Supplementary written evidence from Ian Prosser, Director of Railway Safety ORR (RLS0025)
Follow up - Rail Safety Inquiry
Thank you for your letter of 13 December 2016. I am writing to respond to your request for further information following the two oral evidence sessions
1. Can you explain the process by which the ORR carries out inspections of the risk assessments undertaken by duty-holders? What factors are taken into account in assessing whether the risk assessment is adequate? How regularly are these inspections carried out?
In line with our published strategy for regulating health and safety risks[1] on the railway, ORR focuses inspection activity on duty-holders' overall risk assessment and change management capability. We do not routinely inspect all individual risk assessments or approve all the risk assessments that duty-holders carry out.
The legal requirements for risk assessment in the rail industry are set down in the Management of Health & Safety at Work Regulations 1999; the Railways and Other Guided Transport Systems (Safety) Regulations 2006; and EU regulation 402/2013 on a Common Safety Method for Risk Evaluation & Assessment. Both ORR and RSSB have published guidance on what is expected of a "suitable and sufficient" risk assessment in context of this legislation.
Nevertheless, we frequently review individual risk assessments, usually in one or more of the following circumstances:
- When they are prepared by duty-holders in support of an application we are required by law to make a decision on, for example, for a Level Crossing Order or an exemption from train protection requirements;
- When we are proactively inspecting the arrangements duty-holders' have selected for managing a specific risk priority area, for example, delivery of safe electrical clearances; and
- When we are seeking assurance about how a duty-holder is managing a specific significant technical, operational or organisational change, for example, the introduction of new train dispatch arrangements.
An assessment will normally be deemed to be adequate if it:
- Identifies all significant hazards;
- Addresses the significant risks relating to the activity being assessed;
- Meets or exceeds industry standards and guidance;
- Includes all parts of the organisation's work and risks to the public;
- Takes account of non-routine activities and incident data;
- Looks at risks as part of a system, for example degraded operation;
- Considers the way work is organised;
- Involves staff and their representatives;
- Decides which measures are necessary to protect people's safety; and
- Has communication arrangements in place to ensure staff are aware of the risks and the controls put in place to ensure safety
In the last five years, we have served over twenty enforcement notices directly in
response to failures to carry out adequate risks assessments.
2. The General Secretary of the ASLEF union told the Committee that the ORR stipulates the driver of a train should be able to see a passenger-train corridor between the edge of the train and passengers before moving. Is this more difficult using the equipment associated with 000? Is it realistic to expect drivers to identify such a corridor on busy stations?
The industry (rather than ORR) adopted a standard for Driver Only Operations (DOO) passenger train dispatch in 2014 which requires that the on-train camera/monitor system;
"shall provide a view of the train dispatch corridor parallel to the train body that encompasses:
- The full length of the train.
- The platform from the platform edge back to the yellow warning line. In the absence of a yellow warning line at least 1500 mm adjacent to the passenger bodyside entrances.
- At least the height of the train doors." [2]
To meet this standard, train operators must ensure that each platform has been risk assessed, and if there are any issues with the viewing corridor at certain locations or times, then additional safeguards have to be considered. The provision of additional staff to ensure passengers keep behind yellow lines provided along the platform is one example of additional safety measures, noting these persons will play no part in dispatching the train. Where these risk assessments have been carried out and suitable controls for risks identified have been provided, we think it is realistic for drivers to dispatch a train safely at busy stations.
3. When do you expect the review of your memorandum of understanding with the British Transport Police and Rail Accident Investigation Branch to be completed? What are the key areas for improvement that have emerged so far?
Our review of the Memorandum of Understanding (MOU) agreed between the Rail Accident Investigation Branch (RAIB), the British Transport police (BTP), the Association of Chief Police Officers (ACPO) and the Office of Rail and Road (ORR) for the investigation of rail accidents and incidents in England and Wales is underway and we are aiming for it to conclude by the end of March 2017.
The parties agree that the principles established by the current MoU, first entered into in 2005, are robust and these will be carried through to the new version. Changes are expected therefore to be limited to improving the conciseness and clarity of the document, or to aiding its interpretation. The new draft will place greater emphasis on parallel investigations and mutual co-operation to ensure that the investigative needs of all signatories can be met.
Specific areas that have been identified where greater clarity may be helpful are -
- a more simple explanation of the respective roles and responsibilities of the three organisations to help illustrate that, whilst there is an aspiration to work together, there are different duties/perspectives to be aware of;
- clearer wording to explain the extent to which RAIB inspectors (at any stage of an investigation) can assist with presenting complex technical information, interpreting its meaning, or can corroborate measurements RAIB has carried out; and
- what information prepared by third party technical experts can be shared.
There is a separate MOU covering Scotland and work to review this is tied in with the planned integration of BTP officers in Scotland into Police Scotland.
4. What assessment have you made of the adequacy of the resources dedicated by Network Rail to managing extreme weather and ensuring the integrity of earthworks?
Because of the age of the majority of Network Rail's earthwork assets, the difficulty of guaranteeing integrity and of predicting failure, assessing Network Rail's provision in this area is not a simple question of resource levels. As an integrated safety and economic regulator, we therefore look in the round at ensuring Network Rail improves its knowledge of the condition of its assets, renews the right assets and, where it is not renewing, ensures its maintenance plans respond to the risks.
During the last periodic review (PR13) of Network Rail's funding, ORR ensured the determination for CPS took sufficient account of the need to make earthwork assets more resilient. We felt, at the time of the determination, that Network Rail's plans for renewals of civil engineering assets were not sufficiently well developed to agree funding and so gave time for Network Rail to produce a more maturely developed programme or workbank for civil asset renewal.
Later, in 2015, alongside the Hendy re-plan, Network Rail reduced the volume of renewals it plans to deliver during the remainder of Control Period 5 (CPS), due to affordability constraints. We have been assessing the impact this will have on the network, and our findings are broadly consistent with Network Rail's own assessment. We expect some adverse effect on asset condition and asset performance across the network, particularly earthworks, drainage and structures. We also foresee a need for greater reliance on other safety controls in order to maintain asset safety.
We have also driven improvements in how Network Rail manages the consequences of earthwork failure, in order to avoid derailment and catastrophic results.
In August 2012, following a series of derailments after trains had struck landslips or rock falls, ORR issued an Improvement Notice requiring Network Rail to enhance its risk assessment matrix so that it considered a mixture of asset condition and consequences of derailment when prioritising its extreme weather contingency arrangements. The enforcement was taken in Scotland, but the resulting methodology was adopted across the network. It has been refined since then and the extreme weather arrangements have been reviewed regularly by Network Rail whenever they have been deployed.
ORR considered that this was a targeted and proportionate enforcement response at the time, managing the risk while continuing to recognise that conservative contingency arrangements, for example wholesale line closures and blanket speed restrictions, can have the effect of paralysing large parts of the network - with negative safety consequences.
In September 2016 an asset failure led to a derailment at Huntington Bridge Tunnel near Watford, the first such derailment since our 2012 enforcement. Our investigation of that derailment is not yet complete. Once completed we will ensure Network Rail makes any necessary improvements and lessons are learned.
5. The RSSB told us that they do not cover light rail systems. Are the mechanisms for safety learning for light rail adequate? Is there any scope for improvement in this respect?
UKTram, the trade body and voice for tramways and light rail in the UK, has developed a reporting database that is now being populated with data and evidence from all of the tram systems. There is now a unified set of reporting criteria to capture incident and near miss data. ORR will shortly have access to this database and will use the intelligence to better target proactive inspection and supervision of the systems.
RSSB is becoming involved in light rail standards and has been actively developing standards for the current tram-train trial in Sheffield.
We are continuing to work together with the British Transport Police and the Rail Accident Investigation Branch to investigate this the tragic incident in Croydon. We will ensure that lessons learned from this tragic incident, including any recommendations made by RAIB, are addressed fully and promptly by the operator and the wider sector.
6. We were told by the General Secretary of the ASLEF union that there is no statutory regulation of the number of hours worked in the railway industry, including for drivers. What impact does this have on the industry's attempts to tackle worker fatigue?
The Health and Safety at Work etc. Act 1974 (HSW Act) and the Management of Health and Safety at Work Regulations 1999 place general duties on all employers, including rail employers, to have effective arrangements for managing risks, including those from staff fatigue. In addition, the Working Time (Amendment) Regulations 1998 (WTR), which were introduced under EU 'Social Chapter' obligations rather than the HSW Act, include limits on working hours. Although employers need to comply with WTR requirements, complying with them is not in itself sufficient to adequately control risks from staff fatigue - some work patterns may comply with WTR but still be potentially fatiguing.
In addition to this general legislation, employers controlling staff who carry out safety-critical work in the rail industry, including driving trains, are subject to additional requirements under Regulation 25 of the Railways and Other Guided Transport Systems (Safety) Regulations 2006 (ROGS). This requires employers to have controls in place to prevent staff working if they are so fatigued that they would be liable to affect their own or other people's health or safety, but it does not specify particular numbers of hours worked. It requires a more risk-based approach to managing fatigue risks, taking into account not only the number of hours worked but the many other factors which affect fatigue risk, including time spent travelling, time of day or night, how much sleep workers have had, any medications they may be taking and so on, as part of a much wider ranging fatigue risk management system.
ORR will continue its efforts with employers, rail industry bodies and trade unions to push for improved fatigue controls, and will continue to take appropriate enforcement action where we find significant weaknesses. Our guidance makes it clear that progress requires commitment by employers, staff and trades unions alike.
7. You told the Committee that you were monitoring Network Rail's move to fewer signaller rail operating centres. What are the risks associated with the move to fewer rail operating centres? How is the fact that there is a single point of failure managed? Do you believe that Network Rail is mitigating these risks appropriately?
The main risks associated with the move to fewer rail operating centres (ROCs) are:
- the impact of moving to fewer signallers controlling larger areas on managing signaller workload, during normal working and particularly during perturbation.
- the potential for any failure or perturbation to have an impact on a greater area than currently and how Network Rail will safely restore train movement and introduce 'degraded working' (where trains are moved without the engineering control and integrity of normal signalling) in such circumstances.
- the potential for a single point of failure to arise.
We are alive to concerns about the potential consequence of a single point of failure. Following dialogue with ourselves, there has been progress in this area. Network Rail has described to us a solution, endorsed by its Board, that:
- Separates the people physically from the technology - so that what Network Rail describes as 'critical national platforms' (telecommunications, Traffic Management, power management, operating IT) will be moved away from ROCs into physically separate data centres.
- Provides sufficient connectivity between data centres such that single points of failure are avoided by providing alternate routing of systems' control or other redundancies. This should mitigate the current potential for significant outcomes from any one failure.
- Establishes 'workplace recovery sites' to provide alternative operating locations should a ROC experience significant disruption, such as a natural disaster, emergency evacuation of the ROC etc. It is anticipated that there will be six such recovery sites, typically covering two routes' or ROCs' areas of control.
The detail of Network Rail's plans is sensitive - touching on another area of concern: the vulnerability of ROCs to physical or cyber-attack. (Rail security policy is overseen by the Department for Transport.) I am sure Network Rail would be happy to supply the Committee with more information if requested.
A great deal of work has taken place regarding some aspects of signaller workload; the introduction of obstacle detection at level crossings, for example, reduces the need for banks of CCTV equipment or the staff to monitor them. But in other aspects, for example degraded working following failures, or dealing with telephone calls from users of level crossings, there is more to be done. For example,
- we intervened when it became clear that an inadequate assessment of the results of migration to York ROC had been made. The re-control of a number of former signalbox areas had been undertaken without considering all aspects of signaller workload for ROC staff. The result was that maintenance activities were not carried out because signallers were unable to grant access to the line.
- we had to intervene in recent migrations to ROCs to secure improvements to ergonomic matters, such as work station design, noise and lighting levels etc. Many of these concerns were brought to us by trade union safety representatives, who have since been involved by Network Rail in introducing more consistent arrangements across the network.
In 2016, Network Rail began a complete review of its internal standard describing the scope of ROC requirements. This review has been informed by carrying out risk assessments. ORR saw some interim findings at the end of September, but has not yet seen the final outcome. The work is finishing now and we expect to scrutinise the revised standard early in 2017.
While ORR welcomes the substantial measures being planned to introduce redundancy and flexibility into ROC operation, we consider Network Rail has still to demonstrate that it has adequately assessed all of the risks arising from moving to ROCs or has yet given consistent effect to suitable and sufficient controls and mitigations of those risks. While the process of moving fully to ROCs will take place over a number of years and the key risks will only be realised gradually over time, we look forward to seeing evidence of their being addressed in 2017.
I hope that I have answered these further queries to your satisfaction. Please do get in touch if I can help further on these points or any other rail safety related matter.