About implementation of safety rules

J. Leplat
Ecole Pratique des Haute Etudes, 41 rue Gay-Lussac, 75005 Paris, France
1. Introduction
The term `safety rule' covers a wide variety of subjects, the taxonomy of which is
very dicult and constitutes in itself a theme not lacking in interest. Here, I would
like to limit this text to the safety rules, also very varied, which concern operators at
the executive level. Those rules are established by the rm itself, very often for
determined types of tasks. What will be said here is not the result of personal
research, but of reection from currently available documents on this theme. With-
out abstaining from making reference to other points of view, I will essentially take
a psychological point of view here.
The presentation is directed by the schema givenin Fig. 1. I will start with safety rules
as they currently exist and will rst discuss their nature and characteristics from an
external point of view. Then, I will examine two main conditions of implementation of
these rules: acceptability or desirability of the rules for future users. Here the questions
are: is the operator inclined to apply these rules? Are the means necessary for imple-
mentation present and usable? What are the reactions when the rules are not accepted
in their normal form? Accessibility of the rules is a condition that corresponds to the
questions: does the operator have the rules to apply at his disposal? Are the means
necessary for implementation present and usable? Can the relevant information be
extractedfromthe rules? The last point will discuss the place andlimits of safety rules in
the process of improving safety. In particular, I will examine two main types of sub-
stitutes: change in work conditions and development of competence and autonomy.
2. General characteristics of safety rules
In this rst part, I will dene some general characteristics of safety rules which
will help the reader to have a better understanding of the problems raised by the
implementation of these rules: here, it is a question of internal study of the rules.
SAFETY SCIENCE
Safety Science 29 (1998) 189204
0925-7535/98/$19.00 # 1998 Elsevier Science Ltd. All rights reserved.
PII: S0925-7535(98)00022-8
2.1. The notion of the rule
A rst essential feature of the rule is its operability. A rule denes the char-
acteristics an action must full: it says what must be done (or not done) and the
conditions to do this. The canonical form of the rule is: ``if (such conditions are
fullled), then (do such an action)''. Conditions may be more or less explicit in
the rule. Often, only the conditions specically connected with the rule are made
explicit.
Every rule contains an implicit part relating to the representation of the user's
competence that its author has assumed. Rule operationality denes to what extent,
at what level, the rule indicates, to an individual of determined competence, actions
to be executed in order to achieve the xed objective. The rule can only be opera-
tional and dene all the conditions of implementation if these conditions are known
and foreseeable. In the opposite case, rule operationality decreases and tends
towards a high level of abstraction.
Fig. 1. Some conditions of implementation of safety rules. Read a!b, as b is depending on a.
190 J. Leplat/Safety Science 29 (1998) 189204
2.2. Safety rule
One can adopt the denition proposed in the `In Search of Safety: the Use of
Rules to Achieve Safety' workshop announcement: ``operative principle for
achieving safety''. Here, the objective of the rules concerns safety. It is a matter
of dening the characteristics of an action which will make it safe, i.e. an action
entailing no harmful consequence for the person carrying it out or for other
people.
2.3. Links between safety rules and the expected result of their implementation
One could almost speak here of the link between safety rules and attained level of
safety. This link can be direct, in the sense that rule implementation can more or
less completely ensure safety and avoid (or not) an accident. For example, cutting
the current before repairing a machine will denitely stop any risk of electrocution
(direct link, of deterministic type). ``Not exceeding 50 km/h in a city'' does not
completely protect one from accident. We can also reverse the problem: in some
cases an oence against the rule will necessarily entail an accident (for certain types
of repair, the presence of a current will lead to electrocution), but in other cases, e.g.
not exceeding 50 km/h in a city, this does not necessarily lead to an accident: here,
the link to an accident is probabilistic.
The link between safety rules and the result of their implementation can be
considered objectively, as above, but also subjectively: then, one is concerned with
the representation the subject has of this link. This representation is related to the
knowledge the subject has concerning the mechanism of the action (he knows that
a particular part of the machine is normally switched on and cannot be approached
without risk). This link can also be perceived by feedback of the results after
an oence against the rule. Inadequacy of knowledge or feedback contributes to
distend the link between safety rules and the results of their application (Reason,
1990, p. 20).
2.4. Links between safety rules and work
Safety rules lie within a task with which they maintain more or less direct bonds.
In a study concerning the role of safety in documents available to the operator at
work, Vandevyver (1990) distinguishes four types of documents:
1. documents not specially taking safety into account;
2. documents involving a separate part concerning safety;
3. documents devoted only to safety; and
4. documents integrating safety aspects in the description of the dierent work
phases, e.g. ``before starting the machine, make the machine work on empty;
verify that the knob `emergency stop' stops the machine instantaneously''.
Beyond the characteristics of the documents, it can be noted that the place of a
safety rule in work oscillates between two poles:
J. Leplat/Safety Science 29 (1998) 189204 191
1. it cannot be distinguished from a work procedure: to respect work rules is
at the same time to work with safety. Every deviation from safety can entail
damage to production; and
2. it can be completely distinct from a work procedure, e.g. to wear a safety
helmet on the site.
In the rst case, safety is a property of an action, belonging to a work procedure; in
the second case, safety concerns a specic action, additional to the work procedure.
2.5. Safety rules and system of rules
Safety rules should be considered in relation to each other: the issue of compat-
ibility between rules. These relations can themselves be envisaged in reference to
various systems of rules: a set of rules for an individual work place, a set of rules for
a team, a set of rules for a whole set of works. Conicts can occur within and
between these systems. It is possible to identify some of their sources:
1. rules have been established progressively, by successive additions, often to ad-
dress accidents and incidents, without concern for coherence between rules; and
2. rules have been established by dierent organizational authorities. A typical
situation is the one in which an external contractor works at the same place as
the rm it assists (e.g. for repairs). Safety rules to which the operators of the
two rms are submitted are not always harmonized nor known by both.
(Fleury, 1998, in this workshop) gives examples of systems of rules and
emphasizes the importance of their coherence.
2.6. Links between the objectives of rules
Safety rules have their own objectives which are, precisely, to ensure safety. These
objectives are to be distinguished from the objectives of production rules: to ensure a
result corresponding to the criteria of ecacy. The carrying out of these objectives
of safety and production requires actions which do not necessarily coincide, and
conicts between safety and production rules have often been mentioned (Anon.,
1969). For example, in a transport steelwork department, ``don't put more than n
wagons in a convoy'' (safety rule) can be contradictory to the production rule
``remove the waste products as rapidly as possible''. The compatibility of dierent
types of rules can be considered at the individual, team or organizational level. It
raises the problem of the articulation of production and safety departments which
are often at the origin of these rules.
2.7. Presentation of rules
Essentially, a rule expresses the conditions under which an action must be
executed. Therefore, it is essential to consider how these conditions and this action
are presented. At the same time, it is essential to determine the foreseen rule use. In
192 J. Leplat/Safety Science 29 (1998) 189204
every presentation design, it is essential to take into account the characteristics of
future users. These last points will be discussed mainly in the section on `imple-
mentation'. Here, only a few types of study will be mentioned.
2.7.1. Mode of presentation
Here, it would be interesting to give space to the merits of various modes of
presentation (poster, paper documents, video, etc.), but there are few studies on
this theme.
2.7.2. Rule legibility
This concerns what can be said about physical presentation of the rules: form and
size of the characters, arrangement, use of graphics, etc.; in more complex cases, use
of computer. In a study concerning pilot training, Wibaux (1992) notes:
... if the instructions concern a high risk activity, typographical arrangements
(italics, thick, capital, frames) can help the reader build a representation of the
level of hazard relative to a given situation. (p. 19)
2.7.3. Degree of rule explicitness
On a scale of abstraction, such as the one dened by Rasmussen et al. (1994), the
degree of explicitness should be determined. This depends essentially on the opera-
tors' competence. The less competent the operators, the less abstract the rule must
be. In rules catalogues (as in the posters where they appear) one can nd all the
levels of explicitness, e.g.:
1. ``If you note abnormal work conditions, ask your supervisor for explanations.''
2. ``In welding, verify the correct functioning of the protection.''
3. ``If you have long hair, put on a hairnet or tie your hair back.''
4. ``To clean the machine at the end of operation, use a brush and put gloves on.''
(SNECMA, 1982).
General rules are relevant for very dierent situations: in a particular situation,
they must be operationalized by the operator, or else, new, more specic rules must
be designed. In this case, safety rules are often associated with work rules, but this
association may be more or less well thought out.
2.8. Rules' architecture
Often, work rules consist of a list of elementary actions to carry out; e.g. in a
steelwork job (Leplat, 1989) we can nd: ``Put the winder on the chuck, tighten the
winder on the chuck, lift the maintenance hook ...''. As already mentioned, safety
rules are more or less integrated into these rules; often, they appear at the end of this
list, e.g. ``it is forbidden to place a hung bobbin on the ground without it being
supported''. Then, there is a dissociation between execution rule and safety rule. The
latter, however, could be presented as one of the conditions of execution of the
operation concerned.
J. Leplat/Safety Science 29 (1998) 189204 193
In a study in a steelwork workshop, where safety and execution rules were
presented separately, I suggested the following principles of rules design: for every
work phase or sub-task distinguished, indicate the conditions of hazard release,
execution and control, the possible errors and incidents with their means of detec-
tion, recovery and prevention. In this way, the safety rules are integrated into the
course of the work itself and appear as a condition of a correct course of action.
3. Conditions of implementation
In the previous part, I tried to dene the object `safety rules' and, briey, the sys-
tem of `safety rules'. Now, I examine how rules are implemented by operators and
work groups, and what main types of problems this implementation raises. These
problems cannot always be easily inferred from the characteristics of rules and will
only be revealed by studies of eld situations and accidents. I can only present some
essential aspects which are centred around two notions: acceptability and accessi-
bility. These imply that in order for a safety rule to be implemented, it must be
accepted, i.e. the person is willing to apply it, and accessible, i.e. the person must
have the means to know and apply it. In the previous section concerning the general
characteristics of safety rules, some suggestions were already made concerning the
question of implementation.
3.1. Acceptability
It is clear that an essential condition to the implementation of rules is that they are
accepted by people who have to apply them. If they are not accepted, the operator
may apply them incorrectly (under duress) or not at all. Here, I will only examine
some of the reasons which lead, if not to the refusal, at least to some reservations
about the use of rules. I will not consider the case of pure and simple rejection.
3.1.1. Cost of implementation
Implementation of rules can entail eort that the operator is not willing to make,
in particular if he considers his own procedure is without danger. A typical case
occurs in everyday life when using an underground passage for crossing a busy
road. Many pedestrians continue to cross the road above ground to avoid the stairs
and thus save time. Battmann and Klumb (1993) have analyzed in detail the role of
cost (using the concept of `behavioural economics') in the `compliance with safety
regulations'.
Cost is also often connected to the diculty of rule accessibility and means of
implementation. For example, in an accident analyzed in a steelwork workshop
(Leplat, 1987), a worker wanted to clean the ground by spreading lime. As he was
taking the lime froma moving skip, he was dragged along by the skip and struck a post.
The worker acted in this way because there was no lime close at hand and because,
being a newcomer in the works, he did not know where to nd it. To save eort in
searching, the worker broke the rule which requires no access to a moving skip.
194 J. Leplat/Safety Science 29 (1998) 189204
Cost can also be a cognitive cost. An operator can stay with a routine execution,
no matter how poorly adapted to the present situation, rather than follow the rule
which imposes a dicult adjustment of the machine. It is the same for a user who
continues to work with a badly adjusted instrument because adjustment requires
long computations.
3.1.2. Conicts between rules
When several rules must be implemented in the same situation, these rules some-
times cannot be applied simultaneously or are not compatible. In the short term,
the conict can only be resolved by xing a hierarchy of importance between the
rules, particularly when based on the consequences entailed by their absence of
implementation. In some cases, this can bring one to neglect a rule: e.g. if, in a bus, a
person is ill, the rule of ``assistance to a person in danger'' prevails over the rule
``don't speak to the driver'', and the driver is asked to stop at the rst convenient
place.
Given their variety, the possible conict situations are practically impossible to
foresee completely: so, it can never be totally excluded that one will be faced at some
stage with such conict. Then, the operator has to judge, from a knowledge of the
situation, what rule(s) must prevail: this requires a good level of competence.
3.1.3. Relevance of safety rules
Safety rules can be considered more or less relevant to their object. Individuals can
judge a rule as bad because it entails bad consequences in some circumstances. In
the past this was the case with the rule concerning the wearing of safety belts. The
opponents put forward that the belt constituted a danger in case of re, because
the driver would have diculty in getting free. The irrelevance of safety rules can
result from a number of typical conditions: I will indicate some of them briey.
3.1.3.1. Mismatch between prescribed task and real activity. We know that a task can
be carried out in dierent ways, particularly when it is complex. In particular,
execution by a novice is not identical to execution by an experienced operator,
and execution by two experienced operators with dierent backgrounds can also be
dierent. But there will almost always be only one rule. This rule will be based on
the procedure dened by the expert (prescribed task), and may be irrelevant for
another way of working which can, however, be safe or not. More generally, we can
say about safety skills what Collins (1992, p. 283) writes about skill in general: to
paraphrase, safety skill or safety behavior cannot be captured only by what can be
said of it.
Veyrac et al. (1997) have systematically analyzed the mismatches between rules
prescribed for solutions of incidents and rules eectively implemented by operators.
They dene the nature of these deviations, their origin, consequences on the activity
and, nally, some general conditions for a relevant use of rules.
3.1.3.2. Indeterminacy of rules. An insucient determinacy of rules appears when
people declare that they must be applied ``with intelligence'' (Kasbi, 1991). This
J. Leplat/Safety Science 29 (1998) 189204 195
indeterminacy is connected with several factors. The rst concerns the characteristics
of the operator, in particular, his competence in relation to the rule. We have
already mentioned that every rule ts the representation that the designer has of its
possible user. When this does not t, and the rule risks being too implicit, the user is
not able to compensate with already acquired competence. Then, he nds himself
in a situation of problem solving and can be discouraged from using rules. We can
accept the following remark of Wibaux (1992) in relation to safety rules.
This analysis of what is implicit in the prescriptions shows that the imple-
mentation of pilots procedures is far from being a work of pure and simple
execution of items read on the check-lists. (p. 39)
Conversely, we can nd cases of over-determination of rules when they include use-
less information on the subject, which also risks making the user reluctant to use
them.
These remarks argue in favor of modularization of rules, of better adaptation
to the sometimes dierent skills of possible users, or to variations in their skills
with the level of learning (Wibaux, 1992).
The second factor of indeterminacy is connected to technical conditions them-
selves. As Collins (1992) notes, every possible case cannot be foreseen and the imple-
mentation conditions of rules cannot be exhaustively xed. Therefore, rules are not
necessarily adapted to unforeseen events.
Moreover, we note that rule implementation depends in part on the interpretation
of the situation. This interpretation varies, especially with the conditions taken into
account by the subject and within the context (Leplat, 1991). This is made particu-
larly clear in the work-to-rule in which rules are applied in a very rigid manner.
3.1.3.3. Substitution and addition of rules. Faced with these inadequacies in rules,
operators react by implementing a regulatory process which leads them to modify
the ocial rules or to create new ones. The problems with safety rules can be com-
pared to those of production rules and here we are inspired by the work of Reynaud
(1989) and de Terssac (1992). Reynaud distinguishes between control and autono-
mous regulation. Control regulation is dened by the organization and aims to
elaborate rules which set the purposes of this organization. Autonomous regulation
stems from the operators. According to work demands and to any unforeseen
situation not taken into account by the ocial rules, the operators elaborate, alone
or collectively, other rules with which to guarantee production.
This adaptation relies on taking into account concrete information about the
state of the process, the level of set-ups functioning or the team characteristics
at a given time: its degree of mobilization, its level of preparation or the un-
availability of one of its members ... (de Terssac, 1991, p. 128)
It seems possible to extend this analysis to safety rules, particularly in so far as they
are integrated into the production rules. Elaboration of these informal rules goes
196 J. Leplat/Safety Science 29 (1998) 189204
hand-in-hand with a certain autonomy given to the operators, hence the name
autonomous regulation for the process which generates them. Here, Landa's (1984)
remark is valuable:
... it is important to teach students not only to use algorithms and heuristics
developed by someone else, but how to discover them on their own as well.
(p. 242)
3.1.3.4. Status of safety rules. The status attached to the safety department and
safety institutions probably has a direct inuence on the importance attached to
safety by personnel and on the acceptance of safety rules. The higher this status is,
the more chance safety rules have of being observed. Research is lacking on this
point and would be useful to develop.
3.2. Accessibility
Two essential aspects can be distinguished in the notion of accessibility: acces-
sibility of the rule and accessibility of the means of execution of this rule. Here,
only the rst aspect will be discussed. Two main facets of accessibility will be con-
sidered: accessibility of the rule support and accessibility of the rule content.
3.2.1. Accessibility of the rule support
This concerns the possibility for the operator to nd the document or, more gen-
erally, the source which will deliver the rule content to him. These documents are
kept in places which may more or less be known and accessible to the operators.
Even when they appear on a computer screen, their access can be easy. These di-
culties of access introduce delays which can be critical and,can often discourage the
search for and, therefore, also the use of the rule.
3.2.2. Accessibility of the content
This raises more dicult questions. I will not come back to the legibility
mentioned in the rst part of the paper, but I will comment on three points:
intelligibility, the role of external constraints and cognitive motivation.
3.2.2.1. Rule intelligibility. This problem is connected to the more general problem of
document intelligibility which has been the object of several ergonomic studies in
the past, some of which are already outdated (see classic handbooks of ergonomics
or human factors). Criteria of intelligibility are dened there, which can be used for
safety rules. Intelligibility is not only related to characteristics of a linguistic nature
(length of sentences, word diculty, etc.), but also to characteristics of a logical
nature. The complexity of logical structures underlying rules can make them dicult
to understand. From methods of analysis initially developed in his teaching, Landa
(1976, 1984, 1992) has elaborated a method of analysis of cognitive activity called an
`algo-heuristic' and associated with it a technique to simplify texts as rules,
instructions, orders, etc. Thanks to logical restructuring, more legible documents
can be designed which are more easily and quickly usable by a larger number of
J. Leplat/Safety Science 29 (1998) 189204 197
people. Complex safety rules could be the object of the same type of analysis.
This type of problem is sometimes referred to as ``cognitive usability'' (Veyrac et al.,
1997).
3.2.2.2. Cognitive motivation of safety rules. A rule is cognitively motivated when
the user understands the reason why it has been established and the consequences
of breaking it. When this motivation is insucient, one could speak of a ``cogni-
tively implicit'' rule. This problem of rule motivation is particularly acute in
complex systems where the operators have to deal with dicult incidents which
may go beyond the competence of the operators in charge of them. In these
cases, operators may have a set of rules available to them indicating a form of
procedures they have to follow very closely. It appears that sometimes the
operators do not in fact follow this procedure. Herry (1987) analyzed the source
of observed deviations between the ocial procedure and the operator's proce-
dure. First of all, she noted that ``... the prescribed instructions were designed so
that the operator could normally apply them without understanding the process
working ...'' (p. 240). But the operators were reluctant to act without under-
standing. Herry's analysis showed that the mental model of the process used by
the experts who elaborated the procedure was dierent from the operators' models.
The expert's model permitted a better anticipation of the events and, therefore, the
development of a long-term strategy requiring, in particular, what appeared as a sort
of detour. The operators, not understanding this detour, tend to bring into play a
more local response and, therefore, a short-term strategy. So, the motivation for the
rules appears as an essential element in their implementation. This motivation does
not necessarily require that the operators acquire the competence of the procedure's
designer, but that they have an explanation which is easily understood and suited to
the task demands and their knowledge level. Improvement in the operators' knowl-
edge turns out to be essential when prediction of incidents is not possible, either
because of system complexity, or when the operators must directly take charge of
the control of the system after the breakdown of an automatic device. In these cases,
the response to the incident cannot rely on pre-established rules, but must bring into
play the knowledge of the underlying system to develop an original response. In all
these cases of `implicit cognitive rules' or the rules' ineciencies to cover all possi-
bilities, the solution must be looked for in the improvement of the operators' com-
petence by adequate training.
3.2.3. Role of use constraints
Rule accessibility also depends on external conditions imposed on their use. Here,
I will mention only two of these conditions: the frequency of use and the time
constraints it has to respect.
3.2.3.1. Frequency of rule use and internalization. Safety rules can be distinguished
according to their frequency of use. Some rules associated with the execution of
the work itself are used repeatedly, e.g. driving rules for professional drivers. On the
contrary, other rules are used only exceptionally, concerning situations which rarely
198 J. Leplat/Safety Science 29 (1998) 189204
occur, e.g. safety rules in case of re. In this second case, for correct imple-
mentation, the problem is to regularly remind people of the rules in order to
compensate for the lack of memory of the rules which is the result of an absence
of reinforcement.
In the case of frequent use, the problem is one of automatization. We can note
that the use of safety rules must be not confused with the form of cognitive func-
tioning named ``rule based'': a safety rule can be implemented at the skill based
level. This automatization presents advantages (less mental load, rapidity of access,
etc.), but, at the same time, some drawbacks and dangers. Indeed, it may lead one to
ignore the conditions under which the rules must be implemented and apply them in
irrelevant conditions. So, the rule can generate a more or less stereotyped behavior,
disconnected from the context, in accordance to the rule, but in which function and
purpose are forgotten (Fleury, 1998, in this workshop). The eects of automatiza-
tion are sometimes expressed as rigidity or ``cognitive conservatism'' (Reason, 1990,
p. 78).
Commenting on some aspects of the Chernobyl accident, Medvedev (1990)
wrote:
... nevertheless, it is obvious that with the conformism of the operators who
have learned not to think for themselves, carelessness and negligence around
them were reinforced during the succeeding years to become the norm in the
end. (p. 65)
3.2.3.2. Time constraints. In tasks with high time constraints (plane piloting, emer-
gency situations, etc.) it is not possible to recourse to documents during task execu-
tion. The rules must be internalized to be immediately available: this internalization
comes from advanced learning or careful preparation. The safety rule makes a cer-
tain representation of the action and the nature of this representation is related to
the quality of rule implementation. Knowledge developed about the topic of
`instruction and internalization' can be used here (for a good presentation see Bibby,
1992). Advanced internalization leads to an automatization of use with the advan-
tages and drawbacks mentioned above.
4. Conclusion
In conclusion, I would like to consider some aspects of the following questions:
are safety rules necessary? Which safety rules? What can be substituted for them?
In answering these questions, I will formulate some recommendations of a more
practical character.
4.1. Are safety rules necessary? From rules as alibis to rules as safety aids
Safety rules can be seen from dierent perspectives. The legislator needs safety
rules to dene and punish oences: this legal aspect is important as a means of social
regulation because the autonomy of the operators is linked to their responsibility.
J. Leplat/Safety Science 29 (1998) 189204 199
Therefore, rules are necessary, but if rules are suited to their purposes, consider-
ing the conditions of execution. However, safety rules must not be alibis for
management.
Sometimes, we can have the feeling that the system of safety rules in the fac-
tory has been designed by successive additions, after occurrences of accidents, and
as a means of preventing their repetition. This is not harmful in itself but it is
often the reection of what can be called an ``administrative conception of safety''
(Leplat, 1985). Instead of changing the working conditions, which are the source
of the accidents, the rules are changed, or one is added, so as to allow the
transfer of the responsibility for a similar accident to the operator, without con-
cern for the coherence of this rule with others or for its relevance to other
concrete situations.
Safety evaluations, judged on the degree of implementation of safety rules,
make the operator transform the goal of his activity into the execution of the
rules instead of the realization of a safe situation. The overprescription of rules,
i.e. numerous, very detailed and precise rules, can bring about violations. These
often minor and insignicant violations can progressively diminish the value of
the rules in general.
Safety rules must be designed as safety aids, in the same sense as work or decision
aids. For the operators, the rules must be guides to help them to manage their
activity from a safety perspective. Here, an important problem is to determine the
types of rules to be taught. As work becomes more discretionary, rules must take
dierent forms and must be more meta-rules which prescribe not so much the safe
behaviour to adopt as the properties required from the behavior and the criteria it
must satisfy. Then the operators' responsibility is no longer to be judged in terms
of deviations from prescribed rules or standard safe behavior, but in assessing if,
in the specic situation, these meta-rules are implemented as they should be by a
skilled operator.
4.2. Which rules? From rules prescribed by the organization to rules elaborated in
cooperation
We have seen that the essential conditions for the implementation of rules are
their acceptability, relevance and accessibility. These conditions can be fullled
even better if future users of safety rules participate in their elaboration. This parti-
cipation ensures, in fact, that real procedures and concrete work conditions have
been taken into account: so, real acceptability, relevance and accessibility will be
improved.
But since work and work environment evolve, a rule can become unsuitable and
lose its qualities. Therefore, it is necessary to allow for updating of rules when
changes occur in the work or its environment. Sometimes, rules of modular form
are recommended, which can be easily adapted (e.g. to dierent levels of experience)
and modied in case of changes in working conditions. It is also important to
emphasize the fact that safety rules do not have a purpose in themselves, but have
their value only in as much as they are instruments for improving safety. This
200 J. Leplat/Safety Science 29 (1998) 189204
remark is particularly apposite when, as a result of an unforeseen exceptional
event, conicts of criteria occur. In these cases, the operator must be in a position
to judge the relevance of rules, their degree of importance or their possible reject-
ion in favor of measures momentarily more relevant for safety. In some exceptional
cases, infringement of safety rules can improve safety. In no case must the rule lead
to a blind obedience which obliterates the capacities of judgment in the specic
situation.
4.3. What instead of rules?
Safety rules have two main drawbacks: (1) they must be applied, and it is never
sure they are: human failure is always possible; and (2) there are cases where it is not
possible to establish rules because all the possible events cannot be enumerated or
even identied in advance.
4.3.1. What measures oppose lack of implementation?
I have examined the conditions suitable for reducing the lack of implementation,
but is it possible to go further? Is it possible to do without rules where they now
exist? In theory, ergonomics aims to reduce the necessity for rules by designing
working conditions suited to the users' characteristics: here, we will only review two
principles it can use. These principles can be considered as an incorporation of the
rules into the device or the task environment itself, suppressing the necessity for
verbal explicitation.
4.3.1.1. Principle of affordance. This principle, initially proposed by Gibson, was
taken up by Norman (1988) for a use directly relevant here.
The term aordance refers to the perceived and actual properties of the thing,
primarily those fundamental properties that determine just how the thing could
possibly be used. A chair aords (``is for'') support and, therefore, aords sit-
ting. (...) Aordances provide strong clues to the operations of things. Plates
are for pushing, knobs are for turning. (...) When aordances are taken
advantage of, the user knows what to do just by looking: no picture, label, or
instruction is required. (p. 9)
There is a sort of `psychology of materials'. The principle of compatibility, well
known in ergonomics, can be incorporated into this perspective. Norman shows
what the wide eld objects in everyday life oer to the application of this principle.
The safety problems oer another aspect to it. In this case, it is necessary to look for
how to adjust working conditions in order for them to bring about expected
behaviors and also to reduce the importance of rules. Road layout changes can
bring about a slowing down: parallel yellow lines give a feeling of speed which sug-
gests the need to slow down. By a suitable adjustment of the objects and the envi-
ronment, it is possible, in accordance with Eco's expression (Eco, 1988) ``to
communicate the function they make possible''. The objects and their context
J. Leplat/Safety Science 29 (1998) 189204 201
become communication instruments in themselves and reduce the need for rules.
Here, there is a wide eld of action open to safety in the same sense as to cognitive
engineering. In this perspective, Rasmussen and Vicente (1989) proposed the
so-called ``ecological interface design'' ``... to provide recommendations for
designing interfaces that take into account and support the properties of human
cognition ...'' (p. 533).
4.3.1.2. Use of forcing functions
A way of reducing the necessity for rules is to prevent the implementation of
harmful actions. Here again, Norman (1988) showed the importance of this with the
notion of forcing functions.
Forcing functions are a form of physical constraint: situations in which the
actions are constrained so that failure at one stage prevents the next step from
happening ... (p. 132)
Numerous examples of forcing functions exist for everyday instruments and
for industrial tools, e.g. it is impossible to have access to the drum of a
washing machine when it is functioning; it is impossible to open the doors of
a moving wagon, etc. A more widespread use of these forcing functions could
lead to the elimination of a certain number of safety rules. For every rule, it
is always good to ask: what should be done to eliminate the necessity for this
rule?
As a nal conclusion, the presence or necessity of rules, irrespective of their
quality, shows in part the incapability of responsible people to adapt their work
and general living conditions satisfactorily or, in other words, to combat defective
conditions with appropriate ergonomic interventions.
4.3.2. What measures oppose complexity and unpredictability?
When the systems controlled by the operators become very complex, all actions
the operators can be required to implement cannot be foreseen, e.g. ``in the driving
task, there occur a set of situations for which the application of strict formal rules
will be not sucient'' (van Eslande and Nachtergaele, 1993). This situation is also
mentioned in the nuclear eld. Therefore, it is very dicult to dene a system of
rules with a complete operational character. In these cases, the function of rules
changes: they tend to limit the eld within which safe actions must be situated. They
help to determine what Rasmussen et al. (1994) call ``the boundary of acceptable
state of aairs'', i.e. to delimit the `space of possibilities' or `degrees of freedom' that
can be used by the operator. In these situations, safety cannot only be guaranteed by
safety rules which often say what must not be done rather than what must be exactly
done. Then, elaboration of a safe action relies to a large degree on operator or team
competence which, given the knowledge of the system's functioning and safety goal
to be achieved, will have to conceive of an appropriate action. This operator or
team competence must be related to the autonomy which must be given to the
operator or team.
202 J. Leplat/Safety Science 29 (1998) 189204
References
Anon., 1969. Recherche communautaire sur la se curite dans les mines et la side rurgie, Etudes de Physio-
logie et de Psychologie du Travail, no. 4, Luxembourg, Service des Publications des Communaute s
Europe ennes.
Battmann, W., Klumb, P., 1993. Behavioural economics and compliance with safety regulations. Safety
Science 16, 3546.
Bibby, P.A., 1992. Mental models, instruction and internalization. In: Rogers, Y., Rutherford, A. Bibby,
P.A. (Eds.), Models in the Mind. Academic Press, London, pp. 153172.
Collins, H.M., 1992. Experts articiels: machines intelligentes et savoir social. Editions du Seuil, Paris.
de Terssac, G., 1991. Travail et re gulations sociales. Revue Internationale d'Action Communautaire
25/65, 127136.
de Terssac, G., 1992. Autonomie dans le Travail. PUF, Paris.
Eco, U., 1988. Le Signe. Editions Labor, Bruxelles.
Fleury, D., 1998. Reinforcing the rules or integrating behavioural responses into road planning. Safety
Science 29 (this issue).
Gibson. Author, please supply reference.
Herry, N., 1987. Errors in the execution of prescribed instructions: design of process control work aids. In:
Rasmussen, J. et al. (Eds.), New Technology and Human Error. John Wiley, Chichester, pp. 239246.
Kasbi, C., 1991. Accident procedure application in nuclear power plants. Paper presented at the XI
Congress of the International Ergonomics Association.
Landa, L.N., 1976. Instructional Regulation and Control. Educational Technology Publications, New
Jersey.
Landa, L.N., 1984. Algo-heuristic theory of performance, learning, and instruction: subjects, problems,
principles. Contemporary Educational Psychology 9, 235245.
Landa, L.N., 1992. Lev Landa's worker miracles. Business Week Sept. 21, 7273.
Leplat, J., 1985. Erreur Humaine, Fiabilite Humaine dans le Travail. A. Colin, Paris.
Leplat, J., 1987. Recherche sur une me thode d'analyse des accidents et sur son exploitation en vue de
l'ame lioration de la se curite du travail. Final report. Laboratoire de Psychologie du Travail, Paris.
Leplat, 1989. Author, please supply reference.
Leplat, J., 1991. Activity eld in dynamic process control, or what process is controlled? In: Cognitive
Science Approaches to Process Control, Third European Conference. University of Wales, Cardi,
pp. 137158.
Medvedev, G., 1990. La Ve rite sur Tchernobyl. A. Michel, Paris.
Norman, D.A., 1988. The Psychology of Everyday Things. Basic Books, New York.
Rasmussen, J., Pejtersen, A., Goodstein, L.P., 1994. Cognitive Systems Engineering. Wiley, New York.
Rasmussen, J., Vicente, K.J., 1989. Coping with human errors through system design: implications for
ecological interface design. International Journal of ManMachine Studies 31, 517534.
Reason, J., 1990. Human Error. Cambridge University Press, Cambridge.
Reynaud, J.D., 1989. Les Re gles du Jeu: l'Action Collective et la Re gulation Sociale. A. Colin, Paris.
SNECMA, 1982. Author, please supply reference.
van Eslande, P., Nachtergaele, C., 1993. Situations-pie ges, Erreurs et Diculte s Ge ne ratrices d'Accidents
de la Route. Internal report. INRETS, Archueil.
Vandevyver, B., 1990. Fiches de poste. Comment constituer des ches de poste inte grant la se curite ,
Travail et Se curite , January.
Veyrac, H., Cellier, J.-M., Bertrand, A., 1997. Mode le de l'ope rateur et mode le du prescripteur. Le cas des
consignes de re solution de situations incidentelles pour les conducteurs de trains. A paratre dans ``Le
Travail Humain''.
Wibaux, F., 1992. L'Implicite dans la Prescription: le Cas de la Formation au Pilotage de l'A320.
Me moire du CNAM (Ergonomie), Paris.
J. Leplat/Safety Science 29 (1998) 189204 203
Appendix A
1. Some questions as guidelines for a rst evaluation of safety rules
1. Are the future users and working conditions known?
2. What are the justications for the rule?
3. Are there other possible means (technical, ergonomical, etc.) for achieving the
same result?
4. Is the new rule coherent with the other dierent existing systems of rules?
5. Are there possibilities for conicts and ways of solving them?
6. Is the new rule adaptable to changes in conditions?
2. Acceptability
1. Is the (physical, mental, etc.) cost of implementation not too high?
2. Is the rule suited to the real activity (and not only to the prescribed one)?
3. Is the rule suited to the user's competence; to dierent levels of his future
experience?
4. Can possible diculties of implementation be discussed with the users?
5. Are possible adaptations of the rule foreseen?
3. Accessibility
1. How is the rule made known?
2. Is the support of the rule easily accessible?
3. Are the means of rule implementation foreseen and available?
4. Are the conditions of rule implementation suciently explicit?
5. Is the rule content accessible to the users (readability, linguistic, logical
intelligibility)?
6. Is the rule cognitively justied for the users?
204 J. Leplat/Safety Science 29 (1998) 189204