Erik Hollnagel

To err is human: the ETTO principle

Lecture date: 17 December 2008

Surprisingly, it is the investigation of “non-accidents” that inspires Erik Hollnagel most in his work: though, as he explained, accident investigation and risk assessment models universally focus on what goes wrong and the elimination of “error”. This principle, in an approach dating back to the Industrial Revolution, may work with machines: but it does not work with humans, who are a common element in all accidents. Variability in human performance is inevitable, even in tasks we repeat every day. The need to identify a cause for any accident has coloured all our thinking about risk assessment.

The trouble is that we don’t just “find” causes; we tend to “create” them, and when none can be found, we use the “act of God” opt-out clause. This is a social process, which changes over time just as thinking and society change: from the end of the Second World War until the late 1970s, most accidents were perceived as a result of technical failure. The Three Mile Island accident (March 1979) saw the emphasis begin to shift from technical to human failure. With the Challenger disaster in 1986, the cause identified was not solely technical or human but organisational.

The current financial crisis is another such organisational accident, and future accidents will no doubt inspire us to find new causes by which to describe them. Hollnagel would prefer to be able to explain why – for most of the time – we do things right, and to use this knowledge to shift accident prevention thinking from identifying causes to understanding and supporting human creativity, learning and performance variability. Resilience Engineering (the subject of his latest book) proposes a simple principle which can be applied to any situation or domain to reveal the “trade-offs” we make in the pursuit of attaining our goals: the Efficiency/Thoroughness Trade-Off (ETTO) principle. We make these trade-offs for a variety of reasons in order to get something done: on the side of thoroughness, we pay more attention to safety; on the side of efficiency, we do things faster. These trade-offs are not made for any bad reason, but for the greater good.

In an example taken from nature, Hollnagel argued that birds display ETTO every day when they risk eating in the open, where food is plentiful and the danger is greatest, as opposed to eating less but in safety. Indeed, human ability to adjust performance to changing circumstances is also a key to our success. Things go right most of the time, but occasionally and inevitably, an unforeseen combination of the same trade-offs result in accidents. The origin of both success and failure is the same: performance. The systems we depend upon today are complex, intractable, interdependent and constantly changing. Our safety is the ability to succeed in varying circumstances. Therefore, we need to build human performance variability into these systems. Hollnagel argued that if varying performance can lead to failure, the current focus of risk assessment, it is just as variable when resulting in success: and it is success we should be focusing our attention on. He believes this would be a leap forward in the thinking around accident prevention and would make a positive contribution to the design of socio-technical systems and management.


Download the interview (mp3)

About the speaker

Erik Hollnagel (PhD, psychology) is Professor and Industrial Safety Chair at École des Mines de Paris (France), Professor Emeritus at University of Linköping (Sweden), and Visiting Professor at the Norwegian University of Science and Technology (NTNU) in Trondheim (Norway). He has since 1971 worked at universities, research centres, and industries in several countries and with problems from several domains, including nuclear power generation, aerospace and aviation, air traffic management, software engineering, healthcare, and land-based traffic. His professional interests include industrial safety, resilience engineering, accident investigation, cognitive systems engineering and cognitive ergonomics.

He has published more than 250 papers and authored or edited 13 books, some of the most recent titles being “Resilience Engineering Perspectives: Remaining Sensitive to the Possibility of Failure” (Ashgate, 2008), “Resilience Engineering: Concepts and Precepts” (Ashgate, 2006), “Joint Cognitive Systems: Foundations of Cognitive Systems Engineering” (Taylor & Francis, 2005) and “Barriers and Accident Prevention” (Ashgate, 2004). Erik Hollnagel is, together with Pietro C. Cacciabue, Editor-in-Chief of the international journal of Cognition, Technology & Work.