An introduction to incremental safety

Our summary

Erik Hollnagel, ever prolific with the metaphors that have left a lasting mark on safety management, offers a new framing — and a new buzzword — to guide us along the path of what he recommends for safety.

This path is built on three main observations: 

• to reframe the misunderstandings of Safety I and Safety II,
• to abandon concepts that lack operational meaning (such as safety culture),
• and to think of resilience through an incremental logic.

Thus, a new overarching concept is born: incremental safety.

First observation (a bitter one for the author): correcting the many misunderstandings that have arisen around the previous buzzword, Safety I and Safety II

With hindsight, the terms “Safety I” and “Safety II” have fueled confusion about the possible existence of several kinds of safety. This confusion has even led some authors (Leveson, 2020; Aven, 2022; Cooper, 2022) to mistakenly conclude that there might also be a “Safety III”.

Being safe therefore means being free from or protected against harm or injury, whether actual (occurring here and now) or potential (likely to occur at some point in a foreseeable future).

The proper interpretation is that Safety I and Safety II represent different ways of achieving this state of safety, rather than different definitions of safety itself. 

In this logic, Safety I corresponds to a decremental approach (Hollnagel, 2026), in which the goal is to minimize unexpected and unacceptable outcomes — an approach associated, as Hollnagel reminds us, with the popular yet utterly unrealistic vision of zero accidents.

Safety II seeks a state of safety defined as one in which there are as many expected and acceptable outcomes as possible — an incremental approach, corresponding to an incremental safety culture. Hollnagel also points out that incremental safety carries with it an equally unattainable ideal — that everything goes well..

He therefore emphasizes that the two approaches are, of course, complementary and not antagonistic.

Second observation: escaping the conceptual void created by the notion of safety culture

Safety culture has become a convenient concept to explain problems that can no longer be accounted for by human error or technical failure.

The author reminds us that the concept emerged in the wake of the major catastrophes of the 1980s (TMI, Bhopal, Challenger, etc.), for which the “usual” causes — human error and technical error — no longer seemed sufficient to explain why the accidents occurred. These catastrophes marked the beginning of the third era of safety, that of safety management, in which organizational failures became the default explanation for accidents.

It is worth recalling that the search for (new) causes or explanations of accidents, in order to eliminate them, traces back to Heinrich’s historical work, which was based on three key ideas:

1. A result can always be attributed to a specific cause;
2. It is possible to find or determine what that cause was or is (provided that enough data, time, and effort are invested); ;
3. Eliminating the cause will effectively prevent the result from recurring.

According to Hollnagel, in order to make safety culture operational within an organization — and to use it meaningfully as an explanatory framework — one would need to have three types of knowledge:

Erik Hollnagel observes that none of these three objectives can be achieved by using safety culture as the key to explaining accidents.

• Knowing one’s position is impossible. 

Safety, like risk, is a social construct (Searle, 1992). It represents a set of ideas shared by a number of people. Truth, trust, and resilience are other common examples of social constructs, as they have no obvious physical reality. A social construct cannot be measured or counted. There simply exists no unit of measurement for safety, nor for safety culture, and no meaningful scale can be conceived. There is also another reason: the paradox that safety is defined by its absence rather than by what happens when it is present, as James Reason highlighted. Thus, when an accident occurs, people are quick to conclude that it was caused by a lack of safety or a lack of safety culture. Yet it is obviously impossible to measure something that does not exist.

• Managing the trajectory one wishes to impose on safety culture is an illusion. 

• Often, one only knows what one does not want, and the means to “steer” the culture are largely absent.

Just as for physical movement, like driving a car on a highway, one can effectively control speed and direction because the necessary tools have been designed for easy use, nothing comparable exists for a journey centered on safety culture. Maturity curves of safety culture (such as the DuPont Bradley curve) reflect social judgments rather than operational criteria. No company continuously measures the workplace accident rate it is supposed to represent. Nor are there lower or upper thresholds for the four proposed maturity stages. For Hollnagel, these are simply visually appealing representations of the widespread idea that safety culture evolves in distinct phases, but none of them support the three types of knowledge mentioned above.

Finally, simplicity remains the enemy of reality when it comes to managing culture. Whatever the maturity of the safety culture, it remains a multifaceted phenomenon that cannot be triggered and managed by simple means, such as leadership. Trivial or simple problems may indeed have trivial or simple solutions, but non-trivial or complex problems — such as safety culture maturity — invariably require non-trivial or complex solutions. Offering a simple solution, like leadership, to a complex problem, like safety culture maturity, does not magically simplify the problem; it simply ensures that the solution will not work.

If one were to retain the concept of safety culture despite these limitations, it would be preferable to focus on fostering an incremental culture rather than a decremental one.

If decremental and incremental safety denote different approaches to achieving a state of safety “where unexpected and unacceptable outcomes are minimized”, then decremental and incremental safety cultures refer to the corresponding sets of artifacts, assumptions, and values that, according to Schein (1992), constitute an organizational culture. Each of these two cultures can be characterized by a few key points:

• For a decremental safety culture, it is important to constantly focus on unacceptable outcomes, count the number of failures and unsuccessful results, and widely publicize them; to worry about potential problems in the future; to investigate events in the simplest possible way; to systematically prioritize rigor over efficiency; and not to seek to communicate or validate lessons learned. In the event of a problem, the people on the front line are blamed.
• To develop an incremental, progressive safety culture, one must do things very differently: foster and support a visionary mindset — that is, the attitude that, with diligence, every action can in principle lead to acceptable outcomes. Successful work should be recognized and repeated; everyone should strive to remember what they have done and share it with colleagues. Learning focuses on what should be done rather than what should not be done. Management must use clear messaging and encourage a shared spirit of initiative. One should not fear trying new solutions, nor forget to inform others so that they know what to expect. One must act rigorously, always in accordance with conditions, strive to optimize resources and opportunities, and encourage interpersonal exchanges and feedback.

Third observation: if the concept of safety culture is abandoned, resilience is the only alternative to pursue

For Erik Hollnagel, the only viable alternative to the concept of safety culture maturity is resilience, defined not as a quality in itself, but as a characteristic type of performance: "A resilient system is defined by its ability to adjust its functioning effectively before or after changes and disruptions, so that it can continue to operate after a major disturbance or incident, and in the presence of ongoing constraints" (Hollnagel, 2008). Resilience thus goes far beyond simply overcoming fragility and expanding smoothly.

It is built on four systemic capacities/pillars:

Conclusion: the author’s parting piece of sage advice

Beyond the maturity of safety culture, it makes sense — both practically and ethically — for most organizations to improve their safety, defined as “a state in which unexpected and unacceptable outcomes are minimized as much as possible”. The solution lies in taking a closer look at the four systemic potentials described above and developing ways to enhance them, not individually, but as an integrated whole.

This holistic approach, based on the four systemic potentials and thus on a progressive safety culture, provides the three types of knowledge outlined earlier.