Navigation – Plan du site
Dossier ATWAD

Learning from experience: a theoretical framework for the work activity analysis and safe design

Le retour d’expérience en tant que cadre théorique pour l’analyse de l’activité et la conception sûre
El sistema de reporte basado en la experiencia como marco teórico para el análisis de la actividad y el diseño seguro
Cecilia De la Garza et Elie Fadier
Cet article est une traduction de :
Le retour d’expérience en tant que cadre théorique pour l’analyse de l’activité et la conception sûre


Différentes études ont été conduites au cours d’un projet pluridisciplinaire français GIPC-PROSPER sur le thème « Intégration de la prévention dans la conception » (Fadier, Neboit, & Ciccotelli, 2003). Un des objectifs principaux était le développement d’un cadre théorique et méthodologique orientant une meilleure prise en compte des conditions d’utilisation réelles des équipements industriels dans le processus de conception. Les principaux résultats résultent de la proposition de nouveaux concepts pour l’analyse de l’activité de travail qui a pour but de faire un retour d’expérience vers une conception plus sûre (activités limites tolérées à l’usage et conditions limites tolérées par l’usage). Ainsi l’analyse de l’activité de travail réelle apparaît comme un outil pour la conception en permettant un feedback à divers experts impliqués dans la conception d’une situation de travail. A partir de l’analyse du travail certains aspects de la situation future probable peuvent être anticipés, ainsi que certains risques pour la sécurité peuvent être mieux contrôlés dès la conception. Ceci signifie d’intégrer ces aspectslà dans les cahiers de charges.

Haut de page

Texte intégral

1. From empirical analyses to the proposal of a theoretical and methodological framework for the activity analysis

1The results presented in this paper are derived from empirical industrial studies. These studies contribute to the construction of a theoretical and methodological framework for the analysis of the activity to design reliable and safe work situations.

2Our general hypothesis is that any sociotechnical system is characterized by a natural migration towards acceptable borders of technical performance and safety. This occurs from the design phase until the functioning phase (see Figure 1). Accidents occur when the system tolerance levels are exceeded; then, the drift becomes irreversible (Rasmussen, 1997; Amalberti, 2001; Fadier, De la Garza, & Didelot, 2003).

3Various design premises can be advanced:

  • Design does not end upon completion of the development stage, but involves also the installation and functioning stages. During these latter stages, adjustments that will have an impact on future working conditions may be required. In some cases, the design process may finally end with operation.

  • Design "reuse" of an engineering solution or adaptation of an existing solution to a new concept without assessment in a real situation can be observed (Guindon, 1990; De la Garza, & Fadier, 2005). Whilst this approach appears economical from a cognitive standpoint and in some cases may be efficient, it appears nevertheless unsuitable at the operational level. In some cases, the engineering solution does not protect the operator or is incompatible with another engineering solution because it has not been assessed, principally from a human factors standpoint. Data on such migrations are neither collected, nor analyzed through "near miss" reporting nor used as a safety tool, despite the fact that they are very useful for designing an enhanced system (Shaaf van der, Lucas, & Hale, 1991).

Figure 1: Relationship between the analysis at the different stages from design to functioning

Figure 1: Relationship between the analysis at the different stages from design to functioning

4A double work analysis was adopted to assess various situations of design and production (printing works, treatment of household refuse and in the railway field). Thus, this approach involves choices of design safety, health and risks and real difficulties on industries. The aim is to propose some recommendations to the designer to enrich design models and anticipate the majority of critical events that could adversely affect personnel or that could affect operation and maintenance activities (data processing, access, etc.) and the reliability of the system.

5This experience feedback is thus the direct result of analyses of work activity according to the methodological framework of Boundary Conditions Tolerated at Use (BCTU) and Boundary Activities Tolerated during Use (BATU) (Fadier, De la Garza, & Didelot, 2003). BATU concerns compensatory activities and strategies to cope with regulation, technical and production requirements, etc., at different stages of design, functioning process, and hierarchical levels. The BCTU are the consequences of the BATU and characterize the migration processes from the early stages of design to use. These activities and conditions are « border line » because they engender risks and bypass safety barriers; they are tolerated because they improve system performance, they are totally unknown. In some cases BATU remember the organizational deviance described by Vaughan (2001). It is about a step of analysis of work activities with stages of the various processes of work from the design to the effective use.

6This step makes it possible to make a diagnosis and at the minimum to understand the broad impact on safety and the reliability of a system, then an experience feedback (REX) for a safe design. The design involves not only the industrial equipment, but also certain aspects of real activities, the organization and the general work environment.

2. From diagnosis towards forecast: an experience feedback for design of working systems

7We are interested in the linkage between the diagnosis and the forecast in the design. We consider the forecast like the capacities of prediction of the future operation of a system, and the diagnosis as analysis and the synthesis of the real operation of a system. These two concepts can be in dynamic interactions towards a direction where the diagnosis of the work situations can enrich the forecast at the time of a future design. It is about one of the elements of the experience feedback supplied with the various viewpoints of engineering, ergonomics, safety, etc. (see Figure 2)

8Generally, when designing work equipment, designers satisfy the request (i.e. specifications), while at the same time planning for the future operation of the designed equipment. However, the diagnosis carried out during the analyses of the activities of production and maintenance, show that the forecasting by the designers is very restricted, often focusing only on certain working activities and situations.

Figure 2: Linkage between diagnosis, feedback and forecast from design to functioning stages

Figure 2: Linkage between diagnosis, feedback and forecast from design to functioning stages

9Figure 2 highlights that the analysis of the production activity enriches considerably the feedback from experience, which optimizes the design of the equipment and in a larger way the design of safe working systems.

10In our research, we have not been able to study the prognosis by the designer. On the other hand, our research has targeted the diagnosis done at different stages of the design process. The design process is enriched by information and knowledge coming out of diagnosis of design, implementation and production activities. We will show that the diagnosis related to implementation and production lead to core decisions regarding design, but also work organization. Our analysis examined dysfunctions, their relationship to organizational factors, and their impact on system reliability and performance.

2.1. From diagnosis towards forecast: design stage

11The diagnosis was established starting from analyses of two design situations: , the first one concerns the design of printing lines, and the second one is about the design of waste plants and particularly the design of waste handling line. The aim of this study is to identify the methods of safety integration used by various participants in the design process (project manager, engineers, specialized engineers, draftsmen, etc..). These analyses focused on the cognitive aspects of work and took into account of aspects of safety. We explored the mental representations created by different designers with regard to safety, operating situations and end-users. We were therefore able to identify the knowledge used to make safety-related decisions and choices (standards, informal feedback, machine characteristics, known or assumed uses) (De la Garza, & Fadier, 2005).

  • Our analysis outlined that design integration of safety and ergonomics is not included in initial representations because these issues are not specified as initial objectives in the specifications.

  • Safety does not have the same status as clearly established production specifications.

  • Safety should correspond to obligations, legislative and regulatory requirements (mainly standards). From this standpoint, safety could be considered as a problem to be solved.

  • There is no planned approach to safety, unlike other design objectives, and safety is not linked to or integrated in any specific design stage.

  • Safety is an “add-on” during the design project, especially at the development stage. It does not appear to be considered either during the analysis of objectives at the beginning or during subsequent functional analysis. Safety emerges in connection to personal initiatives, e.g., from a specialist, or is related to problem solving because a regulation or standard needs to be addressed. In this case, safety choices will be negotiated and a solution will be found that represents a compromise between other objectives and constraints. Sometimes is “too late” and safety-related technical choices will be “added on” onto the other choices.

12This exploratory study shows that the situation is practically the same in the two cases we studied. Safety is not viewed as a real design objective, despite the fact that, in both cases, the working equipment and plant required certification with respect to safety standards and risk analysis.

13Analysis of cognitive processes involved in design-based safety integration and of the knowledge required by designers reveals that designers possess a mental representation that is neither complete nor relevant to user needs or to industrial equipment uses. These are important areas to be developed to provide support to both designers and the design process itself.

2.2. From Diagnosis towards forecast: Installation stage

14Through a work analysis centered on observations in the field (installation of a printing line), the goal was to understand how the actors of this phase manage to operationalize a system, which was at this stage considered apart from any functioning context (Didelot, 2001).

15During these observations, various risks and difficulties were identified, highlighting three types of variations:

  • Variations between the system prescribed by designer (plans established in accordance with the customer-applicant) and the system implemented (components delivered on the building site to be assembled on site by the workers),

  • Variations between the system implemented and the installed system (with all the adaptations carried out by the workers according to various parameters: delivered parts, lack of conformity, ways of wiring to be deviated from …),

  • Variations between the installed system and the current system exploited by the users who derives compared to its initial state from delivery.

16These challenges and their solutions show that this phase of implementation corresponds to a design of “detail” during which implicit data of specifications are defined in the physical phase of realization of the installation on the site (Neboit, Fadier, Demor, & Weill-Fassina, 2000).

17This analysis of the installation phase shows the difficulty that the workers have in adapting a system, which has been designed according to the requirements of the site to make it operational. One can assume that this type of adaptation is related to a model of dynamic cognition (Amalberti, 1996) according to which the operators have a general knowledge allowing them to know which risks they are able to manage, which situations must be avoided; and to establish priorities between the various tasks…

18The adapted system resulting from the installation phase will constitute the operational framework of reference that differs from that prescribed by the designer and which will control the operation of the system. This adaptation seems to introduce factors with the “probable future activity” of the operators.

19This analysis confirms, however, that the installation phase is really a prolongation of the design phase, and its study makes it possible to enrich the design work system .

2.3. From diagnosis towards forecast: functioning stage

20The diagnosis in this case is established from the activity analyses of real use of the current equipment under organizational constraints. These analyses relate to the follow-up of teamwork uninterrupted in the printing sector and the follow-up by teams of workers who sort the lines of household refuse manually.

21With regard to the analyses of functioning situations, the diagnosis reveals difficulties in various fields, showing an experience feedback sufficiently broad and being able to imply varied decisionmaking centers. For example:

  • design of the work equipment: technical choices, problems of accessibility and usability;

  • forecast in terms of Human Resources: staff, distribution of the operators, training of the employees, job changes, requirements in terms of competences compared to the technical evolutions;

  • the organization of the working time: night-work / from day, shift work, rotations, working hours;

  • design of the task: procedures of work, operating modes;

  • impact of business constraints: time pressure, quality constraints, management of competition;

  • impact of the work organization: just-in-time, seasonal activities, subcontracting.

3. Constitution of a forecast enriched by a diagnosis: The case of railway interoperability

22The analysis framework of BCTU and BATU was applied in a railway project on interoperability to establish a “forecast” and guide the design of a future system (Weill-Fassina, De la Garza, & Kaplan, 2006). Interoperability involves crossing borders from a country to another without changing either locomotive or the driving crew. The main objective is the integration of Human Factors in the project for a future safe organization. Railway interoperability is the result of the opening of the European borders in 2003.

23The objective was to study the implementation stage in an interoperable freight connection between two marshalling yards involving France and Germany (Woippy-Mannheim). The results are derived from the diagnosis of both the design project, more specifically the early stages of the design, and the implementation of this interoperable connection. The diagnosis in terms of BCTU and of BATU consisted of an experience feedback for the design of a safe future organization, while seeking to apply it to a future connection between France and Italy.

24The activity analysis for the implementation project in the field was performed by a comparison between the state « before the interoperability » and the state « during the implementation », as well as a comparison of the technical and organizational systems between France and Germany. The objectives were:

  • identification of the changes and the new work requirements , as well as the difficulties and risks related to interoperability;

  • dentification of similarities between the countries, marshalling yards and modes of control in order to establish a guide of analysis integrating these parameters for the organization of any future interoperable connection between the two countries;

  • identification of critical interoperable events as incidents reported by the drivers with experience in a foreign country.

25For the analysis of the early design stages, the study focused on prior training considered for drivers and the European directives, the safety policy in each country and the organisation of collaborative work in the two countries. The data collection consisted of numerous interviews of managerial staff.

26In a graphic way, the results made it possible to build the links that are shown in figure 3. Thus, it appears possible to stop, to content or avoid processes of migration towards less safe zones, less reliable or lower performance of the sociotechnical systems.

27The diagnosis from the implementation in the field highlights BCTU and BATU at the operational level and at the management level. Figure 3 summarizes the relevant points and links with reference to diagnosis and forecast taking into account human factors in future project.

28The main points will be discussed to illustrate both BCTU and BATU.

29From an individual viewpoint, for the driver, the relevant risks concern communications, by radio, telephone or face-to-face, in a foreign language, for usual and critical situations.

  • risks of confusion and misunderstanding of information between drivers and other personnel, in marshalling yards, stations or in the route;

  • risks of inadequate interpretation of signaling, because signals can be similar but may have a different meaning;

  • risks of lack of self-confidence in a foreign country, emphasized by a critical event to cope with in the route or in a marshalling yard.

30From a collective and a network viewpoint, the risks and difficulties concern different staff implicated in the interoperable situations.

  • The operation of the organisational system with delays in the trains, errors in the wagons, difficulties and incompatibilities between information and communication systems of the two countries;

  • poor planning of staff requirements, workload, new tasks, new functions in a marshalling yard handling interoperable trains;

  • ambiguous management leading for example to very strong doubts by the agents of control

  • crew, of the project of interoperability, leading to strikes;

  • lack of training for the different actors of the marshalling yards involved in interoperability;

  • heavy training systems not adapted to the needs of the personnel: lack of practical training, lack of collective training with the staff of the marshalling yard, lack of operational training for safety regulations, as well as lack of training to cope with critical situations.

Figure 3: Relevant points of the diagnosis and forecast in the interoperability railways

Figure 3: Relevant points of the diagnosis and forecast in the interoperability railways

31The final analysis led to guidelines, including three tools, and contributed to the organization of a safe future interoperability (Weill-Fassina, et al., 2006).

4. Conclusion

32Through this methodological and theoretical framework of BATU and BCTU, emphasis is on the analysis of the impact of the boundary activities on the performance and sociotechnical reliability of the system. These boundary activities are not centered on an operator in particular, but on the interactions between different staff concerned by the same work situation and their work environment. We view the operators in terms of collective work or functional network with supervisory staff. All these categories are implied in various decision-making centers and at various stages of the design and production.

33Thus, at the end of these activity analyses, the experience feedback can concern various designers and owners to the full extent limited partner and/or undertaking of a contract. The impact of these analyses are difficult to completely assessed, but we assume that they are important even if the goal is to integrate them into the specifications. An important element of this theoretical and methodological framework is to show how the analysis of the activity can contribute to the development of an ecological approach to design.

Haut de page


Amaberti, R. (1996). La conduite des systèmes à risque. Paris: PUF.

Amalberti, R. (2001). The paradoxes of almost totally safe transportation systems. Safety Science, 37, 109112.

De la Garza, C., & Fadier, E. (2005). Towards proactive safety in design: a comparison of safety integration approaches in two design processes. International Journal of Cognition Technology and Work, 7 (1), 5162.

Didelot, A. (2001). Contribution à l‘identification et au contrôle des risques dans le processus de conception.

Thèse de doctorat, Nancy : INRS, Nancy, 270p.

Fadier, E., De la Garza, C., & Didelot, A. (2003). Safe design and human activity: construction of a theoretical framework from an analysis of a printing sector. Safety Science, 41(9), 759-789.

Fadier, E., Neboit, M., & Ciccotelli, J. (2003). Intégration des conditions d’usage dans la conception des systèmes de travail pour la prévention des risques professionnels. Bilan de la thématique 1998-2002. Notes Scientifiques et Techniques de l’INRS, NS 237, INRS, 39 p.

Guindon, R. (1990). Designing the design process: exploiting opportunistic thoughts. Human Computer Interaction, 5 (2-3), 305-344.

Neboit, M., Fadier, E, Demor, S., & Weill-Fassina, A. (2000). Contribution at the worker’s expertise to the design of a new computer aided manufacturing system. In M. Tadeusz, & W. Karwowski (Eds.),

Proceedings of the 7th International Conference “Human aspects of advanced manufacturing: agility and hybrid automation III” (pp. 50-54). Institute of Management Jagiellonian University of Krakow, Poland.

Rasmussen, J., (1997), Risk Management in a dynamic society: a modelling problem. Safety Science, 27 (23), 183-213.

Shaaf van der, T.W., Lucas, D.A., & Hale, A.R. (Eds). (1991). Near miss reporting as safety tool. Oxford : Butterworth-Heinemann.

Vaughan, D. (2001). La normalisation de la déviance : une approche d’action située. In M. Bourrier (Ed.),

Organiser la fiabilité (pp. 201-203). Paris : L’Harmattan, collection risques collectifs et situation de crise.

Weill-Fassina, A., De la Garza, C., & Kaplan, M. (2006). Integrating human factors in freight interoperability safety design. In Facteurs humains et conception des systèmes de travail (pp. 85-96). Colloque International ISSA, Nice.

Haut de page

Table des illustrations

Titre Figure 1: Relationship between the analysis at the different stages from design to functioning
Fichier image/png, 79k
Titre Figure 2: Linkage between diagnosis, feedback and forecast from design to functioning stages
Fichier image/png, 139k
Titre Figure 3: Relevant points of the diagnosis and forecast in the interoperability railways
Fichier image/png, 189k
Haut de page

Pour citer cet article

Référence électronique

Cecilia De la Garza et Elie Fadier, « Learning from experience: a theoretical framework for the work activity analysis and safe design », Activités [En ligne], 4-1 | avril 2007, mis en ligne le 15 avril 2007, consulté le 26 avril 2017. URL : ; DOI : 10.4000/activites.1503

Haut de page


Cecilia De la Garza

EDF R&D, Management des Risques Industriels
1 av. du Général de Gaulle, 92140 Clamart, Cedex, France

Elie Fadier

INRS - Département Homme au Travail
Laboratoire Ergonomie et Psychologie Appliquées à la Prévention.
BP 27 - 54501 Vandoeuvre cedex, France

Haut de page