UK Railway Restructuring and the Impact on the Safety … · 2016. 3. 15. · The Management of...

Railway Reforms in Europe

Feature

Japan Railway & Transport Review 34 • March 20034 Copyright © 2003 EJRCF. All rights reserved.

UK Railway Restructuring and the Impact onthe Safety Performance of Heavy Rail Network

Roderick I Muttram

Background

Between 1993 and 1996, the formervertically integrated British Rail (BR)organization was split into more than 100parts and sold, privatized or franchised.Much has been said about the separationof management of the track from that oftrains and about the privatization ofinfrastructure ownership, but therestructuring went well beyond just that.Following the recommendations ofconsultants, the British government splitBR into over 100 legally separate parts. Itis that fragmentation and the manner ofcertain parts of it, that in combination withsevere historic under-investment has ledto some problems for the UK railwaysys tem and not , in my opinion,privatization itself or the organizationalseparation of track and trains. The processhas also produced some notable and oftenunrecognized successes. Amongst themis a significant underlying improvementin key safety performance indicators,achieved despite radical structural changeand a public and media perception,conditioned by a few highly reportedaccidents, that safety has worsened.

Introduction

The separation of the management ofrailway infrastructure and train operationsin European Member states is a legalrequirement under EU Directive 91/440/EEC, which became law in 1991. Therequirement is for separation at least to alevel where infrastructure costs aresufficiently transparent to allow the faircosting of access by other operators.Separate ownership is not required but theBritish government decided to go wellbeyond the minimum requirements. Thearchitects of UK rail privatization hadanother objective—to reduce the cost tothe State of managing a declining industry.

Whilst there was talk about innovationpotentially bringing growth, few believedthis would happen. In the later days ofBR, there had been some notablesuccesses. The ‘Business Sector’ or‘Organization for Quality’ reorganizationhad delivered some good results,particularly in the InterCity area. Butoverall, BR had been in an underlyingdecline for many years; there had beenshort-term upswings associated with theeconomic cycle, but the long term trendwas clearly down. Little thought wasgiven in the privatization process to themanagement of innovation or growth orto how the hundreds of new interfaceswould affect such matters.U n d e r B R , t r a i n s , s i g n a l l i n g ,electrification, etc., were usually designedor heavily influenced by the RailwayTechnical Centre at Derby (sometimesworking with other BR departments) whoalso took responsibility for putting thingsright when they did not work as planned.For instance, rolling stock was oftendeveloped in service with designdeficiencies corrected at BR’s cost. Thetrain manufacturing facilities, which hadbeen sold to the private sector in an earlierexercise, were essentially ‘build-to-print’organizations. The management ofsystems that crossed interfaces betweentrack and trains, or between companies,had never been a significant issue becauseresponsibility for the limited number thatexisted fell to individual BR functionaldepartments with responsibilities alsospanning the interfaces.The problem was compounded becausethe underlying complexity of railways hasbeen growing. The introduction of three-phase-motor electric traction, with on-board power conversion, coupled with thero l l -ou t o f the compute r-basedinterlockings pioneered by BR in the early1980s was increasingly making thetechnical interfaces more complex andharder to analyse when incrementalchanges were made. Easy-to-change but

hard-to-reliably predict computer-basedsystems driven by software were makingthe safety validation of these systems anincreasing issue too.Additionally, as a vertically integratedorganization, BR had relied heavily onlocal knowledge and the apprenticeshipof staff who learned on the job fromcolleagues; there were few formalsystems of the type needed to support afragmented structure. Those who craftedthe shape of , and rules for, theprivatization were primarily lawyers andfinance people, not engineers. The BRengineers involved came primarily fromthis ‘local knowledge’ culture and fromthe functional directorates of Signallingand Telecommunications (S & T),Mechanical and Electrical Engineering (M& EE), or Civil Engineering; theirexperience of such organizational andtechnical interface issues was severelylimited. Where they had managedinterfaces, both sides were controlled bytheir organization. The new structure wasput together on the basis that interfaceswould be managed by the use ofcontracts and standards. For instance, itwas assumed that a piece of rolling stockconstructed to Railway Group Standards(about which more later) and verified asbeing compliant with them, would besafe to run on the infrastructure with nomore work. Further, only key parametersgoverning safety needed to be coveredin such Standards, commercial issuescould be left to individual companies orwhere necessary would be governed bycontract. Even if the Standards had beeninherited in much better shape than theywere, such an approach has inherentproblems, the more so given that the UK’searlier history of privately built railwaysconstructed by many different companieshad produced highly non-uniforminfrastructure. The immaturity of manyo f t h e n e w c o m p a n i e s f u r t h e rcompounded the problems.

Japan Railway & Transport Review 34 • March 2003 5Copyright © 2003 EJRCF. All rights reserved.

The Management of Safety

In the run up to privatization, the UKrailway safety regulator—the State-ownedbut independently governed Health andSafety Executive (HSE)—wrote the reportEnsuring Safety on Britain’s Railways,examining the various options formanaging safety in the soon-to-be-established fragmented structure. Theyconcluded that railways should bebrought fully into the regime governed bythe UK Health and Safety at Work Act andsubject to Safety Case arrangementssimilar to those introduced in the UKoffshore oil industry after the Piper Alphadisaster. Railtrack, the infrastructureowner and operator, and every trainoperator would be required by law toproduce a formal Safety Case documentsetting out an assessment of the safety risksaffecting operation, and the systems andprocesses by which they would becontrolled. The HSE would acceptRailtrack’s Railway Safety Case as thecontroller of ‘the premises’ but not thoseof the operators (see below).Thus, when BR was split-up ready forprivatization in 1994, it’s Safety andStandards Directorate (S & SD), which wasresponsible for network-wide Standards(later to become known as the RailwayGroup Standards), passed to the networkinfrastructure owner and operatorRailtrack. The HSE believed that Railtrackhad special responsibilities as the ownerof the network to control the risk importedby operators. The Directorate was givenboth the responsibility of setting networkStandards regarding system safety and safeinterworking and the duty to accept theRailway Safety Cases of train operators asprescribed by the Railway (Safety Case)Regulations 1994. This system, where theHSE accepted Railtrack’s Railway SafetyCase and Railtrack accepted those of trainoperators was called ‘the cascade.’ Beforethe split-up of BR, late in 1993, the

managers tasked with setting up Railtrackhad suggested that it might be better if theS & SD was established as an independentorganization unconnected to any of thenew commercial companies, but the HSErejected this as ‘not giving Railtrackenough responsibility.’

Early Developments

Not too long after Railtrack was privatizedin 1996, a number of people, and mostimportantly the Parliamentary SelectCommittee on Environment, Transport andthe Regions, began to question whether itwas appropriate for a commercialorganization like Railtrack to set the SafetyStandards for, and approve the SafetyCases of, other commercial companies(the operators). The government hadchanged in early 1997 and the newLabour government had strongly opposedthe privatization of the railways when itwas in opposition. Indeed it hadthreatened re-nationalization, but backedaway from this on coming to powerbecause of the costs and potentialdisruption such a move would incur. TheLabour Party in the UK has always hadvery close links with the trades unionmovement, which was and remainsfundamentally opposed to the principleof privatization of the railways, or anyother public service for that matter.

The reforms to working practice broughtabout by the contract ing out ofmaintenance were particularly unpopularwith the t rades unions. The BRmaintenance units were sold by trade sale,largely to civil engineering companies,who as part of their reforms introducedmuch more sub-contracting. Sub-contractors often lacked the skills andlocal knowledge on which BR’s practiceshad depended. Further, the maintenancecontracts set up as part of the privatizationand inherited by Railtrack were overlyfavourable to the contractors in manyrespects and included a very high profitrate (15%). These measures wereintended by government to maximize theprice of the former BR maintenance unitswhen they were sold, realizing a goodshort-term gain for the Treasury. As wellas being loaded in the contractor’s favour,these initial contracts also attempted topass maintenance responsibility on aperformance basis to the contractors in away that left Railtrack with too littlecontrol over things for which it was clearlylegally responsible. Some well-publicizedmaintenance failures occurred, many ofthem associated with the inappropriateuse, and/or fai lure to ensure thecompetenVØÉ of sub-contractors. The HSEreviewed matters and published a verycritical report on Railtrack’s managementof its contractors (with little or norecognition of the problems built into the

London commuter train near Clappham Junction in BR days (EJRCF)

Japan Railway & Transport Review 34 • March 20036


Copyright © 2003 EJRCF. All rights reserved.

arrangements by the privatization). Assome of the contractors started to reporthigh profits (derived from the high marginsbuilt into the contracts by government),the media (encouraged by the tradesunions and some politicians) started tocampaign that the privatized industry wasputting ‘profits before safety,’ whichbecame something of a rallying cry for theopponents of the process.The Select Committee and othersexpressed a concern that ‘safety standardswere falling.’ This was taken to mean thatRailtrack was relaxing the requirementsplaced on its contractors and that S & SDwas in some way complicit in that change.In fact neither was true. It is worth notingthat ‘standard’ is a word with severalmeanings and even a native speaker ofEnglish can be confused by it. In fact, theHSE had never had any significantcriticism of the specifications (thestandards as requirements documents)and S & SD was continuing to developand improve them. Railtrack was alsoputting a lot of work into improving itscompany standards, both uniquely and inresponse to Group Standards changes. Itwas also working on better forms ofmaintenance contract to be introducedwhen the first of the initial contractsexpired, but the shortest contacts were for5 years. The problems lay in the weak(but externally imposed) maintenancecontracts and inadequate funding levelsthat were leading to significant problemsin compliance with Standards. The phrase‘Standards are falling’ often actually meansthat the degree of compliance withStandards is falling, i.e. the Standards arenot being worked to or enforced.

The Problems Continue

A few years after privatization, Railtrack’sinfrastructure was coming undersignificant stress. It was assumed thatprivate management would reduce the

cost of running the system, as hadoccurred with other utility privatizations.In reality, BR had managed the systemfor years on inadequate funding and hadbecome very skilful at ‘make do andmend.’ The split of responsibilities in acontractual relationship do not favoursuch practices. In effect, the government-appointed (commercial) Regulator haspower to control the main source ofRailtrack’s income by setting the level ofTrack Access Charges that Railtrack cancharge train operators. The Regulatorwas pushing Railtrack for efficiencysavings (cost reductions) similar to thoseachieved by other privatizations when,in reality, the baseline contract values formaintenance were already inadequate tomaintain the system in steady state. Tomake matters worse, one of the successesof privatization has been a significant andlargely unanticipated growth in passengernumbers and freight volumes. Thefranchised Train Operating Companies(TOCs) have a high fixed proportion totheir costs and to increase revenues ranmore off-peak trains and used innovativemarketing to fill them—a desirableoutcome for passengers at least. Someother elements of the commercialframework set at privatization turned outto be perverse. For example, someoperators deliberately failed to recover aservice after an infrastructure faultbecause they made more money inpenalties from Railtrack than thedisruption would cost them. On someroutes , passenger numbers haveincreased by 40% to 50% sinceprivatization and most routes have grownby at least 10%. Freight tonne-km alsoincreased in part due to innovativemarketing by the new private operatorsand in part due to new coal flows aspower stations shifted from using localdeep-mined coal to less costly importedopen-cast coal. These heavy extra trainsincreased the wear and tear on thealready under-invested and under-

maintained infrastructure but Railtrackreceived little extra revenue from thembecause of the small variable element inthe pr ic ing s t ructure. A fur theraggravating factor was that Railtrack hadnot inherited any kind of asset register ordatabase from BR and had been muchtoo slow in developing one due to thepressures of separation and privatization.It had little knowledge of what and whereits assets were, let alone their condition.It was in a weak position to argue withthe Regulator for more money because itcould not provide any hard evidence. Inthe absence of such evidence, theRegulator (not unreasonably) looked atother external benchmarks to judgeRailtrack’s needs. Moreover, in some ofthe early years, the financial structure atprivatization had meant that Railtrackhad been able (foolishly as it turns out)to show good profits and it’s share pricewas riding high, so how could it needmore money?Indicators such as track quality and brokenrails started to show a worsening trend andthe HSE intervened again.Against this background and respondingto the recommendations of the SelectCommittee, the then Minister of Transportasked the HSE to look again at the safetystructure of the industry in general and atthe positioning of Railtrack’s S & SD inparticular. They spent over a yeargathering evidence and analyzing it butfound little of concern and certainly noevidence that commercial issues wereadversely influencing safety decisions.Indeed, the main concern came from trainmanufacturers, who in taking on thedesign risk previously borne by BR feltthey were being asked to do too much todemonstrate that new trains were safe, nottoo little. The HSE’s report was sent tothe Minister and the Secretary of State justbefore the serious train collision atLadbroke Grove in October 1999.The Ladbroke Grove collision was themost serious safety failure on Britain’s


railways for a decade. Thirty-one peopleincluding both drivers were killed, andmany more were seriously injured. Theaccident was headline news around theworld. A commuter train belongingto Thames Trains had passed a signalat red and collided head-on with aFirst Great Western High Speed Train(HST) on its way into Paddington. Theclosing speed has been estimated at over220 km/h, making it probably the highestspeed collision between two passengertrains in history. While the immediatecause was obvious—the driver of thecommuter train had cancelled hisAutomatic Warning System (AWS) andpassed a red signal—the underlyingcauses were very complex and involvedmany management failures. The signalhad been passed at danger many timesbefore and Railtrack’s responsibleoperating zone had (with benefit ofh i n d s i g h t ) r e a c t e d s l o w l y a n dinadequately. Another significant factorwas the 1995 decision by government toabandon the nationwide installation ofAutomatic Train Protection (ATP)recommended af ter the ClaphamJunction crash in 1988 because it was tooexpensive. As a result, although the trackat Ladbroke Grove had ATP, thecommuter train did not.When Ladbroke Grove occurred, railwaysafety became a highly political issue andthe HSE report was used as a way ofdistracting attention from the earliergovernment decision not to install ATP.(While the decision not to install ATP hadbeen made by a different government, ithad not been substantially changed bythe sitting government after an earlierATP-preventable collision occurred justa few miles away on the same route atSouthall in September 1997, killing sevenpassengers.) On the Sunday afterLadbroke Grove, the Secretary of Statecame under intense media pressure toresign. In defence, the governmentissued a statement saying that a damning

report by the HSE showed that Railtrackhad put profit before safety and it wouldn o w b e ‘ s t r i p p e d o f i t s s a f e t yresponsibilities.’ The industry had severaldraft copies of the report due to HSEconsultation on the contents; one copyfound its way into the hands of the press,who published the fact that it was not sodamning after all. Actually, it said therewas no s igni f icant problem. ByWednesday, the government had to backdown and announced that Railtrackwou ld r e t a in r e spons ib i l i t y fo roperational safety but the positioning ofits S & SD would be the subject of bothshort- and longer-term inquiries. Thisincident damaged the reputation of boththe railway and the government.The government then launched a numberof new inquiries. The Public Inquirychaired by Lord Cullen would be the mostimportant, but the HSE was also asked tolook at Railtrack’s safety managementsystem in a shorter t ime-scale; acommittee led by a senior civil servantwould look at any short-term measuresneeded to fix ‘the S & SD problem.’ Du

Pont was also commissioned by S & SDto carry out a revue of safety managementin the industry.None of these short-term inquiries foundany problem with the way S & SD hadbehaved. It was shown to have been fairand even-handed, to have worked hardin the pursuit of safety improvement andno evidence was found that commercialmatters had ever been put before safety.Nevertheless, the review committeerecommended that pending the outcomeof Lord Cullen’s Inquiry, S & SD shouldbe separated from Railtrack to the greatestextent possible without legislation. Anew subsidiary company, Railway Safety,was established which while still ownedby Railtrack was an independent, not-for-profit company (limited by guarantee)with its own board of directors formedof representatives of all the industry andindependent safety experts.Sir David Davies, then President of theRoyal Academy of Engineering, agreedto become Chairman of Railway Safety,and a number o f o ther eminentindependent safety experts joined the

Thirty-one people died in this tragic accident at Ladbroke Grove. One side of the leading carriage of the ThamesTrains commuter train can be seen resting on the roofs of the other carriages. The burned remains of carriage H ofthe First Great Western HST are on the right. The two trains collided head-on with a combined speed of over220 km/h. (Author)




new board. As Director S & SD, I wastransferred to become Chief Executive ofthe new company. Senior managers inRailway Safety are prohibited fromholding shares in any railway company.Concurrently with the establishment ofRailway Safety, the ‘cascade’ wasabandoned and the process of approvingoperators’ Railway Safety Cases waspassed to the HSE. However, RailwaySafety has a statutory duty to review themand either recommend acceptance orpoint out deficiencies.Part 2 of Lord Cullen’s Inquiry waspublished in September 2001. It lookedat the industry’s safety structure andrecommended the transfer of RailwaySafety’s functions to a new legal entity thatis independent of Railtrack, but withgovernance by representative of the wholeindustry—Railtrack, the operators,contractors, manufacturers and therailway trades unions. The process toestablish this new company, which willbe known as the Rail Safety and StandardsBoard (RSSB), is complex and it will beApril 2003 at the earliest before it is upand running. Lord Cullen was not criticalof S & SD or Railway Safety in his report.He recommended that there should be anindustry safety body separate from thesafety regulator (which should remain theHSE) and not owned by the infrastructurecompany alone, to avoid even a suspicionof bias. All the staff from Railway Safetywill transfer to RSSB. Until the transfer iscomplete, Railway Safety will perform itscurrent role at the heart of the railwayindustry ’s arrangement for safetycollaboration in a fragmented industry.

Safety Performance—The Real Story

So, what really happened to the safetyperformance of the UK main-line railwaythrough the privatization process? Thereality is different to the perception; infact the safety process has been a

significant success and safety hasimproved overa l l . Lord Cul lenrecognized this fact and recommendedthat the Safety Case system continue.This does not excuse the failures that leadto the recent high-profile accidents—there i s s t i l l a need for fu r therimprovement. Anyway, the politicalinvolvement and high media profile havechanged public expectations and thereis now a much lower tolerance of railwayaccidents than there was in the past.Figure 1 shows a graph of all collisionsa n d d e r a i l m e n t s o n R a i l t r a c kinfrastructure normalized by millions oftrain-miles. As can be seen, the rate hasimproved by more than a factor of threesince the restructuring in 1994. If the dataare normalized by millions of train-kmto be more familiar to people outside theUK and USA, the rate is now at about0.6, which is amongst the best in Europeand within a factor of two or three of theexcellent performance achieved in Japan.Figure 2 shows the rate of Signals PassedAt Danger (SPADs) for the UK main-linenetwork. What had been a f la tperformance up to 1994 has, sincerestructuring, improved by more than afactor of two. This has been achieved bya wide range of initiatives both to improvetraining and awareness and measuressuch as improved signal sighting and areminder device in the cab to address ‘startaway from red’ SPADs. It has not involvedthe widespread deployment of ATP. AfterLadbroke Grove, a programme wasimplemented to fit a national simple trainprotection system as quickly as possible.This so-called Train Protection andWarning System (TPWS) is functionallys imi lar to Japan ’s ATS-SN. Theprogramme is now nearing completionand further substantial SPAD ratereductions are being achieved along witha reduction in the number of more severeSPADs due to a shift to lower categoriescaused by the mitigating effect of TPWS.I am the Chairman of a national

Programme Board that is overseeing anational project team looking atdeployment of full ATP to the newEuropean Standard (ERTMS), in the longerterm, particularly on higher-speed routes.Many other Key Safety PerformanceIndicators, such as broken rails and track-geometry faults also show improvementover the period since privatization. Spaceprecludes their inclusion in this article butfurther data on UK railway safetyperformance, including comprehensivedownloadable annual safety performancer e p o r t s , c a n b e f o u n d a thttp://www.railwaysafety.org.uk.

Recent Events

In October 2000 and during Lord Cullen’sinquiry, a high-speed derailment causedby a broken rail occurred at Hatfield onthe East Coast Main Line north of London,leading to four deaths and many injuries.The rail had suffered serious damage dueto rolling-contact fatigue; it had beenidentified for replacement but had notbeen changed and other controlsrequired by the Standards had not beenimposed. An immediate examination ofthe network revealed unexpected levelsof rolling-contact fatigue (and itsassociated damage symptoms, gaugecorner cracking and head checking) atmany other locations. The Railtrackmanagement, battered by media,government and regulatory pressure, andfaced with yet more criticism of its controlof contractors, reacted with panic. Itimposed emergency speed limits as lowas 20 mph (32 km/h) at rolling contactfatigue sites all across the network,including on 200 km/h lines. Journeytimes became extended to a completelyunacceptable degree and the timetablecollapsed. The network was crippled,and to some degree, has still not fullyrecovered more than 2 years later. MrGerald Corbett, Railtrack’s high-profile


Chief Executive, resigned a few weeksafter Hatfield. An emergency programmewas initiated to replace rails, switchesand crossings. It went on for manymonths and the costs and associatedcommercial penalties to operators for theresultant disruption drove Railtrack todeclare a heavy loss in fiscal 2000–01.The cries of ‘profits before safety’ wereheard yet again. The public inquiries intoLadbroke Grove were still being held atthe time of Hatfield. Prior to hisresignation, Mr Corbett was due to giveevidence and was subjected to heavypressure regarding the balance betweenperformance and safety. It was suggestedthat part of the reason for the Hatfieldderailment was that the high penaltiesassociated with delays or unplannedrepair work had made Railtrack and itscontractors reluctant to do essential workif it would disrupt train operations.Railtrack had been running a majordelay-minute reduction campaign and itwas said that the high profile of thiscampaign had drowned out the safetymessage. Although others made the pointthat good performance and safety are notincompatible (quoting Japan as evidencet h a t b o t h c a n b e a c h i e v e dsimultaneously), the impression wascer ta in ly le f t tha t the dr ive fo rperformance had produced a mind-setwhere the focus was on improvingperformance and that safety had been

seen as secondary because it was alreadyOK. In other words, complacency aboutsafety had set in for some people at least.T h e s u b s e q u e n t i n d e p e n d e n tinvestigation into why there had been asignificant increase in rolling-contactf a t i gue on Ra i l t r a ck ’s ne two rkemphasized the degree to which this wasa system issue, outside the control of anyone of the players in the privatizedindustry. It had much to do withintroduction of new rolling stock withbetter ride characteristics that reducedtrack wear but allowed fatigue to developas a result. However, Railtrack’s reactionand its already poor reputation acquiredfrom prior events meant that it took theblame. The last straw came when, in anattempt to maintain at least some friends(in the financial institutions), Railtrackpaid a 2000–01 d iv idend to i t sshareholders despite heavy losses andwhile asking for more governmentmoney. An infuriated government usedits powers under the Railways Act to putRailtrack into Railway Administration inOctober 2001. A year later it was boughtout of administration by Network Rail, anot-for-profit company established withgovernment support. Few mournedRailtrack’s demise and little recognitionis given to the many problems it inheritedor the things it did achieve (such as thecomplete refurbishment of Britain’spreviously crumbling large Victorian

stations). Hopefully, Network Rail willsucceed because it has the politicalsupport that Railtrack never had.

Managing Systems

Meanwhile, the quest continues for asatisfactory answer to the problem ofmanaging cross-boundary systems in afragmented industry.The government’s Strategic Rail Authority(SRA) was formally constituted in February2001 to provide strategic leadership to theindustry. Under the guidance of Mr RichardBowker, its new Chairman and ChiefExecutive, it is finally providing the overallstrategic direction (including at timesdetailed specifications) on the type ofrailway the government is prepared tosupport. While public spending on therailway has doubled in recent years, thereis still considerable doubt as to whether thisis enough to meet the public desire for abetter system, particularly given the historicbacklog remaining to be overcome.Within this framework, if the growth incosts is to be contained and moredelivered within the available funding, theindustry has to find better ways to worktogether to deliver the outputs the SRAwants. Better management of systems thatcross operational, organizational andownership boundaries is a key elementin this.

Figure 1 All Collisions and Derailments on RaitrackInfrastructure

0.8

0.7

0.6

0.5

0.4

0.3

0.2

0.1

0.01988/89 1989/90 1990/91 1991/92 1992/93 1993/94 1994/95

Privatization1995/96 1996/97 1997/98 1998/99 1999/00 2000/01 2001/02

2000/01 rate = 0.219 2001/02 rate = 0.109 50.4% better than 2000/01

Acc

iden

ts/M

illio

n to

tal t

rain

mile

s

Figure 2 All SPADs and Two Categories of Severe SPADs

3.5

3.0

2.5

2.0

1.5

1.0

0.5

0.01989/90 1990/91 1991/92 1992/93 1993/94 1994/95 1995/96 1996/97 1997/98 1998/99 1999/00 2000/01

Total Severity 4 to 8Severity 3 to 8

SPA

Ds

(on

or a

ffect

ing

runn

ing

line)

/mill

ion

trai

n m

iles

A reduction by a factor of two has been achieved without widespreaddeployment of ATP.




Systems are made by bringing togethermany components to achieve somethingthat none could achieve on its own. Abattery, two wires and a bulb can makelight, an ‘emergent property’ possessed bynone of the components. Management ofsystems requires an understanding both ofthe properties of the components and ofthe intended emergent property. Thecomponents may be physical (such as awire) or abstract (such as a way of working).The emergent properties also may beabstract, such as safety or efficiency.Systems can also have unintended andundesirable emergent properties. Thespecification of what the component willdo always has some implicit and unstatedassumptions of how it will be used. If thesupplier’s assumptions are different fromthose of the user, there is a danger thatsomething unanticipated will occur. Thatunanticipated consequence is not aproperty of any component but of the waythat they are brought together. It emergesfrom the interface between two or morecomponents.T h e p r o b l e m m a y n o t e m e rg eimmediately. A component may worksatisfactorily when first installed butproblems may emerge later, eitherbecause the component changes (fore x a m p l e b e c a u s e o f i n c o r r e c tm a i n t e n a n c e o r i n a p p r o p r i a t emodification) or because the rest of the

system changes or simply through theeffects of aging.The problem of unanticipated behaviouris particularly great if the componentincludes software. There are often verymany unstated assumptions in the designof software and it is impossible in practiceto test every combination of inputconditions and their timing.A full specification of a component shouldinclude a complete list of all the thingsthat it will NOT do, as well as those thatit will. This is not possible for any but thesimplest of components. The onlysatisfactory way of ensuring safety at theinterfaces between components is toempower a system architect, with anoverview of the entire system assuranceprocess, from the start of design andcontinuing throughout the operational life.The Southall Inquiry led by Professor JohnUff took evidence from myself and otherson how such problems might be avoidedin the future, accepting that a return to asingle vertically integrated organizationwas not going to happen. I suggested theidea of a System Authority and this wassupported by others. I also suggested thata recommendation from the Inquiry ondevelopment of the concept might helpto speed progress. That recommendationwas made as Recommendation 63 thatstates, ‘One or more System Authoritiesshould be created to oversee the specific

development of any new project on therailways and to oversee continuation ofwork on existing projects, including AWSand ATP.’ The Office of the Rail Regulator(ORR), which is the governmentappointed but independent economicregulator of the UK industry, took the leadin promoting this recommendation. LordCullen also took evidence from myself andothers on this subject and made furtherrecommendations supporting SystemAuthority development in his reports intoLadbroke Grove.Currently, Railway Group Standard GE/RT8049 sets out the form of SystemAuthorities and also the criteria for whenthey must be established. If the need fora System Authority is identified to managea particular system or issue that crossesorganizational boundaries and if theparties do not form a System Authority,Railway Safety can issue a mandaterequiring them to do so. The form selectedfor the System Authorities is that of aCompany Limited by Guarantee. Each ofthe parties, owning or affected by thesystem concerned, must buy a share inthe company. The company’s legalconstitution is set out so as to give it theresponsibility of being the ‘systemarchitect’ making system configurationand trade-off decisions to produce the bestsolution for the system overall. Thecompany can also make decisions aboutredistributing costs to prevent any partybeing disadvantaged. If the best systemsolution is selected then any changesshould always improve the systemposition overall, meaning there shouldalways be a surplus somewhere that islarger than any loss elsewhere needing tobe compensated. Railway Safety acts asthe administrator and facilitator of SystemAuthorities, it also provides them with acompany address, and facilitates thedrawing up of the necessary legaldocuments through its solicitors.Two System Authorities are now up andrunning. Post-Hatfield, the Wheel Rail

Great Western intercity trains at London Paddington Staion in 1999 (EJRCF)


Roderick I Muttram

Mr Muttram is Chief Executive of Railway Safety, a not-for-profit company that sets safety standards

for the UK main-line railway network and acts as the industry’s safety coordinator. He became Chief

Executive on 31 December 2000, having relinquished his positions on the Boards of Railtrack PLC

and Railtrack Group PLC as Director, Safety & Standards. Mr Muttram also holds several other senior

positions with UK and European railway organizations. He is a Chartered Electrical Engineer with

over 30 years experience of engineering in high-hazard industries and has recently been elected a

Fellow of the Royal Academy of Engineering.

Interface System Authority (WRISA) nowmanages the critical wheel–rail interface,including proposing any changes neededto the mandatory Standards for securingsafe interworking to Railway Safety. TheTPWS System Authority looks after thesystem issues regarding the TrainProtection and Warning System.The situation continues to evolve. Since11 September 2001, insurance companiesare very wary of transportation risks andit has proved very difficult to get insurancecover for the System Authorities to protecttheir directors from incurring personalliabilities associated with a SystemAuthority decision. Although WRISA andTPWS are seen as quite successful andtheir members wish them to continue,there is a current reluctance to form anynew authorities because of the insuranceproblems. One solution being discussedis to form System Committees within thenew RSSB. These would not be legallyconstituted companies but would performthe same system architect function fromwithin the RSSB and would be coveredby its insurance provisions. Thissignificantly extends the role of RSSB intoan area that is not just about safety but isalso about commercial optimization of therailway system. For that reason, it is rightlygenerating considerable debate.Whatever the final outcome, one veryclear lesson from the experience of UKrail privatization is that some arrangementmust be found in a fragmented industryto cover ownership of the performance ofsystems in a holistic way.

Lessons Learned fromUK Rail Privatization

So, what are the key lessons from the UKexperience? There are many and somethat are relevant to this article are listedbelow:1. Transport safety is a matter of public

policy—no government could ever behands-off.

2. Railway restructuring is best carriedout at a time of political stability.Whether railways are public orprivate, governments still have a keyrole to play and create the climate inwhich railways operate. Cementingmajor change in a hostile politicalenvironment is very challenging.

3. Whatever organizational structure ischosen make sure responsibilities areclear and aligned. Commercial,operational and safety responsibilitiesshould flow through the interfaces inthe same direction, i.e. the customer–supplier relationship should be in thesame direction for all areas. Railtrackacting as a pseudo-safety regulator onthe TOC’s created conflicts.

4. However the organiza t ion i spartitioned make sure there is a clearresponsibility, either by an individualparty or through a collective process,for system performance. Systemperformance cannot be assuredwholly by standards on different sidesof an interface.

5. Think very carefully about ALL thepossible effects of commercialincentives and be aware of perverseoutcomes.

6. Do NOT change everything at once.Phase in change and outsourceactivities in a controlled way withinthe capabilities of the organization tomanage. People need time to learnnew skills and adapt to new ways ofworking. If there are no areas ofstability, the system will undoubtedlybecome unstable.

7. Fragmenting the organization into toomany parts will spread managementtoo thinly to cope with change—interfaces compound rapidly with thenumber of organizations and interfacesconsume management effort.

8. Never be complacent about safety.However well it seems to be going,railways are amongst the mostcomplex technical and operationalundertakings in the world and requireconstant attention to detail.

9. Public expectations of railway safetyare continuing to increase. Unlessdel ivered sa fe ty per formanceimproves at the same or a better pacethan the expectation, the perceptionwill always be that things are gettingworse even when they are improving.It is necessary to ‘run to stand still’ andfind innovative ways to improvesafety.

10. Much can still be done to improveperformance by working on the softerissues of human factors and the thingsthat influence them rather thanspending large sums on new technicalsolutions.

UK railway privatization has had manysuccesses. They go largely unsung whileits failures are ‘proclaimed from therooftops.’ Privatization has not of itselfcaused the problems—fragmentationcertainly contributed. �

UK Railway Restructuring and the Impact on the Safety … · 2016. 3. 15. · The Management of...

Documents

Transcript of UK Railway Restructuring and the Impact on the Safety … · 2016. 3. 15. · The Management of...