Safety I and Safety II: What Does It Mean to Be Safe?

Consider the question: What makes a system “safe”?

For decades, aviation has defined safety as the absence of mishaps. We measure success by tracking the number of specified events over a specified period of time. For example, Air Mobility Command (AMC) had zero fatal air mishaps in 2025. Using this metric, which assumes safety comes from maintaining an acceptably low number of adverse events, the command appears safer than American Airlines, which in January 2025 experienced a fatal mishap over the Potomac River. 

However, this traditional way of thinking has limits. With complex airspace, advanced aircraft, and ever-evolving mission expectations, modern flight environments involve dynamic interactions and considerable unpredictability. Unfortunately, the safety systems that evolved in the mid-twentieth century remain rigid and are unsustainable in the modern world. Therefore, we must shift our perspective from focusing solely on why things go wrong to understanding why things so often go right.

The World of Safety I: Finding and Fixing

Safety I, the traditional safety management model, has dominated aviation since the early days of flight. When the concept was developed, aircraft were simple, and the operational environment lacked complexity and interdependence. At its core, Safety I operates under a simple directive: understand what went wrong and stop it from happening again.

This directive makes several assumptions about the chain of events leading to a mishap, including that events can be viewed as a “cable link chain.” In this view, an event can be deconstructed into core parts that occur one after another, leading directly to an adverse outcome. These links appear in a bimodal manner: they either work or fail. When a link fails, the mishap is primarily the output of that failure which caused cascading failures further down the chain. From this perspective, a mishap investigation only needs to find the broken link to fix the chain and prevent a future mishap.

Have you seen this “find and fix” chain metaphor in the safety world?

Downstream consequences of the “find and fix” mindset include:

1. Safety begins with a mishap. The “find and fix” mentality necessarily waits for an adverse event to occur before analysis begins. This consequence is most apparent for preventing mishap recurrence, but also applies to proactive safety models where a deviation, warning light, or other event kickstarts analysis.
2. Variability is seen as a threat. Systems are designed for specific actions and functions. Deviations from “work as imagined” increase variability and therefore the risk of an adverse event.
3. The greatest lessons come from the worst events. Large deviations from “work as imagined” produce outcomes far from intended safe mission completion. Thus, the worst mishaps are treated as the most important learning opportunities.
4. Humans are liabilities. The variability of human performance is viewed as a threat to safety and must be reduced. The prevalence of “human error” in training and investigations demonstrates these concerns.

Critically, Safety I has led to remarkable improvements in aviation design, maintenance, training, and performance. By leveraging a Safety I perspective, the Air Force Safety Center has reduced fatal mishaps to an all-time low. However, the consequences of a Safety I mindset place a lower limit on its effectiveness as more advanced technologies and tactics are incorporated. Stated another way, as systems become more complex, mishaps become rarer, and events to analyze become fewer. Eventually, we will see a decreasing marginal usefulness of Safety I efforts. This is where an expanded focus becomes necessary.

The Expansion to Safety II: Making Good Things Happen

Introduced by Professor Erik Hollnagel,[1] Safety II offers a different paradigm. It redefines safety not as the absence of accidents, but as the ability to succeed under varying conditions. Instead of asking why things go wrong, Safety II asks: Why do things go right almost all the time?

This approach recognizes that the mission environment, aircraft, and crew interactions make up a complex system in which small changes in one domain can have unintended effects in another. In a Safety II world, mission success does not depend on rigid adherence to procedures but on skilled aircrew who adapt to meet the changing nature of the environment. Under this concept, variability is neither good nor bad; it must be monitored to ensure your mission system (aircraft, crew, and environment) remains within control.

Adopting a Safety II mindset leads to alternatives to the consequences of Safety I:

1. Safety is a constant. To ensure as many things as possible go right, Safety II requires learning from the thousands of successful flights rather than the handful of failures.
2. Variability is a safety tool. The “work as imagined” concept is frequently contradicted by the “work as done” interaction with reality. Organizations that learn from small variations across the crew force can harness “work as done” to disseminate best practices.
3. Focus on success. Major mishaps provide powerful (and sometimes tragic) lessons but are extremely rare. Minor, unpredictable variations occur on every flight. The thousands of daily successes, where crews adapt and overcome to mid-mission challenges, provide far more valuable and repeatable insights. This approach fosters continuous, incremental improvement over time, compared to sharp, reactive changes in the wake of a single failure.
4. Humans are resources. The ability to predict, adapt, and accomplish the mission makes humans irreplaceable. In other words, Safety I suggests that if not for human error, the mission would have been safe. Safety II suggests that if not for the human at the controls, the mission would not occur at all.

Investing in Safety II is therefore an investment in performance and productivity. By understanding what leads to optimal outcomes, organizations can disseminate those techniques and make operations more effective, even when no mishap occurs. For AMC, Safety II seeks to use all available data to maximize mission success.

Best Practices: Combining Safety I and Safety II in AMC

Safety I has led to a historic decline in mishap rates across the Air Force, and AMC recently won an institutional award for best Major Command Safety Office. The way forward is not to replace Safety I but to widen the path to incorporate a Safety II perspective. The key is to maintain two perspectives: one that investigates system failure (Safety I) and another that asks what was working before and what changed (Safety II). AMC Air Operations maintains two programs as extensions of the Safety I principles, but are well-positioned to take advantage of a Safety II perspective:

• Military Flight Operations Quality Assurance (MFOQA): Often regarded as “Big Brother,” MFOQA analysts examine hundreds of aircraft sensor data to identify specific events and behaviors that may lead to undesirable aircraft states, allowing the command to understand “work as done.” MFOQA analysis can identify how crews consistently and successfully adapt to changing weather, minor system anomalies, or air traffic congestion. Additionally, analysis can identify a “drift” toward undesirable habit patterns long before a mishap occurs, shifting safety from a reactive to a proactive and predictive science.
• Aviation Safety Action Program (ASAP): ASAP provides crews with an opportunity to report safety issues and errors without fear of reprisal. It offers AMC staff a looking glass into the realities of “work as done.” ASAP reports provide a foundation of Just Culture, where honest mistakes are viewed as opportunities. A Safety II-aligned ASAP would increase focus on reports describing success stories, purposeful decision-making, or behavioral changes that enabled mission success despite unexpected threats or errors.

To maintain its success trajectory, AMC aims to increase its focus on what goes right. The staff is shifting from solely “proactive safety” to a broader investment in aircrew human performance. With Safety II in mind, MFOQA and ASAP will enable AMC Air Operations to understand and strengthen the skills that create success every single day.

What Can You Do?

As an AMC member, you can apply these principles today by:

• Viewing safety on a spectrum. Instead of a binary safe/unsafe view, see safety as a range from a minor deviation to a mishap. When you see a deviation, ask, “What else would need to happen for this to become a mishap?” This helps anticipate and build systemic resilience.
• Asking, when something goes wrong, how it used to go right. Failure is usually an unexpected combination of everyday performance variability. What was different this time?
• Looking for why things go right. Success is not an accident. Things go right because someone made a sensible adjustment based on the demands of a situation. Share those successes! If you are an aircrew member, send us an ASAP.

---

^[1] Hollnagel, E. (2014). Safety-I and Safety-II: The Past and Future of Safety Management. CRC Press.

^[2] From Hollnagel E., Wears R.L. and Braithwaite J. (2015). Safety-I to Safety-II: A White Paper. The Resilient Health Care Net: Published simultaneously by the University of Southern Denmark, University of Florida, USA, and Macquarie University, Australia.