Written evidence from Sanjeev Appicharla (SLC 015)

1. Abstract: The Written Evidence is a submission by the author in his personal capacity. The Written Evidence presents evidences and arguments for the claims of latent (human) errors occurring over the last 171 years that have adversely impacted safety property at level crossings. Based on the latent errors presented, author appeals to the Members of the Transport Select Committee to initiate reforms to amend the existing legislative requirements. These reforms, it is hoped, will eliminate the conflicting requirements imposed on the GB Rail Industry.  The Submission is of eight pages long. Additional two pages provide references to the cited papers and a system diagram of the GB Rail Industry.
2. Author’s Biography: Author is British Naturalised citizen since 2006. Author is a graduate electrical (power) engineer with 25 years of experience in management and design of industrial power distribution systems upto 220 kV level, acquisition and execution of turnkey power and automation projects. In the last 10 years, he specialised in modelling and analysis of safety critical system and accidents. Author‘s experience in system safety engineering research and experience is evidenced by the publications of four peer reviewed publications at the Institute of Engineers and Technology ( IET) International System Safety Conferences in 2006, 2010, 2011 and 2012. Author has two more publications due for presentation at the IET International System Safety Conference in October 2013.
3. Author’s Award. Author was awarded a Letter of Gratitude in 2009 for his contribution to the UK HSE Consultation Document,’’ Be Part of Solution, the UK HSE’s Strategy for the 21st Century’’.

1         Part One: Brief Description of Advaita Vedanta

The metaphysical teachings, models of human nature and human factors that guide author’s intuitive thinking are presented. This inclusion is relevant and logical as James Reason excluded acts of God from his psychological study on Human Error (pp8)[16].

1.1       Teaching of Brahman and Atman

The holy teacher of the Tattriya Upanishad at the start of the exposition on the Brahman prays for the well-being of the teacher and the pupil [27].

Om. May That protect us both (teacher and pupil). May That cause us both to enjoy the bliss (of Mukti). May we both exert to find out the true meaning of the scriptures. May our learning be brilliant. May we never quarrel with each other!

Om Peace, Peace, Peace.

The ancient holy teacher of the Tattriya Upanishad explains creation using a logical scheme of forms and logarithmic scheme of to explain Brahman as truth (existence), knowledge and infinity. The idea is promoted and accepted by the author is that Supreme Brahman transcends ideas of space, time and causation. OM. Sri Adi Shankara Acharya, the chief exponent of Advaita Vedanta philosophy taught the Narayana is higher than the Unmanifest. Sri Adi Shankara Acharya taught that individual soul (Jiva-atma) and) is in reality all pervasive and identical with Universe (Param-Atma).

The individual soul (Jiva) considers itself as atomic, as an agent, and as part of Lord due to the delusion of Maya.  Due to Maya, the individual soul falsely superimposes gross and subtle attributes onto itself. However, when ignorance is removed by the Grace of a holy teacher, this identity is realised. The classical example used in the teaching is the fear of snake in darkness. This fear disappears when it is seen in the light that it is actually a coiled rope. Nature divided itself into eight subtle particles of ether, air, water, fire, and earth and I-consciousness (Ahamkar), mind-stuff (manas) and intelligence (Buddhi) constitute the jiva-atma, the transmigrating entity. The three modes of material Nature of goodness (sat), passions (rajas) and darkness (tamas) constitute the faith of those who discard the Vedic scriptures as their authority is described in the Chapter XVII of the Bhagavad Gita. Lord Almighty, the Supreme Brahman, is the inactive One, the higher One than the Immutable and is the Knower of all fields. More details can be gathered about these concepts from the ancient philosophical treatises (Shrutis) of the Upanishads, the Brahma Sutras, Smritis like Bhagavad Gita and the Laws of Manu, and Histories of Mahabharata and Ramayana as well.

1.2       Individual or Collective Human Factor Model

The essence of the teachings of the ancient Upanishads is that the inner and outer worlds are closely interrelated. Human nature and the nature of Universe are seen as microcosm and macrocosm. The faculties within the human being and cosmic powers are called devas, gods. There are nineteen faculties within the human being (Atman), as per the classification system of theory of knowledge known as Samkya Yoga[27]. The enumeration is as follows: (1) five faculties of perception are hearing, touching, sight, tasting and smelling; (2) The five faculties of actions are senses of speaking, grasping, movement, excretion and pro-creation, (3) sense of mind-stuff, (4) sense of intelligence or Buddhi, 5) sense of I-Consciousness, ( 6) five subtle elements of ether, air, water, fire, and earth transform into five gross elements of senses of objects which emanate from the (7) Unmanifest Nature( Matter)  and (8) Atman, the Purusha or ‘spirit’. The matter is an active principle, including mind, senses as well as the body. Together with five gross elements of objects of sound, sight, touch, smell and taste, the five subtle elements, inner personality of ego, mind stuff and intelligence, ten senses, Unmanifest Nature (Prakriti) and Purusha (Narayana) constitute the twenty five elements of the Samkya Yoga propounded by Lord Krishna. Lord Kapila, regarded as an incarnation of the Supreme Being- Narayana, taught that knowledge results from the application of the senses to their particular objects. Objects beyond sense perception are deduced by inference or learning from the sacred scriptures through the instructions of the holy teacher. Similar convictions appear some 2,000 years later in the writings of Sir Issac Newton on theme of philosophy of religion as well.

1.3       Doctrine of Causation in the Upanishads

The teaching of doctrine of causation as per the Samkya philosophy is the effects is latent in the cause. The three causal factors involved with an artefact by a human being are made up of three causal factors of agent, instrument and the object to be attained. The classical example used is the ceramic object made out of clay (material cause), formed by the potter’s wheel (instrument) and shaped by the hands of the potter (effective cause).  The object, beautiful artefact of a pot, thus, results from the joining of the material, instrumental and efficient causal factors. The Sage Maitri taught that the existence of lamp comes from the joining of base, wick and oil, likewise, the self and pure one exist from joining of the inner one and the egg. Thus, it can be inferred that Universe viewed as an object is result of Supreme Brahman acting as material and efficient cause [27].

1.4       Support for the Upanishads from Nobel Prize Winners

The ideas of Vedanta were accepted by Nobel Laureate Erwin Schrödinger who kick started the interface between modern physics and Vedanta by noting that molecules contain information to be transferred between generations of human race [6]. Noble laureates Rabindranath Tagore, T.S. Eliot, Albert Einstein, Gerald Wald, Brian David Josephson, and Francis Crick were influenced directly or indirectly by the ideas of Vedanta through the writings of Erwin Schrödinger. Vedanta was introduced into the West formally by 19th century philosopher, Arthur Schopenhauer. Arthur Schopenhauer established connection between 17th Century British Empiricist John Locke) philosophy and 18th century German idealist (Immanuel Kant) philosophy and ancient Buddhism, a strand of Hinduism by rejecting Cartesian dualism or false dichotomy of subject-object [3].

Nobel Laureate Albert Einstein taught the speed of light is the limit for signalling of events ie there are no instantaneous interactions, geometry of space-time is curved, Newtonian Law of Gravitation did not have either empirical or theoretical foundation, light bends due to presence of heavy masses, and non –Euclidean geometries were true. Further, our intuitive experiences of a time sequence of events cannot be mapped to time sequence of experiences due to lack of concept of absolute time and space in the theories of relativity [1].

2         Part Two: Information System Analysis of Stakeholders’ Organisational Map of the GB Rail-Road Interface and Human Error

2.1       Stakeholder Organisations’ Map and Requirements under the Common Safety Method Regime for Safety Regulation

The Parliamentary Note SN 3255 dated 26 January 2012 note sets out the responsibilities of relevant bodies for the safety management of level crossings [14]. It sets out the government and industry’s views on the safety management of level crossings. The document does not contain any formal information model to guide the thinking.

The Figure 3 in this submission provides a partial map of GB stakeholder organisations and the internal departments of Network Rail directly involved in the day to day life of railways. As far as possible, in accordance with the International Standard IEC 15288, this map represents the relations and inter-relations between agencies from whole –part, client –supplier and support-supported perspective in a recursive manner [12]. Client –supplier perspective may be taken to represent end-means perspective as well. The clients namely, people and goods waiting to be transported from one place to another for the GB Rail Industry are represented at the top. The various organisations that compose the GB Rail Industry as a supplier of transport services are assumed to co-ordinate and co-operate their decision and actions to accomplish the work or task of transporting people and goods from one place to another. However, this structural map is insufficient to provide information on the functional organisation of the work or task of transporting people and goods from one place to another and the unwanted outcomes that may result. Therefore, author uses Jens Rasmussen’s Human Performance Shaping Factors (SRK) Framework and recommendations contained in the UK Health and Safety Executive’s Guidance Document Number 238 to populate Management Oversight and Risk Tree as a fault tree representation using cause-effect reasoning to map the harm suffered by people or goods or staff as a result of accident to the agencies involved [15],[24]. Thus, cognitive errors induced into subjective judgements and decisions regarding the hazardous situations are avoided. Failing to learn right lessons from accidents due to cognitive limitations of human information processing ability are, thus, avoided[15],[16].  Researchers like James Reason (1990) and Jens Rasmussen, Annelise Mark Pejtersen and L.P. Goodstein (1994) and Nobel Laureate Daniel Kahneman  have drawn author’s attention to the fact that false hypothesis of human error and hindsight bias distort the safety risk perceptions[5],[15],[16]. 

The functional division of the work or task of transporting people and goods from one place to another is currently organised by the Railway Undertaking(s) namely  freight and train operating companies by accessing the track infrastructure provided by the Infrastructure Manager, Network Rail. The Performance Regime and Common Safety Regime are regulated by the ORR whereas the Department of Transport organises franchises and draws up high level requirements to be delivered by Network Rail in the form of High Level Output Specification (HLOS).

The ORR prepares Statement of Funds Available (SOFA) and regulates safety by means of prosecuting of duty-holders under the UK Health and Safety Work Act 1974.   The examination of the Schedules by which delays are attributed to the various parties are not relevant to the theme of rail-road interface and thus, left out of the discussions. Nobel Laureate Gary Baker’s Human Capital provides insight into how the work of 20th specialists is co-ordinated within firms and across firms and the role of engineering institutions played in the development of specialisation since 19th century. Gary Baker reckons that 19th century engineers were not specialised [9]. But due to excessive specialisation, 20th specialists may fail to know about the work of other specialities.

As per the website information, RSSB is an industry’s co-originating body to support activity amongst its various members numbering 60 and shown in the Figure 3: System View of GB Rail Stakeholder Organisation Map. Railway Group Standards (RGSs) are documents that define mandatory engineering and operational requirements in respect of the mainline railway. The central purpose of RGSs is to enable the different participants in the industry to co-operate safely and efficiently where they need to do so, without having to reinvent the basis of that co-operation every time. Compliance with RGSs is mandatory, through licence conditions, and the content of each RGS is developed and agreed by the GB railway industry, through Standards Committees facilitated by RSSB.RSSB’s role includes drafting the content of standards and assessing their impact, as well as managing meetings, carrying out consultations, and publishing the standards themselves.

The CSM relies upon the decision criteria of Expert Judgement to decide whether a change is significant or not. If the change is significant then the procedures within the CSM apply. The results of the technical review are presented in the form of latent errors that endanger the application of the CSM, a risk based approach. As per the clause 4.2 of the European Railway Safety Directive, and article 2 of the Common Safety Method, the Railway organisations must have a system in place to control changes/new projects and manage related risks, taking into account also those relating to occupational safety. Changes can apply to technique/technologies; operational procedures/rules/standards; organisational structure. As per the clause of article 4 (2) of the Railway Safety Directive and article 15(1) of the Railway Interoperability Directive, for a significant change a system approach and a risk assessment is necessary to ensure a safe integration and operation of the structural sub-systems covered by TSI within the system[7],[8].

The ORR Review on the CSM and Level Crossings, based upon their website information, is presented hereafter. The ORR Guidance document notes,” that the CSM presents three ‘risk acceptance principles’ by which the hazards associated with a significant change can be analysed and evaluated: a) the application of codes of practice, b) a comparison with similar systems (reference systems) and c) an explicit risk estimation. Risk assessment associated with significant organisational changes is not an exact science; it is about managing and organising people, therefore a qualitative or semi-quantitative risk ranking method for assessing organisational changes should meet the requirements of the CSM. There is no defined methodology currently available for risk assessment of organisational change (clause 18). A qualitative risk assessment based on a structured workshop process and the management of a hazard record derived from the workshops should be adequate to meet the requirements of the CSM”.

The ORR Guidance Note on Level Crossings notes the following:” The law relating to level crossings is not straightforward as there is a need to balance the interests of road and rail, and take account of the impact of local circumstances that affect the use of the crossing. The law applying to level crossings has evolved over the past 160 years. No single government department controls all level crossing legislation. Currently, laws relating to the highways, railways and health and safety apply.

The Law Commission for England and Wales and the Scottish Law Commission are undertaking a joint review of the existing law governing level crossings”.

Author has noted that adjusting the laws and regulations applicable to safety by politicians and accident investigators every X years or analysing hazardous events respectively is a method of control by trial and error method.  This is in contrast to the Cognitive Systems Engineering Framework advanced by Jens Rasmussen, Annelise Mark Pejtersen and L.P. Goodstein. This idea of control by trial and error by national politicians to correct for experienced problems is referenced from Jens Rasmussen, Annelise Mark Pejtersen and L.P. Goodstein (pp 18)[15]. Author accepts James Reason’s argument that person’s (decision maker) distance from the front -line activities (and incidentally, from direct hazards) the greater is their potential danger to the system (pp174)[16].

James Reason (1990) whilst advancing a general view of accident causation in complex systems noted that identifying latent errors is the challenge faced by human factors researchers concerned with the preserving the safety of complex, high risk systems (pp210)[16] . Author  of this submission notes this focus on ergonomic or behavioural aspects of human beings excludes cybernetic engineers, philosophers, lawyers, organisational theorists and practitioners, and parliamentarians who have to face this challenge as well(pp138-139)[15]. This is because Jens Rasmussen et all argued that actual work systems like railway transport system involve several nested closed-loops with adaptive and self-organising features (pp18-19)[15]. Thus, it is necessary to examine intra- organisational factors and organisational factors that can impact the safety performance in an adverse manner.

However, author of this submission does not agree to the ORR idea that there are no qualitative methodologies currently available for risk assessment of organisational change and identifies this as latent error. Author, faced with a challenge of assuring changes to rules and regulations from organisational perspective are safe, conducted a personal survey in 2005. This survey revealed to the author that James Reason’s conceptual framework –the generic error –modelling system (GEMS) can be used to locate the origins of the basic human error types associated with a significant change to individual role in an organisation in conjunction with Swiss Cheese Model. Nancy Leveson’s New Accident Model, STAMP methodology is another methodology available. Management Oversight and Oversight and Risk Tree (engineering model) in conjunction with Jens Rasmussen’s Skill-Rules-Knowledge Framework (human factors model) is another methodology under the name System for Investigation of Railway Interfaces is another methodology available [13],[15],[16],[19].

This can help understand the overall context shaping this behaviour of human elements within a complex system. Sir Charles Haddon Cave investigating the NIMROD Aircraft accident used a hybrid model of Bow Tie Model (engineering model) and Swiss Cheese Model (human factors model) to investigate the contribution of organisational factors as well[4]. The Figure 1 and Figure 2 show the author’s Updated version and James Reason’s original Swiss Cheese Models. These figures do not show feedback loops and their variety and sensitivity as per James Reason’s cybernetic model (pp210)[16]. James Reason’s cybernetic model is accepted by the author and can be represented as loops feed backing opposing the latent failures through modelling accident(s). A similar approach is taken by Prof R.A. Smith of Imperial College, London (ICL) to perform systemic analysis of railway accidents (2005). This paper can be accessed from the R.A. Smith’s ICL website.

Figure 1: Stages of development of organisational accident as per James Reason’s Swiss Cheese Model

Figure 2: Stages of development of organisational accident as per updated Swiss Cheese Model

2.2       Active and Latent Error(s) Impacting Level Crossing Accidents

The division of human error cited by James Reason (1990) is due to Rasmussen and Pedersen (1984), (pp173-174)[16]. An entire chapter is devoted to the concept of human error Rasmussen, J., Pejtersen A.M., Goodstein, L.P(1994) (pp 135-159)(15].  The Industry ‘s view point is that at level crossings, some 95% of the risk of accidents arises through some form of misuse by road users – split between a lack of understanding (errors) and wilful acts (violations) can be seen from any of the RSSB’s presentation on Safety at Level Crossings. But this fact statement focusses only on user error’s and does not reveal fallible decisions (latent errors) that kick started the accident sequence (Figure 1).

The Updated Swiss Cheese Model (Figure 2) can be validated using the following description of active and latent errors.

Definition: Active errors are human errors, whose effects are felt almost immediately. For example, a road user entering the level crossing space when it is not safe to do so as in the case of Herefordshire Level Crossing Accident in 2010[21]. This active error affects the risk management practices in an adverse manner at the individual level. The Highway Codes are cumbersome for road users is a noted factors in the UK HSE Research Project published in 2005[25].

Definition: Latent errors are human errors whose adverse consequences may lie dormant within the system for a long time, only becoming evident when they combine with other factors to breach system (production) defences.

Author accepts James Reason idea of latent error is intimately bound up with the character of technology and argued that tackling latent errors is the most effective way to improve safety of complex systems (pp174)[16].The following latent errors came to author’s attention in connection with the level crossings. HMRI in the post war years (1945-67) did not pay attention to inherent dangers with the introduction of automatic half barrier crossing technology replacing manned gate crossings. These dangers became evident with the Hixon accident when all the organisations (both railway and non- railway) failed to process the information available with them and the Hixon accident manifested. This is the first instance where the accident investigator used Newtonian mechanics to advise time to arrive be increased from 24 to 32 seconds. Another accident took place at the same site and a bridge was finally built despite the opposing legal requirements and economic arguments (pp46) [22]. The Network Rail signalling project team did not install approaching locking function at the Herefordshire level crossing to prevent the barrier being opened when the signal was cleared for the train causing the accident or civil engineers failing to install bridge at the site or did not locate the stop signal correctly at the site thereby affects the risk management practices in an adverse manner at the level of department level inside Network Rail [21]. Or using FN curves in the form of RSSB Safety Risk Model or using mathematical model of Poisson without paying heed to Andrew Evans’s cautionary advice that empirical or Poisson curves do not provide objective decision criteria for societal risk acceptance in 2003. Further, these models are unable to represent human errors occurring at higher levels of the industry. These latent errors affect the railway practices of risk assessment in an adverse manner at the Industry level [23]. Or the idea expressed by RSSB publication in 2011 that check list of hazards suffices affect the railway practices of risk assessment in an adverse manner at the company level [11]. Or the idea expressed by Stanley Hall and Peter Van Der Mark, GB Rail domain experts, in 2008 that the replacement of level crossings by bridges is the only complete answer, but a cost which is most cases is not justified by the incremental increase in safety. Author is of the opinion that 1,000 odd public level crossings can be replaced with bridges to prevent future disasters, if topography permits. Where topography does not permit, full barrier crossings with TPWS may be installed [22]. Or decision of the 19th century parliament to enact 1842 Railway Regulation Act requiring the Board of Trade powers in Section 13 to authorise railway companies to construct bridges in place of level crossings at their own expense, although it did not give the Board the powers to compel them to do so affect the railway practices of risk assessment and management in an adverse manner at the industry and regulatory level. The section 46 of 1845 states the same requirements but Special Act can override this requirement (pp10) [22]. Or lack of legal and judicial clarity between the various legislative Special Acts concerning Level Crossings and HSWA 1974 as identified by the Law Commission and Scottish Law Commission in 2010 leading to sub-optimal actions by duty-holders. Or failure of the Law Commission and Scottish Law Commission to identify the 1842 Railway Regulation Act as part of their review in 2010. Or decisions of Local authorities to oppose the move to close the public level crossings proposed by Network Rail[20]. Or Network Rail to decision to adopt All Level Crossing Risk Model which does not model and analyse latent errors to prioritise risk posed by level crossings. Or  Network Rail failure to learn lessons by taking a decision to adopt Bow Tie Model as Enterprise Risk Management Model in its April 2013 web communication despite the evidence provided by Sir Charles Haddon Cave in 2009 as to Bow Tie Model’s unsuitability to model organisational factors[4]. Or failure of RSSB and Network Rail to learn from the insight generated by James Reason (1990) that probability or quantitative risk assessments using fault and event trees do not incorporate human errors that seed latent faults into the system when developing the Engineering Safety Management Best Practice in 2000[16],[26].

Or all researchers failing to notice that the level crossing indicators installed are different from traditional signalled traffic lights that regulate road traffic movements. Or British Transport Police’s action to prosecute road users in conjunction with Network Rail for the violation of their duties without recognising the fact the right of way of passage afforded to horse cart users on public highways dates back to ancient times or not paying attention to the fact that there are more than 100 factors that affect the perception of the road users as identified by the UK HSE Report in 2005[25].  Or RAIB failure that to see that RSSB Railway Group Standard failed to specify sufficient braking distance at the protective signal at the Herefordshire Level Crossing Accident in 2011[21]. Or RSSB, RAIB, and ORR failing to notice that Author had pointed out in 2010 that Standards Committee composed by Subject Matter Experts suffers from Group-think Bias thus inserting latent errors into Railway Group Standards by taking risky options [17],[18],[20],[21]. Or Safety Culture of the Industry is still needs to improve as noted by Imperial College London in 2012[2]. Or RSSB and Industry failing to notice that ALARP Principle of Risk Management requires a Code of Practice to be followed and Railway Group Standard(s)on Level Crossing do not constitute Best Practice due to Group-think bias as identified by author  in 2006,2010,2011[19],[20],[21]. The claim that decisions of the RSSB  Standards Committe are fallible by author is supported by RAIB’s report 11/2012. This report states that RSSB the RSSB Standards Committee approved a safety critical deviation to the ERTMS/ETCS Cambrian Project waiving the integration of level crossing functionality into the new signalling systems [18]. Or the writers of the RAIB Report 12/2011 suffer from false dichotomy of subject-object divide when examining the safety of AOCL level crossings.

The above latent errors discussed do not represent the stochastic errors, as envisaged by James Reason, that combine to create holes in the physical or administrative barriers to aid the dangerous flow of events that result in the level crossing accident(pp199)[16]. Thus, author wishes to note that ORR observation that organisational factors cannot be identified is not true nor the RSSB or duty –holders have put in sufficient efforts to identify systemic (latent errors in their risk management practices and decision making process at the Standards Committee Level) factors before rushing to blame the individual users for the risk at the rail-road interfaces.

3         Conclusion

Reflecting upon the foregoing, author concludes that members of public have suffered accidents at public and non –public level crossings for the failure of engineers, managers, accident investigators, regulators and government agencies to foresee harm that can result from the inherent danger posed by the automation of level crossings and failure to de-couple the road and rail industries by means of bridges, under-pass or over -pass. The GB Rail safety standards or Railway Signalling Principles do not require the crossing space between the railway and roads to afford free passage to the road user. The miracle cure of Train Protection and Warning System against two centuries old safety problem of train collision(s) had to be legislated as the industry in 1999-2000 failed to foresee its safety benefits and argued against it.

Author appeals to the Members of the Transport Select Committee to initiate reforms to the current legal and regulatory practices to afford safety at rail-road interfaces by combating the above latent errors. The Codes of Practice for Engineers and Managers can be subsequently developed through the establishment of National Hazards Committee to tackle latent errors that may arise with High Speed Two, Crossrail, and Network Rail Projects where the plan(s) for the implementation of new signalling technologies are proposed. In this way, the repeating the same mistakes over the last 171 years can be averted.

4         References

[1] Albert Einstein, “Relativity”, Translated by Robert Lawson, London: Routledge, 1920

[2] Arnab Mazumdar, Miltos Kyriakidis, Peri Smith,     Washington Y. Ochieng. “The influence of human performance on railways technological changes in the U.K”, Railway Research Annual Conference, November 2012, London

[3] Arthur Schopenhauer, “On the Principle of Sufficient Reason”, Translated by Karl Hillebrand. New York: Prometheus Books, 1813/2006.

[4] Charles Haddon Cave, QC, “Nimrod Review, Independent Investigation into broader issues surrounding loss of the RAF Nimrod MR2 Aircraft Accident XV 230 in Afghanistan in 2006. Accessed online 15 July 2013.http://www.official-documents.gov.uk/document/hc0809/hc10/1025/1025.pdf

[5] Daniel Kahneman, “Thinking Fast and Slow”, Penguin, Books, 2011, London. 

[6] Erwin Schrodinger, “What’s Life”, The physical aspect of living cell, Accessed on 15 July 2013.

              https://en.wikipedia.org/wiki/What_Is_Life%3F

[7] European Commission, “Railway Safety Directive” 2004/49/EC, 2004.

[8] European Railway Agency, “Guide for the application of the Commission Regulation on the adoption of a common safety method on risk evaluation and assessment as referred to in Article 6(3)(a) of the Railway Safety Directive”, July 2009, Cedex.  Accessed online on 24 June 2013

[9] Gary S.Baker., “Human Capital” 3rd edition, Chicago: The University of Chicago Press, 1964

[10] G. Bearfield., “Taking Safe Decisions, Railway Industry ALARP Guidance”, The Safety Critical Systems Club Newsletter, 19(1), pp1-5(Sept 2009).

[11]G.J.Bearfield, R .Short., “Standardising Safety Engineering Approaches in the UK Railway, The Sixth International System Safety Conference. Birmingham: The Institution of Engineering and Technology, September 2011.

[12] ISO/IEC 15228, “Systems lifecycle Processes”, International Electro-technical commission, Brussels (2001)

[13] Leveson, N.G.,”A New Accident Model for Engineering Safer Systems, Safety Science, Vol, 42, No.4, (April 2004)

[14] Louise Butcher, “Parliamentary Note 3255: Railway: Level Crossings”, January 2012.

[15] Rasmussen, J., Pejtersen A.M., Goodstein, L.P., “Cognitive Systems Engineering”, John Wiley & Sons, New York, (1994)

[16] Reason, J., “Human Error”, Cambridge University Press, New York, pp (1990)

[17] RAIB Report 12/2011. “Investigation into the safety of automatic open level crossings on Network Rail’s managed infrastructure”, Derby, July 2011.

[18] RAIB Report 11/2012. “Incident at Llanbadarn Automatic Barrier Crossing (Locally Monitored), near Aberystwyth”, Derby, June 2012

[19] Sanjeev Appicharla, “System for Investigation of Railway Interfaces-SIRI”, Proceedings of First International Conference on System Safety, Institution of Engineering and Technology, London,pp 7-11(2006)

[20] Sanjeev Appicharla ‘System for Investigation of Railway Interfaces-SIRI’ Proceedings of Fifth International Conference on System Safety, Institution of Engineering and Technology, Manchester, 2010.

[21] Sanjeev Appicharla, “Analysis and modelling of the Herefordshire Accident using MORT Method.” The 6th IET International System Safety Conference. Birmingham: Institution of Engineering and Technology, 2011. 11

[22] Stanley Hall, and Peter Van Der Mark. Level Crossings. Hersham: Ian Allan Publishing, 2008

[23] UK HSE Research Report 073, “Fatal Transport Accidents and FN Curves 1967-2001’’, HMSO (2003)

[24] UK HSE Guidance Note 238, “‘Out of Control’, why control systems go wrong and how to prevent failure”, HMSO, 2003.

[25] UK HSE Research Report 359, “‘Level crossings Summary of findings and key human factors issues”, HMSO, 2005

[26] UK Railway Industry, “Engineering Safety Management”, London (2000)

[27] Valerie, Roebuck, ‘’Upanishads’’, Penguin Books, London, 2003.

5         Appendix: System View

Figure 3: System View of GB Rail Stakeholder Organisation Map

September 2013