Posts about Metro Crash

Root Cause Analysis: Whenever accidents happen, root cause analyses must be conducted to identify the root causes, or hazards, that led to the accident. NTSB conducted an excellent root cause analysis of the Red Line crash. The problem with relying on root cause analyses alone is that systems with very, very few accidents present few opportunities to identify root causes, and the root causes of each accident are statistically likely to be different.

Failure Modes and Effects Analysis (FMEA): A more proactive approach to hazard analysis is to identify all of the ways in which a system might fail. These are the system's failure modes. Loss of train detection by the automatic train control system was the failure mode implicated in the Red Line crash. But there are dozens of other failure modes. FMEA identifies as many failure modes as possible, identifies the causes of each failure mode, and then prioritizes the actions that would correct each cause by the severity and likelihood of the effects of their failure mode and the cost of the corrective action.

NTSB rightly identified the deeper cause of the Red Line crash as not the failure of track circuit modules but an institutional failure to address safety. This institutional failure, though, was unhelpfully generalized as the "lack of a safety culture." How does one get a "safety culture"? NTSB's recommendations are sorely lacking in detail on this topic, with no mention of hazard analysis or FMEA. The result, as has been said, is a tone of petulance by the NTSB.

When WMATA calmly, systematically begins to conduct hazard analysis, publicly displays the resulting prioritized list of Corrective Action Plans in its monthly Vital Signs report, and then updates the list itself (as hazard analyses are conducted continuously) and the status of each plan, then people will think of WMATA as having a "safety culture".

In this regard, the FTA was much more helpful than the NTSB in the FTA Audit's recommendations for a "Hazard Management Program". The institutional root cause of the Red Line crash, unidentified by NTSB, was described perfectly by the FTA: "There is no evidence that safety analysis is being performed to prioritize hazards for elimination and mitigation."

Will cooler heads at WMATA prevail? Preliminary signs are not encouraging. The WMATA Board criticized the failure to implement over 100 Corrective Action Plans. Similarly, a WMATA official told the Riders Advisory Council, in explaining why the new 7000 series of rail cars will forego longitudinal seating, that if there were anything it could do, no matter what, to improve safety, then they would be remiss in skipping it.

Both of these incidents portray a shell-shocked WMATA that is reflexively saying "of course" to any idea that could improve safety. This emotional response to safety is precisely what leads to the false "safety vs cost" trade-off. A proactive hazard analysis program, however, must prioritize this list of ideas because it has produced far more corrective action plans than there is money or time to ever implement.

This results in a lean safety agenda that prioritizes CAPs with a high safety return on investment, not those that will only push large volumes of riders into cars for a minimal improvement in safety. That's why the FTA asked WMATA for its list of "top ten" hazards that it plans to address.

Furthermore, it's unclear if FMEA and Hazard Analysis are skills that exist within WMATA. The recent WMATA Vital Signs monthly report of Key Performance Indicators, such as passenger injuries and bus on-time performance, is to be commended for transparently monitoring and reporting metrics. But the discussions of "Why did performance change?" and "Actions to improve performance" for each KPI seem so arbitrary that it appears no root cause analyses were conducted for each KPI that was below target. Hopefully new Chief Safety Officer James Dougherty can bring these skills to WMATA.

It's time for calm, proactive analysis to replace emotional, reactive safety initiatives. The Metro Board and GM, as well as journalists and bloggers, can be more helpful by asking the right questions, as the FTA did, instead of exposing every safety idea that WMATA has not implemented as indicative of an agency with no "safety culture."

The signal system should have worked. It's inexcusable that it didn't. It's inexcusable that the NTSB could find all these problems with it but WMATA could not. It's inexcusable that a lot of people seem to have ignored the fact that the systems were generating errors and nobody was looking into why.

The 1000-series railcars should also be replaced. But can we really say the Board ignored the NTSB's recommendation? Actually, they spent a decade fighting for federal and local funding to replace the cars. This year, that funding finally came through, and WMATA is replacing the cars. Sure, it would have been nice to replace them earlier, but it wasn't like the money was sitting in a bank account gathering interest.

In lambasting of the Board yesterday, the NTSB sounded petulant that WMATA hadn't dropped everything to replace half its railcar fleet and magically come up with the money to do so. It's too bad they didn't follow that NTSB recommendation, but that NTSB recommendation was wildly unrealistic. Nonetheless, leaders spent 15 years on it and are now close to achieving it.

But I still object to the NTSB's continued focus on crashworthiness of railcars, their pressure to replace or revamp the 2000 through 4000 series, and their peevish attitude that WMATA hasn't done that already. The money isn't there. The achievable safety gains revolve around avoiding crashes, not rebuilding cars around handling crashes.

An obsession with crash survivability, instead of crash avoidance, already led the FRA to wreck intercity passenger rail in the US. Sure, new cars should be safer, and WMATA should replace ones that are unsafe as quick as they can, but despite running all these supposedly unsafe cars, Metro still had a fraction of the injury or fatality rate of highways. We might demand safer cars to be built going forward, but we don't demand that every driver on the road immediately replace his or her private car with the fanciest side curtain airbags on the luxury models.

Could the Board have done better? Yes. Should we demand better in the future? Absolutely. Did they just ignore NTSB recommendations around railcars? No, they pushed for 15 years to find money to satisfy that particular recommendation. And ironically, one of the only reasons the feds even came through with the money for new railcars was because of the crash. If it hadn't happened, WMATA might still be lobbying to replace the 1000 series.

According to the NTSB discussion, the Board asked the General Manager to explain the top safety incidents and what was being done about them. The Board sees itself as a policy-making body, and doesn't meddle in day to day operations. Asking the GM for a safety summary seems like the right approach. If the GM's summary was misleading, it would be nice if Board members had psychically divined this, but it's hard to see how exactly they could have.

Sumwalt also criticized the way the WMATA Board has a committee on Customer Service, Operations, and Safety. "We at the NTSB only focus on safety," he said, "but that committee has to balance customer service with safety." Yes. It should. Customer service and safety are both important. The NTSB may have the luxury of ignoring everything but safety, but that doesn't mean that boards or agencies can do so.

The Board could have constantly asked the General Manager what the agency was doing to comply with NTSB recommendations, said Groff. But we know that many of those recommendations were financially unrealistic. The NTSB members might wish that everyone spent all their time sitting around and only worrying about safety and nothing else, but that's not how it works in reality.

Another NTSB member noted that in a hearing, Board Chairman Peter Benjamin previous Board Chairman Jim Graham said he hadn't heard of the Tri-State Oversight Committee before the crash, though then-General Manager John Catoe was well aware of it. But few of us out in the public had heard of it either. The TOC, by all accounts, operated in obscurity and for some strange reason didn't feel it could talk to the Board or the public.

We were all ignorant of the safety problems before the crash. Now, following investigations, it's clear that there were many organizational problems within WMATA, and the TOC wasn't functioning properly. I wish that the Board or other leaders had found out and fixed it, but it's hard to throw stones at leaders who only knew what we knew, and we didn't know about the problem.

The fault lies with General Manager Catoe and the safety officials at WMATA. Now, knowing this was such an issue, the Board does have a responsibility to ensure it gets fixed. Now, the Board should delve more deeply into the progress the agency is making on safety. Now, they shouldn't be satisfied with vague answers from management.

And now, if future crashes happen that could have been prevented, it would be fair to blame the Board if they don't take adequate action. I'm not sure that stepped-up level of oversight is happening. The NTSB said that even today, the Board doesn't claim responsibility for safety. They're right that this should change. It should start now.

Update: I've revised the headline and intro paragraph to reflect some further thoughts on what the Board needs to do going forward.

They reiterated their recommendation to replace the 1000 series cars, which WMATA will do with the Kawasaki order which, as of this morning, is now cleared to go forward. The NTSB said the 2000 and 3000 series cars are also susceptible to telescoping in a crash, but it's unclear what WMATA can do about it unless the federal government is interested in coming up with billions more to replace them.

DCist has a good summary of this morning's session. The meeting is now on break for lunch until 12:30. I will be tweeting the afternoon session @ggwash and will post about it again later.

Update: Steven Yates made a good point I also wanted to make but wanted to get the post out quickly:

"When safety is more important than schedules, their lessons will have been learned," said NTSB Chairman Deborah Hersman.

Placing aside for the moment how well WMATA keeps to schedules, I think this is flawed thinking. As we've discussed before, a decrease in the quality and reliability in regards to speedy transit will result in more people driving, which is much more dangerous than taking Metro.

Maybe they'll talk about this later, but there seems again to be no comparison of Metro safety to other modes. Saying the 2000 and 3000 series are not so safe is sure to make some riders nervous. It'd be great if those cars were more crash-proof, but is riding in them really something to avoid compared to driving?

The NTSB tends to focus on just how to improve the particular mode they're investigating at the time, but that carries problems. If they're going to make strong statements about the importance of safety, they should put it in some context rather than simply scaring people away from Metro.

An unoccupied track circuit is shown in diagram "A". The power source is located at the number "1", with the relay shown at number "2". The completed circuit is shown in green on the diagram.

A train is detected because it shorts the circuit. In railroading, this is called "shunting" the circuit. When a train enters a block, the metal wheels and axle conduct the circuit as a short cut which bypasses the relay. This de-energizes the relay, which causes signals to report the block as occupied. This is reflected in diagram "B": "1" shows the power source, "3" is the wheel/axle of a train, and "4" is the de-energized relay.

Metro's track circuit system ("C") is a little more advanced. In Metro's case, each block has a relay on each end called a "Wee-Z bond". These bonds are split between blocks. Each one acts as a transmitter for one block and a receiver for the adjacent block. If a given block's transmitter ("5") and receiver ("6"), located on opposite ends of the block, have a complete circuit, the block is considered unoccupied, and therefore safe for trains to enter.

If, however, a train is in the block, the transmitter/receiver circuit is broken, stopping subsequent trains from entering the block. Speed commands are sent to the train in the block through the transmitter bond. The commands are sent as high-frequency audio waves through the running rails. The ATC computer uses data from the blocks to determine which blocks are occupied, and therefore how to space trains.

In general railroad signals work like traffic signals - they can't prevent a train from passing a stop signal, they just alert a driver to stop. However, many railroads and transit operators have systems which can stop a train. This is the case with Metro and New York's subway system, for example. New York uses trip stops, which are metal arms at the base of the signal. When red, the arm is in the up position, and it hits a valve on trains that pass it which applies the emergency brake.

Metro's system uses Automatic Train Control (ATC) to enforce stop commands and keeps trains safely spaced by controlling train speeds. Because signals are not present on the wayside, operators know whether it is clear to proceed through cab signaling. The ATC system sends speed commands to the train and the speed appears on the operator's console. In both manual and automatic operation, the ATC system automatically applies the brakes if the train's speed exceeds the regulated speed for more than 2 seconds.

In the June 22 collision, the track circuit where Train 214 stopped did not detect the train. Because Train 214 was not detected, the ATC system did not stop Train 112 as it approached. The NTSB has not released an official cause as to why the system failed to detect the train. However, parasitic oscillations are often cited as a primary factor. How those parasitic oscillations got into the system and bypassed the track circuit has not been announced.

Despite the fact that these parasitic oscillations had been present in the track circuit for five days, Metro did not catch the problem. A realtime backup system is necessary to assure that this sort of thing is not repeated in the future. In a later post, I'll explore the consequences of track circuit failures and some potential solutions.

The first partial sighting of Train 214 was 1,121.5 feet. At this position and time of day, the stopped train is in shadow and is screened by the chain-link fence running alongside the Shady Grove-bound track. It is also obscured by the vegetation on the west bank of the railroad cut.

The report also shows braking based on first full sighting of the stopped train. This is 471 feet from the point of impact, a little more than the length of a 6-car train. Even an emergency brake application at this point would not have averted the collision, but would have slowed the train to about 24 mph. A three second-delay in response time would have resulted in a crash speed of 44 mph.

Based on the steel bluing (skid marks) on the rails, the operator of Train 112, Jeanice McMillan, probably applied the brakes less than three seconds after the point of first full view, but not in time to stop the collision from occurring at at least 33 mph.

The NTSB identified a "last point" to stop after which a collision was inevitable. That point is about 400' after the first partial sighting, and about half the distance to the full sighting.

The collision happened around 15 seconds after the first partial sighting of the stopped train, or around 5 seconds after the first full sighting.

It is important to note that even when the stopped train came into view, it might not have been clear to the operator of Train 112 that the visible train was stopped on the Shady Grove track (Track 2). This was reported to be a factor when a Metro train struck wayside workers at Eisenhower Avenue in November 2006 (page 5).

These tests show the importance of the ATC system. Line-of-sight often does not present enough time or distance to stop trains, which is why railroads and transit systems use signal systems. It is absolutely vital that fixes for the ATP train detection system be found.

In past discussions, some commenters have wondered about color-light signals as a solution. It appears that in this case, they would not have made much difference. The track circuit where Train 214 was stopped failed to detect Train 214. If color-light signals had been present, they would have displayed a "clear" aspect in the same manner that the ATC system sent "clear" to the cab speed signals on Train 112.

If WMATA and its passengers cannot be confident in the train detection system, there can be no true confidence in passenger safety. That's why it is so important to design and implement at least one backup system. San Francisco's BART did so in the early 1970s, and WMATA tells us that they are working on a system now. WMATA hopes that such a system can be in place by the end of this calendar year. For riders, that system cannot come soon enough.

Tuesday

• Introduction of the Board of Inquiry and Technical Panel
• Introduction of parties
• Accident overview
• WMATA's oversight of safety
• WMATA's operational actions to address safety issues
• Tri-State Oversight Committee (TOC) overview of WMATA

Wednesday

• State safety oversight of rail transit systems
• Federal oversight of rail passenger systems

Thursday

• High reliability organizations

The NTSB issued multiple recommendations to Metro to ensure enhanced track worker safety. These included:

• Establishing procedures to be used for members of a work crew to acknowledge a lookout's warning that a train is approaching on a particular track from a particular direction before a lookout gives an all clear signal to a train. (R-08-01)
• Establish a systematic program for frequent unannounced checks of employee compliance with Metrorail operating and safety rules and procedures. (R-08-02)
• Perform periodic hazard analyses on the deficiencies identified by unannounced checks of employee compliance in response to Safety Recommendation R-08-02, and use the results to revise Metrorail training curricula or enforcement activities, as necessary, to improve employee compliance with operating and safety rules and procedures. (R-08-03)
• Promptly implement appropriate technology that will automatically alert wayside workers of approaching trains and will automatically alert train operators when approaching areas with workers on or near the tracks. (R-08-04)

At the time of these recommendations, NTSB member (and now Chairwoman) Deborah Hersman felt that Metro did not have a strong culture of safety. Hersman was quoted, "a strong safety culture doesn't take dollars; it takes a will. They had rules. Those rules weren't observed."

In the wake of the NTSB findings, Metro general manager John Catoe vowed to make the transit system the safest in the country. Catoe said Metro would look at adding new technology to improve the safety of track workers. Polly Hanson, the Metro safety and security "czar" at the time, said she hoped to implement the NTSB's recommendations for alert equipment. Anonymous sources told the Washington Post that staff within the rail department were not in favor of this due to the extra work it would require.

Around this time, Metro hired a new Chief Safety Officer. Ronald Keele was brought on as part of Catoe's safety reform efforts. Keele had previously served in a similar role at Metro, and then at MTA in Maryland. He was also chief safety officer for NASA's space shuttle program, in the time period prior to the Columbia accident. Keele said one of his top priorities would be improving safety for track workers.

In July 2008, Catoe attended a Federal Transit Administration Safety Summit. From a U.S. Department of Transportation newsletter:

Mr. Catoe raised the following issues such as recognizing gradual changes to operating conditions, getting "out in front" of safety problems publicly, and leadership acceptance of responsibility and commitment to solving and tracking problems. Mr. Catoe emphasized the importance of top‐down leadership and accountability, and direct communication with employees. He also shared the importance of rules enforcement programs and agency‐wide participation.

In the nearly two years since the new safety chief was hired and the NTSB reports were issued, it's unclear how much progress has been made. According to WMATA's web site, Alexa Dupigny-Samuels now holds the position of Chief Safety Officer. Dupigny-Samuels was appointed in February 2009. The press release announcing Dupigny-Samuel's appointment offers no information about Keele's future. Metro has not answered inquiries about Keele's departure or reassignment. The latest update regarding the track worker protection technology was that Metro was still considering the options.

Tragedy would again strike Metro track workers this year. On August 9, Mike Nash, 63, was struck and killed by a gravel-spreading machine on the Orange Line. Nash had been working on the rails for 19 years. The NTSB declined to investigate that incident, as it did not involve a train, but rather maintenance equipment. On September 10, John Moore, 44, was struck by a train between the Braddock Road and National Airport stations. He died four days later. The NTSB was notified of the incident. At this time, Metro has offered little information about the incident. Moore worked with communications equipment, but it is unclear what work he was doing at the time of the accident.

It remains to be seen the cause of Moore's death, and whether it is directly related to any of the problems identified by the NTSB in 2006. With regard to the 2009 deaths, Catoe says that Metro has "got to get back to the basics of safety." Operating a railroad is dangerous, and there will be accidents, this much is for sure. However, given the seriousness of the NTSB recommendations issued not even two years ago, it is important to evaluate whether Metro has improved. Has Metro been able to develop the culture of safety Hersman deemed so important? Has the turnover in the safety department hampered these efforts? Has John Catoe lived up to his words of getting "out in front" of problems? The answer to these questions become clearer after looking at all of the areas of Metro safety.

In the next part of the series, we will look at Metro's history of derailments, their causes, and Metro's reaction.

The goal of this series, The Price of Safety, is shine a light on Metro's safety record and attempt to identify ways that Metro can improve safety given limited resources. By identifying current and historical shortcomings, it is possible to lay out a roadmap for reform. This is not a series about the June 22 crash, but rather a bigger picture look at Metro's self-proclaimed "culture of safety." This is also not an attempt to blame Metro for circumstances beyond their control, but to identify positive steps to address the issues that they can control and avoid future problems where possible.

Metro is at a crossroads, suffering budgetary problems and the consequences of the organization's worst rail disaster. There is never an easy or convenient time for an organization to undertake significant and ground shaking changes. For Metro, however, many needed changes are ripe or even overdue.

The following is a brief sketch of where this series will go, and what will be covered. I will break the sections up as logically as possible, with the goal of a new post each week. I will try to present as much objective information as possible in order to draw a reasonable and honest summary of the current state of safety.

Previous incidents

• Struck workers: Fatal incidents involving track workers
• Derailments: From the 1982 fatal derailment to present
• Collisions: The 1996, 2004 and 2009 crashes
• Near-misses: Focusing on the 2005 incident outside Foggy Bottom, but looking at others, including the 2009 near-miss at Potomac Avenue

Metro's safety priorities and response to crises

• Communication with NTSB and the Tri-State Oversight Committee
• Safety management structure and institutional memory. Is there a true "culture of safety" within Metro?

Looking ahead, the potential for reform

• The next steps: Immediate changes
• Bigger picture: 'Creative destruction' to Metro's organizational chart
• Financial and political considerations versus passenger safety: A life or death struggle

I hope you'll join me in taking a critical look at a vital part of our region's infrastructure.