Is incremental safety a new type of safety? It is not, of course, for there can be only one (as the Highlander wisely said). The only possible definition of safety is “a state where there are as few unexpected and unacceptable outcomes as possible”. The word safety is unsurprisingly derived from Latin where the word salvus means, uninjured, unharmed and in good health (Raheemy, Sherratt & Hallowell, 2025), to be safe therefore means to be free from or protected against harm and injury, either actual (occurring here and now), or potential (possibly occurring at some time in the foreseeable future) Every sentient organism either tries to avoid getting into situations where they can suffer injury or be harmed, e.g., by making the threat disappear (which is why dogs bark at strangers), or else try to get away from such situations if they happen nevertheless, typically by hiding, by seeking cover, by crawling or by fleeing (as all birds and winged insects do when we approach them). The "fight or flight" response (Cannon, 1915) is universal. Humans,as animals with cognitive abilities, especially the use of symbolic representation and memories of the past (history), as well as the ability to select some memories rather than all (corresponding to consciousness and also the ability to imagine what may happen in the future are naturally motivated to ensure a state of safety for whatever they do, individually and collectively. This explains the importance both of feeling safe and of being safe (which, although often confused are quite different, we sometimes feel safe even though we are not, and vice versa.

Alternative ways to become safe

In hindsight, the terms Safety-I and Safety-II regrettably nourished the confusion about whether there is more than one type of safety.There is not, as there can be only one! The confusion even tempted some (Leveson, 2020), (Aven, 2022), and (Cooper, 2022) wrongly to infer that there could also be a Safety-III. Others foolishly latched onto this. (Flinterman, 2024), and (Samost-Williams & Brook, 2025).

 As a psychologist I had anticipated that this false inference might be made, and therefore explicitly warned against it in my 2014 book:

“Since Safety-II represents a logical extension of Safety-I, it may well be asked whether there will not some day be a Safety-III? In order to answer that, it is necessary to keep in mind that Safety-I and Safety-II differ in their focus and therefore ultimately in their ontology. The focus of Safety-I is on work that goes wrong or fails, and the corresponding efforts are to reduce their number. The focus of Safety-II is on work that goes well, and the corresponding efforts are to make sure that more work goes well.” (Hollnagel, 2014, p. 178).

A more detailed argument why Safety-III is impossible can be found here.

In hindsight, I neglected to point out that Safety-I and Safety-II represent different ways to achieve a state of safety, rather than different definitions of safety. (But this was not clear to me, nor to others, at the time). Safety-I and Safety-II are by their intention actually akin to safety differently (Dekker, 2015), where the adverbial form of different makes clear that it does not refer to a different type of safety, as there, indeed, can be only one, but to a different way of achieving and/or managing safety – understood as the state of being safe.

Alternative ways to become safe

According to Safety-I and the safety legacy (Hollnagel, 2025), a state of safety can be achieved by reducing the number of acts and/or events that result in unacceptable outcomes -- hence a decremental approach(Hollnagel, 2026), with the popular but completely unrealistic Zero Accident Vision(ZAV). (Zwetsloot et al., 2013; Sharman 2016; Björnberg, et al., 2019). According to Safety-II, a state of safety can be achieved by increasing the number of acts and/or events that result in acceptable outcomes, hence an incremental approach, corresponding to an incremental safety culture. Incremental safety implies the equally unattainable ideal that everything goes well (Visio centum).

If safety is defined as a state where there are as few unexpected and unacceptable outcomes as possible, then the focus is clearly on those, and efforts are consequently aimed at reducing that number to be as small as possible, ideally zero, hence a decremental approach. If safety instead is defined as a state where there are as many expected and acceptable acceptable outcome as possible, then the focus is on those, and efforts are in consequence aimed at increasing that number to be as large as possible, ideally 100%, hence an incremental approach. Visio centum is, of course complementary to the Zero Accident Vision. If Visio centum is ever achieved, meaning that every act leads to predictable and acceptable outcomes, then there will, logically be no acts that lead to unpredictable and unacceptable outcomes.

Coin Flipping

Incremental and decremental safety refer to two different approaches to become safe, rather than to two different types of safety. The difference can be illustrated by flipping a coin. Unless the person who flips the coin is incredibly skilled any physical coin will land either heads up or tails up (only a quantum coin could, like Schrödinger's cat, remain in a quantum superposition. But it would be terrible for safety, and for daily life, if it was not possible to determine whether the outcomes of an act were acceptable or unacceptable. Yet even though the outcomes of flipping a coin themselves are binary, the values need not be. If the coin was flipped to make a decision the value of the outcome will be positive for one part and at the same time negative for the other (except for:heads, I win; tails you lose), but such complementarity of value is unlikely to be the case where the issue is industrial safety. There are few, if any, cases in which an accident, resulting in harm, loss or injury will be seen as having a positive value – the only exception is perhaps the actions of a terrorist, an assassin or an arsonist. Decremental safety also (I sincerely hope) exclude the possibility that someone concludes that there is a third way to achieve a state of safety, such as Safety-III. (Although human folly seems to have no upper limit.) If you neither try to reduce or decrement the number of cases where work goes wrong, nor try to increase or increment the number of cases where work goes well, the only option left is to do nothing or laissez-faire, which for few companies is an attractive safety management strategy since it means that nothing will change with regard to safety and few companies dare publicly declare they are financially or ethically satisfied with their current occupational accident rate and want to keep that as their status quo. Using the analogy of coin flipping. The coin will land either tails up (corresponding to an unacceptable outcome) or heads up (corresponding to an acceptable outcome). So the two types of outcomes are clearly mutually exclusive, if there are more of one type of outcomes, there will be fewer of the other type of outcomes, and vice versa. The intention with this analogy is not to suggest that the outcome of work activities are random. On the contrary, we do all we can to bias the coin so it does not land tails up, corresponding to unacceptable outcomes or a decremental safety culture. The analogy rather suggests that we might as well bias the coin in the opposite direction so that it is more likely to land heads up corresponding to acceptable outcomes or an incremental safety culture, because that is after all what we would like, and need to happen in everyday work.

Safety-III RIP

In hindsight, the terms Safety-I and Safety-II created some confusion about whether there was more than one type of safety. There is not, since there can be only one! The confusion even tempted some (Leveson, 2020), (Aven, 2022), and (Cooper, 2022) wrongly to infer that there could also be a Safety-III. Others foolishly latched onto this. (Flinterman, 2024), and (Samost-Williams & Brook, 2025). Being a psychologist I had anticipated that this false inference might tempt some, and had therefore explicitly warned against it in my 2014 book:

“Since Safety-II represents a logical extension of Safety-I, it may well be asked whether there will not some day be a Safety-III? In order to answer that, it is necessary to keep in mind that Safety-I and Safety-II differ in their focus and therefore ultimately in their ontology. The focus of Safety-I is on work acts that go wrong or fail, and the corresponding efforts are to reduce their number. The focus of Safety-II is on work acts that go well, and the corresponding efforts are to make sure that more go well.” (Hollnagel, 2014, p. 178).

Three more detailed arguments why Safety-III is impossible can be found here and in (Hollnagel,. 2025).

In hindsight, I failed to point out that Safety-I and Safety-II represent two different ways to achieve a state of safety, rather than two different definitions of safety. (But this was not clear to me, nor to others, at the time). Safety-II is actually akin to safety differently (Dekker, 2015) , where the adverbial form of different makes clear that it does not refer to a different type of safety, but to a different way of achieving and/or managing safety – understood as the state of being safe. (a similar argument for safety is made in (Hollnagel, 2025). The only third option I can imagine would be sacramental safety, which has the phonetic resemblance to decremental and incremental safety, but semantically makes as little sense as did Safety-III. Time will tell if my imagination is too limited (I secretly fear so, but dread ever to see the evidence for it).

Safe and Safer

We are fooled by the language we use when we think, and talk about safety. As pointed out by professor James Reason (RIP) the first paradox of safety ”Safety is defined and measured more by its absence than its presence”. Yet we commonly and habitually use the comparative form safer of the adjective safe, wrongly meaning more than safe. Yet practically all formal definitions of safety emphasize the absence of something.

According to the conventional interpretation of safety, now often called Safety-I (Hollnagel, 2014b), safety refers to a condition where as little as possible goes wrong. The American Society of Safety Engineers and the American National Standards Institute, for instance, define safety as “the freedom from unacceptable risk” (ASSE, 2011, p. 13). The Agency for Healthcare Research and Quality (AHRQ), likewise defines safety as “freedom from accidental injury, (Emanuel et al., 2009) which can be achieved by “avoiding injuries or harm to patients from care that is intended to help them”. Finally the International Civil Aviation Organization (ICAO), defines safety as “the state in which the risk of harm to persons or of property damage is reduced to, and maintained at or below, an acceptable level through a continuing process of hazard identification and risk management” (ICAO, 2013, pp. 1–2). When we say that something is safer, as in One Percent Safer (Sharman, 2020) we actually, and paradoxically mean it is one percent less unsafe, so there are fewer *(by 1%) unexpected and unacceptable outcomes. It therefore represents a decremental approach. The opposite is a true incremental approach, formerly called Safety-II, where the meaning of safer is the there are an increased number of expected and acceptable outcomes, even if it is just by one percent. Returning to language, safer actually means less unsafe, hence less of something, rasher than more of something. The only thing there will be more of is cost, since it is far from inexpensive to become safer by reducing the number of unacceptable outcomes. But there is little to show as a result of the investment, except hopefully fewer accidents and unwanted outcomes, which means that something is saved or avoided. In contrast to that incremental safety means that something is gained because more work will go well, leading to increased productivity and revenue. And since we live in a macroscopic (non-quantum world), where an act cannot go well and fail at the same time, an increase in the number of acceptable outcomes also means a decrease or reduction in the number of unacceptable outcomes. An incremental safety approach therefore fulfills the aim of a decremental safety approach at the same time.

A Farewell to Safety Culture

The fundamental dilemma is that safety culture is an intangible that purports to account for the tangible, for human performance in general and organizational accidents in particular. The following sections takes a closer look at this dilemma. The aim is briefly to chart the chequered history of safety culture, to focus on the fundamental intellectual dilemma and to suggest a modest solution.

So much has been written about safety culture, that even an AI endowed search engine does not know the number of published books , but a conservative intelligent human estimate is at least several hundreds, to say nothing of tens of thousands of journal papers and conference proceedings with no end in sight. Few of these efforts have, however, addressed Throughout most of the history of safety, the ages of technology and of human factors, according to (Hale & Hovden, 1998), cf., Table , safety practitioners were satisfied with using a single cause (either a technical failure and malfunction or a quirk of the human factor) to account for why and how accidents happened(technically called proximal monocausal attribution)but the 1970s and 1980s saw several large accidents such as the explosion at Flixborough (1974), The nuclear reactor accident at Three Mile Island (1979), the explosion of the space shuttle Challenger (1986), the accident at the Chernobyl nuclear power plant (also 1986), the capsizing of the Herald of Free Enterprise (1987) and the King’s Cross Underground fire (also 1987), where were no obvious proximate active failures, but instead a combination of active failures and long-standing (latent) distal systemic pathogens, that suddenly resulted in an accident. This ushered in the age of safety management (Table ) which required a combination of active failures and latent system conditions or pathogens,hence a transition to distal multicausal attribution that challenged established linear cause-effect reasoning It also threatened conventional monocausal reasoning and called into question traditional Newtonian methods of safety analysis and management. (Dekker, Cilliers & Hofmeyr, 2011). Out of this turmoil arose the idea that safety culture, as a single cause or factor perhaps could be used to explain what happened. This salvaged the convenience of monocausal thinking but at the cost of reduced veracity. The concept of safety culture maturity, using the analogy of human psychological development soon became so popular as a way to account for third age accidents, that it itself required further elaboration.The primary contribution of safety culture was to meet the psychological and socio-cultural need for simple explanations of accidents in cases where proximal monocausal attribution was inadequate. Safety culture has never demonstrated any practical value or ability to improve safety byreducingthe number of unexpected and unacceptable outcomes. Safety culture is a social construct(Searle, 1995), and also counterfactual conditional.There are no recognised psychological, sociological, or organizational theories that support safety culture, and no known methods effectively to establish, manage,maintain, or improveit. Safety culture came out of nowhere to relieve the anxiety in the wake of organizational accidents. Safety culture achieved that but has otherwise done nothing to reduce or prevent such accidents from occurring much work and many serious efforts notwithstanding.

Table 1: Three ages of safety (Hale & Hovden, 1998).

Safety culture was first invoked as a counterfactual cause or explanation when the International Nuclear Safety Advisory Group (INSAG) from the International Atomic Energy Agency (IAEA) released its report on the causes of the accident that had happened at the Chernobyl Nuclear Power Plant on April 26, 1986. (INSAG-4, 1991), although (Reason, 1988) had already attributed the accident to a combination of an inadequate test plan and Group Think. Safety culture from the beginning denoted something that was absent but which might have prevented an accident if only it had been present, or in other words as a counterfactual conditional.

In the INSAG report introduced the concept of safety culture to the common safety vocabulary, safety culture was defined as:
“that assembly of characteristics and attitudes in organizations and individuals which establishes that, as an overriding priority (nuclear plant) safety issues receive the attention warranted by their Significance” (INSAG-4, 1986, p. 5). This is, however, in philosophy known as an analytic proposition, that is true solely by virtue of its meaning.

Safety culture was therefore from the very start left undefined. The INSAG is not a permanent group of a fixed size, so it is difficult to say with any kind of certainty who contributed the idea of safety culture. Educated guesses, however suggest that Mr. Brian Edmondson from the Central Electricity Generating Board (CEGB) in the UK may have been the one. The term safety culture appears to have originated privately in the post-Chernobyl analytical work by the British Central Electricity Generating Board (CEGB) (likely authored by Mr.Brian Edmondson) and was carried into IAEA discourse through professional collaboration, and eventually formalised anonymously in the INSAG-4 report. We know for certain that when Jim Reason wrote his paper on the Chernobyl errors (Reason, 1987, p. 203-204), he pointed to the problems of coping with complexity, and elements of 'groupthink'

Reason concluded that “we would be wise to extend the causal analysis beyond the limited scope of individual information processing to take account of the social aspects of the situation”. (Ibid p. 204. This is in many ways the essence of safety culture.

The tangible-intangible dilemma

The INSAG-4 report also contained the following important passage, which has received very little attention:

“The definition relates Safety Culture to personal attitudes and habits of thought and to the style of organizations. A second proposition then follows, namely that such matters are generally intangible; that nevertheless such qualities lead to tangible manifestations; and that a principal requirement is the development of means to use the tangible manifestations to test what is underlying.” (INSAG-4, 1986, p. 1, emphasis added).

Much has been written about safety culture since then, but few authors seem to have noticed the above passage with the second proposition, which was cleverly tucked away on page 1 of the report. This passage nevertheless precisely identifies the fundamental problem with safety culture, namely how the intangible (safety culture) determines something tangible (what people do at work particularly when it does not go well) or tangible=F(intangible), and whether this can actually be regulated. Without having a clear and practical solution to The tangible—intangible dilemma dilemma it is a fool’s errand to rely on safety culture.

Throughout the three ages of safety (Table 1, above) it has every now and then, but rarely been necessary to find a cause for a hitherto unknown type of accidents. The best known case is the world's first commercial jet airliner, the de Havilland Comet aircraft. During its first year of operation (1949) three Comets planes were lost in highly publicised accidents after suffering catastrophic mishaps mid-flight. Following these accidents the Comet was withdrawn from service, but a redesigned version flew again in 1958. The aircraft was finally retired in 1997. To provide passengers with a better experience, the Comets had large rectangular windows, which eventually induced metal fatigue. Metal fatigue is the weakening of a metal part due to repeated cyclical movement such as bending or twisting Metal fatigue was obviously not considered when the Comet aircraft were designed, even though the phenomenon had been known, and named, since 1839. Metal fatigue was seen as just another failure of technology hence did not introduce a new age of safety.

In other sciences it has also from time to time needed to introduce something new, because it was required by the underlying theories. The best known example is that the Standard Model of particle physics required specific elementary particles, most famously the Higgs Boson, predicted by Peter Higgs, Francois Englert, and others in 1964, and confirmed to exist by experiments using the Large Hadron Collider (LHC) in 2012. (Higgs and Englert shared the Nobel prize in physics in 2013). A similar inference in cosmology is the existence of dark matter, a mysterious, form of matter that supposedly makes up altogether 85% of the known universe although it is yet to be found, perhaps because it by definition is invisible. Safety culture differs from both of these. There is first of all no compelling physical evidence, such as crashed airliners that requires safety culture as a cause, neither are there any strong theories about human or organizational behaviour that predict its existence. So like dark matter safety culture remains invisible. The reasons why safety culture became necessary are instead purely psychological. Whenever something unexpected and unacceptable happens there is an insatiable psychological need of explanations.

The need of safety culture

New causes can become necessary for two different reasons,as explained above: (1) for technical reasons when a new type of accidents happens, as illustrated by the case of the de Havilland Comet aircraft , or (2) for theoretical reasons as illustrated by the Higgs boson. Safety culture, however, was due to neither of these reasons, but had its own and equally compelling reason: (3) psychological necessity, as pointed out by many philosophers.
First of these was the Andalusian Muslim polymath, Ibn Hazm of Cordoba (994 – 1064) who observed that: ”The chief motive of all human actions is the desire to avoid anxiety.” (Hazm,1990, p. 114).
Half a Millenium later, the English philosopher Thomas Hobbes (1588 - 1679) in his great book Leviathan wrote that:
“Ignorance of remote causes, disposeth men to attribute all events, to the causes immediate, and Instrumentall for these are all the causes they perceive”. (Hobbes, 1651, Chapter XI).
This by the way elegantly explains the problem of organizational accidents, namely that we cannot perceive the causes. Latent conditions, by definition, stay latent because they are not noticed.
In the late 19th century The eminent German philosopher, Friedrich Wilhelm Nietzsche (1844-1900), was even more direct, when he wrote:
“to trace something unfamiliar back to something familiar is at once a relief, a comfort and a Satisfaction, while it also produces a feeling of power. The unfamiliar involves danger, anxiety and care -the fundamental instinct is to get rid of these painful circumstances. First principle - any explanation is better than none at all.” (Nietzsche, 1997, Chapter 5, emphasis added). I will refer to this as the Nietzschean anxiety.
But most eloquent was Count Leo Tolstoy (1828-1910), who in his great book War And Peace discussed how the Muscovites tried to make sense of the conflict when Napoleon was marching toward Moscow. Tolstoy astutely noted that:
“Man’s mind cannot grasp the causes of events in their completeness, but the desire to find those causes is implanted in man’s soul. And without considering the multiplicity and complexity of the conditions any one of which taken separately may seem to be the cause, he snatches at the first approximation to a cause that seems to him intelligible and says: This is the cause.” (Tolstoy, 2007, Book 13, Chapter 1)
The famous US psychoanalyst Erich Fromm (1900-1980) was more blunt when he wrote: “The quest for certainty blocks the search for meaning.”(Fromm, 2002, p. 45).
The numerous unexpected and unacceptable outcomes that happened in the third age of safety - and which still happen, created an urgent need for a new type of explanation that the counterfactual social construct safety culture appeared to meet. Safety culture literally came as a deus ex machina.

Given that safety culture for the reasons mentioned above was necessary to restore the peace of mind where simpler explanations had failed, the obvious next question is how a safety culture can be established and maintained. This is the essential problem the INSAG identified when they wrote “the development of means to use the tangible manifestations to test what is underlying.” This is where an articulated theory of organizational culture would have come in handy. Such a theory is unfortunately nowhere to be found. A good approximation is Edgar Schein’s proposal that an organizational culture has three main parts. According to (Schein, 1992) an organizational culture comprises artefacts, [the visible, tangible elements of an organization's culture] that are easy to perceive, shared basic assumptions [the deeply embedded, taken-for-granted behaviours which are usually unconscious], but constitute the essence of culture, hence essentially Reason’s Group Think, and the espoused values [the organization's stated values and rules of behaviour]. The artefacts represent and complement the union of espoused values and the basic assumptions. There are several renderings of this model (often as three layers of a pyramid with artefacts at the top and underlying assumptions as the bottom layer. Cultures are, more generally, “systems of (socially transmitted behaviour patterns) that serve to relate human communities to their ecological settings (Keesing, 1974, p. 75), presumably also when these settings are intentionally created, such as the places of work that are of concern for industrial safety and which today totally have replaced natural work environments, with the possible exception of fishermen, farmers, loggers, and miners.

Schein’s model is, however not a proper scientific model according to the definition by (Coombs, Dawes & Tversky, 1970, p. 2). These authors define a model as:

“... the representation of some aspects of the world by a more abstract system. In applying a model, the investigator identifies objects and relations in the world with some elements and relations in the formal system.” (Coombs, Dawes & Tversky,1970, p. 2).

Schein’s model does describe three essential parts of an organizational culture (artefacts, basic assumptions an espoused values, but does not describe their mutual relations. The intangibles are obviously the espoused values and the shared basic assumptions but Schein's model contains nothing that corresponds to the tangibles, to human performance. It is therefore of little help to clarify the intangibles and to use safety culture actively to improve system performance., how, for instance, does a change in artefacts affect the espoused values? And what should be done effectively to change the basic assumptions, if and when needed?

The tangible—intangible dilemma is the essential issue that the INSAG report identified. There are two well-known candidates or frameworks that address that: the HSE Safety Culture Ladder and the Bradley curve.
As soon as safety culture and safety culture maturity became important issues proposals were made about how to manage the intangible in order to ensure the desired tangibles, to wit the absence of organisational accidents. But all such attempts immediately ran into problems with the first paradox of reason.
Twenty five years ago Jim Reason published a paper on “Safety Paradoxes And Safety Culture”, which received surprisingly little attention. In this paper Professor Reason described four paradoxes of safety (a paradox is a seemingly absurd or contradictory statement or proposition which when investigated may prove to be well founded or true.) The first paradox was that safety is defined and measured more by its absence than its presence. That means that what was supposed to be the tangible outcome of the intangible safety culture actually is not there, which, of course, is a major problem for the intangible-tangible dilemma. While there are many well-known manifestations of the absence of safety there are practically none for the presence of safety, that can serve as evidence for the presence of the intangible safety culture. It is therefore essential to define which tangible manifestations the intangibles are supposed to produce. Another consequence of the first paradox is that while there are numerous models of how accidents occur there are practically no models of performance when there are few or no unexpected or unacceptable outcomes, even though these happen nearly all the time and are the rule where accidents are the exceptions and also is the kind of performance that is highly desired and necessary for companies to sustain their existence. There is actuyally a fifth paradox as well, which is a consequence of the first paradox. The fifth paradox is explained here.

Examples
Examples of the tangible
Examples of the tangible, are relatively easy to find. The simplest is probably the adage ”Safety Fitst”, which in a slightly expanded form becomes S.T.O.P: Stop, Think, Observe, Plan, in some cases supplemented by Communicate.
An even better example from the world of healthcare is Jeff’s rule:
which encourages practitioners to ‘reflect, review, rethink’ if a patient presents three times with the same or escalating symptoms. (Spencer, et al., 2025).

Examples of the Intangible

Examples of the intangible are in the nature of things harder to come by. Because they require an available definition of culture, or at least organizational culture.
What is culture?
Culture can be defined as the complex whole of a group's shared beliefs, customs, values, and ways of life, including both tangible elements and intangible aspects like language and traditions. Culture can be defined as the complex whole of a group's shared beliefs, customs, values, and ways of life, including both tangible elements and intangible aspects like language and traditions. The concept of an organizational culture, can be found as far back as the esprit de corps of the Napoleonic Grande armée (1805-1815), possibly even the agoge of the Spartan Army more than two Millennia ago, Another expression is provided by the individual or collective level of aspiration for performance, or the anspruchsniveau (Chapman & Volkman, 1939) and (Lewin, et al., 1944), and, of course, more directly in the model of organizational culture described by Schein, 1992):the artefacts, [the visible, tangible elements of an organization's culture] that are easy to perceive,the shared basic assumptions and the espoused values. There are several renderings of this model (often as three layers of a pyramid with artefacts at the top. Cultures are, more generally, “systems of (socially transmitted behaviour patterns) that serve to relate human communities to their ecological settings (Keesing, 1974, p. 75), presumably also when these settings are artificially , such as the places of work that are of concern for industrial safety and which today totally have replaced natural work environments, with the possible exception of fishermen, farmers, loggers, and miners.

The problems in defining the intangible safety culture wére clearly laid out by (Borys, 2019) who concluded:
“The literature review revealed that there is no agreed definition of the term ‘safety culture,’ and no definitive model of safety culture. In short, the body of literature is large, diverse, fragmented, confusing and ambiguous. There is little evidence supporting a relationship between safety culture and safety performance. In a practical sense, it is fruitless to continue to attempt to define safety culture. Rather than trying to change something as nebulous as ‘safety culture,’ the focus should shift to changing the organisational and management practices that have an immediate and direct impact on workplace safety. Organisational culture, however, is a useful concept if understood as a metaphor rather than a variable. Organisational culture informs changes in organisational practices that focus on safety, and may evolve as the culture learns and grows over time. While they do not inform culture change, safety climate surveys may be a useful measure of the perceived effectiveness of changes in organisational practices focused on safety. This view of organisational culture has implications for practice, both for OHS professionals and management.” Borys, 2019. p. 29)

The HSE Safety Culture Ladder

One of the best known frameworks for managing and improving safety culture is Patrick Hudson’s HSE Safety Culture Ladder, even if it does not directly address or solve the tangible-intangible dilemma. The HSE Safety Culture Ladder represents the intangible by five levels or steps (Figure 1.) An obvious question is, of course, where the five named levels come from and what their theoretical or empirical basis is.

The origin of the HSE Culture Ladder is not in research on safety culture, but rather in research on safety climate.(Westrum, 2004). Whereas the HSE Culture Ladder pretends to be a model of safety culture maturity, accounts of Safety Climate (Westrum, 2004) are less pretentious. Climate represents patterns in information handling, and therefore at best represents espoused management values. Hence completely different from the safety culture of the organization as such, as management is a subset of the organization. To make matters worse,neither the HSE Safety Culture Ladder (Figure 1), nor the Bradley curve (Figure 2) are actually models in a scientific sense (Coombs, Dawes & Tversky,1970). They are both seductive graphical renderings of the popular idea, that safety culture can gradually mature or improve through a number of distinct phases, either five levels or four stages but neither rendering provides the three types of knowledge needed to control a change, described below [The Knowledge Needed To Control A Change].

The analogy with a ladder offers the affordance that safety culture is improved by climbing up the ladder, just as we physically can reach higher if we use a ladder. The critical question is, how a simple and familiar movement in the tangible world can be represented as a similar movement in an intangible world, Hudson, of course, understood that a movement in the intangible world must take place in the minds of the people who do the work, because their actions constitute the tangible manifestations that express the safety culture. Hudson “solved” the problem in the following way:

“But it was clear that simply pointing out which direction to go would not be enough to actually induce progress up that ladder, for that some way of creating lasting change was necessary. The next stage in the project therefore required the development of a process model that defined how people could be brought to change and, it was felt, it would be best if this change was what people wanted, not one that they felt had to take place because they are told to. There are a wide variety of change models available, but most of these (e.g. Kotter, 1996; Kotter and Heskett, 1992) tend to concentrate on the details of project management in a change environment; we selected one model from psychology, the transtheoretical model of (Prochaska and DiClemente, 1983) and (Prochaska et al., 1998), because it covered the elements felt essential to cover the requirement that people should want to change. In particular this model laid much more emphasis on getting those involved to have an active personal desire to change rather than a passive requirement to meet the goals of management. (Hudson, 2007, p. 704) presents the five main stages of the change model, with its special emphasis on acquiring awareness and, once behaviour change has been effected, of maintaining that change.”

Hudson chose the so-called transtheoretical model of (Prochaska and DiClemente, 1983), which became marketed and widely known as the hearts and minds method. (It really ought to be called the minds and hearts method, because convincing people to change is done by working on their mindsets and not their feelings Putting hearts before minds is an Aristotelian mistake.

This solution is, however, replete with problems. The transtheoretical model of change, was so named because it is not based on a specific articulated theory of how changes can be made but rather is a hodgepodge of different theories from psychotherapy, it may well be useful to understand how a personal choice such as to stop smoking takes place. Yet we know practically nothing about how the decisions we make determine the actions we take. An organisation is anyway not a single sentient being, and does not as such choose to change or improve its safety culture, responsible managers perhaps do but they do not by themselves constitute the safety culture of a company. While the transtheoretical model possibly may be appropriate for understanding how a management decision is made, it is singularly unsuitable for understanding how to implement a change in the workforce, once the management’s choice has been made. The hearts and minds method therefore does little to explain the tangible-intangible dilemma.
Another peculiarity of the Safety Culture Ladder is the Pathological is the name for the third step, half way to optimal maturity. In common parlance pathological is the worst possible and not the third best. The worst is here calculative, which most people would rank better than pathological, since it at least suggest there is some kind of underlying principle.

Hudson's mistake

The above long quotation from (Hudson, 2007, p. 704) exposes the main problem with the hearts  and minds method for all to see. Regardless of whether safety culture is defined as Group Think (Reason, 1988), as ancestry and social environment (Heinrich, 1959) as an esprit de corps, as a collective level of aspiration for performance in a task, as a socially transmitted behaviour pattern or as the shared basic assumptions or the espoused values, of (Schein, 1992), it is obviously not something a single individual can decide to change, neither is it something that can be changed from the outside by a single factor leadership, for instance. A person may choose to adopt an artefact, such as a MAGA Cap, but cannot in the same way choose to change the shared basic assumptions or the espoused values of the organization where that person works, if they even are aware of them? It may happen after a while of socializing with others that also wear a MAGA cap, but then as a result of social pressure, as described by social judgement theory (Sherif & Sherif, 1968) rather than as a personal choice. It actually contradicts the very idea of culture to assume that adherence to the culture that influences what we do is a discrete individual choice, that can be changed in the same way as breaking a bad habit. To suggest that reveals a fatal misunderstanding of whatever culture or safety culture is. Performing in accordance with the safety culture or with the local organizational culture in general, is not an individual choice or an isolated act, like lighting a cigarette. This is also evident from the popular definition of safety culture as “the way we do things around here”. The analogy that is the justification for the minds and hearts and minds method is therefore misleading, irrelevant and inappropriate and the supporting reasoning is illogical and seriously flawed. Seen from this perspective the choice of the hearts and minds approach was a rather desperate efficiency-thoroughness trade-off (Hollnagel, 2009), based on Hudson’s urgent need to come forward with some sort of method that could be used to change people’s mindset (Hudson, as cited above).

It must be remembered that the transtheoretical model, in both the original version, and Hudson’s interpretation thereof represents hypothetical stages of an individual’s mindset, rather than of a safety culture. It can therefore not be claimed to be a model of safety culture maturity in the way that Schein (1992) is a model of organizational culture. Developing or maturing a safety culture must address the shared basic assumptions, espoused values, and artefacts, if, indeed, an artefact can represent safety culture maturity? And this cannot be replaced by addressing individual characteristics and attitudes. Group Think is neither the sum, nor the average of how a set of individuals think or of their readiness to behave safely, nor are there many artefacts that naturally represent basic assumptions and espoused values.

The Bradley curve

Another popular suggestion for solving the tangible-intangible dilemma is the Bradley curve. It differs from the HSE Culture Ladder (Figure 1) by showing a a continuous curve divided into four sections of apparently equal size instead of five discrete stages or steps.

Figure 2: The Bradley curve from (Jasiulewicz-Kaczmarek, M., Szwedzka, K. & Szczuka (2015).)

The Bradley curve illustrates imagined steady improvement, measured by a diminishing number of occupational accidents, precisely what management wants. The smooth curve is, a manager’s wet dream with neither data nor theory to support it. In the 1990s, Ed Woolard the CEO of DuPont chartered a so called DuPont Discovery Team to develop a system that would allow sustainable and lasting improvement in organisational safety (unsurprisingly defined in terms of the Zero Accident Vision,Woolard had apparently also adopted the myth of safety culture). The best (and actually also the only) known, outcome of that team effort was the Bradley Curve (proposed in 1994 and named after a team member: Vernon Bradley (sometimes wrongly named Berlin Bradley, who was Manager of a DuPont plant in Canada). Empirical support is out of the question because continuous measurements of occupational accident rates are unaffordable and therefore practically impossible. In the best cases a occupational accident rate may be calculated weekly, monthly, or quarterly, but most likely only as part of an annual report. A proper rendering of the Bradley curve would therefore be a staggered graph or a histogram rather than a smooth curve. The Bradley curve anyway does not describe a system that will bring sustainable and lasting improvement in organisational safety, but only the imagined outcomes should such a system ever be specified and realised. The Bradley curve appears in many promotional materials from companies that either claim they use it or (worse) offer to teach others how to do so, but there are few if any scientific papers that either describe or support it, although several make opaque reference to it. (The names of the four stages were apparently borrowed by Mr. Bradley from Covey (1989) who himself seems to be taken them from the famous Swiss developmental psychologist Jean Piaget, hence not related to safety culture at all.) The curve is only possible if it is supported by a method to bring about a steady reduction of occupational accidents. Such a method did not exist in the 1990s and does not exist today. If wishes were horses, beggars would ride, and occupational accident rates would be under steady control.

The Bradley curve in no way explains how safety culture maturity can be controlled, CEO Ed Woolard’s ambitions notwithstanding. Unlike a ladder, there is no natural affordance for a curve or a slope, except, perhaps to slide down along it. Yet, the further you move along the slope as it is rendered in Figure 2, the further you get away from being in the best position, which in the natural rank order usually is the leftmost (cf. The common expression “first in line”), The common renderings of the Bradley curve, but not the version seen in Figure 2 do include an ordinate scale named Safety Culture Self Assessment but it is not actually defined, and it would anyway not be reliable, if it was based on self assessment. Neither is it intuitive that moving further to the right represents improved safety culture maturity. The leftmost position is usually considered to be better than any of the following. The further you move to the right the lower you also are on the abscissa. The Bradley curve therefore represents a counter-intuitive relation in every way and seems to be based on wishful graphics rather than systematic thinking. The curve is divided into four regions or segments of apparently equal size, named (reactive, dependent, independent, and interdependent), the names have no obvious connotations unlike the names of the five steps of the Safety Culture Ladder. And it is not reasonable that an interdependent safety culture is more mature than an independent one. From a simple reliability point of view, the opposite may actually is more reasonable, since a system where functions are independent is more reliable, and therefore preferable to a system where function are interdependent or coupled, as the latter is more likely to experience the normal accidents that (Perrow, 1984) brought into to the safety debate. the order of the two stages independent and interdependent therefore ought to be reversed. Neither does the Bradley curve in any way support how to determine the current position. Since the curve also represents the occupational accident rate it would in principle have been possible to define threshold values for each of the four stages, at least as percentages. The affordance of a ladder is that it brings you higher for each step you take. The Bradley curve does not offer any knowledge of how the movement along the slope, the so-called safety voyage can take place (the means). The Bradley curve (Figure 2) does show a rough correlation with the occupational accident rate, but in this case it seems more reasonable to assume that the decreasing rate is a function of the postulated maturity of safety culture, rather than the other way around, since the latter raises the fundamental question of how the occupational accident rate effectively can be reduced, something the safety legacy so far has been unable to provide.

Similar to the HSE Safety Culture Ladder, the Bradley curve indicates a default goal, namely the fourth and rightmost stage (interdependent) but with no definition of what interdependent means in practice, nor how it can be determined, except by the above mentioned subjective safety culture self assessment.
Altogether the Bradley curve may appear appealing to a manager or a CEO, but is woefully underspecified and therefore impossible and inadvisable to use in practice.

The Reason decomposition

That Jim Reason was aware of the tangible-intangible dilemma, is clear from the following question:
“By what means can we set about transforming an average safety culture into an excellent one? The answer, I believe, lies in recognising that a safe culture is the product of a number of inter-dependent sub-cultures, each of which – to some degree – can be socially engineered. An informed culture can only be built on the foundations of a reporting culture. And this, in turn, depends upon establishing a just culture. In this concluding section, we will look at how to build these two sub-cultures. The other elements of a safe culture – a flexible culture and a learning culture hinge largely upon the establishment of the previous two. They have been discussed at length elsewhere (Weick, 1987), and (Reason, 1997) and will not be considered further here. (Reason, 2000, p. 12).
This decomposition defines a pyramid of subcultures as shown in Figure 3.

Figure 3: The decomposition of safety culture (Reason, 2000).

Reason’s decomposition proposal triggers three comments, Firstly, how is it possible to decompose an intangible safety culture into four subcultures? Secondly, that each of the four proposed subcultures will presumably be intangible themselves. Thirdly that if two of the proposed subcultures an informed culture and a reporting culture can be managed independently, as the quote suggests, then why can the same operations not be applied to the larger safety culture. The relative order of Flexible Culture and Learning Culture is not specified. Neither is it described how it can be determined that either of the four safety culture components are present. Reason’s suggested decomposition is thus even less of a model than Schein’s. Additionally neither (Weick, 1987), or (Reason, 1997) describe how a culture can be managed. Reason’s decomposition is therefore not a viable solution to the tangible-intangible dilemma, nor does it clarify what safety culture is.

Resolving The tangible—intangible dilemma

The tangible—intangible dilemma is a serious impediment for the safety legacy and for established approaches to safety management. Despite the several attempts described above, the tangible—intangible dilemma has not to find a solution. But a solution is actually fairly simple. Namely to replace the intangible with something tangible. The tangible replacement is in this case resilience, not in the sense of a wholesale substitution of safety culture by resilience culture, but by realising that resilience is tangible because it denotes what a system does rather than what it has. The question therefore becomes what characterises resilient performance. An early definition was: