The paradoxes of almost totally safe transportation systems

Safety remains driven by a simple principle: complete elimination of technical breakdowns and human errors. This article tries to put this common sense approach back into perspective in the case of ultra-safe systems. where the safety record reaches the mythical barrier of one disastrous accident per 10 million events (10(-7)). Three messages are delivered: (1) the solutions aimed at improving safety depend on the global safety level of the system. When safety improves, the solutions used to improve the safety record should not be further optimised, they must continue to be implemented at present level (to maintain the safety health obtained), and supplemented further by new solutions (addition rather than optimisation rationale); (2) the maintenance and linear optimisation of solutions having dwindling effectiveness can result in a series of paradoxes eventually replacing the system at risk and jeopardising the safety record obtained in the first place; and (3) after quickly reviewing ambiguities in the definition of human error and the development of research in this area, this article shows, through recent industrial examples and surveys, that errors play an essential role in the acquisition and effectiveness of safety, at individual as well as collective levels. A truly ecological theory of human error is developed. Theories of error highlight the negative effects of an over-extensive linear extrapolation of protection measures. Similarly, it is argued that accepting the limitation of technical systems performance through the presence of a minimum breakdown and incident 'noise' could enhance safety by limiting the risks accepted. New research opportunities are outlined at the end of this paper, notably in the framework of systems now safe or ultra-safe. (C) 2001 Elsevier Science Ltd. All rights reserved.