On Safety Management Devices: Injunction and Order Use in Emergency Situation

This paper aims to introduce two main concepts regarding safety management which are injunction and order. In a ﬁ rst section, those two kinds of communication for action will be de ﬁ ned and distinguished through responsibility repartition criterion. Indeed, while injunction device involves addressee ’ s com-mitment regarding action design, order device is a less complex one in which a speci ﬁ c authority is responsible of order content in a speci ﬁ c frame while the addressee is generally only responsible of the order content execution. To illustrate those concepts potential, injunction and order contribution to face an emergency situation will be demonstrated through local ﬁ eld management and Headquarter relationship analysis during a crisis exercise of major magnitude in a nuclear fuel cycle industry. As a general conclusion regarding safety management, one would note that injunction use ensures decision-making robustness by subjectivity mobilization, as challenging voices multiplication participates to solid evidence emergence thanks to cross-checking practices. Secondly, the speci ﬁ c result of this demonstration remembers one of the Fukushima-Daiichi management lessons, meaning that in a resilient system, Headquarter tends to communicate with Local Management Team through injunction.


Introduction
According to CREAM methodology developed by Hollnagel [1], Human Reliability (HR) depends on three factors: human, technology and organization [2]. As this knowledge can possibly contribute to develop resilient systems, management devices use to overcome unexpected situations seems to be a relevant research topic to deepen. As Blau noticed, two kind of communication management can address to the people managed, depending on their "independence in the performance of [their] duty" [3] and impacting responsibility distribution. Those two kinds of communication are management devices that we would call order and injunction. Both of them are used by an authority demanding something from someone but with a different approach toward responsibility (which can imply notions such as liability or duty).
This contribution defines those two safety management devices called injunction and order and demonstrate their contribution to system recovery in an emergency situation. This "ongoing crisis in which conventional resources are lacking, but societal expectations are high" [4] was a particularly interesting case as explicitation processes and time acceleration effect emphasize how nuclear organizations deal with those issues.

What Is Injunction?
Injunction is a communication triggering action as the addressee should adapt his behavior regarding its message (conformity). This communication comes from an authority and is both binding and relying on its addressee subjectivity [5]; as the addressee is linked to the expected action or to its aim regarding responsibility criterion. Fundamentally, injunction implies a tension between what comes from oneself (autonomy) and what is implemented by external sources (heteronomy) [6]. This phenomenon affects one's identity as no one can predict how far a subject will integrate external things to his subjectivity [7] and experience.
By saying so, one would conclude right by stating that safety injunction is not always or completely defined in time, space and form as shown by its legal evolutions from British Equity system to its 19th to early 20th variations in the United States of America (Stewart 1895; Gregory 1898; Mc Murry 1961) cristalized in the Pullman strikes repression through the Omnibus Indictment, and to its actual uses demonstrating that the term 'injunction' has no fixed definition but is determined by its practice (Preston 2012, p. 5). That is why, prevention posters from Oak Ridge Laboratory dating from the Manhattan Project times are still quite relevant for any worker exposed to radiation sources, even though some military elements might have lost some sense since [8].
What is also interesting about injunction as a management device is that there is a wider array of potential issuers than in the order case. So far, three kinds of authorities have been identified as relevant to make an injunction.
The first authority observed is derived from the recognized power one has to direct someone else, such as in hierarchy case. This typical authority has been widely analyzed since management studies beginning, particularly with Henri Fayol description of administrative skills use [9].
The second authority defined comes from the legitimacy inherited from ones' function, in Weber sense [10]. So, experienced workers, specialists, inspectorate and auditors can also make injunctions. We chose here not to use the word "expert" as Blau showed that training purpose in organizations was mainly to make people experts in their respective domains; as we wanted to insist on the role idea which goes beyond knowledge.
The third authority observed results from a commitment. In this configuration, issuer and addressee are parts of the same community of interest and share an aim. That is why the issuer is legitimate to make an injunction and the addressee has to fulfill his duty as a group member. As one can guess, this is why safety culture development is encouraged in nuclear firms.
Finally, observing nuclear industry fieldwork shows that safety injunction use often implies an interesting labor division. Indeed, the issuer; or transmitter regarding its human or non-human status [11]; fixes goals that the addressee has to reach by defining himself means such as structures, equipment, workforce, and so on. So, safety injunction strength and weakness is its capability to rely on its addressee's experience by giving him some latitude to obtain a better individual contribution to safety. However, as nuclear industry also needs precision in several quality aspects, order as a management device can also be very helpful.

What Is Order?
Order is a time and space framed, oral or written binding communication, coming from an authority detaining a recognized power of direction over the addressee, to which the addressee must obey. In most of the cases, this authority is responsible of the given order result. Obedience and disobedience are not related to the autonomy-heteronomy tension derived from conformism but is a matter of dependence and independence balance. As a matter of fact, obedience in the kind of relationship previously described does not impact the addressee identity in the same way as injunction.
Indeed, as there are objective things showing the addressee's dependence and as the action expected is, apparently, not related to his own willingness, the subject is generally not easily questionable for his acts. As The Grapes of Wrath novel shows [12], when an expropriated farmer asked for who he should shoot to avenge his loss, the answer done by the mended man is that he is just following the owner orders who is just following the bank orders; and so on until the causal chain vanishes in the unknown, making the farmer's quest for a convener absurd.
Furthermore, orders are often combined with injunctions. Even in organizations when orders through short communications were openly favored such as in jail or in Christian schools during XVIIIth and XIXth centuries, Michel Foucault demonstrated the existence of another purpose than getting obeyed quickly.
What was at stake was to place bodies in a little world of signals to which an only and mandatory answer is attached. So, a daily-life order can also be combined with an injunction shaping prisoners and pupils' behavior, training them to react in the exact sense defined [13]. In this case, their individual contribution to performance tends to zero.
As subjects can be both commanded (when management makes them do something using order device) and governed (which means that management guides their actions and consequently modify their behavior by injunction device use) depending on management device choice, and because power relations are generally numerous and of various kinds [14], distinguishing how one is put under pressure and to what extend regarding his responsibility can be quite necessary to face all the expectations one is addressed in a particularly sensitive moment such as facing an emergency situation.

Crisis Organization Context
In September 2014, a nuclear industry organized a major crisis exercise of 36 h that we will not try to analyze as such. Our demonstration will only focus on something out of all simulation aspects: the relationship between local and national level to manage an emergency situation. Crisis mode is a simplified organization designed to save time. What should be remembered about this design is that: • Local Emergency Management Team is responsible of field response to the crisis; • While its national hierarchy (Headquarter) informs stakeholders and takes specific decisions like internal intervention force deployment; • As this intervention force is composed of various specialists from other entities with no previous hierarchical link with Local Management Team but who will be placed under its command during field intervention.
As we explained earlier, an authority derived from the recognized power one has to direct someone else can possibly use injunction and order management devices. As time is lacking and precision necessary to get out of the crisis situation, one could have imagined that order would have been the main device used by Headquarter to lead the Local Management Team.
However, our observations note a different result which might clarify one of Fukushima-Daiichi management lesson regarding Yoshida and Prime Minister's coordination unit [15]: injunction can be used to handle uncertainty while order contributes to accelerate the recovery process.

Recovering with Injunction and Order Use
On the first day, a simulated tornado damaged the nuclear fuel cycle platform in the early afternoon. As no one knew exactly what were the consequences of such natural disaster on the plant, all actors tried to face the crisis in the best way they could think of. In this sense Becker's vision of enactment phenomenon, that is to say ways people find to cooperate for the moment to get to the next step in a specific occasion [16], began to appear.
During the mid-afternoon turn-over preparation conference call between Local Management Team and Headquarter, five issues were highlighted (in no preference order): • Human assessment; • Safety assessment; • Production recovery conditions; • International Nuclear Event Scale (INES) classification of the event; • Plant workers evacuation.
As injunction use showed regarding the last point ("This needs to be addressed"); Local Management Team was clearly expected by Headquarter to solve those problems, though Headquarter also ordered "not to waste time" on INES classification.
On the field, as Local Team handles operational responsibility towards crisis management for legal and practical reasons, decision was made to prior human and safety assessment. So, rounds and competencies checking were organized to gather information on damages, assess risks and take back control on source terms. Workers evacuation was done during the night when Plant Management was sure no one would be carelessly exposed to danger.
On the second day, as reliable data were gathered, valuable technical solutions were found such as sprinkling devices and robot use to deal with the most risky situations. When it appeared that the intervention force would be sent in a relatively controlled environment, the Headquarter finally ordered to allocate the internal intervention force to spread uranium powder extraction, a relatively known action. As a consequence, the crisis exercise finished in the expected time and with no human loss due to National or Local effort for system recovery; which might not have been the case if previous decision had been confirmed to send the force right after the tornado instead of triggering its early warning mode for field checking support.

Results
First, injunction effectiveness to system recovery in national and local level management relationship has been demonstrated in several ways.
Injunction use contributed to data collect organization as the National level trusted Local Management Team ability to gather adequate means because of geographic position and responsibility repartition. But injunction use also contributed to recruit individual contribution to solution design such as sending a robot to a damaged building to prevent criticity peak consequences on intervention forces.
As a consequence, injunction reduced uncertainty and contributed to an effective internal force deployment through order. So this second management device could help, for its part, to solve the crisis in a clean-cut way.
Second, Headquarter injunction use in its relationship with local management allowed priority fixing, innovative choices but also, to a certain extent, contributed to limit errors due to omission or deny, as even the terrorism hypothesis has been considered. To put it in a nutshell, injunction contributed to an exhaustive situation assessment by cross-checking practices without penalizing field action.

Discussion
Choosing wisely between order and injunction management devices during the crisis participates in effective system recovery.
If resilience is a characteristic of a system with elastic behavior which can face disturbances [17]; that is to say a system able to partly absorb human experience through contextualization without rejecting all systemic aspects; knowing more about safety injunction reception could be an important step in for organizations dealing with high risks design.
But how could one understand that, in the one hand, injunction nature implies some result uncertainty because of the addressee regarding reliability criterion and, in the other hand that this device also effectively contributed to safety thanks to this same addressee?
Regarding management, qualifying devices, understanding their logics such as in order and injunction case might lead us beyond finding sole conditions of use.
Injunction use could be an empirical proof that systems are not only meant to be designed according to models [18], and in our case quite causal and narrow ones if we refer to Nancy Leveson and al. analysis: "this confusion of component reliability with system safety leads to a focus on redundancy as a way to enhance reliability, without considering other ways to enhance safety" [19].
But crossing an organizational approach with Professor Kyoko Sato's present book contribution regarding imaginaries referring to Castoriadis philosophy could also be adapted to complete our complex system understanding, as imaginaries are fundamentally out of modelling approaches but intertwined with their works: "reality and rationality" [20].
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.