Before a hazard can be managed, it must first become a concern
Safety systems help organisations identify hazards, assess risk, investigate events and decide what action to take. The Normal-Model Framework asks what happens immediately upstream: How does something become recognised as a safety concern in the first place? A person encounters a situation. Most of it appears sufficiently normal and receives no further attention. But something may be different: an unexpected sound, an unusual reading, a hesitation, a smell, an inconsistency or simply a feeling that something is not quite right. That difference may snag them. What happens next is not automatic. They may investigate it, report it, act immediately, watch and wait — or dismiss it. Safety can depend upon that routing decision.Noticing is not enough
People often notice things without acting on them. The difference may appear too small, too uncertain or too difficult to explain. The person may lack confidence in their judgment. They may be busy, tired or under pressure. Previous warnings may have led to nothing. Speaking up may carry a social or professional cost. The question is therefore not only: Was the signal noticed? It is also: Why was it passed forward, investigated, acted upon or allowed to disappear? NMF treats attention, time, confidence, authority and credibility as finite resources. Escalating a concern requires someone to decide that allocating those resources is justified.A safety event through the NMF
Detection What differed from the person’s model of normal? A more experienced person may detect a difference that a novice cannot yet see. A familiar situation may also suppress attention because it appears normal enough. Evaluation Did the difference appear meaningful? The person must judge whether it represents danger, harmless variation, incomplete information or noise. That judgment is made from a representation of the situation—not from direct access to everything that is actually happening. Commitment Was there enough confidence to take the next step? The threshold for investigating may be lower than the threshold for stopping an operation. Different people, roles and organisations may use different thresholds. Action What happened next? Possible actions include intervening, reporting, asking another person, gathering more information, monitoring the situation, deliberately ignoring it or doing nothing without consciously deciding to do so. Waiting can also be an action when it is an active decision to watch for further evidence. Learning What was written back into future models of normal? An incident, near miss, successful intervention or false alarm can change what people notice next time. But learning from outcomes is difficult. A bad outcome does not necessarily prove that the original decision was unreasonable. A good outcome does not prove that the situation was safe.The problem of successful safety
When somebody notices a weak signal and prevents harm, the feared event never occurs. That can make the intervention appear unnecessary. Likewise, a risk may be repeatedly accepted without producing an accident. The absence of harm can gradually become evidence that the situation is normal—even when the underlying danger remains. This creates a difficult safety question: What should we learn from something that did not happen? NMF separates the quality of a judgment from the outcome that followed it. It encourages examination of what was known, noticed and reasonably represented at the time of the decision.Questions NMF can bring to safety
• What was considered normal in this situation? • What differed from that model? • Who noticed the difference? • Who did not notice it? • What made it appear meaningful or insignificant? • What competing demands were consuming attention? • What level of confidence was required before acting? • What were the perceived costs of speaking up? • Who was understood to own the next decision? • Was waiting deliberate or merely a failure to act? • What did the outcome teach? • Was the right lesson learned?A potential use—not a replacement
The Normal-Model Framework does not calculate risk, define acceptable safety standards or provide the correct operational decision. It does not replace professional expertise, safety management systems, checklists, reporting systems or incident investigation. It offers a complementary way to examine the human path from: something is different to: this may matter to: something should be done. Its potential contribution lies in making that path more visible — and helping us ask where a safety concern was detected, strengthened, weakened, passed forward or lost.
Safety
“Before we can deal with a danger, someone
must first notice that something may be wrong.”
“Noticing is not enough.
The concern must reach someone who can act.”
i
© Normal-Model Framework - 2026
Before a hazard can be managed, it
must first become a concern
Safety systems help organisations identify hazards, assess risk, investigate events and decide what action to take. The Normal-Model Framework asks what happens immediately upstream: How does something become recognised as a safety concern in the first place? A person encounters a situation. Most of it appears sufficiently normal and receives no further attention. But something may be different: an unexpected sound, an unusual reading, a hesitation, a smell, an inconsistency or simply a feeling that something is not quite right. That difference may snag them. What happens next is not automatic. They may investigate it, report it, act immediately, watch and wait — or dismiss it. Safety can depend upon that routing decision.Noticing is not enough
People often notice things without acting on them. The difference may appear too small, too uncertain or too difficult to explain. The person may lack confidence in their judgment. They may be busy, tired or under pressure. Previous warnings may have led to nothing. Speaking up may carry a social or professional cost. The question is therefore not only: Was the signal noticed? It is also: Why was it passed forward, investigated, acted upon or allowed to disappear? NMF treats attention, time, confidence, authority and credibility as finite resources. Escalating a concern requires someone to decide that allocating those resources is justified.A safety event through the NMF
Detection What differed from the person’s model of normal? A more experienced person may detect a difference that a novice cannot yet see. A familiar situation may also suppress attention because it appears normal enough. Evaluation Did the difference appear meaningful? The person must judge whether it represents danger, harmless variation, incomplete information or noise. That judgment is made from a representation of the situation—not from direct access to everything that is actually happening. Commitment Was there enough confidence to take the next step? The threshold for investigating may be lower than the threshold for stopping an operation. Different people, roles and organisations may use different thresholds. Action What happened next? Possible actions include intervening, reporting, asking another person, gathering more information, monitoring the situation, deliberately ignoring it or doing nothing without consciously deciding to do so. Waiting can also be an action when it is an active decision to watch for further evidence. Learning What was written back into future models of normal? An incident, near miss, successful intervention or false alarm can change what people notice next time. But learning from outcomes is difficult. A bad outcome does not necessarily prove that the original decision was unreasonable. A good outcome does not prove that the situation was safe.The problem of successful safety
When somebody notices a weak signal and prevents harm, the feared event never occurs. That can make the intervention appear unnecessary. Likewise, a risk may be repeatedly accepted without producing an accident. The absence of harm can gradually become evidence that the situation is normal—even when the underlying danger remains. This creates a difficult safety question: What should we learn from something that did not happen? NMF separates the quality of a judgment from the outcome that followed it. It encourages examination of what was known, noticed and reasonably represented at the time of the decision.Questions NMF can bring to safety
• What was considered normal in this situation? • What differed from that model? • Who noticed the difference? • Who did not notice it? • What made it appear meaningful or insignificant? • What competing demands were consuming attention? • What level of confidence was required before acting? • What were the perceived costs of speaking up? • Who was understood to own the next decision? • Was waiting deliberate or merely a failure to act? • What did the outcome teach? • Was the right lesson learned?A potential use—not a replacement
The Normal-Model Framework does not calculate risk, define acceptable safety standards or provide the correct operational decision. It does not replace professional expertise, safety management systems, checklists, reporting systems or incident investigation. It offers a complementary way to examine the human path from: something is different to: this may matter to: something should be done. Its potential contribution lies in making that path more visible — and helping us ask where a safety concern was detected, strengthened, weakened, passed forward or lost.
Safety
“Noticing is not enough.
The concern must reach someone who can act.”
i
“Before we can deal with a danger, someone
must first notice that something may be wrong.”
