Draft Posts

Challenges and Opportunities for Resilience Engineering and Safety-II

Resilience engineering and Safety-II have emerged as credible perspectives and approaches to tackle some of the fundamental problems faced by societies, organisations and teams. Building on complexity science, systems theory, human factors engineering, and other established disciplines, the approaches have both strong theoretical and practical validity. But – as with prior disciplines – both come with particular challenges for practitioners, who act in a milieu that is not always conducive to straightforward practical application.

I asked a selection of practitioners in healthcare, web operations and engineering, and aviation for their views on these challenges and opportunities. Each was selected simply based on my awareness of their work and communication on the topics of resilience engineering and Safety-II, especially on social media (e.g., twitter, LinkedIn). Forty people were invited to share their views, and 36 responded. I analysed their responses thematically, resulted in the following preliminary synthesis. The thematic analysis could, of course, have resulted in different categories, but these are hopefully useful to get a sense of the main kinds of challenges and opportunities.

The results were presented in brief at:

Shorrock, S. (2021, June). Invited Keynote: So what should we do? Challenges for resilience engineering and safety-II in practice. Joint initiative – 15th Conference on Naturalistic Decision Making and 9th Symposium on Resilience Engineering. 21-24th June 2021.

The themed responses are presented below (with permission). My thanks to all contributors. The raw data may be subject to a future publication, but are presented here for public view.

Healthcare

  1. Suzette Woodward
  2. Ken Catchpole
  3. Tracey Herlihey
  4. Mark Sujan
  5. Manoj Kumar
  6. Carl Horsley
  7. Matt Scanlon
  8. Satyan Chari
  9. Shelly Jeffcott
  10. Alison Leary
  11. Alastair Williamson
  12. Neil Spenceley
  13. Ben Tipney
  14. Paul Bowie
  15. Mark Johnson

Web Operations and Engineering

  1. John Allspaw
  2. Lorin Hockstein
  3. J Paul Reed
  4. Jessica DeVita
  5. Chad Todd
  6. Thomas Depierre
  7. Ryan Kitchens
  8. Amy Tobey
  9. Jessica Joy Kerr 

Aviation

  1. Sarah Flaherty
  2. Anders Ellerstrand 
  3. Adam Johns
  4. Christina Heuerding
  5. Tom Laursen
  6. Tony Licu
  7. Bogomir Glavan
  8. Raquel Mercedes Martinez 
  9. Phil Bonner
  10. Joerg Leonhardt
  11. Craig Foster
  12. Stephane Deharvengt

Challenges for Resilience Engineering and Safety-II

Conceptual, Explanatory & Communicative (Applied) Challenges

The term ‘resilience’ is often seen as an individual trait

  • Suzette Woodward The word resilience gets misused. Often used to refer to individual resilience (ability to bounce back) rather than the system. This frustrates people as it makes it all about them. 
  • Ken Catchpole Convincing clinicians even to think about systems (rather than just behavior). This is general problem, but specifically for resilience, which is used as the antithesis of ‘burnout’ (ie. the individual ability to put up with terrible systems) and the Orwellian “Resilience Training” (courses marketed to help individuals deal with terrible systems). I was in a grant review committee (a group of clinicians & health services researchers where I’m usually the only HF) where I had to specifically describe (with enthusiasm) what resilience was so as to distinguish it from “individual resilience” and why it was an important idea. After 5-6 years working with this group, they now get the idea of HF, so this relatively new idea is interesting, but definitely still not straightforward for this group. 
  • Manoj Kumar Definitions and understanding of RE. There are significant misconceptions and misunderstandings of concept of RE. Often when the word ‘resilience’ is used in healthcare, focus is on personal resilience which further removes any organisational drive for understanding RE. 
  • Carl Horsley The focus on “personal resilience” during COVID now means that we are almost unable to use anything which uses the concept of ‘resilience”. We have had to work hard to offset this by re-emphasising the systemic nature of the concept. 
  • Alastair Williamson The term “Resilience Engineering” is something new though I sense that this approach with this title may struggle due to current use of ‘personal resilience’ and the idea of sending staff on ‘resilience training’ to manage the demands of work. 

There is limited understanding of the concepts of RE and S-II in general, and their application 

  • Ken Catchpole Getting across the idea that “error” is a slippery term. The narrative is complex, especially in clinical disciplines that see themselves as process/protocol oriented.
  • Manoj Kumar Healthcare organisations do have the capacity and resources to sustain required operations under the varying conditions or stressors but often miss that opportunity because of the poor understanding of concepts and use of RE and its impact on system performance.
  • Carl Horsley Likewise, while RE often focuses on the heroic adaptations of frontline staff to dynamic conditions, we inadvertently cast all adaptation as good rather than understanding that it can be a sign of major system dysfunction. The key is to explore under what conditions variability aids safety and when should we be damping down variability. This original understanding in RE seems to have been lost somewhat.
  • Shelly Jeffcott A lot of Safety II data is talked about as “soft intelligence” which I feel has a kind of derogatory tone to it akin to “soft skills”. It seems that this stuff about how people feel about work and how they may struggle and/or strive in the complex systems that we chuck them in, is treated as randomly collected, anecdotal, and so not actionable, or ultimately meaningful to us.
  • Paul Bowie To some extent I think, like ‘Human Factors’, the terms and understandings are beginning to mutate and take on a life of their own. It’s being conflated with learning from excellence for example. Or people don’t grasp its RE background and the whole take on why things go right and wrong in complex systems – the mindset isn’t quite in the Safety-II lane. So they throw in a bit of the Domino Model or such like and say we can use this to also understand things going right etc
  • Chad Todd Language Use: RE and Safety-II have concepts that my peer groups and executive leadership/management will consider jargon unless they’ve read about RE/Safety-II. Translating the jargon to common terms or defining them during a conversation remains difficult most of the time.
  • Ryan Kitchens The big challenges in my mind are largely cultural (in the business sense of culture). I often have to translate and frame things into terms that people want to hear along the lines of “best practices” and whatnot while the. working to undo those concepts without coming across like I’m insulting people.
  • Adam Johns Engaging stakeholders in appreciating the value of an RE approach when they’re used to a certain language and focus from the safety function.

Conceptual, Explanatory & Communicative (Theoretical) Challenges

Theoretical writings aren’t always helpful

  • Ken Catchpole A lot of the narrative and leadership in this area is also fairly vague, theoretical and somewhat “ivory tower” chin stroking. 
  • Tracey Herlihey The terminology Safety I/II is ambiguous and may have contributed to some misunderstandings, with Safety I often being seen negatively. 
  • Mark Sujan What I call the “credibility crisis”: as Nancy Leveson and others point out, there is no Safety-I, and it appears questionable whether one can lump such a diverse range of theories and approaches together in a reductionist way and label them Safety-I. 
  • Sarah Flaherty There are multiple models/names/approaches that pretty much describe the same thing or at least have the same outcome. The language changes but that’s about all. They all purport to be the one true way, creating almost cult-like movements. Most of these are celebrity academic led, and followers become partisan and quite patronizing towards others who may not have seen the light. 
  • Sarah Flaherty I was talking to a client yesterday who had had a couple of high profile celebrity academics address their senior leadership team as one of their department heads had declared Safety II to be the way forward. His take on it was that they didn’t have a clue about the operational environment in which he was working and felt very patronized by their approach to describing a different way of working.  
  • Sarah Flaherty Many academic theories are not easily understood or easily applied in an operational context. A degree of maturity is required to understand the complexity and many operational people I work with do not have the time or capacity to translate theories into practice. Many organisations are tactical and siloed and struggle to see how these theories can be usefully employed. Some organisations ‘get it’ and will introduce initiatives – but often only in one part of the company that might have a more mature, strategic perspective. 
  • Dominic Furniss This isn’t all positive, e.g. some desire to go straight into Safety-II, taking the view it is a paradigm shift and all the old stuff, now debunked, fits within Safety-I.
  • Dominic Furniss The Safety-I and Safety-II rhetoric sometimes paints a bit of a caricature of Safety-I. But some of this is fundamental and important, e.g. if we take it that Safety-I is about reducing the risk of bad things happening. Some want to throw the baby out with the bath water. Is it better to do Safety-I well than Safety-II badly?
  • Craig Foster Some of the philosophy started to come unstuck – some of the arguments in academia that we saw started to move away from pragmatism. Arguments over whether Resilience is something the organisation does or something it has – to practitioners looking for answers, was just counting angels on a pin head. Some statements by academics appeared symptomatic of Safety-II losing its way for practitioners and disappearing up its own backside.
  • Craig Foster One of the key criticisms I’ve heard about our Safety Strategy is that it’s not ‘pure’ enough for the RE crowd. As it was a corporate strategy and there is only so much you can get away with. I think that’s probably a key point for me, the ideas of Safety-II and RE need interpretation for industry to make them pragmatic and actionable. The academia-practitioner divide is too great.

Methodological (Applied) Challenges

The practical application of RE and S-II is opaque or difficult

  • Ken Catchpole I think there’s a big gap between the ‘idea’ of resilience, and the real challenges of application in practice.
  • Ken Catchpole Safety II has penetrated quite quickly, but there’s still a lot of misunderstanding and a big gap between the idea, how it looks, practically in a grant and what it’s going to deliver in terms of generalizable improvements in patient safety.
  • Ken Catchpole Lack of practical examples of resilience – people can get the idea, but how can they use it? What does ‘resilience’ even look like? How can you develop resilience in a system? How can you use resilience approaches to address a specific harm that we’ve just had in the hospital?
  • Ken Catchpole The time and energy required to use something like FRAM doesn’t seem to be all that practical outside of research. In fact, this is a general problem (If the incident analysis happens in week 1, in week 2 we will be defining the action plan/intervention…and week 4 will be the next problem). I removed FRAM from a recent grant because it really confused the reviewers as to what the results would look like and how it would lead to something actionable. (There’s a wider problem here about systems analysis before defining an intervention, but the opacity of Resilience Engineering makes that doubly difficult….while the expertise required makes it difficult to spread/scale…so you end up with a very labour-intensive analysis of one ICU, say, which won’t translate to the other ICU across the street). Systems tools e.g. SEIPS or Usability Heuristics can be used relatively easily, and even approximately (rules of thumb etc). Not so sure that resilience can be.
  • Ken Catchpole So, I guess to summarize I’d say – challenges with getting across the basic idea succinctly (this is relatively easy but takes time); and “rubber on road” challenges – staking your credibility on this new way of thinking is difficult when you’re left with “so what?” or “we haven’t got time to do that”. “but does that tell us we need to do?”
  • Mark Sujan Many Safety-II studies are very strong in their descriptive aspect, but there is as yet little practical guidance for how to move from description to intervention.
  • Tracey Herlihey The models often associated with safety II and resilience engineering are complex and not easily applied – this may create a barrier to adoption.
  • Dominic Furniss How do we know if we have done a Safety-II study well? Some studies use FRAM and their outcomes seems to be finding and fixing problems and reducing risks. Is this then new?
  • Dominic Furniss I think there might be new emphases in Safety-II like complexity, adaptation, performance variability and trade-offs/dilemmas. What defines a proper Safety-II approach?
  • Dominic Furniss Can the fascination with complexity go too far and be unproductive? Jim Reason argued for taking into account distal contributions to incidents, but got to a point where he asked has the pendulum swung too far as we couldn’t control these distal elements. Has the pendulum also swung too far for complexity? Many studies seem to show a simple hierarchy/flow of work-as-understood (prior to study), and then they do a FRAM analysis that looks like a plate of spaghetti to show the new found complexity (after the analysis), but is this always productive?
  • Paul Bowie Clinicians want ‘methods and tools’ i.e. how do we do this in practice?
  • Chad Todd Educating/Extending Safety-II: Once the information is captured of a particular team or teams of what has gone well and their skills highlighted, educating and extending those skills that can be adopted by other teams not involved with that particular part of the engineering organization remains difficult. For example if the infrastructure engineering team captures areas of skills that can be adopted by say the mobile engineering team, how does one do that?
  • Phil Bonner Prevailing Systems Analysis and communication Models such as FRAM are seen as too complex and inadequate from an education viewpoint.
  • Sarah Flaherty Many academic theories are not easily understood or easily applied in an operational context. A degree of maturity is required to understand the complexity and many operational people I work with do not have the time or capacity to translate theories into practice. Many organisations are tactical and siloed and struggle to see how these theories can be usefully employed. Some organisations ‘get it’ and will introduce initiatives – but often only in one part of the company that might have a more mature, strategic perspective.
  • Adam Johns Turning theory into practice around processes and tools like Hollnagel’s resilience potentials, RAG, Woods’ graceful extensibility etc.
  • Tom Laursen I also think that we (I include myself) are a bit arrogant and invest very little time and resources in developing principles, tools and systems that are better, faster and cheaper than what we have today.
  • Bogomir Glavan Implementing a learning culture is tough. Getting employees to take time to deliberately “talk about what went well” naturally is difficult, especially when they see that with a negative connotation. However, this is where we can affect exponential positive change.
  • Raquel Mercedes Martinez Still very difficult to assess (measure) resilient performance. What is the current status of the organization? RE concept goes beyond safety, so should we continue to determine the current status in the organization based solely in safety performance?
  • Raquel Mercedes Martinez Baring in mind the 4 basic abilities in RE, there is still difficulty in the anticipating function. Most organizations have excellent monitoring systems (reporting sytems, indicators, etc) and HRO normally have very robust contingency plans that allow effective response when failures occurs. Learning from both is also an activity which is well developed in most ANSPs’ SMS, but in my opinion it’s harder to find a truly mature and effective anticipating function. An example of such is safety assessment of changes, where there is often difficulty in imagining all that could go wrong.
  • Raquel Mercedes Martinez Regarding Safety II, how can we determine which are those flexible (human) behaviours that help the system bounce back to the expected performance once a mishap has happened? How can we tell them apart from those which are genuinely unwanted?
  • Craig Foster The academic pedigree of the approach shut down many conversations that could have been critical.
  • Craig Foster We needed the methods to back up the approach. We were never going to do FRAM. We observed other organisations doing FRAM arguments when a simple time and motion study would have spotted the same thing. We didn’t see or couldn’t find the added value over the trusted methods.
  • Craig Foster Safety-II ran out of steam a bit when people started struggling to deploy it. There weren’t the use cases of successful deployment (unlike with, I guess, HRO).

There is a lack of evidence of effectiveness

  • Ken Catchpole Lack of evidence-base. I know of no study that suggests adopting resilience approaches would help. Our human factors colleagues love to do studies analysing resilience in systems but not what to do with that information – are there any studies that have successfully used resilience approaches to measurably improve something?
  • Mark Sujan There is an evidence gap for Safety-II, we need a better understanding how and under which circumstances what types of Safety-II approaches / interventions bring about what kinds of changes.
  • Sarah Flaherty Academic models are great for starting conversations but they have taken on a life of their own and are seen as somehow unchallengeable – but they need to be as that how our body of evidence of whether they are effective grows. I hate to be asked whether I’m a Safety I or Safety II person. It’s a facile question.
  • Alastair Williamson I am worried that both terms (S-II and RE) will become tainted in healthcare as they do not follow the scientific mindset of the medical view and Safety-II doesn’t fit with the move for standardisation of work to avoid harm that we struggle with on day-to-day basis.
  • Dominic Furniss Do we have evidence of Safety-II studies in industry that have had a positive impact? I’ve seen practitioners and academics question this. I use language and elements of Safety-II in my Human Factors work. I think many long in the tooth have done so for a long time. Methods can re-emphasise Safety-II elements/language but are all methods compatible, e.g. Bow Ties?
  • Tony Licu Academia lacks access to industry operations to test and validate RE/S-II methods and practices.
  • Craig Foster In an attempt to demonstrate the value of the approach we initiated a number of guerrilla projects to explore the value of these ideas in action. However, in many cases we then struggled to demonstrate the value or the difference or the cost benefit of the approach over what we might have done before. For example, a search for success in normal work, when you are very successful, means that there is lots of data to examine but it is a search for a needle in a haystack made of needles. What is really important? What drives success?

There are false equivalences in organisations

  • Suzette Woodward Learning from excellence- positive reporting is also being used as a way to look at what people do well. Again missing the systems issues. 
  • Shelly Jeffcott The other thing that I think is relevant is that Learning from Excellence has somewhat muddied the waters. To many it is synonymous with Safety II or additional learning from “what went well” (I know the latter is not a correct reflection of what Safety II is about, but it is often captured in that way in healthcare). The upshot is that if you have an LfE or “Greatix” incident reporting system – mostly brief online proformas that generate certificates sent to individuals or teams – then you are covering off on Safety II somehow. But LfE is not Safety II to me. That is primarily because is not, unfortunately, a learning tool (in most all cases). It can be very helpful as a recognition tool and has been shown to boost morale and an assets-based perspective, but it doesn’t capture those events that are rich in describing how we take the same set of conditions and turn them to success instead of failure, for example. We have a new “Greatix” system in SAS with over 1000 events. This is just since November 2020 so that shows you the appetite. I made sure they added an explicit learning question and ended up agreeing to make in a non-mandatory field, which was just as well as only about 10% of people have even tried to fill it in and, where if they do, it says things like “be kind” and “praise counts.” I also argued against calling it Greatix which is in direct opposition to the Datix system in people’s heads and invariably keeps this as a system about individuals and not about system conditions. That is, you blame someone on Datix and then you praise someone else on Greatix. But neither seems to be particularly considering or learning from the situational or contextual conditions that either actor (or sometimes teams) found themselves in. 

There are entrenched and conflicting legacy approaches

  • Carl Horsley There remain some challenges imposed by the approaches to safety arising from New Public Management ie. safety as reliability, auditing as “control of the control structures”, a focus on metrics etc. We are now approaching a time where new models of governance will come and RE is better placed to align with these (ie New Public Governance) 
  • Mark Sujan Related to this, Safety-I approaches are attractive due to their clear link between risk and risk control, which is a simplification of a complex matter, but this simplification is its appeal, whereas for Safety-II there are no such simplistic / reductionist interventions, and this can make it very hard for practitioners to get their heads round. 
  • Manoj Kumar Resources are often wasted on reactive systems and processes with little attention given on how systems perform under varying conditions. Complex problems are often reduced to ‘leadership’ soundbites and cliches.  
  • Ryan Kitchens There is also a really strong dogma in tech to derive metrics from incidents. There isn’t the recognition how this drops context and intentionally narrows and filters our perspective about what we’re learning from incidents. I view this itself as a risk. A problem added onto that is incident analysis looks immensely time consuming in comparison to an industry fixated on fast-moving innovation. 
  • Ryan Kitchens At larger companies, centralization plays an interesting role. There are typically standards and generally applicable technologies that are expected to be used or are blessed in a way to be appropriate. So what you have is a set of experts who people are looking to for guidance. However, the centralized teams can never account for every permutation of every individual team’s problems. A lot of that guidance becomes not in fact generally applicable because it never gets implemented and the centralized teams hesitate to fill the gap because it deviates from their perceived standard. Maybe this is just arguing against “best practices” thinking again. 
  • Christina Heuerding It still depends on individual people, on your manager/boss and colleagues in which way safety is seen. The systems themselves are pretty much incident-numbers driven, safety I. We invest lots of time in investigating incidents and doing bureaucratic work, from many incidents there is nothing to learn but they have to be investigated and cost lots of resources in safety management. 
  • Joerg Leonhardt Most Safety Management Systems are still locked in the traditional approaches to Safety. The proactively Safety Surveys are in most cases still driven by the ideas of auditing the processes and look for what went wrong or deviations from procedure. 
  • Joerg Leonhardt Data available in SMS is based on records from past events, e.g. voluntary reports or incidents. The data is not connected and every event stands for its own. A systemic approach to understand the system performance is lacking. 
  • Joerg Leonhardt We could conclude that there are methods developed to apply S 2 and RE principles and to get different insight and understanding of systems performance. But the application in practice requires a change in how SMS is set up, how the SMS is managed, how strong a Safety Manager is to make inconvenient decisions, how good a regulator understands the benefits of S 2. When the whole SMS makes the change in thinking and practicing than there is a chance to improve S 2 in practice 

Paradigmatic Challenges

The dominant paradigm, collective mindset or common focus is a barrier

  • Suzette Woodward The key issue isn’t the concept of safety II. People like it. The problem is how do we do it. I have shared Jessica Mesman’s work (studying the mundane) which goes down well. However in health they prefer having a ‘failure’ to trigger a review of the functioning system. So they are still waiting for failure rather than studying the system to see how it functions ok / well.
  • Alison Leary I think the biggest challenge in healthcare is a shift to Safety II-we are still very firmly embedded in Safety I, counting harms, root cause analysis, linear cause and effect. Opportunities are there at organisational level.
  • Alastair Williamson I am worried that both terms (S-II and RE) will become tainted in healthcare as they do not follow the scientific mindset of the medical view and Safety-II doesn’t fit with the move for standardisation of work to avoid harm that we struggle with on day-to-day basis.
  • Neil Spenceley Key challenge in healthcare for the introduction of S-II is the long standing embedded culture of pouncing on things that go wrong, identifying the proximity of a healthcare worker to that particular issue, and therefore the cause, which is followed by fear. And then of course it never happens again but it was never going to happen again hence the institutional intervention was a triumph…and repeat.
  • Neil Spenceley I think the increasing complexity of healthcare is a huge issue. It’s so unknown and yet we try to control it more and more and therefore trying to introduce the idea of looking at something that is silent is very difficult. Covid has been helpful in a number of ways in that if you remove a few layers of cheese you improve adaptability and it has shown the genuine resource of humans which needs to be harnessed although there does need to be some corralling of people which comes down to the common purpose. You can feel some of the constraint coming back in however. It’s also taught us that prediction is dead and safety per se has had its day. I think the thing that it’s showed us that needs to be safe is the two way feedback mechanisms allowing an environment to speak with candour (Duty of Candour however is a disaster…) My sense is that the patient doesn’t come first, it’s the staff but the common purpose is enhanced patient care/outcome. Again, anathema to many.
  • Matt Scanlon First, despite my great respect for the seminal work of Fitts and Jones related to understanding how ‘pilot error’ was simply systems failure, I am struck by how often aviation mishaps are still blamed on pilot error. In all fairness, aviation is way ahead of healthcare as evidenced by the redesign work in response to Fitts’ work, and the work of groups like EUROCONTROL.
  • Matt Scanlon Second, working in a pediatric intensive care unit, David Wood’s dragons or the surprises that threaten safety are a regular occurrence. Yet healthcare (and perhaps aviation) is focused on treating these like events with clear “root causes” that can be stamped out.
  • Satyan Chari I have been reflecting a lot more these days on whether Safety II can ever become fully mainstreamed. By this, I mean whether Safety II can systemically embed itself in healthcare rather than carving a long-term niche for itself. I see some critical challenges in making this transition. Healthcare’s last great transformation in safety in the mid-90s was precipitated not just by the Harvard malpractice studies but also by the breathtaking speed with which the newly founded IHI produced literature on what healthcare safety management systems must look like, what their functions must be – and through the advocacy of groups like the IHI, the US patient safety act was enacted into law within a decade. We tend to forget that before the early 90s, most doctors would baulk at the idea of hospital-acquired harm (very Safety 0)! Most western health systems manage safety and quality under very similar legislative, accreditation and operational frameworks. Unfortunately, this wider context within which safety work is done in healthcare is fundamentally aligned to Safety I and at this (structural) level there is little Safety II on display.
  • Ben Tipney In sport, when performance falls to poor/below average levels, rarely is anyone killed or seriously injured. One therefore has the luxury of focusing attention on moments where you feel the opportunity for learning is greatest, as opposed to be dictated by the severity of outcome. The reality of course in risk industries where death/serious injury can occur as a result of poor performance, the impact (on various levels – physically, emotionally, financially etc) on those involved is huge, and as such, realistically we are unlikely to get away from a disproportionate amount of time spent analysing ‘failure’.
  • Ben Tipney Where work is fairly routine/controllable/linear in nature, somewhere between ‘simple’ and ‘complicated’. (https://suzettewoodward.org/2020/10/19/complex-adaptive-systems/), perhaps this is less of a problem – indeed could it be argued that Aviation has made huge strides in safety through adopting a SI approach to analysing incidents and applying risk control methods? My exposure to aviation (through family and colleagues) is through flight ops personnel, and using the ‘Models of Safety’ proposed by Charles Vincent/Rene Amalberti (https://link.springer.com/chapter/10.1007/978-3-319-25559-0_3), it seems that much of the work is done using an ‘Ultra-Safe’ approach of designing error out of the system through standardisation (equipment, training, SOPs etc) – an approach made possible by the relatively low levels of day to day variance, making a SI approach effective.
  • Ben Tipney The key question for aviation as I see would be; where is the work sufficiently complex to warrant a SII/RE approach, and do the people making decisions about safety recognise that complexity? Crucially, being able to differentiate being complicated and complex work. In an industry where such strides have been made using a SI approach, a challenge will be motivating those who have been involved in such improvements to seek a different approach. And perhaps to some extent they might be right – is SII/RE warranted in all aspects of aviation? Is the work becoming more complex over time as flight paths become busier (covid recovery pending of course), or is it potentially becoming less complex for operators due to increasing levels of automation?
  • John Allspaw What Hollnagel has described as habituation continues to be a fundamental challenge for making progress with S-II and RE. It remains difficult to direct people’s attention to how normal work is done; if there is no “incident” to mark activities for deeper exploration, why look at it — that’s just how it was supposed to happen!
  • John Allspaw The 2nd AI winter cannot come soon enough. The emperor’s clothes worn by Machine Learning™ (and its relatives) do appear to arouse some suspicion, but the fantastical promises of magical problem-solving still seem to have a grip on mainstream thinking and businesses.
  • Lorin Hochstein Unwavering faith in automation. We’re a field that builds automation, so there’s a belief that all problems can be solved with automation, and that we can eventually automate the human out of the loop.
  • Lorin Hochstein Don’t see the people in the system. There’s a real absence of recognizing the “socio” in socio-technical systems. There’s a humanistic element that’s generally missing from my field. (You’ll hear a lot of talk about the value of “culture”, but you won’t see many cultural anthropologists being hired). In-depth studying of work is rare.
  • Thomas Depierre Software has eaten the world. Healthcare, Aviation,… Software and in particular internet delivered Software is now essential to life critical practices. Yet, the way software is designed, written and operated has not yet assimilated this fact. This is both an immense need for RE and/or S-II work to navigate these complex systems and their impact, but also a massive challenge.
  • Thomas Depierre The recent ransomware attacks on healthcare providers have barely made a ripple. After all, the people doing *this* software knows that they are playing with people life right? Right? RIGHT?
  • Thomas Depierre How do you bring the idea of safety to a field that fundamentally believe they are already building a safer world and that most of their work is not going to affect anyone life.
  • J Paul Reed Dispelling some of the firmly held notions about safety which are, in fact, harming people
  • Chad Todd Focus on Safety-I: There are very few firms that focus on the idea of Safety-II of looking at what goes well during normal operations and turbulent situations. Especially during a post-incident analysis of a software incident the main focus is on what goes or went wrong, which is small when compared to all that goes right all the time. Once folks ‘feel’ like they understand what went wrong (linear of course) they go design/fix one thing versus all that went right during the incident.
  • Chad Todd The overall challenge, which is an opportunity for raising the bar with RE/Safety-II within WebOps, is drowning the old (current) habits that exist for much more rich, lucrative, and qualitative habits for all layers of the organization through adopting RE/Safety-II practically, which remains difficult.
  • Amy Tobey The biggest challenge with rolling these ideas out in practice is probably the same as other industries. Even though we are young, we still struggle with old-world thinking in our organizations. While software systems tend to be very malleable, the organizational structures that beget them are still often rigid and this presents challenges familiar to any practitioner of resilience engineering.
  • Adam Johns Engaging stakeholders in appreciating the value of an RE approach when they’re used to a certain language and focus from the safety function.
  • Christina Heuerding It still depends on individual people, on your manager/boss and colleagues in which way safety is seen. The systems themselves are pretty much incident-numbers driven, safety I. We invest lots of time in investigating incidents and doing bureaucratic work, from many incidents there is nothing to learn but they have to be investigated and cost lots of resources in safety management.
  • Phil Bonner An organisational faith in ‘safety by SOP’ which has come from our traditional close bond with Civil aviation. To my mind however an Aer Lingus pilots work is far less variable and complex than many of our roles. It is almost impossible to have a Taylorist approach to the diversity of our many roles. This faith has permeated throughout the age ranges so that any change to the status quo is looked upon with suspicion.
  • Phil Bonner The prevailing cause and effect thinking that we have worked so hard since 1999 to foster is hard to shake. Models such as Heinrich’s law and especially Reasons Swiss Cheese are well known throughout the Air Corps. It has taken many years for people to be confident in them and they tend to try and address any identified latent threat with additional SOPs. Similar Safety II models are not well known and it takes a significant effort to change our attitudes.
  • Phil Bonner As the organisation has such faith in SOP, the crews are unwilling to openly admit to bending or breaking the rules.
  • Bogomir Glavan It takes some time to let go of the Safety I security and familiarity and fully embrace Safety II. As an anecdotal reference, we found it took about 6 months for us as full-time LIT (Safety II) observers to change our mindset from the engrained LOSA (Safety I) perspective.
  • Tony Licu Lack of proper structured curricula in universities – they are a handful of establishments teaching RE/Safety-II/System thinking. The graduates they come out with the classical risk management and safety-I approach. System thinking/RE should be in the curricula of all technical and Ergonomics/HF faculties (I think is also an opportunity to bring that in- more and more academics are attracted by the theory of RE/Safety-II).
  • Stephane Deharvengt RE and Safety II methods can be at odds with compliance in an over-regulated environment such as aviation. Search for 100% compliance and endless corrective actions, producing new compliance issues, is exhausting resources and discouraging. Room must be made for experimenting and trusting professionals’ expertise in a controlled manner.
  • Stephane Deharvengt Engineers tend to simplify and decompose problems to develop solutions. Complexity doesn’t sell well but reality is messy. So even safety people tend to rely on simple models of the world that cannot capture human performance and adaptation capabilities.

Organisational Challenges

The need is not evident or the value is unclear

  • Manoj Kumar Unknown unknowns. Perhaps one of the biggest challenges (or threats) when it comes to concepts of resilience engineering is how do you persuade people of the unknown unknowns. They don’t know what they don’t know and hesitate to embrace change as they do not see a problem. 
  • Lorin Hochstein Providing value that can’t be directly measured. It’s hard to justify resilience engineering type work. Many people simply don’t see the value. You need to have a champion in management that “gets” it to justify getting additional resources to do that work. And if your champion leaves, you’re out of luck. 
  • Jessica Joy Kerr In software, a challenge is that the system is hidden from us, it’s not physical. However, when we can change the software we can add visibility, inject clues for ourselves. Because of this, Software has potential to let us learn how to work with complex systems. 
  • Chad Todd Skills vs Engineering: Folks in WebOps “take for granted” their skills that help keep the socio-technical systems running and those skills go unrealized and are under-appreciated by executive/management leadership. Engineering is the mindset where folks go right to the design or resolve mindset without fully appreciating the skills during say a high consequence/high tempo situation that they pulled the system out of a dire situation. 
  • Jessica DeVita Workers involved in an accident have been referred to as a “second victim”, and I wonder if safety practitioners might be something of a third victim. Last year I worked on an investigation that was very disturbing and I didn’t realize how much I was affected by it. As a result, I think it’s critical for safety practitioners to think about self-care. We spend our days asking others how they’re doing, what they experienced, what their needs are, but rarely does anyone ask us how we’re doing. Please take care of yourselves! 
  • Anders Ellerstrand Overall, I think that the big problem with new ideas like RE and Safety-II is that they are not regulatory requirements. And there is, in most cases, not a problem with safety. So, ANSP managers focus on what is actually a problem – costs and capacity. Managing safety is more about ticking boxes and keeping the regulator happy. And there are no boxes to tick when it comes to RE or Safety-II… 
  • Anders Ellerstrand A challenge for resilience could be the requirements of greater efficiency with ATM. You have the RPs [reference periods] that everyone is struggling with. One way to try and achieve those is to remove the ‘slack’. But, aviation is so complex that I don’t believe you can control all elements well enough and if you remove all slack you take a risk. What is saving the day many times is NM [the Network Manager, EUROCONTROL] and the possibility to regulate traffic with rather short notice. In my experience, regulating the traffic is the most used mitigation to a row of hazards. Of course, regulations are not popular at all with airlines and passengers. A bit of slack can manage that, but of course slack is expensive… 
  • Anders Ellerstrand The challenge with Safety-II is that you very rarely do what we did – assess the work in position, although there was no change planned and no safety incident. For some time, the managers were increasingly aware of the drift and at one point decided that they could not pretend not knowing about it anymore. It was very insightful to investigate it before acting. Insightful and unusual I believe. 
  • Phil Bonner We need to orient our culture toward Safety II without breaking away from Safety I completely. This takes time and evidence of success elsewhere in order for senior leadership to truly buy into it. 
  • Tom Laursen Organisations need to comply with all kinds of rules and regulation, both self created and created by the overall system (ICAO, EASA, Eurocontrol, CAAs, IFATCA, IFALPA, etc.). We should discuss the way forward and reflect on ways to include the principles in what we do today. 
  • Christina Heuerding For me as a safety practitioner in aviation our safety world is moving towards safety II / RE, but I often find it by far too slow.  
  • Tony Licu Resistance from management and in general organisations for various reasons – takes them out of comfort zone, they haven’t seen many practical examples around, they are waiting to see first success elsewhere, are from a different school of thought – Safety-I – or simply they lack a champion to lead implementation of RE/Safety-II inside the company, or they seen it advertised by the people in which they do not believe they will be successful in bringing into practice.  
  • Tony Licu Too much pressure to meet regulatory requirements and no space/resources left to invest in RE/Safety-Lack of educated resources. 
  • Tony Licu Some senior leaders haven’t read a book recently and if they read will not be about RE/S-II (sorry to be blunt on this). 
  • Joerg Leonhardt It’s not about missing methods or having enough time, its about the willingness for change and priorisation. 
  • Craig Foster Philosophies like HRO at least are normative and provide some direction and examples of organisations that you could aspire to be. Without true examples of Safety-II organisations I think we struggled to ‘sell’ the idea of how we could be on the basis of a comparison to someone else. Nancy’s critique of Safety-II did strike a chord for me and others who read it also liked it. I agree there is a tension between engineering mindsets and the cognitive and social sciences.

There is a lack of resources (competency, time, money)

  • Shelly Jeffcott Within NHS Scotland the main issue remains how do we support different learning processes and collection of intelligence on a range of events. We don’t even resource the adverse events stuff well enough, and no one seems to have the capacity or any real sense of how we should start collecting non-traditional or normal operations information.
  • Shelly Jeffcott Certainly, the whole near miss and good catch space remains elusive. And if we are talking specifically about resilience, then the instances where harm is avoided – in complex circumstances where harm is almost routine or expected – because of planned or unplanned intervention, then this is the place that I want to focus on and try to learn from. But no one has the time or energy to invest in a new system, and we can’t seem to change the culture of use around DATIX to capture any of this. Although last year I found out that DATIX is supposed to be an incident and near miss reporting system…ha, who knew?! It is mostly, as you know, just a place where people making obligatory reports when there has been a harm event of some kind to patients or staff. But there is usually minimal info provided as people see it as a tick-box, waste of time, potentially incriminating exercise. Which is such a sad indictment.
  • Alastair Williamson The challenge is how we facilitate this [learning] being captured – I sense that is where we are not good at either due to capacity to do it or time to do it. The pandemic has identified the importance in resilience to deliver care in a rapidly evolving situation and some organisations have captured that to learn. We need more teams/organisations to recognise the value of doing this especially if this is focussed around the resilience potentials of responding, monitoring, learning and anticipating. If an organisation recognises the value of developing these potentials then there are enormous opportunities for that team/organisation to deliver safer care.
  • Mark Johnson Healthcare is still struggling in its adoption of the principles of RE and Safety 2. High level people will tell you they get it, but the system is designed in such a way that it demands you always favour efficiency over thoroughness. Cultural messaging from senior people in meetings is always along the lines of “well that’s all well and good but we have to work with what we’ve got and we have to deliver this”. My thoughts are “well that’s okay of course and that could be described as a normal constraint” but then there is a risk they will still seek to blame someone if it all goes wrong instead of saying at the outset, “we know we are rushing you and we are crossing our fingers that nothing bad happens but be assured if it does we will recognise the constraints this placed you under at the time!”
  • J Paul Reed Funding (both time and money)
  • Adam Johns Finding the capacity to apply RE practices against other demands around more traditional safety management demands (safety work vs. safety of work).
  • Tom Laursen I think that the biggest challenge is that Resilience (let’s call it that) is a knowledge driven concept and it relies very much on know-how and expertise. You need well educated experts to be able to benefit from the principles. This clashes with a reductionist and capitalist world that hungers for easy fixes. Most organisations have little time for education and reflection.
  • Joerg Leonhardt Resources in SMS are scarce and often occupied with paperwork, e.g. filling data bases, writing survey reports, working on complaints from the community regarding noise or flight routes. All what we tried to get Safety Manager involved in pro-active Safety or S 2 methods failed not by the interest and willingness from local safety people, but by the ability from management to allocate the right resources for the right task.
  • Craig Foster Where are we now… back doing the day job but still fighting the good fight for a different way of thinking about safety. Some key people have gone and others have moved on to other roles with less scope for action than before. More pressing concerns have got in the way. For us, when we said that we were running out of things to count it gave us a lever, unfortunately, they came back. Although in February this year we did indeed have 0 Risk Assessment Tool points for the first time ever.

Opportunities for Resilience Engineering and Safety-II

Conceptual & Communicative Opportunities

RE and S-II offer a better explanation of the world

  • Carl Horsley The major opportunity is that RE is a coherent approach to safety that ties in well with ideas like psychological safety, HFE work design, relational ways of working, the valuing of expertise. Rather than introducing a “new view” it seems much more like it is a better explanation of the world as found, reflecting the realities of complexity and emergence that exist in work areas like healthcare. 
  • Manoj Kumar Complexity (both a challenge and also an opportunity) 
  • Neil Spenceley We’ve changed the way we do things here in that we do focus on success a lot more and make sure we have a spectrum of S-I/S-II thinking. It’s interesting trying to make people think of an incident with a S-I eye but then think about why has it never happened before and why was the outcome of this arrest was actually very favourable. It’s gently trying to ensure or generate the idea that most days are boring for a reason and the way we subtly and subconsciously finesse the system is a min by min exercise performed by them despite the system. Nobody is recognising this constant source of data. 
  • Neil Spenceley I think one of the most important questions to start asking in our unit is ‘Today, why did nothing happen..?’ There, used to be, 1.3 million healthcare workers with 1 million patient encounters every day in the NHS and yet, most of the time, it’s silently successful. Amazing. 
  • Neil Spenceley That said it’s very interesting working in Paediatric Intensive Care as it’s a very rich source of S-II. I think it’s because there’s very little evidence for what we do, no two patients are the same (weight, disease, physiology etc) and the amount of invasive kit we have compared to adults is far less. And yet our outcomes are amazing. This is partly due to the fact that children on the whole are fairly bombproof but I’m sure some of it is due to the adaptability / free range that we have. I remember having a long chat with a guy called Peter van Manen who at the time was CEO of the electronics wing of McLaren F1 Team (visiting the base was a good day out…). He was quite invested in Paeds ICU monitoring. I said it puzzled me that this was the case because adults had so many more patients, more kit, more data etc. He replied that that was exactly why he looked at paediatrics because we didn’t have so much to go on so we had to think outside the box and the results were mostly very successful. But why…? 
  • Matt Scanlon I think the greatest untapped opportunity is the adaptability of people. Whether it’s Sully’s response to the Flight 1549 events or the way my colleagues can act to save a child’s life in response to sudden deterioration, our collective industries don’t honor and learn from these adaptations in a systematic process. 
  • Matt Scanlon Finally, healthcare (and perhaps aviation) does not systematically acknowledge and address Hollnagel’s four capabilities of a resilient system. While I believe there are numerous pockets of resilience in healthcare, I am saddened that while we reward responding, we fail to systematically learn, monitor and anticipate in our daily work. 
  • Ben Tipney Where work is highly complex and adaptive performance is required due to highly fluid, dynamic and unpredictable work (often done in uncontrollable environments), such as community healthcare or military activity in war zones, high performance is only possible through constant review of plans/performance and adapting as new information comes in – meaning a SII approach is the only way to achieve consistently high performance. Almost all of my work currently is done in healthcare – where the type of work varies hugely and is often highly complex, thus necessitating a flexible approach to safety that requires an overarching SII mindset. 
  • Ben Tipney Coming from a background in coaching high performance sport, one of the most striking commonalities with consistently outstanding individuals/teams is a relentless attitude to improvement – that is an approach to learning that is independent of outcome. My understanding of the essence of RE/SII is exactly this – an approach to improvement that takes a broad view across the spectrum of work, from poor/below average, though to excellence and crucially, including ‘normal work’. The great opportunity of taking this approach is having a more accurate picture of the gaps between work as done/imagined/prescribed/disclosed, and subsequently to develop improvement strategies that address the realities of how work is done day to day. 
  • Paul Bowie Clinicians are intrigued by the concept which they find intuitively attractive and kinder on the workforce. 
  • John Allspaw A double-edged sword opportunity: incidents involving online services continue and are growing in their scale and impact. While this is obviously not good, these surprising events do (well, sometimes) help debunk the age-old notion that “just a little more automation” is the key to robustness and resilience. 
  • Lorin Hochstein We don’t have the baggage of the traditional safety-critical fields. There’s no “Safety-I” that we are reacting to. 
  • J Paul Reed There are, obviously, a lot of benefits to this work, but as I do more of this it, the one I find myself appreciating the most: it offers an almost-privileged view into how our complex world really operates: how folks really go about doing their work, the tradeoffs they make, how technical, “failsafe” systems are anything but, and generally a front row seat to the amazingness of it all! 
  • Sarah Flaherty More holistic multi-disciplinary approach understanding that there is no one size fits all. 
  • Tony Licu The industry has become so complex that needs it now more than in the past.
  • Bogomir Glavan At American Airlines we have been emphasizing that Safety II does not replace Safety I or traditional safety, they complement each other. Pilots who embrace and know a proven Safety I model will have to see what Safety II can bring to the table to hit the “I believe button” by seeing what it can do for them.  
  • Craig Foster Where we have had success is in the challenge to the prevailing mindset. I’d say this is more of a systems thinking approach. But we certainly challenge our world view more than we did. For example, we are pushing a time-to-conflict measure of safety risk because of all that work that was done at the time on systems thinking, measures & targets and Safety-II. That would not have come about without that work. It presents a different perspective on the same thing. We get a lot of resistance, but it is something different and that’s a key take-away.

RE and S-II ideas are understood, appreciated and talked about 

  • Carl Horsley Frontline staff intrinsically understand the ideas and we have seen major links to staff wellbeing and engagement, key areas that are problematic in healthcare currently. 
  • Alastair Williamson For me, a New View around Safety is being talked about in healthcare and Safety-2 and Work-as-Done vs Work-as-Imagined plus other archetypes are talked more widely helped by discussions amongst healthcare professionals and safety experts/practitioners both within the sector and outside. 
  • Satyan Chari I agree with your core premise that Safety II and RE have undeniably emerged as a credible and important perspective to address many of the issues we have struggled to shift, and healthcare is no different. We have (in Queensland) been experiencing some success in taking the Safety II/RE ‘message’ to a vast array of colleagues across clinical practice, safety, governance, and operations – many of whom have found value in the insights on offer, some of whom have been writing up their work for peer review. 
  • Satyan Chari One of the aborted Bridge Lab priorities from last year was to (take a leaf out of the IHI playbook and) facilitate a forum with the Queensland coroner, the Australian safety and quality accreditation body, the health ombudsman, healthcare safety and quality leaders, clinicians and consumers to unpack what a systemic shift to a Safety II paradigm might look like, what the commonalities and divergences might be – and then to produce a consensus statement on meaningful (structural) changes we could work towards. We planned to do this with the Safety Science Innovation Lab at Griffith but ended up shelving the priority for logistical reasons (but hope to pursue in the coming year). 
  • Manoj Kumar There is significant potential within healthcare organisations to get to the “Systems of the fourth kind” (Hollnagel) as we do have the required elements, capacity and resources to get there. Greater understanding of RE in healthcare is needed. NHS is a large organisation and employer. New generation of staff are becoming more aware – thanks to understanding of HFE. Opportunity to target and embed these understandings into training is there and is slowly happening. There’s growing awareness of opportunities to learn from everyday work rather than solely on terminal events. 
  • Dominic Furniss Safety-II has made a good contribution by sparking thought and curiosity around safety – there are different ways of going about this and it opens the conversation.
  • John Allspaw There are some faint indications that my domain is beginning to shift their perspective that people, not technology, are the only adaptive element in the system. More engineers are becoming curious about fundamental topics surrounding cognitive work; they’re reading and sharing their interpretations and reflections with each other. This is encouraging, but this momentum is not guaranteed to continue. The “early adopters” of these perspectives will need to continue making an effort. 
  • Chad Todd Growth in Language Use: WebOps has a lot of practical growth to do with RE/Safety-II when it comes to understanding the language at the various layers (front-line, mid-level management, and executives) of an organization. Converting the jargon of concepts to common language for folks will create common ground that will allow RE/Safety-II to go into practice. 
  • Amy Tobey For me, the most striking thing about introducing resilience engineering and Safety-II concepts in software engineering is how quickly some folks pick it up. In particular, folks at the sharp end of web operations seem to understand concepts like stretched systems and adaptive capacity intuitively. Teaching these ideas to my peers is like giving them a new superpower, finally a way to communicate clearly about things they already knew. 
  • Lorin Hochstein Culture of sharing experiences. The practitioners in our field are very open about discussing their work. You can see it in blogs and on twitter. We have conferences that SREConf and LISA. In particular, companies generally do not consider the infrastructure/operations work to be proprietary, so we can talk pretty openly about practices. 
  • Sarah Flaherty We need to reclaim language and the narrative. No one group gets to decide what is ‘right’. 
  • Sarah Flaherty We actually should be more philosophically agnostic if we want to better serve the industries we work in. And more critical and curious – when did we stop thinking and challenging? 
  • Bogomir Glavan Refining the language already established to fit the organization and operating style makes the transition smoother. 
  • Bogomir Glavan Crews love to talk about what they did and how they overcome challenges. These “Shop Talk” sessions are a gold mine of data and insight on how crews think and act. 
  • Bogomir Glavan Eventually, you need to put a stake in the ground and move forward with your own language and model, what works for your organization may not be verbatim from the textbooks and academics. That’s ok – there is no one size fits all solution and you need to consider your own unique goals and structure. 
  • Raquel Mercedes Martinez RE is a concept that goes far beyond safety but that, if in practice, will ensure safety. Thus by incorporating the concept in different areas of the organization one can take other areas of the business aboard in ensuring safety. 
  • Raquel Mercedes Martinez Safety-II concept is very powerful to build a safety culture among staff. I always talk about the concept with all new operational staff that join FerroNATS and I can see that they instantly fall for it. If able to implement practical (and perceptible) safety-II measures and activities, an organization’s SMS will gain credibility and safety culture will improve. 
  • Tony Licu The COVID19 crisis has bring the word resilience on the lips of everyone (including all politicians) 
  • Tony Licu The theory of RE/ST/S-II is very attractive and can get a lot of traction (though the challenge will be to deliver on it inside an organisation that bought into the concept). 
  • Tony Licu The concept speaks easily to staff at front end. 
  • Craig Foster Safety-II and RE generated a huge amount of energy and excitement in what is generally a very dry discipline that isn’t used to innovation. Safety is inherently conservative – change must be controlled etc. Safety-II and RE shook things up and challenged the existing paradigm.
  • Craig Foster The EUROCONTROL Safety-II seminars were key mechanisms to expose safety specialists to the latest thinking and an academic-supported view on the future of safety management. They generated enthusiasm in the company and industry but also some scepticism (we’ve done this before, we do this already). When they stopped things started dying down. But by then the original evangelists were paying to hear the old hits from the masters rather than any new material.

Methodological Opportunities

Practical opportunities to learn and move toward a better understanding of work

  • Suzette Woodward The latest patient safety incident response framework which replaces the serious incident framework is moving away from root cause analysis and other linear methodologies. Which is a significant step in the right direction. 
  • Tracey Herlihey Recognition that learning from patient safety incidents is important, but other opportunities to learn and improve exist, potentially with fewer barriers 
  • Alastair Williamson There are real opportunities for healthcare to understand ‘work’ and the variability of work within a complex socio-technical system using these approaches so that we start to recognise more that how safety and clinical care is delivered depends on the actions of HCPs making those positive interventions to make care safer in an imperfect system.  
  • Satyan Chari As I also sit on a board level committee, I see a real pressing need to tackle the big questions as to how we might redesign the systems and structures that we use to manage safety and quality in healthcare to allow Safety II approaches to more naturally emerge and permeate all aspects of safety work. We need to re-evaluate how our clinical safety systems operate, how our governance models have been formulated, how we undertake accreditation for services. I believe now is the time to start building a flexible framework and toolkit (self-assessments, transition management tools, readiness checklists etc) to help organisations attempt more methodical transitions from the conventional to the contemporary thinking in this space. 
  • Paul Bowie My response to that is we can already practice it largely by speaking to colleagues, reflecting and learning together about how work is really done and making small changes to enhance system resilience.  In addition, we advocate the following: 1) Dynamic risk assessment (when completing tasks, observing and assessing the working environment to identify hazards and minimise risks to support performance); 2) Team learning from events (while encouraging normal work situations to be reflected on, we also advocate asking How and why does it normally go well (when looking at safety incidents)?; 3) Using the culture cards and/or STEW (systems thinking) cards to better understand the safety features of everyday work; 4) Walkthrough analysis (alien concept in healthcare); 5) Informal learning – speaking to people, capturing multiple perspectives, lowering hierarchies etc; 6) Examining and learning from near miss data; 7) Capturing organisational learning by understanding WAD and capturing adaptations/trade-offs etc
  • John Allspaw Relative to other safety-critical domains, the data researchers would want or need to effectively study cognitive work in rich ways is abundant, to put it mildly. The pandemic has only amplified what data can be available, since teams working remotely with each other is mediated by software. Even the most basic features of current video conferencing, chat, and other collaboration tools include recording and/or logging actions taken and utterances made by participants, at millisecond granularity. Collecting these externalizations for analysis historically was not possible without expensive audio and video recording gear, and if they weren’t set up or recording a given exchange, it was simply missed. The tools used for transcription and analysis have also dramatically improved what researchers have available to them. 
  • Thomas Depierre The tools provided to the people trying to write and understand these systems to make them better are a huge area for interest to anyone wanting to do CSE work…  
  • Jessica Joy Kerr In software, a challenge is that the system is hidden from us, it’s not physical. However, when we can change the software we can add visibility, inject clues for ourselves. Because of this, Software has potential to let us learn how to work with complex systems. 
  • Christina Heuerding When your manager supports you in safety II / resilience there is a great chance to look at different “cases” or non-events and get a new view. 
  • Christina Heuerding In my unit it works quite well meanwhile because of an individually super team: we are able to invest resources in non-events, weak signals, thoughts and sorrows of our controllers; I hope we will be able to continue with that with rising traffic after corona – and we will encounter a lack of personnel. 
  • Christina Heuerding We try to ask our controllers for best practice ideas, lessons learnt and share them in briefings – learning from positive. 
  • Tony Licu The technology has massively evolved so it can support a S-II approach – BI Tools with ML/AI will help dealing with big data (that is the S-II data). 
  • Phil Bonner Our office is continuing to champion Safety II principles. We are rewriting our Safety manual and Safety II will take a prominent roll within it. Recently one of our crews suffered a catastrophic engine failure in their single engine PC9 at FL160 and 22nm from our base. The SOPs did not cater precisely for their situation but they did follow what SOPs they had and successfully conducted a dead stick  glide approach safely back to base. Our investigation of this incident is ongoing however I hope to use their performance internally as a case study in positive performance variability. Aircrew are technical problem solvers and it’s our job to make education relevant, they appreciate case studies (war stories!). So many past case studies are based on learning from tragedy. The mindset needs to change before attitudes and behaviours do.
  • Craig Foster The simplicity of the general ideas ‘we’re running out of things to count’, look for success, all hit home quite easily in a business and industry that believes it is at the forefront of safety management. The philosophical underpinnings made it strong and easier to sell and defend.
  • Craig Foster The ideas of Safety-II and RE (mainly Safety-II) served as an inspiration for some elements of the NATS Safety Strategy – our key vehicle for driving (or attempting to drive) change into all aspects of ‘how’ the business thinks about safety.
  • Craig Foster We embedded some core ideas in the safety strategy that have persisted – people create safety – stolen, unknowingly, from a Charles Vincent book and being a Cummings 3-word phrase – it has stuck and we get traction with that to some extent. It will eventually change the culture, but it’ll take a long time.
  • Craig Foster We have had a number of conversations over the years with other organisations in similar situations. The NHS (twice), Royal Navy, BP and more recently with someone in the Dutch Air Force. The strategy, and the ideas from Safety-II and RE that we tried to embed seem to resonate. Other organisations have taken on the ideas. The Thai ANSP produced key fobs with ‘People Create Safety’ on them. CANSO adopted the NATS strategy in its entirety. It is also used in as a System Safety and Human Factors class tutorial with students and they critique it. I love that. 
  • Craig Foster I really like Jean-Christophe Le Coze’s thinking in this area. He’s published a paper in Safety Science on Safety as Strategy. I highlighted most of it as I was reading it as we could have written it.

Opportunities for usable and practical methods

  • Tracey Herlihey Opportunity to develop simpler models and tools to help think differently about patient safety and how we learn and improve. 
  • Chad Todd Promote Skills and Expertise: WebOps tends to have the organization focus on vanity/proxy metrics without appreciating and focusing on the skills and expertise that resides in the organization. An opportunity is to get the layers of the organization to measure qualitatively the skills and expertise within it and weight it during performance management annual reviews. I’d argue the mid-level management and executives need guidance on how to do that. A cheat sheet perhaps?  
  • Sarah Flaherty Simpler, tangible initiatives to make a sustainable change 
  • Sarah Flaherty Less celebrity academics and models – more operational evidence of effectiveness.  EVIDENTIAL
  • Sarah Flaherty Less infighting and posturing by cultish communities. We all want the same thing. 
  • Tony Licu Some simple techniques have started to emerge (see our Eurocontrol neutralisation of taxonomies etc).  
  • Tom Laursen I think that [developing principles, tools and systems that are better, faster and cheaper than what we have today] could be an angle to gain more acceptance. A good example is Erik’s Safety I/safety II, where he is cutting corners and in many experts’ opinions is a bit superficial. In my opinion the book and the white paper from Eurocontrol is one of the biggest steps we made. In short, the willingness to develop and create easy usable tools and methods is another challenge. 

Organisational Opportunities

Opportunities to develop expertise in RE and S-II

  • Alison Leary Some trusts are appointing psychologists and one is even trying to appoint a CHF specialist but its slow. 
  • Chad Todd Fund a Human Factors and Systems Safety Team or RE/Safety-II Team: Today many if not all organizations has a UX for design team that is a section of human factors. However, there is little weight given to systems safety/RE/Safety-II within WebOps. While talks and papers are good for those willing to listen/read but how does maybe 1-2 persons or 2-4 persons that listen or read about RE/Safety-II able to really make headway with this new found mindset within the organization layers? The opportunity is to fund a small team through an executive sponsorship to focus on moving the concept of RE/Safety-II into practice. This doesn’t say there won’t be difficulties, but this may be the only way to make inroads.  
  • Adam Johns Use RE principles and practices as a vehicle to expand the remit of the safety function to broader operational and organisational goals and activities. 
  • Tony Licu EU start putting money into it – H2020 call on RE. 
  • Tony Licu Work with academia to have embedded in the curricula (also into MBAs curricula) RE/S-II/ST.