Safety III; more of a prequel than a sequel

Af Simon Tulloch, psykolog, chefkonsulent, Dansk Selskab for Patientsikkerhed

When Marty McFly travels back to the ‘Wild West’ of 1885 in the third instalment of the Back to the Future trilogy, his mission is to ensure that ‘Doc Brown’ doesn’t get killed by ‘Mad Dog’ Tannen, (an ancestor of ‘Biff’, the main antagonist in the trilogy), and thus ensuring the safety of future events as already experienced in Back to the Future parts 1 and 2.

In a similar way, Professor Nancy Leveson (MIT) draws upon safety models and methods developed during World War II to help understand the present and shape the future of safety thinking. In this sense, her recent paper titled: ‘Safety III: A Systems Approach to Safety and Resilience’ can be regarded more as a prequel than a sequel.

Læs Nancy Levesons artikel

The paper – which is available via Levesons website – is extremely detailed and provides a thorough examination of current and previous thinking on the subject of safety systems. Leveson uses the work of Professor Erik Hollnagel as the central subject, specifically his definitions of Safety I and Safety II, and his subsequent ‘Resonance Model’ and FRAM method. Around which, Leveson provides an historical perspective of safety which includes the legal, technical, and engineer’s perspective on the subject. As well as examples from different industries, such as aviation, nuclear power, chemical, military, space, and fortunately for us, healthcare.

The paper also contains a detailed analysis of the strengths and weaknesses of the three safety perspectives (see summary examples below), including Leveson’s own model for analysis called Systems-Theoretic Accident Model and Processes (STAMP) which is based on ‘Systems Theory’ – a way of understanding the new technology and complexity in military and aeronautical systems developed initially during World War II, and later refined during the Cold War.


Of particular note, is her analysis of the models used to understand accident causality, specifically the Domino Model (Heinrich, 1931) which still informs our thinking today, as well as The ‘Swiss Cheese Model’ (Reason, 1990) which Leveson presents as little more than a modified version of the domino model, and thus shares many of the limitations, i.e. linear chain-of-events model, and over-emphasis on humans as the cause of errors or accidents.

Dear reader, be warned. This paper is not for the faint hearted. At 109 pages, it is a considerable read and includes a great deal of detail. Equally, advocates of Hollnagel, Safety II, and the Swiss Cheese Model, may find some of this content challenging. We at PS! are still in the process of re-reading and discussing the points raised in the paper. However, the implications could be significant. As Dr Emmitt (Doc) Brown once said: “If my calculations are correct, when this baby hits 88 miles per hour, you’re gonna see some serious sh*t.”

We would welcome your thoughts and reflections on what Professor Leveson has written. Please join the dicussion on my LinkedIn:

or email me directly at:

Fagligt Nyt om patientsikkerhed er et nyhedsbrev, der udgives af Dansk Selskab for Patientsikkerhed, PS!, og udkommer 6 gange årligt. Det formidler nyt om de seneste nationale og internationale forskningsresultater, begivenheder, trends og meninger inden for patientsikkerhed. Mere Fagligt Nyt

5. oktober 2020

Fagligt NytNyheder