1 Introduction

Some objects seem so intertwined with a particular landscape that doubting their pertinence or shape would be out of context. Their presence is so plainly obvious that they simply blend into the scenery itself and can no longer be distinguished. In order to make such objects stand out from the background, an event would have to arise that upsets the scenery, that to a certain extent makes it look foreign. When this occurs, the object loses its natural and imperceptible character and can once again be targeted. This is the process that Chklovski refers to as “the estrangement of objects”Footnote 1 that is apparently capable of “providing an effective antidote to a risk shared by all of us, namely taking reality (even our own) as a certitude” (Ginzburg 2001). Under such conditions, the evidence available may be questioned.

We had to face this kind of situation when along came the invention of a new type of urban transit vehicle: the bus–tram hybrid, a streetcar running on tires, in other words an intermediate vehicle (between bus and tram). Featuring a hybrid design with adjustable axles fitted with tires and capable of being guided by a central rail or driven using a steering wheel, this vehicle resembles the bat in Jean de La Fontaine’s fable that, depending on the circumstances, can assume the form of either a mouse or a bird. This bus–tram configuration not only carried with it the innovation of breaking down the barriers that separate road and rail vehicles, but of calling into question the very notion of guidance.

Even if all bus–tram vehicles offer the same characteristic of dissociating guidance from rolling on a roadway, as opposed to genuine tramways with rails that serve for both guidance and rolling motion, all have not necessarily adopted either the same technique for gripping this guidance rail or the same strategy regarding the exchangeability between driving modes.

Some have opted for a mechanical clamping to a central rail (e.g., the TVR system by Bombardier, Translohr by Lohr Industrie), which presupposes that the vehicle comes to a stop prior to proceeding with a driving mode change, while others have chosen a type of rail grip without any mechanical friction (e.g., Siemens’ optical guidance, magnetic control of a preprogrammed trajectory on the Phileas tram produced by the Dutch company APTS). This latter option, inappropriately referred to as “immaterial”, authorizes an instantaneous mode change from a technical standpoint, even though this capability proves more complex from an actual driver’s perspective (Doniol-Shaw et al. 2005).

This new type of vehicle, capable of being driven using two modes as different as a roadway and rail guidance, has however not been fitted with all the safety features mandated for guided systems. It has been equipped with neither any kind of sweep guard, i.e., a passive safety device designed to avoid running over pedestrians or cyclists who may have been projected in front the moving vehicle, nor the monitoring control still known under the name “dead-man device”. Such a function is programmed to stop the vehicle should the driver be incapacitated to a point of making him unable to perform system supervision duties, thereby activating the emergency brake.

The absence of such safety features stems from the fact that the transit authority, assigned to oversee application of vehicle certification and regulation, considered the capability of being operated as a road vehicle sufficient to dictate this mode as the reference and only submitted them to road-based certification, thus eliminating the rail-guided mode from the evaluation. This narrow view imposed the obligation that the steering wheel remain active at all times,Footnote 2 whether the vehicle is being driven in road traffic or guided on a rail, even though when rail-guided the presence of an active wheel compromises safety,Footnote 3 without serving any navigational purpose. It would take the disastrous startup of the Bombardier bus–tram, marked by a succession of accidents and the subsequent shutdown of operations for a whole year to improve system safety within the Nancy metropolitan area (eastern France) in January 2001, for the authority to become aware of the importance of the guided mode and its unique set of problems.

Revision to the regulatory code specific to urban rail transit safety, necessitated by the requirement to adapt French legislation to comply with European directives in the aim of creating a single European market, has provided the opportunity for the French government to alter its position so as to better manage such innovative contexts in which the boundaries between modes lack stability. This process of rewriting the standards that shape urban transit services has led to deleting all reference to rail, by substituting the term “guided mode”. From a practical perspective, this modification has resulted in the de facto abrogation of the decree issued on 22 March, 1942 that “applied public administration regulations to the policing, safety and operations of rail services designed to benefit the general and local population” and its replacement by the 9 May, 2003 decree “relative to the safety of guided transit services”. Since then, tramways are no longer associated with railways, but merely considered as “public transit vehicles constrained to permanently follow a predetermined trajectory attached to one or several physical rails running along the roadway”. In the process that substituted guided vehicles for tramways, not only had the terminology changed, but the philosophy and economics behind system control as well.

The transition has thus been made from a management principle based on explicit standards, such as the obligation to equip vehicles with a sweep guard or a monitoring device, to a management practice built upon procedures requiring system supervisors to ensure that: “Any new guided transit system or any modification to an existing system must be designed and constructed such that the overall level of safety with respect to users, operating staff and third parties is at least equivalent to the present level of safety or that of existing systems that provide comparable services”. This transition introduces the principle that goes by the acronym GAME (for globally at least the same), in which standards are no longer explicit but instead programmed into the technical components of situations adopted as references, which now places the emphasis on evaluating a new system’s overall performance by means of comparison with a previous system taken as the standard.

The complexity of this new procedure, coupled with uncertainties relative to the modes for evaluating the level of safety reached, has incited Lohr Industrie to abandon its bimodal driving function on its Translohr vehicle, which has become the first guided vehicle running on tires to be compared with a conventional tramway. The reference situation chosen for this “tramway on tires” will in fact be a tram car rolling on a rail track, i.e., the Citadis produced by Alstom, which boasts a recent design and like the Translohr model has a low floor throughout.

Our role comes into play against this backdrop and consists of conducting an expert evaluation of the Translohr design and, more specifically, of its driver’s cab. The request was formulated by the Labor Management CommitteeFootnote 4 of the urban transit network operator for the City of Clermont-Ferrand (central France), once the Translohr had been selected to run on the city’s future tramway line. This evaluation quickly raised the issue of installing the monitoring or dead-man device not only on the Translohr, but also on the latest generation of tramways rolling on railway track (Citadis by Alstom, Eurotram by Bombardier or even the Siemens’ tram–train), in which direction we extended our assessment on behalf of the Transport Ministry, as part of a search for improved safety.

2 Methodological considerations

The analysis was conducted by a sequence of steps, each of which systematically involved the set of pertinent actors. These steps consisted of:

An analysis of documentary data on Translohr, as furnished by the vehicle designer;

A comparative analysis of driver cab design for the various tramways and their evolution since service startup: meetings held with heads of the targeted network operations, interviews with drivers, accompaniment inside the cab over full or partial transit routes, and photo and video recordings;

Vehicle tests conducted at the experimental site of the Translohr manufacturer, using both tram operators experienced in driving different types of vehicles and bus drivers with the Clermont-Ferrand transit network, who were to become future Translohr drivers.

Organization of a daylong session devoted to tramway safety and cab design, combining input from various actors in the transit field: network managers, drivers, experts, State agency representatives, etc.

Interviews with the heads of a number of evaluation and control bodies specialized in guided transit safety, coupled with an analysis of regulatory changes.

3 A new “dead-man’s control” goes unnoticed?

The initial conditions behind development of the Translohr vehicle, in the aim of enabling bimodal operations, i.e., road (bus-driving mode) or guided (tram driving mode), and the later switch in favor of the guided mode exclusively served to influence ultimate vehicle design. Several of the features we observed in the driver’s cab plainly expose this vehicle’s hybrid origins. Just like in a bus, the control panel has been positioned to the left and the traction/braking control requires operating two pedals, whereas modern tram systems are laid out with the control panel centered in the cab and the traction/braking controlled by a hand-held throttle, as inspired by train or metro design. It should also be noted that the control panel occupies the space devoted to the steering wheel, directly in front of the driver, while this space always remains uncluttered in a conventional tram cab.

A monitoring system has been integrated into the driver’s cab in order to comply with guided system regulations, which repeats the obligation in effect on tramways to be equipped with a “special device, of a type certified by the Minister’s cabinet, capable of stopping the train in the event the conductor becomes incapacitated”.Footnote 5 In terms of safety, this monitoring system constitutes an extreme emergency safeguard as also reflected in the widely used term “dead-man device”. Yet for the Translohr vehicle, this equipment obligation meant a new requirement with respect to the initial hybrid version, for which (as indicated above) no monitoring system had been mandated by regulation.

Adding such a safeguard on Translohr does not appear to cause any special problem since France’s rail industry has relied upon comparable measures for a considerable time. The cumulative experience acquired is substantial, as monitoring systems have been used on trains for the SNCF railway company since 1965, on subway cars since the 1970s and on trams since their reintroduction in 1985.

Given the lack of negative lessons from experiences with existing systems, the manufacturer of the new tramway system running on tires has decided to adopt the functional architecture of the devices implemented on the most recent tramways and to unite the set of elements that have already successfully undergone certification procedures. The manufacturer elected to install a manually controlled monitoring function, in the form of pushbuttons located on both sides of the control panel, where pushing on either button serves to activate the monitoring mode. The pushbuttons resemble those used on existing SNCF systems. This control is linked with a time delay mechanism borrowed from Alstom’s Citadis model, established as the reference in terms of safety level, by virtue of the GAME principle mentioned above. This time delay authorizes holding the button down at most 15 s (13 s before triggering a buzzer and then 2 s until the emergency brake gets applied) or a release of at most 4 s (2 before the buzzer and another 2 before the emergency brake).

It has gone unnoticed that the use of these various components, which have been validated and certified on other types of rolling stock, and installation of this “dead-man device” in this new tram car running on tires, constitutes an innovation in device design and, more broadly, in the design of the driver’s cab. This innovation, which pertains to the driving task, has skirted the perception of vehicle designers, who are basically more concerned with technical system performance and compliance with certification procedures.

The presence however of a time-delayed detection device (VACMAFootnote 6), which is hand-activated on a tram with a pedal-operated traction/braking control, raises an “anomaly” within the world of tramways. All sorts of combinations exist (or at least existed) between traction/braking control and the dead-man device (in association with the hand-held throttle, with or without a foot-activated complementary system, and pedal-operated monitoring and traction/braking controls), but never in over one hundred years of electric tram history has a tram car been designed with a pedal-operated traction/braking control and a hand-activated monitoring system. The oddest aspect is that this invention, whose effectiveness cannot be assessed up front, arose practically by accident and hence came to fruition amidst indifference. From the time its technical operations had been validated, no questioning on the part of transit drivers was considered appropriate. The theoretical function of this particular device shields, to a certain extent, its actual effectiveness (Sigaut 1991).

This operational transparency in the design of a transit driver’s cab underscores the way in which technical objects are conceived with respect to referenced certified objects. Such references serve to circumvent a more in-depth consideration of functional features and uses. The lack of knowledge of an object’s functional bases no longer stands as a problem. Imitation becomes a resource in the drive to reproduce existing systems without having to pursue further investigation. The GAME principle, which France has proposed to Europe for the purpose of offering an alternative to the mere probabilistic approach to safety, could lend support for such processes even if, in theory, their application presumes a reexamination of both the problem and the intended solution.

Nonetheless, this avoidance of questioning an innovation within an ultimate emergency device, which elicits special attention, is not necessarily as odd as it may seem given the rather limited knowledge of this system in France. Such a situation is derived from at least two factors. First of all, France has only rediscovered surface rail transit quite recently (1985) and, consequently, was no longer making use of control devices capable of centralizing learning gleaned from experience. It would take waiting until the creation in 2001 of the STRMTG agency specialized in ski lifts and guided transportation services, which incited the constitution in 2004 of a database on all tram-related accidents. Yet, up until now, no dead-man event has resulted in a database entry. Secondly, the hypothesis of the absence of accidents implicating the VACMA (dead-man) system might explain why this device has remained relatively neglected. None of the operators we met with could recall a case where the dead-man system actually served the cause of transportation safety.

A classical paradox is thus at play herein: the lack of knowledge through feedback stems from the very lack of experience. In order to overcome this paradox, it would be necessary to cease the fixation on the exceptional event, i.e., the accident, and instead focus on day-to-day behavior in order to understand how, under ordinary working conditions, the perception of these devices is generated (Amalberti and Barriquault 1999). By means of tangible expressions for appropriating these technical objects, the deviation and incompatibility between standards and practices starts to take shape. Driver statements on these deviations thereby enable reexamining such instruments.

4 A hand-held throttle being continuously revamped

The observation of this ordinary use of dead-man devices has been conducted on four transit networks chosen according to two distinct criteria.Footnote 7 On the one hand, we gave precedence to those networks featuring trams whose traction/braking controls involved a pedal assembly, in order to provide a basis for comparison with the Translohr vehicle, which was the focus of our appraisal mission. Two networks met this criterion quite well. On the other hand, we selected networks with previous experience in the acquisition of a second generation of trams so as to examine how experience had led to learning in terms of both the design of dead-man systems and traction/braking controls. We selected three cases whereby, to varying degrees and with varying levels of formalism, network operators included drivers in their efforts to reconfigure the vehicle control cabin.

The initial observation derived is that the first generation of hand-held throttle equipment, with integration of the dead-man system, was not fully satisfactory from the drivers’ standpoint. The ordering of new equipment made it possible for positive criticism to be vented. It can be remarked that all proposed modifications are oriented towards reducing the ergonomic constraints induced by the shape of the throttle, which constantly occupies the same hand in performing several actions.

In the case of the standard French tram in use on the Paris system, criticism was aimed at hand-held throttle activation as well as the ergonomic constraints associated with the dead-man activation, even though its design did allow for various grip angles (see Figs. 1, 2, 3, 4). It should be pointed out that this throttle design was inspired from the Lyon metro system without considering the differences in use when placed on a tramway. In particular, the fact that the metro’s automatic pilot practically made the hand-held throttle and dead-man device superfluous was completely overlooked. The consequence of this contextual transfer was that tram drivers on systems equipped with such a throttle developed musculoskeletal disorders affecting their hands, wrists, arms and shoulders.

Figs. 1–4
figure 1-4

Standard throttle with dead-man device: two operator positions, for activating the dead-man device and traction

Full size image

This reexamination led to producing a rotary hand-held throttle fitted with a sensitive contact for the dead-man function. Yet, it could be observed that the action “script” incited by the shape of the object (Akrich 1987), i.e., taking control of the throttle in the palm of the hand and a thumb-triggered contact (Figs. 5, 6), cannot be performed smoothly and efficiently. Instead, the sideways, clasped hand position often tends to be preferred (Figs. 7, 8), in association with the pedal activation of the dead-man function that was requested by drivers. The problem then of potential inaccessibility to the dead-man actuator coupled with the hand-held throttle has thus been averted. Consequently, no critical feedback on hand-held throttle design is to be gleaned, even if its use does not entirely correspond with designer expectations.

Figs. 5–8
figure 5-8

The Citadis rotary throttle, in both its theoretical and practical applications

Full size image

In Strasbourg, a city equipped with the Eurotram cars, the hand-held throttle, positioned on the left armrest of the driver’s seat (Fig. 9), was not appreciated primarily because of the pronounced difficulty involved in using the armrest to relax the forearm while operating the throttle (Figs. 10, 11). Moreover, the presence and placement of both the bell and dead-man device on the throttle considerably constrained the driver’s hand and forearm position, which was the focal point of the criticisms lodged. The selected model was inspired from the “joystick” controls in place on the Combino tramway, produced by Siemens. It should be pointed out that on the Combino design, used in Freiburg (Germany), this throttle also serves to monitor driver vigilance. The traction and braking controls eliminate the need to activate an autonomous dead-man device. As the tram is traveling along at coasting speed, i.e., when the throttle is idle, the driver must still keep it held down. Nonetheless, the proposal of directly using the throttle as a source of information on the driver’s active presence and thereby avoiding association with any specific device, while still forwarded, did not win support for “technical” reasons.

Figs. 9–11
figure 9-11

Eurotram control cab—throttle, alarm and dead-man—action on the throttle

Full size image

Included in this redefinition of the traction/braking control around a joystick, the possibility of creating a throttle position that does not correspond with “neutral” (but instead with one of pre-braking without being engaged) will be retained. This position, intermediate between neutral and braking, “discovered” on the Eurotram hand-held throttle by system drivers, enables preparing the tramcar for a braking maneuver without actually triggering the brake and is moreover considered as extremely important for safety purposes, since accident prevention depends to a great extent on driver reaction speed during braking. At present, this position is not physically distinguished over the range of throttle movement; it corresponds to a position described using pejorative terminology: “neither neutral, nor engaging the braking circuits”. On Alstom’s Citadis, this throttle position in anticipation of braking also exists, by positioning away from neutral without engaging the brake. The equivalent of this layout on a pedal-operated tramway yields a form of driving called “preventive”, which consists of releasing traction and coasting as soon as possible, while the driver is moving his foot in front of the brake pedal.

One more point on this topic of braking: the possibility also exists on the current Eurotram hand-held throttle to unlock the emergency brake during operations. This device serves to take advantage of a strong braking force when initiating deceleration, while avoiding a brake lock and causing an abrupt stop inside the passenger compartment. Keep in mind that the majority of bodily injury accidents occur inside the tramcar; it is thus crucial to give the driver ample margin to determine whether or not to pursue an emergency braking maneuver. The request has been submitted to renew this functional feature in the future joystick device.

It may be noticed however that this joystick embodies, just like the former throttle, an entire array of functions (traction/braking, emergency brake release, monitoring and alarm). There are grounds to fear therefore that such a concentration of controls increases the ergonomic constraints placed on the left arm and, as a result, rekindles criticisms directed to the former throttle.

5 A remarkable exception

In contrast with these experiences, the renewal of equipment on Saint-Etienne’s network (an average-sized metropolitan area located in central France) can be characterized by sustained stability in the design of both traction/braking controls and dead-man activation. This stability proves even more remarkable given that as opposed to the Strasbourg or Paris tramway networks, the Saint-Etienne system has always run a tramway ever since the end of the nineteenth century (1881), with pedal-operated tram cars being introduced in 1959.

During discussions held with drivers during the 1990s for the purpose of laying out new equipment, no negative feedback permeated, as regards the existing system that would have incited preference for a hand-held throttle. Conveying the same perceptions on both types of devices, intended to work in unison on the tramline, swayed the decision to renew this pedal-operated control option. The mechanics of new pedal assemblies proved over time to be simpler than the former ones, due to the introduction of electronic controls. Similarly, the pedal-activated dead-man system was kept as is. The pressure applied on this pedal with the left foot must be constant and sufficient to hold it down halfway whenever the tram is moving. A “hard point” in the dead-man pedal stroke enables positioning the pedal at the comfortable angle. Any pressure beyond this stop point or any pressure release would immediately trigger the emergency brake. No time delay is programmed between the detection of inadequate pedal pressure, whether the system is of the buzzer type or any other, and the initiation of braking. After a few adjustments, the drivers felt comfortable with the new pedal assembly rather quickly.

It strikes us that this high level of technical stability is a rare enough occurrence to be remarked and examined, all the more so given that the overall appearance of the “modern” pedal-oriented driver’s cab does not resemble the previous generation of PCC equipment. Between the two, design changes in the driver’s cab seem to have been very stark. It can even be said that everything has changed, including the design of the acceleration pedal and especially the braking pedal, except for the dead-man system. Without necessarily knowing the reasons that influenced this initial choice, our sense is that beyond upholding perceptions or behavioral patterns, the design of this dead-man system meets the sensorial and cognitive demands placed on a driving task, in which various functions are assigned to the two feet. It would, in fact, prove most difficult for the driver to regulate with his right foot traction/braking actions, while using the left to operate an “active” dead-man system based on a monotonic cadence. Constant pressure on the pedal can be viewed as a sort of stable “background” task that drivers are able to assimilate. The fact that a position change immediately triggers braking, and not a preliminary alarm to entice the driver to perform a recovery action, appears to offer an additional safety feature. The hypothesis can be forwarded that a foot position change on the dead-man pedal corresponds to both an abrupt change in environmental conditions and an increase in the requirements for handling the situation. In this case, the consequences of a foot movement on the dead-man’s pedal, which serves to brake the vehicle immediately, constitutes a safety system adapted not only to driver-specific problems (drowsiness, malaise, etc.) but also to abnormal situations from an environmental standpoint, in that it leads to stopping the vehicle (or, to coin a functional safety expression, to secure the vehicle).

5.1 Imitation as a general rule, independently of the context

By virtue of these few examples, the role of imitation may be perceived within the innovation process; this occurs both consciously and subconsciously. Those elements that have successfully worked elsewhere get easily incorporated, yet such an incorporation step takes place without reexamination of the contextual differences and without updating the meaning of the target object from the vantage point of its intended purpose.

Yet the most important point herein is that feedback crystallizes around the local definition of an object, between a network and an equipment manufacturer. All discussions held at this critical juncture do not give rise to any written record. The only objective trace they leave is their “translation” in the new form taken by the technical device (Callon 1986). This new object then gets assimilated, from the perspective of its rationality, with two distinct frameworks, depending on whether it is used at the site where critical design discussions were held or whether it becomes an option in the manufacturer’s catalogue. In the latter case, the object goes unnoticed. Feedback is no longer meaningful; it merely gets engulfed in the physical form of the object, which can no longer yield input as to the reasons and forces behind its creation. Feedback therefore is not being ascribed any social pertinence, and devices that have been heavily critiqued in several places can be seen to proliferate. Here lies an insight into how the recently inaugurated and innovative Bordeaux tramway system,Footnote 8 which uses Alstom’s Citadis model, is equipped with the linear throttle that was rejected by the Citadis drivers working in Paris.

6 “Dead-man” hypotheses: between functionality and belief

This failure to question the reasons that incited tramway networks to request modifications to the dead-man device underlies a general void in challenging the device’s functionality. To clarify this point, let’s go back to the technical object itself, its material nature, shape and operability. Like for any technical object, monitoring systems propose an action “script” that transposes designer hypotheses on “elements making up the setting where the object is to enter” (Akrich 1987). The risk of human failure lies at the heart of such safety measures, yet when examining the various systems we are confronted with a multitude of hypotheses, some in contradiction with others, on the characteristics of human failure. To better understand this paradox, it is first necessary to describe the range of systems involved and explain the hypotheses behind perception and failure physically embodied in the systems created.

7 Several system designs for the various theories on human failure

According to the first such monitoring system, the transit driver must continuously activate the controls. Any release, regardless of whether or not a time delay has been introduced, transforms either existing situation by engaging the emergency brake.

According to the second system, the driver must alternatively press and release the monitoring control: this is the so-called “VACMA” system invented in the 1960s that requires holding down a pushbutton. The time delay allowed for the pressure or release action varies from one network to the next, yet most values lie on the order of 12 s maximum for holding the pushbutton down and 2 s maximum for button release. Should a driver hold the button down more than 12 s on the controls or release it for more than 2 s, a buzzer will sound, after which time action needs to be carried out within 2 s or else the emergency brake gets activated. Strasbourg has the only transit network that opted for a device designed to react indifferently to holding down or releasing the pushbutton. The driver can only maintain the button in the same position for at most 8 s, otherwise an initial alarm sounds; should the driver fail to change button position within 2 s, a second alarm is triggered with a quicker buzz than the first, and the driver has just 2 more seconds to react prior to emergency brake activation.

While both of these systems seek to determine the same type of information, i.e., eventual incapacitation of the driver, their strategies vary as a result of differing theories about human behavior, which may be explained as follows.

With the continuous-pressure system, the theory remains rather simple. If the driver experiences a malaise or falls into a deep sleep, he releases the button; any release therefore must automatically be interpreted as human failure, at which point triggering the emergency brake constitutes the sole means for making the system safe. The faster this release is recognized, then the faster the vehicle can be secured. The 2-s time delay between release of the monitoring device and engaging the emergency brake, as adopted on the Nantes tramway (western France), introduces a second hypothesis: the potential for device inoperability without necessarily any physiological breakdown on the part of the driver. This time delay gives the driver a chance to rectify “faulty manipulation”. Human behavior theory adds the complication of a possible failure of just the action and not the human being. Yet since button release serves as the designated failure signal, the automaton only grants a limited number of seconds for the subject to correct his “faulty maneuver”.

According to the system that verifies human contact with the pushbutton (VACMA), the theory here becomes more complex that the time delay implemented on the Nantes tramway, as the procedure does not recognize that a release action has failed (since the operator is requested to release whether or not he is experiencing a malaise), but merely requires intervals to be regular and very closely-spaced. The asymmetric time delay (12-then-2 s) underscores the fact that pushbutton release, more than maintained contact, is considered as the potential sign of failure. The frequency with which the button must be released remains however a most intriguing parameter: how are these values actually justified?

When questioning rail experts on such a justification, we went away none the wiser. Several competing “indigenous” theories are heard on the rationality behind this set-up and the applicable time delays. For some, the release allows ensuring that a driver does not stay “clenched” on the throttle if indeed he has become unconscious. Others however, and these would primarily include device manufacturers cite the benefit of preventing “cheating”. The time delay differences observed between trains (55/5 s), metro cars or the tram–train recently inaugurated in France (30/2 s), and tramway systems (12/2 s) apparently stem from differences in: vehicle weight, braking distances, and safety intervals. Yet when this rationale gets examined more thoroughly, its practicality is seriously challenged since within an urban setting, 4 s are more than sufficient to run a red light and cross an intersection. The theory most often raised to justify the dead-man (VACMA) control considerably modifies the actual function: the goal would be less concerned with sounding a failure warning than with ensuring ongoing driver vigilance. This shift in emphasis away from monitoring and in favor of vigilance is quite commonplace and may be found, for example, in operating safety regulations as well as in comments by experts, and not just in France.Footnote 9

As a final hypothesis and one supported by VACMA system operations on the Strasbourg network (which calls for pushing and releasing the control button symmetrically), human failure can be evidenced by clenching as well as by release.

7.1 The unspoken hypothesis of cheating?

We have thus explored four configurations of the “dead-man” system. While three of them operate according to an easily explainable theory, the last one remains harder to decipher. VACMA’s asymmetric time delay, broken down into 12 s holding the button down and 2 s for its release, is not grounded in any actual theory, or instead is too heavily steeped in theory to be convincing.

The vigilance control theory, which gets cited most often to justify the VACMA system, still seems disconnected from reality. It has been regularly found that this system’s function is not to monitor vigilance, as a recent accident once again attests.

On 30 August, 2004 along the Rouen (northern France) tramway line, one tramcar rammed into another stopped at a station. The investigation conducted by the Land Transport Office reached the following conclusion: “Human error caused the accident. The hypothesis of being overcome by a sudden malaise was initially examined before giving way to the much more likely hypothesis of the driver’s diminished state of vigilance following the onset of drowsiness”.Footnote 10 For such an accident to arise, during which the driver engaged the VACMA device at least twice without actually seeing the car ahead, serves as a reminder that “the only reliable information it (VACMA) can deliver about the driver would be whether or not he is physically present in the cab”.

Yet unless organizational conditions change, it is entirely possible that this conclusion once again goes unheard by the bodies responsible for ensuring safety on guided transit systems. For nearly 15 years now, it is a well-known experimental finding that a loss of vigilance is not incompatible with continued performance of a repetitive motion. The research carried out has revealed: “During these moments of reduced vigilance, increases are observed in both the frequency and duration of pedal releases”. Researchers went on to note that: “During phases when vigilance wanes, which should be considered as physiological states, we observed response failures to speed limit or stop signals” (Mollard et al. 1991). The dead-man monitoring system can thus be “normally” activated by transit drivers without necessarily suggestive of a bona fide state of vigilance.

This result was contained in nearly the same terms within the initial set of VACMA specifications, since one of the three underlying conditions to be satisfied was: “unconscious activation by the driver, who was not to be encumbered by the tedious constraint imposed by an incessantly-repeated manipulation” (Ribeill 1997).

To better understand this capacity for a “theory” to predominate while failing to stand the test of either facts or scientific experiment, it is probably necessary to seek explanation from the specifications drafted by the SNCF Railway during the 1960s that treated the topic with frankness. VACMA, invented in 1965, did not originally stem from any physiological controversy, but rather from a more pragmatic concern on the part of company engineers to avoid the type of “cheating” that had been occurring with the device then in use on network trains, which consisted of a hoop installed underneath the traction wheel that the driver was required to grip along with the wheel. A simple strap could take the place of manual action, thereby allowing the driver to freely move about within the cab, which for non-stop trips lasting several hours would seem like an attractive option. The release designed into the system therefore merely serves to ensure no cheating by delivering a constant pressure signal (Ribeill 1997). A quick release time can be viewed as a necessary compromise, since the signal that verifies compliance of the mandatory action is the same as that notifying eventual driver blackout.

The emergence of a veritable vigilance control theory, with no way of knowing exactly when, came about subsequent to the invention of VACMA, which was built on the basis of both a physiological hypothesis (i.e., failure manifested by control release) and moral hypothesis (cheating prevention). The fact that this approach to monitoring partially replaced the original theory can likely be explained in the difficulty experienced by transit facility managers to justify to network operators lasting constraints imposed upon them out of suspicion of potential cheating.

In reconfiguring this double theoretical basis for the “dead-man” device around physiological and moral considerations, the unspoken controversy shrouded beneath the device’s actual physical form from one system to the next can ultimately be clarified. A straightforward rating makes it possible to contrast the competing hypotheses on human operations and behavior observed on urban transit systems using three types of set-ups.

For the Nantes and Saint-Etienne networks, operator cheating is not an issue and human failure is signaled by a release of body pressure; monitoring by means of constant pressure indeed proves sufficient.

For the Strasbourg network, cheating is not a problem either, yet bodily behavior causes some uncertainty. Failure can be manifested by clenching as well as by release. A VACMA timed with a symmetric delay between pushbutton pressure and release therefore becomes necessary.

For networks in Paris, Grenoble, Lyon, Bordeaux, Montpellier and elsewhere, cheating can pose a problem and failure can be recognized by bodily release. A VACMA device with asymmetric delay (short time for pushbutton release compared with the time the button needs to be held down) would thus be required.

Once formulated as such, the controversy among dead-man devices could be settled quite easily apparently. From the standpoint of public safety, it would simply be necessary to discuss the rationale behind each one of these hypotheses.

Does human failure result in release or clenching? Outside the realm of scary fiction and horror movies, the hypothesis favoring release is the only one with medical validity.

Is cheating really a problem? Whether in Nantes or Saint-Etienne, both of which have adopted a constant-pressure type of monitoring for their trams, no report of cheating problems with devices has surfaced. The differences between interurban trains and tramways could explain this situation. For one thing, the technical potential for cheating without getting caught by management is even lower since a supervisor can enter the driver’s cab at any point along the transit itinerary. Moreover, travel times between two stops are short, on the order of just a couple minutes, and drivers are not inclined to circumvent a device that is not ostensibly bothersome.

From a safety perspective, automated monitoring systems like that used in Saint-Etienne thus guarantee the best level of reactivity in case of human failure, since the issue of cheating does not get raised within the context of an urban tramway. And yet, current trends would call for standardizing those systems offering the least efficient form of safety.

8 Conclusion

Via this tramway example and the onboard “dead-man” device, it becomes clear that the meanders in the design of a system, in comparison with its initial functional purpose, are not strictly due to a standoff between drivers on one side and systems designers and managers on the other, yet are still capable of steering all actors down the path of “wild solutions” (Amalberti and Barriquault 1999) invented to transform and adapt productive systems. This drift in design is imperceptible because it stems from an accumulation over time of minor transformations and the continual transfer of system “bits” from one context to another. No decisive rupture actually takes place, rather a never-ending series of small adjustments. The implementation of a VACMA dead-man system on trams has thus barely drawn attention since it merely reflects a system that has proven its worth a long time ago.

This lack of attention shown VACMA also exposes a waning interest in the profession of transit driver. For designers and managers alike, innovation only rarely tends to incite a preliminary evaluation of the types of situations being transformed. According to this same rationale, innovation benefits are not typically compared with the reality of the underlying activity. The notion that tasks will, come what may, get done still predominates.

It is not at all surprising to observe certain “disjointedness” in the innovation process with respect to production realities. The devices associated with standards and controls that have been developed and harmonized, prodded by European unification and market globalization, may thus constitute another kind of dislocation, which is very real and both necessary and sufficient for inciting innovation. This view of innovation economics, which favors accommodating the demands inherent in controls and standards over production realities, thereby lends credence to a process of “cultural alienation” of a group, to the extent that “the drive for solidarity among members is given higher priority than any consideration of the group’s founding purpose. (...) Over time, a process takes shape that leads the group’s entire organizational culture to an obscure perception of what the group is really supposed to be representing” (Sigaut 1990). The imaginary associations with “dead-man” control in the field of rail transit depict such a process rather well.

These sorts of meanders become possible since a gap forms between the design of a new technical object, its certification and its ultimate uses. As part of the innovation validation process, controlling standards and respecting procedures have overtaken justifying a given function. To a certain extent, we’re now “on our own”, with no longer the need to justify why something was done since “it goes without saying”: all that needs to be said now is how it got done. In the case of the tram-train, setting the dead-man time delay can be discussed ad infinitum without ever questioning its purpose. With the Translohr vehicle, when the steering wheel was eliminated to become a tramcar, no effort was undertaken to determine whether it was reasonable to have opted not to equip it previously with VACMA since the functional similarities were obvious. When it comes to design, the standard has thus supplanted the inherent work function.

The reintroduction of technical objects into a more open social context would help prevent the design process from gong awry. For the time being, technical objects, while generating considerable discussion on their functionalities, as deduced from their internal configuration, tend not to reveal much about their social integration nor about their eventual purpose and usage; in other words, a question mark remains over the relation between actual function and form. This laconic response regarding uses in design and control aspects likely causes some of the drift between designer imagination and concrete functionality. Once the activity itself has been excluded from the design process, the industry standard becomes the process’s sole benchmark, and this alteration in object meaning undergoes institutional ratification; such a sequence is streamlined by virtue of imitation procedures that overlook object meaning during the justification step.

While opening the design process to embrace new social actors, especially users, does not constitute an original idea as it lies anchored in the emergence of French linguistic accommodation (Wisner 1995) or Anglo-Saxon schools of thought on distributed cognition (Hutchins 1995; Suchman 1987), this research has emphasized the fact that nothing is really certain in this regard. Directing knowledge acquisition onto technical objects on the basis of functional analysis and activity decomposition remains critical to this process.

Research has also demonstrated the misconception of believing in the possibility of performing a long-lasting and continuous reformulation of functional specifications as part of the design process, since all such processes rely upon a “black box” economic approach (Latour 1989) towards a certain number of components—available from manufacturers as is, like packages waiting to be rearranged. The “black boxes” only get opened once displacements, ruptures or innovations arise that shed light on a new problem context for a technical object. These boxes need to become slightly less obscure, meaning that the various design actors, whether they be designers or users, be able to comprehend what exactly is causing the problem.

Once such explanations have been furnished, positions can be seen to move, even though challenging heretofore unquestioned postulates requires more effort given that the debate gets opened from the angle of working efficiency, a point of view often dismissed de facto. The current process of challenging the use of a dead-man device on tramway systems, whose outcome can obviously not be projected, attests to this state of affairs.