Designing highly automated safety-critical railway system and its organization

Abstract

High-speed rail (HSR) has improved dramatically since its launch in 1964 in terms of its technical aspects such as speed and reliability, thanks to technical developments including the automation of the train operation. At the same time, safety has become an increasingly critical aspect as the severity of the accidents has become much more severe. Although the automation and newly developed software might have decreased the number of accidents that would not have been prevented without them, they also have introduced new types of hazards and accidents that did not exist before due to the increased level of complexity of the whole system. These hazards include system design errors, component interactions accidents, or software-related errors due to the increased number of interfaces and coordination among internal and external stakeholders and higher dependency on automation and software.

Thus eliminating component failures should not be the only design consideration or priority, and more consideration should be given to eliminating coordination or design errors that would not be solved by redundancy for the sake of reliability improvement. This thesis mainly focuses on analyzing the past accidents caused by systematic failures and provides recommendations and considerations for designing and operating highly automated complex safety-critical railway systems. Often, the accident analysis finishes once someone is found to be responsible, but this thesis focuses on figuring out why they behaved that way by using the STAMP framework, which is based on systems theory, documenting the systemic factors which contributed to the accidents. The analysis thus looks into not only physical systems but also organizational aspects, such as management, organization culture, and other social-technical aspects.

Two accident analyses revealed causal factors on every level of the organization, including policy makers, audit authority, management, human operators and engineers, physical systems, and so on. In addition, the analyses provide the conceptual explanation of how the systems migrate into an unsafe state over time. The set of knowledge learned through the analyses is summarized as 35 lessons learned. These lessons are of use for future considerations in designing highly-automated safety-critical railway systems and their organization.