Keywords

1 Introduction

A signal passed at danger (SPAD) event is defined as a train passing a red ‘stop’ signal into a section of track without authorisation to do so [1]. The consequences of a SPAD event can vary depending on the situation, they are categorised using the probability and severity of potential outcomes and the distance the train travelled past the signal. In the highest category (A), SPADs can lead to:

  • Injuries and deaths of both passengers and train staff;

  • Delays within the network costing the train/freight operating company (TOC/FOC) money and damaging their reputation;

  • Damage to the train, track or signal costing the TOC/FOC/Network Rail money and reputation.

Lowe and Nock [2] estimated that each category A SPAD costs £22,000, therefore, in the year 2007 alone, the annual cost of category A SPADs was £7 million. The potentially severe consequences and regularity provide good reasons for investigating SPADs.

Findings from a literature review identified that research has been carried out to improve compliance of drivers and railway staff with reporting regulations and practices but there is very little research on how the reporting system is structured and its effectiveness. Several researchers have highlighted the need to learn from past incidents and near misses [3, 4]. Therefore, this paper will focus on the current SPAD reporting system using different analytical approaches.

1.1 Objectives

The objectives of this study are to:

  1. 1.

    Analyse a set of SPAD incident reports (n = 46) to determine common contributory findings

  2. 2.

    Apply and compare the outcomes from using three systematic accident analysis models to extract and identify common causal factors leading to SPAD incidents.

2 Method

Network Rail provided access to forty-six SPAD incident reports from eight different train operating companies (TOCs; n = 24) and six different freight operating companies (FOCs; n = 22). All the incident reports provided had already been assessed by Network Rail to calculate SPAD risk, all reports were reported as category A.

Currently the railway industry uses the Incident Factor Classification System (IFCS) to analysis incident reports, therefore this method of analysis was chosen along with AcciMap and the human factors analysis and classification system (HFACS). AcciMap and HFACS methods were chosen based on the findings of a review on system accident analysis methods and were deemed to be most suitable for the data given. Therefore, all three system accident analysis methods used the same forty-six incident reports to allow comparison of the three methods and their subsequent results.

IFCS was developed by a team at RSSB [5] and is used to classify human error and identify underlying factors relating to the incident. The aim of IFCS is to support and promote key human factor issues in relation to accidents, to allow cross industry learning via causal trends. The intended users are incident investigators, to allow incidents with similar causes to be easily accessible so previous work and recommendations are not repeated or contradicted. Validation of the IFCS was undertaken using 300 pre-evaluated incident reports and applying the IFCS before being implemented within the railway incident investigation process.

The IFCS analysis involves analysing an incident report, highlighting any factors which are human error factors or incident factors. These two categories have further sub categories. Any factor which can be learnt from and describes a system is an incident factor; any factor which is due to a human action is a human error factor.

RSSB have developed specialist computer software to aid the analysis and presentation of the IFCS results. Due to not having access to this software, the 46 SPAD incident reports were analysed by two investigators then combined to minimise the effects of subjectivity and bias. The relevant factors were provided to the researcher on a Microsoft Excel spreadsheet and imported into NVivo for further analysis. The results were then published in table format to allow visual representation of the sub-categories of the human error category and error type of the incident factor category.

The AcciMap method was developed by Svedung and Rasmussen [6] to graphically represent the ‘causal flow of accidents, analyse hazardous work systems and…. interactions’. The AcciMap provides a high level of flexibility within designing the levels and categories/conditions, allowing it to suit a wide range of uses and domains and making it a very popular analysis tool to use [7].

For the AcciMap analysis factors were broken down differently to the IFCS analysis. Normally the bottom layer on an AcciMap is a timeline with an ‘individual’ layer above, however, due to the AcciMap needing to illustrate the findings of forty-six incident reports, a timeline level could not be used. Instead this level was replaced with an ‘action layer’ with an ‘individual’ layer above. The ‘individual’ layer shows all factors which relate to the individual, be that a driver, signaler or conductor. Above the ‘individual’ layer is the ‘team/group’ layer with ‘management’, ‘organisation’ and ‘environment’ representatively higher. After associating each factor with a layer, relationships were then illustrated via lines linking factors together. This stage was done on A3 paper before being imported into Microsoft Visio.

HFACS was developed by Shappell and Wiegmann and is heavily influenced by Reason’s Swiss Cheese model [8]. Reason’s Swiss Cheese Model [9] is described as four levels of human failure – unsafe acts (active failures), preconditions for unsafe acts (latent failures), unsafe supervision (latent failures) and organisational influences (latent failures). Each layer influences the next, either positively or negatively and when a failure occurs at each layer an accident occurs [10]. The aim of HFACS is not to place blame on one factor but to investigate causal factors.

The HFACS has four identical levels to the Swiss Cheese Model that can be further defined using categories similar to the IFCS. Unsafe act is level 1 and is further separated into errors and violations, using the terms skill-based errors, decision errors, perceptual errors, routine violations and exceptional violations. Level 2 is preconditions for unsafe act which is separated into three categories; environmental factors, condition of operators and personal factors. The next level, level 3, is unsafe supervision; this is broken into inadequate supervision, plan inappropriate operation, fail to correct known problem and supervisory violation. The final level to the HFACS is organisational influences, with resource management, organisational climate and operational process sub-categories.

The result of HFACS analysis is a graphic representation of the layers in which if one factor malfunctions or fails on each level then an incident can occur. However, by highlighting prior to an incident the risk each factor has on the chance of an incident occurring, the risk can be reduced. Alternatively, retrospectively conducted HFACS will highlight the failed factors so work can be conducted to ensure it cannot happen again.

The forty-six incident reports were analysed and causal factors were categorised under the HFAC levels. To allow for editing of factors this was conducted first on a whiteboard before computerised using Microsoft Visio.

3 Results

3.1 Incident Factor Classification System

There was a wide distribution of the occurrence of factors throughout the six human factor categories and ten incident factors. As can be seen in the graph below (Fig. 1) the three human error categories which occurred the most throughout the reports are perception slip, decision error, route violation and action slip (n = 61, 35, 19 and 19 respectively). The most common incident factors were personal, communication and knowledge, skills and experience factors (n = 49, 38, 37 respectively). Factors related to the human error categories appeared 168 times through the incident reports, whilst 228 factors were associated with the ten incident factors.

Fig. 1.
figure 1

Distribution of occurrence of causal factors

Full size image

Figure 1 also highlights the factors which were not commonly reported within the incident reports. Teamwork appeared in less than 1% of the overall number of factors for the incident reports. Information and workload combined covered a mere 7.5% of the total numbers. Whilst in the human error categories memory lapse was the least mentioned as a causal factor and only covered 8.3% of the total. Each of the categories were broken down further within the analysis to establish factors which were contributory to the incident.

Perception slip (n = 61) is split into ‘error in interpretation of visual stimuli and ‘error in searching for visual stimuli’ (n = 35, 26 respectively). Most errors in interpretation of visual stimulus were due to the driver responding correctly to the incorrect signal (n = 23). Of these eleven cases were due to misreading or reading across the signal whilst twelve were due to the driver incorrectly predicting what the signal would be. Whilst the most common errors in searching for visual stimulus were more spread out across a variety of causes: failure to locate relevant signal/AWS magnet, speed restrictions and distraction by other lights were all the most popular causes (n = 5 for each group). In four occasions the driver claimed their focus was on the speed restriction rather than the signal, whilst one driver failed to locate the speed restriction for the section that the signal was in. Driver distraction due to light stimulus was also highlighted as an issue with three occasions of the signal being in the same line of sight as another signal and twice a driver became distracted by another light stimulus.

Decision errors were split into four different groups: error in decision, error in strategy, error in judgement and signal predicting (n = 8, 6, 7 and 14 respectively). Signal predicting is the highest occurring error and arises from a driver reacting to what they expect to see rather than what they see. For example, a driver may remember the normal pattern of signals within an area, so they react to what they are expecting to see, not what is there. Thus, they may not slow the train down appropriately, meaning it’s impossible to stop before passing the signal at danger. A common theme within the decision error category is that errors are often based on the correct knowledge and information and sound recollection but the knowledge and information is applied wrong due to the situation.

The ten incident factors focus on management and system errors and the spread of occurrence amongst these factors is more variable than the human error factors. Personal factors were the most common and are those which can affect an individual’s ability to maintain attention and focus resulting in fatigue and/or poor physical and mental wellbeing. Fatigue and distraction are the most common causal causes (n = 10 and 12 respectively) due to a range of issues covering complacency, overtime and family issues (n = 1, 2, 4 respectively). Interestingly, less breakdown was available of causes for this factor in comparison to the human error categories. Most reports which mentioned fatigue as a factor did not mention the cause of the fatigue (n = 6).

Issues due to verbal communication were separated during analysis to before and after the occurrence of the SPAD event. Errors which occurred before the incident predominately lie in communication between the driver and driver manager (n = 7), with only one case of communication error between driver and signaller. The most common errors were within communication of information and knowledge (n = 6).

However, after the incident all but one error was due to the communication between the driver and signaller (n = 13). The reports vary in detail but 77% of errors in communication between driver and signaller after a SPAD incident is due to poor or lack of communication. Miscommunication was also considered to be a causal factor (n = 4) but it was not clear from the reports who was involved, just that it occurred before the SPAD event. Both before and after the SPAD occurrence there are cases where communication guidelines are not followed and either one or multiple people within the line of communication fail to repeat back what they have heard before continuing (before n  = 7, after n = 11). This safe guard is in place to aid communication and prevent misunderstanding and poor communication levels.

3.2 AcciMap

The complexity of the railway system is reflected in the AcciMap analysis, with 150 causal human error factors and relationships depicted in the Human Error Accimap and 287 causal incident factors and relationships depicted in the Incident Factors AcciMap. The two factor groups were categorised into levels and then subsequently grouped into common factor groups, where possible any link to an IFCS factor was included to help in comparison of the two techniques (Fig. 2).

Fig. 2.
figure 2

Human error AcciMap.

Full size image

The human error AcciMap illustrates a skewed distribution of causal factors amongst the levels, with more factors present in the action and individual levels. The action level contains eleven common factor groups with a subsequent fourteen related IFCS factors groups. In total seventy-seven contributory factors were categorised to this level. Responding correctly to an incorrect signal due to a perception slip and signal predicting caused by decision errors are the most common contributory factors at this level (n = 23, 14 respectively). Factors at this level are all direct causation contributory factors e.g. the final factor that caused the incident to happen. The individual level contains less common factor groups (n = 7) and less IFCS factor groups (n = 10) and covered fifty-eight contributory factors. Decision errors within decision, judgement or strategy were the most common (n = 21) but within this error three factors were also routine violations. Errors in decision, judgement and strategy were linked to signal predicting, speeding and braking errors within the action level.

The remaining fifteen contributory factors were spread amongst the remaining levels – group/team, management, organisation and environment. The most common IFCS factor group was situation/exceptional violation – violations of procedures and rules which are out of the driver control such as issues with late trains, equipment failure and poor railhead conditions. This skew in the presentation of contributory factors illustrates that many of the contributory factors are related to the individual or in this case, the driver and can be seen in Fig. 2.

The AcciMap also highlights the relationships between common factor groups. Although interestingly there are limited relationships on an intra level (common factor group on one level with another common factor group on same level) throughout the AcciMap. Many relationships are on an inter level (common factor group on one level with another common factor group on a different level) illustrating that a factor can influence factors on other levels (Fig. 2).

The incident factor AcciMap is a lot more complex diagram which at a glance shows no skewing towards any level. In comparison to the human error AcciMap there is an absence of factor groups within the action and group/team level (n = 4, 6 respectively), however these two levels still include 58 contributory factors across 14 IFCS factor groups (Table 1).

Table 1. Distribution of factors in Incident Factor AcciMap
Full size table

The individual level contains the highest amount of common factor groups, IFCS groups and causal factors (n =  19, 28, 114 respectively). No common factor group is duplicated from the human factor AcciMap and the most common IFCS groups are personal and communication. Personal factors include needing a cold drink, fatigue and health and commonly were related to communication due to these personal factors often not being communicated until an incident has occurred. The abundance of relationship lines to and from this level illustrates the influence factors on this level have on the factors of other levels.

Unlike the human factors AcciMap, the management, organisational and environment levels are more heavily populated. Again, the IFCS factor of communication is common within the management level, often being attributed to issues with information. Communication issues were most likely to be between driver and signaller (n = 15) than driver to another railway colleague - driver and driver manager (n = 7), driver and conductor (n = 1). The management level highlights issues with training, non-technical skills and scheduling/work load.

Issues with reporting and equipment faults within SPAD protection equipment, trains, railhead, brakes and signals are organisational issues due to the financial and organisational aspects behind these factors. Maintenance of current infrastructure and finance to upgrade that infrastructure requires planning from a higher level than local management. Therefore, unsurprisingly the most common IFCS factors on this level are equipment factors and supervision and management factors.

The environment level demonstrates factors outside the drivers control which can contribute to an incident. All common factor groups within this level shared the same IFCS factor of work environment, only thirteen examples of the work environment being a causal factor were found within the analysis. However, this level has relationship lines to all the other levels, demonstrating how potentially powerful this level is. Weather conditions and cab design were common factor groups which are interlinked due to temperature, noise and design being common causal factors. It appears from the reports that at times of extreme weather the cab design is less than favourable and can cause distraction at an individual level. Lighting, both internal and external could also be causal due to the interference with signal sighting.

The incident factor AcciMap illustrates a variety of intra and inter relationships, demonstrating that a contributory factor can affect factors both within the same level and different level. Therefore, indicating that the incident factors have a higher ability to influence more contributory factors.

3.3 Human Factors Analysis and Classification System

A graphical representation of the HFACS is presented in Fig. 3, demonstrating how incidents occur due to the influence of multiple factors across multiple levels.

Fig. 3.
figure 3

HFACS

Full size image

The ‘unsafe act’ is the final defence layer meaning these are often described as the main causation for an incident as it’s the most obvious and what people can see. For example, with the use of on-board train recorders it is simple to see if a braking or speed error has occurred. Also, drivers within interviews may try to explain why the incident happened, often resulting in the cause being stated due to a specific driver error. The HFACs analysis categorises potential errors into five main categories which coincidentally coincide with the IFCS factors; skill based errors, decision errors, perceptual error, routine violation and exceptional violation.

For there to be an error to occur within the ‘unsafe act’ level there must have been weakness or failings within the previous three levels – preconditions for unsafe act, unsafe supervision and organisational influences. Preconditions for unsafe act in relation to signal passed at danger events include both factors outside the driver’s control (environmental factors, condition of operators) as well as personal factors.

Yet prior to this an error must occur at both the ‘unsafe supervision’ and ‘organisational influences’ levels. At the highest level (organisational influences) errors include planning, budgets and safety culture/climate and can occur on a national scale. Whilst ‘unsafe supervision’ errors can occur on a local scale due to inadequate supervision or supervisory violations, failure to correct a known problem, or planning an inappropriate operation.

The HFACs model highlights that it is possible for the driver to be doing everything correctly and a SPAD can still occur. For example, issues with signal sighting, (preconditions for unsafe act), can lead to the driver not being able to locate the signal (unsafe act) as the view is being obstructed by foliage or another signal. This stems from the ‘unsafe supervision’ layer of ‘failing to correct a known problem’. But can be further linked to the first defence layer of ‘organisational influences’ by poor planning that the foliage has not been trimmed back (Fig. 3).

4 Discussion

The incident reports were found to vary in all aspects from detail and content to the reporting structure, and also within the same train or freight operating company (TOC/FOC). This proved a limiting factor for all analysis methods as analysis could only take place on what the railway investigator had written.

The style of writing within the incident reports varied from a ‘keepsakes’ or note style to detailed, cohesive writing. Whilst both styles are valid reporting styles, the former aids those who have prior knowledge of the incident, and hinders those who do not, as information or description of the incident is limited. Reports in this style were often found to state reasons rather than investigate reasons, yet this could be due to this information being missed from the report. This ‘unwritten’ content may be implicit for those ‘in the know’ but difficult for an unconnected reader to understand. For example, in one report under ‘immediate cause’ the following was written ‘the immediate cause of this incident was the driver passing…at danger without authority’. Whilst providing a definition of a SPAD event it failed to inform the reader of the immediate cause to the SPAD.

The structure varied amongst TOCs and FOCs and sometimes varied between the same TOC or FOC. Non-technical skills and IFCS analysis were included in some reports but was not a common feature throughout the reports, in some cases the sections were left blank or the writer confuses the terminology between the non-technical skill terms and IFCS terms.

Therefore, due to the reports being written by experienced employees within the railway network, experienced readers will be able to understand the unwritten assumptions, however readers with limited experience could link factors which, in reality, cannot be linked. However, despite these drawbacks within data extraction, all three analysis methods were fruitful in data extraction and categorisation of the subsequent causal factors. The IFCS extracted 396 causal factors from the 46 incident reports, whilst the AcciMap analysis extracted 437 causal factors. The HFACs analysis does not quantify any factors but was efficient in categorising the causal factors.

The IFCS and HFACs analysis provided criteria for categorising factors whilst the AcciMap analysis provided a framework to place causal factors. Due to the subjective nature of extracting and categorising the factors from the incident reports, there were two coders to ensure that each extraction was associated with the correct factor for all the methods of analysis. The criteria provided by ICFS and HFACs varied in terms of detail, with ICFS providing the most detailed criteria for categorising. Whilst this initially aided analysis, there were cases where a causal factor did not fit ‘neatly’ into a predetermined term or fitted between two or more terms, groups or levels. When similar cases arose in the AcciMap analysis, the causal factor was placed between levels to illustrate it should be considered on both levels. The predetermined groups within the HFACS analysis are the easiest to use as it allows for duplicate factors to appear on the same or other levels. This duplication of factors or presence of very similar factors on any level suggests that this factor is a critical causal factor worthy of further investigation.

It was evident from the results that the methods varied in terms of presentation and degree of detail. The AcciMap was the only method of analysis to illustrate relationships on a multiple scale which allows an expanded view of which factors can affect the other, albeit not directly showing how they can. Whilst this is positive on an AcciMap analysis containing few factors, it can complicate and hinder understanding when analysing large numbers of factors as seen in the incident factor AcciMap (Fig. 2). IFCS and HFACs do not illustrate relationships but in the case of IFCS this could be caused by not having access, therefore not using, the official IFCS analysis software and database. HFACs analysis does not illustrate relationships with lines, which may be considered an advantage as the user/reader will not be prohibited by visual lines that may enable a more thorough investigation of the incident.

Whilst the HFACS analysis, arguably presents the degree a contributory factor can influence other contributory factors, all system accident analysis methods showed this to some degree. The HFACS analysis illustrates that whilst a factor may be the factor that causes an incident, it is not the only contributory factor. For failing to occur on the ‘unsafe act’ level there must be issues and failures on the other three layers. The AcciMap illustrates this with the relationship lines and the IFCS demonstrates it by the inclusion of the same factors under different categories between the human error factors and incident factor groups.

5 Conclusion

The incident factor classification system (IFCS), human factor analysis classification system (HFACS) and AcciMap methods are successful in highlighting causal factors to recent signal passed at danger events on the UK railway network. However, as Gibson et al. [5] states when introducing the incident factor classification system; the system has been designed so it can be altered to be adaptable to the changes within the network. Presuming that no changes to the incident factor classification system have been made then although it’s a modern system the addition of further, less ambiguous guidelines and definitions could remove some of the subjectivity.

All the methods have different advantages and disadvantages. A weakness within the incident factor classification system is the inability to analyse and record interaction between the factors. This is an advantage of the AcciMap analysis but also a weakness, as with complex systems such as the multifactorial nature of the railway the diagram can get very complicated and confusing. The HFACS analysis does not depict the relationships either but provides the knowledge there must be failures on the previous defense layers. A weakness however is that no background or context is provided.

What must be considered when investigating incident reports and methods of analysis of incident reports is that what may be the best way of practice for someone looking into the system may not suit those that are actually working in the system. The findings highlight that there is scope to improve the railway reporting system which will in turn aid system analysis. Furthermore, the incident factor classification system could be combined with elements from the AcciMap HFACS analyses to strengthen this system analysis model. Further studies are underway exploring the causal factors of SPAD events and the differences within reporting styles amongst TOCs using interviews with key stakeholders.