Safety-II and the misleading debate about right and wrong

8 minutes03/01/2021

by Timo Kronlöf

Every year, my colleagues and I ask some of the most forward-thinking minds in occupational health and safety to answer five questions about the current developments in their field. Then we publish the results in our Safety Management Trend Report. I realize, of course, that some of our expert contacts will be unable to respond to our request, either due to a lack of time or on other grounds. However, I never expected that someone would decline for the following reason:

“All five questions refer to “safety management” but [the survey] does not bother to clarify what safety management means. It is taken for granted, and not unreasonably so, that the term refers to the common understanding of safety as a condition where as little as possible goes wrong. From this basis the purpose of safety management is clearly to work towards achieving that, preferably reaching the ideal state of zero accidents / incidents / losses, etc. This interpretation represents a Safety-I perspective.”

I received this message from Erik Hollnagel, a renowned professor who has made a name for himself as an expert in the fields of resilience engineering, system safety, and intelligent human-machine systems. He has released numerous books and publications on occupational health and safety; I cited some of them in my Master’s thesis. I was therefore already aware of the distinction Hollnagel drew between Safety-I and Safety-II. What I was not aware of was the scale of this paradigm shift.

Safety II: A brief overview

Safety II can be regarded as a positivist version of occupational health and safety, in which safety is viewed as the ability to successfully navigate and withstands the stress and high-pressure situations that are part and parcel of the modern, complex world of work. An occupational health and safety strategy based on this concept is focused not on imposing standards and rules, but rather on acknowledging and promoting the human ability to work safely and successfully without unwavering adherence to the rule book - and thus creating lasting resilience. 

Casual analasys from a Safety-II perspective

The following comparison shows that Safety-II makes no distinction between the causes of accidents and safe situations. Both arise for the same reasons:

The Safety of Safety-II: What goes well and why? 

Out of 10,000 events 9,999 will go well. Examining these events can help us to understand when and how safety actually works and is properly implemented. Why should we only focus on the exception – the one event which led to unwanted consequences – if the underlying causes are the same as with all the other 9,999 events. That would be like investigating what makes a happy marriage by only analyzing divorces. 

Tip: Safety-II in detail

You can explore the Safety-II concept in details in our whitepaper "New perspectives for modern Safety Management". The puplication goes far beyond the brief overview I have provided and adresses three other exciting concepts in addition to Safety-II: Behavior-Based Safety, Psychological Safety and Safety Differently.  

A heated debate

Not long after the negative response from Hollnagel, the topic caught my attention again, as a LinkedIn post by Dr. Dominic Cooper caused uproar in the EHS community. He directed harsh criticism at the Safety-II approach and another closely related concept known as Safety Differently. The title of his article – “How different is Safety Differently?” – and the lively exchange of opinions in the comments section spread like wildfire.

Advocates maintain that SD is fundamentally different to Safety-1, as it is not just about successful safety outcomes, but about explicitly trying to change the effectiveness of the entire organisation by focusing on all those things the organisations do well, and building on those. This might be great theoretically, but in practice if an organisation is doing 99.99% of its activities right, it still means there is a lot of scope for error. – Dr. Dominic Cooper

At a panel discussion shortly after he published his post, Dr. Cooper was challenged by Ron Gantt, a passionate advocate of the Safety Differently movement. While it was fascinating to listen to them, I could not help but wonder whether this debate would actually bring us forward as a professional group in terms of preventing accidents and damage to health. To me, the dispute between Gantt and Cooper represents the divisions in the EHS community as we discuss this new paradigm of Safety-II.

The problem with Safety-II

Many EHS managers and safety officers find it difficult to accept or come to terms with the rationale behind Safety-II to begin with. This is often because, upon initial inspection, it can seem as though Hollnagel is trying to characterize all aspects of traditional occupational health and safety as being wrong. This relates not just to the methods and means used over the years, but to the philosophy as a whole. Ultimately, Hollnagel argues that we should move away from identifying the causes of accidents: he eschews the idea of identifying and rectifying causes using the TOP principle (i.e. looking at technical, organizational and personal failures). Instead, in his view, EHS managers should create trust between management and the wider workforce. Rather than dictating what should be done and writing step-by-step instructions, Hollnagel says, EHS managers should start to listen attentively to their employees, ask them questions, and appreciate the value of “adaptive behavior” rather than rules and standards. It is no wonder why seasoned EHS professionals are cautious - these managers have been taught for years that human error was one of the most common causes of workplace accidents. Questioning such core assumption naturally feels difficult to digest.

Yet, Hollnagel himself once explicitly called for root-cause analysis to be abolished entirely as a practice in the field of occupational health and safety:

As far as I’m concerned, it is doubtful that an EHS manager who has successfully conducted root-cause analyses for decades, whose EHS statistics are continuously improving and who is on course to meet his annual targets (e.g. an annual accident frequency rate reduction of 20 %) has any desire to adopt a “new approach”. Why should he place his trust in the human ability to behave safely without the guidance of rules and regulations? 

Safety-II in practice

To begin with, I too saw a number of reasons why sticking with the traditional approach would be better. During my time at an insurance company, for example, negative historical KPIs drawn from accident records for the last five years allowed us to predict a great deal in concrete terms. This meant I regarded Safety-II with some skepticism. Once it became clear to me that the intention behind Safety-II was not actually to replace Safety-I, it became much more attractive. Safety-II was not conceived as the successor to Safety-I. To the contrary, the two concepts complement one another in many respects – which is why they were consciously designated I and II, as opposed to 1 and 2, conveying progression over replacement.

But Safety-II is not intended to be a replacement of Safety-I. Indeed, Safety-II is not a new discipline or a new practice but rather a new perspective on what happens and how it happens. The new perspective provides another way of looking at events, how they are analysed, and how the results are interpreted.(Hollnagel, 2012) 

In light of the heated debate surrounding Safety-II and the email from Dr. Hollnagel, I came to the conclusion that the dispute over whether traditional or modern approaches are correct is hardly productive; we would be better off finding a means of combining the best elements of the old and the new. In the future, success – whether in the field of occupational health and safety or elsewhere – will be not achieved through micro-management, bureaucracy and sanctions.

Yet, despite my growing enthusiasm for Safety-II, one thing remained unclear to me. If something goes wrong in 1 in 10,000 events, how can occupational health and safety systems possibly provide the resources required to investigate the remaining 9,999 and learn from them when negative incidents already create more than enough work?

I was unable to shake this question and I brought it up in a discussion with my team. We considered whether it would be possible to develop a piece of software that allowed Safety-II to be implemented in practice. Until then, Quentic had been an EHS software solution that, for 13 years, had specialized in visualizing all aspects of traditional occupational health and safety – that is to say, Safety-I. However, we decided at that point to adapt a core part of our software. We were able to retain and optimize the underlying framework in doing so – fortunately, Safety-II is “only” a complementary addition to Safety-I. The result is a new module, Incidents & Observations, which enables companies to establish and define their own specific KPIs with which to measure health and safety in the workplace. This is a helpful and meaningful addition to traditional KPIs (e.g. accident frequency rate, accident-free days, audit scores, etc.) and could include employee initiatives and positive observations to share good practices. Users can compare and draw relationships between the various KPI types for Safety-I and Safety-II. In addition, we have integrated the ability to conduct preemptive pre-accident investigations. This is only the beginning – and I am quite aware that the greatest value of EHS software still lies in structuring Safety-I processes as effectively as possible. This means facilitating key traditional EHS processes, such as by automating incident management or simplifying updates to legal registers and safety data sheets.

Paradigm shift: Safety-II as a supplement to Safety-I

Following countless discussions with EHS specialists and managers on the topic of Safety-II and other approaches, I have come to the conclusion that Safety-II is more attractive to companies already achieving good results in relation to occupational health and safety, such as through the use of traditional KPIs. It is common for traditional safety-related KPIs, such as the accident frequency rate (per million hours), to stagnate at less than 5 for a time. Reaching this level requires an immense amount of effort and investment and is usually achieved by means of traditional approaches.  

“… progress on safety has reached a plateau in many industries. It seems that doing more of the same is simply going to get us more of the same - not something different. Following, and embracing the increasingly global trend of doing ‘safety differently’ will help industries break through this asymptote by seeing their people as their resource to harness, by no longer obsessing over achieving the lowest number of negative events, and by once again embracing safety as an ethical responsibility for people, rather than as a bureaucratic accountability to people.” -Sidney Dekker, Safety Management Trend Report 2017 

As a side note: Erik Hollnagel expressly consented to this snippet of his email being published. He very much liked the idea of discussing his Safety-II concept and the associated debate by means of blog articles. This means that Hollnagel is allowing the occupational health and safety community to examine something he believes is vital: a complementary opinion; a second perspective. Thank you.

Further opinions and perspectives on Safety-II

Join the debate! Here are a few fascinating articles I’ve compiled for you: