Safety-I, Safety-II, and Safety-III

Safety-I

Defined by Erik Hollnagel in Safety-I and Safety-II (2014)

Safety means “as few things as possible go wrong.”

How Accidents Are Explained: Accidents are caused by failures and malfunctions. An investigation looks for the causes and contributing factors.
How Safety Is Managed: Reactively: people respond when something happens or when a risk is judged unacceptable.
How People Are Seen: Mainly as a liability or a hazard.

Safety-II

Safety means “as many things as possible go right.”

How Accidents Are Explained: An investigation should study how work usually goes right, as a basis for explaining how it goes wrong.
How Safety Is Managed: Proactively: people keep trying to anticipate developments and events.
How People Are Seen: As a resource the system needs for flexibility and resilience.

“Things basically happen in the same way, regardless of the outcome.”

Erik Hollnagel

Safety-III

Defined by Nancy Leveson in Safety-III (2020)

Safety means freedom from the unacceptable losses that the system’s stakeholders identify.

How Accidents Are Explained: Accidents happen when hazards aren’t adequately controlled. Linear causality can’t be assumed, and there isn’t a single root cause. An investigation should ask why the safety control structure didn’t prevent the loss.
How Safety Is Managed: The whole sociotechnical system should be designed to eliminate, mitigate, or control hazards. Lessons from accidents, incidents, and audits should feed back into that design.
How People Are Seen: The system should be designed so people can be flexible and resilient and can handle unexpected events.

How Different Are Safety-I and Safety-II?

In a 2026 white paper, Leveson argues that Safety-II treats “going right” and “going wrong” as a duality, as if increasing one decreases the other. Every complex system has several goals. A chemical plant can meet its daily production quota while toxic chemicals pollute the area around it. She takes Hollnagel’s statement that it is “more important… that things go right than that things do not go wrong” and shows that, in safety terms, it says avoiding an adverse event matters more than avoiding an adverse event. In her words, “Asking ‘what did not go right’ is equivalent to asking ‘what went wrong.’”

Learn More

The Future of Safety

Hollnagel: There Can Be No Future Alternative to Safety-I and Safety-II

In “The Folly of Safety-III” (2025), Hollnagel calls Safety-III “a meaningless concept.” He argues that Safety-I and Safety-II were never meant as steps in a sequence, and he notes that he warned against inferring a Safety-III when he introduced them. In his view, Safety-II looks at everything that happens, whatever the outcome, so it already covers the concerns of Safety-I and leaves nothing for a third view to study.

He also argues that STAMP isn’t a systems approach, citing a list of assumptions he attributes to it. Leveson had previously presented that list as the assumptions that STAMP explicitly rejects and replaces.

Leveson: The Future Is a Systems Approach

Leveson argues that Safety-I, as Hollnagel describes it, doesn’t match how safety engineering has been practiced for at least 70 years, and that Safety-II concentrates almost entirely on the human operator. In her view, people can only be as flexible and resilient as the system around them lets them be, so the whole system has to be designed for safety from the start, including the tools operators need to handle events the design didn’t foresee. She uses the name Safety-III to contrast Hollnagel’s view with System Safety, a systems approach that she says has been used successfully in U.S. defense and aerospace programs for 70 years.

As evidence for a systems approach, she points to the U.S. Navy’s SUBSAFE program, created after the submarine USS Thresher was lost in 1963. She reports that before SUBSAFE, the United States lost a submarine in peacetime about every two to three years. In the 57 years after SUBSAFE began, not one submarine in the program was lost.