A Sad Safety Track Record
Three serious rail accidents in the last two months is not only a cause for serious concern but an indication of an alarming breakdown in systems that shape railway safety. Safety is the by-product of the normal functioning of the Indian Railways (IR). Clearly, that functioning is now not able to guarantee the required level of safety.
IR doesn’t look at safety in this manner. It believes in what is called the ‘bad apple’ theory: the systems for ensuring safety are fail-safe but for the erratic behaviour of some unreliable ‘bad apples’. Hence, after every accident, one hears the customary refrain that those found responsible for the mishap will be made an example of.
Since the statuary inquiry by the Commissioner of Railway Safety normally limits itself to the sequence of events that led to the accident — and does not go into the organisational factors behind the creation of the accident — systemic failures remain unrecognised and unaddressed. It is time IR discarded the ‘bad apple’ theory and recognised that human error is a symptom of trouble deeper in the system.
Human failure needs to be seen as the starting point of an investigation to understand what the error points to. What were the difficulties that made the people take the decisions. And why the assessments and decisions would have made sense to those who took them when they took them. By adopting this approach, one sees the mistakes as a window of how the whole system works.
For IR to accept this view of human failure, it has to admit that systems are not basically safe. It is the people-system interface that makes systems safe by orienting it towards making safety the prime objective.
Safety is not the only goal when people operate the system. Multiple pressures and goals are always at work that include those of ensuring punctuality, completing maintenance tasks within the available time and materials.
These involve trade-offs between safety and other goals. The tricky part of such decisions is how to balance safety and non-safety goals. For example, making up for late arrival of a train by reducing the time available for maintenance achieves the immediate objective of ensur- ing punctuality. The result is apparent. But how much this decision has ‘borrowed’ from safety is not so easily measurable.
Management and staff face this dilemma everyday. They are being constantly asked to balance multiple objectives, one of which is sticking to the timetable. For example, in the face of capacity constraints, there is a strong resistance to track closure for track maintenance, thereby sacrificing safety for the timetable. There are endless such examples.
Underinvestment over decades has led to such a situation that the old resilience, built into the system through its strong safety culture and nurtured by a stable workforce, has been eroded. Mainly because when norms were watered down to meet commercial and political imp- eratives, the risk picture was never made explicit.
IR needs to do a number of things. First, it needs to rethink its accident model. It can no longer limit itself to seeing accidents only as a chain of events that led to a failure. It must see accidents as related to latent failures that hide in management decisions to procedures to equipment design. And that an accident emerges from normal working of the system that is a systematic by-product of management and staff trying to pursue success under constraints with imperfect understanding of the risks they are creating or trying to reduce during normal maintenance.
The accident inquiry should also go beyond the existing chain-of-events model and look into management decisions that created latent unsafe conditions. Second, IR should develop a risk-assessment system that spots when the system has moved outside the clearly defined safe envelope and must stop, regroup and restart only when safe operating conditions have been established. IR needs to accept that making safety an active feature may need sacrificing goals, traffic volumes and punctuality.
Third, it needs to get away from using fear of punishment as an instrument for achieving safety. It does not work because human errors are a symptom of a systemic problem that everyone may be vulnerable to. The error is not the ‘end of an inquiry’ but the beginning of an investigation.
Finally, IR has to avoid the trap of new technologies. New technologies may remove a particular error potential, but they will most likely present new complexities and error traps with associated safety concerns.
The writer is former general manager, Indian Railways
Move! Can’t you hear my whistle? Engine’s whistle is not working