A Railroad’s Cult of Compliance
We look at some of the safety culture lessons from a fatal rail accident in the US and how a more sophisticated approach has been taken in the UK.
On 3 April 2016 an Amtrak New York to Savannah express train struck a backhoe construction vehicle near Chester, Pennsylvania supporting track ballast-vacuuming work. The 532t, 278m train had been authorised to operate at the maximum speed (110 mph) despite ongoing adjacent track works. As the train approached the works the driver (or locomotive engineer) saw equipment and workers and applied the emergency brake.
The train speed was 106 mph before the emergency brake application and 99 mph* when it struck the backhoe.
[* note some NTSB documents say impact was at 88 mph]
Two roadway workers were killed, and 39 other people were injured. Amtrak estimated property damages to be $2.5 million.
For comparison: the kinetic energy of the train at impact was equivalent of a backhoe striking a parked train at a near supersonic speed.
The NTSB determined the probable cause was:
…the unprotected fouled track that was used to route a passenger train at maximum authorized speed; the absence of supplemental shunting devices, which Amtrak required but the foreman could not apply because he had none [SSDs are a simple device to connect the two rails and cause the proceeding signal to display STOP]; and the inadequate transfer of job site responsibilities between foremen during the shift change that resulted in failure to clear the track, to transfer foul time [i.e. the time that adjacent tracks would be temporarily occupied during the works], and to conduct a job briefing.
Allowing these unsafe actions to occur were the inconsistent views of safety and safety management throughout Amtrak’s corporate structure that led to the company’s deficient system safety program that resulted in part from Amtrak’s inadequate collaboration with its unions and from its failure to prioritize safety.
Also contributing to the accident was the Federal Railroad Administration’s failure to require redundant signal protection, such as shunting, for maintenance-of-way work crews who depend on the train dispatcher to provide signal protection, prior to the accident.
It is noticeable that SSDs were a recommendation after a 29 January 1988 accident when a northbound Amtrak train struck engineering equipment in the same town. The NTSB say “Amtrak management failed to issue SSDs to the night foreman, despite their own rules mandating the use of the safety equipment”. Furthermore, NTSB investigators concluded that “there was wide acceptance at Amtrak of not using SSDs” and they were still not a regulatory requirement. The NTSB say the Amtrack procedure for transfer of ‘fouls’ was “cumbersome” and routinely subject to work arounds.
Fourteen safety recommendations were made after the 2016 accident.
In this article we are going to look at some of the safety management, cultural and training lessons, that have relevance beyond the rail industry.
Senior Management Perspectives on Safety
The NTSB say:
Investigators interviewed Amtrak senior executives and division heads… The managers had a variety of attitudes about best safety practices.
Some managers showed little interest or concern about safety beyond the demands of their immediate job responsibilities, others expressed awareness of safety principles but lacked detailed knowledge of them or experience in applying them, and a few managers enthusiastically espoused their use of well-established and contemporary safety management techniques in performing their jobs.
The inconsistent knowledge and views of safety among Amtrak’s managers and executives indicates a significant shortcoming in the company’s safety culture [and] the differing visions of safety within Amtrak have contributed to a failure to establish effective assurances that safety objectives are understood and achieved in a common, progressive manner.
…the Director of Operating Practices recognized the fallibility of human performance (that is, humans do not perform error free 100 percent of the time) yet failed to acknowledge the inherent risks associated with train dispatchers initiating passenger train movements based solely on verbal communications that tracks are clear.
He would not accept a proposal that train dispatchers…verify [safety-critical information communicated by track foremen] through follow-up questions.
Instead, he strongly relied on old railroad industry adages, such as foremen must follow the rules (report only when tracks are clear), and train dispatchers do not need to slow passenger trains through construction zones because there is no rule that requires it.
Cult of Compliance
Indeed, the NTSB comment that reliance on rule compliance was a common perspective amongst Amtrak managers, evident in multiple interviews, as highlighted in an interview with Amtrak’s Chief Safety Officer:
Question: Do construction zones present any unique challenges from your point of view as chief safety officer?
Answer: Not if you follow the rules. You follow the rules, you follow the procedures out there. The rules, there are rules in place that allow the safe passage of trains. It’s when you don’t follow the rules that you get yourself in trouble. …if you follow the rules and procedures, I don’t see it as much of an issue.
However, some of the procedures in place were “cumbersome”, assumed the use of equipment that wasn’t provided and prone to error.
Question: We know rules probably can’t be written to cover every scenario that’s experienced… We know that people can’t be relied upon as 100% rule followers. Is there a take-away from that that may help Amtrak make some improvements beyond what the NTSB recommends?
Answer: I would take exception to your statement that we can’t depend on people to be 100% rule followers. Every employee’s life depends on each and every other employee following the rules. As soon as one employee fails to follow the rules, it puts another employee or the riding public in jeopardy and that’s unacceptable.
We have previously written about a “Culpable Culture of Compliance” after an Australian Transport Safety Bureau (ATSB) report in a fatal man over board from the bulk carrier Cape Splendor off Point Headland, WA on 6 October 2014. That report was of interest because it discusses how blindly emphasising compliance without considering risk may also create a culture that actually undermines safety.
The NTSB comment that rules and procedures are of course an essential element of transport operations but they are a a ‘soft’ defence. They quote James Reason in his 1997 Managing the Risks of Organizational Accidents (p8):
Soft defences…rely heavily upon a combination of paper and people: legislation, regulatory surveillance, rules and procedures, training, drills and briefings, administrative controls (for example, permit-to-work systems and shift handovers), licensing, certification, supervisory oversight and—most critically—front-line operators, particularly in highly automated control systems.
Hard defences include such technical devices as automated engineered safety features, physical barriers, alarms and annunciators, interlocks, keys, personal protective equipment, non-destructive testing, designed-in structural weaknesses (for example, fuse pins on aircraft engine pylons) and improved system design.
The NTSB say:
Rules and procedures can provide a layer of protection, but they do not constitute all the layers of protection that would be expected in a safe system. (Reason 1997, p7)
According to Reason ([in Organizational Accidents Revisited] 2016, p 33), “Good procedures should tell people the most efficient and safest way of carrying out a particular task. It should be noted that clumsy procedures are among the main causes of human violations.” [emphasis added]
Safety experts (for example, Reason 1997, p49–51) do not support the notion that a focus on rules compliance can completely assure [technically 'ensure'] safety.
Despite this, one of the Amtrak actions after the accident was to do more of the same, as they:
Created an independent compliance group outside the engineering department that is composed of a director and four compliance officers augmented by contract support. The group reports to the senior vice president for operations with its initial focus on evaluating compliance with RWP regulations [Roadway Protection Rules - i.e. worker track protection rules] and making recommendations to improve compliance.
One reason for this knee-jerk compliance monitoring reaction is likely to be the volume of safety shortcomings (29 in fact) identified during the investigation:
These…ranged from individual and crew actions to procedural and oversight work practices that facilitated unnecessary risks and increased the likelihood of the accident.
However, the NTSB note (emphasis added):
While mistakes are expected in human work systems, the multitude of unsafe conditions observed indicates a systemic problem. The active failures that occurred indicate that safety was consistently a low priority in the decision making process of the employees involved. The presence of the unsafe latent conditions indicates that management failed to proactively identify and mitigate unsafe conditions.
One reason for that management failure is probably the culture they had created that suppressed learning and open discussion…
Just Culture? Trust or Fear? Learning or Deception?
Union representatives told investigators that…
…the work environment was hostile and made it difficult for workers to perform their jobs safely and to provide peer-to-peer protection for their colleagues, because Amtrak had instituted a “Cardinal Rules” program that could lead to workers’ being fired for a single violation.
The NTSB note that:
The rules placed the burden for safety on workers, and did not hold supervisors or managers accountable for safety.
In other words they create ‘a blame layer’ of front-line employees.
One union official recounted he could think of “8 or 10 people…fired for minor violations of RWP” citing as an example:
… one guy was fired because he got out of a truck on a, basically a dead track, where the grass is this high, and [he] didn’t get RWP protection. A train hasn’t been on that track for 25 years. [emphasis added]
…the fear of being fired “sends terror into every man’s thought and family, when you’re without that income….” [and] resulted in vital safety information not being reported. He said that “engineers were reluctant sometimes to report close calls with track gangs, because they didn’t want to involve the track gang in discipline.”
Another claimed Amtrak threatened to fire employees for not following fall protection protocol, but again failed to provide the necessary resources, saying:
There’s no dialogue … it’s fear. I mean you talk to the managers, they’re afraid. And you can talk to the youngest guy. It’s fear.
NTSB Board Member Christopher Hart observed:
If these violations are inherently dangerous, query why management has chosen to go after them with punishment rather than establishing a program to collect information to help:
(a) identify why employees sometimes do things that they know will probably increase the likelihood of injury, and
(b) provide a basis for determining what to do about the problem.
The NTSB say:
It does not appear that Amtrak management considered the negative impact the Cardinal Rules have… [as] the establishment and enforcement of rules can undermine workers’ perception that Amtrak has a just culture, which is “an atmosphere of trust in which people are encouraged, even rewarded, for providing essential safety-related information.” (Reason 1997, p 195)
We have previously been critical of the corrosive misapplication of proprietary Just Culture ‘decision aids’ marketed as bureaucratic tools for managers, who sit above ‘the blame layer’ to routinely ‘judge’…
…individuals not the system, with the potential to inadvertently reduce trust rather than enhance it. The circumstances that influenced an individual’s performance are seen as factors that mitigate culpability rather than systemic opportunities to improve.
Those ‘just culpability’ tools fail to reward feedback, as Reason originally proposed, by anything other than an inquisition upon the individual concerned and even turn investment in coaching and training as a punishment!
Furthermore they are actually even worse than the Amtrak system in that they don’t actually identify in advance any specific unacceptable behaviours that would result in disciplinary action (other than sabotage which is by definition a criminal matter in a safety critical industry). They only help define ‘the line’ between acceptable and unacceptable after the event and are primarily focused on separating front-line employee’s errors from violations. Great for retribution but not very helpful for employees trying to juggle the inevitable complexity of real life.
When articulating the concept of a Just Culture in his classic 1997 book Managing the Risks of Organizational Accidents, James Reason, Professor Emeritus University of Manchester, highlighted (p205) that acts of wilful negligence or misconduct are actually “rare” (one aviation industry association reports such circumstances occur 1 in 500 reported incidents). Consequentially, as we previously wrote:
The destructive misuse of such Just Culture tools, like a modern day ducking stool, has a negative cultural effect, completely the opposite of some misguided advocates, who without realising it are taking a ‘Just Culpability’ approach.
By simply punishing the individuals at the end of a trail of errors—as the NHS so often does—we pretend to have fixed the problem. I am no fan of PricewaterhouseCoopers, but the best people to prevent future errors may be the people who nearly—or did—make them. Pretending otherwise: that’s la la land.
Systems ergonomist and human factors specialist Steven Shorrock writes:
So to answer the question, “Just culture: Who do we fear?”: it is the judgement of those close to us – in or from the same world – that we fear the most. It is also those close to us who we can help the most.
The similarity between those proprietary tools and Amtrak approach is that despite the references in the Amtrak cardinal rules to ‘zero tolerance’ and consequently ‘severe discipline, likely dismissal’, Amtrak management actually claimed their process had a spectrum of responses:
Amtrak’s Chief Operations Officer indicated that “every single Cardinal Rule violation goes to a group that looks at the mitigating circumstances, and that group decides what the discipline is going to be, and there’s a progressive discipline process.”
The COO later added that “The perception is, wrongfully so, and I think communication, again, could have been better, that you violate one of these rules, you’re terminated. Nothing could be further from the truth.”
The NTSB establish that in 2016 Amtrak “employees had been terminated in Berlin, Connecticut; Chicago; New York; Denver; Philadelphia; Wilmington, Delaware; and Newark, New Jersey” and the NTSB discuss even considering terminating employees as a form of penalising them (presumably due to the stress, fear and uncertainty). They say:
To address the weak safety culture at Amtrak, senior leadership must stop blaming employees for errors and adopt a system perspective. Senior leadership must address employee fear and engage with workers to correct safety issues. Employees and contractors cannot experience reprisals or negative outcomes for their use of any safety management initiative that incorporates a reporting system intended to collect information on safety vulnerabilities and weaknesses.
In advocating a system perspective, thankfully the NTSB don’t recommend implementing a more formal of assigning ‘accountability’ (or ‘determining culpability’) of front line employees or more ‘compliance monitoring’.
Safety Management System
The NTSB comment that:
For Amtrak to address the safety issues identified in this report, a systemwide overhaul [of their approach to safety management] likely will be required.
They go on to explain how the organisation’s SMS is more than a written document (something we discussed in our 2015 article on accidents at another US railroad whose SMS was just ‘shelfware’: Metro-North: Organisational Accidents).
Amtrak are at the centre of another investigation after an Amtrak passenger service derailed near DuPont, Washington on 18 December 2017 leading to 3 fatalities and an estimated $40mn of damage.
The NTSB also observe:
In particular, there appeared to be a gap in Amtrak’s safety training. The Amtrak director of training indicated that there was no field auditing process to evaluate the effectiveness of the classroom training that Amtrak foremen received.
One union official commented that:
…classroom [safety] training was insufficient, and that the instructors lacked experience and could not effectively elaborate on classroom materials. He voiced concern that feedback from the field was not being incorporated into classroom training appropriately.
It is not uncommon to see organisations:
- delivering training rather than facilitating learning
- not assessing the effectiveness of the training they do by anything other than participant feedback forms completed in a rush on the day of the course
New Chief Safety Officer at Amtrak
UPDATE 9 January 2018: Former Flight Safety Foundation Board Chairman Ken Hylander, a retired senior executive with Delta Air Lines, has been named executive vice president and chief safety officer at Amtrak, the passenger rail operator announced. He will report to Amtrak President and CEO Richard Anderson, who previously was CEO at Delta and Northwest who said:
We are improving safety at Amtrak. Keeping our customers and employees safe is our most important responsibility, and a high quality safety management system is a requirement for Amtrak. Ken is a recognized leader in the implementation and operation of SMS, and his experience will be instrumental in helping build our safety culture.
View from the UK
In 2017 the UK Rail Accident Investigation Branch (RAIB) issued a report into the safety of track workers working on Network Rail’s infrastructure “outside possessions of the line” (i.e. where normal running of trains continued during engineering work).
Simon French, Chief Inspector of Rail Accidents said:
Our analysis has also found that the behaviour and attitudes of track workers, including those with responsibilities for leading safety, are major factors…
Given that behavioural and cultural issues can lead to breakdowns in site discipline or loss of vigilance, the RAIB considers that the industry should reinvigorate the training it provides to track workers in the ‘non-technical skills’ [NTS] needed to work safely on the railway (i.e. generic skills such as the ability to take information, focus on the task, make effective decisions, and communicate clearly with others).
The report explains that:
Network Rail introduced NTS training following a series of accidents involving track workers, including those at Trafford Park on 26 October 2005 (RAIB report 16/2006), Ruscombe on 29 April 2007 (RAIB report 04/2008) and Stoats Nest on 12 June 2011 (RAIB report 16/2012). This training was originally targeted on COSSs [Controller of Site Safety], although Network Rail declared its intention to expand its scope to include other roles such as lookouts, signallers, electrical control operators and operations control staff. The aim was to see a reduction in incidents that had an underlying cause associated with non-technical skills, and a reduction in the number of accidents and incidents involving COSSs.
NTS training started in 2012.
Five recommendations were made by the RAIB in 2017 to further protect track workers:
- improvements in procedures and/or training for those in leadership roles to be able to adapt to changes in circumstances
- improvements to the training of track workers in non-technical skills
- changes in the competence requirements for people who lead track work in higher- risk situations
- making location-specific photographic and video information more easily available to staff involved in planning and leading work on the track
- improvements in the collection, analysis and reporting of information on incidents involving track workers.
Noticeably they choose not to simply demand better enforcement and compliance monitoring. Their report also acknowledged that sometimes well considered and risk assessed variations away from written rule might be justified in local circumstances that not fit the rule well.
RAIB commented in a another investigation report:
Other Safety Resources
We highly recommend this case study co-written by our founder, Andy Evans, 2008: ‘Beyond SMS’ by Andy Evans & John Parker, Flight Safety Foundation, AeroSafety World, May 2008 and this 2011 interview with Andy: How Organizational Culture Drives Safety and Quality
You may also be interested in these Aerossurance articles:
- How To Develop Your Organisation’s Safety Culture
- How To Destroy Your Organisation’s Safety Culture a cautionary tale of how poor leadership and communications can undermine safety.
- The US National Transportation Safety Board (NTSB) commented on the poor organisational culture and leadership after the loss of de Havilland DHC-3 Otter floatplane, N270PA in a CFIT in Alaska and the loss of 9 lives: All Aboard CFIT: Alaskan Sightseeing Fatal Flight
- Metro-North: Organisational Accidents: the story of shelfware
- Performance Based Regulation and Detecting the Pathogens: which discusses both the Metro-North and the crude oil train derailment and fire that killed 47 people on 6 July 2013 at Lac-Megantic
- The Power of Safety Leadership: Paul O’Neill, Safety and Alcoa a real life example of safety leadership and how the stock markets reacted badly until O’Neill’s focus on safety, responding to employee suggestions and continuous improvement (not mere compliance) started to created exceptional business performance.
- Chernobyl: 30 Years On – Lessons in Safety Culture
- Leadership and Trust
- Safety Performance Listening and Learning – AEROSPACE March 2017 (co-written)
- Safety Intelligence & Safety Wisdom