinning package or trade-marked commercialism. It is built on decades of research and practice in safety, human factors and – over the past ten years – resilience engineering. Because it is not a fad, it will not disappear like a fad. Several major organisations and even regulators are starting to embrace the core ideas.

Safety-II isn’t ‘just theory’

While Safety-II isn’t an atheoretical fad, it isn’t ‘just theory’ either. Theory often has a bad name in business, partly because some do not understand what theory is, confusing it with a hypothesis or idea, along with a kind of anti-intellectualism or anti-innovation mindset that rejects new thinking. Safety-II does comprise theory – on performance variability, trade-offs, emergence, etc (and if didn’t, then it should be discarded immediately) – and unapologetically so: as the saying goes, there is nothing so practical as a good theory. Theory – of systems, people, and time – provides a way of explaining and making sense of the world. Without theory, we’re lost.

Safety-II isn’t the end of Safety-I

Safety-I has evolved over decades, and it would be very foolish to blindly discard practices based on Safety-I assumptions. Safety-I and Safety-II are complementary, and “Many of the existing practices can therefore continue to be used, although possibly with a different emphasis” (EUROCONTROL, 2013). But we must take the time to think through the core assumptions of Safety-I (focus on failure, causality credo, human as hazard, bimodality of outcomes and decomposability of systems), and the extent to which they are valid with respect to the systems and situations in which we work. This does not necessarily mean abandoning practices that are founded on these assumptions, but perhaps modifying them and including new types of practice (but not ‘best practice’).

Safety-II isn’t about ‘best practice’

In a complex system, there is no such thing as ‘best practice’, except perhaps practice that is best at a certain time in a certain context – the best that could reasonably be done given the demand, resources and constraints. The best practice we can hope for is contextual practice – practice that fits the context.

Safety-II isn’t what ‘we already do’

I have heard, several times, people say “Oh, yes, we already do that!”, having just been exposed to Safety-II thinking (perhaps a short presentation or a few pages of reading). “We already do that” often acts as a defensive shield to protect an existing paradigm, method or approach that is deep-rooted, cherished, and perhaps profitable. Often, “We already do that” practices are not really consistent with Safety-II thinking, though they may well be very useful and even progressive. But “We already do that” acts as a thought-stopper and prevents reflection about just exactly what it is that we already do, and – perhaps more to the point – why we do it.

Safety-II isn’t ‘them and us’

Safety-II isn’t about separating people into two camps. It is not about ‘Safety-I people’ and ‘Safety-II people’. I have spent much of my career to date in Safety-I contexts. Safety-II does, however, invite us to reflect on our core assumptions about people and systems. While people may prefer to identify more with one set of assumptions than another, the chances are that what we think aspects of both have validity in different contexts. How we combine aspects of Safety-I and Safety-II is a practical issue that we must address.

Safety-II isn’t just about safety

Safety-II is about safety, but not just safety. It is, for me at least, actually about effectiveness. Safety has always been a hard sell to management. It can even be a hard sell at the front-line level. Constant talk of accidents and disasters (actual or potential) and prevention of these does not chime with everyday goal-oriented work. Safety-I proposes a sort of anti-goal – accident prevention – and investments decisions in safety on this basis are difficult. Safety-II is more naturally aligned with business and front-line operational goals that emphasise effectiveness. And effectiveness – doing the right things right – is surely what it is all about.