# Safety and Learning

*A density of the Field Guide to Psychological Safety · 54 articles and 89 papers · Tom Geraghty & Jade Garratt · revised 2026-10-24 · draft*

Human error, drift, blame and just culture, Safety-I and Safety-II, and what it takes for a system to learn: where safety science and psychological safety meet, and where they argue.

Draft: drafted from the map's own summaries, awaiting its authors. Every claim links to the node it rests on.

- **This page:** https://explore.psychsafety.com/densities/safety/

## The landscape

Safety science reached psychological safety from the other direction. [Edmondson (1996)](https://explore.psychsafety.com/n/edmondson-1996.md) found that better-led nursing units reported more drug errors, not fewer, and read the result as willingness to report varying with the openness of the leader. Safety science had spent decades asking why things go wrong in systems, and was already concluding that the answer was rarely the person nearest the failure. [Woods et al (1994)](https://explore.psychsafety.com/n/woods-et-al-1994.md) set out the new view of human error: an erroneous action is a starting point for investigation, not an ending point, error is a symptom of deeper system issues rather than a cause, and judging a decision by how it turned out is a category error. [Cook (1998)](https://explore.psychsafety.com/n/cook-1998.md) put it in eighteen aphorisms: complex systems always run in a degraded state, catastrophe needs multiple small failures to combine, and attributing an accident to a single root cause is not a technical finding but a social one, the expression of a cultural need to localise blame.

Our way in is [local rationality](https://explore.psychsafety.com/n/local-rationality.md): people do reasonable things given their goals, knowledge, understanding of the situation and focus of attention at a particular moment, so when an action looks irrational we are judging from the wrong vantage point, usually an outsider's view enriched by hindsight. Tom's [Blametropism](https://explore.psychsafety.com/n/blametropism.md) names the instinct that works against it, the turning towards individual blame even where it is neither accurate nor useful, and defines blame as accountability without context.

Four questions recur. Whether safety is the absence of failure or the presence of success ([Hollnagel, Wears & Braithwaite (2015)](https://explore.psychsafety.com/n/hollnagel-wears-braithwaite-2015.md)). Whether accidents in tightly coupled systems are normal ([Perrow (1984)](https://explore.psychsafety.com/n/perrow-1984.md)) or can be organised away ([La Porte & Consolini (1991)](https://explore.psychsafety.com/n/laporte-consolini-1991.md)). What accountability means after a failure ([Accountability](https://explore.psychsafety.com/n/accountability.md)). And whether a concern, once raised, reaches anyone with the power to act on it ([Kernick (2021)](https://explore.psychsafety.com/n/kernick-2021.md)).

## The key connections

**From the person to the system.** [Reason (2000)](https://explore.psychsafety.com/n/reason-2000.md) brought the person versus system approach to a clinical audience: blaming individuals for forgetfulness or carelessness is emotionally satisfying but practically counterproductive, and a just culture is the precondition for a reporting culture. [Rasmussen (1997)](https://explore.psychsafety.com/n/rasmussen-1997.md) reframed safety as dynamic control: under cost pressure, everyday adaptive behaviour migrates towards the boundary of safe performance, and because defences are redundant no single violation shows, so removing one root cause merely means another releases the accident later. [Leveson (2004)](https://explore.psychsafety.com/n/leveson-2004.md) made it an engineering claim, accidents happening when the constraints that keep behaviour safe are inadequately enforced, and as we read Leveson, a control structure whose upward feedback is suppressed by fear has already failed. [Read et al (2021)](https://explore.psychsafety.com/n/read-et-al-2021.md) trace the sixty-year migration from blaming the person to interrogating the system, and are candid that practice lags theory and that the systems view has largely failed to reach the media or the courts. Tom's [Human Error & PS](https://explore.psychsafety.com/n/psychological-safety-human-error.md) carries the slips, lapses, mistakes and violations typology, and Jade's [Sharp & Blunt End](https://explore.psychsafety.com/n/the-sharp-end-blunt-end-of-education.md) the distinction between the ward or classroom and the policy decisions made elsewhere that shape it.

**Drift, and why warnings do not travel.** [Vaughan (1996)](https://explore.psychsafety.com/n/vaughan-1996.md) found no rule broken at NASA before Challenger: each time O-ring erosion exceeded expectation and the mission survived, the anomaly was redefined as tolerable, and structural secrecy kept anyone from assembling the whole picture. Tom's [Normalisation of Deviance](https://explore.psychsafety.com/n/normalisation-of-deviance.md) follows the pattern to Columbia, the Costa Concordia and the 737 MAX, and [Kernick (2021)](https://explore.psychsafety.com/n/kernick-2021.md) finds it in the cladding at Grenfell, fitted to other towers first without visible harm. [Weick (1990)](https://explore.psychsafety.com/n/weick-1990.md) finds in Tenerife hierarchical distortion, the steepening authority gradient making the junior crew's doubts progressively harder to voice, and Tom's [Tenerife](https://explore.psychsafety.com/n/the-tenerife-disaster-of-1977-were-going.md) adds that van Zanten asked to be called Jaap and the gradient did its silencing work anyway, because gradients form between positions, not from personality. The Bromiley review ([Harmer (2005)](https://explore.psychsafety.com/n/harmer-bromiley-2005.md)) is the clinical case: nurses who recognised the emergency were unable to make themselves heard. Beneath Tenerife and Bromiley, [Staw, Sandelands & Dutton (1981)](https://explore.psychsafety.com/n/staw-sandelands-dutton-1981.md) supply a mechanism: threat restricts information processing and concentrates control, so, as we read them, the conditions that suppress speaking up are the ordinary response of a team under threat, at least where the threat is external and the group expects to prevail.

**High reliability and mindfulness.** Against Perrow, [La Porte & Consolini (1991)](https://explore.psychsafety.com/n/laporte-consolini-1991.md) described carrier flight decks, air traffic control and a power grid achieving reliability far higher than organisation theory said was possible, with authority that migrates with tempo so that a lower-ranking specialist can direct a superior. [Weick, Sutcliffe & Obstfeld (1999)](https://explore.psychsafety.com/n/weick-sutcliffe-obstfeld-1999.md) supplied the process: five habits of collective mindfulness, from preoccupation with failure to what was later renamed deference to expertise, with the first built explicitly on Edmondson's finding that open units report more. [Vogus & Sutcliffe (2007)](https://explore.psychsafety.com/n/vogus-sutcliffe-2007.md) turned the five into a nine-item scale and found units scoring higher had fewer reported medication errors and falls over the following six months. [Westrum (2004)](https://explore.psychsafety.com/n/westrum-2004.md) gave the field its pathological, bureaucratic and generative typology, in which messengers are shot, neglected or trained, and was more tentative about the evidence than the slide version admits.

**Safety-II and resilience.** [Hollnagel, Wears & Braithwaite (2015)](https://explore.psychsafety.com/n/hollnagel-wears-braithwaite-2015.md) recast safety from minimising what goes wrong to maximising what goes right, with performance variability the source of both. [Woods (2018)](https://explore.psychsafety.com/n/woods-2018.md) insists resilience is a verb: adaptive capacity is built, spent and lost, and routinely traded away for efficiency. [Patterson & Wears (2015)](https://explore.psychsafety.com/n/patterson-wears-2015.md) show a pharmacy quietly consuming its own margin, its pharmacist's fluent adaptations making a brittle system look fine from a distance. [Ghaferi, Birkmeyer & Dimick (2009)](https://explore.psychsafety.com/n/ghaferi-birkmeyer-dimick-2009.md) found complication rates almost identical across 84,730 surgical patients and the variation in mortality driven by failure to rescue, so what separates systems that cope is noticing a deviation early and responding, not avoiding every deviation. Tom's [Safety I & Safety II](https://explore.psychsafety.com/n/psychological-safety-73-safety-i-safety-ii.md) and [WAI vs WAD](https://explore.psychsafety.com/n/psychological-safety-work-as-imagined-vs-work-as-done.md) carry the ideas, and [Shorrock et al (2014)](https://explore.psychsafety.com/n/shorrock-et-al-2014.md) distil them into ten principles with just culture named as one.

**Learning from failure.** [Edmondson (2011)](https://explore.psychsafety.com/n/edmondson-2011.md) reports executives estimating that only 2 to 5 per cent of failures are blameworthy while 70 to 90 per cent are treated as if they were, and sorts failure into preventable, unavoidable in complex systems, and intelligent. [Cannon & Edmondson (2005)](https://explore.psychsafety.com/n/cannon-edmondson-2005.md) find organisations over-attending to catastrophes and under-attending to the small failures that would have warned of them. [Tucker & Edmondson (2003)](https://explore.psychsafety.com/n/tucker-edmondson-2003.md) watched nurses work around operational failures rather than fix the system, held there by time pressure and a lack of psychological safety to escalate. [Hirak et al (2012)](https://explore.psychsafety.com/n/hirak-et-al-2012.md) found learning from failures fully mediating the link from psychological safety to later performance, and [Nembhard & Tucker (2011)](https://explore.psychsafety.com/n/nembhard-tucker-2011.md) found team learning producing worse short-term performance and, after three years, 18 per cent lower mortality. Tom's [Categorising Failure](https://explore.psychsafety.com/n/psychological-safety-86-categorising-failure.md) and [Mining for Root Causes](https://explore.psychsafety.com/n/psychological-safety-48-mining-for-root-causes.md) carry this into investigation, and Tom's [Learning from Incidents](https://explore.psychsafety.com/n/psychological-safety-85-learning-from-incidents.md) shows the conditions for learning having to exist before anything goes wrong.

## The tensions and disagreements

**Normal accidents, or high reliability?** [Perrow (1984)](https://explore.psychsafety.com/n/perrow-1984.md) holds that in interactively complex, tightly coupled systems accidents are normal, an inevitable expression of the system's own characteristics, and that the slack which would make them safer is exactly what is given up to make them worth building. [La Porte & Consolini (1991)](https://explore.psychsafety.com/n/laporte-consolini-1991.md) answer with organisations that achieve reliability anyway, and [Weick, Sutcliffe & Obstfeld (1999)](https://explore.psychsafety.com/n/weick-sutcliffe-obstfeld-1999.md) argue that mindfulness actively counters the structural dangers Perrow describes. The dispute is whether human agency can compensate for structure, and La Porte and Consolini themselves decline to force a resolution.

**Is more reporting good news or bad?** [Edmondson (1996)](https://explore.psychsafety.com/n/edmondson-1996.md) is more careful than its retellings: it does not show that open units made fewer errors, only that willingness to report varies with the perceived openness of the leader, and [Westrum (2004)](https://explore.psychsafety.com/n/westrum-2004.md) reads its tenfold difference the same way. [Vogus & Sutcliffe (2007)](https://explore.psychsafety.com/n/vogus-sutcliffe-2007.md) found the opposite in their sample: units with more reported errors and falls were rated lower on quality by their own managers, so high counts reflected less safe units rather than more transparent ones. [Montgomery et al (2025)](https://explore.psychsafety.com/n/montgomery-et-al-2025.md) searched eight databases for objective outcomes and found five significant studies pointing in opposite directions, more psychological safety predicting more reporting in some and fewer reported errors in others, with no way to tell which without knowing the organisation. [Hopkins (2009)](https://explore.psychsafety.com/n/hopkins-2009.md) has the worst case: Texas City paid its whole workforce a safety bonus for a year that included three fatalities, the number improving as the refinery prepared to explode.

**Blame, no blame, just culture.** [Dekker (2011)](https://explore.psychsafety.com/n/dekker-2011-criminalisation.md) shows prosecution after professional mistakes suppressing the voluntary error reporting through which safety cultures learn, and Tom's [Accountability](https://explore.psychsafety.com/n/accountability.md) records the lesson other clinicians drew from Bawa-Garba and Vaught: not be more careful, but be less transparent. Against dogma in the other direction, [Sherratt et al (2023)](https://explore.psychsafety.com/n/sherratt-et-al-2023.md) found no-blame redirecting blame onto paperwork and procedures, at its extreme until nothing could be learned, and [Blametropism](https://explore.psychsafety.com/n/blametropism.md) argues that blame can occasionally be appropriate and that upholding standards supports psychological safety. [Tasker, Jones & Brake (2023)](https://explore.psychsafety.com/n/tasker-jones-brake-2023.md) found a trust with a procedurally fair incident process, no shared idea of what Just Culture is, and staff still afraid; Tom's [Just Culture](https://explore.psychsafety.com/n/just-culture.md) argues the mechanics are imposed without the culture, so teams revert to punitive habits. [Goodman et al (2011)](https://explore.psychsafety.com/n/goodman-et-al-2011.md) hold prevention and resilience as complements rather than rivals, and record the natural experiment: when the US aviation near-miss system was blame-free, reporting rose; when reports could be used punitively, it collapsed.

**Did anyone speak up?** The simplest reading of this literature is that disasters happen because people stay silent, and several nodes refuse it. [Vaughan (1996)](https://explore.psychsafety.com/n/vaughan-1996.md): the Thiokol engineers raised concerns, and the structure meant the information never assembled in one place. [Kelso (2009)](https://explore.psychsafety.com/n/kelso-2009.md): no warning was ignored before the Iridium collision, because the signal that mattered ranked 152nd that day, and averaged 64th out of more than a thousand that week, among signals that looked exactly like it. [Patterson & Wears (2015)](https://explore.psychsafety.com/n/patterson-wears-2015.md): managers assume they would know if something important were wrong, so a channel that has quietly stopped carrying signal reads as the absence of a problem. Tom's [Parachutes & Evidence](https://explore.psychsafety.com/n/parachutes-and-evidence-based-thinking.md) still rests the case on the catastrophe record, concerns that existed at the sharp end and did not travel, while granting that successes leave no trace.

**Is CRM the answer, and does it travel?** Tom's [Crew Resource Management](https://explore.psychsafety.com/n/crew-resource-management-and-psychological-safety.md) shows CRM operationalising psychological safety decades before the term existed. [Helmreich, Merritt & Wilhelm (1999)](https://explore.psychsafety.com/n/helmreich-merritt-wilhelm-1999.md) document the idea repeatedly failing to stick until its rationale was made explicit, attitudes decaying after training, and courses built on low power distance meeting resistance where challenging a captain is itself the violation. [Havinga et al (2017)](https://explore.psychsafety.com/n/havinga-et-al-2017.md) found CRM showing a clear effect less than half the time in the evaluations that meet a quality bar, and suggest its active ingredient may be a psychological safety climate rather than the skills it teaches. [Milanovich et al (1998)](https://explore.psychsafety.com/n/milanovich-et-al-1998.md) argue that assertiveness training for junior crew on its own has a limited and sometimes counterproductive payoff.

**Safety culture, or whose safety?** [Silbey (2009)](https://explore.psychsafety.com/n/silbey-2009.md) argues that safety culture discourse locates responsibility with the lowest-status workers while ignoring power and competing interests. [Kernick (2021)](https://explore.psychsafety.com/n/kernick-2021.md) finds structures for scrutiny that nothing compels the powerful to act on, and [Vaughan (1999)](https://explore.psychsafety.com/n/vaughan-1999.md) that the structures and pressures which make organisations effective also generate error and catastrophe. [Deming (1986)](https://explore.psychsafety.com/n/deming-1986.md) put roughly 85 per cent of an organisation's problems with the system management designs and 15 per cent with the people in it, and told management to drive out fear.

## What this means for practice

- **Begin the investigation at the human, do not end it there.** [Woods et al (1994)](https://explore.psychsafety.com/n/woods-et-al-1994.md) treat an erroneous action as a starting point for investigation, and Tom's [Dr Richard Cook](https://explore.psychsafety.com/n/psychological-safety-78-dr-richard-cook.md) reads [Cook (1998)](https://explore.psychsafety.com/n/cook-1998.md) the same way, human error as the beginning of an investigation and not the end; [Mining for Root Causes](https://explore.psychsafety.com/n/psychological-safety-48-mining-for-root-causes.md) carries that into post-mortems, where root cause is a fiction that forecloses investigation and the conditions for honest inquiry must be established before the incident, not during it.
- **Design the speaking up in, where you can.** Tom's [Andon Cord](https://explore.psychsafety.com/n/psychological-safety-79-the-andon-cord.md) is a system that makes stopping the line the path of least resistance. [Haynes et al (2009)](https://explore.psychsafety.com/n/haynes-et-al-2009.md) found deaths falling from 1.5 to 0.8 per cent after a surgical checklist was introduced, and suspect its power lies in the briefings it forces, a structured pause that gives everyone in the room standing to speak. [Guardrails & Failure](https://explore.psychsafety.com/n/psychological-safety-84-guardrails-and-failure.md) argues that not everything is safe to fail, and that guardrails reduce the stakes of speaking up by containing consequences.
- **Attend to small failures and process indicators.** [Cannon & Edmondson (2005)](https://explore.psychsafety.com/n/cannon-edmondson-2005.md) on the everyday failures that are the early warning signs; [Hopkins (2009)](https://explore.psychsafety.com/n/hopkins-2009.md) on personal safety numbers that improve while process safety fails; [Goodman et al (2011)](https://explore.psychsafety.com/n/goodman-et-al-2011.md) on procedural decay, where a fix that works removes the feedback that sustained vigilance.
- **Respond, then learn.** The five principles in Tom's [HOP Core Principles](https://explore.psychsafety.com/n/the-core-principles-of-human-organisational-performance.md) end with how we respond matters; Jade's [Learning Teams](https://explore.psychsafety.com/n/learning-teams.md) is a practice for learning from everyday work; Tom's [PSIRF](https://explore.psychsafety.com/n/psirf.md) argues psychological safety must be established before Just Culture approaches can function. [Nembhard & Tucker (2011)](https://explore.psychsafety.com/n/nembhard-tucker-2011.md) warn that the return on learning lags the investment, so short-term metrics will undervalue it.
- **Hold the evidence lightly.** [Montgomery et al (2025)](https://explore.psychsafety.com/n/montgomery-et-al-2025.md) found nine qualifying studies in eight databases; [Westrum (2004)](https://explore.psychsafety.com/n/westrum-2004.md) calls the link between climate and performance a hypothesis; and [Helmreich, Merritt & Wilhelm (1999)](https://explore.psychsafety.com/n/helmreich-merritt-wilhelm-1999.md) say the accident rate is too rare an event to settle what CRM does.

## What the map does not yet hold

Two gaps we know of. Just Culture as an adopted policy has one empirical study here, [Tasker, Jones & Brake (2023)](https://explore.psychsafety.com/n/tasker-jones-brake-2023.md), at a single trust, beside [Sherratt et al (2023)](https://explore.psychsafety.com/n/sherratt-et-al-2023.md) on no-blame in investigation interviews; the rest of the region's case for it is argument, from [Reason (2000)](https://explore.psychsafety.com/n/reason-2000.md) onward. And the evidence that psychological safety changes objective safety outcomes is, by the count in [Montgomery et al (2025)](https://explore.psychsafety.com/n/montgomery-et-al-2025.md), nine studies, of which the five with a significant result point in opposite directions; the region holds the question, not an answer. One provenance note: [Vaughan (1996)](https://explore.psychsafety.com/n/vaughan-1996.md) is on the map from secondary sources, as its node says, so the Challenger account above rests on cross-checked reviews rather than the primary text.

## Explore the density

### Start here

1. [Behind Human Error: Cognitive Systems, Computers, and Hindsight](https://explore.psychsafety.com/n/woods-et-al-1994.md) (Woods, 1994)
2. [How Complex Systems Fail: Being a Short Treatise on the Nature of Failure, How Failure is Evaluated, How Failure is Attributed to Proximate Cause, and the Resulting New Understanding of Patient Safety](https://explore.psychsafety.com/n/cook-1998.md) (Cook, 1998)
3. [Local Rationality](https://explore.psychsafety.com/n/local-rationality.md)
4. [Learning from Mistakes Is Easier Said Than Done: Group and Organizational Influences on the Detection and Correction of Human Error](https://explore.psychsafety.com/n/edmondson-1996.md) (Edmondson, 1996)
5. [Human Error: Models and Management](https://explore.psychsafety.com/n/reason-2000.md) (Reason, 2000)
6. [Risk Management in a Dynamic Society: A Modelling Problem](https://explore.psychsafety.com/n/rasmussen-1997.md) (Rasmussen, 1997)
7. [Normal Accidents: Living with High-Risk Technologies](https://explore.psychsafety.com/n/perrow-1984.md) (Perrow, 1984)
8. [Working in Practice But Not in Theory: Theoretical Challenges of "High-Reliability Organizations"](https://explore.psychsafety.com/n/laporte-consolini-1991.md) (La Porte, 1991)
9. [Organizing for High Reliability: Processes of Collective Mindfulness](https://explore.psychsafety.com/n/weick-sutcliffe-obstfeld-1999.md) (Weick, 1999)
10. [The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA](https://explore.psychsafety.com/n/vaughan-1996.md) (Vaughan, 1996)
11. [From Safety-I to Safety-II: A White Paper](https://explore.psychsafety.com/n/hollnagel-wears-braithwaite-2015.md) (Hollnagel, 2015)
12. [Strategies for Learning from Failure](https://explore.psychsafety.com/n/edmondson-2011.md) (Edmondson, 2011)
13. [The Criminalization of Human Error in Aviation and Healthcare: A Review](https://explore.psychsafety.com/n/dekker-2011-criminalisation.md) (Dekker, 2011)
14. [Just Culture](https://explore.psychsafety.com/n/just-culture.md)
15. [Thinking About Process Safety Indicators](https://explore.psychsafety.com/n/hopkins-2009.md) (Hopkins, 2009)

### Trails through this region

- [Safety & Learning from Disasters](https://explore.psychsafety.com/trails/disasters-papers/) (14 stops)

### Everything in the region

- [Safety & Human Error](https://explore.psychsafety.com/themes/safety/)
- [Safety & Error](https://explore.psychsafety.com/themes/safety-error/)

### On the interactive map

- https://explore.psychsafety.com/?theme=safety
- https://explore.psychsafety.com/?mode=papers&theme=safety-error