Question 1

What is the fundamental difference in focus between a Safety-I approach and a Safety-II approach to DP operations?

Accepted Answer

Safety-I focuses on identifying and eliminating causes of things going wrong, defining safety as the absence of incidents; Safety-II focuses on understanding how things usually go right despite variability, defining safety as the presence of the capacity to adapt and succeed under varying conditions Safety-I (the traditional model) reacts to failure — find the cause, eliminate it, count incidents as the measure of safety. Safety-II (Hollnagel) recognises that most days nothing goes wrong because people and systems continuously adapt to everyday variability — and argues that understanding and supporting that adaptive capacity is at least as valuable as counting failures.

Question 2

What is meant by the distinction between "work-as-imagined" and "work-as-done" in a DP context, and why does it matter?

Accepted Answer

"Work-as-imagined" is what procedures, checklists, and management assume happens; "work-as-done" is what actually happens on watch, including the informal adaptations crew make to handle real conditions — gaps between the two are where unrecognised risk and unrecognised good practice both hide Procedures are written for an idealised, generalised scenario. Real watches involve constant small adaptations — workarounds for known quirks, informal checks, local knowledge — that the procedure never captured. Recognising this gap is central to Safety-II: the adaptations are often exactly what is keeping things safe, not a deviation to be punished.

Question 3

Resilience engineering (Hollnagel) describes four core capacities a resilient system needs. What are they, applied to a DP team?

Accepted Answer

Respond (know what to do when something happens), Monitor (know what to look for as a sign that something is changing), Anticipate (know what to expect before it happens), and Learn (know what has happened and use it to improve) These four capacities give a practical framework for assessing a team's actual resilience, not just its compliance with procedure. A DPO who anticipates weather deterioration before the ASOG amber limit, monitors subtle drift in reference agreement, responds decisively to an excursion, and the team genuinely learns from the debrief afterward — that is resilience in action.

DP — Safety-II & Resilience Practice Questions