Managing Human Factors in Hong Kong through a Risk-based Approach 23rd International Railway Safety Conference Managing Human Factors in Hong Kong through a Risk-based Approach Presented by Paul H.B. SEN Railways Branch Electrical & Mechanical Services Department Government of the Hong Kong SAR

Railway System in Hong Kong Railway Network of HK HR: 11 Lines, 84 Stations LR: 12 Routes, 68 Stops Total Route Length: 218km 5.1 Million pax / weekday Railway System in Hong Kong Relatively small railway network with a total track length of about 218 km Hong Kong is a densely populated city 5.1 millions pax per weekday on the average (7.18 million population in HK as at mid 2013) Rail transport is an indispensable part for Hong Kong people Highly automated with minimum intervention Human factors do play a vital part in rail operation High public expectation for level of service

Oversight on Safe Railway Operations Ensuring the adoption of appropriate safety practices by the railway corporations; Investigation of railway incidents Assessing and following up the railway corporations' improvement measures Assessing and approving new railways and major modifications Railway lines operated by the MTR Corporation Limited RB of EMSD is the regulatory body of all railway lines Empowerment of the Mass Transit Railway Ordinance in Hong Kong Statutory role to oversee the safe operation of the railways Main functions: Investigating into railway incidents; Ensuring the adoption of appropriate safety practices by the railway corporations; Assessing and approving new railways and major modifications; and Assessing and following up the railway corporations' improvement measures

What is Human Factors? “… the environmental, organisational, and job factors, and human and individual characteristics which influence behaviour at work in a way which can affect health and safety.” (Health & Safety Executive, UK) Human beings are fallible: Human errors & violation Someone not doing the right thing at the right time Passenger behaviour: Publicity & education – a joint effort with operator Focus on railway staff: contractors and MTR employees – Staff errors could be reduced (if not eliminated) by design and management

Continuous Monitoring Risk-based Model 4 Phases 1 2 3 4 Classification of Incidents Risk Assessment HF Analysis accordingly to Risk Rating Recommendation Causation Equipment Failure Human Factors External Factors Risk Rating Likelihood Consequence Deficiency Skill Rule Knowledge Remedies Continuous Monitoring Plan-Do-Check-Act Risk-based model involves: Classifying incidents Assessing the likelihood, consequence of any known hazards and determine the risk levels Analysing the HF: human deficiency (SRK) and performance shaping factors Recommendation for incident specific remedies

Classification of Human Factor Incidents - Non-HF Related: Pure equipment failure & External Factors - Focus: HF related: Staff behaviour & Passenger Behaviour Human factors incident classified by type of errors Classified incidents recorded in Incident Data Management System

Trends of Human Factors Incidents Amongst the reportable incidents caused by staff behaviour, it is more common for the staff behaviour to have an impact on OSH Except 2011: Measured by incident number, the impact on passenger / public safety overshot the OSH impact Past 2 years: Raise the attention on any HF elements involved in incidents

Risk Assessment by Risk Matrix Use a conventional risk matrix to determine the risk level 10 levels of likelihood of occurrences – Similar occurrences in the past 7 levels of consequence – Impact on public safety (measured by no. of fatalities) or service (duration of service disruption) Results in 4 levels of overall risk

Risk Assessment by Risk Matrix OR1 Unacceptable and shall be eliminated OR2 Undesirable and shall be reduced by practicable control measures OR3 Tolerable but shall be further reduced if possible OR4 Negligible

Analysis of High Overall Risk Incidents Performance Shaping Factors Human Deficiency Task design, interface design, competence management, procedures, person, environment Skill Rule Knowledge HF Analysis HF analysis – to identify shortfall and find out ways to make good Use performance shaping factors as a guide to comprehend the cause of incidents due to deficiency of staff in respect of skill, rule and knowledge (SRK) Best to be illustrated by HF incidents

Human Factors Incidents

Case 1: 21 January 2010, East Rail Line Failure of Data Transmission Network An evening peak at the East Rail Operations Control Centre For the traffic controller Seeing is believing – The railway is safe and seen to be so by Tracking the locations of trains Communicating with train captain with radio Making public announcement

Failure of Data Transmission Network at East Rail Line All these operations at the East Rail Line Operations Control Centre are supported a data transmission network Fibre Distributed Data Interface (FDDI)

All of a sudden, all terminals became dumb, The traffic controllers at the East Rail Line Operations Control Centre could not track the locations of trains Radio communication with all train captains was also lost. Train services on the whole line were suspended … all for safety 30,000 passengers were stranded during the incident It takes an hour for recovery of train services

Photomontage of OCC ATS Blackout

Case 1: 21 January 2010, East Rail Line Failure of Data Transmission Network Third-party supplier’s computer engineer was conducting a regular software audit to ensure the integrity of the data network To do so, he executed an off-line software optimisation program. He felt hungry and left for dinner! The program he had loaded was a slip of hand, it went online, overloaded the data network with junk data, and paralysed the FDDI network causing the failure.

Failure of Data Transmission Network at East Rail Line All these operations at the East Rail Line Operations Control Centre are supported a data transmission network Fibre Distributed Data Interface (FDDI)

Case 1: 21 January 2010, East Rail Line Failure of Data Transmission Network Third-party supplier’s computer engineer was conducting a regular software audit to ensure the integrity of the data network To do so, he executed an off-line software optimisation program. He felt hungry and left for dinner! The program he had loaded was a slip of hand, it went online, overloaded the data network with junk data, and paralysed the FDDI network causing the failure.

Case 1: 21 January 2010, East Rail Line Failure of Data Transmission Network Remedial Measures Assigning designated staff to closely monitor audits and communicate with third-party expert Avoid peak hours audits Prohibit uploading of new software patches to the online operating systems during traffic hours Ensure that the online system would not be affected by implementing tighter working procedures Establish policy of no software audits during peak hours and operating hours as far as possible Use security device (interlocking switch) to bar any attempt to upload new software patches to the online operating systems during traffic hours

Train Doors Opened when Train Stopped Short of Platform Rear End Case 2: 8 January 2012 East Rail Line Train Doors Opened when Train Stopped Short of Platform Rear End EAL Train Captain Pressing Door By-Pass Button without OCC Authorisation On 8 January 2012, a portion of a passenger train stopped short of the platform stopping mark.

Inaccurate Stopping Position Case 2: 8 January 2012, East Rail Line Train Captain Opened Doors of Train Stopping Short of Platform Rear End What’s wrong? Train captain did not identify the train stopping position There is a procedural bar for door opening Inaccurate Stopping Position OCC Authorisastion Emergency activation by pressing door by-pass switch needs OCC authorisation Train captain did not seek OCC authorisation It is not uncommon for trains to stop in an inaccurate position The train doors will not be opened until the train captain has confirmed that the train is in the correct position. A door by-pass switch was provided at the control console of the cab right in front of the train captain. The original design intent was to allow evacuation in case of emergency. Authorisation of the OCC was needed before a train captain can press the door by-pass button. The train doors were opened as the train captain pressed the door by-pass switch without authorization of the OCC That risked passengers riding on the last train compartment fall to track from a height of about 1.1m Near Miss Potential safety threat of passenger falling to track at height

Case 2: 8 January 2012, East Rail Line Train Captain Opened Doors of Train Stopping Short of Platform Rear End Reinforcing the correct procedure for operating door by-pass switch Identifying train stopping position K R Vigilance Procedure Improvement Measures S D Aid MMI Installing stopping mark at each platform end Switch relocation Reminder label

Vertical stopping mark in Hung Hom Station

With Courtesy of MTR Corporation Limited Case 2: 8 January 2012, East Rail Line Train Captain Opened Doors of Train Stopping Short of Platform Rear End Follow-up Actions: Refresher training programme developed to remind train captains to be vigilant in identifying the train stopping position The training programme also reinforced the correct procedure for operating the door by-pass switch Vertical stopping mark at platform end We recognised that the environment and the design of man-machine interface were performance shaping factors for this incidents. Half a year after the incidenb, the door by-pass switches were all relocated from the front to the back of the train captain to avoid inadvertent operation. Door bypass switch is now located at positions such that Train Captain has to stand-up and walk so as to activate the switch. The switch relocation work was completed in Jul 2012. Label was provided near door by-pass switches to further remind the train captain proper usage of the facility. With Courtesy of MTR Corporation Limited

Case 3: 21 October 2010, Tsuen Wan Line Breakage of Overhead Line Contact Wire In the morning of 21 October 2010, - The overhead line in a section of the Tsuen Wan Line (between Prince Edward Station and Yau Ma Tei Station) was burnt out as a result of repeated short-circuit faults. It took some time to figure out what happed and further 2.5 hours to re-connect the overhead line Altogether, train service at Yau Ma Tei Station was suspended for 3 hours 100,000 passengers were affected

Case 3: 21 October 2010, Tsuen Wan Line Breakage of Overhead Line Contact Wire Cause of Incident Primarily originated from a simple equipment fault But successive human errors are key contributory factors to the severe service impact

Case 3: 21 October 2010, Tsuen Wan Line Breakage of Overhead Line Contact Wire Equipment Failure - Traction motor - Train-bourne circuit breaker Human Errors - Communication between OCC and Train Captain - Mistake in reporting the pantograph status to the Traffic Controller Consecutive electric short-circuit faults Overhead line contact wire overheated and burnt out Snowball Effect Human Errors Procedure of the recovery of traction power by Power System Controller - Repeated attempts to reclose the traction DC circuit breaker before asking the platform supervisor to check the pantograph status on site Originated from a short-circuit fault inside the traction motor Limitation of the train-bourne circuit breaker train-borne circuit breaker damaged Overhead line traction supply circuit breaker was tripped Incident train captain was instructed to lower the pantograph to isolate the fault He acted accordingly and the Power System Controller attempted to resume the traction power supply In fact, the action of the Train Captain was futile. The DC circuit breaker tripped again Nobody checked the status of the pantograph on site Power System Controller did not ask for better information about site situation He repeatedly attempted to re-close one of the DC circuit breakers for that incident section That resulted in 5 consecutive electric-short circuit faults A fault of the traction motor alone would not have caused an incident as such. That was the outcome under a snowball effect and human errors are key contributory factors.

Agreed Mitigation Measures Case 3: 21 October 2010, Tsuen Wan Line Breakage of Overhead Line Contact Wire Agreed Mitigation Measures Install a visual indicator in the driving cab as an visual aid for the train captain to confirm the position of the pantographs Replace train-borne circuit breakers with new ones of higher current rupture capacity Review and revise the operation control procedure for closing traction supply circuit breakers to provide clear steps for operators to follow We figured out that we need to tackle two human factors issues. First, the Train Captain did not correctly report the pantograph status to the Traffic Controller. MTRCL agreed to install a visual indicator in the driving cab as an visual aid for the captain to confirm the position of the pantographs Second, the Power System Controller attempted to reclose the traction supply circuit breakers for several times before asking the platform supervisor to check the pantograph status on site. We reviewed the operation control procedure with MTRCL. MTRCL then revised the procedure for closing traction supply circuit breakers to provide clear steps for operators to follow.

Restricted Manual Mode Train Operation at 20 kph Case 4: Rail Breakage Incidents at East Rail Line and Tsuen Wan Line 2011 Restricted Manual Mode Train Operation at 20 kph East Rail Line Breakage of rail as a result of crack propagating from an insulated rail joint bolt hole. JAN 13 Two rail breakage incidents occurred in early 2011. The first on the East Rail Line on 13 January 2011. Train services were severely affected as trains needed to travel in “restricted manual mode” at 20 kph near the affected rail section.

Restricted Manual Mode Train Operation at 20 kph Case 4: Rail Breakage Incidents at East Rail Line and Tsuen Wan Line 2011 Restricted Manual Mode Train Operation at 20 kph Tsuen Wan Line Aluminothermic weld defect causing rail breakage FEB 10 The secondt on the Tsuen Wan Line on 10 February 2011.

East Rail Line Tsuen Wan Line Case 4: Rail Breakage Incidents at East Rail Line and Tsuen Wan Line (2011) Track Maintenance East Rail Line Dating back from 13 January 2011 … Track maintenance staff had temporarily applied a bolt of smaller diameter Stress concentration at bolt and bolt hole Tsuen Wan Line Dating back from 10 February 2011 … Visual inspection every 3 days Track maintenance staff carried out NDT once every 2 weeks Could not detect any crack For the East Rail Line incident, the incident could have been avoided if a suitable size bolt was used in the first place. The entire rail network was checked and 7 IRJs with a smaller bolt were identified and replace.

Case 4: Rail Breakage Incidents at East Rail Line and Tsuen Wan Line (2011) Recommendations Adoption of EN14730 Site aluminothermic weld procedure Qualification of welding personnel Standards Improvement Measures Recommendations Adoption of ISO 9712 Independent examination certification of NDT personnel Standards A consultant reviewed the rail inspection and maintenance regime. He recommended adopting the EN14730 standard to improve the site alumnothermic welding procedure adopting the ISO9712 standard for independent examination and certification of NDT personnel

Conclusion Coping with human factors incidents – a job for both regulator and operator No recurrence of railway incident caused by the similar human errors Identifying high-risk scenarios and deploy resources accordingly for necessary improvements Targeted safeguard measures for reducing the HF risks to a level as low as reasonably practicable Effective management of railway incidents due to human error - Number of human factor incidents has been substantially contained with a steadily declining trend - No recurrence of railway incident caused by the similar human errors Efficient utilization of resources - Focus manpower resources more efficiently on our identified high-risk scenarios - Devise very targeted safeguard measures and inspection programmes in order to reduce the risk arising from human factors to a level as low as reasonably practicable

Thank You