SAFETY-I & SAFETY-II
Two Complementary Views of Safety
Hollnagel · EUROCONTROL white paper · Aviation Safety Theory

Safety-I defines safety as the absence of unacceptable outcomes and focuses on what goes wrong. Safety-II defines safety as the presence of acceptable outcomes and focuses on what goes right. The argument is not that one replaces the other — it is that modern, high-reliability systems need both lenses to manage themselves.

Overview of the framework

Erik Hollnagel articulated the distinction most fully in Safety-I and Safety-II: The past and future of safety management (2014) and in the EUROCONTROL white paper with Wears and Braithwaite (Hollnagel et al., 2015). Safety-I is the classical view: safety is measured by the rarity of incidents and accidents; improvement proceeds by finding causes, eliminating them, and preventing recurrence. It underpins accident investigation, bow-tie analysis, risk matrices, and most regulatory frameworks. Its limit is asymmetric attention: in a system where 99.99% of operations succeed, Safety-I learns only from the 0.01% that do not.

Safety-II asks how success is produced. It observes that normal work involves constant adjustment to variable conditions — people adapt procedures, reconcile conflicting goals, absorb surprises — and that these everyday adaptations are what keep the system safe as well as productive. Improvement proceeds by understanding performance variability, amplifying the adaptations that make things go right, and dampening those that go wrong. Safety-II is closely linked to resilience engineering and to the ETTO principle.

SAFETY-I Safety = absence of adverse outcomes Look at what goes wrong · accident investigation · find causes & eliminate · bow-tie, HFACS, FMEA View of humans mainly a hazard to be controlled Learns from the rare 0.01% that fail SAFETY-II Safety = presence of acceptable outcomes Look at how things go right · study normal work · amplify good adaptations · FRAM, resilience engineering View of humans resource for flexibility & resilience Learns from all 100% of operations
Figure 1 · Safety-I and Safety-II side by side. They ask different questions of the same work — and both answers are needed.

When to use it

Typical applications

  • Reframing an SMS that has plateaued because further accident prevention has diminishing returns.
  • Designing LOSA-like observational programmes that study routine work, not just unsafe events.
  • Shifting debriefs from "what went wrong" to "how did we recover" and "what held together".
  • Training investigators and safety managers in complementary mental models.

Aviation relevance

  • EUROCONTROL has promoted the framing in ANSPs and for the broader ATM safety community.
  • Pairs with Threat & Error Management, which already has some Safety-II DNA.
  • Natural complement to SMS — Safety-II does not replace hazard registers, it extends learning beyond them.
  • Basis for modern approaches to crew resilience, CRM, and automation design.

Benefits

  • Captures the whole denominator. Learning from 100% of operations, not only the sliver that fail.
  • Positive view of people. Treats human variability as a resource, not a defect — aligning with just culture.
  • Explains plateaus. Offers a narrative for why adding more procedures stops improving accident rates.
  • Links theory to practice. Anchors resilience engineering and FRAM in a concrete day-to-day attitude.
  • Actionable reframing. Teams can run "learning from success" reviews alongside incident reviews.
  • Connects to HRO. Safety-II values and HRO's five principles reinforce each other.
  • Regulatory-compatible. Does not conflict with ICAO SMS or Annex 13 — complements them.

Limitations

  • Hard to quantify. Measuring "how things went right" resists the indicator-based reporting that regulators prefer.
  • Risk of relativism. Without careful framing, "celebrating adaptations" can slide into tolerating drift (ETTO territory).
  • Cultural shift required. Genuinely adopting Safety-II is more change than most safety functions are resourced for.
  • Can be misread as replacement. Hollnagel explicitly argued for both; some practitioners take Safety-II as "ignore incidents".
  • Toolset is younger. FRAM and resilience measurements are less mature than Safety-I staples like bow-tie.
  • Evidence base still building. Fewer published case studies demonstrating cost-effectiveness versus established methods.
In short Safety-I and Safety-II are two lenses on the same work. Use Safety-I when you need to investigate, prevent, and comply. Use Safety-II when you want to understand how the system actually stays safe on ordinary days — and use both together when the gains from elimination alone are running out.

References (APA 7)

Hollnagel, E. (2014). Safety-I and safety-II: The past and future of safety management. Ashgate.

Hollnagel, E., Wears, R. L., & Braithwaite, J. (2015). From safety-I to safety-II: A white paper. The Resilient Health Care Net.

Hollnagel, E. (2018). Safety-II in practice: Developing the resilience potentials. Routledge.

EUROCONTROL. (2013). From safety-I to safety-II: A white paper. EUROCONTROL.

Hollnagel, E. (2009). The ETTO principle: Efficiency–thoroughness trade-off. Ashgate.

Hollnagel, E., Woods, D. D., & Leveson, N. (Eds.). (2006). Resilience engineering: Concepts and precepts. Ashgate.

Further reading

Dekker, S. (2014). The field guide to understanding 'human error' (3rd ed.). Ashgate.

Provan, D. J., Woods, D. D., Dekker, S. W. A., & Rae, A. J. (2020). Safety II professionals: How resilience engineering can transform safety practice. Reliability Engineering & System Safety, 195, 106740.

Hollnagel, E. (2017). Safety-II in practice. Routledge.

Patriarca, R., Bergström, J., Di Gravio, G., & Costantino, F. (2018). Resilience engineering: Current status of the research and future challenges. Safety Science, 102, 79–100.