Learning from Normal Work turns systems thinking from an academic framework into field tools that non-specialists can use during routine work.
Systems thinking offers the core insight that safety is a system property shaped by choices across many company levels.
Learning from Normal Work takes that insight and builds a practical method for tracing those choices to the frontline setting they create.
Key findings
- Rasmussen’s 1997 model traces choices across six levels from government policy to the workstation, and has over 2,800 academic citations.
- A 2023 Safety Science study found field staff could identify contributing factors but could not trace the links between them.
- Aviation has run LOSA with trained peer observers on routine flights since 1999, and ICAO codified it in Doc 9803.
- Proactive questioning rose from 1.73 to 2.72 (p < .001) and error trap scores from 4.10 to 4.72 (p = .043) across companies using the method.
- At one energy company, eight new system-focused questions still left roughly 80% of resulting actions aimed at people.
What does systems thinking claim about safety?
Systems thinking treats safety as a property of how all parts of a company interact, not as the sum of parts working correctly.
Jens Rasmussen’s 1997 model shows how choices at six levels shape frontline working life. Accidents occur when those choices push work closer to the edge of safe performance (Rasmussen, 1997). His model has earned over 2,800 academic citations and remains the most widely cited framework in safety science.
Nancy Leveson’s STAMP model (Systems-Theoretic Accident Model and Processes) frames safety as a control problem. Accidents happen when the control structures that keep hazardous processes in check weaken over time (Leveson, 2011).
STAMP shifts the question from “what broke?” to “what forces in the company allowed the controls to degrade?”
Erik Hollnagel’s Safety-II framework argues that studying only failures gives an incomplete picture. Since over 99% of work goes right, the variation that drives success reveals where the system is at risk (Hollnagel, 2014).
Learning from Normal Work builds on this insight by studying how work happens day to day rather than only after something goes wrong.
Sound science has not yet translated into sound practice.
Where does the translation from theory to practice break down?
The frameworks are well tested but share a common barrier. Each was built for analysts with specialist training and spare time, not for safety staff working under day-to-day limits.
A 2023 study in Safety Science by Salmon, King, Hulme and colleagues tested whether current systems methods work as intended when used by field staff. Staff using AcciMap placed contributing factors at the correct system level with high accuracy.
They could not trace the links between those factors (Salmon et al., 2023). A buying choice sat at the company level and a frontline constraint sat at the task level, yet no one could draw the line between them.
This finding captures the gap between theory and field practice. Placing factors without tracing links is labeling.
It yields the same outcome as writing “culture” or “leadership failure” in a contributing factors field.
| Labeling | Tracing |
|---|---|
| Names a factor at the correct level | Follows the pathway that connects levels |
| Writes “inadequate oversight” in the contributing factors field | Shows how a buying choice created the constraint that made oversight fail |
| Produces a generic fix: retrain, remind, restrict | Reveals the specific choices that can be changed at their source |
Underwood and Waterson’s 2012 review confirmed the pattern. Systems methods lead in accident research but are not used in industry at the same rate.
Barriers include limited testing in field settings and what Underwood described as “the implications of not finding an individual to blame.” Learning from Normal Work was built to close this gap. LFNW makes the tracing of cross-level links open to non-specialists.
The question is how the translation happens in practice.
How does Learning from Normal Work map onto systems thinking?
Learning from Normal Work matches each core systems thinking principle to a field method.
| Systems thinking principle | Source | LFNW method |
|---|---|---|
| Safety is a system property, not an individual attribute | Rasmussen (1997), Leveson (2011) | Cross-functional Learning Teams bring many company levels into the same room |
| Causes span many company levels | Rasmussen’s six-level model | Constraint Mapper traces how planning and buying choices shape frontline life |
| Control structures degrade over time | Leveson STAMP | Decision Decoder shows how choices were rational given the data and pressures at the time |
| Normal work holds critical safety data | Hollnagel Safety-II (2014) | Walk-Through Talk-Through studies routine task performance to surface error traps before incidents |
| The inquiry model shapes what is found | Hollnagel WYLFIWYF; Lundberg et al. (2010) | LFNW shifts from checking compliance to asking how work actually happens |
How the Constraint Mapper works
A trainer sits with a frontline team and asks what makes their work hard.
The answers trace back to management choices:
- A planning move that compressed a maintenance window
- A sourcing change that swapped a supplier
- A staffing cut that removed overlap between shifts
Formal systems study aims for the same output. The Constraint Mapper gets there through a structured talk that non-specialists can lead.
How the Decision Decoder works
Decision Decoder follows a similar logic but works on a given choice rather than a task. When a team reviews why someone made that choice, Decision Decoder asks what data was at hand and what competing pressures shaped the action.
The output is a traced pathway from system pressures to the person’s conduct. It shows that the choice was rational given the context at the time.
Each tool turns an abstract principle into a repeatable practice. No formal training in systems engineering is needed.
The mapping is conceptual, but the evidence from aviation and field data makes it concrete.
What evidence supports the link?
Aviation provides the strongest cross-domain case. LOSA (Line Operations Safety Audit) has used trained peer observers on routine flights since 1999 to spot hidden weak points.
ICAO endorsed the method and codified it in Doc 9803. The FAA classifies it as a tool for predicting hazards. Learning from Normal Work applies the same logic beyond aviation through structured field tools.
Field data confirms the shift from labeling to tracing:
- Proactive questioning skills improved from 1.73 to 2.72 (p < .001)
- Error trap scores rose from 4.10 to 4.72 (p = .043)
- Source: Psychology Applied field data, 2026
Finding an error trap requires tracing the system forces that built it, not just naming a label.
Regulatory signals point in the same direction. IOGP Report 642, led by Dr Marcin Nazaruk, sets the industry standard for Learning from Normal Work (IOGP, 2022).
The U.S. Chemical Safety Board’s 2026 Givaudan report used AcciMap to trace how management choices led to the event. Regulators are now adopting the very systems methods that LFNW puts into field practice.
Across 56 member companies, IOGP 2024 safety data showed contractor fatal accident rates of 0.84 compared to 0.57 for company staff (IOGP, 2025). These numbers reflect system forces that span company boundaries.
The evidence confirms the method works, but the question is what happens without it.
Why does this link matter for safety leaders?
The link matters because it shapes whether a company’s stated pledge to system safety yields system results or defaults to person-focused fixes.
One energy company’s redesigned just-culture process shows the risk. Despite adding eight new system-focused inquiry questions, roughly 80% of resulting actions still targeted people (Psychology Applied field data, 2022-2026).
Good forms do not close the gap without a method that structures the tracing itself.
Many safety leaders who have completed Human and Organizational Performance (HOP) training accept that safety is a system property. The open question is whether current methods can trace how a headcount or buying choice led to a given constraint at a given workstation.
If they cannot, the company is labeling rather than tracing.
Traditional root cause analysis handles bounded technical failures well. Fault tree analysis is mandated by the FAA and the US Nuclear Regulatory Commission for valid reasons.
When the causal chain runs through buying and contract choices, these methods tend to stop at the nearest person. Their structure was not built to trace cross-functional pathways.
Learning from Normal Work provides the field method that traces these pathways during routine work, before incidents force a reactive inquiry.
Putting systems thinking into safety practice starts with seeing that the theory is already in place. Rasmussen and Hollnagel defined what system study should yield. Learning from Normal Work provides the field-tested method for getting there.
References
Hollnagel, E. (2014). Safety-I and Safety-II: The Past and Future of Safety Management. CRC Press.
International Association of Oil and Gas Producers. (2022). Learning from Normal Work (Report No. 642). IOGP.
International Association of Oil and Gas Producers. (2025). 2024 Safety Performance Indicators. IOGP.
Leveson, N. (2011). Engineering a Safer World: Systems Thinking Applied to Safety. MIT Press.
Lundberg, J., Rollenhagen, C., & Hollnagel, E. (2010). What you find is not always what you fix. Accident Analysis & Prevention, 42(6), 2068-2074.
Rasmussen, J. (1997). Risk management in a dynamic society. Safety Science, 27(2-3), 183-213.
Salmon, P. M., King, R., Hulme, A., et al. (2023). Testing the validity of systems analysis methods. Safety Science, 159, 106003.
Underwood, P., & Waterson, P. (2012). A critical review of the STAMP, FRAM and AcciMap systemic accident analysis models. In Advances in Human Aspects of Road and Rail Transportation (pp. 385-394).
