Erik Hollnagel

Safety is a concept as complex as it is crucial. In this new book, Erik Hollnagel reimagines how we approach, understand, and manage safety in modern contexts. It challenges traditional perspectives while weaving together historical insights, cultural analysis, and practical guidance to offer a richer understanding of what it means to work and live safely. Decremental and Incremental Safety Cultures: Safety-I and Safety-II Revisited goes beyond identifying and analyzing safety issues to offer practicable strategies that balance protection and productivity. From the ambivalence of safety and the dialectics of outcomes to the seven stages of safety thinking, each chapter highlights a key aspect of safety practices. It introduces new frameworks including the deconstruction of everyday work and safety solutionism, offering readers the tools to critically assess their own safety measures and form better outcomes. Written in clear, jargon-free language, the book ensures that these insights are accessible to everyone, regardless of their background or experience and readers will develop a decremental and incremental safety. This book is an ideal read for professionals in the fields of occupational health and safety, human factors and risk management. If you have read Safety-I and Safety-II (CRC Press, 9781472423085) by the same author, this book is a must-have to understand the next phase of the Safety-I and Safety-II concepts.

Safety is a concept as complex as it is crucial. In this new book, Erik Hollnagel reimagines how we approach, understand, and manage safety in modern contexts. It challenges traditional perspectives while weaving together historical insights, cultural analysis, and practical guidance to offer a richer understanding of what it means to work and live safely. Decremental and Incremental Safety Cultures: Safety-I and Safety-II Revisited goes beyond identifying and analyzing safety issues to offer practicable strategies that balance protection and productivity. From the ambivalence of safety and the dialectics of outcomes to the seven stages of safety thinking, each chapter highlights a key aspect of safety practices. It introduces new frameworks including the deconstruction of everyday work and safety solutionism, offering readers the tools to critically assess their own safety measures and form better outcomes. Written in clear, jargon-free language, the book ensures that these insights are accessible to everyone, regardless of their background or experience and readers will develop a decremental and incremental safety. This book is an ideal read for professionals in the fields of occupational health and safety, human factors and risk management. If you have read Safety-I and Safety-II (CRC Press, 9781472423085) by the same author, this book is a must-have to understand the next phase of the Safety-I and Safety-II concepts.

The conventional interpretation of safety, known as Safety-I, denotes a condition where as little as possible goes wrong, and the focus of practical efforts in management or analysis is on the occurrence of unacceptable outcomes and on how to reduce their number to an acceptable level, ideally zero. The emphasis is therefore on how to manage safety as such, as seen in the ubiquitous safety management systems (SMS). As Professor James Reason astutely points out, this raises the interesting question of how it is possible to learn about something, let alone manage it, if it is studied only in situations in which it is absent. The solution proposed by and described in this book is to stop using safety as a noun and instead use it as an adverb: safely. Now often referred to as Safety-II, this solution is the logical consequence of resilience engineering and will require new methods, several of which already exist and have proved their worth in practice for years. The question ceases being what to manage and becomes how to manage. Managing safety is protective, hence a non-productive cost, which at best avoids a loss. Conversely, managing safely is productive and can generate revenue in addition to preventing or avoiding losses; aviation and mining are prime examples. From Safety to Safely provides a practical perspective on managing safely, illustrating a practical form of synesis. It offers a new understanding of safety, combining concerns for productivity and safety rather than juxtaposing them, and it shows how to manage complex industrial and social systems in the spirit of resilience engineering and synesis. It is the first book to completely dispense with the loaded term "safety" while offering a practical and viable alternative. Spoiler alert: this book does not mention or analyse any celebrated accidents. This book is for all middle and senior managers, board members, and independent consultants seeking to ensure safe, revenue-generating operations.

The conventional interpretation of safety, known as Safety-I, denotes a condition where as little as possible goes wrong, and the focus of practical efforts in management or analysis is on the occurrence of unacceptable outcomes and on how to reduce their number to an acceptable level, ideally zero. The emphasis is therefore on how to manage safety as such, as seen in the ubiquitous safety management systems (SMS). As Professor James Reason astutely points out, this raises the interesting question of how it is possible to learn about something, let alone manage it, if it is studied only in situations in which it is absent. The solution proposed by and described in this book is to stop using safety as a noun and instead use it as an adverb: safely. Now often referred to as Safety-II, this solution is the logical consequence of resilience engineering and will require new methods, several of which already exist and have proved their worth in practice for years. The question ceases being what to manage and becomes how to manage. Managing safety is protective, hence a non-productive cost, which at best avoids a loss. Conversely, managing safely is productive and can generate revenue in addition to preventing or avoiding losses; aviation and mining are prime examples. From Safety to Safely provides a practical perspective on managing safely, illustrating a practical form of synesis. It offers a new understanding of safety, combining concerns for productivity and safety rather than juxtaposing them, and it shows how to manage complex industrial and social systems in the spirit of resilience engineering and synesis. It is the first book to completely dispense with the loaded term "safety" while offering a practical and viable alternative. Spoiler alert: this book does not mention or analyse any celebrated accidents. This book is for all middle and senior managers, board members, and independent consultants seeking to ensure safe, revenue-generating operations.

The complexity of today’s large organisations, businesses, and social institutions defeats management approaches based on monolithic thinking. Most industry and service organisations look at their performance either from a single perspective – productivity, quality, safety, etc. – or from different but separate perspectives that reside in organisational silos. Quality is treated separately from safety, which, again, is treated separately from productivity, and so on. While siloed thinking may be convenient in the short term, it fails to recognise that any specific perspective reveals only a part of what goes on. Yet it is essential to have a unified view of how an organisation functions effectively to manage changes and to ensure the organisation excels in what it does. Synesis represents the mutually dependent set of priorities, perspectives, and practices that an organisation needs to carry out its activities as intended. It shows how to overcome the fragmentation in foci, scope, and time that characterises the dominant change management paradigms. This book is consequently not about productivity or quality or safety or reliability but about all of these together. It is about why it is necessary to think of them as a whole. And it is about how this can be done in practice.

The complexity of today’s large organisations, businesses, and social institutions defeats management approaches based on monolithic thinking. Most industry and service organisations look at their performance either from a single perspective – productivity, quality, safety, etc. – or from different but separate perspectives that reside in organisational silos. Quality is treated separately from safety, which, again, is treated separately from productivity, and so on. While siloed thinking may be convenient in the short term, it fails to recognise that any specific perspective reveals only a part of what goes on. Yet it is essential to have a unified view of how an organisation functions effectively to manage changes and to ensure the organisation excels in what it does. Synesis represents the mutually dependent set of priorities, perspectives, and practices that an organisation needs to carry out its activities as intended. It shows how to overcome the fragmentation in foci, scope, and time that characterises the dominant change management paradigms. This book is consequently not about productivity or quality or safety or reliability but about all of these together. It is about why it is necessary to think of them as a whole. And it is about how this can be done in practice.

Our fascination with new technologies is based on the assumption that more powerful automation will overcome human limitations and make our systems 'faster, better, cheaper,' resulting in simple, easy tasks for people. But how does new technology and more powerful automation change our work? Research in Cognitive Systems Engineering (CSE) looks at the intersection of people, technology, and work. What it has found is not stories of simplification through more automation, but stories of complexity and adaptation. When work changed through new technology, practitioners had to cope with new complexities and tighter constraints. They adapted their strategies and the artifacts to work around difficulties and accomplish their goals as responsible agents. The surprise was that new powers had transformed work, creating new roles, new decisions, and new vulnerabilities. Ironically, more autonomous machines have created the requirement for more sophisticated forms of coordination across people, and across people and machines, to adapt to new demands and pressures. This book synthesizes these emergent Patterns though stories about coordination and mis-coordination, resilience and brittleness, affordance and clumsiness in a variety of settings, from a hospital intensive care unit, to a nuclear power control room, to a space shuttle control center. The stories reveal how new demands make work difficult, how people at work adapt but get trapped by complexity, and how people at a distance from work oversimplify their perceptions of the complexities, squeezing practitioners. The authors explore how CSE observes at the intersection of people, technology, and work, how CSE abstracts patterns behind the surface details and wide variations, and how CSE discovers promising new directions to help people cope with complexities. The stories of CSE show that one key to well-adapted work is the ability to be prepared to be surprised. Are you ready?

Nothing has been more prolific over the past century than human/machine interaction. Automobiles, telephones, computers, manufacturing machines, robots, office equipment, machines large and small; all affect the very essence of our daily lives. However, this interaction has not always been efficient or easy and has at times turned fairly hazardous. Cognitive Systems Engineering (CSE) seeks to improve this situation by the careful study of human/machine interaction as the meaningful behavior of a unified system. Written by pioneers in the development of CSE, Joint Cognitive Systems: Foundations of Cognitive Systems Engineering offers a principled approach to studying human work with complex technology. The authors use a top-down, functional approach and emphasize a proactive (coping) perspective on work that overcomes the limitations of the structural human information processing view. They describe a conceptual framework for analysis with concrete theories and methods for joint system modeling that can be applied across the spectrum of single human/machine systems, social/technical systems, and whole organizations. The book explores both current and potential applications of CSE illustrated by examples. Understanding the complexities and functions of the human/machine interaction is critical to designing safe, highly functional, and efficient technological systems. This is a critical reference for students, designers, and engineers in a wide variety of disciplines.

Safety-I is defined as the freedom from unacceptable harm. The purpose of traditional safety management is therefore to find ways to ensure this ‘freedom’. But as socio-technical systems steadily have become larger and less tractable, this has become harder to do. Resilience engineering pointed out from the very beginning that resilient performance - an organisation’s ability to function as required under expected and unexpected conditions alike – required more than the prevention of incidents and accidents. This developed into a new interpretation of safety (Safety-II) and consequently a new form of safety management. Safety-II changes safety management from protective safety and a focus on how things can go wrong, to productive safety and a focus on how things can and do go well. For Safety-II, the aim is not just the elimination of hazards and the prevention of failures and malfunctions but also how best to develop an organisation’s potentials for resilient performance – the way it responds, monitors, learns, and anticipates. That requires models and methods that go beyond the Safety-I toolbox. This book introduces a comprehensive approach for the management of Safety-II, called the Resilience Assessment Grid (RAG). It explains the principles of the RAG and how it can be used to develop the resilience potentials. The RAG provides four sets of diagnostic and formative questions that can be tailored to any organisation. The questions are based on the principles of resilience engineering and backed by practical experience from several domains. Safety-II in Practice is for both the safety professional and academic reader. For the professional, it presents a workable method (RAG) for the management of Safety-II, with a proven track record. For academic and student readers, the book is a concise and practical presentation of resilience engineering.

Safety-I is defined as the freedom from unacceptable harm. The purpose of traditional safety management is therefore to find ways to ensure this ‘freedom’. But as socio-technical systems steadily have become larger and less tractable, this has become harder to do. Resilience engineering pointed out from the very beginning that resilient performance - an organisation’s ability to function as required under expected and unexpected conditions alike – required more than the prevention of incidents and accidents. This developed into a new interpretation of safety (Safety-II) and consequently a new form of safety management. Safety-II changes safety management from protective safety and a focus on how things can go wrong, to productive safety and a focus on how things can and do go well. For Safety-II, the aim is not just the elimination of hazards and the prevention of failures and malfunctions but also how best to develop an organisation’s potentials for resilient performance – the way it responds, monitors, learns, and anticipates. That requires models and methods that go beyond the Safety-I toolbox. This book introduces a comprehensive approach for the management of Safety-II, called the Resilience Assessment Grid (RAG). It explains the principles of the RAG and how it can be used to develop the resilience potentials. The RAG provides four sets of diagnostic and formative questions that can be tailored to any organisation. The questions are based on the principles of resilience engineering and backed by practical experience from several domains. Safety-II in Practice is for both the safety professional and academic reader. For the professional, it presents a workable method (RAG) for the management of Safety-II, with a proven track record. For academic and student readers, the book is a concise and practical presentation of resilience engineering.

Accidents are preventable, but only if they are correctly described and understood. Since the mid-1980s accidents have come to be seen as the consequence of complex interactions rather than simple threads of causes and effects. Yet progress in accident models has not been matched by advances in methods. The author's work in several fields (aviation, power production, traffic safety, healthcare) made it clear that there is a practical need for constructive methods and this book presents the experiences and the state-of-the-art. The focus of the book is on accident prevention rather than accident analysis and unlike other books, has a proactive rather than reactive approach. The emphasis on design rather than analysis is a trend also found in other fields. Features of the book include: -A classification of barrier functions and barrier systems that will enable the reader to appreciate the diversity of barriers and to make informed decisions for system changes. -A perspective on how the understanding of accidents (the accident model) largely determines how the analysis is done and what can be achieved. The book critically assesses three types of accident models (sequential, epidemiological, systemic) and compares their strengths and weaknesses. -A specific accident model that captures the full complexity of systemic accidents. One consequence is that accidents can be prevented through a combination of performance monitoring and barrier functions, rather than through the elimination or encapsulation of causes. -A clearly described methodology for barrier analysis and accident prevention. Written in an accessible style, Barriers and Accident Prevention is designed to provide a stimulating and practical guide for industry professionals familiar with the general ideas of accidents and human error. The book is directed at those involved with accident analysis and system safety, such as managers of safety departments, risk and safety consultants, human factors professionals, and accident investigators. It is applicable to all major application areas such as aviation, ground transportation, maritime, process industries, healthcare and hospitals, communication systems, and service providers.

Health care is everywhere under tremendous pressure with regard to efficiency, safety, and economic viability - to say nothing of having to meet various political agendas - and has responded by eagerly adopting techniques that have been useful in other industries, such as quality management, lean production, and high reliability. This has on the whole been met with limited success because health care as a non-trivial and multifaceted system differs significantly from most traditional industries. In order to allow health care systems to perform as expected and required, it is necessary to have concepts and methods that are able to cope with this complexity. Resilience engineering provides that capacity because its focus is on a system’s overall ability to sustain required operations under both expected and unexpected conditions rather than on individual features or qualities. Resilience engineering’s unique approach emphasises the usefulness of performance variability, and that successes and failures have the same aetiology. This book contains contributions from acknowledged international experts in health care, organisational studies and patient safety, as well as resilience engineering. Whereas current safety approaches primarily aim to reduce or eliminate the number of things that go wrong, Resilient Health Care aims to increase and improve the number of things that go right. Just as the WHO argues that health is more than the absence of illness, so does Resilient Health Care argue that safety is more than the absence of risk and accidents. This can be achieved by making use of the concrete experiences of resilience engineering, both conceptually (ways of thinking) and practically (ways of acting).

Health systems everywhere are expected to meet increasing public and political demands for accessible, high-quality care. Policy-makers, managers, and clinicians use their best efforts to improve efficiency, safety, quality, and economic viability. One solution has been to mimic approaches that have been shown to work in other domains, such as quality management, lean production, and high reliability. In the enthusiasm for such solutions, scant attention has been paid to the fact that health care as a multifaceted system differs significantly from most traditional industries. Solutions based on linear thinking in engineered systems do not work well in complicated, multi-stakeholder non-engineered systems, of which health care is a leading example. A prerequisite for improving health care and making it more resilient is that the nature of everyday clinical work be well understood. Yet the focus of the majority of policy or management solutions, as well as that of accreditation and regulation, is work as it ought to be (also known as ’work-as-imagined’). The aim of policy-makers and managers, whether the priority is safety, quality, or efficiency, is therefore to make everyday clinical work - or work-as-done - comply with work-as-imagined. This fails to recognise that this normative conception of work is often oversimplified, incomplete, and outdated. There is therefore an urgent need to better understand everyday clinical work as it is done. Despite the common focus on deviations and failures, it is undeniable that clinical work goes right far more often than it goes wrong, and that we only can make it better if we understand how this happens. This second volume of Resilient Health Care continues the line of thinking of the first book, but takes it further through a range of chapters from leading international thinkers on resilience and health care. Where the first book provided the rationale and basic concepts of RHC, the Resilience of Everyday Clinical Work b

This is the fifth book published within the Ashgate Studies in Resilience Engineering series. The first volume introduced resilience engineering broadly. The second and third volumes established the research foundation for the real-world applications that then were described in the fourth volume: Resilience Engineering in Practice. The current volume continues this development by focusing on the role of resilience in the development of solutions. Since its inception, the development of resilience engineering as a concept and a field of practice has insisted on expanding the scope from a preoccupation with failure to include also the acceptable everyday functioning of a system or an organisation. The preoccupation with failures and adverse outcomes focuses on situations where something goes wrong and the tries to keep the number of such events and their (adverse) outcomes as low as possible. The aim of resilience engineering and of this volume is to describe how safety can change from being protective to become productive and increase the number of things that go right by improving the resilience of the system.

Safety has traditionally been defined as a condition where the number of adverse outcomes was as low as possible (Safety-I). From a Safety-I perspective, the purpose of safety management is to make sure that the number of accidents and incidents is kept as low as possible, or as low as is reasonably practicable. This means that safety management must start from the manifestations of the absence of safety and that - paradoxically - safety is measured by counting the number of cases where it fails rather than by the number of cases where it succeeds. This unavoidably leads to a reactive approach based on responding to what goes wrong or what is identified as a risk - as something that could go wrong. Focusing on what goes right, rather than on what goes wrong, changes the definition of safety from ’avoiding that something goes wrong’ to ’ensuring that everything goes right’. More precisely, Safety-II is the ability to succeed under varying conditions, so that the number of intended and acceptable outcomes is as high as possible. From a Safety-II perspective, the purpose of safety management is to ensure that as much as possible goes right, in the sense that everyday work achieves its objectives. This means that safety is managed by what it achieves (successes, things that go right), and that likewise it is measured by counting the number of cases where things go right. In order to do this, safety management cannot only be reactive, it must also be proactive. But it must be proactive with regard to how actions succeed, to everyday acceptable performance, rather than with regard to how they can fail, as traditional risk analysis does. This book analyses and explains the principles behind both approaches and uses this to consider the past and future of safety management practices. The analysis makes use of common examples and cases from domains such as aviation, nuclear power production, process management and health care. The final chapters explain the theoret

Safety has traditionally been defined as a condition where the number of adverse outcomes was as low as possible (Safety-I). From a Safety-I perspective, the purpose of safety management is to make sure that the number of accidents and incidents is kept as low as possible, or as low as is reasonably practicable. This means that safety management must start from the manifestations of the absence of safety and that - paradoxically - safety is measured by counting the number of cases where it fails rather than by the number of cases where it succeeds. This unavoidably leads to a reactive approach based on responding to what goes wrong or what is identified as a risk - as something that could go wrong. Focusing on what goes right, rather than on what goes wrong, changes the definition of safety from ’avoiding that something goes wrong’ to ’ensuring that everything goes right’. More precisely, Safety-II is the ability to succeed under varying conditions, so that the number of intended and acceptable outcomes is as high as possible. From a Safety-II perspective, the purpose of safety management is to ensure that as much as possible goes right, in the sense that everyday work achieves its objectives. This means that safety is managed by what it achieves (successes, things that go right), and that likewise it is measured by counting the number of cases where things go right. In order to do this, safety management cannot only be reactive, it must also be proactive. But it must be proactive with regard to how actions succeed, to everyday acceptable performance, rather than with regard to how they can fail, as traditional risk analysis does. This book analyses and explains the principles behind both approaches and uses this to consider the past and future of safety management practices. The analysis makes use of common examples and cases from domains such as aviation, nuclear power production, process management and health care. The final chapters explain the theoret

Health care is everywhere under tremendous pressure with regard to efficiency, safety, and economic viability - to say nothing of having to meet various political agendas - and has responded by eagerly adopting techniques that have been useful in other industries, such as quality management, lean production, and high reliability. This has on the whole been met with limited success because health care as a non-trivial and multifaceted system differs significantly from most traditional industries. In order to allow health care systems to perform as expected and required, it is necessary to have concepts and methods that are able to cope with this complexity. Resilience engineering provides that capacity because its focus is on a system’s overall ability to sustain required operations under both expected and unexpected conditions rather than on individual features or qualities. Resilience engineering’s unique approach emphasises the usefulness of performance variability, and that successes and failures have the same aetiology. This book contains contributions from acknowledged international experts in health care, organisational studies and patient safety, as well as resilience engineering. Whereas current safety approaches primarily aim to reduce or eliminate the number of things that go wrong, Resilient Health Care aims to increase and improve the number of things that go right. Just as the WHO argues that health is more than the absence of illness, so does Resilient Health Care argue that safety is more than the absence of risk and accidents. This can be achieved by making use of the concrete experiences of resilience engineering, both conceptually (ways of thinking) and practically (ways of acting).

Resilience engineering has consistently argued that safety is more than the absence of failures. Since the first book was published in 2006, several book chapters and papers have demonstrated the advantage in going behind 'human error' and beyond the failure concept, just as a number of serious accidents have accentuated the need for it. But there has not yet been a comprehensive method for doing so; the Functional Resonance Analysis Method (FRAM) fulfils that need. Whereas commonly used methods explain events by interpreting them in terms of an already existing model, the FRAM is used to model the functions that are needed for everyday performance to succeed. This model can then be used to explain specific events, by showing how functions can be coupled and how the variability of everyday performance sometimes may lead to unexpected and out-of-scale outcomes - either good or bad. The FRAM is based on four principles: equivalence of failures and successes, approximate adjustments, emergence, and functional resonance. As the FRAM is a method rather than a model, it makes no assumptions about how the system under investigation is structured or organised, nor about possible causes and cause-effect relations. Instead of looking for failures and malfunctions, the FRAM explains outcomes in terms of how functions become coupled and how everyday performance variability may resonate. This book presents a detailed and tested method that can be used to model how complex and dynamic socio-technical systems work, to understand why things sometimes go wrong but also why they normally succeed.

Resilience engineering has consistently argued that safety is more than the absence of failures. Since the first book was published in 2006, several book chapters and papers have demonstrated the advantage in going behind 'human error' and beyond the failure concept, just as a number of serious accidents have accentuated the need for it. But there has not yet been a comprehensive method for doing so; the Functional Resonance Analysis Method (FRAM) fulfils that need. Whereas commonly used methods explain events by interpreting them in terms of an already existing model, the FRAM is used to model the functions that are needed for everyday performance to succeed. This model can then be used to explain specific events, by showing how functions can be coupled and how the variability of everyday performance sometimes may lead to unexpected and out-of-scale outcomes - either good or bad. The FRAM is based on four principles: equivalence of failures and successes, approximate adjustments, emergence, and functional resonance. As the FRAM is a method rather than a model, it makes no assumptions about how the system under investigation is structured or organised, nor about possible causes and cause-effect relations. Instead of looking for failures and malfunctions, the FRAM explains outcomes in terms of how functions become coupled and how everyday performance variability may resonate. This book presents a detailed and tested method that can be used to model how complex and dynamic socio-technical systems work, to understand why things sometimes go wrong but also why they normally succeed.

Accident investigation and risk assessment have for decades focused on the human factor, particularly 'human error'. Countless books and papers have been written about how to identify, classify, eliminate, prevent and compensate for it. This bias towards the study of performance failures, leads to a neglect of normal or 'error-free' performance and the assumption that as failures and successes have different origins there is little to be gained from studying them together. Erik Hollnagel believes this assumption is false and that safety cannot be attained only by eliminating risks and failures. The ETTO Principle looks at the common trait of people at work to adjust what they do to match the conditions - to what has happened, to what happens, and to what may happen. It proposes that this efficiency-thoroughness trade-off (ETTO) - usually sacrificing thoroughness for efficiency - is normal. While in some cases the adjustments may lead to adverse outcomes, these are due to the very same processes that produce successes, rather than to errors and malfunctions. The ETTO Principle removes the need for specialised theories and models of failure and 'human error' and offers a viable basis for effective and just approaches to both reactive and proactive safety management.