Safety I: The "Absence of Bad"
The traditional view of safety, dominant in engineering and operations for decades.
- Definition: Safety is a state where as few things as possible go wrong.
- Method: Study accidents. Find what broke. Fix or eliminate it.
- View of humans: Humans are a liability. They introduce variability and error. Safety is achieved by constraining human behavior with rules, checklists, and automation.
- Metric: Number of incidents. Lower is better.
Safety I is not wrong — it produces real improvements. But it has a fundamental blind spot: it only learns from failure. It cannot explain why the system works.
Safety II: The "Presence of Good"
The modern view, developed by Erik Hollnagel and colleagues in the field of Resilience Engineering.
- Definition: Safety is a state where as many things as possible go right.
- Method: Study normal work. Why does the system succeed 99.9% of the time despite constant glitches, ambiguous requirements, and imperfect tooling?
- View of humans: Humans are a resource. They are flexible, adaptive, and creative. They constantly bridge the gap between how the process was designed and how reality actually behaves — and that bridging is what keeps the system running.
- Metric: Understanding of the system's resilience capabilities, not just its failure modes.
The Practical Difference
| Dimension | Safety I | Safety II |
|---|---|---|
| Focus | Failures and accidents | Normal, everyday work |
| Human role | Source of error | Source of resilience |
| Learning method | Post-incident analysis | Continuous observation |
| Goal | Eliminate bad outcomes | Amplify successful adaptation |
| Risk of | Missing systemic fragility | Harder to measure progress |
In Safety II, we study the 99.9% of successful days to understand the system's resilience capabilities. The question is not "what went wrong?" but "what goes right, and how can we protect and amplify it?"
A common SRE interview question is: "How do you build a culture of blameless post-mortems?" Most candidates describe removing blame from the process. A stronger answer connects this to Safety II: blameless post-mortems work because they treat humans as adaptive resources (Safety II), not error sources (Safety I). The goal is to understand the conditions that made the failure possible, not to identify the person who triggered it.