Safety-II and resilience: a contested redefinition of safety itself

Safety is usually defined by what did not happen; Hollnagel, Wears and Braithwaite (2015) call that Safety-I, in which as few things as possible go wrong and failures are traced to malfunctioning components, people included. Safety-II defines safety as the system's ability to succeed under varying conditions, and treats everyday variability as the reason work usually goes right.

This second of ten units argues that the redefinition changed the field's questions, produced methods that do not begin from a broken part (Leveson, 2004; Hollnagel, 2017), and has still not produced a measure of the ability to succeed that predicts safety. It takes the relocation of cause the first unit settled, and asks whether the frame should be replaced rather than repaired.

The redefinition, and the human it puts back

Safety-I is a liability model: it seeks the causes of an adverse outcome, estimates their likelihood, and reacts by removing a cause or adding a barrier (Hollnagel, Wears and Braithwaite, 2015). Safety-II is a capacity model, in which variability supplies the adaptations that meet varying conditions. That covers the older patient who absorbs a slow discharge as readily as the clinician who covers a missing result.

Things do not go right because people behave as they are supposed to, but because people can and do adjust what they do to match the conditions of work. (Hollnagel, Wears and Braithwaite, 2015)

Four abilities, and what they make assessable

Woods and Hollnagel (2017) organise resilience around four abilities a system must have: to respond, to monitor what is becoming critical, to anticipate, and to learn from experience. The list settles what kind of thing resilience is: it belongs to the system, which makes it something to engineer rather than a trait to train.

Bergstrom and Dekker (2014) set out an organisational meso level at which actors construct resilience: actors respond to the local conditions they can see, and the constraints that produce those conditions sit above them. In two published case studies, the Challenger launch decision and the 1994 Black Hawk shootdown over northern Iraq, the people involved were adapting sensibly inside the conditions they faced, and the drift came from ordinary organisational normalisation rather than from rule-breaking. The paper synthesises case studies, so it locates resilience without measuring it.

The redefinition becomes engineering in STAMP and FRAM

Leveson (2004) argues that new technology changed the character of accidents, so the explanatory mechanisms had to change with it. Her model, STAMP, treats safety as a control problem rather than a reliability problem. Accidents occur when the control system fails to handle failures or dysfunctional interactions adequately. The unit of analysis becomes the hierarchical control structure, in which each level constrains the one below and receives feedback.

Hollnagel (2017) supplies the second method. FRAM represents a system as coupled functions described by six aspects: input, output, preconditions, resources, control and time. Variability in one function feeds the functions it couples to, so ordinary variability aggregates into functional resonance.

Adaptation in ordinary work

Rankin and colleagues built a framework for analysing adaptive behaviour where systems work near the margins of safety, and a variety space diagram relating variability, disturbances and constraints to performance (Rankin et al., 2013). Both rest on nine focus groups with safety staff in health care, nuclear power, transportation and emergency services. Adaptations were continuous, local and shaped by context, which supports the descriptive claim rather than a measurement.

Provan and colleagues separate two ways of managing safety (Provan et al., 2020). Centralised control aligns people to what is safe; guided adaptability lets them adapt to emergent conditions. Safety-II, they observe, is presented as a paradigm shift but has created practical difficulty for safety professionals, because it does not say when to reinforce alignment and when to support a frontline adaptation. The choice is hardest for staff with no time to spare.

The argument reached the ward as a protocol, not a test

Anderson and colleagues designed a feasibility study in the emergency department and the older person's unit of a large London teaching hospital, using the Concepts for Applying Resilience Engineering model to guide collection and analysis (Anderson et al., 2016). The evaluation phase is to be designed only once the first two phases are complete.

Sujan, Huang and Braithwaite (2017) characterise learning from incidents as resting on a Safety-I definition of safety as the absence of negative events, and argue from a Safety-II definition instead: safety is the ability to make dynamic trade-offs and adjust performance to changing demands, so organisations should study what goes right in everyday clinical work as well as what goes wrong.

The word wandered: four concepts and one scale

Woods (2015) separates four uses of the label: rebound from trauma, robustness, graceful extensibility when surprise challenges boundaries, and the sustained ability to adapt as conditions evolve. Conflating them produces claims that cannot all be true at once, so the field must choose a meaning before it can measure resilience.

Thielmann and colleagues surveyed 285 emergency medical services personnel in Germany with the RS-13 resilience scale, the Irritation Scale and the Maslach Burnout Inventory, finding 39 per cent with a low level of resilience and lower irritation and burnout scores among the more resilient (Thielmann et al., 2024). As a test of Safety-II it measures an individual capacity, cross-sectionally, with no measure of system performance.

The contested question: engineering, or critique waiting for failure data?

The first holds that Safety-II is usable engineering, and its evidence is the existence of working methods. Leveson (2004) sets out STAMP and the analysis, design and measurement that follow; Hollnagel (2017) sets out FRAM, which models variability propagating between functions; and Dui and colleagues review how importance measures, maintenance and resilience relate, describing a field that expects to compute rather than to argue (Dui et al., 2023). Its test is whether an analysis changes a design decision.

The second holds that the redefinition is a critique not yet tested, and its strongest evidence is the state of the operational work. The healthcare programme defers its outcome evaluation (Anderson et al., 2016), the clinical introduction offers concepts rather than a test (Fairbanks et al., 2014), the proposal to learn from what goes right carries no evaluation (Sujan et al., 2017), and the practitioner is given a dilemma rather than a rule (Provan et al., 2020). A review of the tools built since found 16, five never evaluated and few measuring a patient outcome (Birkeli et al., 2025). Its test is an outcome: a setting in which a Safety-II intervention changed what happened to patients.

The third holds that the argument is carried by the word rather than by the theory. Woods (2015) shows the label splitting into four incompatible concepts, and Thielmann et al. (2024) measure it as an individual capacity, so the level of study has drifted down to the person. Its test is definitional discipline: whether a paper says which resilience it means, and then measures that.

One of three studies would settle it, and none is reported here: a resilience measure with demonstrated predictive validity, the deferred evaluation of a programme such as CARE, or a head-to-head comparison of the countermeasures the two accounts of the same events generate.

What to do while the dispute is open

The evidence on the two sides is unequal. That Safety-II is usable engineering rests on working methods: STAMP and FRAM exist, and the maintenance literature expects to compute. That the redefinition is untested rests on the operational record, which is a protocol, a commentary, a critique, a practitioner account and a review of 16 tools, few tied to a patient outcome. The strongest objection to this unit's thesis is that a method nobody has used cannot be said to have failed. While the dispute is open, a safety case should carry a measure of the ability to succeed beside the count of failures, and no redesign should rest on that ability until an instrument predicts something.

Where this is heading

The direction of travel is from definition to measurement and from advocacy to prospective test. The named work that would move it is the CARE programme's evaluation phase (Anderson et al., 2016) and the research agenda for importance measures in resilience management (Dui et al., 2023). Woods (2015) adds the precondition: until the field chooses which resilience it means, an instrument measures whatever it happens to capture.

Sources

• Hollnagel, E., Wears, R. L. and Braithwaite, J. (2015). From Safety-I to Safety-II: A White Paper. The Resilient Health Care Net. https://www.england.nhs.uk/signuptosafety/wp-content/uploads/sites/16/2015/10/safety-1-safety-2-whte-papr.pdf Defines Safety-I as the state in which as few things as possible go wrong and Safety-II as the ability to succeed under varying conditions. It reports no data of its own, so the unit treats it as the claim under test.
• Woods, D. D. and Hollnagel, E. (2017). Prologue: Resilience Engineering Concepts. In Resilience Engineering. CRC Press. doi:10.1201/9781315605685-1 Sets out resilience engineering as a paradigm for coping with complexity under pressure, organised around four abilities: to respond, to monitor, to anticipate and to learn. It supplies the definition whose parts can be assessed separately, and places resilience in the system rather than the person.
• Leveson, N. (2004). A new accident model for engineering safer systems. Safety Science. doi:10.1016/s0925-7535(03)00047-x Introduces STAMP, in which accidents result from inadequately enforced safety-related constraints rather than a chain of component failures, analysed through a hierarchical control structure with feedback. It is the unit's first method that does not need a broken part.
• Hollnagel, E. (2017). FRAM: The Functional Resonance Analysis Method. CRC Press. doi:10.1201/9781315255071 Presents a method representing a system as coupled functions described by six aspects: input, output, preconditions, resources, control and time. Variability in one function can be traced into the functions it feeds, so the model can be built prospectively.
• Rankin, A., Lundberg, J., Woltjer, R., Rollenhagen, C. and Hollnagel, E. (2013). Resilience in Everyday Operations. Journal of Cognitive Engineering and Decision Making. doi:10.1177/1555343413498753 Built a framework for adaptive behaviour near the margins of safety, and a variety space diagram relating variability, disturbances and constraints to performance, from nine focus groups with safety staff in four domains. It shows adaptation is ordinary, while remaining an account of practice rather than a measurement.
• Provan, D. J., Woods, D. D., Dekker, S. W. and Rae, A. J. (2020). Safety II professionals: How resilience engineering can transform safety practice. Reliability Engineering and System Safety. doi:10.1016/j.ress.2019.106740 Distinguishes management through centralised control from management through guided adaptability, and reports that Safety-II has created practical difficulty because it does not settle when to reinforce alignment and when to support a frontline adaptation. It is the unit's clearest statement of the practitioner cost.
• Fairbanks, R. J., Wears, R. L., Woods, D. D., Hollnagel, E., Plsek, P. and Cook, R. I. (2014). Resilience and Resilience Engineering in Health Care. The Joint Commission Journal on Quality and Patient Safety. doi:10.1016/s1553-7250(14)40049-7 Summarises a workshop on resilience in patient safety, sets out the elements of a resilient organisation and gives examples of resilience engineering techniques applied in clinical settings. As a commentary it supplies concepts rather than an evaluation.
• Anderson, J. E., Ross, A. J., Back, J., Duncan, M., Snell, P., Walsh, K. and Jaye, P. (2016). Implementing resilience engineering for healthcare quality improvement using the CARE model: a feasibility study protocol. Pilot and Feasibility Studies. doi:10.1186/s40814-016-0103-x Sets out a feasibility study using the Concepts for Applying Resilience Engineering model in a large London teaching hospital, with ethnography followed by co-designed interventions, and an evaluation phase to be designed only once the first two phases are complete.
• Sujan, M. A., Huang, H. and Braithwaite, J. (2017). Learning from incidents in health care: Critique from a Safety-II perspective. Safety Science. doi:10.1016/j.ssci.2016.08.005 Argues that learning from incidents rests on a Safety-I definition of safety as the absence of negative events, and that organisations should study what goes right in everyday clinical work as well as what goes wrong. It is a critique of the object of learning without an evaluation attached.
• Dui, H., Liu, M., Song, J. and Wu, S. (2023). Importance measure-based resilience management: Review, methodology and perspectives on maintenance. Reliability Engineering and System Safety. doi:10.1016/j.ress.2023.109383 Reviews the definitions of importance measures, maintenance and resilience, and analyses the role of importance measures in maintenance management for improving resilience. It is the unit's evidence that the engineering side of resilience expects to compute.
• Woods, D. D. (2015). Four concepts for resilience and the implications for the future of resilience engineering. Reliability Engineering and System Safety. doi:10.1016/j.ress.2015.03.018 Groups the uses of the label around four concepts: rebound from trauma and return to equilibrium, robustness, graceful extensibility when surprise challenges boundaries, and network architectures that sustain adaptability as conditions evolve. It shows the meanings generate incompatible claims, so the field must choose one if resilience is to be measured.
• Thielmann, B., Ifferth, M. and Bockelmann, I. (2024). Resilience as Safety Culture in German Emergency Medical Services: Examining Irritation and Burnout. Healthcare. doi:10.3390/healthcare12181860 Surveyed 285 emergency medical services personnel in Germany with the RS-13 resilience scale, the Irritation Scale and the Maslach Burnout Inventory, finding 39 per cent with a low level of resilience and lower irritation and burnout scores among the more resilient. It is the unit's example of resilience measured as an individual capacity.
• Bergstrom, J. and Dekker, S. W. A. (2014). Bridging the Macro and the Micro by Considering the Meso: Reflections on the Fractal Nature of Resilience. Ecology and Society. doi:10.5751/es-06956-190422 Argues that resilience is constructed at an organisational meso level between the person and the wider system, and works through two published case studies, the Challenger launch decision and the 1994 Black Hawk shootdown over northern Iraq. It reads both as ordinary normalisation rather than rule-breaking.
• Birkeli, G., Lindahl, A. K., Hammersboen, A. M., Deilkaas, E. C. T. and Ballangrud, R. (2025). Strategies and tools to learn from work that goes well within healthcare patient safety practices: a mixed methods systematic review. BMC Health Services Research. doi:10.1186/s12913-025-12680-2 A PROSPERO-registered review that pooled 22 articles describing 16 tools for learning from work that goes well. Most tools targeted hospital staff and were welcomed, but five had never been empirically evaluated and few studies measured a patient outcome, so the operational record for Safety-II is now systematically mapped and its outcome gap confirmed.