1. Human Factors in the Development of Safety-Critical Railway Systems
Simon Zhang,
Technical Director,
Lloyd’s Register Rail (Asia) Ltd

2. Factors affecting Safety Critical System Development
3. Design of safe and high performing equipment
1. Management systems and processes to safely guide and control business activities
The Equipment
The System
2. Capable and competent people and culture to deliver safety objectives
The People
IRSC 2012 Conference

3. Human Errors in the Railway World
Human errors can be costly and/or fatal
IRSC 2012 Conference

4. System Lifecycle IRSC 2012 Conference
Where do human errors occur in the development lifecycle?
What type of errors occur & why?
How can they be addressed?
Human factors is about ensuring a fit between the people doing a task and the factors that influence the performance of the task
Tasks in a system lifecycle (EN50126/9 View)
IRSC 2012 Conference 4

5. Strategies for addressing Human Error in System Development
EN50126 Guidelines
Human competency
Human independence during design
Human involvement in verification and validation (V&V)
Interface between human and automated tools
Systematic failure prevention processes
Application of EN50126
Competency is a prerequisite
Education and training are assumptions
IRSC 2012 Conference

6. EN50126 Process Framework
IRSC 2012 Conference

7. EN50129 View (1)
Safety Organisation
IRSC 2012 Conference

8. EN50129 View (2) Systematic failure prevention processes
IRSC 2012 Conference

9. EN50129 View (3)
Human Involvement in V&V
IRSC 2012 Conference

10. Limitations of Process-Based Standards
Incompleteness of processes
Inadequate guidance on human factors in system development
Questionable rationale for SIL and Processes
The processes for higher SIL may not produce safer products or systems
Applicability of standards
Well understood problem domain
Risk totally covered
‘Mature’ project and safety organisation
IRSC 2012 Conference 10

11. Yellow Book’s View Compliance based approach
Using existing standards as the driver to develop and evaluate a system
Risk based approach
Using risk assessment as the driver to develop and evaluate a system
IRSC 2012 Conference

12. Assessor’s View (from LR Rail experience)
IRSC 2012 Conference

13. Emerging Themes from Assessments
Mainly from the Chinese railway signalling industry in recent 3 years
20+ Chinese companies
30+ RPC projects
10+ ISA projects
Aim to explicitly identify and evaluate the underlying risk associated with known human factors in system development
Using EN50126/9 standards as a starting point
Several themes emerged from the studies relating to human errors & human factors
IRSC 2012 Conference

14. Chinese Railway Signalling Industry
China has experienced a large number of railway construction projects in both high speed mainline and metro systems
Lessons from last year’s 7.23 railway accident
Due to serious design flaws in control equipment and improper handling of the lightning strike
Personnel competency is questionable
Re-examine existing safety management systems and development processes
IRSC 2012 Conference

15. Initial Findings – Theme 1
Human competency
Undefined competence requirements on many roles such as verifier, validator and safety engineer
Training and qualification records may not be trusted
Certified or qualified training and education institutes are required
Domain knowledge and experience are more important and can be easily verified via interviewing
Organisational culture and HR policy can also influence
Difficult to keep capable safety engineers
IRSC 2012 Conference

16. Initial Findings – Theme 2
Human Independence during Design
Organisational structures
E.g. rigidly hierarchical structures
Leadership patterns
Two extremes
Responsibilities and roles
Incorrect understanding of allocated responsibilities and authority control
IRSC 2012 Conference

17. Initial Findings – Theme 3
Human Involvement in V&V
Undefined competence requirements on many roles such as verifier, validator and safety engineer
Lacking domain knowledge from the verifier or auditor
Misunderstanding the role of V&V
Lack sufficient project resources for V&V activities
Tight project schedule
IRSC 2012 Conference

18. Initial Findings – Theme 4
Interface between Human and Automated Tools
Undefined competence requirements on the tool users
Lacking of guidance on safety analysis over the tools
Difficult to have a systems approach
Viewing the tool and tool user as a complete system in a context of a project
IRSC 2012 Conference

19. Initial Findings – Theme 5
Systematic failure prevention processes
Inadequate guidance on techniques/measures recommended from standards
linking techniques/measures with a level of recommendations does not help
Tactic knowledge is required
Undefined competence requirements on many roles such as verifier, validator
Safety management system may also help
But there is lack of guidance from the standards
IRSC 2012 Conference

20. Enhancing assessments to evaluate human factors
Is there good:
working culture?,
leadership?
motivation?
Are roles, responsibilities & authorities defined?
Organisational arrangements
Procedures/ tasks demands
Working environment
Workstation/ workplace
Machine interface
Person
Can people reach everything?
Is there enough space to work?
Are there obstructions?
Can a good working posture be achieved?
Can procedures be followed?
Is there time pressure?
What working hours or breaks?
What training is given?
What level of
supervision is there?
What competence is required – are these well defined?
Processes for using tools well developed?
Is there understanding of safety standards?
Is the machine/tool easy to use?
Is the behavior of the tool understood by user?
What happens if the tool fails (e.g. during V&V)?
Is it available where it is needed?
Does the interface meet expectations?
Is the lighting OK?
Is noise a distraction or does it prevent good communication?
Does the temperature make people tired?
What attributes does a person need:
good vision/hearing,
strength,
particular skills,
personality traits
motivation?
Qualifications & experience
Domain knowledge
How can we bring these into the assessments?
IRSC 2012 Conference

21. Evolution of the Standards
Introduction of EN50128:2011 Standard
Definition of 10 roles including verifier and validator
Guidance on support tool for software development
Focus on tool validation and tool specification
New development on EN50126/9 standards in the near future
Merging the EN50126/8/9 standards together
The role and competence requirements of safety engineer need to be defined
More guidance on using the HR/R techniques/measures
Develop guidelines on the SMS (safety management system)
Interface between human and tools needs to be elaborated
IRSC 2012 Conference

22. Future Work
Get feedback on the viability and effectiveness of the approach
Conduct more empirical studies from other geographical areas such as Hong Kong, Taiwan, Korea and India
Define robust human factors evaluation framework
Consider ranking or quantitative assessment
Provide input to the development of new EN5016/8/9 standards
Industry research into root causes of Human Errors during system design
IRSC 2012 Conference

23. Conclusions Do not take human competency for granted;
Company/project management styles can always influence human independence;
Human judgement determines the V&V success criteria;
Interface between human and automated tools can be unexpectedly complex;
Understanding the rationale behind techniques/measures is more important than choosing which in the systematic failure prevention processes.
IRSC 2012 Conference

24. Finally
“Human error plays a part in most, if not all, accidents. If you have not considered human error when specifying your work, it will be difficult to show that you have controlled risk to an acceptable level”.
“Human error has causes. We understand some of these and know how to prevent them. When designing railway systems you should look for opportunities to prevent human error leading to an accident”.
IRSC 2012 Conference