The Folly of Safety-III

Hollnagel’s response to some of the recent (and somewhat bizarre) articles on ‘Safety-III’.

Spoiler: It’s not charitable.

I’m relying on a lot of direct quotes.

Providing context, Hollnagel argues:

· Introduction of Safety-I and Safety-II (SI / SII) to characterise two opposite means of safety was “met with surprisingly large interest” and “also with some skepticism”

· These terms, though simple, were misunderstood

· SI / SII were a modest contribution to the “slowly growing dissatisfaction with the convential interpretation of safety”

· Despite that Hollnagel “explicitly warned against drawing the conclusion that there also would or ever could be a Safety-III”, it nevertheless, though predictably, still emerged from some authors

Of course, since SII was a logical extension of SI, an SIII emerging probably is a fair expectation in principle (if people didn’t read the original source…)

SI was characterised by the focus on things that go wrong, and hence, efforts are focused towards reducing the number of things that go wrong.

SII in contrast focuses on the entire performance spectrum, but particularly emphasising the things that go right.

But despite’s Hollnagel’s warning that SIII is unnecessary, because, strictly speaking, SI/SII already covers all performance, this “warning did not prevent some, e.g., (Leveson, 2020), (Aven, 2022), and (Cooper, 2022), from addressing Safety-III, or perhaps they did not read it” (emphasis added).

Only Leveson was said to define SIII, being:

“Safety-III: The goal is to eliminate, mitigate, or control hazards, which are the states that can lead to these losses”.

Interestingly, for Hollnagel, this definition of SIII from Leveson “is a paraphrase of my definition of Safety-I” and “it contains nothing new”.

For Hollnagel, “It is really a case of the emperor having no clothes, as Cooper(2022) mistakenly argued”.

Further, Cooper failed to “distinguish between resilience engineering, Human & Organizational Performance (HOP), Safety-II and “safety differently”, mistakenly considering them as synonyms which “they clearly are not”.

It’s argued that the predominant focus on what goes wrong in SI “excludes everything else”. Hence, SII with a focus on performance that is acceptable or unacceptable, but a focus on what goes well covers everything else.

It’s argued “Safety-I and Safety-II thus do not disagree about the definition of what safety is as there can be only one: Safety is a state where as few acts as possible go wrong, i.e., lead to unacceptable outcomes”.

But they differ in how a ‘state of safety’, or perhaps the verb of creating safety via capacities, where SI focuses on reducing what goes wrong, called a decremental approach, whereas SII favours things that go well, an incremental approach.

Decremental approaches aim to reduce things, e.g. to gradually reduce something. Incremental approaches, SII, “aims to increase the number of events that lead to acceptable outcomes”.

So in all, SII, including SI, focuses on “all events regardless of their outcomes”, the entire performance distribution, whereas SI focuses primarily on the left tail of the distribution (rare and exceptional unwanted events).

Since SII includes the entire performance distribution, “there is nothing else to look at. And since Safety-II looks neutrally at all outcomes regardless of whether they are acceptable or unacceptable, there is no other way of looking at them”.

Hence, SIII makes no sense within Hollnagel’s SI/SII characterisation. Further, “There is therefore no need for a “Safety-III”, neither a Safety-IV or any higher order, nor is it logically possible since there cannot be any events that are not members of [the existing SI/SII characterisation]”.

Moreover, “Safety-II is intentionally biased toward frequent events with acceptable outcomes, but mostly to compensate for these having been traditionally neglected or excluded as being of little or no interest”.

Conclusions

In all, Hollnagel concludes that:

· “The folly of Safety-III is not proposing Safety-III as a concept, which I never did anyway, except as a hypothetical question, followed by a warning not to do it”

· “The folly is arguing against Safety-III as if it had ever been proposed, suggested, or defined. The folly is to rally against something that is just a product of stereotyped and oversimplified reasoning”

· “The folly is to give in to the practically atavistic reaction of inferring a sequence (I-II-III), where there clearly is none and where none was ever intended”

· Despite this, Hollnagel is still “bewildered when it [SI/SII] is dressed up to look like an academic argument as in Leveson (2020)”

· “The inevitable conclusion is that Safety-III not only is an as yet undefined concept but that it also is utterly meaningless and unnecessary with no value for neither current nor future safety practices”

Ref: Hollnagel, E. (2025). The Folly of Safety-III.