Safety II is a perspective on safety that focuses on understanding why things go right under real operating conditions, rather than only investigating failures. Developed by Erik Hollnagel, Safety II treats human variability as a source of resilience. The academic frameworks behind Safety II and systems thinking are well validated, but most organizations struggle to translate them into daily practice. Learning from Normal Work, developed by Psychology Applied, provides the operational method that closes this translation gap through 14 field-tested tools.
The Theory Is Sound, the Translation Has Failed
Systems thinking has never lacked intellectual credibility in safety science. Jens Rasmussen’s 1997 risk migration model has accumulated over 2,800 academic citations. Nancy Leveson’s STAMP and STPA methods are taught in engineering programs worldwide. Erik Hollnagel’s Functional Resonance Analysis Method (FRAM) has generated a dedicated research community. AcciMap, which traces contributory factors across organizational levels, has been applied in hundreds of published studies.
These frameworks represent the consensus view of how accidents happen in complex systems: through the interaction of decisions, constraints, and adaptations spread across multiple organizational layers.
The problem is that consensus in academia has not translated into practice on the shop floor. A 2012 review by Underwood and Waterson examined why systems approaches dominate accident analysis research but are not used in industry at the same rate. They identified concrete barriers: limited validation in operational settings, usability problems, analyst bias, and what they called “the implications of not finding an individual to blame.” Underwood’s subsequent doctoral work added that systems methods “were not presented consistently or clearly enough in the literature to support practitioner uptake.”
This is the operationalization gap. The science exists. The translation does not.
Non-Experts Can Place Factors but Cannot Trace Relationships
The most precise measurement of this gap comes from a 2023 study published in Safety Science by Salmon, King, Hulme and colleagues. They tested whether contemporary systems methods work as intended when used by practitioners rather than academic specialists.
The finding was striking. When participants used AcciMap to analyze an incident, they achieved high validity for placing contributory factors at the correct system level. A frontline decision sat at the frontline level, an organizational policy sat at the organizational level, and a regulatory gap sat at the regulatory level. Placement was accurate.
What practitioners could not do was trace the relationships between those factors. They could identify that a procurement decision existed at one level and a frontline constraint existed at another, but they could not draw the line connecting them. They could not show how the procurement decision created the frontline constraint.
This matters because tracing relationships is the entire purpose of systemic analysis. Placing factors without connecting them is labeling. It produces the same outcome as writing “culture” or “leadership failure” in a contributing factors field: a correct name in the right box, with no explanation of the mechanism.
A separate finding from the same study reinforced the point. Net-HARMS, another systems analysis method, achieved poor validity overall when used by non-specialists.
The Regulator Has Crossed the Gap, but Industry Mostly Has Not
In May 2026, the U.S. Chemical Safety and Hazard Investigation Board (CSB) published its investigation report into the Givaudan Sense Color explosion in Louisville, Kentucky, which killed two workers and seriously injured three others. In Appendix A, the CSB included an AcciMap, a systems analysis method developed by Rasmussen, to trace contributory factors from the regulatory environment through corporate governance to facility-level management failures.
The CSB found that the Louisville facility’s “implementation of its process safety policies was deficient” and that management “did not assign or train any employee to have oversight responsibility and be accountable for the implementation of the process safety policies.” Recommendations targeted corporate Givaudan, the EPA, and OSHA rather than frontline operators.
This is significant because the regulator used a systems analysis method to trace how organizational decisions created the conditions for a fatal explosion. The CSB followed the pathway from corporate policy through management implementation to frontline consequence.
Most industrial organizations have not made the same crossing. In the organizations I work with, I consistently see investigations that name organizational factors without tracing how they connect to frontline conditions. The investigation writes “inadequate management oversight” in a contributing factors field, assigns a corrective action to “improve oversight,” and considers the analysis complete. The mechanism, how oversight failures created specific error traps at specific workstations, remains unexamined.
Why the Complexity Barrier Persists
The academic systems thinking methods were designed for analysts with specialist training and dedicated time. Leveson’s own STAMP/STPA guidance acknowledges this directly, noting it “represents a shift from traditional hazard analysis techniques, requiring practitioners to learn and adopt a new mindset” and that “training and supervised practice is a must.”
For FRAM, a 2020 review by Patriarca and colleagues in Safety Science found obstacles limiting practical application. A subsequent 2024 study applying FRAM in a healthcare setting noted that FRAM outputs can be “complex and difficult to interpret” for those without specialist backgrounds. These are honest acknowledgments from the research community. The methods produce valid results when applied by trained analysts, but they do not transfer easily to safety professionals, supervisors, and operations managers.
I saw this challenge firsthand through the experience of a safety director I describe in the Learning from Normal Work book. He discovered AcciMap and STPA at a conference, read the foundational papers, and tried to apply them with his team. He hit what I call the invisible barrier between what is known and what is practical. The methods required specialist analytical expertise his team did not have, dedicated time his organization would not allocate, and a level of abstraction that left his frontline supervisors unable to engage with the outputs.
His frustration mirrored a pattern I see across the organizations I work with. Safety professionals learn about systems thinking in postgraduate courses or at industry conferences. They return with the intellectual framework but without the operational tools to apply it on Monday morning. The concept makes sense, but the method does not translate. The early attempts fail because the practitioner asks leading questions, gets defensive answers, and slips back into the familiar habit of labeling behaviors rather than tracing the constraints behind them.
The operationalization gap is not a failure of will. It is a failure of translation.
How Learning from Normal Work Closes the Gap
Learning from Normal Work, developed by Psychology Applied, approaches the same systemic challenge from the opposite direction. Rather than starting with an academic framework and asking practitioners to apply it, Learning from Normal Work starts with structured field conversations and builds systemic understanding from the ground up.
Two tools illustrate how this works in practice.
The Constraint Mapper is a structured conversation method where a facilitator sits down with a frontline worker or team and asks about the constraints that shape how they actually perform a task. The conversation follows a specific structure, moving from the task itself to the conditions that make it difficult: time pressure, tool availability, procedure-reality gaps, conflicting priorities, and equipment design limitations.
What emerges from a Constraint Mapper session is a map of system-level influences on frontline behavior. A planning decision that compressed a maintenance window creates time pressure. A procurement decision that changed a supplier introduces unfamiliar materials. A sales commitment creates production targets that conflict with pre-startup checks. These connections, which are the relationships that Salmon and colleagues found practitioners cannot trace using AcciMap, surface naturally through a structured conversation about real work.
The Decision Decoder takes a specific decision that was made during work and analyses why it made sense at the time. Rather than asking “why did you do that?” (which produces defensive responses), the tool explores the information available, the competing priorities, the time constraints, and the organizational pressures that shaped the choice. The result is a traced pathway from organizational conditions to individual action, which is the core output that formal systems analysis aims to produce.
Neither tool requires specialist training in systems engineering. Both produce relationship-tracing outputs that connect organizational decisions to frontline conditions. Both work proactively, during normal operations, rather than reactively after an incident. The methodology has been deployed at enterprise scale with organizations including Johnson and Johnson, Domtar, and Ecopetrol. At TE Connectivity it produced statistically significant improvements in information quality (p < .001), measured by Psychology Applied’s training impact research.
From Labels to Constraints: What the Shift Looks Like
The difference between labeling and tracing shows up in how organizations respond to findings. When an investigation labels “inadequate training” as a contributing factor, the corrective action is predictable: retrain the workforce. When a Constraint Mapper session traces the pathway, the organization might discover that the training program was redesigned by a corporate function that had never visited the facility, using equipment specifications from a model that was replaced two years ago, and delivered in a compressed format because the operations schedule left no room for the original duration.
That is the difference between naming a factor and tracing the relationships that created it. The label produces a generic fix. The traced pathway reveals specific organizational decisions that can be addressed at their source.
Research confirms that generic fixes dominate current practice. A review of 71 health-and-safety audit reports found zero recommendations calling for deep systemic investigation. Auditors prioritized document adjustments and minor physical fixes. A systematic review of 21 root cause analysis studies by Martin-Delgado and colleagues found that only 2 could “to some extent establish an improvement in patient safety due to RCAs,” with 47% of studies identifying weak recommendations as the principal failing.
Even sophisticated redesigns struggle without a method that forces the trace. Research into one major energy company’s redesigned just-culture process, which included eight new system-focused investigation questions, found that roughly 80% of resulting actions still targeted people rather than systems. Good intentions and improved forms do not close the labelling-versus-tracing gap without a method that structures the relationship-tracing itself.
Traditional Methods Are Necessary but Not Sufficient
This is not an argument against traditional investigation methods. Fault tree analysis is mandated by the FAA and the US Nuclear Regulatory Commission. HAZOP, LOPA, and structured root cause analysis are embedded in process safety practice through CCPS and IChemE guidance. For well-bounded, technically dominated failures with short causal chains, such as a single-component failure or a clear barrier breakdown, these methods are repeatable, auditable, and genuinely effective.
The boundary condition is organizational complexity. When the causal chain runs through procurement, planning, commercial, and contractual decisions, traditional methods tend to stop at the nearest person because their analytical structure was not designed to trace cross-functional pathways. The evidence supports a complement-and-escalate position: use traditional methods for bounded technical failures, and escalate to systemic approaches when investigations keep producing shallow fixes or when the same type of event recurs despite corrective actions being implemented. IOGP 2024 safety data illustrates the scale of the problem that traditional approaches alone do not resolve. Across 56 of 72 member companies, company fatal accident rates stood at 0.57 compared to 0.84 for contractors, a gap of roughly 47%. Of 32 fatalities reported in 2024, 26 were contractors. These numbers reflect systemic conditions, contractual structures, interface management, and risk propagation across organizational boundaries, that individual-focused investigation methods are not designed to reach.
Proactive Learning Goes Beyond the Conditions Surrounding the Worker
The most significant distinction between Learning from Normal Work and reactive investigation is the starting point. Investigation starts after an event and traces backward. Learning from Normal Work starts during normal operations and traces forward, which means it surfaces the same systemic conditions while they are still just conditions, before they combine with a triggering event.
This is not a theoretical distinction. Aviation has operated a comparable approach for over 25 years through the Line Operations Safety Audit (LOSA), endorsed by the International Civil Aviation Organization since 1999 and codified in ICAO Doc 9803. LOSA uses trained peer observers on normal flights to build what the FAA classifies as a predictive hazard-identification process: non-punitive, identity-protected, conducted during routine operations. Learning from Normal Work applies the same logic to industrial settings through structured tools that make systemic inquiry practical for non-specialists.
The organizations leading on safety today are recognizing that the operationalization gap between academic frameworks and frontline practice is itself the problem to solve. Proactive learning goes beyond the conditions immediately surrounding the worker to uncover the organizational dynamics that created those conditions: procurement decisions that reshaped supplier quality, planning pressure that compressed maintenance windows, and contractual structures that left safety responsibilities unclear. This is what systemic analysis looks like when it reaches the shop floor, and it requires methods built for the people who do the work, not only the analysts who study it.
Frequently Asked Questions
What is Safety II and how does it differ from Safety I? Safety II is a perspective developed by Erik Hollnagel that defines safety as the presence of successful outcomes rather than the absence of failures. Safety I focuses on preventing things from going wrong by eliminating errors and deviations. Safety II asks how things go right most of the time, treating human variability as a source of resilience rather than a problem to control. Learning from Normal Work operationalizes Safety II principles through structured field tools designed for non-specialists.
Why do systems thinking methods stay in academia? Systems thinking frameworks such as STAMP, FRAM, and AcciMap require specialist training, dedicated analytical time, and a level of abstraction that non-expert practitioners find difficult to interpret. A 2012 review found barriers including limited validation in operational settings, usability problems, and difficulty communicating outputs to decision-makers. The methods are validated for trained analysts but have not been successfully translated for routine use by safety professionals and supervisors in industrial organizations.
Can non-expert practitioners use AcciMap effectively? A 2023 study in Safety Science found that non-expert practitioners accurately place contributory factors at the correct system level when using AcciMap. However, they achieve only moderate validity for tracing the relationships between those factors, which is the core purpose of systemic analysis. This “place but cannot trace” finding illustrates the operationalization gap and explains why additional methods, such as those provided by Learning from Normal Work, are needed.
What is the operationalization gap in safety? The operationalization gap is the disconnect between validated academic frameworks for systemic safety analysis and the ability of practitioners to apply them in daily work. Systems thinking, Safety II, and resilience engineering provide robust theoretical foundations. Most organizations cannot translate these concepts into tools their teams can use because the original methods require specialist expertise. Learning from Normal Work addresses this gap through 14 field-tested tools designed for non-specialists.
How does Learning from Normal Work make systems thinking practical? Learning from Normal Work uses structured conversation tools, including the Constraint Mapper and Decision Decoder, that guide non-expert users through systemic analysis without requiring specialist training in systems engineering. These tools surface the relationships between organizational decisions and frontline conditions through conversations about real work, producing relationship-tracing outputs in a format practitioners can execute during normal operations. The methodology is delivered through a six-month Competency Pathway deployed at enterprise scale.
Written by Dr Marcin Nazaruk, Psychology Applied. Dr Nazaruk authored the IOGP 642 industry standard for Learning from Normal Work and leads SPE/IOGP working groups on human factors in safety.
learningfromnormalwork.com
References:
Rasmussen, J. (1997). Risk management in a dynamic society: A modeling problem. Safety Science, 27(2-3), 183-213.
Underwood, P., & Waterson, P. (2012). A critical review of the STAMP, FRAM and AcciMap systemic accident analysis models. In Advances in Human Aspects of Road and Rail Transportation (pp. 385-394). CRC Press.
Salmon, P. M., King, R., Hulme, A., et al. (2023). Testing the validity of systems accident analysis methods. Safety Science, 159, 106003.
Patriarca, R., Di Gravio, G., Woltjer, R., et al. (2020). Framing the FRAM: A literature review on the Functional Resonance Analysis Method. Safety Science, 129, 104827.
Martin-Delgado, J., et al. (2020). Limitations of incident-learning systems in health organizations: A systematic review. Annals of Internal Medicine, 173(4), 304-314.
CSB. (2026). Givaudan Sense Color, Inc. Dust Fire and Explosions (Report No. 2024-06-I-KY). US Chemical Safety and Hazard Investigation Board.
Hollnagel, E. (2014). Safety-I and Safety-II: The Past and Future of Safety Management. Ashgate Publishing.
ICAO. (1999). Line Operations Safety Audit (LOSA) (Doc 9803). International Civil Aviation Organization.
