Safety Management System

From protection to resilience: Changing views on how to achieve safety

Erik Hollnagel Ecole des Mines de Paris, CRC, Sophia Antipolis, France

Abstract Effective safety management requires the ability to learn from the past and to anticipate the future. Yet what we can learn from the past (i.e., accident investigation) and what we can imagine for the future (i.e., risk assessment) depends critically on how we think about it, i.e., the models and methods we have at our disposal. Accident investigations have long been dominated by a search for causes, either as root causes or human errors. Risk assessment has similarly been dominated by static representations such as event and fault trees. In both cases the commonly used models and methods have reached their limits because the reality of our self-created socio-technical environments has become too complex. The alternative is to understand how the variability of human actions is a resource rather than a threat and to define safety as a system’s resilience, its ability to adapt and adjust, rather than as the absence of adverse outcomes. Introduction Even in the best of all possible worlds, the future is not completely predictable. Events are bound to occur for which we are not prepared, some with positive and some with negative outcomes. Although there are very few situations where things go wrong compared to the very many where things work out fine and where the outcomes are as intended – or at least acceptable under the circumstances – the positive cases tend on the whole to go unnoticed. When the outcome of a task or an activity is acceptable, there is little motivation to look for why that was so; it is simply taken for granted – and even considered normal – that things go right. Conversely, when something goes wrong a relentless hunt for the cause(s) begins, in order to ensure that such an event never happens again. Unless we are willing to treat adversity with Panglossian optimism we must, of course, find some...