The Old View of Safety

There's a poster in every breakroom in this industry. A worker with a mangled hand, a bandage where fingers used to be. "I should've locked it out." A woman with a ruined eye, safety glasses sitting on the bench behind her. "I should've worn my PPE."

Different injuries, same message. The system is fine. You're the risk.

But the worker didn't create the hazard; they were assigned to it. And the system that put them in front of an unguarded machine doesn't make the poster. The procedure that hadn't been updated since the equipment was replaced doesn't make the poster. The training that covered the regulation but never the task doesn't make the poster. It's always a person who failed. Never a system that failed the person.

And the poster is just the version at eye level. Climb the org chart and the message repeats.

The incident investigation usually lands on the operator. "Failed to follow procedure" sits at the top of the root cause databases — TapRooT's data puts it around 40% of cases — and once that finding is on the table, the harder questions rarely get asked with the same rigor. Was the procedure workable? Did the equipment still match the document? The root cause has a name and a job title before the analysis is finished. It happens often enough that OSHA and EPA jointly published a fact sheet in 2016 urging employers to push past immediate causes to the system failures underneath them. Two federal agencies putting that in writing tells you investigations weren't getting there on their own.

The vendor selling the fix speaks the same language with a bigger number attached. Calculate the fines. Describe what an uncontrolled ammonia release does to the people standing next to it. Mention criminal liability. Bring up their families. Financial ruin, physical harm, legal exposure and personal guilt layered into a single ask: you need us, or this happens to you.

And the enforcement apparatus is built around the violation. The carve-outs that do exist — VPP, audit self-disclosure policies — are exceptions a facility has to opt into. The default encounter is an inspection, and an inspection produces a citation list or nothing. There's no line on the form for a facility quietly getting better. The system documents what's wrong because that's the only thing it's structured to see.

Same message at every altitude. When something goes wrong, someone is getting found at fault.

What all of it reliably produces isn't compliance or safety. It's silence.

Sidney Dekker calls this the old view of safety: human error as the cause of the incident rather than a symptom of the system that produced it. Under the old view, the question after an incident is "who screwed up?" And everyone watching learns the lesson. Don't be the next name on the report.

The operator who notices the procedure doesn't match how the equipment actually runs mostly doesn't agonize over it. He does the work the way the work gets done, because he knows what every operator knows: the binder is for the auditor. And that arrangement holds right up until something happens. Then the document nobody asked him to keep accurate becomes the standard he's measured against, and the gap between the binder and the work stops being paperwork and becomes the finding.

The maintenance manager who knows his documentation has gaps doesn't need a vendor calculating his worst-case penalty exposure on a napkin. He's been losing sleep over it. But when the only path anyone presents requires budget approval from someone who doesn't know what PSM stands for, the cost of acting feels as dangerous as the cost of not acting. So he freezes, and from the outside freezing looks like complacency.

I argued in "Compliant and Fragile" that a clean compliance record and a fragile plant look the same from the outside. The language of fear is one reason they stay that way. It suppresses the signals that would tell you the difference: the near-misses, the procedure mismatches, the feedback from people who know what's actually happening on the floor.

Taleb would call this a fragility generator. The system doesn't just fail to detect weakness. It actively suppresses the information that would reveal it. The record stays clean. The plant stays brittle.

What changes when you retire the old view?

Instead of "who screwed up?" ask "why did it make sense to the person at the time?"

Most of what gets written up as failure to follow procedure is one of two things. Either the system designed the person into the failure (unclear lockout points, ambiguous valve labeling, procedures written for equipment that's been replaced) or the official procedure diverged so far from how the work actually gets done that the shortcut became the standard. Human factors research has a name for this: work-as-imagined versus work-as-done. The procedure describes the work somebody imagined. The floor runs the work as it actually exists. One study tracked 524 procedural steps in a high-risk industry and found a third diverged from the written procedure in practice. Nobody was being reckless. The document and the work drifted apart, and noticing wasn't anyone's job. Ask the new question and all of this surfaces. But surfaced information still needs somewhere to go.

Aviation learned this the expensive way. In 1974, TWA Flight 514 descended early on an ambiguous approach clearance and flew into a Virginia mountainside. The investigation turned up something worse than the crash: six weeks earlier, another airline's crew had misread the same clearance the same way and barely cleared the same terrain. They reported it inside their company. The information existed but it had nowhere to go.

Two years later, NASA and the FAA built the Aviation Safety Reporting System around a single design insight: the agency with enforcement power can't be the one receiving the reports. NASA administers it. The FAA funds it and never sees a name. Reports are confidential, voluntary and non-punitive, and filing one carries limited immunity for unintentional violations. Pilots, controllers, mechanics and dispatchers file roughly a hundred thousand reports a year, nearly two million since 1976, describing exactly the events that stay buried in a punitive system. The information was always there; the culture kept it underground. Aviation didn't surface it with posters. It made honesty safe, and that's what an enforcement culture built for learning looks like.

The prescription for this industry isn't more documentation, more audits, more posters. It's via negativa, a Latin phrase meaning improvement through subtraction. You may not know what the perfect safety program looks like. Nobody does. But you can name what's clearly making things worse. Stop asking what to add. Ask what to remove. Here, the answer is the fear.

Remove it and near-miss reporting shifts from admission to contribution. But it starts with something more basic: asking the operator whether the procedure matches the work. Most of the time, nobody does. The annual certification is a signature, not a conversation. The SOP exists for the auditor, the operator does the job his way, and the two diverge silently because the system never gave him a role in keeping them aligned. A PSM coordinator who hands an SOP to the operator who runs that equipment and asks "is this accurate?" learns more in ten minutes than a compliance audit reveals.

The investigation changes its question. "Why did this make sense?" produces systemic fixes: a redesigned lockout sequence, a procedure rewritten for the actual equipment, a training gap identified and closed. "Who failed to follow procedure?" produces a write-up and another poster.

The on-ramp becomes accessible. The maintenance manager wasn't frozen by ignorance. He was frozen by the size of the only step anyone offered him. A first step one person can take, the second obvious from the first. No budget line, no layers of approval from people who've never walked the engine room.

And compliance starts measuring what matters. Not the absence of catastrophe. Leading indicators: procedure update frequency, time between a finding and its resolution, near-miss reporting rates. These tell you the difference between a plant that's sound and one that's just been quiet.

The poster is the culture in miniature. It tells the operator whether the system was built around them or against them. Whether reporting a problem is a contribution or a confession.

A plant that suppresses near-miss data and a plant that has no near-misses look the same from the outside. The old view of safety is how they stay that way.

And the risk never moves. It stays with the people in the building and the neighborhood around it. That's the quiet cost of a fear-based system: it outsources the truth about your facility to whoever shows up to find fault with it, while the consequences stay home. A program that removes the fear keeps the information where the risk already lives. In-house. Yours.

The constraint was never awareness. Facilities know where they're exposed. The constraint is that every signal in the system, from the breakroom wall to the investigation report to the vendor pitch, taught people to protect themselves from the system instead of engaging with it.

Aviation had its 1974. The information about the next incident already exists on a plant floor right now, in the head of an operator nobody's ever asked. Change the language and it starts moving.