Erik Hollnagel, Safety-I and Safety-II: The Past and Future of Safety Management, 2014
Nancy Leveson, Safety-III: A Systems Approach to Safety and Resilience, 2020
Safety-I
Safety means “as few things as possible go wrong.”
- How Accidents Are Explained
- Accidents are caused by failures and malfunctions. An investigation looks for the causes and contributing factors.
- How Safety Is Managed
- Reactively: people respond when something happens or when a risk is judged unacceptable.
- How People Are Seen
- Mainly as a liability or a hazard.
Safety-II
Safety means “as many things as possible go right.”
- How Accidents Are Explained
- An investigation studies how work usually goes right, as a basis for explaining how it goes wrong.
- How Safety Is Managed
- Proactively: people keep trying to anticipate developments and events.
- How People Are Seen
- As a resource the system needs for flexibility and resilience.
“Things basically happen in the same way, regardless of the outcome.”
Safety-III
Safety means freedom from the unacceptable losses that the system’s stakeholders identify.
- How Accidents Are Explained
- Accidents happen when hazards, the states that can lead to a loss, aren’t adequately controlled. Linear causality isn’t assumed, and there isn’t a single root cause. An investigation asks why the safety control structure didn’t prevent the loss.
- How Safety Is Managed
- The whole sociotechnical system is designed to eliminate, mitigate, or control hazards. Lessons from accidents, incidents, and audits feed back into that design.
- How People Are Seen
- The system is designed so people can be flexible and resilient and can handle unexpected events.
Sources
Leveson argues that Safety-I, as Hollnagel describes it, doesn’t match how safety engineering has been practiced for at least 70 years, and calls the systems approach she describes Safety-III.
The three cards follow the comparison table in Leveson’s paper (Table 1). The Safety-I and Safety-II columns of that table are taken from Hollnagel’s book.