ORIGINAL RESEARCH ARTICLE

Negotiating Safety by Movements: Articulation, Alignment and Separation between Train Driving and Railway Traffic Controlling Activities

Oriane Sitte De Longueval, Simon Flandin, and Germain Poizat

Faculty of Psychology and Educational Sciences, University of Geneva, Genève, Switzerland

 

 

Abstract

 

On October 20, 2015, at 7:28 a.m., the regional express train 848973 left Abancourt for Rouen. The driver, traveling at 139 km/hour, hit two cows despite his emergency braking. As the carcasses passed under the obstacle deflector, they impacted the train’s braking capacity and left it skidding at a speed of more than 100 km/hour. The ground-to-train radio was not working, so the driver had to use his mobile phone to inform the traffic controller at Serqueux of the situation. The latter then cleared the track, stopped all other traffic and directed the train onto a ramp to slow it down. At the same time, at 7:50 a.m., when the train had slowed down sufficiently, the driver jumped out of his cab and put wheel chocks on the track thereby immobilizing the train and preventing it from heading back in the other direction. (French Bureau of Enquiry and Analysis for Transport Safety Report)

The driver lost control of this train due to a chance failure in the normal modes of interaction between him and the traffic controller. He was rescued by restoring this interaction through a means not provided by the organization (e.g., knowledge of the topography of the tracks) and another prohibited under formal safety rules (e.g., use of his personal mobile). We can see here that the negotiation of safety between different work activities requires a degree of reciprocity. Conversely, in high-risk organizations, work interdependencies can significantly contribute to safety breaches (Grusenmeyer, 2009; Owen et al., 2013; Tillement et al., 2009). The purpose of this article is to explore the interactions between two different activity systems to offer a better understanding of the reciprocal movements between them, an aspect which has largely been overlooked by current research.

The negotiation of safety could be defined as ‘the efforts by the interested parties to come to an agreement about the problem and the appropriate solution’ (De Terssac & Mignard, 2011, p. 186). Guided by recent research (Gherardi & Nicolini, 2002; Lorino, 2009; Owen, 2008; Tillement et al., 2009), the aim of our research is to explore the negotiation of safety between two activity systems. According to the cultural-historical activity theory developed by Engeström (1987, 2001, 2009, 2015), when analyzing an activity, you should take account of ‘a system that includes individuals, the tools, materials or concepts they use, their relations with the surrounding community and the product intended to be produced, the interactions that take place therein. [and] any transformations that also take place’ (Gilbert et al., 2013, p. 70).¹ These activity systems are understood as being shared when they are directed at a partially shared object and mediated by artefacts (Engeström, 1987, 2001). Negotiation between them is marked by constant movement (Engeström, 2000, 2004; Engeström & Sannino, 2011). These movements are defined as the ‘dominant patterns and directions of physical, discursive and cognitive motion in historically different organizational frameworks’ (Engeström, 2006, p. 15). The study of these movements should enable an ‘expansive visualization’ (Engeström, 1999, p. 63) of the negotiation of safety, both in the inter-systemic space of the activity systems and over the time of their co-evolution.

The purpose of this article is to offer a better understanding of the movements that occur between activity systems when they negotiate safety. Our focus is railway driving and rail traffic control which are two joint activity systems tasked with ‘working together on safety’. Our qualitative study into the interaction between these systems in a large European transport company shows that the negotiation of safety between these activity systems is based on the movements of articulation, alignment, and separation. Our aim is to further current knowledge of safety and of activity theory and construct a model of negotiation engineering between activity systems in high-risk industries.

Literature review

The conceptual framework of this study is based on a wide-ranging review of the current literature on the negotiation of safety between different work activities, and particularly on the work of Engeström, whose work allows us to analyze movements between the joint activity systems underlying this negotiation.

Safety negotiation between different work activities

Safety as a negotiation

Since early research into ‘HROs’ (High Reliability Organisations) (Rochlin et al., 1987; Weick, 1987) and ‘resilience engineering’ (Hollnagel, 2014), safety has been seen as a negotiated order, the place where an organization’s formal regulation and its informal use by practitioners overlap (Journé & Stimec, 2015). Similar to De Terssac and Mignard (2011), we consider negotiated safety to consist of ‘the efforts by the interested parties to come to an agreement about the problem and the appropriate solution’ (p. 186). This negotiation involves identifying and typifying normal and dangerous situations, which in turn allows us to identify the appropriate action to be taken (Cambon-Bessières & De Terssac, 2009).

Extensive research into safety negotiation between rules and practices within a same work activity currently exists. However, there is little work into safety negotiation between different work activities (see, however, Gherardi & Nicolini, 2002; Lorino, 2009; Owen, 2008; Tillement et al., 2009). Yet high-risk organizations very often depend on complex socio-technical-organizational systems involving extensive division and interdependence of occupations, roles, and labor. In such organizations, every individual has their rightful place depending on their own specialization. Accordingly, work activities are separated geographically, organizationally, culturally, and indeed subjectively, while being structurally dependent (Vaughan, 1996). However, the distance between these work activities can be seen as a safety factor at the level of the organizational system by imposing/maintaining a reflexivity between work activities which can cause friction but can also give rise to essential discussion (Rochlin, 1993). This capacity to reflect and learn would appear to be a key factor fostered by highly reliable organizations (Rochlin et al., 1987; Weick, 1987). However, this separation can also present risks when activities find it difficult to understand each other or act together (Grusenmeyer, 2009; Vaughan, 1996). Breaches can effectively occur between work activities that do not manage to coordinate their efforts and co-manage risk situations (Grusenmeyer, 2009; Owen et al., 2013; Tillement et al., 2009).

Yet little research has been conducted regarding the negotiation of safety between different work activities despite the fact that it is commonly found in highly reliable organizations.

The joint negotiation of safety between work activities

Research into the negotiation of safety between different work activities (Gherardi & Nicolini, 2002; Lorino, 2009; Owen, 2008; Tillement et al., 2009) has focused on a variety of important issues.

Gherardi and Nicolini (2002) take a pragmatic approach and show how members of two different communities of practices compare and align their views in the negotiation of safety. This alignment is provisional and unstable given that the practices adopted in each community are rooted in different worldviews (and views of safety) and in the differing power relations between them. Similarly, Lorino (2009) notes the importance of the ‘chronotopes’ (or representations of time and space) in which work activities are embedded. Workers from different professional worlds can have different worldviews and different ways of reasoning and organizing their work. This chronotopic dichotomy prevents them from assessing the potential impact of the decisions they take within their own work activity on the safety of the work activity of others.

Adopting a cultural-historical perspective, Owen (2008) has analyzed the tensions that can arise between the different constituents of two activity systems that jointly negotiate safety. She has shown how the boundaries between these systems have been historically and culturally drawn and how that can lead to contradictions between systems and tensions between workers.

Finally, from a more interactionist perspective, Tillement et al. (2009) have explored the negotiation of safety in instances where the formal ways in which work is divided between occupational groups have been disrupted. This leads to a more informal rearticulation, mirroring existing imbalances of power. The more powerful occupational group imposes its production objectives on the weaker one, which is forced to scale back its safety targets.

According to these studies, the negotiation of safety between different work activities depends on a more or less harmonious comparison between the worldviews (Gherardi & Nicolini, 2002) and the extent to which they are rooted in a similar context (Lorino, 2009). It also depends on the more or less effective management of tensions that arise between them (Owen, 2008) and the balance of power between them (Tillement et al., 2009). This article focuses on an additional aspect of the negotiation of safety between work activities, namely the movement between them during negotiation. For this purpose, we have adopted a cultural-historical activity frame (Engeström, 1987, 2001, 2009, 2015).

Movements between joint activity systems according to cultural-historical activity theory

‘Movement’ as a key concept to extend the understanding of safety negotiation between work activities

The cultural-historical activity theory as developed by Engeström (1987, 2001, 2009, 2015) is particularly suited to the study of interactions between artefact-mediated activity systems (Licoppe, 2008). It focuses on systems and the changing dynamics of activities, culturally and historically, and also developmentally. Their interaction stems from a form of negotiation that is central to coordinating ‘distributed agency’ (Engeström, 2008). According to Engeström, this negotiation is similar to the construction of a ‘negotiated order (Strauss, 1978) in which the participants can pursue their intersecting activities’ (Engeström, 2008, p. 328).

When activity systems try to construct this negotiated order, they are constantly engaged in reciprocal movement (Engeström, 2000, 2004; Engeström & Sannino, 2011). These movements are both spatial and temporal. They occur in the space between activity systems and over time through successive learning and development cycles. The challenge is to understand ‘how such basically forward-oriented expansive learning actions are intertwined with horizontal or sideways movement across competing or complementary domains and activity systems, particularly characteristic to co-configuration’ (Engeström, 2004, p. 15).

By investigating these movements, we can address hitherto neglected issues concerning the negotiation of safety between activities. To date, most research has largely focused on action and work interactions. What we want is an ‘expansive visualization’ (Engeström, 1999, p. 63) in both space and over time of the work that interests us here. The visualization in space is required because we do not see activity as a collection of localized actions or operations but rather as an activity system with multiple constituents that interact with other activity systems. Activity is not seen as a linear series of actions, but rather as a cultural-historical construct that develops over successive cycles.

A spatial extension

Engeström looks at what happens within activity systems and at the interaction between them when they are joint, namely when they are directed at a partially shared object and mediated by artefacts (Engeström, 1987, 2001). These activity systems are not viewed as collections of individual actions or operations but as systematic and complex ensembles of sociocultural mediation which is intrinsically collective in nature. Engeström (1987, 2001) views each activity system as heterogenous, multivocal, structured and driven by mediation between six basic constituents. When we investigate the junction between these two systems, we can pinpoint the interactions and tensions that arise between each of the constituents of these activity systems.

The object is the first constituent and is the reason for the activity system. It comprises all the tasks and solutions deployed to achieve the activity system’s objectives. The object is worked on by the subject, an individual or a group of people, involved in the activity. These activity systems interact through mediating artefacts, or conceptual, material or digital tools that mediate between the subject and the object. The community is also involved in this activity system, and comprises the social group to which the subjects belong. Formal and informal rules underpin and constrain the actions carried out as part of the activity. Finally, the division of labor refers to the distribution of work horizontally in terms of tasks and vertically in terms of power and status. When activity systems interact, they construct a shared or joint object which provides the basis for the coordination of activities and their joint outcome. Figure 1 models the interaction between two joint activity systems according to Engeström.

Figure 1. Model of the interaction between two joint activity systems.
Source: Own elaboration, based on Engeström (2001, p. 136).

This theory posits a local analysis on a level different from that of action by seeking to capture the activity that occurs in an inter-systemic space, at the intersection of the constituents of each of the systems (Engeström, 2011). Such an approach can help us understand how safety is negotiated within this space.

A temporal extension

Once we have decoded joint activity systems structurally, we can move towards exploring how they evolve over time (Engeström, 1987, 2001). This transformation can be seen as an attempt to ‘reorganize, or remediate, the activity system in order to resolve its pressing inner contradictions’ (Engeström, 1995, p. 180). Indeed, Engeström refers more to the reorganization than to the organization of activity systems. Here, he uses a process approach to an organization where actors are constantly reorganizing their structure. This organization can be analyzed in three stages (Engeström, 1987, 2001).

First, the structure of activity systems. This refers to ‘organizational anatomy’ (Engeström & Sannino, 2011, p. 371), inherited from the past and frequently formally determined, but then constantly transformed by action. This predetermined structure does not always meet the needs of the situations faced by workers, and that is where contradictions arise.

In specific situations, these contradictions may present as deviations from the normal work process (Engeström, 2008)² and can weaken activity systems and the interaction between them. This may arise when there is a contradiction between different versions of a constituent of an activity system (e.g., when a new rule has been introduced), between different constituents of the same activity system (e.g., between a subject and his or her community), and/or between the constituents of joint activity systems (e.g., the division of labor of system A and that of system B). This is the level of contradiction that concerns us here.

Not only are these contradictions disruptive, they also are also potentially ‘creative’ and play a key role in developing activity systems. Their individual or collective resolution by practitioners is what allows systems to adapt temporarily to the contradiction or even to renew themselves. For Engeström (2011), the developments of practitioners consist of qualitative transformations guided by an expansive conceptualization of the overall object of the activity. When practitioners can identify and understand contradictions, they learn and develop and are able to act at an intermediate level to resolve them. This gives rise to new daily work practices and, on occasion, to new organizational structures (Engeström, 2001). Figure 2 shows the three levels in the negotiation of joint activity considered by Engeström to be cycles in the development of activity systems.

Figure 2. The stages in negotiating joint activity.
Source: Own elaboration.

This model seeks to define the negotiation of safety ‘in motion’, namely in terms of its structural (past), situational (present), and development (future) cycles.

We should also explore the movements underpinning the negotiation of safety between two joint activity systems through the prism of a cultural-historical approach to activity. They constitute a stumbling block for safety and yet constitute the cornerstone of cultural-historical activity theory. With a view to understanding the movements that take place between activity systems when they negotiate safety, we have carried out a qualitative case study of drivers and traffic controllers within a large European passenger and freight transport company.

Methodology

In this case study, we have collected ethnographic data on the interaction of these joint activity systems and analyzed them from a process-based perspective.

The case of rail safety negotiations between driving and traffic controlling

If a train can travel so fast with so little energy, it must not be rolling but sliding. Low wheel/rail adhesion is the main advantage offered by rail transport but is also its main disadvantage. At full speed, it is impossible for train drivers to see where the train is going, brake in time, and avoid the danger. That is where the traffic controllers come in. They direct drivers remotely from their traffic control centers (Figure 3: left-hand photograph), using signaling systems across the railway and radio. Controllers are sedentary and usually work remotely in the company of their colleagues in a traffic control center. In return for this remote guidance, the drivers tell them what they can see from their cabs is happening on the track (Figure 3: right-hand photograph). An on-board geolocation system positions their train on a graphic representation of all the traffic on the network and can be seen by the traffic controllers (whiteboard in the photograph on the left). These drivers are constantly on the move and spend most of their time alone, in direct contact with the train and in indirect interaction (generally by radio or via the crew) with the passengers.

Figure 3. Views of traffic controllers and train drivers.
Photo: Oriane Sitte De Longueval (2020)

According to Engeström (1987, 2001), the traffic controlling and driving activity systems coordinate to produce safe movement. For this purpose, the subjects of these systems (controllers and drivers) use their own rules (principles, manuals, and flowcharts) and mediating artefacts (radio, signaling, geolocation, optical panel) to interact. They act towards an individual object (rail traffic for one, train movement for the other) and towards a common object (safe rail movement), within their respective communities (operators and traffic or driving managers) according to the (geographical and hierarchical) divisions of labor in force in the traffic activity system organized by sector and those organized by line in the driving activity system. Figure 4 illustrates this mechanism.

Figure 4. Coordinating traffic control and train driving activity systems for safe rail.
Source: Own elaboration.

Controlling and driving are therefore the main coproducers of rail movement and act jointly. Controlling is ‘addressed’ (Lorino, 2009, p. 94) to driving and vice versa. However, drivers and controllers virtually never meet each other and rarely speak to each other. In the company in question, they were growing even farther apart with successive reorganizations as the sector was opening up to competition. This created activity silos and drove a wedge between those on the operational side (such as driving) and those on the infrastructural side (like controlling) as each was now owned by a different public limited company, under the umbrella of a common parent company.

Rail safety is largely located at the point of contact between the driving and the controlling systems. It is based on the joint avoidance of the risk of trains colliding or of people being hit. Drivers and controllers, and indeed the company in general, view this safety as a historical priority. The combination of production imperatives and safety obligations is based on an extremely high level of technical expertise and mastery of the tools and regulations governing the driving and controlling activities, ensuring compliance with the rules to the letter, while leaving room for improvisation in the face of the unexpected. Having said that, both drivers and controllers see themselves as ‘ayatollahs of the rule’ and ‘world champions in circumvention’.

In spite of the efforts they make to ensure that the two systems work together safely, their interaction remains irremediably subject to the friction and misunderstandings that underlie most safety incidents and accidents.

Data collection

Activity theory requires an ethnographic approach (Ybema et al., 2009) that allows for radical localism (Engeström, 1999). We used this type of qualitative data-collection approach with a group of drivers and controllers over a period of two years (2019–2021) in a large European company. Our data came from several sources (observation, interviews, documents) and reflect different points of view (that of the driving activity and that of the controlling activity).

One researcher was posted to the company safety department for a continuous period of 20 months. This allowed us to collect valuable contextual information. Furthermore, as illustrated in Appendix A, we conducted several sessions of direct observation of driving (n = 4) and controlling (n = 4). Each of these eight observations (n = 8) lasted 3 h 37 min on average. We used an observation guide to focus on the constituents of the activity as a system, its interactions with the joint system, any disruption to activity caused by this interaction, and the methods favored by the practitioners to resolve matters.

Furthermore, after two exploratory group interviews (n = 2), with two groups of four drivers, we then conducted individual interviews with drivers and driving managers who had previously worked as drivers (n = 4) and with controllers and controller managers (n = 3). Our informants were questioned about their daily work, their different tasks, and the types of interactions they have with the neighboring activity. These interviews can be found in Appendix B.

Finally, we used several documents (e.g., guidelines, accident, and incident reports, articles from internal newspapers dealing with safety excerpts from posts by trade groups on social networks, illustrations of critical situations by stakeholders) to supplement and contextualize our interviews and observations.

These data were all transcribed (in the case of the interviews), recorded in a diary (in the case of the observations), and reproduced (in the case of the documents) before being anonymized and analyzed.

Data analysis

In order to study movement (understood as displacement in space and time) between activity systems, we based our data analysis on a visual mapping strategy (Langley, 1999). This allowed us to account for processes that involve several dimensions simultaneously, the interactions between them, and their evolution over time (Langley, 1999). We developed a graphical tool to depict interactions between dimensions in space and time.

We applied this analytical strategy in three successive coding stages. The first ‘spatiotemporal’ stage sought to situate the constituents of the activity systems in space and time. The second ‘interactional’ stage sought to identify interactions between these constituents. The third ‘directional’ stage sought to specify the nature of the movements that shift the activity systems in relation to each other (see details in Appendix C).

The spatiotemporal analysis aims to identify a fixed mutual representation of the activity systems in space (how the constituents of the systems are positioned in their own and in the shared space) and over time (how this position evolves over the three stages of the negotiation of safety: structuring; contradiction; and the practitioners’ development). The construction of this spatio-temporally anchored representation is based on deductive encoding of the data using two levels of theoretical codes drawn from Engeström’s model. The first level [constituents of activity systems] (n = 6) concerns the elements of the driving and controlling systems and enables them to be positioned in space. The second [stages of negotiation] (n = 3) concerns the stages in the negotiation of safety and allows the activity systems to be positioned in time.

The interactional analysis stage shows interactions between activity systems in each place and at each time in the negotiation of rail safety between drivers and traffic controllers. Empirical codes (n = 18) are used to cross-reference the previous codes, thereby showing what happens at the intersection of each constituent of the activity systems at different specific times.

The directional analysis stage links together the codes constructed during the second stage and reveals the typical movements that occur between activity systems. A final level of empirical codes (n = 3) allows us to identify these movements which underpin the negotiation of safety between joint activity systems.

Findings

We have established that the negotiation of safety depends on three types of movement: articulation, alignment, and separation between driving and traffic controlling activities.

The type of movement favored depends less on the situation itself than on the constituents of the activity systems involved in the negotiation. The articulation movement depends on the objects³ and the artefacts mediating the activity systems, the alignment movement involves rules and divisions of labor, and the separation movement involves subjects and communities. We aim to describe each type of movement in terms of its initial structure, through the contradictions that may compromise it and through the developments implemented to re-establish it by its practitioners.

Negotiating safety by articulating activity systems

The articulation of activity systems involves linking them in such a way so that their relative mobility is preserved.

Structures articulating activity systems

Driving and controlling are operationally interdependent and geographically independent. For rail safety to be negotiated despite this distance, these two activities are structured in two ways.

Firstly, the objects of driving and controlling are designed to be mutually complementary. The two activity systems do not share the same purpose or operate in the same way or within the same boundaries. They are consequently unable to act on each other. Their objects are different. Drivers optimize and secure the movement of the trains, from the point of departure to that of arrival. Controllers optimize and secure the movement of trains in a particular domain. This domain partly comprises the driver’s train route, but also includes other tracks, other trains, other practitioners, and consequently, other risks. Drivers need the traffic control system to make the trains run as it maps out the routes and operates the appropriate railway signaling. Similarly, controllers need to move trains forward, or stop them, as appropriate, in order to manage rail traffic. These activities systems act through each other, for each other, and in relation to each other. Their objects are articulated around a shared, higher-level, object that puts rail production and safety on an equal footing. This is what emerged from the interviews: ‘Produce [rail movement] safely’.

This articulation relies on mediating artefacts designed to ensure permanent, efficient, and safe interoperability between driving and controlling. Drivers and controllers must pass on information to their counterparts without any disruption to their work. Most of their interactions are automated, mechanized, tracked, and stored with this objective in mind. This allows them to keep each other informed in real time, without having to exchange information verbally. Driving is guided by instructions about speed and when to stop, broadcast on the track and to the cab by the controller. Traffic control is guided by the location of trains on a map of the network that the controllers have in front of them. When they have to speak over the radio, this verbal interaction is governed by procedures. These are designed to limit any ‘useless’ information that might interfere and to cross-reference ‘critical’ information so that it can be verified and errors avoided. Figure 5 shows, from left to right: the radio used by drivers and controllers to communicate, a guide to these communications and the form used to log this information.

Figure 5. Artefacts mediating between driving and controlling.
Source: Oriane Sitte De Longueval (2020).

Contradictions disarticulating activity systems

The hazards specific to rail production, and their cascading implications for transport plans, can give rise to contradictions that disarticulate activity systems.

These can be contradictions between the common object of safe railway production, and the objects specific to each of its activity systems. When a transport plan is disrupted, the aim of controllers is to manage traffic in the area as best as possible and that of drivers is to keep their trains moving along the track as best as possible. At that point, drivers and controllers lose sight of the common object in the pursuit of their individual objects. This is what happens in the following scenario:

So for me [as the driver], the procedure [for moving a train onto a siding] is for the [controller] to give me a written document to assure me that there isn’t another train that might enter the siding and that he has checked this. But [the controller] said ‘to speed things up, why don’t you go over to the other [lane], and when you get there, I’ll give you the document’. That was it. Except when that happens it’s me who’s taking the risk. We use the safety team and if they haven’t checked properly, we could be in trouble. But that saved him a bit of time because I was in the way and he had to get the other trains through. All he wanted was for me to clear out of the way so that he could get on with his job. (Édouard, driver)

In this situation, the controller asked the driver to move his train onto a siding without first ‘protecting’ this track. He encouraged the driver to take a risk, to enable him to get on with his controlling work more efficiently. Here, the objects, rather than being articulated, get in each other’s way, are mutually obstructive, and disarticulate each other. The shared object, namely the safe production of rail traffic, which normally operates as a hinge, breaks down. The production of one activity system takes precedence over the safety of the other.

Contradictions can also arise between the mediating artefacts of activity systems. This disrupts the transmission of information between them resulting in under- or disinformation. This is shown further in the text:

One of the controllers wondered what had happened to train XB467, which had been stopped on the track for 15 minutes due to a breakdown. He was worried because it was blocking one of the tracks and starting to seriously disrupt other traffic. At the same time, requests were pouring in, giving the impression that everyone needed to know why the train had stopped and when it would get going again. The controller called the train driver over the radio to ask what was happening and when his train was likely to get moving again. The driver simply replied, ‘I am using the guide’. The controller just had to make do with this regulatory information, basically to the effect that the driver was trying to repair his train. He would be given no idea as to the cause or duration of the breakdown. He would simply have to make do with what he calls, ‘the magic words’. (Traffic control observation notes)

In situations like these, a contradiction arises in the use of mediating artefacts. The mediating artefact plays its role, but the driver does not use it in the way the controller would have liked him to. As far as the driver is concerned, if you state that you are ‘following the guide’, you can put an end to traffic disruption and avoid being held responsible for any mistakes concerning the cause of the breakdown or how long it will take to repair. As far as the controller is concerned, what the driver has just said is a non-answer, cutting short any further discussion and preventing him from getting any additional information that could be used for traffic management. This communications procedure allows the driver to sidestep questioning by the controller and be free to get on with his repair. It prevents the controller from getting the information he needs from the driver, to allow him to get on with his work. They both communicate via the mediating artefacts used at the time, but their communication no longer allows the activity systems to be articulated. This is disruptive for the driver and inoperable for the controller.

Developments rearticulating activity systems

Faced with contradictions such as these, drivers and controllers try to re-articulate their objects and mediating artefacts in a developmental dynamic.

In their efforts to re-articulate their respective objects, they develop agreements around a common object. Let us take a train protection request to controllers as an example of this type of development. When a train breaks down on the track, the driver makes a ‘protection request’ to the controller. This type of protection guarantees that the controller has stopped nearby traffic to allow the driver to move the train onto another track. Drivers must determine the size of the zone to be protected. However, as a precaution, they sometimes ask controllers to set a larger protection zone than necessary. This leads to increased interaction between control offices and the risk of potential failures (in the event of oversights or misunderstandings) in the degree of protection ultimately provided for the driver. By trying to over-assure their safety without being aware of traffic constraints, drivers are putting their trains at risk. In such situations, controllers like Miguel try to negotiate the size of the protective zone.

‘So the driver, who had happened to plan on having lots of distance to be well protected, is going to end up not being well protected, because with all that distance, we forgot to ask the other office to take protective measures and that means that there is the chance that they will send traffic to the zone. So we’ve worked closely on this with the driving establishment to get some proper prior agreements where everyone shares their needs and listens to the needs of others’. (Miguel, traffic control manager)

Drivers and controllers, through exchanging views on the nature and constraints of their work, can bring to light contradictions between their respective objects. This helps them agree on an intermediate protection zone and re-articulate their objectives. In this instance, understanding is not merely about local and inter-individual development. It goes all the way up to the management of their respective operational units and has the potential to transform the instructions given for protecting trains and thereby change the activity systems.

The mediating artefacts are rearticulated by developments by drivers and controllers. As they are anxious to come to a better mutual understanding, they create more direct, more open, and/or richer communication tools. This is the case of a prompt designed by a traffic manager. He first consulted drivers and then created a new mediating artefact for the controllers in his team. It gives them a better picture of the driver’s environment when they have to guide them remotely. Figure 6 illustrates this prompt.

Figure 6. Photograph of the prompt placed in a traffic station.
Source: Oriane Sitte De Longueval (2020).

This prompt helps controllers visualize the train’s environment when they are interacting with the driver. Several key elements and reference points are marked and positioned on a schematic representation of the line routed by the controller. The photograph shows footbridges and underground passages (black rectangles) and tunnels (gray rectangles), and points that are easy for the driver to spot, such as junctions and bridges (boxes), the equivalent of traffic lights (red dotted lines), line numbers, the towns and cities crossed, and the control offices involved. These developments are confined to the controllers concerned and the drivers with whom they are in contact, and affect different teams.

Negotiating safety by aligning activity systems

The alignment of activity systems corresponds to their ability to operate in parallel and as a mirror image of each other.

Structures aligning activity systems

While driving and controlling can occur in parallel, their divisions of labor and rules correspond with each other at all points without the systems needing to interact.

In terms of division of labor, driving and controlling tasks complement each other at each hierarchical level. An analysis of the organization charts (Figure 7) shows that each driver has a counterpart on the controlling side and that their roles are complementary.

Figure 7. Simplified train driving and traffic control flowcharts.
Source: Own elaboration.

This is how the division of labor is aligned. In principle, there is no need for an intermediary activity system, or even mutual consultation, to drive or control the trains. Everyone does what they have to do depending on their role and level. If drivers and controllers need to talk to each other, they each know who to talk to.

The same applies to the alignment of driving and controlling rules. They are local, ad hoc adaptations of more general, common rules. These rules reflect and never contradict each other, albeit without specifically referring to each other. Miguel explained this to us.

I have ‘controlling’ guidelines, but no access to [driving] guidelines. We have, for example, DC7202 [controlling guideline] which talks about different ways of protecting drivers, and they have TT something [driving guideline] or other which says the same thing somewhere. So if you take these different guidelines and put them side-by-side, they say exactly the same thing. Their purpose is the same, but we do not necessarily know what the driver’s instructions are. (Miguel, traffic control manager)

The guidelines mentioned by Miguel are essentially flowcharts that describe in precise detail the procedure to be followed in a certain number of specific cases. Some of these cases are common to both driving and controlling, as they often involve both activity systems. In such cases, everyone follows their own flowchart. They are different, but they correspond at each stage. For example, in the event of an abnormal collision, drivers must locate the kilometer impact point, and stop and tell the controller. Controllers who receive such a call should ask the driver about its nature and its kilometer impact point. Alignment of behaviors is structured in advance, without the controllers having to know the rules governing the drivers or vice versa.

Contradictions misaligning activity systems

Some contradictions misalign divisions of labor and the rules governing driving and controlling.

Misalignment of divisions of labor in driving and controlling can create role conflicts. In these situations, either there is nobody responsible for the task that needs to be done, or several people are or nobody knows who is responsible for what. This is precisely what happens to Julien in the following instance:

[You don’t feel] great driving, [you call] traffic control [to get a replacement] […] [traffic] tell you to call your [driving] people, you get through to them, and your people say ‘yeah right, but why don’t you just take your train over there, over there, over there?’ But hey, you just can’t keep driving. Safety wise it’s all your fault if you bump into [another train]. (Julien, driver)

As Julien no longer feels capable of driving his train, he needs a replacement. In these circumstances, drivers normally consult controllers to find one. However, in this case, they send Julien back to his driving managers. His managers take no responsibility for replacing him and ask him to keep driving even though he is no longer able to do so. Now Julien has lost all contact with a controller who can help him with his driving.

The same applies to the rules governing activity systems. When a situation that does not map directly onto the driving and controlling flowcharts arises, their rules become misaligned. In situations like this, the fact that there is no purpose-designed flowchart, coupled with a lack of knowledge of the general rules that apply to the other party, prevent them from being able to act together without acting against each other. In the words of Alix, ‘the flowchart is great because there is less to think of, but the problem is that agents stop asking questions and when their situation is similar to the one prescribed by the flowchart they tend to stick to it and this means they are potentially deadlocked, locked inside a procedure’ (Alix, traffic manager).

The mere existence of flowcharts means that people are not required to think about the rules that apply to the other party. However, when the rules governing the two activity systems are no longer aligned, because of unpredictable circumstances, drivers and controllers become deadlocked.

Developments realigning activity systems

Faced with these contradictions, drivers and controllers try to realign their divisions of labor and their rules.

They start to create developments in their roles, so as to partially realign the divisions of labor and to break the deadlock. They have to step outside the tasks assigned to them and take personal responsibility for their actions as they have not been predicted and sometimes even fall into the domain of others. This is illustrated in the following text:

Today, while [the] driver may have all the technical knowledge to carry out a brake test, he is not authorized to do so because he is not able to complete what is known as a brake bulletin. Under regulations, brake checks must be carried out by an authorized agent on site. However there isn’t one at every station, so sometimes there is no one who can do the test, so we can’t leave. I’ve already broken that rule. I went off to do the brake test, saying [to the controller] ‘I have the technical expertise, I know how to do it, no worries, I just don’t have the authorization. However, if there is a problem with the brakes or an investigation, don’t come to me splitting hairs’. (Laurent, driving manager)

The driver is prepared to step outside his role to carry out a brake test for which he is not authorized. He does, however, set one condition for offering this ‘helping hand’ – that he is not to be blamed if there is a problem later. This is how he breaks the deadlock for the controller, who can now start up the traffic again, and for himself, as he can get back in his cab. However, these role changes remain few and far between and are often covered up for fear of sanctions or a loss of posts as some may be deemed superfluous if roles are allocated differently. These developments do not effectively transform the structure of the activity systems on a long-term basis.

Similarly, when rules are misaligned, controllers and drivers develop special rights. This allows them to realign sufficiently to resolve the contradiction. They have to take a step back from their work flowcharts, or even step away entirely, and devise different procedures that are more in line with those of the neighboring activity. Alix explained this to us:

When there is an issue, they can’t manage or they haven’t understood or the procedure doesn’t actually work, that’s when they bring in the on-call manager to assess the situation. And he can take the liberty of, in inverted commas, circumventing the regulations, analyzing the situation and breaking the deadlock. (Alix, traffic control manager)

As we can see here, for this kind of development to happen, it often requires seeking the sound advice of a work colleague who is prepared to adopt a cross-activity approach. It could be a more experienced or more adventurous colleague with a more systemic understanding of the rail rules common to driving and controlling. It could be someone who can be accessed directly from the traffic control center, or by telephone or, in the case of drivers, ‘between trains’. It has to be someone not just with knowledge, but someone who is prepared to assume responsibility for circumventing the flowchart. So, to realign rules, it often requires an intermediary who is authorized to circumvent them: supervisors in the case of controllers; and the driving support center for drivers. These developments therefore involve hierarchies in the activity systems. If they are effective in responding to recurring contradictions, some may even lead to an updating of the rules governing the activity systems.

Negotiating safety by separating activity systems

Separation between joint activity systems involves the gap that can creep in between them and mainly concerns their subjects and their communities.

Structures separating activity systems

The interdependence of driving and controlling requires a degree of independence of each of the activity systems and consequently there is contradiction and reflexivity in their interactions. Here, the separation of activity systems is characterized by interpersonal mistrust and a separation between communities.

For both drivers and controllers, mistrust of the subjects of the other activity is deemed to be a professional skill that ensures the safety of the organizational system as a whole. Everyone should keep their distance from other people and should be sure to check everything over and make all their decisions by themselves. If anyone wants to oblige someone else to carry out an action, they must provide written assurances and obtain the other person’s agreement. This is ‘rational’ mistrust, where credence is only ever given to what has been scrupulously and directly controlled, using tried-and-tested methods of analysis and actions.⁴ This helps us understand the following reaction by a controller under observation: ‘We [the traffic controllers] are the ones who decide. The drivers can’t tell us what to do!!’ (Traffic control observation notes).

This distance between drivers and controllers is designed to prevent any mutual influence as that could lead to risk-taking by one at the request or under pressure by the other. Interpersonal mistrust is primarily the result of professional training and is geared towards preventing gullibility. During recruitment, training, and practice, drivers and controllers must be open to interaction and criticism without ever allowing their decisions to be dictated implicitly or explicitly by their counterparts. Drivers and controllers develop interpersonal mistrust as they all have direct or indirect experience of the consequences of gullibility on rail safety.

The separation between the driving and the controlling communities bolsters this interpersonal mistrust and increases the gap between driving and controlling. These two professions, with their very strong professional identities and segregated career paths, have little or no opportunity to interact outside the frameworks predefined by the mediating artefacts and only in situations where this is necessary. Betty explained this to us: ‘A driver rarely enters the world of controlling and controllers rarely enter the world of driving. […] These worlds are closed and ultimately the only time people talk to each other is when there is a problem’ (Betty, former driving manager).

Contacts between those managing the rail infrastructure (e.g., controllers) and those using it for transport purposes (i.e., drivers) can be seen as ‘cronyism’. Cronyism of this nature, in the context of the opening up of the rail market to competition, can also be seen as an obstacle to free competition. These two worlds share a pride in belonging, but also a ‘necessary rivalry’. We can see this separation in the way that the communities describe each other. Controllers often think of drivers as ‘grumpy’, given that they often sound annoyed when they finally contact them (often after a long period of silence). Drivers tend to think of controllers as ‘half asleep’ because they are often slow to open signals or give them information (often because they have so much to do at the same time). Communities describe each other in these ways because they never meet and come into contact only through the constraints they impose on each other. The separation between the communities shapes their mindsets and consequently the ways in which they view and interact with each other.

Contradictions re-separating activity systems

This structural gap can be exacerbated by certain contradictions involving interpersonal conflict or community withdrawal.

When there is interpersonal conflict, the subjects of the activities enter into contradiction, they oppose each other and can neither understand one another nor agree. Mistrust becomes distrust and distance turns into breakdown. This can happen openly or less so. Drivers and controllers may fail to interact and thereby fail to negotiate safety. They can also, more directly, cut an interaction short and invite the other person to ‘go it alone’ with all the concomitant risks. ‘Sometimes everything is so tense that you end up throwing everything out of the pram and saying [to the controller], if you’re not happy, then do it yourself!!’ (Romain, driver).

This re-separation also emerges in rifts between communities which can also cause communities to withdraw as can be seen in cross-company inquiries carried out following (safety- or production-related) incidents or accidents involving driving and controlling. These inquiries consist of a joint analysis of events by the protagonists and their managers. The recordings of the actions and interactions between drivers and traffic controllers are retrieved in an attempt to identify the precise causes of the event, to discipline those responsible where necessary, but primarily to ensure that the accident does not happen again. The main issue is the safety of the rail system. However, we can see that these inquiries are often obstructed by the communities themselves. Miguel explained this to us:

Obviously, when you put a train behind schedule or in danger, someone has to be held responsible. So there’s going to be a tug-of-war about apportioning blame. […] So while we try to do cross-analyses, there’s actually no real dialogue, everyone’s sticking to their own [job], even if you want to be open you still want to protect yourself. (Miguel, controller manager)

Communities clearly prefer to protect their members from possible individual or collective sanctions than to contribute to identifying safety failures. This means that they stop working together to improve safety.

Developments de-separating activity systems

In situations such as these, drivers and controllers try to develop ways of de-separating, designed less to make the separation between the activity systems obsolete than to make it viable. They consequently develop interpersonal trust and organize meetings between the communities.

The development of trust between subjects means that they must step back from the assurances that mistrust can offer. Admittedly, they can control each other by rigorously following tried-and-tested methods, but any control that they may exercise is limited and dependent in part on the disposition and competence of the other party. They are sometimes forced to trust each other despite the uncertainty and anonymity of their interaction. This is what emerges from the following group exchange:

– So you just have to trust the controller, even though you can’t see him. But you can tell from listening to him whether he is sure of himself, whether he knows what he’s talking about or not, if you see that he’s stuttering, you ask him to read it again. Normally you are not supposed to trust anything other than what is written down. (Léo)

– But you have to strike a balance between mistrust and trust. The last time I came back from holiday I was completely out of it and was maneuvering and then the [controller] said over the radio ‘you’re going a bit fast, aren’t you? …’. and I just had time to catch the sound of his voice … And the way he said it … I didn’t think, I just slammed on the brakes and then told myself that I had been right to trust him without thinking because I had nearly run into something. (René)

This extract shows that the development of interpersonal trust follows the deployment of precautionary strategies. These strategies aim to determine the reliability of the driving or controlling counterpart based on the balance between mistrust and trust. They can be based on an assessment of the familiarity or tone of voice heard over the radio, as is the case with René. They can also be based on a feeling of belonging to the same ‘railway community’, or an assessment of the risk incurred if a colleague is put at risk. These developments which de-separate subjects are generally restricted to one-off or frequently recurring interactions, but do not transform activity systems on a long-term basis.

Meetings between the driving and controlling communities are set up (at individual, collective and also managerial levels) to prevent community withdrawal. The aim is to render the worlds of driving and controlling more porous. These collective meetings can be held at the management level. Managers from the two communities can start to exchange ideas and even work on common issues together. In some cases, they then organize meetings between the drivers and controllers under their respective supervision. ‘The driver under observation explained that drivers can sometimes go to a traffic control station to observe and understand the other profession. But he added that it is harder for controllers to get into a driving cab, because they need training and authorization’ (Train-driving observation notes).

Some drivers get the opportunity to visit traffic control offices, although the reverse is more difficult to achieve in practice. These meetings can lead to particularly fruitful exchanges between drivers and controllers. They can see the reasoning behind the ‘half-asleep’ controller and ‘grumpy’ driver caricatures when they appreciate the actual conditions governing the activity of the other party. The communities grow closer together. These meetings involve changes to the way work is organized and can only take place with the agreement of management. However, in situations where they might hamper competition, they remain local, under the radar, not particularly institutionalized and very dependent on management say-so.

In light of these findings, we would argue that the negotiation of railway safety depends on the movements of articulation, alignment, and separation between rail traffic control and driving. Figure 8 summarizes these three movements with arrows to illustrate the reciprocal movements of each of the constituents of the activity systems when they negotiate safely together.

Figure 8. Movements of articulation, alignment, and separation between rail traffic control and driving.
Source: Own elaboration.

Discussion

Our findings allow us to make four theoretical arguments.

Setting in motion the negotiation of safety between activity systems

This article has attempted to make a contribution to the theorizing of the negotiation of safety between activities (Gherardi & Nicolini, 2002; Lorino, 2009; Owen, 2008; Tillement et al., 2009), by focusing on the movements that underpin it. We have argued that safety is negotiated through the movements of articulation, alignment, and separation between rail traffic control and driving. By describing these movements, we can achieve an ‘expansive visibilization’ (Engeström, 1999, p. 63) of the negotiation of safety, by showing how it unfolds in the inter-systemic space of the activities and over the period of their co-evolution.

More specifically, our findings detail what happens alongside the discursive practices identified by Gherardi and Nicolini (2002), by describing non-discursive practices between non-human constituents of activity systems. In this case study, the opportunities for discussion identified by Gherardi and Nicolini (2002) are rare and not encouraged to any extent. The way that movements are structured between activity systems seeks to minimize, mechanize, or even prevent verbal interaction between subjects. However, the developments implemented by our subjects to adjust these movements would appear to create further interactional opportunities both of an interpersonal and a verbal nature, designed to foster discussion between opposing mindsets.

This article also brings us back to the idea of the ‘chronotope’, defined as a social, spatial, and temporal configuration (Lorino, 2009). The negotiation of safety would appear to depend in part on the interpenetration of chronotopic factors specific to each joint activity (Lorino, 2009). We would argue that the movements of articulation, alignment, and separation take place via an ‘intermediary chronotope’ linking the joint chronotopes. By conceptualizing and describing this third-party chronotope, we are better able to analyze these movements.

Furthermore, our findings show how activities manage to bypass the contradictions identified by Owen (2008) in the negotiation of safety. Workers will re-articulate, realign, and de-separate from their activity systems to achieve safety.

Finally, we have sought to analyze the movement involved in negotiating safety between activity systems. This movement had been seen hitherto as ‘articulation work’ (Strauss, 1988) seeking to align and coordinate tasks between activities, which can be applied to practitioners, groups, and even systems (Tillement et al., 2009). Our findings allow us to identify three different types of negotiating movement depending on the nature of the shifts they effect between communities. Articulation is one such movement, not in its customary definition, but rather used specifically to refer to the linking of activity systems in such a way that their relative mobility is preserved. We have also shown attempts to delegate risk between activities (Tillement et al., 2009), and yet the symmetry between the relative powers of the activities in question would appear to make it easier for them to oppose this.

Setting in motion the cultural-historical activity theory

According to the cultural-historical activity theory, activity systems are in constant motion (Engeström, 2000; Engeström & Sannino, 2011) and this may be horizontal (between operational units) or vertical (between hierarchical levels) (Engeström & Sannino, 2011). Engeström (2006) has described three types of movement: that of the subject towards an expert community; that of several subjects around a problematic shared object; and that of several subjects belonging to loosely coupled activity systems around a unifying yet runaway object known as a ‘knot’. However, this theory is a work in progress and remains to be fleshed out further (Engeström, 2004). We have focused on the systematic movements that occur between two distinct, but tightly coupled, activity systems when they negotiate safety.

These movements take place ‘from one constituent to another’, between each activity system (e.g., between their respective subjects). Furthermore, each type of movement is specific to the constituents that it moves. Objects and artefacts are involved in an articulation movement, rules and divisions of labor in an alignment movement, and subjects in communities in a separation movement. This would appear consistent with the challenges faced by an organization responsible for high-risk activities. In such organizations, where activity systems are complex and tightly coupled, it is important to articulate joint work appropriately and fine tune its organization appropriately, while keeping its workers at a safe distance. These movements are bilateral and pulsating. They are reflected in to-and-fro movements of activity systems on either side of a median position, resulting in safe articulation, alignment, or separation. These pulsations are punctuated by the prior structuring of the movement, by its deviation as a result of contradictions, and by its reframing by practitioners. This reframing tends to reposition the movement in its initial trajectory, without reproducing it. The aim is to balance movement between activity systems to ensure the safety of joint work.

Setting in motion HRO principles between activity systems

In studies of HROs, great importance is attached to the principles of properly managing the inevitable tensions that arise between the operating rules laid down by the management and the working practices implemented by the workforce (Rochlin et al., 1987; Weick, 1987; Weick & Sutcliffe, 2007). However, this literature does not question the relevance of these principles to the tensions which equally inevitably emerge between the constituent activities of these organizations (Journé, 2017). Our article shows how the principles governing the negotiation of safety within HROs are supported by the movements of articulation, alignment, and separation, whenever this negotiation takes place between joint activity systems.

It would appear that the anchoring of decisions in operations and a unanimous commitment to resilience are principles associated with a movement to articulate activity systems. This ensures that in situations where there are different operating methods and challenges, the safety of one activity is not compromised to the detriment of another. The principle of analyzing problems in all their complexity requires an alignment movement that allows the intersystemic part of this analysis to be distributed between the activity systems. Finally, we have shown that the principles of deference to expertise and learning from mistakes and failures can potentially be undermined by mistrust between experts in different activities, and also by the tendency of communities to withdraw within activities and overlook some safety failures (Morrison & Milliken, 2000). In circumstances such as these, the collective vigilance supported by the proponents of HROs (Weick & Sutcliff, 2001) is likely to be targeted at individuals rather than at the risks they face. The negotiation of safety requires a movement of separation to re-establish a climate of trust and interaction.

Organizing movement between activity systems negotiating safety

In the organization that we studied, difficulties in negotiating safety between activity systems coincided with a relative rarity of interactivity management systems, underscoring the pressing need for systems of this nature. The negotiation of safety between driving and controlling is covered by discussions and simulations in training, but these remain confined to driver-only or controller-only groups. Discussions over difficulties in negotiating safety between drivers and controllers consequently take place among workers who share the same mindset. Thus, cross-training would appear to be an obvious solution providing that the dispersed nature of controlling and the itinerant nature of driving did not make this type of training excessively complex or costly for both sides. As a follow-up to this study, we helped design and distribute an interprofessional simulator. It uses virtual reality to enable a driver and a controller to co-manage a risk situation remotely. They wear virtual reality headsets and are immersed in an interactive representation of their work environment and can swap roles to put themselves in their counterpart’s shoes (Figure 9).

Figure 9. Photographs of the inter-trade simulator, trainees during a debriefing, view of a virtual reality driving cab, view of a traffic control center in virtual reality (from left to right).
Source: Oriane Sitte De Longueval (2020).

The value of this tool appears to us to lie mainly in the opportunity it offers for discussion between drivers and controllers during the debriefing. This allows them to compare the nature and constraints of each activity and to work together to find future ways of negotiating safety better. In light of this, we would advocate the design of a new approach to safety negotiation between activity systems in high-risk industries (Journé & Stimec, 2015). We would recommend, for this purpose, the interventionist Change Laboratory methodology (Engeström et al., 1996). It seeks to facilitate intensive and far-reaching changes to activity systems with a view to gradually and continuously improving their interaction. The idea is to create a dialogue between activities, as part of a collaboration between researchers and practitioners through holding regular workshops. These can allow the different players to jointly analyze contradictory everyday situations together and to co-construct new ways of organizing joint activities. This approach would help players understand each other better while drawing a veil over those parts of their work that they might not wish to reveal (Owen, 2008) (unlike ‘walk in my shoes’ activities which are likely to lead to incursions into the other’s room for maneuver to the detriment of safety). It would also allow managers to support dialogue between activities (Lorino, 2009).

Conclusions

Our article shows how the negotiation of safety within HROs is underpinned by intersystemic and pulsating movements of articulation, alignment and separation. This could prove illuminating for other activity systems that are both complex and tightly coupled. This would be the case of activities that interact in the transport sector (e.g., between airplane pilots and air traffic controllers), the medical sector (e.g., between doctors and nurses), the energy sector (e.g., between operators using and maintaining nuclear power plants), and the construction sector (e.g., between the design and manufacture of buildings).

Future, larger scale, research could investigate multiple interactions within more than two activity systems internal or external to the organization. It could also allow us to explore further the retroactive way in which workers’ developments are fed into the organization of activity systems over time. It would also be interesting to assess the impact of local risk-taking between activity systems and not rely solely on the workers’ points of view. Finally, action research could be used to develop ad hoc tools to support the negotiation of safety between joint activity systems.

Acknowledgments

The authors thank the editor and the anonymous reviewers for their sound and accurate advice, which has greatly improved the final manuscript. They also thank all the invaluable reviewers of this article for their active support and precious assistance throughout this research. Finally, they extend their thanks to the company featured in this case study for having initiated, hosted, and partly financed the research work underpinning this study and to all their participants for their time, trust, and assistance.

References

Cambon-Bessières, L. & De Terssac, G. (2009). Savoir évaluer la situation pour doser l’action dans les prisons. In G. De Terssac, I. Boissières & I. Gaillard (Eds.), La sécurité en action (pp. 133–144). Octarès.

De Terssac, G. & Mignard, J. (2011). Les paradoxes de la sécurité. Le cas d’AZF. Presses universitaires de France.

Engeström, Y. (1987). Learning by expanding: An activity-theoretical approach to developmental research. Orienta-Konsultit.

Engeström, Y. (1995). Objects, contradictions and collaboration in medical cognition: An activity-theoretical perspective. Artificial Intelligence in Medicine, 7(5), 395–412. doi: 10.1016/0933-3657(95)00012-U

Engeström, Y. (1999). Expansive visibilization of work: An activity-theoretical perspective. Computer Supported Cooperative Work, 8(1), 63–93. doi: 10.1023/A:1008648532192

Engeström, Y. (2000). Activity theory and the social construction of knowledge: A story of four umpires. Organization, 7(2), 301–310. doi: 10.1177/135050840072006

Engeström, Y. (2001). Expansive learning at work: Toward an activity theoretical reconceptualization. Journal of Education and Work, 14(1), 133–156. doi: 10.1080/13639080020028747

Engeström, Y. (2004). New forms of learning in co-configuration work. Journal of Workplace Learning, 16(1–2), 11–21. doi: 10.1108/13665620410521477

Engeström, Y. (2006). Development, movement and agency: Breaking away into mycorrhizae activities. In K. Yamazumi (Ed.), Building activity theory in practice: Toward the next generation (pp. 1–43). Kansai University.

Engeström, Y. (2008). Quand le centre se dérobe: la notion de knotworking et ses promesses. Sociologie du travail, 50(3), 303–330. doi: 10.4000/sdt.19398

Engeström, Y. (2009). The future of activity theory: A rough draft. In A. Sannino, H. Daniels & K. D. Gutiérrez (Eds.), Learning and expanding with activity theory (pp. 303–328). Cambridge University Press.

Engeström, Y. (2011). Théorie de l’activité et management. Management & Avenir, 2(42), 170–182. doi: 10.3917/mav.042.0170

Engeström, Y. (2015). Learning by expanding: An activity-theoretical approach to developmental research (2nd ed.). Cambridge University Press.

Engeström, Y., Pihlaja, J., Helle, M., Virkkunen, J. et al. (1996). The change laboratory as a tool for transforming work. Lifelong Learning in Europe, 1(2), 10–17.

Engeström, Y. & Sannino, A. (2011). Discursive manifestations of contradictions in organizational change efforts: A methodological framework. Journal of Organizational Change Management, 24(3), 368–387. doi: 10.1108/09534811111132758

Gherardi, S. & Nicolini, D. (2002). Learning in a constellation of interconnected practices: Canon or dissonance? Journal of Management Studies, 39(4), 419–436. doi: 10.1111/1467-6486.t01-1-00298

Gilbert, P., Raulet-Croset, N., Mourey, D. & Triomphe, C. (2013). Pour une contribution de la théorie de l’activité au changement organisationnel. @GRH, 2(7), 67–88. doi: 10.3917/grh.132.0067

Grusenmeyer, C. (2009). Interactions maintenance-exploitation et sécurité – La gestion de l’information relative aux interventions de maintenance lors d’un arrêt programmé sur une chaufferie nucléaire. In G. De Terssac, I. Boissières & I. Gaillard (Eds.), La sécurité en action (pp. 85–101). Octarès.

Hollnagel, E. (2014). Resilience engineering and the built environment. Building Research & Information, 42(2), 221–228. doi: 10.1080/09613218.2014.862607

Journé, B. (2017). Le modèle de la haute fiabilité et ses implications managériales. In P. Chaumette (Ed.), Challenge économique et maîtrise des nouveaux risques maritimes. Quelle croissance bleue ? (pp. 363–374). Gomylex.

Journé, B. & Stimec, A. (2015). Négociation et sûreté. Un état de l’art. Les cahiers de la sécurité industrielle, 2015(3). Retrieved from https://www.foncsi.org/fr/publications/cahiers-securite-industrielle/negociation-surete-etat-art

Langley, A. (1999). Strategies for theorizing from process data. Academy of Management Review, 24(4), 691–710. doi: 10.2307/259349

Licoppe, C. (2008). Dans le «carré de l’activité»: perspectives internationales sur le travail et l’activité. Sociologie du travail, 50(3), 287–302. doi: 10.1016/j.soctra.2008.06.002

Lorino, P. (2009). Concevoir l’activité collective conjointe: l’enquête dialogique. Étude de cas sur la sécurité dans l’industrie du bâtiment. Activités, 6(1), 87–110. doi: 10.4000/activites.2154

Morrison, E. W. & Milliken, F. J. (2000). Organizational silence: A barrier to change and development in a pluralistic world. Academy of Management Review, 25(4), 706–725. doi: 10.2307/259200

Owen, C. (2008). Analysing joint work between activity systems. Activités, 5(2), 52–69. doi: 10.4000/activites.2040

Owen, C., Bearman, C., Brooks, B., Chapman, J. et al. (2013). Developing a research framework for complex multi–team coordination in emergency management. International Journal of Emergency Management, 9(1), 1–17. doi: 10.1504/IJEM.2013.054098

Rochlin, G. I. (1993). Essential friction: Error-control in organizational behavior. In N. Åkerman (Ed.), The necessity of friction (pp. 196–232). Physica-Verlag. doi: 10.1007/978-3-642-95905-9_11

Rochlin, G. I., La Porte, T. R. & Roberts, K. H. (1987). The self-designing high-reliability organization: Aircraft carrier flight operations at sea. Naval War College Review, 40(4), 76–92.

Strauss, A. (1978). Negotiations: Varieties, contexts, processes, and social order. Jossey-Bass.

Strauss, A. (1988). The articulation of project work: An organizational process. Sociological Quarterly, 29(2), 163–178. doi: 10.1111/j.1533-8525.1988.tb01249.x

Tillement, S., Cholez, C. & Reverdy, T. (2009). Assessing organizational resilience: An interactionist approach. M@n@gement, 12(4), 230–264. doi: 10.3917/mana.124.0230

Vaughan, D. (1996). The challenger launch decision: Risky technology, culture, and deviance at NASA. University of Chicago Press.

Weick, K. E. (1987). Organizational culture as a source of high reliability. California Management Review, 29(2), 112–127. doi: 10.2307/41165243

Weick, K. E. & Sutcliffe, K. M. (2001). Managing the unexpected: Assuring high performance in an age of complexity. Jossey-Bass.

Weick, K. E. & Sutcliffe, K. M. (2007). Managing the unexpected: Resilient performance in and age of uncertainty. Jossey-Bass.

Ybema, S., Yanow, D., Wels, H. & Kamsteeg, F. H. (Eds.). (2009). Organizational ethnography: Studying the complexities of everyday life. Sage. doi: 10.4135/9781446278925

Appendices

Appendix A. Details of the interviews carried out for the study

	Last name	Participant’s job	Job experience (years)	Duration
Exploratory interviews	G1	Group interview with drivers	No information	1 h. 38 min.
	G2	Group interview with 4 drivers	No information	1 h. 37 min.
Driving interviews	C1	Driver	26	59 min.
	C2	Local driving manager	25	4 h. 14 min.
	C3	Former driving center manager	6	45 min.
	C4	Former local driving manager	20	2 h. 21 min.
Traffic control interviews	CA	Local traffic control manager	18	2 h. 2 min.
	CB	Traffic control business unit manager	11	1 h. 14 min.
	CC	Local traffic control manager	5	1 h. 45 min.
Source: Own elaboration.

Appendix B. Details of the observations carried out for the study

	Last names	Activities observed	Individuals observed	Duration
Presence in the General Security Directorate	GSDO	Day-to-day life of the company’s safety department	Senior executives, cross-functional staff, safety experts	20 months
Driving observations	DO1	Driving a train in the cab	1 agent, 1 local manager	2 h. 15 min.
	DO2	Training of drivers by their local supervisor	4 agents, 1 local manager	5 h.
	DO3	Training of driving agents by their local supervisor	4 agents, 1 local manager	5 h.
	DO4	Simulated driving as part of a training course on a driving simulator	4 agents, 2 trainers, 1 local manager	3 h.
Controlling observations	COA	Management of controlling in traffic control center	5 controlling agents, 1 business unit director	40 min.
	COB	Management of controlling in traffic control center	5 controlling agents	5 h.
	COC	Management of controlling in traffic control center	5 controlling agents	4 h.
	COD	Management of controlling in traffic control center	5 controlling agents	4 h.
Source: Own elaboration.

Appendix C. Grid of codes used in data analysis

	Structures of A/B activity systems	Contradictory situations disrupting work	Developments of systems by practitioners
A/B objects	Structuring the complementary nature of A/B objects	Productive risk-taking between objects	Developing secure agreements around the common A/B object	Articulation movement between A/B activity systems
A/B mediating artefacts	Structuring interoperability between A/B mediating artefacts	Failure of or breakdown in interoperability between A/B mediating artefacts	Developments of A/B mediating artefacts
A/B divisions of labor	Structuring the coincidence of roles in A/B divisions of labor	Role conflict in A/B divisions of labor	Helping hand developments	Alignment movement between A/B activity systems
A/B rules	Structuring coincidence between A/B rules	Non-applicability of A/B rules	Special rights in A/B rules
A/B subjects	Structuring of interpersonal mistrust between A/B subjects	Interpersonal conflict between A/B subjects	Development of interpersonal trust between A/B subjects	Separation movement between A/B activity systems
A/B communities	Structuring separation among A/B communities	Community withdrawal among A/B communities	Developing meetings between A/B communities
Note:	First-order theoretical codes	Second-order theoretical codes	Third-order theoretical codes
Source: Own elaboration.

Footnotes

^1. While Engeström conceptualizes activity in terms of systems, it is difficult to find any precise or concise definition of these systems in his work. Our definition is based on his work.

^2. According to Engeström and Sannino (2011), the systemic contradictions at the root of these work disruptions are not easy to identify through empirical surveys, because they occur on a large scale and over a long period of time. It is easier to find evidence of them in case studies. Engeström (2008), for example, explores these contradictions through discursive disruptions that he observes in television work.

^3. We take the terms object, mediating artefact, division of labor, subject and community from Engeström’s activity theory, as we do the notions of organization, contradiction and development. These terms have been described in the review of the literature.

^4. The mistrust of other people here comes from confidence in tried-and-tested methods of analysis and action in driving and traffic controlling.