Safety I and Safety II: An explainer

More than a decade has passed since Erik Hollnagel’s seminal paper, “A Tale of Two Safeties,” was published in the journal Nuclear Safety and Simulation.

The 2013 paper, which outlines the concepts of Safety I and Safety II, was followed the next year by Hollnagel’s book, “Safety I and Safety II: The Past and Future of Safety Management.”

What are Safety I and Safety II? Why do they matter to organizations?

Here are the basics.

Safety I

To put it simply, Hollnagel defined Safety I as “reactive safety management” and Safety II as “proactive safety management.”

Safety I – often thought of as “traditional safety” – includes incident investigations and lagging indicators such as total recordable incident rate and days away, restricted or transferred rates.

“Safety I tacitly assumes that systems work because they are well designed and scrupulously maintained, because procedures are complete and correct, because designers can foresee and anticipate even minor contingencies, and because people behave as they are expected to – and, more importantly, as they have been taught or trained to do,” Hollnagel writes.

“This unavoidably leads to an emphasis on compliance in the way work is carried out.”

Safety I also includes behavior-based safety, according to Tim Page-Bottorff, senior safety consultant at SafeStart.

Safety II

In Safety II – known as the “new view” – the focus is more on potential incidents, Page-Bottorff said. That includes pre-incident investigations and leading indicators.

Safety II also “explicitly assumes that systems work because people are able to adjust what they do to match the conditions of work,” Hollnagel writes. “People learn to identify and overcome design flaws and functional glitches.”

One way of employing Safety II is via Human and Organizational Performance. This philosophy looks at how work is accomplished in the context of workplace conditions or other circumstances.

To illustrate this concept, Richard Fairfax, principal consultant at the National Safety Council and former OSHA deputy assistant secretary, uses the example of a machine guard.

A Safety I investigation may find that an incident was caused by a missing machine guard, and the likely result would be someone getting disciplined. A Safety II perspective would involve questions such as: Why was the machine guard removed? Was there too much production pressure? Was the employee rushing?

The approach under Safety II isn’t to blame the employee, but to learn why the guard was missing. Using the Safety I approach, blame would be placed on the employee, Fairfax said.

Why the change?

Why has a distinction formed between Safety I and Safety II? Nearly a decade before Hollnagel made these designations, Nancy Leveson provided some insight in a 2004 paper published in the journal Safety Science,“A New Accident Model for Engineering Safer Systems.”

Among the reasons:

• New types of hazards
• Decreasing tolerance for a single incident
• Increasing complexity
• Changes in regulations and public views of safety

Leveson also points to the fast pace of technological change. Think about cellphones from 20 years ago versus the smartphone in your pocket. What advanced functions can newer phones perform in comparison with older ones, and how much do you need to learn to use newer phones?

Fairfax said another reason for the evolution is an attempt to solve stagnant fatality and injury rates. He added: “I think that’s spurred companies, people, and safety and health professionals to ask, ‘Are we doing enough?’”

Why is it important?

Safety pros may think: Why do Safety I and Safety II matter?

One main reason: It’s a framework to examine safety programs; identify any gaps; and look for ways to solve issues, especially for complex problems.

“In incorporating many different points of view, you might be able to apply a certain tool toward risks or hazards in the workplace,” Page-Bottorff said. “You can’t just keep doing the same things in the same way and expect better outcomes or improvements.”

The use of those different tools is one reason why experts say Safety I and Safety II are better together than as separate entities.

Also, Safety I can’t be abandoned. At a basic level, organizations need compliance with safety rules and a focus on workplace hazards.

They also need workers to make safe choices, especially in high-consequence situations.

Corrie Pitzer, founder and CEO of Safemap International, gave an example from his time in the South African military. The “absolute rule” when getting into a helicopter while carrying a rifle is the muzzle must be pointed down.

“If there’s somebody that’s got a round in their rifle and it goes off in a helicopter,” Pitzer said, “[the bullet] goes up, it shoots through the rotor and 20 people are dead.

“When you jump into that helicopter with a muzzle up, no one’s going to ask you why you did it. No one’s interested in what ‘context’ may have influenced your thinking.”

He later added: “Consequences are still a critical piece of human behavior.”