A SYSTEMS APPROACH TO ENHANCING

RAILWAY SAFETY ASSURANCE

Paul Hollywell
BSc, MSc (Lon), MSc (UCL), CEng, MIET, MINCOSE, FIEHF

Technical Director, Railways Division, Mott MacDonald Limited

T +44 (0)20 8774 2609; E paul.hollywell@mottmac.com

Summary
This paper describes how the quality of Safety Assurance can be enhanced through a full and proper
understanding of (a) how the complexity of major rail projects can be managed successfully, (b) how
human and organisational failures can impact railway safety, and (c) how that understanding can
improve using contemporary Safety Assurance processes, methods and tools. This is done by
exploring the synergistic relationships between Systems Engineering (SE), Human Factors &
Ergonomics (HFE) and Safety Assurance. SE promotes structured design and delivery processes
which reduce risk and improve the efficiency of design, delivery, operation and maintenance of
complex engineering projects. HFE manages the human behaviour contribution to system safety
through understanding a person’s capabilities and limitations and evaluating human performance.
Safety Assurance provides confidence as a project progresses through its lifecycle that the delivered
system will be safe to operate and maintain. This paper explains how the quality of Safety Assurance
can be enhanced by applying SE and HFE principles when using contemporary Safety Assurance
processes, methods and tools on major rail projects.

1. INTRODUCTION interact so that perturbations or failures in one

“With advances in technology, major projects
have become hugely complex. Great
engineers of the past like Stephenson and
Brunel could conduct an entire project with a
manageable ‘headful’ of information. This is
no longer possible …”
Major Projects Association, 2002 [11]
In recent years it has become widely
recognised that “major projects have become
hugely complex”, none more so than rail
projects. Those working within the rail industry
are all too familiar with how challenging the rail
environment can be and how difficult it is to
introduce changes. It is not always
appreciated by those outside the industry that
this is because railways are highly complex
due to their inherent nature.
1.1. Complexity of Rail Projects
There are a range of factors associated with
the inherent nature of a railway that make rail
projects highly complex. First, a railway is a
system made up of various different
subsystems that are normally distributed over
large geographical areas. Also, these
subsystems are normally closely coupled and
subsystem can quickly impact on other
subsystems. These subsystems involve a
range of different engineering disciplines. In
those parts of the world where railways were
established in the 1800s and 1900s, there can
be a mix of ‘old’ and ‘new’ technologies which
is challenging. In some locations, the railway
is expected to operate almost 24/7, 52 weeks
of the year. This means that introducing a
major change to a railway has to be done as a
series of smaller changes (i.e. stage works),
each of which has to be managed as a mini-
project in its own right. And at all times, the
public expects high levels of service and safety
and therefore safety authorities require
projects to adopt rigorous Systems Assurance.
Over the last decade the complexity of a
railway has increased further due to the higher
demands placed on it by passengers and other
stakeholders. The trends and drivers of these
enhancements cover three areas: effective
operations, quality service and efficient
systems [1]. Better operational performance
includes increased capacity and improved
reliability. Enhanced quality includes
responsive customer information, product

1
delivery and increased safety. Improved
efficiency includes reduced cost, lower
emissions and limited external impact. To
meet these needs the industry is making
changes to the design and operation of railway
systems to improve the service, reduce cost,
raise energy efficiency, lower emissions,
provide sustainable solutions and lessen the
impact on the environment. While all these
developments are happening, the rail industry
is expected to maintain or even improve its
already high safety standards and follow
rigorous Systems Assurance processes.
Therefore Safety Assurance needs to remain a
key part of the overall Systems Assurance
process of all rail projects whilst advancing as
a discipline to meet these stringent safety
requirements and regulatory approvals.
1.2. Objective of Paper
This paper explores the synergistic
relationships between Systems Engineering
(SE), Human Factors and Ergonomics (HFE)
and Safety Assurance. It explains how the
quality of Safety Assurance can be enhanced
by applying SE and HFE principles when using
contemporary Safety Assurance processes,
methods and tools on major rail projects.
2. SYSTEMS ENGINEERING (SE)
“Engineering systems, and the problems that
they seek to solve, are becoming more
complex. … We need Integrated System
Design that looks holistically at both the need
and the solution, and we need engineers who
can think holistic to carry it out”.
Royal Academy of Engineering, 2007 [18]
In recent years Systems Engineering (SE) has
developed into a mature discipline that
promotes structured design and delivery
processes making all decision-making explicit
and justifiable throughout the project lifecycle.
Such an approach reduces risk and improves
the management of complex engineering
through the project lifecycle. The International
Council on Systems Engineering (INCOSE)
defines SE as: “an interdisciplinary approach
and means to enable the realization of
successful systems. It focuses on defining
customer needs and required functionality
early in the development cycle, documenting
2
requirements, and then proceeding with design
synthesis and system validation while
considering the complete problem: operations,
cost and schedule, performance, training and
support, test, manufacturing, and disposal. SE
considers both the business and the technical
needs of all customers with the goal of
providing a quality product that meets the user
needs” [8]. A simpler (and much shorter)
definition from the INCOSE UK Chapter
defines SE as: “a structured and auditable
approach to identifying requirements,
managing interfaces and controlling risk
throughout the project lifecycle” [7].
SE is essentially ‘systems thinking’ applied to
engineering projects. Although the Body of
Knowledge for SE is large and wide-ranging
(e.g. INCOSE Handbook [8] and ISO SE
standard 15288 [9]), a large part of SE can be
described via the five concepts of ‘systems
thinking’ [2].
2.1. Five Concepts Describing SE
Applying the five concepts of ‘systems
thinking’ to an engineering project via the SE
discipline, assists in managing project
complexities effectively and reducing risk,
including safety risk.
2.1.1 Holism
Holism comes from the Greek word ‘holos’
which means ‘whole’. This concept
encourages the analysis of a system as a
whole rather than merely the separate analysis
of its subsystems. This is because the
system’s functioning and performance cannot
be fully understood solely in terms of its
component parts. It is only when a system’s
elements are combined that it gains qualities
that are not present in the separate parts; they
only exist when these parts are combined
together. Those qualities are known as the
emergent properties of the system and include
safety, reliability and operational performance.
Complex systems, in which the parts interact
with each other and with the surrounding
environment to determine how the system
behaves, are becoming a serious challenge to
engineers as such systems rarely behave
exactly as intuition would predict [18].
2.1.2 Hierarchy
The concept of hierarchy is a commonly
understood one as most engineered systems
(and also most organisational systems) are
hierarchical in nature. The structure of the
whole system can be represented as a
supersystem comprising a hierarchy of
systems, subsystems and components. (A
supersystem is also known as a ‘system-of-
systems’). Considering how the supersystem
is structured, one engineer’s system can be
another person’s supersystem or subsystem.
It should be noted that the risks associated
with each subsystem in the hierarchy
contribute to and ultimately determine the risks
of the whole system. A system breakdown
structure is a valuable way in which an
engineer can, through progressive
decomposition of the whole system, represent
and gain an understanding of a large, complex
system and assign project responsibilities to
the appropriate disciplines. The disadvantage
of hierarchies is that they can sometimes
encourage ‘silo engineering’ i.e. a loss of being
part of a ‘bigger picture’.
2.1.3 Lifecycles
The concept of lifecycles is also commonly
understood as most engineering projects are
divided up into discrete stages to make them
more manageable, i.e. to aid the planning and
control of resources. A lifecycle is composed
of a number of clearly defined and distinct
work phases which designers and engineers
use to plan for, design, build, test, and deliver
engineered systems. Lifecycles make
engineers aware of the totality of the project
development and implementation process.
Lifecycles also remind engineers to think about
the later stages of a project during design
development rather than waiting until designs
are complete. This is known as ‘left shift’ or
concurrent design which brings efficiencies
through avoiding redundant design work and/
or poor design solutions caused by irreversible
decisions. This is because it is easier and
cheaper to make changes during design than
afterwards. An obstacle to implementing ‘left
shift’ is the level of effort needed early in a
project.
3
2.1.4 Partitioning
Considering how a system can be divided up
into discrete subsystems in order to manage
complexity (i.e. ‘dividing and conquering’) is
the concept of partitioning. The resulting
relationship between system functions and
subsystems can sometimes be modular (i.e.
‘one-to-one’) or integrated (i.e. ‘X-to-Y’). There
are clear advantages from partitioning a large
and complex system, similar to those for
hierarchy above. It reduces the complexity of
the overall system and apportions the
responsibilities for individual functions/
subsystems between the most capable and
competent resources. The disadvantage of
these partitions is that they create interfaces
(i.e. technical, contractual and organisational)
that need to be carefully managed. Also, it
can again sometimes encourage ‘silo
engineering’. Having partitioned a system,
developed a design and implemented a
solution, there are the various challenges
associated with recombining the whole system
i.e. system integration. One of these
challenges is the successful management of a
system’s emergent properties including the
safety of the system.
2.1.5 Subjectivity
The concept of subjectivity involves gaining a
deeper understanding of a system through
looking at it from different perspectives. Not
only does this invite different interpretations
and a wider set of requirements, it also
acquires valuable subjective and cultural
information. Thus, this approach provides a
richer and more complete understanding of a
system. It may also reveal and anticipate
concerns or issues early in the project lifecycle
when they can be dealt with quickly and
cheaply. Inviting project stakeholders to
become involved at different lifecycle stages
can bring benefits to a project. For example:
an owner is mainly interested in system
‘value’; a designer in system design; a supplier
in system manufacture/ construction; an
operator in system operability; a maintainer in
system maintainability; a neighbour in system
impact; and a regulator in system compliance
with regulations. Each of these stakeholder
perspectives and concerns bring insights that
identify areas of opportunity and risk.
2.2. Benefits of SE
The benefits from applying SE to rail projects
are varied and numerous, including better
designs, fewer design changes, less design
errors, abortive work and rework. Further
benefits can be achieved through reduced
through-life costs and reduced deployment
timescales. Using a “structured and auditable
approach” based on ‘systems thinking’ will
improve system reliability, availability,
maintainability and safety. It is the latter
benefit of SE that will be explored later in this
paper.
HUMAN FACTORS & ERGONOMICS (HFE)
“To err is human; to forgive, divine”.
Alexander Pope (1688-1744) [13]
It is now widely accepted that human error
contributes significantly to accidents in the
high-hazard industries including rail. Over the
last few decades this HFE contribution has
increased greatly, not because humans have
become any less reliable but because
engineering and equipment have become
much more reliable and more controllable
functions implemented. The International
Ergonomics Association (IEA) defines HFE as:
“the scientific discipline concerned with the
understanding of interactions among humans
and other elements of a system, and the
profession that applies theory, principles, data
and methods to design in order to optimize
human well-being and overall system
performance.” [6].
HFE aims to ensure that designs complement
the strengths and abilities of people and
minimise the effects of their limitations, rather
than forcing them to adapt. Poor designs can
cause people to commit errors, adapt their
behaviours and violate rules [19]. This can
undermine the human reliability and
performance levels claimed by some safety
arguments used in safety cases. If claims on
human performance are to be used, it is
important to first have a full and proper
understanding of human behaviour and human
error.
4
2.3. Human Error Types
To properly understand human error, first
some understanding of the different types of
human behaviour is needed. The Skills, Rules
and Knowledge (SRK) classification of human
performance has been widely adopted to
describe human performance in a range of
situations [14].
Skilled-based behaviour is adopted when
completing familiar and routine tasks that can
be carried out smoothly with little conscious
thought. Rule-based behaviour is adopted
when carrying out more complex or less
familiar tasks according to rules (written or
remembered). Knowledge-based behaviour is
adopted when a completely novel situation is
encountered for which no rules exist and a
task requires a plan of action. The
development of such a plan is derived from
‘first principles’ based on the physical and
functional properties of a system.
The main factors that determine whether we
select skill, rule or knowledge-based behaviour
is our understanding and experience in a
particular situation. The more practiced and
experienced we are, the more skill-based our
behaviour. The less practiced and
experienced we are, the more we rely on rules.
In the extreme, we may have to fall back on
our knowledge-based behaviour and work out
a plan of action from scratch.
The SRK classification of human performance
is used to describe three basic human error
types: skill-based errors, rule-based errors,
and knowledge-based errors [16].
2.3.1 Skill-based errors
Skill-based human errors are most likely to
occur during the largely automatic execution of
routine actions in familiar surroundings.
Almost invariably our minds are on things
other than the immediate details of the task.
People are very good at performing these
habitual, skill-based actions so long as things
remain exactly as they have always been.
‘Slips’ occur when we fail to execute an action
as planned through inattention, due to failing to
monitor the progress of our actions. ‘Lapses’
occur due to memory failures, when we forget
to carry out an intended action (i.e. omission)
or forget that we have already performed a
certain action (i.e. repetition).
2.3.2 Rule-based errors
Rule-based human errors are most likely to
occur when we are dealing with familiar
situations, but apply the wrong ready-made
solution. These errors are known as ‘rule-
based mistakes’ and they come in two basic
forms. We can either misapply a normally
‘good’ plan of action, one that has worked in a
similar situation before, failing to notice the
signs which indicate the need for another
approach (i.e. strong-but-wrong). Or we can
simply apply a ‘bad’ plan of action, one that
has not been used in a similar situation before
and therefore we have no previous evidence
that it works. Rule-based mistakes occur
when we execute an action as planned but an
inappropriate plan of action was chosen.
2.3.3 Knowledge-based errors
Knowledge-based human errors are most
likely to occur when we run out of ready-made
solutions and have to go back to thinking from
‘first principles’ in a totally new situation.
Knowledge-based reasoning is fallible and
these types of errors are known as
‘knowledge-based mistakes’. Although people
are good at coming up with new solutions to
dealing with exceptional circumstances when
they have plenty of time to think, we are
generally very bad doing this under time
pressure, high stress and with the prospect of
imminent disaster. Knowledge-based
mistakes also occur when we execute an
action as planned but an inappropriate plan of
action was chosen.
The SRK classification of human performance
explains why the different types of human error
occur (i.e. slips, lapses and mistakes). Such
human errors can lead to the unintentional
breaking of rules, through incorrectly executing
an appropriate plan of action or correctly
executing an inappropriate plan of action. This
is in contrast to violations where people
deliberately set out to break rules.
5
2.4. Violations
A violation is distinct from a human error in
that a deliberate decision is made to deviate
from a prescribed plan of action (i.e. rule or
procedure) for many reasons. Usually it is a
deliberate but non-malicious non-compliance
with the rules and procedures. While the non-
compliance is intended, the bad outcomes that
sometimes ensue are not. (Procedural non-
compliances committed by vandals, thieves,
saboteurs and terrorists are not normally
included as violations in the human error
literature).
Just as there are different types of human
error, so there are different types of violation.
Violations may be ‘routine’, ‘situational’ or
‘exceptional’ [4]. Again, using the SRK
classification of human performance, these
different types of violation can be classified in
a similar way as with human errors [3] & [20].
2.4.1 Knowledge-based violations
Exceptional violations can be considered as
knowledge-based violations. These violations
are rare and happen only in unusual situations,
often when something goes wrong
unexpectedly when we enter a totally
unfamiliar situation and have to think from ‘first
principles’ how to solve the problem, e.g.
during an emergency; or when the plans of
action that we normally follow start to break
down, forcing us to break the rules and
procedures. Should this type of violation
become a regular or habitual event, then it
could become a rule-based violation.
2.4.2 Rule-based violations
Situational violations can be considered as
rule-based violations. These violations occur
when we enter a familiar situation and follow a
plan of action that has worked for us before
which goes against the rules and procedures.
Often these violations are dictated by a
person’s immediate work space or
environment (physical or organisational).
These can include the design and condition of
the work area, time pressure, number of staff,
supervision, equipment availability and design,
weather and time of day. Should this type of
violation become the normal way a person (or
peer/ work group) behaves, then it is likely that
it will become habitual and develop into a skill-
based violation.
2.4.3 Skill-based violations
Routine violations can be considered as skill-
based violations. These violations occur when
we automatically and unconsciously break a
rule or procedure because such an action has
become a natural response to us (our peer/
work group) and such actions have gone
unchallenged in the past.
The concept of skill, rule and knowledge-
based violations is extremely useful as it
simplifies the nature of violations and makes
them more understandable to the non-
specialist. It also reveals strategies for
reducing violations that are similar to those
used to combat skill, rule and knowledge-
based human errors, as outlined later. The
above reasons for human error and violations
is summarised in Figure 2.
2.5. Improving Human Performance
Understanding why human error and violations
occur enables effective strategies to be
developed for improving human performance.
2.5.1 Reducing human error
The strategies adopted to reduce human error
need to recognise the different types of human
behaviour that cause these occurrences [5].
Skill-based errors, i.e. slips and lapses, cannot
be totally eliminated but changing the design
through applying HFE guidance can reduce
the likelihood of human error occurring.
Design changes can also reduce the degree of
harm for when human error occurs.
Rule-based mistakes can be reduced through
aiding an individual in three areas. Giving
training to a person provides knowledge and
experience in applying plans of action. This
should be done after design improvements
have been made so that training costs are
minimised. Supporting a person when
carrying out a task (e.g. supervision,
procedures, checklists, decision-making tools,
automation) will assist greatly. Raising a
person’s awareness of the needs and benefits
of actions rather than allowing them
‘mindlessly’ follow a series of procedural steps.
6
Knowledge-based mistakes can be reduced
through attempting to ensure that a person
never has to rely on knowledge-based
reasoning in a safety-related situation, and that
the available rules and procedures are
adequate, particularly when the situation could
be stressful. If, however, knowledge-based
reasoning is unavoidable, a person should be
given sufficient knowledge and experience
about a system to ensure they can reason
things reliably.
2.5.2 Reducing violations
Any strategies adopted to reduce violations
need to reduce both a person’s motivation to
commit violations and change an
organisation’s processes to reduce the
opportunity and likelihood of violations being
committed. Both these ‘internal’ and ‘external’
aspects of violations need to be dealt with [12].
Violations tend to originate from a perceived
conflict between an individual person’s goals
and the goals of an organisation. For
example, an organisation wants to improve
safety, whilst an individual may at times decide
to improve their own efficiency, speed,
comfort, convenience, finances or social
conformance. A large part of reducing
violations successfully is about aligning
personal and organisational goals.
2.6. Benefits of HFE
It can be seen that humans are fallible and
errors can be expected in predictable ways.
HFE provides a valuable understanding of
human performance, clarifies how people
contribute to safety, and gives guidance on
how human performance can be improved and
assured as part of safety arguments. The
safety of human performance could relate to
tasks required to be undertaken during normal,
abnormal or emergency conditions.
3. ORGANISATIONAL SAFETY
People form organisations to enable certain
functions to be performed. With regards to rail
projects these functions cover project delivery,
and railway operation and maintenance.
These organisations have developed
processes and procedures to manage safety
which can be observed in a Design Safety
Case, Operational Safety Case and
Operational Safety Management System
(SMS). By examining a system model of an
organisation it can be seen how organisations
can fail with safety consequences and how
HFE contributes to those failures. The system
model shows that humans are fallible and
errors can be expected in predictable ways in
the best of organisations, and errors are the
consequences of systemic factors. When
organisations fail it is due to system defences
being breached not a deficient individual.
An organisational accident results from the
combination of an unsafe act and an unsafe
condition (see Figure 3, based on [15] and
[17]). The negative consequences of
organisational processes can affect the rail
environment where they can influence task
and local conditions that promote unsafe acts
(errors or violations) and unsafe conditions
(breaches in defences, barriers and
safeguards). Organisational accidents result
from unsafe acts penetrating the defences to
produce damaging outcomes. By expanding
the key elements of the model we can see how
HFE and defensive failures can lead to
accidents (see Figure 4).
An accident sequence can be divided into four
levels: culture, climate, situation and event.
Both HFE and defensive failures have their
origin in the various organisational processes.
Culture emanates from senior management
and influences climate. Climate relates to
local conditions (local management, resources
and workforce) and is divided into two
interacting sets of factors: local working
conditions and defences within that location. It
should be noted that climate changes much
more rapidly than culture. Local management
is highly influential in determining the
psychological working conditions and the
effectiveness of defences.
The system model of an organisation, although
not perfect, tells us a great deal about how
organisations can fail, i.e. about accidents, and
what can be done to reduce such occurrences.
First, human rather than technical failures
pose the greatest threat to complex and
potentially hazardous systems. As has
already been explained, human failures can be
reduced but cannot be totally eliminated and
7
have different underlying psychological
mechanisms requiring different strategies to
reduce them. Second, decisions that affect
safety occur at all levels of the system, not just
at the ‘sharp end’. Therefore, effective risk
management requires the simultaneous and
targeted deployment of limited remedial
resources (e.g. money, staff, support, training)
at different levels of the system: organisation
and senior management, local working
conditions and local management, situation/
task and individual/team.
4. ENHANCING RAILWAY SAFETY
ASSURANCE
Having gained a fuller understanding of the
complexity of major rail projects and how
human and organisational failures can impact
railway safety, we can now explore how the
quality of Railway Safety Assurance can be
enhanced by improving the use contemporary
Safety Assurance processes, methods and
tools.
4.1. Overview of Safety Assurance
When a new railway is being introduced or a
change made to an existing rail system, safety
can be compromised. Thus, Safety Analysis
techniques have been developed over the
years to provide structured and systematic
approaches to provide confidence as a project
progresses through its lifecycle that the
delivered system will be safe to operate and
maintain. During a project’s design
development stage this process is achieved by
asking:
 What can go wrong?
(i.e. Hazard Identification)
 How often can it go wrong and what would
be the consequence?
(i.e. Hazard Assessment)
 How can this risk be reduced to the
required level of safety?
(i.e. Hazard Reduction).
This process is undertaken by the project
delivery organisation’s designers and iterates
until the design has reduced all safety risks to
the required level of safety. Any hazards that
require control measures that involve
operation/ maintenance actions to achieve a
tolerable safety level are agreed with the
railway operation/ maintenance organisation.
Evidence that this process has been done
comprehensively is captured in the Design
Safety Case. (See Figure 1).
During a project’s production stage, the railway
operation/ maintenance organisation develops
control measures to reduce those safety risks
associated with the hazards transferred from
the design development stage to a tolerable
level. Evidence that this process has been
done comprehensively is captured in the
Operational Safety Case. (See Figure 1). The
railway operation/ maintenance organisation
also develops safety risk control measures,
such as policies and procedures, to manage
the hazards associated with operations and
maintenance activities. Evidence of the
adequacy of these control measures is
captured in the Operational SMS. (See Figure
1).
4.2. Enhancing the Quality of Safety
Assurance
The above Safety Assurance processes and
practices are supported by a number of
established techniques. By applying SE and
HFE principles to these contemporary Safety
Analysis processes, methods and tools on
major rail projects we are able to enhance the
quality of Safety Assurance. Some of these
enhancements are described in this section.
4.2.1 SE principles
‘Holism’ reminds us that the safety of the
whole rail system needs to be assured and not
just the separate subsystems. This is because
safety is an emergent property of a system
and can only be assured when all the
interacting parts and surrounding environment
are considered. Although the concept of
‘hierarchy’ is valuable when it comes to
dividing up the safety analysis of a large and
complex rail system into simpler less-complex
subsystems (i.e. through Subsystem Hazard
Analysis), it is important to remember that
safety can only be assured when safety is
assessed for the totally-integrated rail system.
In managing complexity, the concept of
‘partitioning’ a large and complex rail system
8
assists in dividing up the task of delivering the
different parts of the system and apportioning
responsibilities. However, it also creates
interfaces that need to be carefully managed.
If these interfaces are technical or
organisational, there may be safety
implications if they are not controlled
adequately. It is therefore important that when
the Safety Analysis of a large and complex rail
system has been simplified through
Subsystem Hazard Analysis, there is a need
for hazards that cross subsystem boundaries
to be identified. These interface hazards may
be technical or organisational and should not
be overlooked during the design development
stage. Similarly, it is crucial that hazards that
cross organisational boundaries are properly
controlled within an Operational SMS.
‘Lifecycles’ makes it clear that Safety
Assurance should not just be thinking about
designing the system for operation. Designers
should also consider the safety issues that
arise during the other lifecycle stages; the
safety of construction, integration, testing,
commissioning, maintenance and
decommissioning of the rail system. It also
reminds us that the consideration of safety
early in design development enables Safety
Assurance to inform the design and not just
demonstrate the safety of the design. This
early consideration of safety can create the
opportunity for inherently safer designs and
sometimes lead to cost saving due to avoiding
the unnecessary over-engineering of safety
features. Sometimes hazard identification
workshops held early in design development
provide the first opportunity for the different
design disciplines to come together to discuss
and evaluate the overall design. Such forums
are valuable to integrating the design.
The concept of ‘subjectivity’ reminds us of the
importance of involving a wide range of
stakeholders and not just designers when
identifying safety hazards and reducing safety
risks. Thus, by involving contractors, systems
engineers, testing and commissioning
engineers, operations and maintenance staff in
hazard identification workshops (e.g. HAZOPs
or checklists), so hazards associated with all
lifecycle stages can be identified. Additionally,
having a HFE specialist involved in Safety
Assurance will greatly enhance how potential
human failures are identified and dealt with
across the system lifecycle.
4.2.2 HFE principles
During a project’s design development stage,
HFE has a crucial and important contribution
to make in enhancing Safety Assurance. As
already mentioned, including a HFE specialist
in hazard identification improves the
recognition of how potential human failures
can impact system safety. For hazard
assessment, HFE techniques such as a
Human Reliability Assessment (HRA) [10] are
able to provide estimates of human error
probabilities, thus enabling the cost-
effectiveness of proposed safety risk control
measures to be thoroughly evaluated. For
hazard reduction where human performance is
involved, HFE is able to propose safety risk
control measures based on strategies that
understand the underlying human behaviour
types. This identifies effective control
measures to tackle human error and violations
to be developed and implemented.
Also part of enhancing Safety Assurance is
ensuring that HFE is integral to project design
as this ensures that designs are developed to
take proper account of a person’s human
limitations and capabilities. This increases the
ability to alter a design to eliminate a safety
hazard rather than having to resort to less
effective measures such as (in order of
precedence) designing to minimise the risk,
adding safety devices, providing warning
devices, or developing procedures and
training.
During a project’s production stage, HFE can
provide support to the development of effective
policies and procedures for managing safety
risks to reduce the potential for people to
intentionally or unintentionally not follow rules.
This can be done by applying HFE’s
understanding of the causes of human error
and violations and how the likelihood of this
occurring can be reduced.
Typically a contractor’s Safety Assurance
process finishes when a rail system is handed
over and becomes operational. It is, however,
9
important to recognise that a railway operation/
maintenance organisation can fail to maintain
a safe system due to a combination of unsafe
acts and unsafe conditions, as described
earlier in this paper and in Figure 4. It is
therefore crucial that an organisation monitors
its safety performance. This is often done
using both reactive indicators (e.g. near-miss,
incident and accident reports) and proactive
indicators (e.g. safety tours and inspections,
audits and reviews). The understanding of the
influence that HFE has on how organisational
processes can influence unsafe acts and
unsafe conditions, and how these can manifest
themselves in human error and violations, is
an essential part of an organisation’s self-
awareness of its resilience in managing safety.
Thus, it is generally accepted that an
operation’s SMS needs to be a living
management system, constantly improving
and adapting to changes in the environment.
HFE can play an important part in that
continuous improvement process.
5. CONCLUSIONS
This paper has described how the quality of
Safety Assurance can be enhanced through a
full and proper understanding of (a) how the
complexity of major rail projects can be
managed successfully, (b) how human and
organisational failures can impact railway
safety, and (c) how that understanding can
improve using contemporary Safety Analysis
processes, methods and tools. This was done
by exploring the synergistic relationships
between SE, HFE and Safety Assurance. It
concluded that the quality of Safety Assurance
can be enhanced by applying SE and HFE
principles when using contemporary Safety
Analysis processes, methods and tools on
major rail projects.
6. ACKNOWLEDGEMENTS
The author would like to thank all those he has
learned from in over 25 years of working in SE,
HFE and Safety Assurance mostly in the rail
industry. The contents of this paper are solely
the responsibility of the author and do not
necessarily represent the views of Mott
MacDonald Limited.
7. REFERENCES
[1] ANU Edge. On Track to 2040: Preparing the Australian Rail Supply Industry for
Challenges and Growth, 2011.
[2] Emes, M. Systems Engineering Management – Systems Thinking. University College
London, UCL Centre for Systems Engineering, October 2009.
[3] Hollywell, P.D. & Corrie, J. D. Reducing Violations on the Railways: What Only
Experience Can Teach? Paper presented at ‘Violations, Procedures and Human
Factors’ Conference organised by IBC, London, March 2000.
[4] HSE. Introduction to Human Factors.
http://www.hse.gov.uk/humanfactors/introduction.htm. Accessed June 2014.
[5] HSE. Reducing Error and Influencing Behaviour, HSG48. HSE Books, 2009.
[6] IEA. What is Ergonomics? http://www.iea.cc/whats/. Accessed June 2014.
[7] INCOSE UK Chapter. Z1 Guide: What is Systems Engineering? Issue 3.0, March
2009.
[8] INCOSE. Systems Engineering Handbook (Version 3.2.2): A Guide for System Life
Cycle Processes and Activities. INCOSE-TP-2003-002-03.2.2, October 2011.
[9] ISO/IEC 15288:2008. Systems Engineering – System Life Cycle Processes.
[10] Kirwan, B. A Guide To Practical Human Reliability Assessment. Taylor & Francis,
1994.
[11] Major Projects Association (MPA). Systems Integration for Major Projects. Summary
notes of a seminar held at the Royal college of Pathologists, London on 12th March
2002.
[12] Mason, S. et al. Improving Compliance with Safety Procedures: Reducing Industrial
Violations. HSE Books, 1995.
[13] Pope, A. An Essay on Criticism, Part II; 1711.
[14] Rasmussen, J. Skills, Rules, Knowledge: Signals, Signs and Symbols and Other
Distinctions in Human Performance Models. In IEEE Transactions on Systems, Man,
and Cybernetics, SMC-13, 257-267, 1983.
[15] Reason, J. A Life in Error: From Little Slips to Big Disasters. Ashgate Publishing
Limited, 2013.
[16] Reason, J. Human Error. Cambridge University Press, 1990.
[17] Reason, J. The Human Contribution: Unsafe Acts, Accidents and Heroic Recoveries.
Ashgate Publishing Limited, 2008.
[18] Royal Academy of Engineering. Creating Systems that Work: Principles of
Engineering Systems for the 21st Century, 2007.
[19] RSSB. Understanding Human Factors: A Guide for the Railway Industry. Rail Safety &
Standards Board, 2008.
[20] Whittingham, R.B. The Blame Machine: Why Human Error Causes Accidents.
Elsevier, 2004.

10
Figure 1: Typical Project Lifecycle with SE and Safety Assurance Elements

Figure 2: Reasons for Human Error and Violations

11
Figure 3: Simple System Model of Organisational Failures

Figure 4: Detailed System Model of Organisational Failures

12