This was just one of the accident\/near-miss investigations I read from the RAIB site, thanks to Mike D sending me the link.\u00a0 It’s an excellent example (so were others, but this one had colored images enough to really “feel” the whole accident and its precursors on both the train side and the signallers’ side.) \u00a0\u00a0 Here’s the link again to that particular accident investigation report–dive in if you want, but I’m going to make a shorter outline of the accident and what I consider the most critical elements (similar but not identical to the investigators.)<\/p>\n
https:\/\/assets.publishing.service.gov.uk\/media\/58e4f1d440f0b606e30000c3\/R042017_170314_Hockham_Road.pdf<\/p>\n
The accident occurred in April of 2016, on a stretch known as the “Thetford Line”.\u00a0\u00a0\u00a0 Access to most of the 43 level crossings of this line (for pedestrians, cars, trucks, tractors with and without trailers, and livestock)\u00a0 is supposed to be controlled by “signallers” in a separate facility, using computer displays to determine if it’s safe to allow the individual to cross.\u00a0\u00a0 Users (those doing the crossing) at many (if not most) of the crossings are expected to open and close safety gates on each side of the railway themselves, use the provided phone to call in to the signallers and obey instructions.\u00a0 Traffic on the roads leading to crossings is highly variable, both by crossing and by time of day and time of year.<\/p>\n
For instance, a safety assessment carried out in June 2014 found that “66 trains\/day passed over the crossing, which was used by 24 vehicles and 8 pedestrians \/<\/span> As a result of the overall traffic on, and across, the tracks, Signallers would experience multiple phone calls requesting clearance to cross within a short length of time on most days, and always during the harvest period, and in multiple locations on the line.\u00a0 Trains had a speed limit of 90mph;\u00a0 and passenger trains would usually run within 5 mph of that maximum for passengers’ sake.\u00a0\u00a0 Thus even a small error by a signaller could result in a collision, as a train running 90mph would cover 1.5 miles in one minute, and 132 feet or 44 yards in one second.<\/p>\n This accident involved a tractor pulling a trailer of feed and an auger.\u00a0 The driver had been given clearance to cross the tracks, did not see the train (curve),\u00a0 and pulled out in front of the train too close for the train to stop.\u00a0 The train was traveling at 87 mph.\u00a0\u00a0 The driver did not hear the train’s warning horn from around a curve, because the tractor cab was soundproofed.\u00a0\u00a0 The tractor was totalled, with serious injuries to the driver and considerable damage to the train, from the initial collision, the auger punching holes in the sides of cars, and a wheel assembly of the tractor that came off and got under the locomotive.\u00a0 Several passengers and the driver had minor injuries.<\/p>\n At first glance, this looks like it was entirely the Signaller’s fault.\u00a0 On closer examination, which the RAIB certainly gave, the accident resulted from multiple failures by different entities at different levels…it’s a system failure to deal with human factors (training, scheduling, suitability for the job, failure to grasp the range of user behaviors, failure to prioritize the right things when commissioning software, etc.)\u00a0 Humans, as well as machines, have performance limits, break down in various ways, and most of those ways are predictable *if looked for*.<\/p>\n First glance at the Signaller involved:\u00a0 1) Due to his diagnosis of diabetes in the recent past, he’d been demoted to a lower managerial position that made him responsible for just the Thetford Line’s Signallers, and required him to “cover” for those who were not available, including (on the shift he was on) the others’ mealtimes.\u00a0 2) He had been in his higher position when the new computer system was installed, and had expressed a dislike of it, and of the computer monitor displays.\u00a0 (Looking at them, they’re “noisy” with information that distracts from what Signallers really need to know to make sound decisions on safety at level crossings.) 3) He had worked several successive night shifts the previous week, ending on Saturday morning, and accepted an overtime day shift on Sunday with insufficient sleep on Saturday.\u00a0 4) He regularly worked overtime shifts as the unit was understaffed, and also had family responsibilities that cut into his sleep schedule (the family responsibilities are not described, but I wondered if his eagerness for overtime work resulted from a cut in pay in his new position and extra expenses relating to those responsibilities (new baby, sick baby, wife, child, or other family member.)\u00a0 6) Although Signaller supervisors were expected to do annual training on every position they might have to fill,\u00a0 with an expectation it would take place during a full shift of work,\u00a0 he had not done that, and instead counted his random short “break period” stints as retraining.\u00a0 7) On the day of the accident, he had come in at 6 am, and then at the lunch break for others, covered one position after another in succession, snacking at the desk.\u00a0 8)\u00a0 He admitted that he had “lost track” of the train involved in the accident, while trying to determine if a train on the other line was a threat (it was 10 minutes away.)\u00a0 In the 15 seconds he spent on the phone with the user, the train involved covered 1.45 miles\/minute, 127.6 feet\/second…and thus in 15 seconds,\u00a0 over a third of a mile.<\/p>\n But there’s a lot more to it.\u00a0\u00a0 Understaffing of the Thetford Line signalling crew meant that *all* the current active employees were taking considerable overtime–it was the “normal culture” to ignore the recommendations for adequate rest and just be there when needed.\u00a0\u00a0 The Signaller involved wasn’t doing anything they all didn’t do, and his boss expected it of them all…they weren’t funded to replace signallers leaving the system at a higher level.\u00a0 This was certainly known to the hiring entity involves; they chose to depend on tired workers.\u00a0 Constant fatigue becomes the new normal and most people (students, writers, everyone) are often unaware of how their performance is impaired by lack of sufficient sleep and recovery time.\u00a0\u00a0 Multiple complaints about both the computers and the other safety equipment were ignored.\u00a0 In fact, additional safety equipment had very recently been removed from the Hockham level crossing (automatic train sensing equipment that gave users a red or green light depending on whether a train was imminent or not)\u00a0 because its manufacturer had not completed a safety form desired by the railroad so that users were deprived of a system they’d been using to augment the signallers.\u00a0\u00a0\u00a0 The Thetford station was not supplied with the number of display screens recommended by the system designer (only 3 instead of 4).<\/p>\n Worst–and definitely the responsibility of those who ordered the software system, not the signallers themselves–is in “Report 04\/2017<\/span> Given the number of trains, level crossings, and users, and the insufficient staffing that led to chronically tired workers, it was inevitable that signallers would make mistakes leading to near-misses and collisions.\u00a0 Their job required them to make fast mental calculations based on variable train speeds, over variable distances, to decide when a train would pass a level crossing…and to trust that users’ estimate of how long it would take them to cross the tracks was accurate.\u00a0 No one, apparently, had ever fact-checked the latter, and signallers (busy with multiple crossings and phone calls) didn’t have the time or ability to fact-check their mental calculations except when they were wrong.<\/span><\/p>\n The technology of computer monitors is adequate to support moving graphics that are easily understandable.\u00a0 But for them to work well, the software must be tested *by potential users* not just software designers\/programmers, and the project aimed at giving those users what they need.\u00a0 (And I say this from my own experience creating software for a very large system–long ago, but the principles of making a system the *users* find helpful are still relevant, though languages, processors, etc. change.)\u00a0 Unfortunately, too many people in the computer business assume that any user can learn quickly to use any software if you, the person introducing it, talks fast enough.\u00a0\u00a0 That is not true.\u00a0 If you want users to use visual modalities, images that mean something other than “there’s a cat\/dog\/pony\/person,” then you need someone who really understands what makes a screen of data easily used, or difficult to use.\u00a0 (Edward Tufte is an international expert in this, not the only one, but I’ve read his books and gone to one of his one-day seminars.\u00a0 Strongly recommended for anyone who wants to make data into easily understood graphical form.)\u00a0\u00a0\u00a0 What a signaller needs to know is where a train is, and when it will be at the next crossing, and the interval between where it is and the next crossing requires a distance\/velocity calculation a computer can do faster than most humans.\u00a0 Therefore the screen should show that: “UP Train 177, 1 mile\u00a0 to Hoxham Road, 0 minutes, 41.3793 seconds, NO CROSSING”.\u00a0\u00a0\u00a0 Or even more simply “WAIT, TRAIN TOO CLOSE.”\u00a0 Next train to cross, “DOWN Train 1K70 10 miles, check again after Train 177 passes”.\u00a0\u00a0 The signaller should be able to input the crossing desired, and both see a simplified graphic to scale (one train, one distance)\u00a0 with clear text below.\u00a0 (There are other options but that would work much better than what you see on the screen now.)\u00a0 The signaller would only have to pick the right crossing from a list, something that can be done much quicker and more easily than trying to remember 143 different level crossings.\u00a0\u00a0 Sidebar the list, tap the chosen crossing, get the display of train number, track, and time to crossing.<\/p>\n From the POV of users, the safety gates should both be operable from either side of the tracks with one button push…no one should be required to walk across the tracks to open the opposite gate and again to shut the gate on the far side after crossing…that exposes the user to more danger.\u00a0\u00a0 Users need instruction on the information to give to the signaller about the vehicle type they’re going to cross in (large tractor, can’t hear train horns, trailer with feed & augur) as user estimates of time to cross the tracks hasn’t been validated.\u00a0 Some vehicles (and ridden horses) should always be given a 2 minute safety margin.\u00a0 (The day I ride across tracks,\u00a0 Hell will be at a pleasantly cool temperature and all the demons will have vanished forever.\u00a0 When I have to drive across a level crossing, I’m hyper, even if there are gates and they’re up. )\u00a0 Was once surprised at a level crossing north of Leander TX: gates up, no lights flashing, but when I crossed, a loco was parked just out of sight (nighttime) with its light blazing in my driver-side window.\u00a0\u00a0 Why it was there, and “live” at that time of night I don’t know but I was still breathing too fast a mile down the road.<\/p>\n Anyway: I was disappointed that the RAIB did not identify the software design as the most basic of the problems here (perhaps knowing that it would not be replaced no matter what…but I’d fight for that, if I were in their shoes.)\u00a0\u00a0 They mention it, but not with the emphasis I place on it.\u00a0 Yes, the Signaller Involved made multiple errors and so did his supervisor, and so did whoever decided that it was OK to work signallers into exhaustion, shift them around the clock on shifts, etc.\u00a0 Yes, the system of uneven distances for sections of track adds to the confusion.\u00a0\u00a0 Yes, other elements of the track safety system leave holes big enough for tractors to drive through (the gates, the off\/on addition\/subtraction of other safety equipment.)\u00a0 But the actual interface between user and signaller, and signaller and necessary data, involves a chunk of computer software that badly (dangerously) needs revision.\u00a0\u00a0 And someone authorized its development and payment for it.<\/p>\n Argue with me.\u00a0 This is a fascinating case, and we can all get something from it.\u00a0 I’m sure I haven’t learned everything it has to teach, yet.<\/p>\n <\/p>\n <\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" This was just one of the accident\/near-miss investigations I read from the RAIB site, thanks to Mike D sending me the link.\u00a0 It’s an excellent example (so were others, but this one had colored images enough to really “feel” the whole accident and its precursors on both the train side and the signallers’ side.) \u00a0\u00a0 Read More…<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,22],"tags":[17,9,24],"class_list":["post-1133","post","type-post","status-publish","format-standard","hentry","category-life-beyond-writing","category-science","tag-life-beyond-writing","tag-research","tag-science"],"_links":{"self":[{"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1133"}],"collection":[{"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=1133"}],"version-history":[{"count":4,"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1133\/revisions"}],"predecessor-version":[{"id":1140,"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1133\/revisions\/1140"}],"wp:attachment":[{"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=1133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=1133"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/elizabethmoon.com\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=1133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
cyclists daily. During the harvest period (June to September) the vehicle traffic <\/span>increased to 100-120 per day.”\u00a0 <\/span>And that’s for only one level crossing of the 43.\u00a0 The Hockham Road crossing involved a road intended to be limited access, for use by the farm and farm employees of a particular farm in accessing fields on both sides of the railway, but sometimes used by paintball players as a shorter access to a paintball recreation center.\u00a0 No information was given about its variation in use during one day (busy periods, slack periods.)<\/p>\n
Hockham Road UWC<\/span>42<\/span>March 2017 :\u00a0 <\/span> The information displayed to a signaller is not designed<\/strong> to help them judge <\/span>when it is safe to allow a user to cross at a UWC.”\u00a0\u00a0 (My emphasis.)\u00a0 In other words, from the beginning, a system intended for signallers to use *was not designed to help them do their\u00a0 job: that of preventing collisions between trains and cross-traffic.*\u00a0 Giving signallers the information they really needed–not the information someone else thought they should have or it would be nifty to have–should have been a top priority for the computer displays they used. Signallers were placed at risk of making fatal errors, not just from confusing, crowded, busy screen displays, but from not having the information they really needed to give quick, accurate responses to the calls they received.\u00a0\u00a0 The graphics on the screen–because of using section data referring to how the tracks were wired to the system–did not give the exact location of trains at any given moment, and there was a variable distance between “axle-counting” units where the trains were “located.”\u00a0 <\/span><\/p>\n