47

A systemic analysis of railway accidents

J Santos-Reyes1, A N Beard1
, and R A Smith2
1
Civil Engineering Section, Heriot Watt University, Edinburgh, UK
2
Department of Mechanical Engineering, Imperial College London, UK

The manuscript was received on 15 April 2004 and was accepted after revision for publication on 11 October 2004.

DOI: 10.1243/095440905X8745

Abstract: Over the last 15 years many railway accidents have happened in Britain and
worldwide. Following these train accidents, there has been a large amount of public debate
about safety management on the British railways. These accidents have raised issues regarding
the effectiveness of the safety management of the railway system. This paper presents a sum-
mary of the results of a preliminary systemic analysis of several British rail accidents, i.e.
those at Clapham Junction (1988), Paddington (1999), Hateld (2000), Selby (2001), and Potters
Bar (2002). It also includes the train accident at Eschede, Germany (1998). It is hoped that
this systemic analysis will help to identify learning points, which are relevant for preventing
accidents in the railway industry. The model is described in the context of the British railway
industry. However, the model itself is general and not specic to any particular country.

Keywords: railway, safety, management, systemic

1 INTRODUCTION circumstances in order to help to illustrate the fea-

The British railway industry was privatized in 1994.
Privatization was initially brought about by the sale
of a number of businesses, such as those operated
by the freight train operating companies and the
rolling stock companies, and the franchising of
newly created passenger train operating companies
(TOCs). It has also led to a more fragmented industry
and as a result a number of organizations have been
involved in the maintenance and renewal of the rail-
way system. In order to gain a full understanding
and comprehensive awareness of risk involved in
the complex relationships among train operators,
maintenance contractors, and regulators, among
others, it is necessary to try to adopt a systemic approach
to safety management in the railway industry.
Systemic may be dened as trying to see things as a
whole and attempting to see events, including
failure, as products of a working of a system. A rail-
way systemic safety management system (RSSMS)
model has been constructed by using this approach
[1, 2]. The RSSMS model has been used to analyse
railway accidents that occurred under different


Corresponding author: Civil Engineering Section, School of the
Built Environment, Rication, Edenburgh EH14 4AS, UK.
tures of the model as well as to identify deciencies
in different aspects of the safety management at
the times of the accidents. The accidents that were
chosen were those at Clapham Junction (1988),
Paddington (1999), Hateld (2000), Selby (2001),
and Potters Bar (2002). The train accident in
Eschede, Germany (1998), has been considered in
order to gain an insight into the management
of safety in a non-British railway system.
There were other accidents that could have been
selected for analysis; however, they were not con-
sidered because of the similarity of circumstances
to other accidents looked at. For example, the
Southall railway accident (1997) occurred under
similar circumstances to that of the Paddington acci-
dent (1999). In the Southall case a high-speed train
(HST) travelling from Swansea to Paddington,
London, running at about 200 km/h on the Great
Western Main Line passed two warning signals. The
driver saw the red signals but it was too late to
bring the train to a halt. The train collided with
empty wagons at the rear of a train that was crossing
the up main line. However, it can be revisited in
future work if considered necessary. There have
also been accidents during maintenance and
renewal of the railway infrastructure where often
trackside workers are exposed daily to risk of fatality

F01304 # IMechE 2005 Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
48 J Santos-Reyes, A N Beard, and R A Smith
during such activities. An example of such risks
was the case of the fatal accident that occurred at
Edge Hill, Liverpool, England, in 1999 where a plant
quality supervisor was struck by a scrap train
during maintenance work. Again, these types of acci-
dents are not within the scope of the present paper;
they may be considered in future work. Finally,
non-fatal railway accidents or incidents were not
looked at in this analysis. However, the model
could be applied to such cases and this is being
considered for future work.
This paper presents the results of a systemic
analysis of the accidents listed above. The metho-
dology has been to compare the features of the
failed system with the characteristics of the RSSMS
model. The main sources of information were reports
resulting from inquiries, as well as other papers and
sources published in the ofcial web pages of the
Health and Safety Executive (HSE), for the above
accidents. It is hoped that this systemic analysis
will help to identify learning points, which are
relevant for helping to prevent accidents in the
railway industry.
The paper is organized as follows: a brief descrip-
tion of the above accidents is presented in section
2. Section 3 presents a description of the RSSMS
model, which was used to map on to the safety man-
agement at the time of the accidents. The summary
of the main ndings of the comparison process is
presented in section 4. Finally, some conclusions
are presented in section 5.
2 RAILWAY ACCIDENTS
2.1 Clapham Junction train accident
On the morning of Monday, 12 December 1988, a
crowded commuter train ran head-on into the rear
of another, which was stationary in a cutting just
south of Clapham Junction station, London. After
the impact the rst train veered to its right and
struck a third oncoming train. As a result of the
accident, 35 people died and nearly 500 were injured,
69 of them seriously [3].
2.2 Paddington train accident
On 5 October 1999, a three-carriage Thames Trains
diesel unit (the Turbo) was in collision with a
First Great western HST at Ladbroke Grove, 2 miles
outside Paddington railway station, London. The
Thames train had just started a journey from
Paddington station to Bedwyn in Wiltshire and was
travelling at about 50 mile/h. The Great Western
train was a HST, consisting of eight coaches with a
diesel power car at each end, from Cheltenham to
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
Paddington and was travelling at about 95 mile/h.
The Turbo that passed a red signal, signal SN109 at
Ladbroke Grove, initially caused the collision. The
Turbo continued for some 700 m into the path of
the HST. The driver of the Turbo applied the
emergency brakes 2 s before the collision; the closing
speed of the two trains was about 130 mile/h [4 6].
The initial impact was between the leading coupler
of the front car of the Turbo and the drawgear of
the power car of the HST. The cabs of coach B3
(the Turbo) and the HST leading power car were
destroyed. At this stage the fuel tank under coach
B3 of the Turbo was ruptured and spread its diesel
contents, which then ignited. At about the same
time, secondary collisions took place involving
other carriages within each train. Coach B3 (driven
backwards by the HST) impacted with the leading
end of the middle coach B2. The leading end of
the rst HST coach, coach H, also impacted with
the trailing end of the HST power car. Coach H
rotated as it followed the HST power car and jack-
knifed as it was pushed round by the other HST
coaches following through, with coaches F and G
toppling over. A subsequent impact between a HST
coach and the trailing turbo coach, coach B1,
caused the latter to topple over. The scope of the
destruction was compounded by the immediate
development of res on and around the trains, in
particular, coach H of the HST and the middle car
of the Thames Trains Turbo.
As a result of the collision and the subsequent
res, 31 people died (24 from the Turbo and seven
from the HST, including the drivers of both trains)
and a further 227 were taken to hospital. 296
people were treated for minor injuries on the site of
the accident.
2.3 Hateld train derailment
On 17 October 2000, a passenger express train travel-
ling from Kings Cross to Leeds derailed. The train,
operated by Great North Eastern Railway (GNER),
derailed roughly half a mile south of Hateld station
(approximately 16.8 miles from Kings Cross). Four
people were killed and 70 injured as a result of the
derailment [7 9].
2.4 Potters Bar train derailment
The rear coach of a four-coach unit passenger train
derailed outside Potters Bar station on Friday, 10
May 2002. The train, operated by West Anglia Great
Northern, which was not due to stop at Potters Bar,
was travelling at up to 100 mile/h. The rear part of
the train derailed at points 2182A located approxi-
mately 150 metres south of the station. The rst
F01304 # IMechE 2005
 A systemic analysis of railway accidents
three coaches remained upright and came to rest
400 m north of the station, still on the down fast
line. The derailment led to the loss of seven lives
and many injuries [10, 11].
2.5 Selby train accident
On Wednesday, 28 February 2001, a Land Rover
pulling a trailer loaded with a Renault car left the
west-bound carriageway of the M62 motorway at
Great Heck and came to rest foul of the up line.
Shortly after, it was struck by an up passenger train,
Newcastle to London, operated by GNER causing
the leading driving van trailer (DVT) to become
derailed. Almost immediately, the derailed DVT was
involved in a secondary collision with a down freight
train. Ten people were killed and 76 people sustained
personal injury, many being seriously injured.
The HSE and Railway Safety (now the Rail Safety
and Standards Board) produced reports about this
accident [12, 13].
2.6 Eschede train accident, Germany
On 3 June 1998, a high-speed Intercity express (ICE)
train derailed and collided with a highway overpass
in Eschede, northern Germany. The ICE train was
travelling at a speed of approximately 120 mile/h
when the accident happened. About 3 miles prior
to the crash site, a rear wheel of the rst passenger
car failed. The wheel rim or metal sleeve began to
break off from the wheel. The remainder of the rim
struck against the tracks. The train travelled nearly
3 miles with the damaged wheel. Then 200 m
before a bridge, the train approached a track switch
at a turnout. At this stage the broken wheel rim col-
lided with a guide rail. As a result of the impact, the
rear left wheels of passenger car 1 derailed, followed
by cars 2 and 3. The trailing end of passenger car 3 hit
the bridge and knocked out the support columns.
Cars 3 and 4 were able to go through the falling
bridge. The middle car 5 was crushed by the collap-
sing bridge and torn apart. Passenger car 6 turned
sideways across the track. The following six passen-
ger cars 7 12 including the rear end locomotive hit
the blockade. 101 people were killed in the accident
an 108 people were injured [14, 15].
3 A RAILWAY SYSTEMIC SAFETY MANAGEMENT
SYSTEM MODEL
The RSSMS model is intended to maintain risk
within an acceptable range in railway operations.
The model is proposed as a sufcient structure
for an effective safety management system. It has a
fundamentally preventive potentiality in that, if all
F01304 # IMechE 2005
49
the subsystems and connections are present and
working effectively, the probability of a failure
should be less than otherwise.
The RSSMS model consists of the following
fundamental characteristics:
(a) a recursive structure (i.e. layered);
(b) a structural organization that consists of a
basic unit in which it is necessary to achieve
ve functions associated with systems 1 to 5;
(c) the concept of relative autonomy;
(d) four principles of organization;
(e) the concept of maximum risk acceptable (MRA)
and acceptable range of risk;
(f) the concept of viability of a safety management
system.
In addition it may be augmented by various
submodels.
Brief descriptions of (a) and (b) are given in
sections 3.1 and 3.2 respectively. The concept of
relative autonomy is described in subsection 3.2.1.
Appendix l describes the four organizational prin-
ciples and the concepts of MRA and viability are
put forward in section 3.3. Finally, section 3.4
presents communication and control submodels.
3.1 Recursive structure
Figure 1 shows two levels of recursion for the railway
transport system. A recursion may be regarded as
a level, which has other levels below or above it.
For example, recursion 1 consists of four subsystems
of the system of interest, i.e. the total transport
operations system. Each subsystem, represented
by a parallelogram symbol, is a management
unit and manages the operations indicated as ellip-
tical symbols, i.e. each corresponding to rail, road,
air, and sea subsystems. It must be emphasized
that the right-hand part of the gure is intended to
be seen as a cylinder, with circular cross-sections
being viewed obliquely. Given this, then the sub-
system of particular interest is the subsystem called
rail. In order to identify the component(s) of the
subsystem rail it is necessary to move down a
level of recursion. Then the total railway operations
is shown in recursion 2 (a level below recursion 1).
On the other hand, the components of the total
transport environment (the elliptical symbol
shown on the left-hand part of Fig. 1; this will be
explained in more detail in a later section) are not
part of the system of interest but they may inuence
it, e.g. via economic and political drivers. It is very
important to consider this environment.
The RSSMS model as shown in Figs 1 and 2 is
intended to manage safety on the railways at two
levels of recursion only (Fig. 2 should be seen in
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
50 J Santos-Reyes, A N Beard, and R A Smith

Fig. 1 Recursive structure for the RSSMS model

Fig. 2 A RSSMS model

Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit F01304 # IMechE 2005
 A systemic analysis of railway accidents
the context of Fig. 1). These gures will be used as the
basis for the description of the RSSMS model.
3.2 Structural organization of the RSSMS
The RSSMS model has a basic unit in which it is
necessary to achieve ve functions associated with
systems 1 to 5 (Fig. 2). Systems 2 to 5 facilitate the
function of system 1, as well as ensuring the continu-
ous adaptation of the railway system as a whole. The
ve functions are the following: formulation of the
railway safety policy, railway safety development,
railway safety functional, coordination, and railway
safety policy implementation.
1. System 1: railway safety policy implementation.
This system implements safety policies in the
total railway operations. System 1 consists of one
or more operations within the railway industry
that deal directly with the organizations core
activities. How system 1 might be broken down
further is a key question. For example, system 1
might be decomposed on a basis of geography
or functions. This is considered very briey later
(see subsection 3.2.3).
The management of the maintenance of the rail
network, signalling structures, buildings, stations,
and depots, for example, are actions of the
local railway safety management unit (l-RSMU).
Another example could be the management of
contractors and operating companies on a day-
to-day basis. In the case of a train accident, the
emergency procedures would generally be
implemented by the l-RSMU.
2. System 2: railway safety coordination. This sys-
tem coordinates the activities of the operations
of system 1 in relation to the RSSMSs total
environment (this will be discussed further in a
later section). System 2, together with system 1,
implements the safety plans received from
system 3. It informs system 3 about routine infor-
mation on the performance of the operations of
system 1. To achieve the plans of system 3 and
the needs of system 1, system 2 gathers and
manages the safety information of system 1s
operations. There are other organizations within
the total environment that may create some
conicting situations in the operation of system 1.
An example of coordination activity could be the
solving of any conict that may arise between
the British railway system and the international
train operator, Eurostar, that links Britain with
continental Europe. It should be noted that,
when system 1 is made of various operations or
subsystems, then system 2 coordinates their
activities, as shown in Figs 3 and 4.
F01304 # IMechE 2005
51
3. System 3: railway safety functional. This system is
responsible for maintaining risk within an accep-
table range in system 1 and ensures that system 1
implements the organizations safety policy.
It achieves its function on a day-to-day basis
according to the safety plans received from
system 4. System 3 requests from systems 1, 2,
and 3
information about the safety performance
of system 1 to formulate its safety plans and to
communicate future needs to system 4. It is also
responsible for allocating the necessary resources
to system 1 to accomplish the organizations
safety plans.
System 3
, railway safety audit, is part of system
3 and its function is to conduct audits sporadically
into the operations of system 1. System 3
inter-
venes in the operations of system 1 according to
the safety plans received from system 3. System
3 needs to ensure that the reports received from
system 1 not only reect the current status of
the operations of system 1 but also are aligned
with the overall objectives of the organization.
The audit activities should be sporadic (i.e.
unannounced) and they should be implemented
under common agreement between system 3

and system 1. A corrective action during a near-
miss incident or accident, either through system
2 or through the command channel (i.e. the chan-
nel that connects systems 3 and l (see Fig. 2))
could be an example of the action of system 3.
Furthermore, system 3 should allocate resources
for the training of train personnel, maintenance,
and renewal of the railway system. On the other
hand, the revision of the adequacy and the
functioning of the engineering services and xed
installations of the railways (e.g. track, signalling,
structures, telecommunications, buildings, sta-
tions, and depots) are examples of the action of
system 3
. Another example of the action of
system 3
could be the inspection of the train
driver management as well as signals passed at
danger (SPADs) management in the total railway
safety operations.
4. System 4: railway safety development. This system
is concerned with safety research and develop-
ment for the continual adaptation of the railway
system as a whole. By considering strengths,
weaknesses, threats, and opportunities, system 4
can suggest changes to the organizations safety
policies. This function may be regarded as a
part of effective safety planning. Firstly, system 4
deals with the safety policy received from
system 5. Secondly, it senses all relevant threats
and opportunities from the total physical and
socio-economic environment of the organization,
including the railway safety future environment
(this is explained in more detail in a later section).
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
52 J Santos-Reyes, A N Beard, and R A Smith

Fig. 3 A RSSMS model: geographical regions. The decomposition here is on the basis of
geography, with England, Scotland, and Wales as examples

Thirdly, system 4 deals with all relevant needs of
system 1s performance and its potential future.
Finally, it deals with the condential or special
information communicated by system 4
.
System 4
, railway safety condential reporting
system, is part of system 4 and is concerned with
condential reports or causes of concern from
any employee, about any aspects, some of which
may require the direct and immediate inter-
vention of system 5.
5. System 5, railway safety policy. This system is
responsible for deliberating safety policies and
for making normative decisions. According to
alternative safety plans received from system 4,
system 5 considers and chooses feasible alter-
natives, which aim to maintain the risk within

Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit F01304 # IMechE 2005
 A systemic analysis of railway accidents 53

Fig. 4 A RSSMS model: functions. The decomposition here is on the basis of functions, e.g.
infrastructure, maintenance, and scheduling operations

an acceptable range throughout the life cycle of
the total railway operations. It also monitors the
interaction of system 3 and system 4, as rep-
resented by the lines that show the loop between
systems 3 and 4 in Fig. 2. An example of system
5s policies is to address the prevention of train
accidents. These policies should also promote a
good safety culture throughout the organization
and among the organizations involved in the
operation, maintenance, renewal, and enhance-
ment of the rail network.
Figure 2 shows, at two levels of recursion only, the
RSSMS model that is intended to manage safety on
the railways (the two levels should be seen in the
context of Fig. 1). The top right-hand side dashed

F01304 # IMechE 2005 Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
54 J Santos-Reyes, A N Beard, and R A Smith
line rectangular box is the total railway safety man-
agement unit (t-RSMU) at recursion 2. The dashed-
line circle represents the total railway operations.
However, the basic unit may be replicated for
every operation of system 1 as implied in Fig. 3.
3.2.1 RSSMS and relative autonomy
The RSSMS is intended to be able to maintain risk
within an acceptable range at each level of recursion,
but this safety achievement at each level is con-
ditional on the cohesiveness of the whole railway
industry. The RSSMS contains a structure that
favours relative autonomy and local safety problem-
solving capacity. Relative autonomy means that
those involved in bringing about each operation
of system 1 of the RSSMS are responsible for
that activity with minimal intervention of systems
2, 3, 4, and 5. The organizational structure of the
RSSMS allows decisions to be made at the local
level. Decision making is distributed throughout
the whole organization. This means that distributed
decision making involves a set of decision makers
in each operation of system 1 and at each level of
recursion (see Figs 3 and 4). These decision makers
should be relatively autonomous in their own right
and act relatively independently based on their
own understanding of railway safety and their
specic tasks. However, it must be recognized that
they have interdependence with other decision
makers of other operations of system l. Therefore,
each operation of system 1 should be endowed
with relative autonomy so that the organizational
safety policy can be achieved more effectively.
However, it is vital that relative autonomy not be
confused with isolation; it must be within an
adequate system of control and communication.
3.2.2 RSSMS and its environment
The RSSMS relies on ve functional imperatives
and the extent to which the RSSMS structural
organization accommodates contextual constraints
determines its ability to adapt. The organizational
structure of the RSSMS is shown as interacting in a
dened way with its environment through system
1s operations, and through system 4, as illustrated
in Fig. 2. Environment, both socio-economic and
physical, is understood as being those circumstances
to which the RSSMS response is necessary. The
RSSMS also needs to respond to necessary internal
matters, e.g. inadequate training of train drivers.
System 4 deals with the RSSMSs total socio-
economic and physical environment within which
the railway system is embedded. The dashed-line
elliptical symbol represents the RSSMSs total
environment, as illustrated in Fig. 2. System 4 deals
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
also with the railway safety future environment,
which is also embedded into the RSSMSs total
environment. The railway safety future environ-
ment is concerned with threats and opportunities
for the future development of safety. On the other
hand, system 1s operation interacts with local
environments with which the organizations opera-
tions must deal. The local railway environment
is embedded into the total railway environment of
the RSSMS as illustrated in Fig. 2. For example, the
railway industry is embedded within a wider socio-
economic and physical structure that will constrain
the way that it can develop. There are various
important socio-economic and physical charac-
teristics that need to be taken into account. These
characteristics can be segregated thus: rstly,
physical characteristics, such as the geography of
the country, weather conditions and public utilities;
secondly, economic characteristics such as level of
employment, train operators, users, cost/prots,
and other types of industrial and commercial
considerations; nally, socio-political character-
istics, such as regulators, and social organizations.
The demands and needs inherent in these character-
istics will suggest and condition patterns of struc-
tural organization of the RSSMS. The railway
industry needs to pay attention not only to these
characteristics, but also to the complexity, stability,
or uncertainty of changing technologies.
Apart from confronting demands for its products,
an organization faces an environment upon which it
is dependent for nance, work force, and materials,
i.e. for its resources. The RSSMSs total environment
has a certain pattern of resource availability to which
the organization has to relate. The supply of
resources to the railway changes over time, forcing
it to make organizational adaptations. These adap-
tations may involve merging departments, changing
the location of decision making, introducing new
procedures, and so on. These changes may have
signicant impacts on the safety performance of
the whole organization. Similarly, local environ-
ments are also characterized in a similar way to the
organizations total environment, i.e. physical,
economic, and socio-political.
Whenever a line appears in Fig. 2 representing the
RSSMS model, it represents a channel of communi-
cation, except for the lines that connect the balan-
cing loop that connects systems 4 and 3. There is a
particular concern in the RSSMS about the nature
of these channels and the information that ows
in the communication channels. These channels of
communication should obey four organizational
principles in order to attempt to make a system
viable (see Appendix 1). The bidirectional arrows
represented in the RSSMSs total environment indi-
cate the interactions among the local environments,
F01304 # IMechE 2005
 A systemic analysis of railway accidents 55

as well as the interaction of these local environments

with the total environment.
Figure 2 shows a dashed line directly from system 1
to system 5, representing a direct communication or
hot-line for use in exceptional circumstances, e.g.
during an emergency. Also shown in Fig. 2 is a line
with an arrow from system 1 to system 4
and
system 5, representing a safety condential report-
ing system. Both channels, the hot-line and the
condential reporting system, represent initially
one-way communication channels but they may
become two-way communication channels between Fig. 5 The MRA and the acceptable range of risk
systems 1 and 5 and systems 1 and 4
respectively.
In general, a tentative basic RSSMS model has
been described. This is an attempt to consider the This probability depends, inter alia, upon the MRA
railway system as a whole as shown in Figs 1 and level set and the environmental drivers, e.g. econ-
2. However, it must be emphasized that there could omic and political. The viability must always be
be (and generally will be) more than one operation seen in relation to the MRA level set. It might be
or subsystem in system 1. possible to achieve a relatively high viability, but at
the cost of specifying a relatively large MRA, possibly
corresponding to an unacceptably high risk.
3.2.3 Decomposition of system 1 of Fig. 2 Calculation of the viability of a safety management
system remains for future research work; here the
The overall approach is non-dogmatic and system 1
considerations are purely qualitative.
of Fig. 2, corresponding to railway operations, may
be decomposed (i.e. lower recursion levels decided
upon) in different ways. For example, system 1 of 3.4 Paradigms for communication and control
Fig. 2 may be decomposed in terms of geographical
regions (see, for example, Fig. 3) or in terms of The model as sketched above may be augmented
functions, e.g. maintenance and infrastructure by specic paradigms that have been put forward
operations (see Fig. 4). Which decompositions are that are intended to act as templates giving
feasible or desirable and the advantages and disad- essential features for effective communication and
vantages of different decompositions will require control (Appendix 2), to be used in a comparative
much consideration and will need to be investigated sense and in addition to the four principles of
in the future. For the present, the general outline organization (Appendix 1).
only is considered.
4 SUMMARY OF THE ANALYSIS OF
THE ACCIDENTS
3.3 The maximum risk acceptable, the
acceptable range of risk, and the viability In each case, the analysis consisted in comparing
the characteristics of the RSSMS model with the
The critical aspect of the RSSMS model is its ability
safety management at the time of the accident
to maintain risk below, and preferably well below,
(Figs 6 and 7). The main ndings are summarized
a MRA in the face of events. The MRA is understood
in the subsequent sections.
as the level of risk above which the risk is totally
unacceptable, as illustrated in Fig. 5. An acceptable
risk on the other hand is one which is below 4.1 Clapham Junction rail accident (1988)
the MRA and, as a general rule, well below the
The immediate cause of the accident was a faulty
MRA. The viability of the RSSMS is then the
signal, WF138, that was falsely fed by a current
probability that it will be able to keep the risk
from an old wire in the Clapham Junction relay
within an acceptable range for a given time period
room; 35 people were killed and many others were
according to
injured as a result of the accident.
Viability P (the RSSMS has the capacity to 4.1.1 Recursive mappings (see Figs 6 and 7)
maintain the risk within an
1. The interaction between the train and track was
acceptable range for a stated
managed by the same organization (British Rail).
period of time) However, it is unclear whether the safety

F01304 # IMechE 2005 Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
56 J Santos-Reyes, A N Beard, and R A Smith

Fig. 6 Recursive structure of the RSSMS model

management of the time considered such inter-
action effectively.
4.1.2 Structural organization mappings (see Fig. 7)
1. There was failure of the function associated with
the rail infrastructure safety management unit
(RISMU) (part of system 1), e.g. deciencies in
the way that the work was carried out on Jobs
104 and 201. This contributed to the malfunctio-
ning of the signal WF138.
2. There was failure of the function associated
with the train safety management unit (TSMU)
(part of system 1). For example, the signaller at
Clapham Junction did not detect the malfunc-
tioning of the signal WF138.
3. There was failure of the function associated with
system 2 (coordination). For example, it seems
that there was no mechanism to detect and
communicate about the faulty signal to other
divisions and to higher management.
4. There was failure of the function associated
with system 3 (assessment, monitoring, and

Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit F01304 # IMechE 2005
 A systemic analysis of railway accidents 57

Fig. 7 The RSSMS: recursions 2 and 3

maintenance). For example, the management
of safety at regional level (Southern) failed to
monitor the rail infrastructure and train opera-
tions.
5. There was failure of the function associated with
system 3
(audit): For example, the management
of safety at regional level (Southern) failed to
inspect the performance of the work done in
relation to the estate and functioning of the
signalling related systems in the relay room.
6. It is a unclear whether the function associated
with system 4 (research and development) was
in place and performed its function effectively.
7. There is no evidence of the existence of a
condential reporting system (system 4
) at the
time of the accident.
8. Safety policies (function associated with system 5)
were set but it is unclear whether they were
effective.
4.2 Paddington train collision (1999)
A Thames Trains Turbo passed a red signal (SN109)
and collided with an express train, resulting in 31
fatalities and injuries to many other persons.
4.2.1 Recursive mappings (see Figs 6 and 7)
1. The interaction between the trains and track
was managed by many organizations. For
example, Railtrack was the rail infrastructure con-
troller and the trains involved in the accident were

F01304 # IMechE 2005 Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
58 J Santos-Reyes, A N Beard, and R A Smith
managed by different TOCs. Such interaction
was not dealt with effectively. (See section 4.7 for
further details.)
2. The fragmentation of the rail industry created
conicts among the organizations involved in its
operations. For example, Railtrack had
an interest in the management of safety on its
operations but not a direct interest in the safety
management of the trains, train drivers, rolling
stock, etc. The other way round is also true;
TOCs had a direct interest only in their operations
but not in the rail infrastructure.
4.2.2 Structural organization mappings (see Fig. 7)
1. Failure of the function associated with the RISMU
(part of system 1 and managed by Railtrack). For
example, the signaller at the integrated electronic
control centre (IECC) expected the driver of the
turbo to come on the telephone and to tell him
that he had passed the red signal.
2. Owing to the separation between the trains and
track, it is not clear whether the role of the
TSMU (part of system 1, and managed by TOCs)
in the process of continuous monitoring of the
drivers and trains movements was carried out.
This is because the trains are monitored and
controlled by the RISMU of the rail infrastructure
controller (Railtrack).
3. Owing to the fragmentation of the rail industry,
conicts were created but there was no indication
of the existence of the function associated with
system 2 (coordination). For example, in the acci-
dent, there was no indication of the existence of a
channel of communication between the IECC and
the HST involved in the accident.
4. There was failure of the function associated with
system 3 (assessment, monitoring, and mainten-
ance), e.g. deciencies in the management of
SPADs.
5. There was failure of the function associated with
system 3
(audit), e.g. deciencies in the inspec-
tion of the performance of the train drivers and
signallers in relation to SPADs.
6. It is unclear whether the function associated
with system 4 (research and development) was
in place and performed its function effectively.
Certainly there was some research going on, e.g.,
on SPADs. However, there was no coherent
system to cover all parts of the fragmented railway
industry.
7. There is no evidence of the existence of a
condential reporting system (system 4
) at the
time of the accident.
8. Safety policies (function associated with system 5)
were set but it is unclear whether they were
effective.
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
4.2.3 Four organizational principles [4]
Reference [4] highlighted some shortcomings of the
type of alarms used in the trains cab. It can be
seen that the driver had the same type of signal
(the horn sound) for a double yellow, single
yellow, and a red signal and even for a speed
restriction signal. This may have caused confusion
for the train driver.
4.3 Hateld train derailment (2000)
A high-speed passenger train was derailed due to a
fracture and subsequent fragmentation of a rail.
The accident resulted in four passengers killed and
70 seriously injured.
4.3.1 Recursive mappings (see Figs 6 and 7)
1. The interaction between the train and track was
managed by many organizations. For example,
Railtrack was the rail infrastructure controller
and trains were managed by different TOCs.
Such interaction was not dealt with effectively.
(See section 4.7 for further details.)
2. The fragmentation of the rail industry created
conicts among the organizations involved in its
operations. For example, Railtrack had an interest
in the management of safety on its operations
but not a direct interest in the safety management
of the trains, train drivers, rolling stock, etc. The
other way round is also true; TOCs would have
a direct interest only in their operations but not
in the rail infrastructure (e.g. GNER did not have
an incentive to carry out wheel turning).
4.3.2 Structural organization mappings (see Fig. 7)
1. There was failure of the function associated with
the RISMU (part of system 1 and managed by
Railtrack). For example, cracks were not detected
in the rails.
2. Owing to the separation between the train and
track, it is not clear whether the role of the
TSMU (part of system l and managed by TOCs)
in the process of continuous monitoring of the
drivers and trains movements was carried out.
This is because the trains are monitored and
controlled by the RISMU of the rail infrastructure
controller (Railtrack).
3. Owing to the fragmentation of the rail industry,
conicts were created but there was no indication
of the existence of the function associated with
system 2 (coordination).
4. There was failure of the function associated with
system 3 (assessment, monitoring, and main-
tenance), e.g. a deciency in the management of
F01304 # IMechE 2005
 A systemic analysis of railway accidents
contractors and the failure of detecting cracks on
the rails.
5. There was failure of the function associated
with system 3
(audit) e.g. deciencies in the
inspection of the state of the tracks and the
inspection of the maintenance work on rails.
6. There was failure of the function associated with
system 4 (research and development), e.g. the
failure of the development of new procedures
for the inspection of rolling contact fatigue, de-
ciencies in the development of new procedures
to manage broken and defective rails, and failure
in the development of new techniques for the
detection of rolling contact fatigue cracks in rails.
7. The condential incident reporting and analysis
system (CIRAS) performed a function similar
to that associated with system 4
(condential
reporting system). However, it is unclear whether
it was operational and effective at the time of the
accident.
8. There was failure of the function associated with
system 5 (policy). For example, system 5 failed
to promote safety as a priority during track main-
tenance throughout the rail network and failed to
promote sufcient track access time for mainten-
ance work, not only on tracks but also on anything
related to the maintenance of the rail infrastruc-
ture. It is not clear whether employees were
encouraged to use the condential reporting
system. This could have helped to bring matters
of concern to the attention of systems 4 and 5.
4.4 Selby train collision (2001)
A Land Rover road vehicle and trailer left the carria-
geway near Great Heck, Selby, and came to rest foul
of the up line. Shortly after, an up passenger train
struck it. Almost immediately, the derailed train
was involved in a second collision with a down
freight train. The accident resulted in ten people
killed and 76 injured.
4.4.1 Recursive mappings (see Figs 6 and 7)
1. The overall safety management did not deal
effectively with the risks involved when interact-
ing with other transport systems e.g. the road
system. (See section 4.7 for further details.)
4.4.2 Structural organization mappings (see Fig 7)
1. There was failure of the function associated with
the RISMU (part of system 1 and managed by
Railtrack).
2. Owing to the separation between the trains and
track, it is not clear whether the role of the
TSMU (part of system l and managed by TOCs)
F01304 # IMechE 2005
59
in the process of continuous monitoring of the
drivers and trains movements was carried out.
This is because the trains were monitored and
controlled by the RISMU of the rail infrastructure
controller (Railtrack).
3. Owing to the fragmentation of the rail industry,
conicts were created but there is no indication
of the existence of the function associated with
system 2 (coordination).
4. There was failure of the function associated with
system 3 (assessment, monitoring, and mainten-
ance). For example, it is unclear whether system
3 performed risk assessments from imported
risks such as roads.
5. It is unclear whether the function associated
with system 4 (research and development) was
in place and performed its function effectively. It
is the responsibility of system 4 within the
RSSMS model to help to maintain the continual
adaptation of the railway system. This is done by
identifying threats and opportunities and suggests
changes to the organizations safety polices. The
function associated with system 4 should have
assessed the imported risks involved from other
activities such as road transportation.
6. The CIRAS performed a function similar to that
associated with system 4
(condential reporting
system). However, it is unclear whether it was
operational and effective at the time of the
accident.
7. Safety policies (function associated with system 5)
were set but unclear whether they were effec-
tive, e.g. deciencies in the formulation of policies
related to the assessment of imported risk
throughout the whole rail network.
4.5 Potters Bar train derailment (2002)
A train travelling from Kings Cross, London, derailed
at Potters Bar when passing over points 2182A. The
accident resulted in seven people killed and many
injured.
4.5.1 Recursive mappings (see Fig. 7)
1. The interaction between the train and track was
managed by many organizations. For example,
Railtrack was the rail infrastructure controller
and trains involved in the accident were managed
by different TOCs. The safety management of the
time did not consider such interaction effectively.
(See section 4.7 for further details.)
2. The fragmentation of the rail industry created
conicts among the organizations involved in its
operations. For example, Railtrack had an interest
in the management of safety on its operations
but not a direct interest in the safety management
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
60 J Santos-Reyes, A N Beard, and R A Smith
of the trains, train drivers, rolling stock, etc. The
other way round is also true; TOCs would have a
direct interest only in their operations but not
in the rail infrastructure.
4.5.2 Structural organization mappings (see Fig. 7)
1. There was failure of the function associated with
the RISMU (part of system 1 and managed by
Railtrack). For example, points south of the
station moved while the 12.45 pm train from
Kings Cross to Kings Lynn was passing over them.
2. Owing to the separation between the train and
track, it is not clear whether the role of the
TSMU (part of system 1 and managed by TOCs)
in the process of continuous monitoring of the
drivers and trains movements was carried out.
This is because the train was monitored and con-
trolled by the RISMU of the rail infrastructure
controller (Railtrack).
3. Owing to the fragmentation of the rail industry,
conicts were created but there was no indication
of the existence of the function associated with
system 2 (coordination).
4. There was failure of the function associated with
system 3 (assessment, monitoring, and main-
tenance), e.g. deciencies in the management at
zone level to conduct audits in order to know
the current state of both the rail network and the
knowledge and the commitment to safety of
the contractors that carried out the maintenance
work of the rail infrastructure, and deciencies
in the management of the contractors.
5. There was failure of the function associated with
system 3
(audit), e.g. deciencies in identifying
and inhibiting all possible performances that did
not comply with the planned safety objectives of
the physical rail network as well as employees,
and deciencies in the inspection and monitoring
of the maintenance work on rails.
6. The CIRAS performed a function similar to that
associated with system 4
(condential reporting
system). However, it is unclear whether it was
effective at the time of the accident.
7. Safety policies (function associated with system 5)
were set but it is unclear whether they were effec-
tive. For example, system 5 failed to promote
safety as a priority during track maintenance
throughout the rail network and related to pro-
mote sufcient track access time for maintenance
work not only on tracks but also on anything
related to the maintenance of the rail infra-
structure. It is not clear whether employees were
encouraged to use the condential reporting
system. This could have helped to bring matters
of concern to the attention of systems 4 and 5.
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
4.6 Eschede train accident (1998)
A high-speed ICE train derailed and collided with a
highway overpass in Eschede, northern Germany.
The ICE train was travelling approximately at a
speed of 120 mile/h when the accident happened.
The accident resulted in 101 fatalities and 108
people injured.
4.6.1 Structural organization mappings (see Fig. 6)
1. There was failure of the function associated
with system 3 (assessment, monitoring, and
maintenance). For example, Deutsche Bahns
management did not carry out inspections.
2. There was failure of the function associated
with system 3
(audit). For example, Deutsche
Bahns management failed to test the wheels.
This may be because those at a higher level did
not make any suggestions about the necessity of
testing such wheels. They never had been tested
during 4 years of operation. It also failed to
monitor the state and functionality of the
rubber suspended wheels.
3. There was failure of the function associated with
system 4 (research and development).
4. There is no evidence of the existence of a
condential reporting system (system 4
) at the
time of the accident.
5. Safety policies (function associated with system 5)
were set but it is unclear whether they were
effective. It seemed that any proposal related to
safety was rejected on the grounds of costs. For
example, in 1994 the Railway Board stopped
the ultrasound tests that had been used before
for helping to establish metal fatigue as a preven-
tive measure. Another example is that the Board
rejected the proposal of a new system to enable
the train driver to monitor any distortion of the
tyres during travel. The reason given was that
the system was too expensive.
4.7 General comments
4.7.1 Train and track interdependence
Owing to the split between train and track man-
agement, there were conicts of interest between
Railtrack and the TOCs, such as Thames Trains.
For example, Railtrack had an interest in the man-
agement of safety on its operations but not a direct
interest in the safety management of the trains (e.g.
training of train drivers, and rolling stock). The
other way round is also true; TOCs would have a
direct interest only in their operations but not in
the rail infrastructure. As a consequence of this
there was no coherence in the safety policies
F01304 # IMechE 2005
 A systemic analysis of railway accidents
implemented in the operations of system l, i.e. train
and rail infrastructure operations. Some examples
are as follows.
Miss Forster of First Great Western about SPADs
commented [4, p. 135]:
It was a huge, frustration. There were a lot of meetings
held on different issues, but Signals Passed at Danger
specically, where lots of ideas were created but
no action then was taken with all those ideas. And
then we had another group set up to discuss ideas
and it seems that Railtrack became overwhelmed
with those ideas and actually just did not appear to
us, though they may well have been taking things
forward within their organization, they did not com-
municate that with us.
Miss Forster also told the inquiry of her concerns
about the quality of communication between
Railtrack and her company. She said [4, p. 136]:
I nd Railtrack Zone unresponsive to our requests for
information, for action, and that unresponsiveness is
not only between me and Railtrack, it is often between
the signallers and the drivers, and the response to the
drivers report is actually sometimes non-existent,
sometimes ineffective.
Similar concerns were expressed by other TOCs.
For example, in October 1998 a common objective
was put forward by TOCs at the meeting of the
senior management group. The group noted [4,
p. 136]:
TOCs required a faster notication of multi-SPAD
information and to provide the SPAD list every two
weeks.
Another example was with regard to the compe-
tence of staff engaged by the lack of common
safety purpose among the organizations involved
in the railways operations (e.g. contractors and
Fig. 8 Multi-mode transport interdependence
F01304 # IMechE 2005
61
subcontractors). Joint Rail Unions drew attention to
this issue [5, p. 51]:
. . . an industry within an industry supplying both
safety-critical and ordinary labour of which there are
about 130 suppliers and a number of new applicants.
It become (sic) apparent that abuses of the systems in
place were rife with allegations of inadequate training,
exceedance of working hours and lack of any safety
systems within the supplying companies.
4.7.2 Interdependence among the modes of
transport
The interdependence between the total rail and
t-RSMU system and other modes of transport
shown in Fig. 1 and are represented in detail in
Fig 8. However, the safety management at the
time of the Selby accident lacked a system for dealing
effectively with such imported risks.
Some examples to illustrate this are as follows.
Mr Backshall (Bridgeguard 3 and Works Agreement
Manager, Railtrack LNE Zone, York) carried out a great
deal of outside party work liason. He stated [12, p. 73]:
. . . there was no mechanism for the railway to become
aware of increases in trafc volumes at any particular
structure, except that an improvement scheme may
present the opportunity for the railway to become
aware of the current road trafc levels. . . .
He [Mr Backshall] did not see it as his responsibility to
nd out about the level of road vehicle incursions but
saw it as a function of Railtrack HQ to watch national
trends.
In reply to a question from the Inquiry Panel, he
stated [12, p. 74]:
. . . any exercise to determine risk would probably be
carried out by the highway authority but that it
would be better if there was a Railtrack involvement.
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
62 J Santos-Reyes, A N Beard, and R A Smith
Mr Teager (Head of Structure Assessment Manage-
ment, Railtrack) commented, in relation to the future
identication and assessment of risk [12, p. 71]:
I believe what is actually required is for the Highways
Agency, ourselves [Railtrack] and other bridge owners,
HMRI, HSE, to come to some form of agreement on
the level of risk, the tolerability of risk in the various
situations, the urgency on which certain risk can be
addressed and should be addressed, and to come
forward with an agreed physical action plan.
Mr Robinson (Head of Risk Assessment, Railway
Safety) commented, with respect to the imported
risks [12, p. 71]:
He [Mr Robinson] explained that his department has
not found anyone they can talk to on the risk imported
from the highway, although there were a number of
good relationships with other agencies.
The above has highlighted that effectively there
was no system that considered such interdepen-
dence among the various modes of transport.
However, it does not mean that knowing the inter-
dependence among the transport systems could
have prevented the accident at Selby, but the recur-
sive structure provides means of awareness of the
existence of such risks and to act accordingly by a
well-coordinated system.
5 CONCLUSION
Over the last 15 years, many railway accidents have
happened in Britain. These accidents have raised
issues regarding safety management on the British
railways. This paper has highlighted the main short-
comings of the safety management at the times of
the accidents. A non-British accident has also been
considered, i.e. Eschede. The approach has been
to compare the features of the accidents with the
characteristics of a RSSMS model, which has been
constructed employing the concepts of systems.
The model is proposed as a sufcient structure for
an effective safety management system. It has a
fundamentally preventive potentiality in that, if the
subsystems and connections are in place and work-
ing effectively, it is expected that the probability of
a failure would be less than otherwise. It is important
to stress that subsystems must be not only nominally
in place but also working effectively. This is demon-
strated by a comparison between the Clapham
Junction and Paddington accidents. The accident at
Clapham took place when the entire railway
system was under the control of British Rail.
Nominally there existed an integrated system 3
and an integrated system 2; however, they did not
perform effectively. In the Paddington crash, such
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
integrated systems were not nominally or effec-
tively in place.
This article has described work that is part of a
wider process exploring the practical value of this
approach. The method may be employed both
reactively and proactively. In a reactive application
its value has been shown through the analysis of past
accidents, as in this paper. Already, applying the
model has highlighted the fact that, strategically,
there is no t-RSMU and no l-RSMU in existence
in the real-world system in Britain. In a proactive
sense it is intended, in future research, to explore
different possible ways of applying the model. In
this way, different options for a railway system
may be examined, comparing advantages and dis-
advantages of each. To close, overall, it is hoped
that the systemic analysis employed in this paper
will help to identify learning points, which are
relevant for preventing accidents in the railway
industry.
REFERENCES
1 Santos-Reyes, J. and Beard, A. N. A systemic approach
to safety management on the UK railway system. Civil
Engng Environmental Systems, 2003, 20, 1 21.
2 Santos-Reyes, J. and Beard, A. N. A systemic approach
to re safety management. Fire Safety J., 2001, 36(4),
359 390.
3 Hidden, A. Investigation into the Clapham Junction
Railway Accident, 1989 (Her Majestys Stationery
Ofce, London).
4 Cullen, D. The Ladbroke Grove Rail Inquiry, Part 1, 2001
(HSE Books, London).
5 Cullen, D. The Ladbroke Grove Rail Inquiry, Part 2, 2001
(HSE Books, London).
6 Cullen, D. and Uff, J. The Joint Inquiry into Train
Protection Systems, 2001 (HSE Books, London).
7 Health and Safety Executive, Train derailment at
Hateld, 17 October 2000. First HSE Interim Report,
10 December 2002; http://www.hse.gov.uk.
8 Health and Safety Executive, Train derailment at
Hateld, 17 October 2000. Second HSE Interim
Report, 10 December 2002; http://www.hse.gov.uk.
9 Health and Safety Executive, Hateld derailment
investigation. Interim Recommendations of the Investi-
gation Board, 10 December 2002; http://www.hse.
gov.uk.
10 Health and Safety Executive, Train derailment at
Potters Bar. Friday 10 May 2002. HSE Interim Report,
10 December 2002.
11 Health and Safety Executive, Train derailment at
Potters Bar, 10 May 2002. Progress report by the HSE
Investigation Board, 10 December 2002.
12 Railway Safety, Derailment of passenger train 1F23 04
45 Newcastle to London, by a road vehicle and sub-
sequent second collision with 6G34 05 00 Immingham
to Ferrybridge at Great Heck on 28 February 2001.
Formal Inquiry: Final Report. London, 2001.
F01304 # IMechE 2005
 A systemic analysis of railway accidents
13 Health and Safety Executive, Train collision at
Great Heck near Selby, 28 February 2001. Report,
10 December 2002; http://www.hse.gov.uk.
14 Danger Ahead. ICE high-speed train disaster. Special
Report, Eschede, Germany, 10 December 2002; http://
danger-ahead.railfan.net/features/eschede2.htm.
15 Kuepper, G. A new risk: the crash of bullet-trains
experiences from the German ICE accident on June 3
1998. Assoc. Scientists Prof. Engng Personnel J., 1999.
16 Beer, S. The Heart of Enterprise, 1979 (John Wiley,
Chichester, West Sussex).
17 Fortune, J. and Peters, G. Learning from Failure
The Systems Approach, 1995 (John Wiley, Chichester,
West Sussex).
APPENDIX 1
The rst principle of organization (from Ashbys
law [16])
Managerial, operational, and environmental var-
ieties, diffusing through an institutional system,
tend to equate; they should be designed to do so
with minimum damage to people and to cost (i.e.
for a viable system).
An example could be an evacuation system
designed to save lives in the case of a re or
explosion; then the evacuation capacity must be at
least as great as the number of possible evacuees.
The Second principle of organization (derived
from Shannon [16])
The four directional channels carrying information
between the management unit, the operation, and
the environment must each have higher capacity to
transmit a given amount of information relevant to
variety selection in a given time than the originating
subsystem has to generate it in that time (as shown
in Fig. 9).
Fig. 9 The basic elements of an RSSMS, illustrating the
four key information channels
F01304 # IMechE 2005
63
An example is that the channels carrying pro-
cedures of evacuation must have enough speci-
city to reduce ambiguities or to eliminate unclear
instructions.
The third principle of organization
Wherever the information carried on a channel
capable of distinguishing a given variety crosses a
boundary, it undergoes transduction, and the variety
of the transducer must be at least equivalent to the
variety of the channel.
An example is that, in the case of a means of escape
for tunnel users, a transducer might be a re safety
instruction leaet. This would transduce between
the person making up the evacuation rules and the
people that the rules are aimed at; then the notice
must be comprehensive and clear.
The fourth principle of organization
The operation of the rst three principles must be
cyclically maintained through time, and without
hiatus or lags (i.e., they must be adhered to
continuously).
APPENDIX 2
Two paradigms are described that are intended to
supplement the RSSMS model. In addition, several
human factors paradigms have been described
by Fortune and Peters [17] that may well be of
value.
Control paradigm
A basic control paradigm is shown in Fig. 10.
This diagram is intended to be interpreted in a
very general sense and not simply in a hard engin-
eering way. The management or controller and
the system or organization under control are
inseparable in the RSSMS model. The sources of
control are spread through the whole structure of
the RSSMS rather than localized within a separate
system.
As shown in Fig. 10, this feedback control model
consists of various elements, such as the operations,
comparator, reactive adjuster, proactive adjuster,
input changer A, and input changer B. The manage-
ment plans or sets safety objectives. These safety
objectives are represented in the comparator. The
function of this comparator is to compare the
actual output with the planned safety objectives.
Thus this control model can detect any deviation
from the planned safety objectives through the
Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit
64 J Santos-Reyes, A N Beard, and R A Smith

Fig. 10 Feedback control

comparator. The reactive adjuster involves adjusting
the input to the operations through the input chan-
ger A.
The proactive adjuster, on the other hand, is
intended to manage safety proactively. In other
words, the proactive adjuster involves anticipating
any deviation from the organizations safety objec-
tives proactively. In order to do so, the proactive
adjuster involves modifying the input through the
input changer B. This process can be accomplished
through modelling risk for the whole system. If the
RSSMS is able to do so, then it can be said that the
RSSMS is an adaptive system.
A simple example of how to control a system
through this feedback control model could be a
truck carrying hazardous materials. The truck and
its route represent the operation, with the dispatcher
as the management. The dispatcher schedules the
journey of the truck and this schedule is being rep-
resented in the comparator, as shown in Fig. 10.
The dispatcher monitors the schedule of the truck
and detects any deviation of the actual truck

Fig. 11 A bidirectional communication Paradigm. (Reproduced by permission from Fortune and

Peters [17])

Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit F01304 # IMechE 2005
 A systemic analysis of railway accidents 65

schedule from the planned schedule. If a deviation Communication paradigm

is detected, the dispatcher may elaborate a new
The RSSMS communication paradigm is governed
plan, the reactive adjuster, in order to achieve the
by the four organizational principles, which are
planned schedule of the truck. Considering, for
listed in Appendix 1, as suggested by Beer [16].
example, that the truck is scheduled to drive through
However, a complementary communication para-
a region where a snowstorm is expected or already in
digm could be the communication paradigm
progress the dispatcher could anticipate by asses-
suggested by Fortune and Peters [17]. Figure 11
sing the impact of such an event on the planned
shows a dynamic two-way process of communi-
route and evaluate alternative routes. This process
of changing plans is the function of the proactive cation in which the senders message can be used
to modify subsequent messages.
adjuster.

F01304 # IMechE 2005 Proc. IMechE Vol. 219 Part F: J. Rail and Rapid Transit