تجزیه و تحلیل سیستم از تصادف راه آهن Ladbroke Grove

On 5 October 1999, near London Paddington Station, two trains collided on a main line near Ladbroke Grove. The immediate “human error” that preceded this crash was a Signal Passed At Danger (SPAD). Thirty-one people lost their lives and many more were injured. The crash prompted an extensive multi-disciplinary investigation and hearing to identify the factors that contributed to the Signal Passed At Danger event. This included the involvement of psychologists to consider the human factors “responsible” for the crash and the broader system context, including the operational and organizational environment that may have contributed. This paper summarizes the key factors identified in relation to this crash within a system analysis framework. This framework considers multiple sources of influence upon the driver in relation to the committed Signal Passed At Danger. These influences include direct factors attributable to the driver and the immediate circumstances of the event, as well as indirect, or latent, factors within the operational procedures and the management of the organization. This systemic combination of factors, not an isolated case of human error, conspired to propagate the events that resulted in the Signal Passed At Danger event and subsequent crash. This particular case demonstrates that train crashes cannot be distilled to a single causal factor. Rather, such crashes result from a system failure in which unpredicted interactions between direct and indirect influences coincide at an inopportune instant.

As expressed in the preceding excerpt from a commemorative poem, fatal train crashes, as in other transportation systems, are traumatic and significantly impact society. Historically, the fatal train crash rate has been fairly stable in the United States and Britain. For example, in the USA between 1993 and 2003, the annual crash rate has shown only minor fluctuations, between 3.5 and 4.3 fatal crashes per 1.6 million train kilometers (1 million miles), with no significant downward trend (FRA, 2002). For the same period, train accident fatalities in the UK fluctuated between 1 and 33 (the year of Ladbroke Grove) with an average of 10 fatalities in train accidents per year (HSE, 2003a and HSE, 2003b). Again, there is no evidence of a downward trend. This may suggest that while current safety programs have stabilized the crash risk for rail transportation they have not been able to produce a sufficient impetus to dramatically reduce crash rates. To achieve a step function increase in safety within any transportation mode, it is necessary to view safety from a system perspective and to consider the interaction of all types of crash factors within an integrated framework that defines the crash process. Only in this way will comprehensive safety interventions be discerned and implemented to effectively reduce crash risk within the system. It is clear from Fig. 1 that human error, together with track problems, represent the largest categories of causes of U.S. train crashes between 1999 and 2002. An analysis of primary cause of train incidents in the UK for 2002/03, also gives staff error as a contributory cause of 32 of the 69 collisions occurring on Network Rail within this year.However, there are several fundamental issues with this simplistic formulation of causal factors that limit our ability to understand and prevent future train crashes. First, this formulation may exclude consideration of other types of factors that may have influenced the sequence of events that precipitated the crash. These may include latent factors that reside as “pathogens” within the organizational structures, policies, and procedures of the rail company and governing agencies. These factors, in turn, may influence the propagation of other factors that can have a more immediate influence on the sequence of events resulting in a crash (Reason, 1990 and Reason, 1997). This formulation also ignores the interaction among factors in determining the crash sequence, when, in fact, any factor alone may be necessary but not sufficient without the context of other factors. Moreover, the actual temporal sequence of different factors may not be apparent; therefore, a single factor may be attributed to the crash only because it was mistakenly interpreted as the nearest factor to the crash event. Finally, the interpretation of crashes in terms of independent factors can be biased toward the identification of the human operator as the root cause in an otherwise complex system (Rasmussen, 1990). The attribution of “human error” is often no more than a post-hoc rationalization biased by hindsight. This causal factor is descriptive only, and, therefore, does not provide an explanation of the process that gave rise to a context in which the actions of the human made sense at that moment.

If a limited set of independent factors were to be considered in relation to the Ladbroke Grove crash (see Fig. 1), then this crash might be attributed only to the driver of the Turbo train that perpetrated the SPAD at SN109. However, this is a limited view that does not consider the reasons the driver did not stop at the signal and the interaction that occurred among a complex set of contributing factors. As a result, attributing only “human error” to this crash would focus safety interventions toward just one feature of the system. In so doing, overall safety would not be improved given that the system pathogens that propagated this crash would likely remain within the system. Fortunately, the formal inquires of this crash did adopt a systems perspective to consider both the local (direct) and distal (latent) factors that may have influenced this crash scenario, as well as the interaction between these factors within the system of the rail industry: It was concluded that the poor sighting of the signal, allied to the effect of bright sunlight at a low angle behind the driver, probably led him to believe that he had a proceed aspect. The unusual configuration of the signal not only impaired the initial sighting of its red aspect but also might well have misled an inexperienced driver such as the driver of the turbo. He had only recently qualified as a driver and there were significant shortcomings in his training. (Cullen, 2000b, vol. 2) Thus, the active failure of Mr. Hodder that resulted in the SPAD was related to the local complexity of the signaling and track layout at Ladbroke Grove. These local factors interacted with environmental conditions to produce viewing conditions that were ambiguous for an inexperienced driver operating on expectations of a more familiar routing with a proceed signal. In turn, the emergence of these local conditions may be attributed to distal factors that resided within the different layers of the system that comprised the train company and the rail industry. These latent factors include the complex signaling array that was inherently difficult to interpret a warning system that was not sufficiently informative, and a failure to provide sufficient training and specific information to drivers that may have otherwise prepared them for the inherent SPAD risk at this site. Findings of the inquiry are summarized in Fig. 3, a diagram depicting a systems perspective.