ETTO
Efficiency–Thoroughness Trade-Off Principle
Hollnagel · Why Things That Go Right Sometimes Go Wrong · Aviation Safety Frameworks

ETTO states that people and organisations must constantly trade thoroughness for efficiency. The same rules-of-thumb that keep normal work going explain many adverse outcomes, so the principle reframes "human error" as the downside of reasonable choices made under time and resource pressure.

Overview of the framework

Erik Hollnagel proposed the ETTO principle as a unifying explanation for both successful and failed performance (Hollnagel, 2009). Whenever a task must be carried out with finite time, attention, energy, and resources, the operator chooses a point on a spectrum: sufficient thoroughness to get it right, or sufficient efficiency to get it done. Perfect thoroughness makes action impossible; pure efficiency invites error. Safe operations live at a sustainable compromise.

ETTO is paired with its counterpart, TETO (thoroughness-efficiency trade-off), which describes the symmetrical pressure in safety-critical, rare events. The principle is descriptive and general — it is not a recipe for analysis but a lens through which existing methods (CREAM, FRAM, incident reviews) can be read. In practice, ETTO manifests as a library of ETTO rules: "it looks fine", "it's normally OK", "we usually skip this step", "someone else checks it later". These shortcuts are not laziness; they are how normal organisations deliver on conflicting goals.

THOROUGHNESS EFFICIENCY sustainable compromise task never completed excess cost & delay steps omitted adverse outcome everyday operating point "Looks fine" visual ok ⇒ skip detail "Normally OK" past success ⇒ same now "Someone checks" defer to downstream
Figure 1 · ETTO as a spectrum. The green band is the ordinary operating compromise; typical ETTO rules appear below.

When to use it

Typical applications

  • Re-framing incident and accident reports that would otherwise stop at "pilot error" or "procedure violation".
  • Designing procedures that acknowledge real-time trade-offs rather than prescribing unrealistic thoroughness.
  • Facilitating debriefs after near-misses — asking which ETTO rule was active and why.
  • Informing training in crew resource management, threat-and-error management, and safety culture.

Aviation relevance

  • Explains normal deviations from SOPs — such as abbreviated checklists on short turns — without moralising.
  • Useful for line-operations safety audits (LOSA) and for interpreting ASR/ASAP narratives.
  • Pairs well with Dekker's New View of human error and the FAA's Threat and Error Management model.
  • Grounds the concept of drift — how an organisation's normal slowly moves toward the unsafe boundary.

Benefits

  • Non-blaming vocabulary. Reframes shortcuts as rational responses to pressure rather than carelessness, matching modern safety-culture principles.
  • Explains success and failure symmetrically. The same rules that produce good outcomes on 999 flights produce the anomaly on the 1,000th.
  • Cheap to apply. Can be used in an after-action discussion without any software or training overhead.
  • Scales across levels. Applies equally to individual operators, crews, organisations, and regulators.
  • Bridges Safety-I and Safety-II. Offers language to describe adaptive performance without dismissing residual risk.
  • Supports procedure design. Helps identify where procedures are written as if thoroughness were free, and where graceful degradation is needed.
  • Compatible with other methods. ETTO rules slot into CREAM CPCs, FRAM variability, and HRA error-forcing contexts.

Limitations

  • Not predictive. ETTO explains after but gives little leverage to quantify future risk.
  • Risk of over-use. Labelling every event an "ETTO trade-off" can become a truism that discourages deeper investigation of specific causes.
  • Limited granularity. The binary thoroughness/efficiency framing simplifies multi-criteria trade-offs (cost, fatigue, legality, comfort).
  • Can be misread as permissive. Naïve readers sometimes take "it's rational to cut corners" as license rather than as a diagnosis.
  • No explicit treatment of severity. ETTO treats trade-offs symmetrically, but the cost of thoroughness is rarely of the same magnitude as the cost of a catastrophic miss.
  • Empirical base is informal. Most support comes from case studies and worked examples rather than controlled measurement.
In short ETTO is a descriptive principle, not a technique. Use it to reframe "error" as trade-off, to spot the everyday rules-of-thumb that keep flights on schedule, and to guide procedure and training design that acknowledges those trade-offs rather than wishing them away.

References (APA 7)

Hollnagel, E. (2009). The ETTO principle: Efficiency–thoroughness trade-off — Why things that go right sometimes go wrong. Ashgate.

Hollnagel, E. (2014). Safety-I and safety-II: The past and future of safety management. Ashgate.

Hollnagel, E., Wears, R. L., & Braithwaite, J. (2015). From safety-I to safety-II: A white paper. The Resilient Health Care Net.

Dekker, S. (2014). The field guide to understanding 'human error' (3rd ed.). Ashgate.

Woods, D. D., Dekker, S., Cook, R., Johannesen, L., & Sarter, N. (2010). Behind human error (2nd ed.). Ashgate.

Reason, J. (2008). The human contribution: Unsafe acts, accidents and heroic recoveries. Ashgate.

Further reading

Hollnagel, E. (2004). Barriers and accident prevention. Ashgate. [Background to the balance between constraints and performance.]

Rankin, A., Lundberg, J., Woltjer, R., Rollenhagen, C., & Hollnagel, E. (2014). Resilience in everyday operations: A framework for analyzing adaptations in high-risk work. Journal of Cognitive Engineering and Decision Making, 8(1), 78–97.

Amalberti, R. (2001). The paradoxes of almost totally safe transportation systems. Safety Science, 37(2–3), 109–126.

Snook, S. A. (2000). Friendly fire: The accidental shootdown of U.S. Black Hawks over northern Iraq. Princeton University Press. [Classic exposition of drift.]