- Email: [email protected]
Are you fit to continue? Approaching rail systems thinking at the cusp of safety and the apex of performance
Safety Science 76 (2015) 101–110
Contents lists available at ScienceDirect
Safety Science journal homepage: www.elsevier.com/locate/ssci
Are you fit to continue? Approaching rail systems thinking at the cusp of safety and the apex of performance Anjum Naweed a,b,⇑, Sophia Rainbird a,b, Craig Dance c a
Central Queensland University, Appleton Institute for Behavioural Science, Australia Cooperative Research Centre for Rail Innovation, Australia c Rail Corporation New South Wales, Australia b
a r t i c l e
i n f o
Article history: Received 18 November 2013 Received in revised form 16 January 2015 Accepted 22 February 2015 Available online 17 March 2015 Keywords: Rail safety Systems thinking Risk perception Complexity Managerial thinking and cognition
a b s t r a c t The incidence of driving a train through a stop signal continues to have implications for safety on railways. Industry rulebooks advise how to manage these events, but there has been very little investigation of causality from the systems-view. The increasing trend for maximising rail capacities could be exacerbating the issue and warrants investigation from this perspective to determine the factors impinging on safety decisions in train driving. A participative research approach incorporating cab rides, focus groups, and a generative scenario simulation exercise was used to investigate how train movements and safety risk was managed, and the implications of this on the rail organisation. Twenty-eight train drivers participated from eight passenger rail organisations across Australia and New Zealand. Inductive thematic analysis of the data revealed factors associated with (1) changes to signal meaning, (2) the nature of the driver-signal relationship, and (3) the confounding practice of asking a driver if they were ‘‘fit to continue’’ driving after going through a stop signal. The findings reflected a strong pattern of a normalisation of deviance. The results are discussed in terms of the mechanisms underlying the observed phenomenon and a model outlining prospective solutions for future research is presented to contribute to the development of novel ideas for further thinking and research. Ó 2015 Elsevier Ltd. All rights reserved.
1. Introduction Railways are designed to guide trains over pre-set routes and train movements are managed to optimise network performance. Signals show the train its movement authorities (i.e. where the train is permitted to be) on the track but it is left to the train driver1 to determine how they respond and stop based on safe-working requirements (Branton, 1979). In practice, driving a train can be a bit like driving a semi-trailer on ice with a blindfold on (Naweed, 2013b). This is because of how it feels to drive steel wheels over steel tracks, and because railways curve a lot, it is not always possible to see where you are going. Rail corridors are filled with vegetation and other visual obstructions, and the markers that constitute movement authority (e.g. signals, speed boards, temporary speed restriction boards) are often hidden from view. All of this creates the need to ⇑ Corresponding author at: Central Queensland University, Appleton Institute for Behavioural Sciences, 44 Greenhill Rd, Wayville, SA 5034, Australia. Tel.: +61 8 8378 4520. E-mail address: [email protected] (A. Naweed). 1 The term train driver varies from country to country and changes from organisation to organisation. Those who operate trains can also be called Locomotive Engineers, Railroad Engineers, Train Operators, Engine Drivers, or Loco Pilots. http://dx.doi.org/10.1016/j.ssci.2015.02.016 0925-7535/Ó 2015 Elsevier Ltd. All rights reserved.
have very reliable knowledge of the routes and a good awareness of the evolving situation (Luther et al., 2007). Given the sighting constraints and requirement for stopping accuracy, railway signalling is designed to preview what the next signal is likely to show. This provides the driver with time to correct their speed and to brake appropriately. Fig. 1 illustrates three examples of how signals in railways are designed. The signals vary in colour and configuration but all three use the same principles for driving safely over railways – that of a multiple aspect design that provides early indication of the cautionary and stop (i.e. danger) signals in a strict sequence. This gives the driver the time they need to reduce the speed of the train and stop appropriately. However, as the distances between caution and stop signals may go on for some time, there is also a requirement for the driver to stay alert. Given the safety imperative for trains to remain within their areas of authority, driving past a signal at danger is understandably one of the biggest failure modes. In rail organisations this is referred to as a ‘‘SPAD,’’ an abbreviation for ‘‘signal passed at danger.’’2 Research is pointing to a common finding that these events do 2 The term ‘‘SPAD’’ is also used to describe situations where the train has exceeded its track authority or limits so it is possible to have a ‘‘SPAD’’ with no signal.
102
A. Naweed et al. / Safety Science 76 (2015) 101–110
Fig. 1. Examples of multi-aspect signalling design. Tracks (a) and (b) illustrate three- and four-aspect signalling conventions on railways in Australia (Sydney, NSW) respectively. Track (c) illustrates four-aspect signalling in New Zealand (Wellington).
not occur equally at all signals but often, are associated with certain conditions. Some signals are identified as multi-SPAD signals or SPAD hotspots,3 which recognises a location or signal that is associated with numerous events, but also reflects chronic issues with the task and/or use of the signal in this location. However, these issues could be associated with a number of different things, such as varying levels of train exposure, problems with signal visibility, higher densities of signals in that location, and so on. For this reason, it can be very difficult to triangulate the cause of signal passed at danger events, and a systems-oriented view of the problem can provide a useful lens with which to examine it through. Whilst the majority of signal passed at danger events do not result in accidents, they do present significant collision risk, thus rail operators have dedicated ‘‘SPAD management’’ teams as part of the systems they use to manage safety. These teams support network recovery when there is an incident, collect event data, investigate causation, and deal with the train drivers after an incident. In most parts of the world, reporting signal passed at danger events is a statutory obligation and part of the licensing agreement for rail operators (Ministry of Transport, 2005). This creates a need to minimise these events in order to meet safety targets, but given that most rail operators are also businesses that profits from punctuality, there is an imperative to minimise network disruption and avoid receiving penalties and fines for late running. 1.1. Complexity in maximising rail network capacities: a systems view In recent years, complexity theory has emerged to advocate a view of systems where complexity is becoming the defining characteristic (Dekker, 2011; Dekker et al., 2011; Goh et al., 2010). This theory describes how failure may emerge opportunistically from the systems put in place to prevent them, but also explores notions of deviancy and deviant behaviour as something that becomes 3 These terms are used in Australia and NZ to describe signals and areas associated with a high SPAD rate. They may be referred to differently other parts of the world.
normalised. The normalisation-of-deviance theory was first developed out of research and investigation into the tragic Challenger disaster in 1986 (Vaughan, 1997). In the social context, the theory describes the effect of people within organisations growing accustomed to a deviant behaviour, so much so that they do not consider it as deviant, even though they far exceed the own rules or codes for elementary safety (Vaughan, 1997). Models and frameworks of risk management in dynamic society such as the Practices Migration model add to these ideas (Amalberti, 2001; Amalberti et al., 2006; Rasmussen, 1997). They suggest that a system can be easily stressed by a rapid pace of technological change, through increasingly aggressive and competitive environments, and from changing regulatory practices and public pressures. All of these elements feature pervasively in the rail domain. It is therefore quite easy to see how these combined productive pressures result in a rapid migration to areas at increasing risk through the standardisation of violations. In this regard, the signal passed at danger can be viewed as a ‘‘wicked problem,’’ meaning that the failure mode is linked with cultural challenges and changing requirements that are often contradictory, incomplete and difficult to recognise (Rittel and Webber, 1973). In this way, SPADs can be likened as a symptom of other problems. The normalisation-of-deviance and complexity theories have since been used to explain how compliance may give rise to hazards through deviant behaviours, and how these may erode to a level that effectively reduces the level of risk reduction afforded by the system. Considering how signal passed at danger events are managed from the systems view may provide new information to the people involved with the issue, and explain how complexity may arise between the immediate and/or remote components of the failure mode. The intersection of different approaches and perspectives used to manage these events may have a tendency to blur the issue, and in some respects, the failure may essentially remain unmanaged. As an overarching theoretical framework, complexity and systems thinking may be used to provide insight into safety decision making.
A. Naweed et al. / Safety Science 76 (2015) 101–110
In Australia and New Zealand, rail operators have a tendency to use single factor accounts of failure for human action or inaction to explain signal passed at danger events (e.g. driver was distracted, driver misread the signal, driver misjudged the braking distance). These can be very judgmental and seldom look beyond the trainsignal conflict point to the wider system to explain potential causes, and in practice, reflect an underdeveloped systems culture. Research has started to examine signal passed at danger events for causation beyond single factor accounts (e.g. Stanton and Walker, 2011) and the context-shaping features of the wider-organisation (Naweed, 2013a) to develop multi-factorial accounts of failure. The relationship between the driver and the signal has been identified as having highly dynamic characteristics; that is to say a relationship characterised by constant change and activity where the driver and the signal is essentially a system for regulating train movement. However, few studies have researched the unseen factors that shape how the signal passed at danger event is managed from a systems perspective. In Australia, New Zealand, and the wider Asia–Pacific region, rail is undergoing job growth; Australia alone has seen exponential increases in the patronage of their passenger operations since 2008 (Australasian Railway Association Inc., 2008; Infrastructure Partnerships Australia and PriceWaterHouseCoopers, 2009). These increases have created a push for rail operators to maximise their network capacities (Infrastructure Partnerships Australia and PriceWaterHouseCoopers, 2009). However, these increases are being seemingly accompanied by increase in SPAD rates (Australian Transport Safety Bureau, 2012; KiwiRail, 2013). Australian rail news wires regularly announce new contracts for the development of rolling stock for major operators, though it is difficult to determine exactly how much rail traffic is growing, and whether this is proportionate to the increases in demand. SPAD rates could also be impacted by changes in technology, timetabling, and management of training programs. Increased reporting figures may also reflect changes in detection and SPAD reporting processes. However, increases in exposure of train services is invariably a contributing factor, and indeed, annual industry safety reports make this link to explain increases in SPADs as being ‘‘due to intensification of services and new services being introduced’’ (KiwiRail, 2013, p. 27). It is therefore important to determine how the trend for maximising capacities could be impacting train driving and the risk of signal passed at danger events. This is particularly the case with
103
rail networks such as those in Australia and New Zealand where train driving is still performed using basic train state features (e.g. speedometer) and traditional navigational parameters (e.g. route knowledge). In these networks, few organisations have safety systems that are able to enforce braking if the speed of the train exceeds the posted limits. Further, none have signalling communication technologies that can manage the amount of headway (i.e. distance) between trains (Naweed, 2013a). To some extent, this begs the question of what safety management systems rail operators have in the place to moderate how the distances between trains are maintained. Researching this issue under the overarching theoretical framework of complexity may expound these issues, and draw insight into the systems and organisational behavioural mechanisms underlying safety decision making and causation of the signal passed at danger. 1.2. Aims and objectives This research set out to determine how the trend for maximising capacities could be impacting the train driving task and the incidence of the signal passed at danger failure mode. The study explored this by determining how train movements and safety risk was managed from the perspective of the train driver, and the implications of this behaviour on the rail organisation. Very little if any research has been performed in this area, so the aim was to undertake a general exploratory study to lead to new knowledge about this research gap and the identification of important variables for future research. The study was driven by the research question: given the trend to maximise network capacities, how is rail safety and performance regulated in the rail domain?’’ 2. Methods 2.1. Research approach Cab rides and focus groups were conducted with passenger train drivers in eight rail organisations across Australia and New Zealand. These were undertaken in a number of metropolitan regions (Adelaide, Sydney, Melbourne, Brisbane, Perth, Auckland, and Wellington). The approach was formed using interviews and observations. Direct methods of talking with experts and watching them at work helped conceptualise the issue in the problem
Fig. 2. Methodological framework designed for the study showing progression from observational cab rides to focus groups and the invention task.
104
A. Naweed et al. / Safety Science 76 (2015) 101–110
Table 1 Overview of focus group. Class of question
Content
Example question
General experience Impression of risk categorisation Prospective causation Task influence
Organisational issues Management, classifications Fatigue, awareness, distraction Service delivery, sustained attention Cab environment, safety systems Personalised countermeasures Invention Task
How does your organisation react to a danger signal being passed? What are your views on the different categories of a signal passed at danger event? What sort of things would you consider to be distracting during driving? How much do you think fatigue contributes to the risk of passing a signal set to danger?
Equipment design Risk mitigation Scenario design, analysis, and review Broader issues
Areas for improvement
Does your train have any special equipment to help you stop at signals? What strategies have you developed or used to help you stop at danger signals? Invent a scenario and driving conditions that may result in a signal being passed at danger. . . How could a driver be better prepared for a signal passed at danger event?
domain (Cooke, 1994), in this case, management of safety risk. Fig. 2 conceptualises the design of the methodological framework and outlines the methods and their purpose. Cab rides were undertaken at each organisation prior to the focus groups. These were performed to understand the rail network and support the focus groups to follow. Notes about the particular rail environment (signals, stopping patterns, etc.) were taken and informal interviews were performed with train drivers. At the time of data collection, drivers performed their task traditionally with rudimentary train state features (e.g. speedometer) in all of the organisations, navigating with only their knowledge of the route and its signalling conventions. Each of the eight focus groups lasted approximately 120 min. A total of 28 drivers participated. The average age was 45 (SD = 8.5; Median 48; Mode 53; Range 24–58). Twenty-two participants had more than ten years train driving experience. Focus groups were semi-structured and included a new driver (<1 year driving) and 2–3 experienced drivers (>10 years driving). Table 1 shows an overview of the protocol. The foundation of the protocol was a specially designed scenario simulation task, referred to as an ‘‘invention task’’ with the participants. This task required each participant to generate a hypothetical signal passed at danger scenario with detail of the decision points, shifts in situation assessment, violated expectations, anomalies, and strategies they would adopt to prevent the scenario from unfolding in the same way. By asking participants to simulate their role in such a scenario, the task stimulated knowledge acquisition from situational insight. The task was a variation on methods that involve walking through issues with participants and describing the steps in problem solving on the way (Cooke, 1994), and it drew on principles from the Critical Decision Method (Klein et al., 1989). However, the task also generated visualisations of SPAD scenarios (see Fig. 5 for example), also known as rich pictures to aid in the data acquisition process. Similar techniques have been developed to externalise mental knowledge and investigate causal relationships (e.g. Checkland, 1980; Monk and Howard, 1998; Naweed and Balakrishnan, 2012; Naweed et al., 2012). Integrating an approach that looked beyond discourse also addressed the difficulty of eliciting tacit knowledge from train drivers (Branton, 1979).
2.2. Data analysis Eight focus group transcripts and thirty scenarios4 were analysed with the aid of NVivo, a qualitative data analysis software for organising, searching, and coding data (QSR International Pty Ltd. Version 10 2014). Data within the transcripts included verbal elaborations of the visualisations obtained from the scenario simulation task. Fig. 3 shows a complete description of the data analysis process. The analysis followed a process of open coding, category 4 Of the 28 participating drivers, two generated an additional scenario hence these data included 30 drawings.
development, and thematic coding. First, informal interviews from cab rides and all conversation from the focus groups was transcribed orthographically. Categories were then drawn from the open coding process, including coding of phrases, comments and features of the transcripts, which grounded findings in the data (Huberman and Miles, 1994). The categories were not predefined, thus they emerged from an inductive analysis. The findings of the open coding process were then developed further and refined into overarching categories, discussed by the researchers, allowing them to agree on coding definitions and to find consensus within the data. The drawings were compared against the verbal elaborations through a process of constant comparison and cross-data validity checks, to allowing for further refining and determine consistency (Patton, 2002). The categories were then grouped into themes, which were used to generate and/or support hypotheses identified in the introduction. As part of this process, these findings were also used to conceptualise a model to outline avenues of future research. 2.3. Ethical considerations Participant recruitment was facilitated by contacts in each of the organisations, first with the dissemination of general information articles, and second, with specific information sheets outlining the study. During the study, participants were not required to answer questions they felt uncomfortable with, and any potentially upsetting topics (e.g. fatalities) were avoided. Data were completely de-identified and comments that could be traced back to an individual were not reported. Cab rides required prior approval. The study met the requirement of the human ethics committee of CQUniversity (approval no: H12/03-033). 3. Results The data collected provided critical insights into how the signal passed at danger event was being managed in Australia and New Zealand and how this influenced the way safety and performance was being regulated. Analysis revealed three themes concerned with: (1) Notions of colour and signal meaning being devalued. (2) The nature of the relationship between a driver and the signal, and (3) Asking a driver if they were fit to continue driving after passing a signal at danger.5
5 Note that a number of threads and subcategories were identified in this work but not all were included in this paper. This is because they were not the focus of this work and/or did not reach consensus within the data enough to support a welldefined theme. Those who want to know more about the other aspects of this research can do so from the following: (Naweed, 2013a; Naweed and Rainbird, 2015; Naweed et al., 2015).
A. Naweed et al. / Safety Science 76 (2015) 101–110
105
conveyed time keeping as the main performance criteria, which attracted train movements that were risky and counterintuitive but nevertheless appeared to evidence on-time running on paper, ‘‘Why do you start a train directly onto a red light when there’s no way for it to go? You’re setting somebody up to fail . . . if you have a SPAD there, you’re going to hit something.’’ The main reason for granting the train positioned on platform 3 with the authority to leave the station was so that it could technically depart on time, even though it would only be moving several train lengths before having to stop again. The signal passed at danger event in this scenario was also referred to as a prospective SPAD hotspot (i.e. an area where a high number of these events may occur over a relatively short period). Most rail organisations were considered to emphasise time keeping performance, creating pressures to perform that ultimately impacted how driving was managed by the driver. 3.2. The nature of the driver-signal relationship
Fig. 3. Description of the data analysis process.
These themes and the main categories are shown in Fig. 4. The method of analysis employed in this study sought to identify consensus in the data. Therefore the three themes presented comprise universal perspectives among the drivers from the organisations. Consensus was found across the variables, including the different States within Australia, Australia versus New Zealand, and with different levels of experience. Each of the themes is discussed and examples from the dataset are provided to support them where necessary. 3.1. Devaluing the meaning of cautionary signals The first theme was concerned with the prevalence of cautionary signal aspects in day-to-day operations. The perception was that the meaning behind cautionary signals had essentially changed. On some journeys it was said to be routine to never see a clear aspect, but despite this, the expectation was for drivers to maintain on-time running, ‘‘That’s the way we have configured the network. We have devalued that yellow,’’ ‘‘We still get hammered on our side about losing time,’’ ‘‘[Control asks] why are you late? Because there’s like four cautions, I had to go through four cautions between this spot and this spot.’’ Data from general focus group discussion and the scenario simulation exercise suggested that the combination of habituation and time pressure motivated drivers to treat caution signals as if they were clear aspects and drive at line speeds, ‘‘If you’ve seen something happen ninety-nine times you expect it will happen the one hundredth time...’’ Risk acceptance was the essence of this theme, and from a systems perspective, pointed to a normalisation of deviance, both in terms of how train movements were managed and the way that the task was regulated. This perspective was found in all organisations and evidenced in the frequency of cautionary signals seen during the observational cab rides. The theme of devaluing signal meaning was related to how safety and performance was being regulated. To exemplify this, Fig. 5 shows a scenario collected in the study. The scenario has also been storyboarded (see inset) to conceptualise the tension between safety and performance in the rail context. The scenario
The second theme provided insight into the nature of the relationship between the driver and the signal, and the impact that driving past a stop signal had on this relationship. Participants made a point of conveying the unique characteristics and properties of each signal, ‘‘Every signal tells you a story.’’ It was not uncommon for drivers to see many hundreds if not thousands of signals in every shift, but passing a signal at danger, even by a metre, was described in terms of emotional and physiological response. All participants indicated they were ‘‘conditioned’’ into seeing a danger signal as equivalent to a ‘‘physical boundary’’, and going past such a boundary would leave them shaken, ‘‘Having this incident rocked my world, shattered it, left me in a very bad place for a while,’’ ‘‘I saw the flash of red out of the corner of my eye. Initially I sat there for about 10 s just gripping the controls thinking, oh God, life’s over,’’ ‘‘I felt terrible. I went I just want to cry! Because I’d made a mistake, like, I’m not – I take pride in my job so making that mistake was like, oh my God.’’ Participants also contextualised their relationships with railway signals in different ways. One group of answers described signals by assigning primacy to their purpose as a ‘‘top priority’’ and as the ‘‘ultimate collision avoidance system.’’ Other categories captured how drivers interacted and managed signals in terms of the different types of intimate relationships they held. One such relationship was about a deep sense of regard and esteem for signals and these categories contained words like ‘‘respect,’’ and statements like ‘‘the most respected thing out there.’’ Another kind projected the effects of observing signal authority on security, and signals were described as ‘‘my life-line’’ or ‘‘my passenger’s safety.’’ Some drivers described their relationship in terms of its role on the broader context of their personal lives, and expressions of the signal as ‘‘my livelihood’’ and ‘‘my bread n’ butter,’’ very were common. Signals were also personified with human or animal attributes and described as ‘‘my colleague’’ and ‘‘my best friend,’’ and in one case ‘‘a large dog,’’ conveying an inscrutable threat. Lastly, the relationship was also expressed in terms associated with spiritual ethics or divine law, and signals were described as ‘‘my religion,’’ and ‘‘God.’’ Taken together, these data pointed to a strong, highly intimate and often complex dynamic underlying the relationship between the driver and the signal. Based on data gathered from the scenario simulation exercise, the density of signals and performance requirements (i.e. on-time running) appeared to attract operational errors, such as the scenario in Fig. 5. However, the intensity of the relationship between the driver and the signal was such that violating its terms appeared to create symptoms of an acute stress response (release of noradrenaline, increased heart rate, constricted blood vessels, change in
106
A. Naweed et al. / Safety Science 76 (2015) 101–110
Fig. 4. Diagrammatic summary of the key thematic findings.
blood pressure), and emotional irregularity (disbelief, fear, panic anxiety). This threatened the performing capacity of the driver by manifesting cognitively (e.g. daze, narrowed attention, confusion, distraction, impaired judgement, disorientation, partial amnesia), and musculoskeletally (e.g. shaking, muscular agitation, delayed response). The intensity was such that the psychological ramifications were said to continue long after the event. In terms of risk management, this translated into use of mitigation strategies that were compulsive in appearance and adopted to remind the driver that they were driving through a caution zone (e.g. counting backwards, singing songs, standing up). 3.3. Yes, I am fit to continue. . . Study data showed some uniformity in the processes adopted to manage the driver following a signal passed and danger. All events were investigated as part of the organisation’s safety management system. This included an on-site ‘‘fact finding exercise,’’ drugs and alcohol testing, an interview with the driver for their recollection of events, the train management techniques they had used, and any factors that could have influenced their decision-making capacity. Details of the signal were captured (e.g. signal type, protection class, sighting distance), to build a profile of the event. The driver’s state of fatigue and shift-work patterns were also recorded. While the fact gathering exercises were relatively comprehensive, there was less uniformity in how operators managed risk on their
network after the event. Detaining the train at the site of the event was not compulsory, and in the majority of organisations, moving the train and relieving the driver from duty at ‘‘the nearest safest location’’ was the preferred mode of managing risk. However, the ability of the driver to continue operating the train immediately after a signal passed at danger event was typically determined over the radio by a train controller6 with a single question: ‘‘Are you fit to continue.’’7 Participants involved in risk management indicated that the ‘‘fit to continue’’ check was used to determine if drivers were ‘‘physically okay,’’ ‘‘unshaken’’ and in a state where they were ‘‘able to concentrate.’’ Participants held views that asking drivers if they were ‘‘fit to continue’’ was confounding and near-preposterous, ‘‘Once you had a serious near-miss, where you can hear fear in the driver’s voice or they’ve had a SPAD, to me they should be immediately relieved from duty,’’ ‘‘If you had a SPAD the last thing you want to do is drive that train and [the driver] should say, no, this is where I stop, I do not go anywhere.’’ In operations where a train guard was present (crew member responsible for platform 6 The term train controller varies from country to country and from organisation to organisation. Those who interact with train drivers during driving and/or control train movements also called Dispatchers, Signallers, Network Control Operators, and Rail Traffic Controllers. 7 The question varied between organisations (e.g. are you alright to continue; are you able to continue) but the essence of what was being asked was generally the same.
A. Naweed et al. / Safety Science 76 (2015) 101–110
work, wheelchair assistance, station announcements), the guard may have been asked to accompany the driver as an ‘‘extra pair of eyes’’ though this control was critiqued, ‘‘I was not in a good place to drive, even though I had the guard next to me the whole way, all the guard’s doing is looking out the window.’’ In operations where the driver was the only crew person aboard the train, the risk was reportedly managed by ‘‘giving the train priority of way.’’ This meant that drivers would continue driving on ‘‘clear aspects and at a low speed,’’ but in practice this did not always happen and drivers considered it a ‘‘weak procedural control,’’ especially with existing network disruption. In both cases, the distance to ‘‘the nearest safest location’’ varied, and could be the next station, or at a location many kilometres away, ‘‘I remember this one driver went from [location A] all the way through to [location B] into [location C] and this guy was rattled.’’ In one case, a participant reported they had driven 20 km to the ‘‘safe location’’ following an event. In some networks, the initial radio-based assessment of being ‘‘fit to continue’’ would also be corroborated with ‘‘a visible inspection by a competent person’’ at the next ‘‘manned location.’’ Thus, a duty manager or a staff member at this location would be radioed and asked to inspect and verify if the driver was indeed ‘‘fit to continue.’’ The question ‘‘are you fit to continue,’’ reflected a paradox in the safety management systems where the check was adopted. This was evident when participants indicated that answering the question ‘‘are you fit to continue’’ with a ‘‘yes’’ was contrary to what seemed intuitively right or correct, but almost all drivers were likely to answer it with a ‘‘yes’’ no matter how compromised they felt. This was underpinned by strong motives to comply from inward projections of blame, but also because they feared that they would be seen to be uncooperative, and believed it could be used against them in the ensuing investigation. This was linked with worries of being ‘‘labelled as someone who has had a SPAD’’, and the notion that ‘‘a SPAD needs to be paid off’’ to recover reputation, ‘‘There’s a particular scare-factor management put around with SPADs, you know – you do this, you get a bell plug.’’8 The fear of being seen to not cooperate was particularly apparent when a signal passed at danger was categorised as a technical SPAD by the controller; this is where the signal switched from proceed to danger unexpectedly, presenting no opportunity to prevent the outcome. However, experiencing an incident under these conditions was still considered to produce the same emotional response, ‘‘I haven’t had a SPAD yet. . . had a few close calls, had false SPADs where you get the same sort of adrenalin rush/feeling.’’ In some cases, it was reportedly worse because it was completely unexpected. Some participants indicated that the question was just a formality, and after such a SPAD event, they were expected to provide no resistance, ‘‘Train control puts pressure on the driver to proceed.’’ Participants who had experienced passing a danger signal provided accounts of the poor risk controls that were in place and admitted to having violated many driving rules during the postincident journey, ‘‘I really shouldn’t have been driving. I made a lot of mistakes driving back to [the location] that I would never normally make. If there’d been management in there with me, they would have done me for half a dozen other things – I won’t go into them, but it’s – it was traumatic.’’ Additionally, verifying the initial radio-based determination for being ‘‘fit to continue’’ with a visual inspection raised concerns of non-objectivity, not only because it occurred after the fact, but because the ‘‘competent person would then [also] have to manage disrupted passengers.’’ From the perspective of organisational behaviour, the contradiction of asking the driver ‘‘are you fit to continue’’ is the essence of this paper in 8 A bell-plug is a key that controls the door on trains. Here, the term ‘‘bell-plug’’ was used as a euphemism for demotion, and being redeployed into lower-grade service as a train guard in the same organisation.
107
so far as the driver is very unlikely to be in a ‘‘fit’’ state of mind to determine if they are indeed ‘‘fit’’ to continue. From a systems view, these findings support the notion of a normalisation of deviance in rail risk management processes, but also where operational complexity is becoming the defining characteristic. 4. Discussion The results presented data for different levels of management associated with, or directly influenced by, how railway operators managed safety risk on their networks. These were concerned with how train movements were managed to maximise capacities, how drivers interacted with signals, and how safety risk was handled after a signal passed at danger event. The first and third themes were intertwined with performance and connected with safety in a highly competitive dynamic. The nature of the driver-signal relationship was a more personal introspection of this that erred towards safety, but some of this was also influenced by performance (e.g. ‘‘my bread n’ butter’’, ‘‘my livelihood’’). The first theme indicated that current rail safety management systems are trying to address SPADs without fully understanding the causes. Signal integration and redesign practices may not be supporting how drivers should be driving in the wake of increase in train services, and simply adding another signal between existing signals to separate trains may not have the desired result. The demand for service delivery had created a drive to maximise network capacity, but few networks appeared to have undertaken a review or analysis of signal infrastructure with the aim to optimise how the driver and the signal interface with one another, or the way that timetables are designed. From the systems view, it may encourage deviant behaviours or unsafe acts. For example, in a number of scenarios, drivers intentionally broke safeworking protocols such as answering or indeed making a call to train control when unsafe to do so. This issue linked back to performance pressure, which destabilised core driver-signal dynamics, such as remembering the colour of the last signal, and retaining an awareness of what the next signal aspect was likely to be. The highly intimate and personal nature of the relationship between the driver and the signal was not altogether surprising, given the relative importance of signal authority, frequency of signals, and the isolation of the cab environment. Participants described their relationships in different categories but every response evidenced the significance of signals to the driving role, and the gravity of this to the life of the driver. There was a singular weightiness to this relationship that gave unique insight to train driver identity, but given the emotional investment in the task, participants viewed a cost to breaking the terms of the relationship (beyond safety). Some of the relationships were person-oriented (e.g. costs to the driver) whilst others were system-focused (e.g. cost to the system), thus it is entirely possible that they could also define behavioural implications in SPAD situations. The concern for being ‘‘labelled’’ a driver who has had a SPAD, and the idea that this would need to ‘‘paid off,’’ appeared to breed a culture of taboo in the industry and strong convictions of punitive action to follow. The intimate nature of this dynamic and the potential for disrupting it may have been related to compulsive behavioural traits observed in some of the risk mitigation strategies (Naweed et al., 2015). Finally, the theme ‘‘yes, I am fit to continue,’’ reflected negative attitudes towards this aspect of risk management, most of which appeared to be justified. However, there could also be several reasons why not moving a train immediately after a signal passed at danger encroaches on rail safety. If a signal is passed at danger on open track (i.e. not at a platform) waiting for a recovery team to arrive may breed unrest or disquiet among passengers, attracting the desire to open carriage doors and egress directly into the
108
A. Naweed et al. / Safety Science 76 (2015) 101–110
railway corridor. Equally, leaving the driver on their own for a prolonged period before relieving them of duty could also have a negative personal impact. The key point here is that the intent to move the train to a ‘‘safe location’’ invariably runs parallel to performance, but it is also a safety issue, thus a well specified rail safety management system would need to consider the competing demands specifically for their networks. This is an example of where operational complexity is becoming the defining feature of the domain and creating deviancy. As a status check, ‘‘are you fit to continue’’ also contains traces of strategic ambiguity; that is, a deliberate use of ambiguity in strategic communication in order to create a space (Davenport and Leitch, 2005). As a cohort, train drivers are very unlikely to admit to being upset by a SPAD occurrence, particularly when talking to a controller immediately after the event. It is also critical to understand that such an event is likely to produce the same stress response regardless of whether or not the driver was at error. The assumption that drivers should be able to continue if an event was caused by technical error does not recognise the physiological,
physiological, and emotional instabilities. In considering the response to a signal passed at danger event as a management issue with differing needs and viewpoints, it would be useful to ensure that the response is adequately handled from a psychosocial and cultural perspective. A driver should feel to be able to say ‘‘no’’ when asked if they are ‘‘fit to continue’’ without fear of punitive action or being perceived as an inconvenience. In the context of this study, ‘‘are you fit to continue’’ was more about discursive closure and while it appeared to present a delegation of authority, the question was perceived as a discursive transformation that supported the organisation’s own performance goals. 4.1. Exploring new approaches and potential solutions This paper reports central themes that came out of the study. It is important to recognise that a variety of human factors issues can contribute to the risk of passing a signal at danger, such as fatigue (e.g. Dorrian et al., 2007), and indeed, a number of these were mentioned over the course of the focus groups. However, they were not
Fig. 5. Example scenario collected during the study depicting safety and performance constraints. Inset storyboard manipulation shows four key steps as the scenario unfolds (note: the direction of travel is from the left to right).
A. Naweed et al. / Safety Science 76 (2015) 101–110
identified as direct causes in the scenario simulation exercise and were therefore not reported. Fig. 6 presents a conceptual model derived from the study that has been constructed to outline future research avenues based on the findings. As shown, a number of important relationships were synthesised from this study, and those associated with the driver-signal and the signal passed at danger were couched within the broader topic of organisational behaviour. The relationship between the driver and signal was very dynamic, as was the incidence of passing a signal at danger. This influenced organisational behaviour, therefore change and development in rail organisations would benefit from understanding the nature of the relationships caught between these dynamics. In this case, the relationships between safety versus performance, the driver and the controller, and error producing conditions. This study was couched within a systems view and brought out different levels of the system to understand how existing operational complexity may impact the problem. However, as outlined in the introduction, the problem is a wicked one, and more than likely involves specific implications, but given the nature of these issues they are difficult to identify. Specific recommendations for concentrating research and practice towards overcoming the problem is given in Fig. 6, according to the various aspects of the system. Based on this study, future research may be explored through training and pedagogical solutions that focus on self-regulation and targeted training, whereas research of the failure mode may be undertaken through human resources management, on issues such as post-incident risk. As shown in the model these areas are also dynamic, such that driver self-regulation will impact crew resourcing and so on. A more specific avenue of research in the area of self-regulation may involve the development of evidencebased techniques or strategies for promoting meta-awareness of cognitive state immediately after a SPAD. This would help the driver determine their psychological condition and limiting factors. The model also proposes keys areas where research may use this information to pursue change and development, such as organisational culture and risk modelling. The aim of the model is to stimulate further thinking and research, but a brief account of potential human resources and training-related initiatives follows. 4.1.1. Safety and performance training modules Currently, the bulk of train driver training in Australia and New Zealand is focused almost entirely on acquiring route knowledge and learning how to operate a train. This then connects with an understanding of driving strategy (also referred to as ‘‘the methodology’’) which is needed to regulate how driving is performed.
Fig. 6. Model outlining key areas for future research.
109
There is nothing very wrong with this approach – it has been the way of the traditional train-driving world for a while. However, with the push for maximising capacities, it is important to implant content that will render drivers and controllers more aware of the associated big picture elements, which impact how they personally view and manage their tasks. Including a safety and performance module that openly discusses these issues and conceptualises timetabling design from disparate perspectives may create a better understanding of how performance can be managed in different situations. This may induce a better tolerance to time pressure and engender more intelligent self-regulation, and create more commitment to professional driver training. The aim would ultimately be to foster a more erudite understanding of the synergy in the safety and performance relationship. 4.1.2. Targeted simulator-based learning of SPAD scenarios Further to the use of more specific safety and performance training modules, more informed techniques to transmit the actual experience of passing a signal at danger may improve the way a trainee responds to it in the real-world. Currently, the safety implications and nature of SPADs are transmitted in the classroom environment and acquired through stories and cautionary tales as part of the organisational cultural zeitgeist. The adoption of train simulators to enhance learning is a fast going enterprise but there is evidence to suggest they are not being utilised to their full potential (Naweed, 2013b). It is proposed that organisations use the safety of the simulated environment to try to emulate the experience of a signal passed at danger event. This is very much a fringe solution and necessarily involves some deception to set up the scenario appropriately, but the essence is to target learning of the signal passed at danger failure mode to provide the most informative learning experience. However, this method implies the implementation of a learning and development scenario that would be invariably based on error, and therefore out of phase with the dominant rail philosophy that subscribes to safety procedures. 4.1.3. Crew resourcing and supporting the train driver post-incident Clearly, one of the most difficult issues to address is the management of post-incident safety risk inherent to the signal passed at danger event. Given what was identified in the study thematically, better support and/or resourcing to determine if the driver is ‘‘fit to continue’’ is advocated. This may be adopted by better awareness of the issue in train control, and by providing controllers with basic trauma response skills. In environments where the driver is not the only crewmember, the train guard may also be taught these skills to better support the driver. 4.1.4. On-time running Given that on time running was found to be a major performance-shaping characteristic in this study, new methods and approaches for the way that organisations manage timetabling should be explored. One such area has been to investigate if the ‘‘turn-up and go’’ model typically used by bus networks could be applied to rail. This approach has received serious consideration in some Australian rail networks and replaced the model of explicit punctuality (e.g. a train will arrive at 13:11) with the indication of service delivery within a certain timeframe (e.g. a train will arrive roughly every 15 min). Whilst this initiative would invariably build resilience into timekeeping and potentially change how time pressure is perceived (Naweed and Rainbird, 2015), it may not necessarily change the risk profile. From the systems view of complexity, the initiative could reduce perceived time pressure for drivers but also displace it and create new issues. For example, the initiative may drive further increases in train services on the rail network, and therefore, exacerbate the risk associated with
110
A. Naweed et al. / Safety Science 76 (2015) 101–110
maximising capacities. Understanding the impact of changing current on-time running models is an empirical question that needs to be researched. 4.1.5. Systems and organisational culture Many of the findings in this paper point implicitly to a lack of or an underdeveloped systems culture in the rail domain where safeworking is defined in very binary terms. In practice, decision making during train driving is a skilful response to risk where drivers apply a flexible boundary to their assessment and management of risk (O’Keeffe et al., 2015). Currently, the approaches to deal with SPADs have a tendency to be judgemental and seldom look beyond the train-signal conflict points to the wider rail-system. These approaches are also associated with a culture that perceives a significant power differential between the driving function and other related groups (e.g. signaller, controller) when it is far more accurate to define train movement as a product of a coordinated team effort. Encouraging drivers to impose opinions of whether they believe themselves to be fit to continue after a SPAD, without real or perceived risk of punishment, requires development in systems and organisational culture. Developing and applying rail crew resource management practices, the equivalent of crew resource management in the aviation domain, may be one way towards achieving a mature systems and organisational culture. Recent research in this area reveals that crew resource management training can have positive benefits at the industry and the individual level (Roop et al., 2007). It can also help railway operators improve their understanding of the causes of SPAD incidents. 5. Conclusions This paper presented findings associated with different levels of risk management in and around the critical rail failure mode of passing railway signals at danger. Data analysis revealed three themes associated with how railway operators managed safety risk on their rail networks, including the devaluation of signal meaning, the intimacies in the driver-signal relationship, and the perceived confound of asking a driver if they could continue driving after having such an event. These themes were synthesised into an overarching narrative that provided insight into how safety and performance is managed in the rail domain, together with a model outlining key areas for future research. Although these findings were based on subjective and nuanced perspectives of risk management, they were found in eight organisations across Australia and New Zealand, and in the wake of documented increases in rail industry job growth, warrant further research. Future work may explore the relationships between the themes that were revealed to determine how signals are treated by individual train drivers, and how this affects the tendency to self-identify as fit to continue. Acknowledgements The authors gratefully acknowledge the CRC for Rail Innovation (established and supported under the Australian Government’s Cooperative Research Centres program) for the funding of this research; Project Number: R2.116 SPAD-risk Management & Mitigation. The authors are also very thankful to the train drivers that took part in the study, and gratefully acknowledge the assistance of rail organisations in Auckland, Wellington, Queensland, New South Wales, Victoria, South Australia, Western Australia, and Karratha.
References Amalberti, R., 2001. The paradoxes of almost totally safe transportation systems. Saf. Sci. 37 (2–3), 109–126. Amalberti, R., Vincent, C., Auroy, Y., Maurice, G., 2006. Violations and migrations in health care: a framework for understanding and management. Qual. Safe. Healthcare 15 (1), 66–71. Australasian Railway Association Inc., 2008. A Rail Revolution – Future Capability Identification and Skills Development for the Australasian Rail Industry. Canberra, Australia: E. a. W. R. Department of Education. Australian Transport Safety Bureau, 2012. Australian Rail Safety Occurrence Data 1 July 2002 to 30 June 2012. Canberra, ACT: ATSB. Branton, P., 1979. Investigations into the skills of train-driving. Ergonomics 22 (2), 155–164. Checkland, P., 1980. Systems Thinking, Systems Practice. Wiley, Chichester, UK. Cooke, N.J., 1994. Varieties of knowledge elicitation techniques. Int. J. Hum Comput Stud. 41 (6), 801–849. Davenport, S., Leitch, S., 2005. Circuits of power in practice: strategic ambiguity as delegation of authority. Organ. Stud. 26 (11), 1603–1623. Dekker, S., 2011. Drift into Failure: From Hunting Broken Components to Understanding Complex Systems. Ashgate, Surrey, UK. Dekker, S., Cilliers, P., Hofmeyr, J.-H., 2011. The complexity of failure: implications of complexity theory for safety investigations. Saf. Sci. 49 (6), 939–945. Dorrian, J., Hussey, F., Dawson, D., 2007. Train driving efficiency and safety: examining the cost of fatigue. J. Sleep Res. 16 (1), 1–11. Goh, Y.M., Brown, H., Spickett, J., 2010. Applying systems thinking concepts in the analysis of major incidents and safety culture. Saf. Sci. 48 (3), 302–309. Huberman, M.A., Miles, M.B., 1994. Data management and analysis methods. In: Denzin, N.K., Lincoln, Y.S. (Eds.), Handbook of Qualitative Research. Sage, Thousand Oaks, pp. 209–219. Infrastructure Partnerships Australia, & PriceWaterHouseCoopers, 2009. Meeting the 2050 Freight Challenge. Sydney, New South Wales: P. Australia. KiwiRail, 2013. Annual Report 2013. Annual Report (Web Version).pdf (Retrieved 01.11.14). Klein, G.A., Calderwood, R., MacGregor, D., 1989. Critical decision method for eliciting knowledge. IEEE Trans. Syst. Man Cyber. 19 (3), 462–472. Luther, R., Livingstone, H., Gipson, T., Grimes, E., 2007. Understanding driver route knowledge. In: WIlson, J.R., Norris, B., Clarke, T., Mills, A. (Eds.), People and Rail Systems. Ashgate, Cornwall, UK, pp. 71–79. Ministry of Transport, 2005. Railways Act 2005. (Retrieved June 10). Monk, A., Howard, S., 1998. The rich picture: a tool for reasoning about work context. Interactions 5 (2), 21–30. Naweed, A., 2013a. Psychological factors for driver distraction and inattention in the Australian and New Zealand rail industry. Accid. Anal. Prev. 60, 193–204. Naweed, A., 2013b. Simulator integration in the rail industry: the Robocop problem. Proc. Inst. Mech. Eng., Part F: J. Rail Rapid Transit 227 (5), 407–418. Naweed, A., Balakrishnan, G., 2012. Perceptions and experiences of simulators as a training tool in transport: the case of the Australian rail industry. Road Transport Res. J. 21 (3), 77–85. Naweed, A., Rainbird, S., 2015. Recovering time or chasing rainbows? Exploring time perception, conceptualization of time recovery, and time pressure mitigation in train driving. IIE Trans. Occ. Ergon. Hum. Factors. http:// dx.doi.org/10.1080/21577323.2014.989339. Naweed, A., Balakrishnan, G., Bearman, C., Dorrian, J., Dawson, D., 2012. Scaling generative scaffolds towards train driving expertise. In: Anderson, M. (Ed.), Contemporary Ergonomics and Human Factors 2012: Proceedings of the International Conference on Ergonomics & Human Factors 2012. CRC Press, Blackpool, UK, p. 235. Naweed, A., Rainbird, S., Chapman, J., 2015. Investigating the formal countermeasures and informal strategies used to Mitigate SPAD risk in train driving. Ergonomics. http://dx.doi.org/10.1080/00140139.00142014.01001448. O’Keeffe, V.J., Tuckey, M.R., Naweed, A., 2015. Whose safety? Flexible risk assessment boundaries balance nurse safety with patient care. Safety Sci. 76, 111–120. Patton, M.Q., 2002. Qualitative Research and Evaluation Methods. Sage, Thousand Oaks, CA. Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem. Saf. Sci. 27 (2–3), 183–213. Rittel, H.W., Webber, M.M., 1973. Dilemmas in a general theory of planning. Policy Sci. 4, 155–169. Roop, S.S., Morgan, C.A., Kyte, T.B., Arthur, W., Villado, A., Beneigh, T., 2007. Railroad Crew Resource Management (CRM): The Business Case for CRM Training in the Railroad Industry. U.S. Department of Transportation, Washington, DC. Stanton, N.A., Walker, G.H., 2011. Exploring the psychological factors involved in the Ladbroke Grove rail accident. Accid. Anal. Prev. 43 (3), 1117–1127. Vaughan, D., 1997. The Challenger Launch Decision: Risky Technology, Culture and Deviance at NASA. The University of Chicago Press, USA.
Contents lists available at ScienceDirect
Safety Science journal homepage: www.elsevier.com/locate/ssci
Are you fit to continue? Approaching rail systems thinking at the cusp of safety and the apex of performance Anjum Naweed a,b,⇑, Sophia Rainbird a,b, Craig Dance c a
Central Queensland University, Appleton Institute for Behavioural Science, Australia Cooperative Research Centre for Rail Innovation, Australia c Rail Corporation New South Wales, Australia b
a r t i c l e
i n f o
Article history: Received 18 November 2013 Received in revised form 16 January 2015 Accepted 22 February 2015 Available online 17 March 2015 Keywords: Rail safety Systems thinking Risk perception Complexity Managerial thinking and cognition
a b s t r a c t The incidence of driving a train through a stop signal continues to have implications for safety on railways. Industry rulebooks advise how to manage these events, but there has been very little investigation of causality from the systems-view. The increasing trend for maximising rail capacities could be exacerbating the issue and warrants investigation from this perspective to determine the factors impinging on safety decisions in train driving. A participative research approach incorporating cab rides, focus groups, and a generative scenario simulation exercise was used to investigate how train movements and safety risk was managed, and the implications of this on the rail organisation. Twenty-eight train drivers participated from eight passenger rail organisations across Australia and New Zealand. Inductive thematic analysis of the data revealed factors associated with (1) changes to signal meaning, (2) the nature of the driver-signal relationship, and (3) the confounding practice of asking a driver if they were ‘‘fit to continue’’ driving after going through a stop signal. The findings reflected a strong pattern of a normalisation of deviance. The results are discussed in terms of the mechanisms underlying the observed phenomenon and a model outlining prospective solutions for future research is presented to contribute to the development of novel ideas for further thinking and research. Ó 2015 Elsevier Ltd. All rights reserved.
1. Introduction Railways are designed to guide trains over pre-set routes and train movements are managed to optimise network performance. Signals show the train its movement authorities (i.e. where the train is permitted to be) on the track but it is left to the train driver1 to determine how they respond and stop based on safe-working requirements (Branton, 1979). In practice, driving a train can be a bit like driving a semi-trailer on ice with a blindfold on (Naweed, 2013b). This is because of how it feels to drive steel wheels over steel tracks, and because railways curve a lot, it is not always possible to see where you are going. Rail corridors are filled with vegetation and other visual obstructions, and the markers that constitute movement authority (e.g. signals, speed boards, temporary speed restriction boards) are often hidden from view. All of this creates the need to ⇑ Corresponding author at: Central Queensland University, Appleton Institute for Behavioural Sciences, 44 Greenhill Rd, Wayville, SA 5034, Australia. Tel.: +61 8 8378 4520. E-mail address: [email protected] (A. Naweed). 1 The term train driver varies from country to country and changes from organisation to organisation. Those who operate trains can also be called Locomotive Engineers, Railroad Engineers, Train Operators, Engine Drivers, or Loco Pilots. http://dx.doi.org/10.1016/j.ssci.2015.02.016 0925-7535/Ó 2015 Elsevier Ltd. All rights reserved.
have very reliable knowledge of the routes and a good awareness of the evolving situation (Luther et al., 2007). Given the sighting constraints and requirement for stopping accuracy, railway signalling is designed to preview what the next signal is likely to show. This provides the driver with time to correct their speed and to brake appropriately. Fig. 1 illustrates three examples of how signals in railways are designed. The signals vary in colour and configuration but all three use the same principles for driving safely over railways – that of a multiple aspect design that provides early indication of the cautionary and stop (i.e. danger) signals in a strict sequence. This gives the driver the time they need to reduce the speed of the train and stop appropriately. However, as the distances between caution and stop signals may go on for some time, there is also a requirement for the driver to stay alert. Given the safety imperative for trains to remain within their areas of authority, driving past a signal at danger is understandably one of the biggest failure modes. In rail organisations this is referred to as a ‘‘SPAD,’’ an abbreviation for ‘‘signal passed at danger.’’2 Research is pointing to a common finding that these events do 2 The term ‘‘SPAD’’ is also used to describe situations where the train has exceeded its track authority or limits so it is possible to have a ‘‘SPAD’’ with no signal.
102
A. Naweed et al. / Safety Science 76 (2015) 101–110
Fig. 1. Examples of multi-aspect signalling design. Tracks (a) and (b) illustrate three- and four-aspect signalling conventions on railways in Australia (Sydney, NSW) respectively. Track (c) illustrates four-aspect signalling in New Zealand (Wellington).
not occur equally at all signals but often, are associated with certain conditions. Some signals are identified as multi-SPAD signals or SPAD hotspots,3 which recognises a location or signal that is associated with numerous events, but also reflects chronic issues with the task and/or use of the signal in this location. However, these issues could be associated with a number of different things, such as varying levels of train exposure, problems with signal visibility, higher densities of signals in that location, and so on. For this reason, it can be very difficult to triangulate the cause of signal passed at danger events, and a systems-oriented view of the problem can provide a useful lens with which to examine it through. Whilst the majority of signal passed at danger events do not result in accidents, they do present significant collision risk, thus rail operators have dedicated ‘‘SPAD management’’ teams as part of the systems they use to manage safety. These teams support network recovery when there is an incident, collect event data, investigate causation, and deal with the train drivers after an incident. In most parts of the world, reporting signal passed at danger events is a statutory obligation and part of the licensing agreement for rail operators (Ministry of Transport, 2005). This creates a need to minimise these events in order to meet safety targets, but given that most rail operators are also businesses that profits from punctuality, there is an imperative to minimise network disruption and avoid receiving penalties and fines for late running. 1.1. Complexity in maximising rail network capacities: a systems view In recent years, complexity theory has emerged to advocate a view of systems where complexity is becoming the defining characteristic (Dekker, 2011; Dekker et al., 2011; Goh et al., 2010). This theory describes how failure may emerge opportunistically from the systems put in place to prevent them, but also explores notions of deviancy and deviant behaviour as something that becomes 3 These terms are used in Australia and NZ to describe signals and areas associated with a high SPAD rate. They may be referred to differently other parts of the world.
normalised. The normalisation-of-deviance theory was first developed out of research and investigation into the tragic Challenger disaster in 1986 (Vaughan, 1997). In the social context, the theory describes the effect of people within organisations growing accustomed to a deviant behaviour, so much so that they do not consider it as deviant, even though they far exceed the own rules or codes for elementary safety (Vaughan, 1997). Models and frameworks of risk management in dynamic society such as the Practices Migration model add to these ideas (Amalberti, 2001; Amalberti et al., 2006; Rasmussen, 1997). They suggest that a system can be easily stressed by a rapid pace of technological change, through increasingly aggressive and competitive environments, and from changing regulatory practices and public pressures. All of these elements feature pervasively in the rail domain. It is therefore quite easy to see how these combined productive pressures result in a rapid migration to areas at increasing risk through the standardisation of violations. In this regard, the signal passed at danger can be viewed as a ‘‘wicked problem,’’ meaning that the failure mode is linked with cultural challenges and changing requirements that are often contradictory, incomplete and difficult to recognise (Rittel and Webber, 1973). In this way, SPADs can be likened as a symptom of other problems. The normalisation-of-deviance and complexity theories have since been used to explain how compliance may give rise to hazards through deviant behaviours, and how these may erode to a level that effectively reduces the level of risk reduction afforded by the system. Considering how signal passed at danger events are managed from the systems view may provide new information to the people involved with the issue, and explain how complexity may arise between the immediate and/or remote components of the failure mode. The intersection of different approaches and perspectives used to manage these events may have a tendency to blur the issue, and in some respects, the failure may essentially remain unmanaged. As an overarching theoretical framework, complexity and systems thinking may be used to provide insight into safety decision making.
A. Naweed et al. / Safety Science 76 (2015) 101–110
In Australia and New Zealand, rail operators have a tendency to use single factor accounts of failure for human action or inaction to explain signal passed at danger events (e.g. driver was distracted, driver misread the signal, driver misjudged the braking distance). These can be very judgmental and seldom look beyond the trainsignal conflict point to the wider system to explain potential causes, and in practice, reflect an underdeveloped systems culture. Research has started to examine signal passed at danger events for causation beyond single factor accounts (e.g. Stanton and Walker, 2011) and the context-shaping features of the wider-organisation (Naweed, 2013a) to develop multi-factorial accounts of failure. The relationship between the driver and the signal has been identified as having highly dynamic characteristics; that is to say a relationship characterised by constant change and activity where the driver and the signal is essentially a system for regulating train movement. However, few studies have researched the unseen factors that shape how the signal passed at danger event is managed from a systems perspective. In Australia, New Zealand, and the wider Asia–Pacific region, rail is undergoing job growth; Australia alone has seen exponential increases in the patronage of their passenger operations since 2008 (Australasian Railway Association Inc., 2008; Infrastructure Partnerships Australia and PriceWaterHouseCoopers, 2009). These increases have created a push for rail operators to maximise their network capacities (Infrastructure Partnerships Australia and PriceWaterHouseCoopers, 2009). However, these increases are being seemingly accompanied by increase in SPAD rates (Australian Transport Safety Bureau, 2012; KiwiRail, 2013). Australian rail news wires regularly announce new contracts for the development of rolling stock for major operators, though it is difficult to determine exactly how much rail traffic is growing, and whether this is proportionate to the increases in demand. SPAD rates could also be impacted by changes in technology, timetabling, and management of training programs. Increased reporting figures may also reflect changes in detection and SPAD reporting processes. However, increases in exposure of train services is invariably a contributing factor, and indeed, annual industry safety reports make this link to explain increases in SPADs as being ‘‘due to intensification of services and new services being introduced’’ (KiwiRail, 2013, p. 27). It is therefore important to determine how the trend for maximising capacities could be impacting train driving and the risk of signal passed at danger events. This is particularly the case with
103
rail networks such as those in Australia and New Zealand where train driving is still performed using basic train state features (e.g. speedometer) and traditional navigational parameters (e.g. route knowledge). In these networks, few organisations have safety systems that are able to enforce braking if the speed of the train exceeds the posted limits. Further, none have signalling communication technologies that can manage the amount of headway (i.e. distance) between trains (Naweed, 2013a). To some extent, this begs the question of what safety management systems rail operators have in the place to moderate how the distances between trains are maintained. Researching this issue under the overarching theoretical framework of complexity may expound these issues, and draw insight into the systems and organisational behavioural mechanisms underlying safety decision making and causation of the signal passed at danger. 1.2. Aims and objectives This research set out to determine how the trend for maximising capacities could be impacting the train driving task and the incidence of the signal passed at danger failure mode. The study explored this by determining how train movements and safety risk was managed from the perspective of the train driver, and the implications of this behaviour on the rail organisation. Very little if any research has been performed in this area, so the aim was to undertake a general exploratory study to lead to new knowledge about this research gap and the identification of important variables for future research. The study was driven by the research question: given the trend to maximise network capacities, how is rail safety and performance regulated in the rail domain?’’ 2. Methods 2.1. Research approach Cab rides and focus groups were conducted with passenger train drivers in eight rail organisations across Australia and New Zealand. These were undertaken in a number of metropolitan regions (Adelaide, Sydney, Melbourne, Brisbane, Perth, Auckland, and Wellington). The approach was formed using interviews and observations. Direct methods of talking with experts and watching them at work helped conceptualise the issue in the problem
Fig. 2. Methodological framework designed for the study showing progression from observational cab rides to focus groups and the invention task.
104
A. Naweed et al. / Safety Science 76 (2015) 101–110
Table 1 Overview of focus group. Class of question
Content
Example question
General experience Impression of risk categorisation Prospective causation Task influence
Organisational issues Management, classifications Fatigue, awareness, distraction Service delivery, sustained attention Cab environment, safety systems Personalised countermeasures Invention Task
How does your organisation react to a danger signal being passed? What are your views on the different categories of a signal passed at danger event? What sort of things would you consider to be distracting during driving? How much do you think fatigue contributes to the risk of passing a signal set to danger?
Equipment design Risk mitigation Scenario design, analysis, and review Broader issues
Areas for improvement
Does your train have any special equipment to help you stop at signals? What strategies have you developed or used to help you stop at danger signals? Invent a scenario and driving conditions that may result in a signal being passed at danger. . . How could a driver be better prepared for a signal passed at danger event?
domain (Cooke, 1994), in this case, management of safety risk. Fig. 2 conceptualises the design of the methodological framework and outlines the methods and their purpose. Cab rides were undertaken at each organisation prior to the focus groups. These were performed to understand the rail network and support the focus groups to follow. Notes about the particular rail environment (signals, stopping patterns, etc.) were taken and informal interviews were performed with train drivers. At the time of data collection, drivers performed their task traditionally with rudimentary train state features (e.g. speedometer) in all of the organisations, navigating with only their knowledge of the route and its signalling conventions. Each of the eight focus groups lasted approximately 120 min. A total of 28 drivers participated. The average age was 45 (SD = 8.5; Median 48; Mode 53; Range 24–58). Twenty-two participants had more than ten years train driving experience. Focus groups were semi-structured and included a new driver (<1 year driving) and 2–3 experienced drivers (>10 years driving). Table 1 shows an overview of the protocol. The foundation of the protocol was a specially designed scenario simulation task, referred to as an ‘‘invention task’’ with the participants. This task required each participant to generate a hypothetical signal passed at danger scenario with detail of the decision points, shifts in situation assessment, violated expectations, anomalies, and strategies they would adopt to prevent the scenario from unfolding in the same way. By asking participants to simulate their role in such a scenario, the task stimulated knowledge acquisition from situational insight. The task was a variation on methods that involve walking through issues with participants and describing the steps in problem solving on the way (Cooke, 1994), and it drew on principles from the Critical Decision Method (Klein et al., 1989). However, the task also generated visualisations of SPAD scenarios (see Fig. 5 for example), also known as rich pictures to aid in the data acquisition process. Similar techniques have been developed to externalise mental knowledge and investigate causal relationships (e.g. Checkland, 1980; Monk and Howard, 1998; Naweed and Balakrishnan, 2012; Naweed et al., 2012). Integrating an approach that looked beyond discourse also addressed the difficulty of eliciting tacit knowledge from train drivers (Branton, 1979).
2.2. Data analysis Eight focus group transcripts and thirty scenarios4 were analysed with the aid of NVivo, a qualitative data analysis software for organising, searching, and coding data (QSR International Pty Ltd. Version 10 2014). Data within the transcripts included verbal elaborations of the visualisations obtained from the scenario simulation task. Fig. 3 shows a complete description of the data analysis process. The analysis followed a process of open coding, category 4 Of the 28 participating drivers, two generated an additional scenario hence these data included 30 drawings.
development, and thematic coding. First, informal interviews from cab rides and all conversation from the focus groups was transcribed orthographically. Categories were then drawn from the open coding process, including coding of phrases, comments and features of the transcripts, which grounded findings in the data (Huberman and Miles, 1994). The categories were not predefined, thus they emerged from an inductive analysis. The findings of the open coding process were then developed further and refined into overarching categories, discussed by the researchers, allowing them to agree on coding definitions and to find consensus within the data. The drawings were compared against the verbal elaborations through a process of constant comparison and cross-data validity checks, to allowing for further refining and determine consistency (Patton, 2002). The categories were then grouped into themes, which were used to generate and/or support hypotheses identified in the introduction. As part of this process, these findings were also used to conceptualise a model to outline avenues of future research. 2.3. Ethical considerations Participant recruitment was facilitated by contacts in each of the organisations, first with the dissemination of general information articles, and second, with specific information sheets outlining the study. During the study, participants were not required to answer questions they felt uncomfortable with, and any potentially upsetting topics (e.g. fatalities) were avoided. Data were completely de-identified and comments that could be traced back to an individual were not reported. Cab rides required prior approval. The study met the requirement of the human ethics committee of CQUniversity (approval no: H12/03-033). 3. Results The data collected provided critical insights into how the signal passed at danger event was being managed in Australia and New Zealand and how this influenced the way safety and performance was being regulated. Analysis revealed three themes concerned with: (1) Notions of colour and signal meaning being devalued. (2) The nature of the relationship between a driver and the signal, and (3) Asking a driver if they were fit to continue driving after passing a signal at danger.5
5 Note that a number of threads and subcategories were identified in this work but not all were included in this paper. This is because they were not the focus of this work and/or did not reach consensus within the data enough to support a welldefined theme. Those who want to know more about the other aspects of this research can do so from the following: (Naweed, 2013a; Naweed and Rainbird, 2015; Naweed et al., 2015).
A. Naweed et al. / Safety Science 76 (2015) 101–110
105
conveyed time keeping as the main performance criteria, which attracted train movements that were risky and counterintuitive but nevertheless appeared to evidence on-time running on paper, ‘‘Why do you start a train directly onto a red light when there’s no way for it to go? You’re setting somebody up to fail . . . if you have a SPAD there, you’re going to hit something.’’ The main reason for granting the train positioned on platform 3 with the authority to leave the station was so that it could technically depart on time, even though it would only be moving several train lengths before having to stop again. The signal passed at danger event in this scenario was also referred to as a prospective SPAD hotspot (i.e. an area where a high number of these events may occur over a relatively short period). Most rail organisations were considered to emphasise time keeping performance, creating pressures to perform that ultimately impacted how driving was managed by the driver. 3.2. The nature of the driver-signal relationship
Fig. 3. Description of the data analysis process.
These themes and the main categories are shown in Fig. 4. The method of analysis employed in this study sought to identify consensus in the data. Therefore the three themes presented comprise universal perspectives among the drivers from the organisations. Consensus was found across the variables, including the different States within Australia, Australia versus New Zealand, and with different levels of experience. Each of the themes is discussed and examples from the dataset are provided to support them where necessary. 3.1. Devaluing the meaning of cautionary signals The first theme was concerned with the prevalence of cautionary signal aspects in day-to-day operations. The perception was that the meaning behind cautionary signals had essentially changed. On some journeys it was said to be routine to never see a clear aspect, but despite this, the expectation was for drivers to maintain on-time running, ‘‘That’s the way we have configured the network. We have devalued that yellow,’’ ‘‘We still get hammered on our side about losing time,’’ ‘‘[Control asks] why are you late? Because there’s like four cautions, I had to go through four cautions between this spot and this spot.’’ Data from general focus group discussion and the scenario simulation exercise suggested that the combination of habituation and time pressure motivated drivers to treat caution signals as if they were clear aspects and drive at line speeds, ‘‘If you’ve seen something happen ninety-nine times you expect it will happen the one hundredth time...’’ Risk acceptance was the essence of this theme, and from a systems perspective, pointed to a normalisation of deviance, both in terms of how train movements were managed and the way that the task was regulated. This perspective was found in all organisations and evidenced in the frequency of cautionary signals seen during the observational cab rides. The theme of devaluing signal meaning was related to how safety and performance was being regulated. To exemplify this, Fig. 5 shows a scenario collected in the study. The scenario has also been storyboarded (see inset) to conceptualise the tension between safety and performance in the rail context. The scenario
The second theme provided insight into the nature of the relationship between the driver and the signal, and the impact that driving past a stop signal had on this relationship. Participants made a point of conveying the unique characteristics and properties of each signal, ‘‘Every signal tells you a story.’’ It was not uncommon for drivers to see many hundreds if not thousands of signals in every shift, but passing a signal at danger, even by a metre, was described in terms of emotional and physiological response. All participants indicated they were ‘‘conditioned’’ into seeing a danger signal as equivalent to a ‘‘physical boundary’’, and going past such a boundary would leave them shaken, ‘‘Having this incident rocked my world, shattered it, left me in a very bad place for a while,’’ ‘‘I saw the flash of red out of the corner of my eye. Initially I sat there for about 10 s just gripping the controls thinking, oh God, life’s over,’’ ‘‘I felt terrible. I went I just want to cry! Because I’d made a mistake, like, I’m not – I take pride in my job so making that mistake was like, oh my God.’’ Participants also contextualised their relationships with railway signals in different ways. One group of answers described signals by assigning primacy to their purpose as a ‘‘top priority’’ and as the ‘‘ultimate collision avoidance system.’’ Other categories captured how drivers interacted and managed signals in terms of the different types of intimate relationships they held. One such relationship was about a deep sense of regard and esteem for signals and these categories contained words like ‘‘respect,’’ and statements like ‘‘the most respected thing out there.’’ Another kind projected the effects of observing signal authority on security, and signals were described as ‘‘my life-line’’ or ‘‘my passenger’s safety.’’ Some drivers described their relationship in terms of its role on the broader context of their personal lives, and expressions of the signal as ‘‘my livelihood’’ and ‘‘my bread n’ butter,’’ very were common. Signals were also personified with human or animal attributes and described as ‘‘my colleague’’ and ‘‘my best friend,’’ and in one case ‘‘a large dog,’’ conveying an inscrutable threat. Lastly, the relationship was also expressed in terms associated with spiritual ethics or divine law, and signals were described as ‘‘my religion,’’ and ‘‘God.’’ Taken together, these data pointed to a strong, highly intimate and often complex dynamic underlying the relationship between the driver and the signal. Based on data gathered from the scenario simulation exercise, the density of signals and performance requirements (i.e. on-time running) appeared to attract operational errors, such as the scenario in Fig. 5. However, the intensity of the relationship between the driver and the signal was such that violating its terms appeared to create symptoms of an acute stress response (release of noradrenaline, increased heart rate, constricted blood vessels, change in
106
A. Naweed et al. / Safety Science 76 (2015) 101–110
Fig. 4. Diagrammatic summary of the key thematic findings.
blood pressure), and emotional irregularity (disbelief, fear, panic anxiety). This threatened the performing capacity of the driver by manifesting cognitively (e.g. daze, narrowed attention, confusion, distraction, impaired judgement, disorientation, partial amnesia), and musculoskeletally (e.g. shaking, muscular agitation, delayed response). The intensity was such that the psychological ramifications were said to continue long after the event. In terms of risk management, this translated into use of mitigation strategies that were compulsive in appearance and adopted to remind the driver that they were driving through a caution zone (e.g. counting backwards, singing songs, standing up). 3.3. Yes, I am fit to continue. . . Study data showed some uniformity in the processes adopted to manage the driver following a signal passed and danger. All events were investigated as part of the organisation’s safety management system. This included an on-site ‘‘fact finding exercise,’’ drugs and alcohol testing, an interview with the driver for their recollection of events, the train management techniques they had used, and any factors that could have influenced their decision-making capacity. Details of the signal were captured (e.g. signal type, protection class, sighting distance), to build a profile of the event. The driver’s state of fatigue and shift-work patterns were also recorded. While the fact gathering exercises were relatively comprehensive, there was less uniformity in how operators managed risk on their
network after the event. Detaining the train at the site of the event was not compulsory, and in the majority of organisations, moving the train and relieving the driver from duty at ‘‘the nearest safest location’’ was the preferred mode of managing risk. However, the ability of the driver to continue operating the train immediately after a signal passed at danger event was typically determined over the radio by a train controller6 with a single question: ‘‘Are you fit to continue.’’7 Participants involved in risk management indicated that the ‘‘fit to continue’’ check was used to determine if drivers were ‘‘physically okay,’’ ‘‘unshaken’’ and in a state where they were ‘‘able to concentrate.’’ Participants held views that asking drivers if they were ‘‘fit to continue’’ was confounding and near-preposterous, ‘‘Once you had a serious near-miss, where you can hear fear in the driver’s voice or they’ve had a SPAD, to me they should be immediately relieved from duty,’’ ‘‘If you had a SPAD the last thing you want to do is drive that train and [the driver] should say, no, this is where I stop, I do not go anywhere.’’ In operations where a train guard was present (crew member responsible for platform 6 The term train controller varies from country to country and from organisation to organisation. Those who interact with train drivers during driving and/or control train movements also called Dispatchers, Signallers, Network Control Operators, and Rail Traffic Controllers. 7 The question varied between organisations (e.g. are you alright to continue; are you able to continue) but the essence of what was being asked was generally the same.
A. Naweed et al. / Safety Science 76 (2015) 101–110
work, wheelchair assistance, station announcements), the guard may have been asked to accompany the driver as an ‘‘extra pair of eyes’’ though this control was critiqued, ‘‘I was not in a good place to drive, even though I had the guard next to me the whole way, all the guard’s doing is looking out the window.’’ In operations where the driver was the only crew person aboard the train, the risk was reportedly managed by ‘‘giving the train priority of way.’’ This meant that drivers would continue driving on ‘‘clear aspects and at a low speed,’’ but in practice this did not always happen and drivers considered it a ‘‘weak procedural control,’’ especially with existing network disruption. In both cases, the distance to ‘‘the nearest safest location’’ varied, and could be the next station, or at a location many kilometres away, ‘‘I remember this one driver went from [location A] all the way through to [location B] into [location C] and this guy was rattled.’’ In one case, a participant reported they had driven 20 km to the ‘‘safe location’’ following an event. In some networks, the initial radio-based assessment of being ‘‘fit to continue’’ would also be corroborated with ‘‘a visible inspection by a competent person’’ at the next ‘‘manned location.’’ Thus, a duty manager or a staff member at this location would be radioed and asked to inspect and verify if the driver was indeed ‘‘fit to continue.’’ The question ‘‘are you fit to continue,’’ reflected a paradox in the safety management systems where the check was adopted. This was evident when participants indicated that answering the question ‘‘are you fit to continue’’ with a ‘‘yes’’ was contrary to what seemed intuitively right or correct, but almost all drivers were likely to answer it with a ‘‘yes’’ no matter how compromised they felt. This was underpinned by strong motives to comply from inward projections of blame, but also because they feared that they would be seen to be uncooperative, and believed it could be used against them in the ensuing investigation. This was linked with worries of being ‘‘labelled as someone who has had a SPAD’’, and the notion that ‘‘a SPAD needs to be paid off’’ to recover reputation, ‘‘There’s a particular scare-factor management put around with SPADs, you know – you do this, you get a bell plug.’’8 The fear of being seen to not cooperate was particularly apparent when a signal passed at danger was categorised as a technical SPAD by the controller; this is where the signal switched from proceed to danger unexpectedly, presenting no opportunity to prevent the outcome. However, experiencing an incident under these conditions was still considered to produce the same emotional response, ‘‘I haven’t had a SPAD yet. . . had a few close calls, had false SPADs where you get the same sort of adrenalin rush/feeling.’’ In some cases, it was reportedly worse because it was completely unexpected. Some participants indicated that the question was just a formality, and after such a SPAD event, they were expected to provide no resistance, ‘‘Train control puts pressure on the driver to proceed.’’ Participants who had experienced passing a danger signal provided accounts of the poor risk controls that were in place and admitted to having violated many driving rules during the postincident journey, ‘‘I really shouldn’t have been driving. I made a lot of mistakes driving back to [the location] that I would never normally make. If there’d been management in there with me, they would have done me for half a dozen other things – I won’t go into them, but it’s – it was traumatic.’’ Additionally, verifying the initial radio-based determination for being ‘‘fit to continue’’ with a visual inspection raised concerns of non-objectivity, not only because it occurred after the fact, but because the ‘‘competent person would then [also] have to manage disrupted passengers.’’ From the perspective of organisational behaviour, the contradiction of asking the driver ‘‘are you fit to continue’’ is the essence of this paper in 8 A bell-plug is a key that controls the door on trains. Here, the term ‘‘bell-plug’’ was used as a euphemism for demotion, and being redeployed into lower-grade service as a train guard in the same organisation.
107
so far as the driver is very unlikely to be in a ‘‘fit’’ state of mind to determine if they are indeed ‘‘fit’’ to continue. From a systems view, these findings support the notion of a normalisation of deviance in rail risk management processes, but also where operational complexity is becoming the defining characteristic. 4. Discussion The results presented data for different levels of management associated with, or directly influenced by, how railway operators managed safety risk on their networks. These were concerned with how train movements were managed to maximise capacities, how drivers interacted with signals, and how safety risk was handled after a signal passed at danger event. The first and third themes were intertwined with performance and connected with safety in a highly competitive dynamic. The nature of the driver-signal relationship was a more personal introspection of this that erred towards safety, but some of this was also influenced by performance (e.g. ‘‘my bread n’ butter’’, ‘‘my livelihood’’). The first theme indicated that current rail safety management systems are trying to address SPADs without fully understanding the causes. Signal integration and redesign practices may not be supporting how drivers should be driving in the wake of increase in train services, and simply adding another signal between existing signals to separate trains may not have the desired result. The demand for service delivery had created a drive to maximise network capacity, but few networks appeared to have undertaken a review or analysis of signal infrastructure with the aim to optimise how the driver and the signal interface with one another, or the way that timetables are designed. From the systems view, it may encourage deviant behaviours or unsafe acts. For example, in a number of scenarios, drivers intentionally broke safeworking protocols such as answering or indeed making a call to train control when unsafe to do so. This issue linked back to performance pressure, which destabilised core driver-signal dynamics, such as remembering the colour of the last signal, and retaining an awareness of what the next signal aspect was likely to be. The highly intimate and personal nature of the relationship between the driver and the signal was not altogether surprising, given the relative importance of signal authority, frequency of signals, and the isolation of the cab environment. Participants described their relationships in different categories but every response evidenced the significance of signals to the driving role, and the gravity of this to the life of the driver. There was a singular weightiness to this relationship that gave unique insight to train driver identity, but given the emotional investment in the task, participants viewed a cost to breaking the terms of the relationship (beyond safety). Some of the relationships were person-oriented (e.g. costs to the driver) whilst others were system-focused (e.g. cost to the system), thus it is entirely possible that they could also define behavioural implications in SPAD situations. The concern for being ‘‘labelled’’ a driver who has had a SPAD, and the idea that this would need to ‘‘paid off,’’ appeared to breed a culture of taboo in the industry and strong convictions of punitive action to follow. The intimate nature of this dynamic and the potential for disrupting it may have been related to compulsive behavioural traits observed in some of the risk mitigation strategies (Naweed et al., 2015). Finally, the theme ‘‘yes, I am fit to continue,’’ reflected negative attitudes towards this aspect of risk management, most of which appeared to be justified. However, there could also be several reasons why not moving a train immediately after a signal passed at danger encroaches on rail safety. If a signal is passed at danger on open track (i.e. not at a platform) waiting for a recovery team to arrive may breed unrest or disquiet among passengers, attracting the desire to open carriage doors and egress directly into the
108
A. Naweed et al. / Safety Science 76 (2015) 101–110
railway corridor. Equally, leaving the driver on their own for a prolonged period before relieving them of duty could also have a negative personal impact. The key point here is that the intent to move the train to a ‘‘safe location’’ invariably runs parallel to performance, but it is also a safety issue, thus a well specified rail safety management system would need to consider the competing demands specifically for their networks. This is an example of where operational complexity is becoming the defining feature of the domain and creating deviancy. As a status check, ‘‘are you fit to continue’’ also contains traces of strategic ambiguity; that is, a deliberate use of ambiguity in strategic communication in order to create a space (Davenport and Leitch, 2005). As a cohort, train drivers are very unlikely to admit to being upset by a SPAD occurrence, particularly when talking to a controller immediately after the event. It is also critical to understand that such an event is likely to produce the same stress response regardless of whether or not the driver was at error. The assumption that drivers should be able to continue if an event was caused by technical error does not recognise the physiological,
physiological, and emotional instabilities. In considering the response to a signal passed at danger event as a management issue with differing needs and viewpoints, it would be useful to ensure that the response is adequately handled from a psychosocial and cultural perspective. A driver should feel to be able to say ‘‘no’’ when asked if they are ‘‘fit to continue’’ without fear of punitive action or being perceived as an inconvenience. In the context of this study, ‘‘are you fit to continue’’ was more about discursive closure and while it appeared to present a delegation of authority, the question was perceived as a discursive transformation that supported the organisation’s own performance goals. 4.1. Exploring new approaches and potential solutions This paper reports central themes that came out of the study. It is important to recognise that a variety of human factors issues can contribute to the risk of passing a signal at danger, such as fatigue (e.g. Dorrian et al., 2007), and indeed, a number of these were mentioned over the course of the focus groups. However, they were not
Fig. 5. Example scenario collected during the study depicting safety and performance constraints. Inset storyboard manipulation shows four key steps as the scenario unfolds (note: the direction of travel is from the left to right).
A. Naweed et al. / Safety Science 76 (2015) 101–110
identified as direct causes in the scenario simulation exercise and were therefore not reported. Fig. 6 presents a conceptual model derived from the study that has been constructed to outline future research avenues based on the findings. As shown, a number of important relationships were synthesised from this study, and those associated with the driver-signal and the signal passed at danger were couched within the broader topic of organisational behaviour. The relationship between the driver and signal was very dynamic, as was the incidence of passing a signal at danger. This influenced organisational behaviour, therefore change and development in rail organisations would benefit from understanding the nature of the relationships caught between these dynamics. In this case, the relationships between safety versus performance, the driver and the controller, and error producing conditions. This study was couched within a systems view and brought out different levels of the system to understand how existing operational complexity may impact the problem. However, as outlined in the introduction, the problem is a wicked one, and more than likely involves specific implications, but given the nature of these issues they are difficult to identify. Specific recommendations for concentrating research and practice towards overcoming the problem is given in Fig. 6, according to the various aspects of the system. Based on this study, future research may be explored through training and pedagogical solutions that focus on self-regulation and targeted training, whereas research of the failure mode may be undertaken through human resources management, on issues such as post-incident risk. As shown in the model these areas are also dynamic, such that driver self-regulation will impact crew resourcing and so on. A more specific avenue of research in the area of self-regulation may involve the development of evidencebased techniques or strategies for promoting meta-awareness of cognitive state immediately after a SPAD. This would help the driver determine their psychological condition and limiting factors. The model also proposes keys areas where research may use this information to pursue change and development, such as organisational culture and risk modelling. The aim of the model is to stimulate further thinking and research, but a brief account of potential human resources and training-related initiatives follows. 4.1.1. Safety and performance training modules Currently, the bulk of train driver training in Australia and New Zealand is focused almost entirely on acquiring route knowledge and learning how to operate a train. This then connects with an understanding of driving strategy (also referred to as ‘‘the methodology’’) which is needed to regulate how driving is performed.
Fig. 6. Model outlining key areas for future research.
109
There is nothing very wrong with this approach – it has been the way of the traditional train-driving world for a while. However, with the push for maximising capacities, it is important to implant content that will render drivers and controllers more aware of the associated big picture elements, which impact how they personally view and manage their tasks. Including a safety and performance module that openly discusses these issues and conceptualises timetabling design from disparate perspectives may create a better understanding of how performance can be managed in different situations. This may induce a better tolerance to time pressure and engender more intelligent self-regulation, and create more commitment to professional driver training. The aim would ultimately be to foster a more erudite understanding of the synergy in the safety and performance relationship. 4.1.2. Targeted simulator-based learning of SPAD scenarios Further to the use of more specific safety and performance training modules, more informed techniques to transmit the actual experience of passing a signal at danger may improve the way a trainee responds to it in the real-world. Currently, the safety implications and nature of SPADs are transmitted in the classroom environment and acquired through stories and cautionary tales as part of the organisational cultural zeitgeist. The adoption of train simulators to enhance learning is a fast going enterprise but there is evidence to suggest they are not being utilised to their full potential (Naweed, 2013b). It is proposed that organisations use the safety of the simulated environment to try to emulate the experience of a signal passed at danger event. This is very much a fringe solution and necessarily involves some deception to set up the scenario appropriately, but the essence is to target learning of the signal passed at danger failure mode to provide the most informative learning experience. However, this method implies the implementation of a learning and development scenario that would be invariably based on error, and therefore out of phase with the dominant rail philosophy that subscribes to safety procedures. 4.1.3. Crew resourcing and supporting the train driver post-incident Clearly, one of the most difficult issues to address is the management of post-incident safety risk inherent to the signal passed at danger event. Given what was identified in the study thematically, better support and/or resourcing to determine if the driver is ‘‘fit to continue’’ is advocated. This may be adopted by better awareness of the issue in train control, and by providing controllers with basic trauma response skills. In environments where the driver is not the only crewmember, the train guard may also be taught these skills to better support the driver. 4.1.4. On-time running Given that on time running was found to be a major performance-shaping characteristic in this study, new methods and approaches for the way that organisations manage timetabling should be explored. One such area has been to investigate if the ‘‘turn-up and go’’ model typically used by bus networks could be applied to rail. This approach has received serious consideration in some Australian rail networks and replaced the model of explicit punctuality (e.g. a train will arrive at 13:11) with the indication of service delivery within a certain timeframe (e.g. a train will arrive roughly every 15 min). Whilst this initiative would invariably build resilience into timekeeping and potentially change how time pressure is perceived (Naweed and Rainbird, 2015), it may not necessarily change the risk profile. From the systems view of complexity, the initiative could reduce perceived time pressure for drivers but also displace it and create new issues. For example, the initiative may drive further increases in train services on the rail network, and therefore, exacerbate the risk associated with
110
A. Naweed et al. / Safety Science 76 (2015) 101–110
maximising capacities. Understanding the impact of changing current on-time running models is an empirical question that needs to be researched. 4.1.5. Systems and organisational culture Many of the findings in this paper point implicitly to a lack of or an underdeveloped systems culture in the rail domain where safeworking is defined in very binary terms. In practice, decision making during train driving is a skilful response to risk where drivers apply a flexible boundary to their assessment and management of risk (O’Keeffe et al., 2015). Currently, the approaches to deal with SPADs have a tendency to be judgemental and seldom look beyond the train-signal conflict points to the wider rail-system. These approaches are also associated with a culture that perceives a significant power differential between the driving function and other related groups (e.g. signaller, controller) when it is far more accurate to define train movement as a product of a coordinated team effort. Encouraging drivers to impose opinions of whether they believe themselves to be fit to continue after a SPAD, without real or perceived risk of punishment, requires development in systems and organisational culture. Developing and applying rail crew resource management practices, the equivalent of crew resource management in the aviation domain, may be one way towards achieving a mature systems and organisational culture. Recent research in this area reveals that crew resource management training can have positive benefits at the industry and the individual level (Roop et al., 2007). It can also help railway operators improve their understanding of the causes of SPAD incidents. 5. Conclusions This paper presented findings associated with different levels of risk management in and around the critical rail failure mode of passing railway signals at danger. Data analysis revealed three themes associated with how railway operators managed safety risk on their rail networks, including the devaluation of signal meaning, the intimacies in the driver-signal relationship, and the perceived confound of asking a driver if they could continue driving after having such an event. These themes were synthesised into an overarching narrative that provided insight into how safety and performance is managed in the rail domain, together with a model outlining key areas for future research. Although these findings were based on subjective and nuanced perspectives of risk management, they were found in eight organisations across Australia and New Zealand, and in the wake of documented increases in rail industry job growth, warrant further research. Future work may explore the relationships between the themes that were revealed to determine how signals are treated by individual train drivers, and how this affects the tendency to self-identify as fit to continue. Acknowledgements The authors gratefully acknowledge the CRC for Rail Innovation (established and supported under the Australian Government’s Cooperative Research Centres program) for the funding of this research; Project Number: R2.116 SPAD-risk Management & Mitigation. The authors are also very thankful to the train drivers that took part in the study, and gratefully acknowledge the assistance of rail organisations in Auckland, Wellington, Queensland, New South Wales, Victoria, South Australia, Western Australia, and Karratha.
References Amalberti, R., 2001. The paradoxes of almost totally safe transportation systems. Saf. Sci. 37 (2–3), 109–126. Amalberti, R., Vincent, C., Auroy, Y., Maurice, G., 2006. Violations and migrations in health care: a framework for understanding and management. Qual. Safe. Healthcare 15 (1), 66–71. Australasian Railway Association Inc., 2008. A Rail Revolution – Future Capability Identification and Skills Development for the Australasian Rail Industry. Canberra, Australia: E. a. W. R. Department of Education. Australian Transport Safety Bureau, 2012. Australian Rail Safety Occurrence Data 1 July 2002 to 30 June 2012. Canberra, ACT: ATSB. Branton, P., 1979. Investigations into the skills of train-driving. Ergonomics 22 (2), 155–164. Checkland, P., 1980. Systems Thinking, Systems Practice. Wiley, Chichester, UK. Cooke, N.J., 1994. Varieties of knowledge elicitation techniques. Int. J. Hum Comput Stud. 41 (6), 801–849. Davenport, S., Leitch, S., 2005. Circuits of power in practice: strategic ambiguity as delegation of authority. Organ. Stud. 26 (11), 1603–1623. Dekker, S., 2011. Drift into Failure: From Hunting Broken Components to Understanding Complex Systems. Ashgate, Surrey, UK. Dekker, S., Cilliers, P., Hofmeyr, J.-H., 2011. The complexity of failure: implications of complexity theory for safety investigations. Saf. Sci. 49 (6), 939–945. Dorrian, J., Hussey, F., Dawson, D., 2007. Train driving efficiency and safety: examining the cost of fatigue. J. Sleep Res. 16 (1), 1–11. Goh, Y.M., Brown, H., Spickett, J., 2010. Applying systems thinking concepts in the analysis of major incidents and safety culture. Saf. Sci. 48 (3), 302–309. Huberman, M.A., Miles, M.B., 1994. Data management and analysis methods. In: Denzin, N.K., Lincoln, Y.S. (Eds.), Handbook of Qualitative Research. Sage, Thousand Oaks, pp. 209–219. Infrastructure Partnerships Australia, & PriceWaterHouseCoopers, 2009. Meeting the 2050 Freight Challenge. Sydney, New South Wales: P. Australia. KiwiRail, 2013. Annual Report 2013.