In brief
- Safety-I asks how harm happens and how hazards, failures and controls can be managed.
- Safety-II asks how everyday work usually succeeds under variable and pressured conditions.
- Safety-III, in the systems-theoretic sense used here, asks how systems should be designed, controlled and adapted to prevent unacceptable losses.
- These perspectives are not a simple ladder from old to new. Used well, they help us ask better and more balanced safety questions.
Why this topic matters
Safety work is shaped by the questions we ask. If we only ask what went wrong, we may miss how people usually make the system work. If we only ask what goes right, we may underplay hazards, controls and accountability. If we only focus on formal system design, we may miss how work is actually carried out in local conditions.
This is why Safety-I, Safety-II and Safety-III are useful to compare. They are not just labels. They represent different ways of noticing, explaining and improving safety. In healthcare, aviation, rail, construction, process industries and AI-enabled operations, each perspective can reveal something important, but each can also become misleading when used alone.
A practical safety conversation therefore needs balance. We need to learn from incidents and weak signals. We also need to understand everyday work, adaptation and resilience. And we need to design systems with clear constraints, feedback and responsibilities so that people are not left to compensate for poor design.
The core idea
Safety-I is the most familiar starting point. It remains essential, but it becomes limited when it treats safety only as the reduction of adverse events. It focuses on adverse events, hazards, errors, failures, non-compliance, barriers and controls. Its practical value is clear: organisations need to understand what can go wrong, prevent unacceptable outcomes, investigate incidents and maintain controls. Safety-I becomes limited when safety is treated only as the absence of reported harm, or when learning stops at finding a failed person, failed component or failed procedure.
Safety-II shifts attention to how things usually go right. It asks how people adapt to variable demand, limited resources, imperfect information, time pressure and changing conditions. This is especially important in complex socio-technical systems, where procedures cannot fully describe every situation. Safety-II helps make everyday work visible, including the gap between work-as-imagined and work-as-done.
Safety-II is commonly associated with the work of Erik Hollnagel and resilience engineering.
Safety-III is more contested as a term. For that reason, it should always be defined when used.In this resource, it refers mainly to the systems-theoretic argument associated with Nancy Leveson. From this view, safety is concerned with freedom from unacceptable losses. Accidents occur when hazards are inadequately controlled, and safety improvement requires attention to system design, safety constraints, control structures, feedback, responsibilities and coordination across levels of the system.
The important point is not to choose a favourite label. The important point is to use the right questions for the problem. A medication process, an aircraft approach, a construction task, a tram operation or an AI-supported inspection process may all need hazard analysis, learning from everyday work and systems thinking about control and feedback.
A practical comparison
Swipe horizontally to view full table.
| Perspective | Main question | What it helps you notice | Useful for | Watch out for |
|---|---|---|---|---|
| Safety-I | What can go wrong, and how can harm be prevented? | Hazards, failures, incidents, controls, barriers, compliance and loss scenarios. | Hazard analysis, incident investigation, assurance, control monitoring and learning from harm. | Reducing safety to low incident counts, blame, or simple “find and fix” explanations. |
| Safety-II | How does work usually succeed under variable conditions? | Adaptation, resilience, trade-offs, work-as-done, performance variability and local expertise. | Understanding everyday work, improving procedures, strengthening operational learning and supporting frontline performance. | Becoming too vague, romanticising adaptation, or shifting responsibility onto frontline workers without improving the system around them. |
| Safety-III | What system constraints and feedback are needed to prevent unacceptable losses? | Control structures, feedback loops, responsibilities, system boundaries, unsafe interactions and emergent hazards. | System safety, STPA, safety assurance, design of complex systems and analysis of socio-technical control. | Using the term without defining it, or treating system models as complete representations of messy operational reality. |
How these perspectives change the conversation
After an incident, a Safety-I question might ask which controls failed, which hazards were present and what barriers need strengthening. A Safety-II question might ask how the work is usually made to succeed, what adaptations were normal, and why the same adaptations sometimes help and sometimes create vulnerability. A Safety-III question might ask which feedback was missing, which safety constraints were not enforced, and how the wider system allowed the hazardous state to develop.
During routine improvement work, Safety-I may support audits, risk assessments and control checks. Safety-II may support observations, conversations about work-as-done, after-action reviews and learning from successful recovery. Safety-III may support redesign of responsibilities, information flows, interfaces and escalation paths.
When introducing new technology, the three perspectives are particularly useful together. Safety-I asks what new failure modes or hazards may be introduced. Safety-II asks how people will actually use, adapt to and work around the technology. Safety-III asks how the whole control structure changes: who has authority, who receives feedback, what happens in degraded modes, and how unsafe interactions will be controlled.
Using the perspectives together
A balanced safety review can start with three simple questions. First, what are we trying to prevent? This keeps attention on hazards, controls and unacceptable outcomes. Second, how does the work normally succeed? This brings in everyday performance, local adaptation and the gap between policy and practice. Third, what does the system need to make safer performance easier? This moves the discussion towards design, feedback, resources, coordination and governance.
Useful prompts
- What does the procedure assume about time, staffing, equipment, information and coordination?
- Where does everyday work differ from the written version of work?
- Which adaptations are helpful, and which adaptations are warning signs?
- What feedback do decision-makers receive, and what feedback is delayed, filtered or missing?
- What system conditions would make the safe action the easiest action?
This approach avoids a false choice between learning from failure and learning from success. Serious incidents still matter. Controls still matter. At the same time, safety is also created through ordinary work: monitoring, coordination, anticipation, recovery and adjustment before harm occurs.
Common misunderstandings
One misunderstanding is that Safety-II replaces Safety-I. It does not. A healthcare organisation still needs incident reporting, risk assessment and control of known hazards. An airline still needs stable approach criteria, go-around policies and investigation processes. A construction site still needs basic controls for falls, lifting operations and energy isolation.
Another misunderstanding is that Safety-II simply means “celebrating success”. Its real value is deeper than that. It asks how successful performance is produced, what pressures people manage, what trade-offs they make, and what support they need. If Safety-II becomes a slogan without careful observation and evidence, it loses its practical value.
A third misunderstanding is that Safety-III is universally defined. It is not. The strongest and most developed use of the term comes from a systems-theoretic view of safety. Because the term is still debated, it should be used with a clear explanation of what is meant.
Limitations and cautions
These perspectives are useful, but the labels can become distracting. Practical safety work should not be reduced to arguing whether something is Safety-I, Safety-II or Safety-III. The better question is: what does this perspective help us see, and what might it hide?
Safety analysis also needs to fit the nature of the work. Some activities are highly standardised and benefit from tight control. Others are complex, adaptive and uncertain, requiring more attention to judgement, coordination and recovery. Many real systems contain both. A good safety approach should be sensitive to that mixture.
Finally, adaptation should not be used as an excuse for weak design. People often create safety by adjusting to local conditions, but they should not have to rescue the system continuously. The goal is to design and manage systems in which safe performance is supported, visible and sustainable.
Related publication(s)
- Kaya, G.K., Humphreys, M., Camelia, F. and Chatzimichailidou, M. (2025). Integrating causal analysis based on system theory with network modelling to enhance accident analysis. Ergonomics. 1-28. DOI: 10.1080/00140139.2025.2516060.
- Kaya, G.K. A system safety approach to assessing risks in the sepsis treatment process. Applied Ergonomics. 94, 103408. DOI: 10.1016/j.apergo.2021.103408.
- Kaya, G.K., Stallard, R., St-Laurent, M., Li, W.-C. and Sujan, M. (2026). Exploring unstable approaches in aviation: utilising functional resonance analysis method. The Aeronautical Journal. 130(1345):917-943. DOI: 10.1017/aer.2025.10108.
- Kaya, G.K., Ovali, H.F. and Ozturk, F. (2019). Using the functional resonance analysis method on the drug administration process to assess performance variability. Safety Science, 118, 835–840. DOI: 10.1016/j.ssci.2019.06.020.
- Losi, E., Kaya, G.K., Camelia, F., Chatzimichailidou, M., Slater, D.H., Patriarca, R. and Sujan, M. (under revision). Systemic safety analysis of complex socio-technical events: insights from applying CAST and FRAM. Reliability Engineering & System Safety. Publication details forthcoming.
Selected references
- Aven, T. (2022). A risk science perspective on the discussion concerning Safety I, Safety II and Safety III. Reliability Engineering & System Safety, 217, 108077. DOI: 10.1016/j.ress.2021.108077.
- Hollnagel, E. (2012). FRAM: The Functional Resonance Analysis Method: Modelling Complex Socio-technical Systems. Ashgate.
- Hollnagel, E. (2014). Safety-I and Safety-II: The Past and Future of Safety Management. Ashgate.
- Leveson, N.G. (2020). Safety III: A Systems Approach to Safety and Resilience. MIT Engineering Systems Lab.
- Martins, J.B., Carim Jr., G., Saurin, T.A. and Costella, M.F. (2022). Integrating Safety-I and Safety-II: Learning from failure and success in construction sites. Safety Science, 148, 105672. DOI: 10.1016/j.ssci.2022.105672.
- Provan, D.J., Woods, D.D., Dekker, S.W.A. and Rae, A.J. (2020). Safety II professionals: How resilience engineering can transform safety practice. Reliability Engineering & System Safety, 195, 106740. DOI: 10.1016/j.ress.2019.106740.
- Steen, R. and Johnsen, S.O. (2026). A maturity model for accident investigation: beyond technical and functional analysis. Safety Science, 196, 107108. DOI: 10.1016/j.ssci.2025.107108.
- Woodward, S. (2019). Moving towards a safety II approach. Journal of Patient Safety and Risk Management, 24(3), 96–99. DOI: 10.1177/2516043519855264.