Safety-II and human and organizational performance

Luis Ortega, the maintenance lead at the Gainesville plant, had been at Harrowgate Foods Inc. for nineteen years. When Rachel asked him what he thought of the new spiral conveyor procedure, he said it was good, but that it would only work until the next thing changed. 'Every procedure here is written for a plant that doesn't exist,' he said. 'The ovens run hotter in summer, the flour supplier changes the bag size, a part is on back order and we use a different one. The crews make it work every day. Most days they make it work safely. Nobody asks how.'

Luis had put his finger on an idea that has reshaped safety thinking over the past two decades. Traditional safety management focuses on what goes wrong: incidents, errors and violations. A newer set of approaches, including Safety-II, resilience engineering and human and organizational performance (HOP), argues that we should spend at least as much effort understanding what goes right, because that is where most of the information is. This lesson introduces these ideas and shows how Harrowgate Foods Inc. used them.

Safety-I and Safety-II

Erik Hollnagel, a Danish psychologist who has worked on safety in aviation, health care and nuclear power, introduced the terms Safety-I and Safety-II in the early 2010s.

• Safety-I defines safety as the absence of harm: as few things as possible going wrong. It explains incidents as the result of failures or malfunctions, often human error, and it manages safety by finding and removing causes and adding barriers, rules and checks. It learns mainly from incidents.
• Safety-II defines safety as the ability to succeed under varying conditions: as many things as possible going right. It sees people's ability to adjust their work to real conditions as the main reason things usually go right, and the same variability as the reason they sometimes go wrong. It learns from everyday work, not just from failures.

Hollnagel does not argue that Safety-I is wrong. Barriers, procedures and investigations remain essential, especially for well-understood hazards like moving machinery. His point is that Safety-I alone is not enough in complex workplaces, because incidents are rare and each one teaches only a little, while successful everyday work happens thousands of times a day and is full of lessons that nobody collects.

Work as imagined and work as done

One of the most useful ideas from this school of thought is the gap between work as imagined and work as done. Work as imagined is how managers, engineers and procedure writers believe the work is carried out, based on the design, the procedure and the plan. Work as done is how the work actually happens on the floor, with the real equipment, staffing, time pressure, materials and interruptions.

There is always a gap, because no procedure can foresee every situation. Workers fill the gap with adjustments. Many adjustments are skilled and safe: using a different tool that works better, sequencing tasks to avoid a hazard the procedure missed, or helping a struggling colleague. Some drift toward danger, like skipping lockout on the spiral. Safety-I tends to treat the whole gap as non-compliance to be closed by enforcement. Safety-II treats it as information to be understood: why do people adjust, which adjustments keep work safe, and which ones signal that the system is under too much strain?

Steven Shorrock and others have added work as prescribed (the written procedure), work as disclosed (what people say they do, which may be shaped by what they think they should say) and work as observed. The more distance between leaders and the work, the more they rely on the first two, and the further their picture is from reality.

Human and organizational performance

HOP is a practical approach, developed in US industry and associated especially with Todd Conklin, that brings these ideas together into a set of principles for leaders. Different authors list them slightly differently. The five most often cited are:

• People make mistakes. Error is normal, even for the best people. The goal is not to eliminate error but to make systems that tolerate it.
• Blame fixes nothing. Blame makes people hide information and leaves the conditions that caused the error in place.
• Learning and improving is vital. Organizations should learn from everyday work and near misses, not just injuries.
• Context drives behavior. The systems, processes, pressures and conditions people work in shape what they do far more than their attitudes do.
• How leaders respond to failure matters. The response to bad news determines whether people bring the next bad news.

These principles overlap with just culture, psychological safety and leadership behaviors from earlier lessons. HOP's particular contribution is a set of tools for learning from normal work and a focus on building capacity: the ability of a system to fail safely when something goes wrong.

Building capacity to fail safely

If errors are inevitable, the question becomes: when someone makes a mistake, what stops it turning into a serious injury? HOP calls those defenses capacity. At the spiral conveyor, the redesign added capacity in several layers: a disconnect beside the machine so lockout takes seconds, an interlocked access panel that stops the conveyor if opened, a second sanitation worker on nights, and a sanitation start time moved 20 minutes earlier so the crew is not racing the restart. None of these depends on the worker never making a mistake.

Capacity thinking pushes organizations toward the higher levels of the hierarchy of controls, covered in HSE-103: elimination, substitution and engineering controls, which work even when people err, rather than administrative controls and personal protective equipment, which depend on perfect human performance.

Learning teams

The HOP tool that Harrowgate Foods Inc. found most useful was the learning team. A learning team is a small group of the people who do the work, brought together with a facilitator to understand how a task is really done, what makes it difficult and where the system could fail. It can be used after an incident, but it is most valuable before anything goes wrong.

A learning team usually meets in two or more short sessions:

• Learning session: the workers describe how the work actually happens, using open questions such as 'What makes this job hard?', 'What do you have to work around?' and 'What surprises you?' Leaders and facilitators listen and do not judge or fix.
• Soak time: a break of a day or more to let people think.
• Fix session: the group identifies where the system could fail and proposes improvements, and leaders commit to actions with dates.

Elena ran the first learning team at Harrowgate Foods Inc. on the bakery's dough mixer changeover, which had no incidents but which everyone said was 'a pain'. Six operators and two maintenance staff described a changeover that took 45 minutes on paper and 30 in practice. In the learning session, they explained the difference: the procedure required removing a heavy mixing hook with a two-person lift, but the second person was rarely available, so operators used a pry bar and a cart in a way nobody had designed. It worked, usually. The group proposed a small hoist and a hook cart, which maintenance built for less than the cost of a single shoulder injury.

Asking about normal work

Safety-II encourages leaders to ask questions about normal, successful work, not just about failures. Instead of only investigating why something went wrong, they ask why it usually goes right. Useful questions include:

• 'How do you get this done on a day when you are short-staffed?'
• 'What do experienced people know about this job that isn't written down?'
• 'When did this job almost go wrong but didn't? What saved it?'
• 'What would make this easier to do safely every time?'
• 'What has changed recently that the procedure doesn't reflect?'

Comparing learning sources

Rachel wanted to know how much the plant was learning from incidents compared with normal work. Elena compared the number of improvement actions generated over six months from each source, and how many of those actions were engineering or design changes rather than retraining or reminders.

# Improvement actions in six months, by learning source and type.
sources = {
    "Injury investigations": {"events": 9, "actions": 22, "engineering": 5},
    "Near miss reports": {"events": 140, "actions": 61, "engineering": 19},
    "Learning teams (normal work)": {"events": 6, "actions": 38, "engineering": 21},
    "Leader walk-arounds": {"events": 210, "actions": 74, "engineering": 18},
}
total = sum(v["actions"] for v in sources.values())
for name, v in sources.items():
    share = 100 * v["engineering"] / v["actions"]
    per_event = v["actions"] / v["events"]
    print(f"{name:<30} actions {v['actions']:3d} ({per_event:4.1f} per event), engineering {share:4.0f}%")
print(f"Total actions: {total}")

Injury investigations          actions  22 ( 2.4 per event), engineering   23%
Near miss reports              actions  61 ( 0.4 per event), engineering   31%
Learning teams (normal work)   actions  38 ( 6.3 per event), engineering   55%
Leader walk-arounds            actions  74 ( 0.4 per event), engineering   24%
Total actions: 195

The six learning teams produced 38 actions, more than six for every session, and more than half of them were engineering or design changes, the strongest kind of control. Injury investigations produced fewer actions and a lower share of engineering fixes, partly because investigations under time pressure tend to reach for retraining. The results convinced Rachel to fund a learning team on one task at each site every month.

Cautions

Safety-II and HOP are sometimes misread. They do not mean that rules do not matter, that anything workers do is acceptable, or that individual accountability disappears. Some rules, such as lockout and confined space entry permits, are critical and non-negotiable precisely because the consequences of variation are too severe. The value of these approaches is in understanding why people deviate and fixing the conditions, not in excusing the deviation. They also do not replace incident investigation; they add another source of learning alongside it.

In the United States, learning teams fit naturally with OSHA's recommended practices, which call for involving workers in hazard identification and in developing and evaluating controls. Involving safety committee members in learning teams strengthens both.

Using Safety-II questions in investigations

Safety-II ideas also change how incidents are investigated. Instead of asking only what went wrong and who failed, investigators ask how the work normally succeeds and what was different this time. For the spiral conveyor, that meant asking how night sanitation usually managed to clean the spiral without injury despite skipping lockout. The answers were revealing: experienced workers watched the belt direction, kept their hands outside a painted line and never reached in alone. The injured worker had been working alone that night because a colleague had called in sick. The informal safeguards that kept the shortcut from causing harm depended on two people being present, and nobody had noticed that they were a safeguard at all. Understanding that helped explain why the shortcut had seemed safe for so long, and why adding a second person on nights was part of the fix.