Culture wars, Part 1

I spent three hours viewing the video archive of the Nov. 14, 2017 National Transportation Safety Board meeting convened to review and approve the findings, probable cause and safety recommendations developed from NTSB investigation into the April 3, 2016 collision of Amtrak 89 with M/W equipment at Chester, Pa., on the Northeast Corridor.

The circumstances of the accident:

• 2 Track (Editor’s note: The Pennsylvania Railroad established this nomenclature; Amtrak still uses it on the NEC) was out of service continuously for M/W work between two controlled points. Foul time was intermittently requested on 1, 3, and 4 Tracks. (2 and 3 Tracks are inner tracks, adjacent to each other; 1 and 4 the outer tracks of the four-track configuration).

• During some or all of an overnight period, the roadway worker employee in charge (EIC) had received foul time on 1, 3 and 4 Tracks, and had placed a backhoe on 3 to assist the work being performed on 2. The train dispatcher had properly affixed protection to his control panel, preventing the routing of trains into the fouled tracks.

• At approximately 7:30 AM, the “overnight” EIC released 1, 3 and 4 to the train dispatcher, reporting clear. The train dispatcher properly removed the blocking protection. The overnight EIC had released the tracks and reported clear despite leaving a backhoe on 3 between the control points.

• The “day” EIC and another employee reported to the work site and without determining if, how, and where protection was provided, proceeded to the area of the backhoe. One employee entered the cab of the backhoe. The other, the EIC, was between the backhoe and the M/W equipment on out-of-service 2.

• Receiving no request from a roadway worker for foul time on 3, the train dispatcher selected 3 between the controlled points as the route for Amtrak 89. As the backhoe was a rubber-tired vehicle, it did not shunt the track circuit, and provided no indication of track occupancy. The signal indication that Amtrak 89 received authorized it to proceed on 3 at the maximum authorized speed.

• As 89, operating at 106 mph, approached the M/W equipment located on 2, the locomotive engineer observed the backhoe fouling 3 and initiated an emergency brake application. The train struck the backhoe at 99 mph, killing the employee seated in the machinery. The debris from the collision struck and killed the track supervisor standing between the backhoe and equipment on 2.

The cause of this accident is transparently clear to even the most casual observer: the release of the foul time on 3 by the overnight EIC when the track was still obstructed by the backhoe.

The cause of the fatalities is also transparently clear: the failure of the day EIC to ascertain that foul time protection was in place before entering the track and obstructing train movement.

What is not so transparently clear, but is a fact, is that when an accident results because of employee failure to properly comply with and utilize the protections offered and required by the operating rules and procedures, you can bet that while the accident itself may be a “one-off,” the violations are not. You can be sure that the violations of procedure have achieved the status, or near that, of a regular practice, as in “I’ve done it this way 1,000 times before and it’s always worked.”

The video archive of this meeting should be mandatory viewing for those responsible for safe train operations. All the items in the NTSB’s docket (DCA16FR007) should be required reading.

I was struck by the relative clarity of explanation provided by NTSB investigative staff, and by the relative confusion the NTSB board members distinguishing between processes that are primary to safe train operations, and those that are secondary.

Of course, when we are dealing with operating practices, and a failure of the practitioners, we can’t simply call it that. Operating practices is so 19th century, so railroad-specific so archaic, we have to find another term. We have, and that term is “safety culture.”

Using that term, we can attract the interest of the human performance specialists, the sociologists, the psychologists, and we can get a more complete evaluation of the cause of the failure and the necessary remediation. And that’s a good thing. Nevertheless, improving a “safety culture” only has meaning if we can improve our operating practices, improve compliance with improved operating practices, and improve our practitioners. There is no meaning to a “better” or “robust” or “improving” safety culture separate and apart from the practices and the practitioners.

That gets us to the heart of the conundrum that besets those who want to divorce “improved” safety culture from improved operating practices. And that conundrum is, in a single word, enforcement.

All too often, the advocates of improving the safety culture have identified “enforcement” as a negative element, contrary to the prospect for improvement. Enforcement, after all, targets a specific behavior by specific individuals. Apparently, it appears to some that enforcement then absolves all others from all responsibility, particularly those charged with designing, implementing and supervising safe operating practices.

In my railroad career, I haven’t found that to be the case. In my railroad career, I certainly never felt that assigning responsibility for a specific failure relieved me of my obligation in overseeing a safe operation.

I don’t know of any instance, including stop signal violations, equipment roll-aways and overspeeding, improperly nullifying the intended operation of a safety device, where operating officers in collaboration with the officers from the signal, track, mechanical and traction power departments did not sift through the details of every incident that had produced an evident risk to safe railroad operations; did not review procedures and requirements; and did not make the adjustments we thought would reduce the risk of reoccurrence. I can never remember an incident where we didn’t do that, and where we didn’t communicate that we were doing exactly that.

If we look closely at the list of NTSB findings of factors contributing to the accident, we see that the critical factors contributing to this accident imply remedies. Each remedy is self-evident. The viability of every remedy is dependent upon enforcement:

• 6,7,8. Lack of random drug testing program for M/W personnel. Remedy: testing. Depends on enforcement in the event of testing positive.

• 9,10. Failure of roadway workers in charge to effectively communicate, leading to failure to protect an obstructed track, and failure to establish protection before fouling track. Remedy: improved understanding of and compliance with the procedures for establishing protection transferring control of track during change of shifts. Depends on oversight and enforcement.

• 11,12,13,14,15. Failure to use supplemental shunting devices (SSDs). Remedy: proper use of SSDs. Depends on oversight and enforcement.

• 16,17. Failure of Amtrak management to develop a site-specific work and safety plan. Remedy: development of such plans. Enforcement of the safety requirement enumerated in the plans.

• 18,19,20,21. Failure of M/W EIC to properly conduct job safety briefing. Remedy: Oversight, supervision, enforcement.

In the video presentation, NTSB Chairman Robert Sumwalt makes a point of identifying Amtrak’s “10 Cardinal Rules” as an example of enforcement culture that operates against safety culture. Chairman Sumwalt argues that the “10 Rules” undermine the trust between employees and supervisors essential to the establishment of a collaborative safety culture, because violation of any one of the ten may lead to dismissal from service.

For sure, that sounds severe, but before we go any further with this, let’s take a look at Cardinal Rule 10, violation of which will “likely lead to immediate dismissal”:

• 10. Failure to comply with applicable Roadway Worker Protection (RWP) procedures.

Interesting, because this makes it clear why certain violations might bring immediate dismissal, as the violation itself can lead to death.

Let’s do a thought experiment. Let’s pretend there’s a new and energetic superintendent on the railroad, one who is vitally concerned with the safety of all the personnel working on the railroad, and in particular M/W personnel working in the vicinity of high-speed train traffic. Let’s pretend further this young and eager superintendent wants everyone to know that she will show up anywhere at anytime in any weather just to see for herself how work is being conducted and if there is something she can learn by observation and talking to the employees about how to make the work sites and processes more safe and more efficient.

Let’s pretend this eager superintendent wants to check the work on 2 Track around MP 15.7 on a Saturday morning. She calls the OCC and gets a lineup of track outages, and requests for tracks including the names of the EICs. She drives in her company vehicle to the work site. She arrives at 07:39 hours.

She’s not sure, at first, at what she’s seeing. She can’t believe what she’s seeing. There’s a backhoe on 3, but the dispatcher’s lineup shows 3 in service at this location. She uses the radio in her vehicle and contacts the dispatcher, who confirms 3 is in service. She then, because she does not want to create panic, immediately requests foul time on 3 in her own name. The dispatcher reports that 89 is approaching the area on 3 and can’t provide the foul time.

Now what? Here’s the only acceptable “now what”: The superintendent initiates an emergency call on the radio, “Emergency, Emergency, Emergency, stop all trains approaching MP 15.7 on all tracks.” After initiating the emergency radio call, the superintendent then repeats her request for foul time on 3. If 89 is already by the control point, the superintendent then establishes direct radio contact with 89, giving her name, job title, instructing the train not to move without her permission. If other trains are in the block on 1 and/or 4, she repeats that procedure.

The superintendent may now proceed to the backhoe on track 3, she will ask first: “Who’s in charge here?” Second, she will ask, “What protection did you establish with the train dispatcher before obstructing the track?”

Now let’s ask the superintendent, “Should these employees be immediately removed from service and subject to discipline that might include dismissal?” Let’s ask you. What do you think?

Maybe these employees have good work records. Maybe these employees have no previous disciplinary items on their records. Maybe these employees are four months away from retirement.

You’re asking me? OK, a robust safety culture does not allow employees to jeopardize their own lives or the lives of others.

So I think the young superintendent would exercise the full wisdom embodied in the operating practices of the railroad and remove these employees from service and charge them with rule violations that might mean their dismissal from service. She has no choice. Her decision is not going to be popular with the union representing the employees. Her decision is going to be characterized as excess, harsh, “stiff.” If collective bargaining negotiations are going on, and not well, there’s going to be push-back, resistance, whatever.

Doesn’t matter. Enforcement is the backbone of every robust safety culture.