I joined the Rail Accident Investigation Branch in 2004, after 22 years in the railway industry. I was looking forward to the opportunity to work in an exciting new venture - the UK’s first independent railway accident investigation body. And I have not been disappointed.
I have been privileged to work with a truly extraordinary team of railway professionals across every railway discipline, and I have met many hundreds of fantastic people in this vibrant sector of the UK economy. I have also seen RAIB establish a reputation for high-quality investigations that make a real difference to railway safety.
Since I am about to retire, I wanted to reflect on the learnings from 17 years of investigation. I hope that exposure to many hundreds of investigations has given me an insight into why accidents occur and the difference that the leaders of the railway industry can make.
It is well known and proven that the commitment of industry leaders makes a real difference to safety, as does their ability to communicate the values that underpin every safe and effective organisation. Since much has been written on this subject, this article will instead focus on the causation of accidents and two areas where safety leaders can make a real difference.
The first of these relates to their awareness of risk and the ways of cultivating that awareness. The second is the process of safety management assurance - the means by which industry leaders assure themselves that their risk is being effectively managed.
How do accidents happen?
I guess that every reader of this article is familiar with Professor James Reason’s famous Swiss Cheese model of accident causation. The model presents an organisation’s defences against failure as a series of slices of cheese, with holes. The holes represent weaknesses in individual parts of the system that are continually varying in size and position across the slices. Accidents take place when a hole in every slice momentarily aligns, permitting a “trajectory of accident opportunity”.
What does this model mean in the context of a railway organisation’s safety management arrangements? The slices of cheese are the control measures and the holes are the gaps in your safety defences. The safety threat is that the holes align. The risk is the combination of the likelihood that the holes align and the consequences should this occur.
Good safety management is about taking the actions needed to avoid a trajectory of accident opportunity due to holes aligning. Actions can include adding another slice of cheese (another layer of safety defence), removing or reducing the size of the holes (addressing areas of weakness), or realigning the safety defences so that the holes are very unlikely to ever align.
So, adopting the Swiss cheese model, and reflecting on 17 years of RAIB investigations, it appears that the causes of accidents fall into six distinct categories:
1: A slice of cheese was missing (a layer of safety defence was missing altogether).
2: A hole in a slice was bigger than previously thought (a safety defence was weaker than imagined).
3: Holes were able to align in a way that no one anticipated (the different layers of safety defence interacted in an unexpected manner).
4: No one spotted the existence of a hole (there was an unknown weakness in a safety defence).
5:. The potential alignment in holes was understood, but the risk of this happening was considered to be acceptable (because the risk of the safety defences failing was thought to be as low as reasonably practicable).
6: An unanticipated sequence of events resulted in one or more slices being bypassed altogether (one or more safety defences proved to be irrelevant).
In my experience as an accident investigator, managers at every level of the railway industry generally appreciate the importance of understanding the way in which their organisations deliver safety. However, given the complexity of the railway’s systems, it is often very difficult for those at the heart of an organisation to clearly picture their areas of weakness and how their safety defences interact. Consequently, in many RAIB investigations, it was concluded that a relatively obvious weakness in a safety defence had not been fully appreciated prior to the accident.
