104 Joint Cognitive Systems
system, the frequency of use, the ease of use, etc. After the disruption from a
change, the system will eventually reach a new equilibrium, which however
may differ somewhat from the former. It is important to take this transition
into account, and to be able to anticipate it. Specifically, if only one part of
the system is changed (e.g., the direct functions associated to the artefact) but
not others, such as the procedures, rules or the conditions for exceptions, then
the transition will create problems since the system in a sense is not ready for
the changed conditions.
Specifically, the manifestations of failures – or failure modes – will
change. The failure modes are the systematic ways in which incorrect
functions or events manifest themselves, such as the time delays in a
response. New failure modes may also occur, although new failure types are
rare. An example is when air traffic management changes from the use of
paper flight strips to electronic flight strips. With paper flight strips one strip
may get lost, or the order (sequence) of several may inadvertently be
changed. With electronic strips, i.e., the flight strips represented on a
computer screen rather than on paper, either failure mode becomes
impossible. On the other hand, all the strips may become lost at the same
time due to a software glitch, or it may be more difficult to keep track of
them.
Finally, since the structure of the system changes, so will the failure
pathways, i.e., the ways in which unwanted combinations of influences can
occur. Failures are, according to the contemporary view, not the direct
consequence of causes as assumed by the sequential accident model, but
rather the outcome of coincidences that result from the natural variability of
human and system performance (Hollnagel, 2004). If failures are seen as the
consequence of haphazard combinations of conditions and events, it follows
that any change to a system will lead to possible new coincidences.
Traffic Safety
An excellent example of how the substitution principle fails can be found in
the domain of traffic safety. Simply put, the assumption is that traffic safety
can be improved by providing cars with better brakes. The argument is
probably that if the braking capability of a vehicle is improved, and if the
drivers continue to drive as before, then there will be fewer collisions, hence
increased safety. The false assumption is, of course, that the drivers will
continue as before. The fact of the matter is that drivers will notice the
change and that this will affect their way of driving, specifically that they will
feel safer and therefore driver faster or with less separation to the car in front.
This issue has been debated in relation to the introduction of ABS
systems (anti-blocking brakes), and has been explained or expounded in
terms of risk homeostasis (e.g., Wilde, 1982). It is, however, interesting to