The Ultimate Safe System: Redefining the Safe System Approach for Road Safety

Abstract

The Safe System approach to road safety has been adopted in many countries, but it has been adopted pervasively to a substantially constrained extent. This paper argues that effective adoption is hampered by two weaknesses in strategies for the implementation of Safe System: (1) interpretations of the shared responsibility principle and (2) Safe System adoption presented as simply requiring the use of multiple pillars of action. The typical description of shared responsibility includes responsibility by road users to obey the rules. This absolves accountability for road safety by the system owners and operators, facilitating victim blaming and reliance on road users who are acknowledged to be fallible. Thus, the system cannot be fully safe, and the vision of zero road trauma cannot be achieved. The extent to which road users are responsible for road safety via their actions is precisely the extent to which those responsible for the system have failed to deliver a safe road system. The assessment of road safety plans as Safe System because it includes multiple pillars of action fails to distinguish a system approach from a Safe System approach. Through these inclusions and interpretations, road safety advocates inadvertently obviate the responsibility of system owners and operators to provide a safe road system and prevent the achievement of zero road trauma, which nonetheless remains the vision described in Safe System strategies and plans. The Ultimate Safe System approach is proposed with a definition that genuinely drives the delivery of a truly Safe System and thus zero road trauma. Practical implications are considered.

1. Introduction

Road trauma is a growing humanitarian crisis, with World Health Organization estimates of annual deaths reaching 1.35 million [1] and annual injuries reaching 50 million [2]. Global Burden of Disease estimates are similar, with slightly fewer deaths but 54 million injuries [3]. Road crashes are the number one cause of death for children and young adults 5–29 years of age, globally [1]. The United Nations (UN) Global Goals for Sustainable Development’s (SDGs) ambitious target of reducing road fatalities and injuries by 50% by the end of the first UN Decade of Action for Road Safety (2011–2020) was identified as unlikely to be met [4,5] and indeed was not met. Rather, despite multiple achievements during the decade [6], road crash deaths have increased [1]. In recent years even high-income countries have suffered increased road crash deaths [7,8]. Reflecting global support for continued efforts to address road safety, in August 2020 the United Nations General Assembly declared a Second Decade of Action on Road Safety and a renewed target to halve deaths and injuries by 2030. Road trauma must be addressed with increased commitment, resourcing, and strategic direction if the second chance to deliver the target is to be achieved.

The Safe System is a philosophy of road safety that, by providing a safe road transport system, eventually no one will be killed or seriously injured on the roads. Since the concept was introduced, it has been widely promoted and adopted to varying, though generally inadequate, extents [9,10]. As background to this development, advocates in some countries have also been pushing for greater accountability of the system operators for many years. Examples include Ralf Nader’s Unsafe at Any Speed [11], which advocates for fundamentally safer vehicles and the push in Australia of the idea that crashes are a political issue to be managed through physical barriers to harm rather than reliance on perfect behavior from human users [12].

The Safe System approach to road safety offers key opportunities to effectively address road trauma, to achieve sustained reductions in deaths and serious injuries, and to address the ‘drift to failure’ hypothesized in road safety [13]. However, it is being adopted to a substantially constrained extent. The aim of this paper is to evaluate descriptions of, and strategies for the adoption of, a Safe System through a review and logical analysis of existing Safe System guides and national strategies. These show how Safe System is being operationalized, and they identify how this operationalization has in part contributed to the failure of road safety delivery and to the prevention of achieving zero road trauma (often referred to as vision zero). The present critical analysis relates to two key aspects of the description, interpretation, and operationalization of Safe System: (1) the principle of shared responsibility with road users and (2) describing and assessing Safe System in terms of pillars. Based on this analysis of existing strategies asserted to be Safe System, the paper offers a clarified definition of the Safe System (the ‘Ultimate Safe System’) to facilitate strategic planning to adopt more genuine Safe System approaches to road safety and to achieve zero road trauma.

2. Current Weaknesses in the Presentation of Safe System

Influential global guidance documents and articles describe the Safe System and provide guidance for its adoption [14,15,16,17], including the latest UN Global Plan for the second decade on road safety [18]. Many national road safety strategies have adopted the Safe System as their guiding principles in different countries and states [19,20,21,22,23,24,25,26,27,28]. A review of these guides and strategies or plans reveals that the core of the Safe System is consistently presented as encapsulating the following principles (with slight variations of wording):

• People make mistakes: Humans will continue to make mistakes, and the transport system must accommodate these.
• Human physical frailty: There are known physical limits to the amount of force the human body can withstand before serious injury or death occur.
• Shared responsibility: Providers, designers, and operators of the road traffic system share responsibility [for safety] with road users, who are often described as having an obligation to obey road law.
• A forgiving road transport system: A Safe System ensures that the forces in collisions do not exceed the limits of the human body.
• Vision zero (or Ethics): The ultimate objective or moral imperative of the Safe System is that no one should die or be seriously injured in road crashes. Safety takes priority over mobility.

Although these strategies and guidance reports are striving for the fundamental aim of Safe System, which is to eliminate road fatalities and serious injuries, the strategic operationalization of the Safe System is misguided through two features: the interpretation and description of the shared responsibility principle and the measurement of Safe System delivery through consideration of the pillars of action. Safe System implementation is also limited by inadequate funding and the poor selection of actions in an ongoing climate of politicized decision making, delivering what is popular rather than what works and faith in common-sense rather than evidence-based interventions [29,30,31]. However, this paper is focused on the weaknesses related to the presentations of the Safe System itself, which additionally limit the potential of the Safe System to counter practical road safety implementation issues. The two identified primary problems are described below.

2.1. Weakness 1: Interpretations of Shared Responsibility Are Inconsistent with Safe System

With the exception of the shared responsibility principle, the description of the Safe System provided in the principles above is legitimate and consistent with the fundamental meaning of the term: providing a system which is safe [32]. However, the Safe System concept has been weakened by common interpretations of ‘shared responsibility’. This principle has been operationalized in different international guidance documents and national strategies in a way that is inconsistent with the other principles of providing a safe road system.

Table 1. Example descriptions of “shared responsibility” in international and national documents where the responsibility is forced upon the road users.

Reference	Description of the Shared Responsibility Principle
World Report [17]	“At the same time, the road user has an obligation to comply with the basic rules of road safety”.
ITF/OECD [33] Towards Zero report	“It stresses that those involved in the design of the road transport system need to accept and share responsibility for the safety of the system, and those that use the system need to accept responsibility for complying with the rules and constraints of the system”.
United Nations Global Plan for the Decade of Action on Road Safety [16]	“This approach means shifting a major share of the responsibility from road users to those who design the road transport system…The individual road users have the responsibility to abide by laws and regulations”.
ITF/OECD [14] report “Zero Road Deaths and Serious Injuries: Leading a Paradigm Shift to a Safe System”:	“Third, while individuals have a responsibility to act with care and within traffic laws, a shared responsibility exists with those who design, build, manage and use roads and vehicles to prevent crashes resulting in serious injury or death and to provide post-crash care”.
Road Safety Strategy for South Australia [28]	“Shared responsibility–everyone has a responsibility to use the road safely with organisations, businesses and communities taking responsibility for designing, managing and encouraging safe use of the road transport system”.
National Strategy for Ireland [24]	“Shared responsibility–everyone has a responsibility to use the road safely with organisations, businesses and communities taking responsibility for designing, managing and encouraging safe use of the road transport system”. “There is sometimes a mistaken view that the Safe Systems approach relates only to infrastructural engineering and not to anything else. This is not the case: the system relates to all the stakeholders who are involved in the road transport network. This includes those who enforce the law, those who educate, emergency and health agencies that operate within the system and, most importantly of all, those who use the system”.
Canadian Road Safety Strategy [19]	“providers and regulators of the road traffic system share responsibility with users”.
United States road safety vision, Towards Zero Deaths [34]	“Road users need to make safety-driven decisions, as do transportation professionals…”.
The Australian National Road Safety Strategy [25]	“Responsibility for road safety is shared by all…. While individual road users are expected to be responsible for complying with traffic laws and behaving in a safe manner, it can no longer be assumed that the burden of road safety responsibility simply rests with the individual road user. Many organisations–the ‘system managers’–have a primary responsibility to provide a safe operating environment for road users”.

provides example descriptions of the shared responsibility principle, revealing the insidious re-introduction of responsibility on road users for their own safety. In each definition of shared responsibility in Table 1, road users are held to account for their own safety.

There are three problems with this: one fundamental problem and two practical problems. The fundamental problem is the inconsistency of the principles of Safe System. The objective of Safe System is to create a system which eliminates deaths and serious injuries. Road users are explicitly acknowledged within the Safe System principles to be inevitably fallible. According to the fallibility principle, placing responsibility for safety on road users means the system cannot be fully safe, and thus the fundamental objective of delivering a safe road system in which users are not killed or seriously injured cannot be met. Therefore, placing responsibility on road users is directly inconsistent with the other principles of the Safe System.

The first practical problem is that the principle of shared responsibility, described to include road users (as in Table 1), undermines the basis of the Safe System. Several of the descriptions in Table 1 attempt to shift the responsibility for safety more towards the system operators. However, these attempts lack impact because a road user can still be held responsible for almost every specific crash. Essentially, the system does not need to protect road users if the users can be held to account for their safety. Conversations with various road system operators, as well as media coverage of crashes, highlight the role of the road user in serious crashes. In conversations about improving the safety of the system, system operators commonly argue for not making changes on the basis of road user responsibility and on what is essentially victim blaming, ‘The road is safe if people drive carefully.’ This is especially critical in speed reductions for safety, which are often not adopted on the basis of political issues over-riding system responsibility for safety. The result is little system accountability [29,35,36]. For example, even in extreme cases, rather than installing a crash barrier to protect users of mountainous roads from disastrous crashes, such as running off the road and over a cliff, road users can be held accountable for their safety by requiring them to not make this mistake as part of their shared responsibility. This example is particularly extreme, yet it still allows road system operators to avoid responsibility. It may seem pedantic to assign responsibility to the road user, yet this is exactly what some road operators have said in these cases, thus asserting no need for them to make improvements on the basis that the road is safe if driven correctly. In many instances, the avoidance of responsibility is more pervasive. For example, system operators allow (and vehicle manufacturers produce) vehicles into countries which are capable of speeds which are well over double any speed limit in that country. The system relies on the road user to choose the right speed instead of limiting the speed of the vehicle, which is achievable with existing technology. The lack of a safe road system can be excused and dismissed through reliance on the share of responsibility assigned to road users. The extent to which the responsibility for safety is placed on (shared with) road users is precisely the extent to which the system is not a safe road system.

The second practical problem is that this re-introduced responsibility on road users for their safety invites reverting to victim blaming and a focus on fixing inherently fallible road users as a method to deliver road safety. Thus, in the example above, fatal off-road crashes on mountainous roads can be dismissed as the failure of road users not being careful and not taking their share of responsibility, and they can generate a reversion to the historically limited behavior-based approach to road safety with solutions such as advising road users to slow down, pointing out the danger, or even reminding drivers to drive carefully. The Safe System approach can quickly become a shadow of itself.

Perhaps the weaknesses generated by shared responsibility with road users can be limited by specification of the extent of road user responsibility. However, the extent of sharing responsibility with road users is typically left unspecified, or, more often, road user responsibility is explicitly set as an obligation to obey laws or road rules, even in expressions of shared responsibility which attempt to increase the responsibility of the road operators (for examples see Table 1). However, this places little real constraint on the extent of road user responsibility, and thus it places little real responsibility on system operators. Taking the example above of run-off-road crashes on mountainous roads, most countries or states have laws requiring drivers to keep their vehicle within their lane and on the road. Thus, any such crash will always involve a driver failing to abide by an existing road rule. In many countries there are general rules, including that drivers must avoid crashes, that they must drive to conditions, and that vehicles must be well maintained. Therefore, the vast majority of serious crashes (even including those related to vehicle failure) will involve at least one road user breaking a road rule, even if unintentionally. Thus, attempts to limit the extent of road user responsibility are broadly ineffective.

There are exceptional strategies that have used the term shared responsibility differently, with more alignment with the Safe System. For example, the strategy for Tanzania [37] (uses shared responsibility to refer to shared actions across many government and non-government stakeholders in order to cover the breadth of actions required to address road safety without explicitly including road users. However, the strategy does include government actions to improve road user behavior. The European Union Directive on Road Infrastructure Safety Management [38] is also a strong example of the Safe System approach which refers to shared responsibility but does not include road users as sharing that responsibility. Vaiana et al. [39] present a case study of improving road safety infrastructure based on this directive.

2.2. Weakness 2: Defining and Measuring the Safe System as Actions across Multiple Pillars Misses the Fundamental Principles

The Safe System is a set of principles guiding the design and building of a road system in which no one will be killed or seriously injured by taking into account the fact that people make mistakes and need protection to the level of our inherent physical fragility. However, in practice, a set of action pillars has been utilised to define Safe System rather than Safe System guiding what needs to be performed under each action pillar. These action pillars are commonly categorised as safer roads, safer speeds, safer vehicles, and safer road users (Victorian Road Safety Strategy [40]; New Zealand’s Road Safety Strategy [23]) and sometimes also includes post-crash care (UN Global Plan for the Decade of Action for Road Safety 2011–2020 [16]). These action pillars may shape road safety activities to take a multi-sectoral approach. This may qualify as a ‘systems approach’, but it is not yet a ‘safe system approach’. The flaw does not lie in the management and description of actions through pillars (which is valuable), but rather in defining, assessing, or operationalizing Safe System in terms of action pillars. This approach is adopted in documents which equate multi-sectoral and Safe System [41]. Actions across many pillars are not evidence for a Safe System approach. Chosen road safety activities across many pillars can continue to be inconsistent with Safe System principles and may not contribute to building a safe road system that can deliver on zero road trauma. For example, under the road user behaviour pillar, there may be education, whereas under the road engineering pillar, there may be improved signage and horizontal delineation to guide road users, and under the speed pillar, there may be campaigns and increased visibility of speed limit signage. However, this use of multiple pillars of activity should not be seen to necessarily constitute a Safe System approach if they do not adhere to the guiding principles: education can remain an attempt to fix road users rather than accommodate them; improved signage and delineation can assist road users to not make mistakes but do not protect people in the event of those mistakes; and more visible speed limit signage equally assists drivers but may not be guiding safe travel speeds if the speed limits are too high and not set according to the known human tolerance to external forces. Defining a Safe System approach via the adoption of actions across multiple pillars allows traditional road safety delivery to continue in effect unchanged, thus ignoring Safe System principles. On the other hand, engineering speeds down to safe levels for all road users, according to the human fragility principle, in congested urban settings (e.g., through speed humps, raised crossings, roundabouts, and chicanes) is a Safe System approach even though it engages only a single pillar of intervention. Safe System is not the use of many pillars but a set of principles used to guide what must be performed under each pillar.

One of the common calls for multi-pillar action as the key is the common rallying call for ‘5 star drivers, in 5 star cars, on 5 star roads’ [42,43,44]. However, this call has significant issues: it ignores vulnerable road users in the road system; it fails to acknowledge the fundamental role of speed; and, most importantly for present purposes, it is inconsistent with the Safe System approach. Any proffered solution that relies on having 5 star users is bound to fail because, as acknowledged in the Safe System principles, humans are inherently prone to error and thus will not be 5 star all the time. Thus, again perhaps unwittingly, the expectation that road users be responsible for their safety and that of others in a road system is re-introduced, averting the need to deliver an inherently safe transport system.

3. Defining the Ultimate Safe System

In order to genuinely achieve a safe road system in which no one is killed or seriously injured, the currently accepted operationalization of Safe System must be revised. We advance the following formal clarified definition of an ultimately safe road system:

In road transport, the Ultimate Safe System is one in which road users cannot be killed or seriously injured regardless of their behavior or the behavior of other road users.

Logical analysis and internal consistency, as above, dictate this rigorous definition. Requirements that road users share responsibility for their safety are inconsistent with the more rigorous conception of the Safe System. Only with this more rigorous approach is it possible to achieve zero road trauma. Achieving no one being killed or seriously injured requires a system in which no one can be killed or seriously injured, regardless of the errors they make. Otherwise, the system relies on road users explicitly acknowledged as fallible to not ever make various mistakes. Only with this rigorous definition is the system consistent with the fundamental meaning of a safe system and the moral imperative to deliver zero road deaths and serious injuries identified under the Safe System approach.

Adoption of this Ultimate Safe System as an objective, consistent with vision zero, also offers the opportunity for benefits in other spheres. For example, more pedestrian areas could have traffic removed, with the provision of more public transport (such as metro systems) or improved urban and land use planning in order to address safety issues, thus making our cities more livable and less polluted and generating fewer climate change impacts.

4. The Practical Value of the Ultimate Safe System Approach

Practical limitations of this approach need to be considered. The vital practical point of the present analysis is that, through internal inconsistencies, there is a fundamental retreat from Safe System even before the process starts. In place of this, a genuine push for Safe System (as advocated here) allows the possible practical boundaries of safety to be explored rather than having limitations—and thus failures—tacitly defined into efforts to achieve Safe System from the start. Limitations, such as those requiring road users to obey all road rules, results in a failure to achieve vision zero or, in reality, get close to it. The presently recommended approach allows for the limits of Safe System (and there may ultimately be none) to be found in practical terms.

The practical limitations require detailed consideration as progress occurs and new limitations become apparent. For example, deliberate circumvention of the system, such as tampering with a vehicle’s intelligent speed limiting system to allow it to exceed the speed limit, may be considered outside the scope of the protective system. However, as countries systematically progress towards Safe System with fewer and fewer deaths and serious injuries, more solutions may be found for even extreme deliberate behaviors along with policy considerations around the cost of prevention. These may include, for example, tamper proofing vehicles or creating ignition lockouts or notification systems if someone tampers with a vehicle.

It is also important to consider that, despite the logic, it may be argued that less rigorous definitions of the Safe System can drive more practical outcomes, and therefore, on this basis, road safety practitioners should support the less rigorous definitions. Although this approach may appear to provide value in some instances, particularly in terms of political acceptance, the less rigorous definitions can create substantial problems for road safety delivery, as described below. Defining an ‘Ultimate Safe System’ may have more practical value than retreating to political convenience. At the very least, it can provide a full appreciation of the problems created by current approaches which do not allow for the delivery of a safe road system. To that end, practical risks with the less rigorous definitions are described below.

First, defining the Safe System to include road user responsibility (and, by extension, accountability) allows politicians and system operators to escape responsibility and accountability. The inclusion of (even shared) road user responsibility for safety allows the accountability of the system for safety to be avoided in favor of victim blaming. Those responsible for the system are able to, and often do, call for road users to take more care rather than addressing the fundamental provision of safety in the system (for examples see: [45,46]); and in events as important to global road safety leadership as the 3rd Global Ministerial Conference on Road Safety in Stockholm in February 2020, in which ministers from some countries called for education and fixing the behavior of road users as the key solutions to the road safety crisis). The value of an Ultimate Safe System lies in its directive power to identify the best sustainable solutions to achieve comprehensive safety. The removal of road user behavior as a factor to achieve safety forces discipline on the system designers and operators to identify innovative solutions that protect road users. Stronger regulation of vehicles and road standards may also be more clearly seen for the fundamental value they can deliver. Renewed discipline and focus enable the road system to become closer to a true Safe System more sustainably, effectively, and efficiently.

Second, the community is misled in its understanding of road safety, which still almost ubiquitously retains a road user responsibility and victim-blaming approach. This is visible in public commentaries on road safety (see [10]). This reinforces community misunderstandings of the Safe System and reduces demand for a Safe System approach from our politicians and leaders. Without this demand for an absolute safe road system from the community, the political motivation to provide it is weakened.

Third, media coverage of crashes still pervasively focuses on the errors of road users as the fundamental account of crash deaths and injuries and is often supported by public references to studies supposedly showing that human error is the main factor causing crashes [47]. It is not possible to align reporting more effectively to the Safe System as long as road users have (shared) accountability for their own safety. Having a rigorous Safe System approach which is understood by the community and the media would, for example, facilitate media pressure on road system designers and operators to provide median barriers rather than blaming drivers for head-on crashes.

Fourth, the less rigorous definition leaves us in the position of having a vision of zero road trauma but not a path to achieving it. In some countries there is now enough demand for a target for zero road deaths and serious injuries, and we can leverage this with an approach which can deliver this long-term vision. Currently, we have a target (zero deaths and serious injuries) but also have plans and strategies which do not follow that vision.

Assessing Safe System delivery actions across multiple pillars also generates significant practical constraints through misunderstandings. Experiences from many low- and middle-income countries (LMICs) identify that this is exactly what is happening: road safety sections may have no role in road design or engineering, or those of whom have responsibility for road features typically only address delineation to assist road users to avoid errors. Indeed, in a number of road agencies in LMICs, road safety sections are colloquially referred to as the “Line and Signs” people. Such agencies are often misled to believe that they are adopting the Safe System approach because they are addressing road safety through multiple components of the system, including via their roads and of course through attempts to improve road user behavior. Finally, on this assessment of the Safe System, the bar has been set so low that everyone exceeds it. It is difficult to imagine any country which does not meet these criteria for Safe System action: all countries have attempts to improve road user behavior through police enforcement, all have signage to direct drivers and horizontal delineation on at least some roads, and all have some form of emergency response and medical treatments which can be applied for crash victims. Despite actions across multiple pillars, it is not a true Safe System approach to road safety.

Counterarguments exist for the practical value of existing approaches, including that this has generated formal political commitment to zero road deaths and serious injuries in a number of countries. However, these ‘commitments’ to zero deaths are hollow, with no implied accountability or specified deliverability, because the timelines for reaching zero are well beyond the political career spans of those making these commitments. For example, the Unites States target for zero is 2050, 32 years after the publication date [48] whereas other zero road trauma commitments are stated as the ultimate aim with no date specified [49]. In addition, in the absence of a coherent articulation of what the Safe System is and its inconsistency with the long-term vision of zero, there is no current compelling planning for the delivery of zero road trauma, and so even intermediate commitments may not be focused on the delivery of a Safe System. Thus, in effect, there is no commitment to Safe System which drives action in the life of the governments making these illusory commitments.

Another potential risk of the approach proposed herein is that various road safety actions which may be effective (such as enforcement) are not characterized as being necessary for the building of an Ultimate Safe System. The recommended solution is that these interventions are adopted as a vital part of the mix of interventions fundamentally as interim interventions until an Ultimate Safe System is achieved. In current circumstances of the limited resourcing of road safety, especially in most LMICs, interim interventions that may not be fully Safe System compliant may be feasible and effective. However, it is important to recognize that these will not deliver the long-term goal of zero road trauma. Thus, although countermeasures geared towards the building of an Ultimate Safe System are the ultimate solutions, interim road safety interventions can still deliver road safety value in various circumstances in the short term. However, it is important to appreciate that the interim interventions: are less sustainable in the long term; cannot eliminate the risk of trauma completely and so will not deliver the Ultimate Safe System where no one can be killed or seriously injured in road crashes; and will not be necessary once a fully operational Ultimate Safe System is established. For long-term sustainability the balance of priorities in investments should be shifted towards interventions that enable the Ultimate Safe System to be built and one day eliminate the need for less sustainable interventions.

The final anticipated risk with the current approach is that it may be seen as removing individual responsibility (one of the existing behavioral standards of many countries, with which Safe System is inconsistent: [50]. Ultimately, it does achieve this, but inherent to achieving a Safe System is that the behaviours of the individual road users are constrained to those which can cause only survivable crashes with no long-term debilitating injuries (for example, by limiting the speed of the vehicle to low enough speeds for survivability for the crash types possible in a given location). It is important that system operators admit that their systems, although improving, are not yet safe (in a Safe System sense), and thus individual responsibility is still required until the Ultimate Safe System is achieved.

Finally, the Ultimate Safe System approach offers methods of validation of progress. Naturally, by definition, in an Ultimate Safe System no one can be killed or seriously injured. Progress can be monitored through strong infrastructure-based analyses and interventions, for example, through road safety assessment processes such as iRAP or inspections [39,51]. Vaiana et al. [39] present a case study based on the European Union Directive for Road Safety [38] which prescribes processes for strong systemic improvements of road safety. As a measure of progress, the ultimate defining feature of Safe System, as follows, can be applied to each section of the road: considering the worst possible mistake road users can make here, can the system still protect them and others from death or serious injury?

5. What the Ultimate Safe System Looks Like

With the clarified definition of Safe System above, it is worthwhile to note what the Ultimate Safe System requires in order to help strategize actions towards building that ultimate system.

Johansson [52] sets out the principles and boundary conditions of road and street design under vision zero. Although they help manage the kinetic energy in crashes and significantly reduce the risk of fatalities and serious injuries, they cannot eliminate the risk altogether, as even at 30 km/h, a pedestrian colliding with a vehicle will still result in a 10% probability of a fatality [53]. A truly safe road transport system would entail:

Road users, including all vulnerable road users, never being exposed to forces which are not survivable or which can create long-term debilitations even when the users make mistakes, including deliberate risk-taking. Although deeply challenging, this can be achieved through:

• Road and vehicle features that are maintained, reliable, effective, and can prevent deaths and serious injuries without being reliant on road user behaviour and compliance with laws. Vehicle maintenance can be controlled through systems such as vehicle lockouts without maintenance.
• Setting and achieving compliance with speed limits required to deliver ultimate safety through vehicle engineering (such as speed limiting, intelligent speed adaptation) without relying on drivers to choose to comply with limits.

6. Conclusions

To be a Safe System, the system must protect human road users from dangerous forces, even in the event of their worst errors, in order to deliver zero road trauma. This cannot include the responsibility being shared with road users, including the responsibility to obey road rules and relying on them not to make mistakes. Such a sharing amounts to admitting that road users are fallible but also expecting them not to be fallible. The Safe System approach cannot be defined or assessed by the adoption of actions across multiple pillars, but by the types of actions being adopted. This paper also argues that, far from being a theoretical notion, the Ultimate Safe System approach can facilitate the achieving of effective, sustainable delivery of road safety by guiding actions even when there is a long way to go to achieving the Safe System and zero road trauma. In the absence of the rigorous specifications of Safe System, road safety planning is left with a destination and a map which guides in the wrong direction, leading to actions which are commonly not designed to deliver on a vision of zero road trauma and which are less sustainable.

In order to effectively transform the existing road system into a truly Safe System, this paper has redefined the Safe System by fully removing the reliance on road user behavior to achieve safety and has offered ways to strategise this redefined Safe System.

In a road transportation system, an Ultimate Safe System is one in which road users cannot be killed or seriously injured regardless of their behaviour or the behaviour of other road users.

It is acknowledged that achieving an Ultimate Safe System is an ambitious long-term mission and that, in the absence of an Ultimate Safe System, interim interventions can also deliver road safety benefits as interventions necessary to build an Ultimate Safe System are increasingly implemented over time. The distinction between interventions that are essential for the building of an Ultimate Safe System and interim interventions enables system designers and operators to keep track of progress and to identify the best next step of interventions with the eventual aim of achieving an Ultimate Safe System. Other practical advantages of articulating the Ultimate Safe System are also offered in this paper. There may be limitations to the extent to which all this can be fully achieved, yet the key advantage of the approach proposed here is that aiming for the Ultimate Safe System allows the limits of the system to be found and new solutions to these limits to be explored. This has clear advantages over the current operationalizations of Safe System which is designed with inherent limitations without exploring the viability of eliminating them.