{'fraction_non_alphanumeric': 0.028064927638235166, 'fraction_numerical': 0.007874015748031496, 'mean_word_length': 5.067253803042434, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
People, systems and safety: resilience and excellence in healthcare practice.

This article outlines recent developments in safety science. It describes the progression of three 'ages' of safety, namely the 'age of technology', the 'age of human factors' and the 'age of safety management'. Safety science outside healthcare is moving from an approach focused on the analysis and management of error ('Safety-1') to one which also aims to understand the inherent properties of safety systems that usually prevent accidents from occurring ('Safety-2'). A key factor in the understanding of safety within organisations relates to the distinction between 'work as imagined' and 'work as done'. 'Work as imagined' assumes that if the correct standard procedures are followed, safety will follow as a matter of course. However, staff at the 'sharp end' of organisations know that to create safety in their work, variability is not only desirable but essential. This positive adaptability within systems that allows good outcomes in the presence of both favourable and adverse conditions is termed resilience. We argue that clinical and organisational work can be made safer, not only by addressing negative outcomes, but also by fostering excellence and promoting resilience. We outline conceptual and investigative approaches for achieving this that include 'appreciative inquiry', 'positive deviance' and excellence reporting.


Introduction
Optimising patient safety is a goal of healthcare. Much has been spoken and written about it, and it is well established as a core activity for all those working in healthcare systems.
This has not always been the case; historically, error and harm from healthcare was an accepted risk of treatment.
However, as standards of treatment and care have improved this acceptability was questioned and refuted, and the patient safety movement born.
This article summarises the evolution of safety science, describing historical approaches, comparing them with recent concepts in safety, and describing how they affect staff working within the healthcare system. It introduces some of the models we use to explain safety-related work and the way we view the system as a whole, and it gives examples of tools and techniques to apply in practice. It does not aim to be a systematic review [1], but instead reflects the authors' (at times partisan) interpretation of the research literature and reflection on clinical and organisational experience. Its purpose is to give the reader an insight into the evolution of current approaches to patient safety and an appreciation of some of their limitations. It also gives an account of some of the newer concepts and the ways they can be applied in everyday safety work. safety management' [2]. In the first age, it was technology that posed the main threat to safety. This was not only because machines were inherently unreliable and dangerous, but also because people had not yet learned to identify and avoid the risks they posed. This age is generally held to have begun around the time of the industrial revolution (c. 1770), but extended well into the 20th century. Both Heinrich's seminal book on industrial safety in the early 1930s [3], and the development in the 1950s and 1960s of a number of methods of analysing risks within technological systems describe this view of safety.
Accidents in the first age of safety were attributed to breakdown, failure and malfunction of machinery. The models used to describe and explain accidents have evolved in parallel with the changes in safety thinking, typified by the three ages listed above. The Domino model, proposed by Heinrich in the 1930s [3] describes a set of domino pieces that fall, each knocking down the next, exemplifying simple, sequential, linear causality. Within this paradigm, event analysis is geared towards finding the step (or component) that 'failed'. Although simple, this model guided risk management well into the 20th century and gave rise to many sophisticated prospective analytical techniques, such as hazard and operability studies and failure modes and effects analysis. Such prospective approaches are fruitful and have also been applied to healthcare, as in a previous study that attempted to identify points in the peri-operative pathway where safety could be enhanced [4]. These were used to try to anticipate the likelihood and severity of possible points of failure or malfunction in industrial systems, so that procedures and 'fail-safes' could be put into place to deal with possible hazards and prevent accidents. Although they focused on the technology rather than the humans operating it, they were applied even to complex mechanical systems such as power plants and led to considerable advances in safety at the time.
The limitations of focusing on technology as the source of accidents were illustrated by the disaster at the Three Mile Island nuclear plant in the US in 1979. During the preceding 20-30 years, there had been some attempts at scientific study of the interplay between humans and technology, but these had focused on efficiency and productivity rather than safety. In comparison with technology, humans 'came to be seen as too imprecise, variable and slow' [5]. The Three Mile Island incident evolved from a minor mistake made during routine maintenance; the operators in the plant control room interpreted conflicting instrument readings in a way that allowed them to apply standard operating procedures in an attempt to correct the problem. However, this interpretation was incorrect and made the situation worse. Only when (some hours later) a new technician was called in to the control room was the situation correctly re-interpreted and a much more serious outcome averted. This incident struck a blow to the notion (supported implicitly by the domino model of accident explanation) that all possibilities of failure could be predicted or managed by predictable means.
Furthermore, it also became generally accepted within the safety science community that it was no longer possible to ignore the role of people in complex systems. To promote human reliability, the aim became to reduce the human contribution in the processes of care to a minimum by standardising and improving basic processes, and automating work as much as possible [6].
However, there are some problems with this approach, especially as applied to healthcare. Many things cannot, or should not, be standardised (see below). Automation is helpful in some aspects of care, but unnecessary or undesirable in others. Logically, human reliability is inevitably accompanied by the potential for unreliability. Although technology can be thought of as morally neutral (it is a nonsense to suppose, for instance, that a machine might deliberately malfunction), humans carry the power of agency, meaning that intention can be This approach was adopted in aviation and subsequently in healthcare, in the NHS and especially in anaesthesia [8][9][10].
A typical approach is depicted in Fig. 1.
However, within 10 years or so (towards the end of the 1980s) it became clear that although the inclusion of human elements was necessary, it was not in itself sufficient to give form to a model that could explain accidents in complex organisational systems. The resulting attention given to broader safety management systems led to the name given to this 'third age'. A move away from the probabilistic assessment of possible risks, and the linear backward search for contributing or causal factors in accidents, was accompanied by a trend towards understanding organisational culture and processes in addition to technology and human behaviour. The relationships between individual human beings, the technology they use, and the organisational setting they work within, together make up complex sociotechnical systems.
The transitions between the first and second, and especially between the second and third, ages have not been clear cut. As Hollnagel noted in 2014, 'the practices of risk assessment and safety management still find themselves in the transition from the second to the third age' [5] and indeed elements of all three ages may co-exist. We should also note here that the three ages of safety (having first been described in 2001) are retrospective constructs that aim to make sense of (and possibly over-simplify) history. Nevertheless, we believe they offer a useful perspective. A summary can be seen in Table 1.

From Safety-1 to Safety-2 and two views of work
The focus in the third age of safety is more on trying to understand and strengthen everyday features of work within complex sociotechnological systems that promote safety. This is the dominant paradigm in what Hollnagel has termed 'Safety-2' in comparison with 'Safety-1', where the focus is essentially on errors and how they have arisen [5]. The system property promoting the maintenance of safety has been termed resilience, and is well defined by Hollnagel as 'the ability to succeed under expected and unexpected conditions alike, so that the number of intended and acceptable outcomes is a high as possible' (p. 134) [5].
Hollnagel went on to articulate the concepts of 'work as imagined' and 'work as done' as two contrasting ways of understanding work [5]. 'Work as imagined' is defined by the rules and standards outlining the way things should work and represents how designers, managers, regulators and authorities believe work happens or should happen. Taking a work-based view of accidents, each step of the investigation model in Fig. 1 can now be seen to be at best limited in its usefulness, and at worst fundamentally flawed.
Waiting for something to go wrong risks unnecessary harm if the problems within the system can be detected before they cause an accident. Finding out what happened (typically by root cause analysis, which is now well embedded in NHS culture) often focuses on the 'first story'; that is, establishing the 'facts' and the timeline linking them. This is essential, but gives an account of events that is incomplete without the meanings given to them by the people concerned, or an understanding of why they acted as they did [11]. The third step, that of attributing actions to people, is the most dangerous. This can very easily stray into the allocation of blame, which is bad for safety in general; humans need to feel safe to act safely, and a punitive culture   will discourage reporting of error and its balanced analysis.
Furthermore, safety investigations often stop as soon as human error has been identified as a causative factor. As noted above, attributing actions to one individual is undesirable and also closes off further investigation into organisational function, norms and behaviour. The fourth element (finding the root cause) is problematic, as the 'root' may never actually be reached, and it is also logically asymmetrical [12]; although it is possible to argue that every cause must have an effect, not every event has an identifiable antecedent, let alone one that can be considered causative (reverse causality).
The final step, that of fixing the system (so that the accident does not happen again) ignores that fact that the system usually operates successfully to prevent the occurrence or propagation of accidents, and so in that sense it does not need fixing. At its simplest, safety becomes a matter of procedures and compliance with them. Means of repair such as recommendations and guidelines very much demonstrate a reinforcement of 'safety as imagined', and often do not mean much to those on the front line. Large enquiries offer many recommendations that are naively assumed to be independent, but which in practice may be contradictory.
However, the strongest indictment of the 'fixing' approach is that it implies a binary view of work and outcome; that correctly functioning systems (and the humans within them) do not lead to adverse outcomes, which can only come about through malfunction or error [13]. As we argued above, this is an oversimplification of work; responsiveness to changing needs and circumstances is essential to get the job done. This performance variability helps produce the right outcome, although sometimes it may contribute to an unacceptable outcome. This is illustrated in Fig. 2. It then becomes possible to posit a revised investigation model (Fig. 3).

Problem areas in patient safety
Studying patient safety and applying its scientific principles to practice is complicated. Here, we deal with four factors that contribute to this. The second is related to this and deals with the advantages and disadvantages of standardisation. In a short but brilliant recent article, Wears explored the complexities behind the common and deceptively simple call for greater standardisation in healthcare [15]. The benefits of standardisation are obvious in many settings and are of particular relevance to safety. Standards promote routinisation, which in turn allows the freeing-up of 'attentional resources, diverting them from mundane to truly complex or pressing issues' [16]. Wears goes on to delineate five problematic aspects of standardisation, especially in healthcare. These include: its philosophical basis rooted in old-fashioned production line industrial processes; its tendency to ignore existing practices, albeit without the formality and documentation usually preferred by managers (see, for instance, our previous work on recovery room handovers [17]); and the fact that important in maintaining safety [22].
The third problem area is transferability. Ideas from safety science have been applied to healthcare and have much to offer, but there are barriers to transferability. First, safety is rightly seen as only one dimension of healthcare quality [23], but as in industry, timeliness, efficiency and customer focus ('patient-centred care') are also important.
However, effectiveness and equity of care must also be included in healthcare quality [23]. Second, although patient safety is a clinical and policy priority, the ideas and  [24]. It has also been argued that the notion of patient safety has been used as an instrument of governmental control; Yeung and Dixon-Woods refer to 'discourse creep' as issues within healthcare are redefined as safety problems to legitimise intervention and potentially limit professional autonomy [25]. Thus, safety is closely related to personal/professional identity and roles. In this context, it is worth noting that despite numerous initiatives to improve patient safety, we have little idea whether they have worked. Although Vincent has argued that this is because we lack the systematic measures to evaluate possible changes, it is also possible (though speculative) that it is more important politically for care to appear to be getting safer than for this to be actually achieved [26]. He and Amalberti have also more recently made the point that care envisaged by standards and guidelines differs from the care given to patients. They note that much care falls below the levels envisaged by standards and guidelines, but point out that it is politically unpalatable for organisations (let alone governments) to admit this openly. They argue that this has two consequences for the management of risk.
First, 'it becomes very difficult to study or to value the many adaptive ways in which staff cope in difficult environments to prevent harm coming to patients'. Secondly, and more importantly, 'attempts to improve safety may not be targeting the right levels (of the organisation) or the right behaviours' [27].

Creating safety and promoting resilience
We suggested above that the key property of safe systems as understood within the Safety-2 paradigm is robustness in the face of error-creating conditionsresilience. Resilience can be defined as the 'everyday performance variability that provides the adaptations that are needed to produce good outcomes, both when conditions are favourable and when • Needs to go beyond the 'first story' • Not necessarily linear -multiple, interacting variables • Understand why previous similar actions went well -examine everyday activities and potential 'rescue points' • Strengthen the system to promote things going well Figure 3 Revised approach to accident investigation. 512 they are not'. Although this review has chosen not to focus on individual resilience, well-being and mental health (these are well dealt with elsewhere), like many, we believe these underpin the resilience of organizations [28,29]. We would simply point out that human performance is poorer if people are tired [30,31] hungry, stressed, sad or are the victims or even witnesses of rudeness or coercion [32,33].
Mental state also influences how people deal with the consequences of error. They need to feel safe to be safe [5], but we would argue that anaesthetists also need to feel safe to act safely; working within a system where individuals are punished for 'mistakes' does not create a good working atmosphere. They also need to feel able to ask for help [34] and to raise concerns [35] without being criticised. As professionals, we need to learn to balance comfort with constant vigilance and 'intelligent wariness' without becoming overwatchful [36]. A 'sixth sense' for safety [37], Work' [38]. This paper sets out the link between the level of staff engagement and the quality of patient care, including safety. It references the 'burnout epidemic' affecting healthcare, citing the link between physician burnout and medical error [39]. Hypothesising that joy is the antithesis of burnout, it describes a framework of factors that facilitate joy, one of which is physical and psychological safety (Fig. 4). These factors should not be considered as optional extras to our workplace, but rather the starting point to ensure that staff can deliver safe, high-quality care. Fostering joy in work, or even just one aspect of itpsychological safetycan be a challenge when the language we use when we talk about safety is primarily negative. We discuss critical incidents [10], error [7], never events [40][41][42] [43][44][45], but regarding positive interactions at work our tendency is, at best, to gratefully accept these and move on. Could we improve our safety culture and introduce some balance by discussing 'great catches' (a positive spin on the near miss), episodes of excellence or 'always conditions' [46]? safely' [48,49].

Figure 4
Institute for Healthcare Improvement framework for improving joy in work [38]. Reproduced with permission.
We believe that a strength of this definition is that it highlights the conditions needed to promote resilience. The report goes on to suggest that an active approach to safety must be developed with a focus on creating safety and not just identification of and measurement of harm.
Resilience and excellencemethodology and models If we are to effectively manage our systems and create safety, it is logical that we must first properly understand how they work in order to recognise why problems occur. It is imperative that we measure quality and safety appropriately and accurately, which as mentioned previously [26] is arguably not happening currently.
Our traditional approaches to quantify safely (or risk) only tell part of the story; focusing on excellence in practice is also vital [50,51]. This appears to offer a simple but potentially effective approach to improving quality and safety. Pilot data suggest that rates of best-practice antibiotic prescriptions increased when positive feedback from reports occurred [59]. In contrast to focussing on finding and fixing errors, this asset-focussed approach is being used in quality improvement methodology in a Health Foundation funded project, positive reporting and appreciative inquiry in sepsis [60].
Noticing and showing appreciation for good work also has the potential to help staff feel valued and improve engagement, potentially fostering 'joy in work' [38]. 4. Can you give me an example of when you improved safety -directly for a patient, or within your organisation?

5.
Tell me 3 small wishes that you have for your team and/or your own work? Figure 5 An example of an appreciative conversation. Taken from EP's work with appreciating people and reproduced with permission.

514
Appreciative Inquiry methodology is a natural fit for positive reporting systems and has been adopted for investigation of Learning from Excellence reports. One example of this reverses the current approach to root cause analysis, replacing the existing Serious Incidents Requiring Investigation meetings with a renamed 'Improving Resilience, Inspiring Success' approach [58]. A strength of these meetings is that individuals and teams cocreate the improvement strategies for their areas of practice.
Appreciative Inquiry can also be used outside positive reporting systems. Deficits or problems are reframed, and generative conversations create solutions based on what can be achieved [66]. One author (EP) has used appreciative inquiry conversations to establish 'what makes a good day' with anaesthetic and intensive care colleagues in service development meetings with teams and during study days.
An example of an appreciative conversation can be seen in Critics of these positive approaches might feel uncomfortable with the absence of criteria to define what constitutes excellence, but this would seem to be a strength of the systems. If we wish to better understand what makes a system perform well under pressure and identify novel approaches to improvement, we need to allow freedom to describe the system when it is working. Perhaps this reflects a reluctance to accept that 'work as done' can vary from 'work as imagined', as well as the ingrained nature of our prevailing approach to safety. However, the repeated occurrence of never events (despite patient safety alerts), improved frameworks and procedures suggest that innovative strategies should be encouraged.

Conclusion
The unspoken expectation is that healthcare practitioners of every profession are to undertake three roles. The first is to undertake the clinical function for which they are engaged, whatever that might be. The second is to not only maintain and enhance patient safety in their own work but also by intervening as necessary in the organisational systems they work within. The third is to seek out opportunities for improving quality and make sure that positive changes are made. We hope that our review has contributed to understanding how these roles intersect and has provided conceptual and practical tools for making sense of some of the demands of the politicised activity that is modern healthcare.