Editorials | 645
8. Flin R, Fioratou E, Frerk C, Trotter C, Cook TM. Human factors 13. Patterson ES, Cook RI. Behind human error: taming complex-
in the development of complications of airway management:
preliminary evaluation of an interview tool. Anaesthesia 2013;
68: 817–25
9. Stiegler MP, Ruskin KJ. Decision-making and safety in anes-
thesiology. Curr Opin Anaesthesiol 2012; 25: 724–9
10. Stiegler MP, Neelankavil JP, Canales C, Dhillon A. Cognitive
errors detected in anaesthesiology: a literature review and
pilot study. Br J Anaesth 2012; 108: 229–35
11. Flin R, Patey R, Glavin R, Maran N. Anaesthetists’ non-
technical skills. Br J Anaesth 2010; 105: 38–44
12. Marshall SD, Mehra R. The effects of a displayed cognitive aid
on non-technical skills in a simulated ‘can’t intubate, can’t
oxygenate’ crisis. Anaesthesia 2014; 69: 669–77
British Journal of Anaesthesia 115 (5): 645–7 (2015)
Advance Access publication 14 July 2015 . doi:10.1093/bja/aev216
A new view of safety: Safety 2
D. R. Ball1 and C. Frerk2,*
1
Department of Anaesthesia, Dumfries and Galloway Royal Infirmary, Bankend Road, Dumfries DG1 4AP, UK, and
2
Department of Anaesthesia, Northampton General Hospital, Billing Road, Northampton NN1 5BD, UK
*Corresponding author. E-mail: chris.frerk@ngh.nhs.uk
Primum non nocere (first do no harm) is a priority for our practice,
and nowadays safety is under constant scrutiny by patients,
politicians, and the press. This is increasingly recognized by
our profession, and articles with a focus on risk and safety are
starting to appear in UK anaesthetic journals.1 2
Safety is a concept that we intuitively believe we under-
stand but is difficult to define. A suitable definition might be
‘the control of recognized hazards to achieve an acceptable
level of risk’. A system is evidently not safe when an episode
of harm has occurred (e.g. wrong-site surgery), but a system
cannot be deemed to be safe simply because an adverse
event has not occurred recently. The longer a team, depart-
ment, organization, or service goes without anything going
wrong, the more likely it is that the people managing it and
working within it believe it to be safe, but this is not necessarily
true. While safe systems will usually go for long periods with-
out adverse events, this can also occur by chance in unsafe sys-
tems, and superficially, it is not possible to distinguish between
the two. Health care is continually being pushed to improve,
not only in terms of safety, but also with increased efficiency
and economy. This invokes the law of stretched systems,
where ‘every system is stretched to operate at its capacity
and as soon as there is some improvement, for example in
the form of new technology, it will be exploited to achieve a
new intensity and tempo of activity’. 3 Increased efficiency
eats silently and progressively into safety margins without us
noticing, and after a while operating within this increasingly
risky environment we are caught out by an adverse event oc-
curring within the system that we thought we understood.
Health-care organizations then immediately increase their
focus on safety, investigations follow, and we offer assurances
that lessons will be learned.
Downloaded from https://academic.oup.com/bja/article-abstract/115/5/645/230434
by PNNL Technical Library user
on 17 April 2018
ity to improve patient safety. In: Carayon P, ed. Handbook of
Human Factors and Ergonomics in Health Care and Patient Safety.
Mahwah, NJ: Lawrence Erlbaum Associates, 2007; 459–76
14. Cuvelier L, Falzon P. Resilience as resource-based design
of anticipated situations. In: Proceedings of the fourth
Resilience Engineering Symposium (June 8–10, 2011). Sophia
Antipolis: 2011; 72–8
15. Cuvelier L, Falzon P, Granry JC, Moll MC. Managing un-
foreseen events in anesthesia: collective trade-off between
“understanding” and “doing”. Work 2012; 41: 1972–9
16. Moloney J. Error modelling in anaesthesia: slices of Swiss
cheese or shavings of Parmesan. Br J Anaesth 2014; 113: 905–6
Established models of accident investigation are generally
based on cascade or domino models of the serial, sequential wor-
sening of an incident into an accident. Heinrich4 first presented
this notion in his book ‘Industrial Accident Prevention’ in 1931,
with five falling dominoes, one being ‘human error’. James Rea-
son’s popular and influential ‘Swiss cheese model’ of accident
evolution invokes a similar idea, with the concept of breaches
in various defences (cultural, organizational, and personal) al-
lowing propagation of an incident into an accident.5 6 These are
essentially linear narratives, based on what Hollnagel calls a
‘causality credo’.7 8 The main assumption in these analyses is
that the event under review occurred in a system that is capable
of deconstruction to its composite parts, and that it is describable
and understandable as a culmination of a number of identifiable
factors, which form a stepwise narrative. These models are
superficially simple and satisfying, appealing to our desire to dis-
cover causation and perhaps culpability in the aftermath of a dis-
tressing event. A key feature in this form of enquiry is that ‘work
as done’ deviated from ‘work as imagined’.7 8 Work as done refers
to the practical and pragmatic way that tasks are achieved ‘at the
sharp end’, where approximations and adjustments are continu-
ally made in order to achieve desired outcomes and there is
necessary variation in activity between groups or individuals per-
forming similar tasks in varying conditions. In this model, errors
are continually prevented, detected, and managed using a mix-
ture of proactive and reactive strategies. Work as imagined has
a different perspective, a key feature of which is that minimal
variation in process is expected and that there is one correct
way to achieve an outcome. This is often perceived to be the pre-
siding view of those ‘at the blunt end’ and is reflected in the vast
arrays of protocols and policies that populate health-care intra-
net sites.
 646 | Editorials
Investigations into incidents and accidents typically identify
human errors based on work as imagined. These retrospective
reviews are subject to hindsight bias; reports are tailored to fit a
linear narrative, and action plans are produced with lists of re-
commendations. This is known as ‘solutionism’, where there is
a belief that problems have easy answers, often of a technical na-
ture.9 This is a key part of ‘Safety 1’ culture, which is the generally
dominant paradigm in health care. As attention is solely directed
at reported or discovered mistakes, only negative outliers in
performance are identified. This is based on the notion of the
‘just world’ hypothesis,10 where a culture of ‘name, blame, and
shame’11 is prevalent and societal pressure to assign account-
ability to individuals continues.
We work in an environment where proscriptive lists of ‘never
events’ are compiled,12 and many safety and quality indicators
are published and publicized (there were more than 100 in a
2009 systematic review).13 Whilst calls to improve safety and re-
duce risk are laudable, most are based on the mantra of work as
imagined, and the practical, achievable improvements remain
elusive.
In the 21st century, our work has become sufficiently complex
as to defy simple analysis of many of the events that befall our
patients. Incidents are no longer tractable or decomposable,
even when subjected to exhaustive analysis.7 8 This is beginning
to be understood in other critical safety industries; for example,
when describing a series of battery fires afflicting the Boeing
787 ‘Dreamliner’ aircraft, Hans Weber, formerly a Federal
Aviation Authority advisor admitted that [after 250,000 flight
hours] ‘. . . we don’t know yet the root cause or causes’.14 Health
care, meanwhile, still demands a root-cause analysis and action
plan within 60 days,15 not accepting that the system from which
the accident emerged is often too complex to discover the real
truth that quickly, if at all.
Charles Perrow recognized that an appreciation of complexity
is key to understanding outlier events. His model of ‘normal acci-
dents’16 emphasizes that en route to an accident there are mul-
tiple design and equipment failures, the majority of which had
not been considered to be problematic until after the accident
occurred. Importantly, he identified ‘negative synergy’, explain-
ing that coupling of equipment, design, and human error leads
to far greater consequences than each taken in isolation and
that when complexity and coupling reach critical, unsustainable
levels, accidents will inevitably occur.
Uneventful safe work usually attracts little attention (as a re-
sult of the basic psychological trait of habituation). Humans are
primed to respond to novelty, such as an unanticipated failure.
Failure is what Safety 1 culture studies; it sees the bad, but is
blind to the good. New ways of looking at safety and risk are
emerging, drawing once again from thinking in the aviation
and nuclear industries. The study and promotion of success in
complex ‘sharp end’ working is called ‘Safety 2’. At its heart is
the notion of resilience engineering.17 Resilience is a form of
toughness, a mixture of proactive defence coupled with reactive
response such that most errors are prevented, avoided, or cap-
tured. Resilience enables adaptation to change and endurance
during adversity. Hollnagel, a leading exponent of this approach,
emphasizes that resilience needs anticipation of threats and
opportunities, flexible responses to changing demands, and con-
tinual learning from both good and bad performance. With this
thinking comes a realignment from a preoccupation with failure
to the promotion of success, from Safety 1 to Safety 2; this is re-
silient health care.18 Safety 1 and Safety 2 are not antagonistic,
but complementary approaches; Safety 1 investigates the
Downloaded from https://academic.oup.com/bja/article-abstract/115/5/645/230434
by PNNL Technical Library user
on 17 April 2018
detrimental outliers, while Safety 2 considers the rest, including
those who excel.
The Safety 2 approach recognizes that we work in a sociotech-
nical system.19 This term tells us that we, our colleagues, our pa-
tients, and the technologies we use are crucially linked and
interdependent and that the human contribution is inseparable
from the whole. Every system contains domains of complexity,
risk, uncertainty, dynamism, and emotion, and each new day
brings about unique collections of interactions, mostly non-
linear, meaning that both good and bad outcomes are emergent
phenomena within a complex system, which are not amenable to
a full description of causation.20 Whilst anaesthesia has shown
consistent improvements in safety21 and is cited as a model for
health care,22 continual increases in demand and expectation
place unprecedented challenges on us. Successful, safe work in
this environment requires a high degree of flexibility and adapt-
ability, with staff constantly having to make real-time trade-offs
between efficiency and thoroughness.23
Hudson described three waves of industrialization: technical,
system, and culture waves.24 The first looked at machines and
mechanism, where causation was seen as simple and linear. Ma-
chines broke down and were fixed, more men were hired and im-
provements in design and manufacture reduced failure. This
approach developed in response to the demands of the Industrial
Revolution and was the dominant perspective for more than 150
years. The second wave, that of human factors, started in the
1960s. Building on the first, this looked at the human contribu-
tion, and with an emphasis on Safety 1, still holds sway in
many working cultures, including health care. We are now enter-
ing the third wave of systems, of organizational safety, where lin-
ear narratives are most often unhelpful. This age appreciates our
work in the context of a sociotechnical system and underpins the
Safety 2 approach.
Managing demand and expectation in health care is one of the
hard problems that continues to tax those who devote entire ca-
reers to it. In recognizing that the complexity of our work has
brought about fundamental change for us, Safety 2 is a way for-
ward. The message is simple and important, giving us a way of
dealing with the challenges of life and work: ‘study success, not
just failure’.
The key to understanding success is to recognize the import-
ance of allowing the workforce to be flexible, innovative, and
adaptable. The same qualities (flexibility, innovation, and adapt-
ability) will, however, lead to failure in different circumstances.
National strategies to promote success should be developed
and promoted, with a rebalancing of effort from a reactive Safety
1 to a proactive Safety 2 culture. Information systems must be
developed to identify good performance more easily.25 Visits to
centres with demonstrably good outcomes could help us to re-
view how this has been achieved and may enable us to share
best practice and drive up standards by learning not only what
others do but also how they do it.
At a departmental level, this way of looking at safety is some-
thing that we can all start to put into practice immediately. We
should begin by examining our current systems, looking at the
whole, including both things that go right and things that go
wrong. We need to recognize that we are all continually making
adjustments within our systems to create safety and balance
risks. We must examine our practices dispassionately and hon-
estly to understand where gaps exist between work as imagined
and work as done, particularly when systems appear to be work-
ing well, and start to consider which gaps and adjustments in-
crease the benefits more than the risks.

Morbidity and mortality meetings should include ‘safety and
success’ sections, where outliers in good performance are ac-
knowledged and discussed. Morbidity and mortality should con-
tinue as part of Safety 1, while system functioning should be
examined as part of Safety 2, where excellent performance can
be studied and used as an opportunity to improve safety. Adjust-
ments and ‘work as done’ should be acknowledged, and variation
should be accepted and embraced, examining both things that go
right and things that go wrong. Only then will we genuinely start
moving in the direction of resilience and safety.
Acknowledgements
We thank Dr B. Vowles, Dr N. Cassells and Dr S. Hillier for their
advice and expertise during preparation of this manuscript.
Declaration of interest
None declared.
References
1. Irwin MG, Kong VKF. Quantifying and communicating peri-
operative risk. Anaesthesia 2014; 69: 1299–303
2. Moloney J. Error modelling in anaesthesia: slices of Swiss
cheese or shavings of Parmesan. Br J Anaesth 2014; 113: 905–6
3. Woods DD. Steering the Reverberations of Technology
Change on Fields of Practice: Laws that Govern Cognitive
Work. Available from http://www.lrdc.pitt.edu/schunn/
cogsci2002/program/plenaries/woods.pdf (accessed 21
December 2014)
4. Heinrich HW. Industrial Accident Prevention: A Scientific
Approach. Columbus: McGraw-Hill, 1931
5. Reason JT. Human Error. Cambridge: Cambridge University
Press, 1990
6. Reason J. Human error: models and management. Br Med J
2000; 320: 768–70
7. Hollnagel E. Safety 1 and Safety 2. The Past and Present of Safety
Management. Farnham: Ashgate Publishing, 2014
8. Hollnagel E, Leonhardt J, Licu T, Shorrock S. From Safety-I
to Safety-II – a white paper. Available from http://www.
skylibrary.aer/bookshelf/books/2437.pdf (accessed 21
December 2014)
9. Morozov E. To Save Everything, Click Here.Technology, Solutionism
and the Urge to Fix Problems That Don’t Exist. London: Allen
Lane, 2013
Downloaded from https://academic.oup.com/bja/article-abstract/115/5/645/230434
by PNNL Technical Library user
on 17 April 2018
Editorials | 647
10. Lerner MJ. The belief in a just world. In: The Belief in A
Just World. A Fundamental Delusion. Perspectives in Social
Psychology. London: Springer Verlag, 1980; 9–30
11. Heard G. Errors in medicine: a human factors perspective.
Australasian Anaesthesia 2005; Available from http://www.
anzca.edu.au/resources/college-publications/pdfs/books-and-
publications/Australasian%20Anaesthesia/australasian-
anaesthesia-2005/05_Heard.pdf (accessed 21 December
2014)
12. Adyanthaya SS, Patil V. Never events: an anaesthetic perspec-
tive. Contin Educ Anaesth Crit Care Pain 2014; 14: 197–201
13. Haller G, Stoelwinder J, Myles PS, McNeil J. Quality and safety
indicators in anesthesia. a systematic review. Anesthesiology
2009; 110: 1158–75
14. Scott A. Boeing 787 receives U.S. approval for expanded flying.
Available from http://www.articles.chicagotribune.com/2014-
05-28/business/sns-rt-us-usa-boeing-faa-20140528_1_787-
dreamliner-etops-faa (accessed 21 December 2014)
15. NHS England. Serious Incident Framework. Supporting
learning to prevent recurrence. Available from http://www.
england.nhs.uk/wp-content/uploads/2015/04/serious-incidnt-
framwrk-upd.pdf (accessed 10th April 2015)
16. Perrow C. Normal Accidents. Living with High Risk Technologies.
Princeton: Princeton University Press, 1984
17. Hollnagel E, Pariès J, Woods DS, Wreathall J. Resilience
Engineering in Practice. A Guidebook. Farnham: Ashgate Pub-
lishing, 2010
18. Hollnagel E, Braithwaite J, Wears RL. Resilient Health Care.
Farnham: Ashgate Publishing, 2014
19. Cooper R, Foster M. Sociotechnical systems. Am Psychol 1971;
26: 467–74
20. Funtowicz S, Ravetz JR. Emergent complex systems. Futures
1994; 26: 568–82
21. Mellin-Olsen J, Staender S, Whitaker DK, Smith AF. The Hel-
sinki Declaration on patient safety in anaesthesiology. Eur J
Anaesthesiol 2010; 27: 592–7
22. Gaba DM. Anaesthesiology as a model for patient safety in
health care. Br Med J 2000; 320: 785–8
23. Hollnagel E. The ETTO Principle. Efficiency–Thoroughness Trade-
Off. Why Things That go Right Sometimes go Wrong. Farnham:
Ashgate Publishing, 2009
24. Hudson P. Implementing safety culture in a major multi-
national. Safety Science 2007; 45: 697–722
25. Cook TM, Coupe M, Ku T. Shaping quality: the use of perform-
ance polygons for multiprofessional presentation and inter-
pretation of qualitative performance data. Br J Anaesth 2012;
108: 953–60