Editor | On 18, Jan 2004

Abstract:
Taking into account of safety on both design and exploitation levels highlights management contradictions comprising technical, economic or human aspects. For example the choice of powerful but expensive technical solution on design level, could has an immediate benefit and/or potential risk on exploitation level. These contradictions are generally solved by compromises. TRIZ is a Method proposing various resolution principles to eliminate contradictions related to the technical and recently organizational problems. Basing on these principles, on the analysis of safety standards and terrain surveys, we structure various solutions allowing to assist the designer in his task and to take into account safety as soon as possible. That will be done by showing the applicability of the TRIZ principles on contradictions related to safety integration in design process. A point of correspondence will be considered between safety standards, our model utilization and the contradictions resolution by TRIZ. The objective of this communication is to propose elements to pilot the emergence of new solutions concerning the resolution of contradictions related to the safety integration by using our “Working situation” model [Hasan & al 2002a; Hasan 2002] . This model has been implanted in an ACCESS database. It will be presented below. Keywords: TRIZ, Contradictions, Design process, “Working Situation” model, Safety.

1. Introduction
Generally, designers consider safety as a constraint. But, the fact that design of equipment and machines can no longer be separated from the concept of human safety has led to the definition of criteria that are linked to the equipment’s exploitation that must be taken into account during their design [Hasan & al 2000a] . The answers brought by the standards and rules seem incomplete as for effective control of risks [Didelot & al 2000] for systems in permanent evolution. Nevertheless, the fact that safety is related to an additional cost can evolve if one uses effective methods allowing surmounting the contradiction productivity/safety, in particular, by consideration as soon as possible of these constraints. So a contradiction, which corresponds to opposing requirements (cost, immediate gains, potential risk) that the designer should face, appears. Production systems design was always struck up under the technical angle through a techno-centered engineering. In this case, system is the subject and the object of technical task. Our objective is to take into account the socio-technical tasks. In this case, the subject of task is the user and its object is the system. The current integration of safety [Fadier & al 1998] is made by passing from a socio-technical task to a technical task, for example, motorize task or/and automate system (Figure 1).

Literature review, concerning the consideration of operator’s safety in production system design, shows that one can group together the works in two grand classes. These two classes belong to ergonomics. The first concerns the design improvement from ergonomic viewpoint in its first sense; the designer adopts an anthropo-centered approach. It tries to realize a system adapted to the man so to relieve physical or cognitive workload [Karwowski & al 1998] . The second class concerns the infringement risks on person’s health and physical integrity. The safety measures, which are deduced from this class, often, increase workload or procedures weigh down of system exploitation. The works carry essentially on methods of workplace analysis and diagnosis and lead more rarely to propose some solutions.

The late integration of safety causes contradictions emergence. For example, designer have to add protection means to satisfy safety requirements in a minimal cost and by limiting their complexity. On the other hand, these protection means can decrease the freedom of operator action by limiting the necessary space during the realization of its work. The disciplinary variety of intervener and associated viewpoints can create also several contradictions: at organizational levels, performances, costs, trade. During technical selection of solution, the designer should know and identify the risks susceptible to be engendered by the chosen solutions and the possible alternatives or compromises, if they exist.

2. Original “Working Situation” model
The proposed model is a database model. It allows taking into account information and elements related to the situation in which the system is going to be exploited. First version of this model in entity-relation formalism is published in [Hasan & al 2003a] . Besides, this model constitutes a base to register process history and all modifications brought to system during its design. Finally, it allows the re-use of the capitalized information for later design. Figure 2 and 3 present the concepts considered in “Working Situation” model [Hasan 2002] in UML class design [Booch and al 2000] . For a simple problem of presentation fluidity, we did not represent the relations between the concepts “Parameter” and “Description” and the other concepts, because all the classes of the model have relations with these two concepts. Production system is an organized set of devices implemented together to create goods or insure some services. This system, when it works at user’s site, defines a working situation.

It needs one or several human operators, to supervise, control it or to realize other precise tasks. This system can consist of several components, which in turn can consist of several subcomponents. These components are based on technical solutions, which can engender Dangerous phenomenon (Hazard). This concept characterizes any cause able to provoke injury or damaging to health of the operator or even a third party entering the working situation zone. 3 The realization of tasks is done by the System or by the Working team. If this realization is done in a danger zone, then a risk for the operator can be provoked. Risk is a combination of probability and the degree of the possible injury or damage to health in a hazardous situation. This situation contains danger zones, which are presented by the concept “Danger Zone”. This concept defines any zone inside and\or around a system in which a person is exposed to a risk of hurt or injury or damaging the health of the operator. This concept defines the potential risk on the operator (destruction, cut, etc.).

The residual risk resulting from the intervention of a working team in the danger zone requires some safety measures. This concept represents the means to be implemented in the system (means of protection as barriers, guards, etc.) or in the working situation (individual complementary prevention measures as corks of ears, glasses, etc.) to avoid the exhibition of operator in hazard.

In [Bernard & al 2002a] different implementation scenarios highlighted the basic principles of how to use our approach, in a real industrial project concerning a printing line system. In [Bernard & al 2002b] the method is illustrated by the results of an experiment carried out in the design department of an industrial partner, which is a leader in offset printing line design. We illustrated the interest and aptness of this model by including the integration process of operator’s safety and the feedback from use site. A software demonstrator implanted on ACCESS concreted this model. The dynamic use of this software demonstrator facilitates the communication among various project actors to avoid expensive later modifications. These modifications require a search for means (methods, tools, etc.) to resolve contradictions as safety-productivity.

3. Theory of Inventive Problem Solving (TIPS) or TRIZ

Here, we briefly, present the method TRIZ. It is a Russian acronym of ” Theory of Inventive Problem Solving”, which allows to guide the designer in a systematic approach to find the solutions of envisaged problems, in particular, in design and innovation of products. TRIZ does not give the solutions but proposes rather tracks to look for them (Figure 4). It is based on five notions, which are: Ideal Final Result, Psychological Inertia, Inventive Levels, Evolution laws and eliminating contradictions. One of those tools [Royzen 1993] is the laws of engineering system evolution among which we find a law towards removing a human from taking part in performance and control of an engineering system.

TRIZ is based on a basic idea to be able to generate several leads for development of a new generation product or process. It has different tools to formalize the problems and allow to resolve them, as the modeling with miniature dwarfs, DTC (Dimension, Time, Cost) operator 5 and Multi-screen diagram [Savransky 1999a] . Furthermore, It has other tools to resolve the problems formalized as the Algorithm for Inventive Problem Solving (ARIZ) [Marconi 1998] , the 76 Standard solutions [Terninko & al 2000] , the substance-field analysis [Terninko 2000] , the contradictions matrix and the Separation Principles [Cavalucci 1999] . Normally, TRIZ’s main applications are limited to the resolution of technological problems, identification of research scenarios and optimal development of system and, finally, in Failure Mode & Effects Analysis. At present, the tendency is to apply TRIZ for non-technique problems (education, medicine, biology, etc.) [Zlotin & al 2001] and for production management [Bertolucci 2001] . On the market there exist computer innovation tools based on TRIZ [Techoptimizer] and [Ideationtriz] .

3.1. TRIZ a method for creative design
In the literature, the method TRIZ was estimated, applied and compared with the creative design methods [Parveen & al 1998] ,. Cavallucci [Cavallucci 1999] positions TRIZ with regard to other methods used in design allowing to express needs or to analyze solutions. Zusman compared and classified hundreds of methods and creative techniques of resolution according to seven criteria: Conditioning/motivating/organizing techniques; Innovation knowledge-based techniques; Systems ; Focusing techniques ; Pointed techniques ; Evolutionary directed techniques ; Randomization. The last one is the only criteria whom TRIZ does not answer [Zusman & al 1999; Gogu 1999] . These works often handled problems of technical innovation and they were object of numerous industrial applications [Trizjournal] . Concerning operator safety, Marsot [Marsot 2001] showed that the method TRIZ could be an integration vector of the requirements of risks reduction by design of working equipments.

3.2. TRIZ a method for contradictions resolution
Savransky presented the origin and the types of the concept “contradiction” and proposed a typology of various contradictions [Savransky 1998, Savransky 1999b] . TRIZ identifies two types of contradictions: physical and technical. * The physical contradiction is the direct opposition of two values for a parameter formulated by the same system, for example, a roller should turn in big speed to ensure the production and slow speed to ensure its cleaning in safety conditions. * The technical contradiction is a situation in which the improvement of a parameter A leads to the deterioration of a parameter B, for example, adding a material safeguarding to increase the safety decreases the accessibility. * There are also in the exploitation of production systems the organizational contradictions. They are situations in which the improvement of a procedure increases workload or system complexity. For example, the application of blanket cleaning procedure required by designer needs stopping the system and a new setting up, and so, it increases operator workload. We notice that to resolve these contradictions we falls again on physical or technical contradictions. TRIZ proposes a systematic and exhaustive method by:
– using the contradiction matrix to resolve problems of technical contradictions [Matrix 1997; Royzen 1997] ,
-the separation principles (in time, space and phase) and the change towards a super
-system or a sub-system to resolve problems of physical contradictions.

These physical contradictions are normally of technological nature related to system but physical contradictions of organizational nature were recently handled by [Hipple on 1999] . 6 In our research works, we were interested especially in contradiction matrix to show the possibility of using TRIZ’s methodology to resolve the contradictions related to operator safety.

3.3. Contradiction Matrix
Altshuller [Domb 1998; Matrix 1997] , creator of TRIZ, identified 39 Features (table 1) synthesizing the factors allowing modeling the technical contradictions.

Contradiction matrix represents the interaction between these features. The Inventive Principles (Altshuller gives 40 presented in [William 1998] ) are supplied to raising these contradictions [Royzen 1997; William 1998; Cavallucci & al 1998; Gogu 1999] . lines represent the features to be damaged and columns the features to be improved. The designer inventiveness appears in the interpretation of this generic principle for his particular problem. [Domb 1998; Matrix 1997] . Also, Marsot [Marsot 2001] presented the way of using this matrix for safety problems. This matrix is not stable and there are more versions that decline more features and Inventive Principles [Savransky 1996] .

4. Contradictions and the concepts of the model
The analysis of our model shows its interest to create various contradictions (physical, technical, organizational). These analysis were done pendant the software denostrator implantation to help designer to solve the contradictions. We are going to clarify this by analyzing the concepts of our model [Hasan & al 2001c] :

* Function: development of a new function in a system or an improvement of an element of this one is forced by the other existing elements defined by the global objective of system functioning and by its cost.
* Technical solution: separation in the time or in the space generally resolved by the designer by compromises (physical contradiction). * System: technical contradiction because of the systematization of two or several contradictory technical solutions (resize the solutions and reassemble differently the components).
* Task and its attributes (duration, sequence and composition) lead to an organizational contradiction which becomes technical or physical according to the case (separation in time or space), but sometimes cause an increase of the workload (harmful function) and improve the safety (useful function).
* Auxiliary (Tool and Consumable): necessity to use an auxiliary (useful function) but this auxiliary can cause a risk (harmful function).
* Danger Zone: the sizing and composition of danger zones play a fundamental role in the “Risk reduction by design” during the systematization of these zones [Hasan 2002] .
* Safety measures: if these measures are safeguarding type (barriers, guard, etc.), accessibility and visibility decrease and the safety increases. This causes more technical or organizational constraints during system use. If safety measures are safety procedures defined by designer one returns on the concept “Task”.

The analysis and observation of operator’s safety problems in design, which done within the framework of our project pluridisciplinary (see Acknowledgements), brings us to go more far in reflection on contradictions related to safety by applying the method developed in TRIZ. This one allows us to take into account the safety but still in an incomplete way. Our analysis allows, nevertheless, showing the possibility of using in an effective way the TRIZ method. They lead to suggest enriching TRIZ’s database for an application in safety domain.

In the following, we present our analysis related to a safety problems on an automated complex production system: a line of off-sit printing, which is the support of our group research works. This work focuses mainly on Boundary Conditions Tolerated by Use (BCTU) [Didelot 2001] , which sometimes appear because of choices made by designer to satisfy certain prescriptions in standards in answering his vision of equipments normal use.

5. TRIZ’s applicability on the contradictions related to safety
In the literature concerning TRIZ, we do not find features allowing representing clearly the safety. There are attempts to take into account the ergonomics point of view of the work but not the safety; in particular when safety integration requires long and difficult procedures, which decrease comfort and ergonomics of work. In other versions different from those proposed by Altshuller, we find a new feature named “Safety” (harmful effect) opposite to the feature “Productivity” (feature to be improved) [Savransky 1996; 1997] . On one hand, in our sense and in its meaning, safety has no widest influence of negative effect. On the other hand, it is not easy to express safety integration by a single feature named “Safety”. The safety depends as we showed on technical quantitative concepts as System, technical Solution etc. and on other socio-techniques qualitative concepts as the dangerous phenomenon (hazard), risk which, in his turn, is dependent on several factors [Standard 1997] . Then, the question is to ask if it is possible to use the same existing features in Altshuller’s matrix to resolve the problems of contradictions related to the safety integration?

The first idea is to verify the compatibility of features of technical contradictions matrix and the parameters related to safety integration. For that purpose, we tried to determine the validity of the features to resolve safety problems. The followed step was to list all the problems noticed on a system called certified. One understands here by certified the fact that the system was considered corresponding to technical current safety rules. Then, we analyzed these problems to know if they could be represented and modulated by using the 39 features. Because the basic contradiction is safety against productivity, then, the features, which represent safety, will be contradictory to productivity. During the determination of features that belong to the matrix and represent safety problems, it will be logical and easier to use the 8 40 inventive Principles of resolution proposed by Altshuller. First, we identified the problems met on a certified system. Then, we analyzed these problems to make links with TRIZ’s features. Finally, we showed the possibility of using contradiction matrix to resolve the contradictions related to safety.

5.1. Problems met on a system corresponding to safety standards
The following problems which can arise on a system certified, nevertheless is known corresponding to current rules and standards, illustrate the difficulty for designer to got at the same time a good safety measures (in sense of risk or accident limitation) and a strict respect for ergonomic principles of design (in sense of obtaining an excellent conditions of employment and comfort). This list has no exhaustive character (Figure 5):

* Increase realization time of tasks because of the respect for safety regulations, which sometimes require stopping the system and application of a long sit up procedures, etc.

* Disregard of rules and procedures required by designer to win time or for any other reasons.

* Contacts with auxiliaries (tools, consumables) being able to cause a problem of safety related to a bad manipulation.

* Bad contact with system, this problem concerns a possible direct contact between system and operator when this last one realizes his task.

* Decrease of possibility of avoidance: during an incident or an accident, the operator should have the possibility of moving back and going away quickly from danger zone. Barriers and guards, installed by designer, can limit freedom of operator movement.

* Increase of system complexity because of safety measures added to system to reach an acceptable risk index.

* Increase of system cost and production activity to set up an individual protection measures (gloves, glasses, etc.).

* Decrease of accessibility: to protect operator, designer adds guards and barriers which decrease the reach and operator accessibility to organs which should be accessible to clean them, setting up, maintain, etc.

* Increase realization time of tasks because of the respect for safety regulations, which sometimes require stopping the system and application of a long sit up procedures, etc.

* Disregard of rules and procedures required by designer to win time or for any other reasons.

* Contacts with auxiliaries (tools, consumables) being able to cause a problem of safety related to a bad manipulation.

* Bad contact with system, this problem concerns a possible direct contact between system and operator when this last one realizes his task.

* Decrease of possibility of avoidance: during an incident or an accident, the operator should have the possibility of moving back and going away quickly from danger zone. Barriers and guards, installed by designer, can limit freedom of operator movement.

* Increase of system complexity because of safety measures added to system to reach an acceptable risk index.

* Increase of system cost and production activity to set up an individual protection measures (gloves, glasses, etc.).

* Decrease of accessibility: to protect operator, designer adds guards and barriers which decrease the reach and operator accessibility to organs which should be accessible to clean them, setting up, maintain, etc.

5.2. The correspondence with TRIZ’s Features
We related to every problem met on the normalized system, features which have an influence on this problem. For example, application of safety standards can lead to more complex and longer procedures that can increase realization time of tasks. This problem can be related to the features 9, 15, 16, 22, 25, 33, 34, 38 (cf. § 3.3), which stipulate that to change the realization time of tasks, it is possible to:

* Modify system speed or realization speed of tasks.
* Modify the duration of action by a moving or stationary object (decompose the task differently, etc.).
* Decrease the loss of energy of system or operator by using lost energy to realize other tasks.
* Decrease the loss of time by realizing tasks at masked time, etc.
* Increase the ease of operation of system by simplifying procedures and the of use and sitting up
* Increase the ease of repair of system by simplifying the procedures and the tasks of repair and maintenance.
* Increase and extent of automation what allows to take away the operator and to win time by automating tasks.

In table 2, we present the identified problems and the corresponding features.

5.3. The results of our analysis
The analysis of this table shows that most of the 39 features of contradiction matrix are useful for modeling the contradictions inherent to the safety problems. The contradictions are presented, between every identified features and the feature “Productivity” (feature n°: 39). This allows deducting that the principles of contradictions resolution quoted in the compartments of the line 39 and the column 39 of Altshuller’s matrix are useful to resolve the contradictions related to safety. Among the 39 features, we found 28 interpretable features to represent contradictions, which result from safety integration. The contradictions between these 28 features and the feature “Productivity” can be resolved by using the inventive Principles of resolution quoted in the compartments of the last line of the matrix.

For example, as regards problem of visibility, three features (5, 6, 18) that are “Area of moving object”, “Area of stationary object” and the “Illumination intensity” can influence visibility. The resolution of contradictions between these three features and the feature “Productivity” is possible by using one or more of 9 Inventive Principles of resolution which are: Segmentation(1), Nested doll (7), Preliminary action (10), Another dimension (17),

In fact, the principles proposed in the compartments of interaction between features are filled by principles, which are considered useful to resolve the technical problems Figure 6. But, is it the case to resolve also the problems related to safety?

We were able to interpret some of these principles to resolve the contradictions related to safety problems. For example, the principle of “Segmentation” (1) allows segmenting the area of an object (possibility of folding, less brilliancy etc.) in order to increase the visibility. The principle of “Another dimension” (17) allows to change the dimension or the position of the area (turn towards highly-rated least brilliant or least hampering. The principle of “Porous materials” (31) allows to change the solid area in a porous area or to increase pores size. The principle of “Discarding and recovering” (34) allows eliminating an element (an area) of an object when this one (the object) ensured its function. That is, if a guard decreases the visibility, its elimination is possible when its function is ensured by the super-system. The principle of “Parameter changes” (35) allows modifying the physical state of object (surface),etc.

On the other hand, one notices that the inventive Principles of resolution have no same correspondence if we interest first and foremost in safety. The Figure 7 shows that another principles could be used to resolve the contradictions between the features. For example, the contradiction with feature (6), which is the “Area of stationary object”, is resolved by four principles proposed in Altshuller’s matrix. On the other hand, we showed that the inventive Principles of resolution 1, 31, 34 are also useful to resolve the contradictions engendered by the decreasing of visibility.

Altshuller’s matrix contains empty compartments when there is not a contradiction or when the contradiction has not a sense. In fact, we found that the compartments of crossing among, on one hand, the feature “Productivity” and on the other hand, the features “Speed” and “Loss of time” are empty. But according to our analysis, the “Speed” could influence three problems related to safety (cf. table 1 and table 2). The same thing for the feature “Loss of time”, which has effects on increase of task time (cf. table 1 and table 2). These empty compartments mean that for the technical problems there is no contradiction between speed and productivity. If “Speed” increases, “Productivity” increases. But, if “loss of time” increases, “Productivity” decreases. This requires the analysis of 40 “Inventive Principles of resolution” to know how to fill these two empty compartments.

These analyses allowed verifying the applicability of TRIZ’s methodology to resolve the problems of contradiction related to safety integration in standards application. This allows integrating this method into the design methods to raise the compromises proposed to satisfy the prescriptions of standards.

It is, also, interesting to note the possibility to use TRIZ for feedback problems coming from ground. The observation of a problem at the user’s site allowed to the proposed a model to determine the element in conflict with the others. This facilitates the modeling of problem then using TRIZ’s to find the tracks of possible solutions. In the following, we present an application recovering from a feedback problem noticed at our industrial partner.

6. Application in a Feedback problem arisen on ground
The contradiction problems related to safety like to have two natures. The application of “Protection devices” on system led to technical contradictions. “Risk reduction by design” led to physical contradictions. We clarified these two points in the case of Boundary Conditions Tolerated by Use (BCTU) and by applying our model of “Working Situation”.

6.1. The procedure of blanket cleaning
Within printing group in an offset printing line, a roller supports the blanket. This one is in direct contact with the paper to realize the printing. During time and because of fattening of ink on this blanket, the quality of printing degrades. The operator is then brought to clean this blanket regularly. To respect safety rules, designer prescribed a procedure illustrated in the Figure 8 by using the SADT formalism [I.G.L. 1989; Jaulent 1994] .

But this procedure requires stopping the system, a new setting up, causes wasting paper and increases the physical operator workload. To avoid this loss of productivity, the operator applies his own procedure (figure 9) and neglects the safety rules by intervening on the system when functioning.

So, contradiction problem can be summarized as follows: the procedure of designer increase safety (useful function) but the productivity decreases and the workload increases (harmful 13 functions). Thus the application of safety standards related to the human intervention on a danger organ led to an organizational contradiction. We suggest in the following resuming the basic problem and using TRIZ to find a better technical solution.

6.2. Basic problem
We modeled the problem in Figure 10 by using substance-field analysis where operator intervenes on a turning organ, which can engender a risk of destruction.

TRIZ proposes the following solutions:
1. Introduce a new substance between objects or introduce a new substance on or around the first object (organ). This solution can be translated in the reality by the integration of guards and barriers in system (Figure 11 A and B). But, these solutions decrease accessibility and visibility of operator necessary to clean the blanket. Increasing accessibility in presence of guards implies stopping the system to remain coherent with safety regulations. So the problem in not resolved.
2. Introduce a new substance on or around the second object (operator). That protects the operator and leads to the use of individual safeguards (gloves, cork of ear, etc.). As we notice, this solution leads to remain risk, Figure 11 C.
3. Change the technical solution that is the base of danger organ to delete the harmful function (risk). This means that designer of this offset line should replace rollers by another technical solution. The ways of solution in this direction turn out to be still too expensive or insufficiently productive.
4. Simplify the system by removing the entity “Operator”. It can be translated by automation of blanket cleaning operation. That satisfies the function of cleaning by another sup-system, which realizes the cleaning task. This solution increases the complexity of the super-system because she adds problems related to the new device. In Boundary Conditions Tolerated by Use or when system will be outside of the normal operating mode, the operator will realize manually this task and we shall return to basic problem.

The analysis of these solutions propositions show that they establish compromises, because both entities connected by the field should always coexist. But, TRIZ is supposed to do not propose compromises what urges us to repeat the problem otherwise. 14

6.3. Reformulation of problem
We try to know the reasons of this human intervention by resuming the elements of our produced model. To avoid cleaning ink dried on the blanket, we try to prevent the occurring of this phenomenon. TRIZ suggests modifying physical state of the ink or blanket surface. That is add additives to improve the properties of ink or treat blanket surface. In practice, one notices that these operations are expensive and that user buys the least expensive ink or answering best quality-price rate. In best cases, we decrease quantity of ink dried on blanket so the frequency of human intervention. But, in every case, we did not resolve completely the problem even if frequency of intervention is decreased and occurrence probability of accident is lesser.

We postulate that the human intervention is obsolete. The roller turns and requires human interventions. On one side its speed should be big to satisfy production requirements and the economic objective. On the other hand, this speed should be weak to not hurt the operator and to not engender destruction risks. The problem can come down to a problem of physical contradiction, which can be resolved by using the Separation Principles in TRIZ. By using separation principle in time, we prevent operator to intervene when roller turns in full speed. To intervene, the operator should stop the system. In fact, the designer, to realize such a solution, defined this type of procedure presented previously. But this one is not applied because it is long and made waste time.

The application of separation principle in space allows taking away the human intervention of the turning roller. It requires the use of a special tool to clean the blanket when the roller turns. This one should be associated to the system while being of easy use. This allows to win at time and to ensure operator safety. Throughout this analysis, our model established at the same time a support and a guide. In the paragraph 6.2, solutions, 2, 3 take into account the concept of “Safety Measures”, solution 4 the concept of “Technical Solution” and solution 5 the concepts of “Function, Task and System”. In the paragraph 6.3 one takes into account successively the concept of “Auxiliary” of consumable type, the concept of “Task” and, finally, the concept of “Auxiliary” of tools type.

The resolution of contradictions related to safety integration in application of standards, is a fundamental necessity. TRIZ allows resolving organizational problems by returning to the technical system origin of the problem. Most of the contradictions send back to “Risk reduction by design” level. At “Safeguarding” level, TRIZ proposes solutions that can be interpreted in term of compromise. Finally, the application of solutions proposed by TRIZ often implies expensive and not practicable modifications. The designer uses more or less implicitly TRIZ’s principles. A more systematic use should establish help to the elaboration or to the validation of rules and safety measures.

7. TRIZ’s use and application of standards
We underlined that the use of our model is in coherence with the application of the strategy of prevention of risks required by the standards. These do not decline particular method of application of this strategy. The results of application of tools supplied by TRIZ to resolve contradiction related to safety by means of our model of “Working Situation”, allowed us to notice the correspondence with safety standards. By analysis of contradictions related to safety integration, we made reports at different levels [Hasan and al 2001d] : 15

7.1. At “Risk reduction by design” level At this level, the contradictions are of physical contradictions type (cf. § 3.2, Figure 12). The necessity of satisfying a function required in the Functional Conditions of Contract forces the designer to propose a technical solution capable of performing this function (useful function). But, this technical solution can engender hazard and dangerous phenomena, which in its turn will define danger zones (harmful function). It is a physical contradiction because the same object (technical solution) has two opposite constraints. At this level it is necessary to delete the harmful function: ?? By using Separation Principles (in time, in space and in phase). In our problem it means “make distance between operator and hazard and danger zones”. This point corresponds well to the requirements of standards. ?? By satisfaction of the required conditions (performed function and acceptable risk) what implies the adjustment of proposed model concepts (to size danger zones [Hasan 2002] , modification of task, etc.) to obtain a acceptable risk level. ?? By change of system level in passing towards the super/sub-system. We do that by modifying the function/task and realizing it by a super-system or by dividing it into several functions/tasks to realize them by several sub-systems.

7.2. At “Safeguarding” level

At this level, we have technical contradictions (cf. § 3.2) because designer did not succeed either in decreasing risk index or in taking away the operator (Figure 12). First of all and by using the substances-fields analysis and the 76 standards of TRIZ [Terninko & al 2000] , TRIZ proposes compromises. In fact, the 76 standards are useful to improve the system after its modeling. What explains the proposition of compromise as guards, barriers, etc. But these compromises, while increasing safety, decrease accessibility and visibility, what leads, then, to decrease the productivity. So, we have here a contradiction between two parameters. For example, the length and surface of a guard increase safety but sometimes decrease productivity because they decrease accessibility, which is necessary for operator to realize correctly and as quickly as possible his task. At this level of problem, the concept “Safety Measures” proposed in the generic model of “Working Situation” allows to integrate well these measures by the anticipation and the consideration of the contradiction productivitysafety. In the second place, to resolve these contradictions definitively, we can use contradiction matrix (cf. § 3.3). But, the important question, at this level, is to know if this matrix allows, by using its 39 features and 40 innovative principles of resolution, to resolve the contradictions related to safety integration. In fact, we do not find, in the matrix, features allowing modeling directly such problems. For that purpose, we proposed an analysis allowing confirming the possibility and the utility of using TRIZ to resolve the contradictions of productivity-safety (cf. § 4). In the third place, if the safeguarding is always necessary, it is necessary to create the function safety. It is a functional and not technical or operational viewpoint of safeguarding principle. In this case, “Safety Measures” of type system (guards, barriers etc.) should be considered as systems, which perform the function of safety and to be rather early analyzed in design phases to decrease the most constraints possible at system use. We present in this level an example of contradictions resulting from a guard late addition. The standards prevent access to turning organs, so designer adds fixed guards if there is no 16 necessity of human intervention. If the opposite should occur, he adds movable guards, which during their opening activate stop of system.

However, some setting up in folding machine require rotation of some rollers during the intervention. Then, the designer added a system allowing to make them turn hurriedly slow. To lead and control the intervention, the same operator should affect at the same moment the monitoring tables and the organ. This leads to a physical contradiction: the monitoring table was moved but is not accessible any more during the opening movable guards. This reality encourage operator to remove this guards and to neutralize the sensors of system stop. During problem analysis and based on concepts identified in our model, we notice that consideration of intervention modes (setting up, maintenance, etc.) allows avoiding such a contradiction. The treatment of the attributes decomposition and interface of the concept “System” allows during the assembly of the equipments to place well the monitoring tables and the movable guard.

7.3. At “Instruction or information for use” level
The contradictions here are of organizational type. “Safety measures” is kind of task that must be applied and realized by operator. These contradictions exist when designer does not manage to decrease/delete hazard with necessity of human intervention. This requires that operator to avoid the hazards should apply some procedures. To resolve these contradictions, one falls on the resolution of physical and\or technical contradictions. for example, we quote the cleaning problem of blanket presented in the paragraph 6.1.

8. Conclusion
Our analysis made on the field showed that use of automated production system conceived by respecting safety standards can lead to risk situations. Our model facilities early safety integration in process deign.

TRIZ’s applicability to resolve the contradictions related to safety was shown and confirmed by the results of our analysis. We showed the possibility of using the features and the inventive Principles of contradiction to resolve our problem concerning the safety. The exploitation of our model based on steps of contradiction resolution should establish help for production system design. We showed this exploitation in examples by taking into account as soon as possible the objectives of safety and productivity. Furthermore, we noticed the possibility of enriching the contradiction matrix. This is possible by filling the empty cases in the matrix by significant contradictions from safety viewpoint.