STAMP-Based Analysis on the Railway Accident and Accident Spreading: Taking the China–Jiaoji Railway Accident for Example
Total Page：16
File Type：pdf, Size：1020Kb
Safety Science 48 (2010) 544–555 Contents lists available at ScienceDirect Safety Science journal homepage: www.elsevier.com/locate/ssci STAMP-based analysis on the railway accident and accident spreading: Taking the China–Jiaoji railway accident for example Min Ouyang a,b, Liu Hong a,*, Ming-Hui Yu a, Qi Fei a a Institute of Systems Engineering, Huazhong University of Science and Technology, Wuhan 430074, PR China b Department of Civil and Environmental Engineering, Rice University, 6100 Main Street, MS-318, TX 77005, United States article info abstract Article history: Each hazard analysis technique is based on a model of accident causation. Most accident models regard Received 22 December 2008 accidents as resulting from a chain or sequence of events, such models are fit for accidents caused by fail- Received in revised form 29 May 2009 ures of physical components and for relatively simple systems, but suffer from serious deficiencies when Accepted 4 January 2010 they are applied to software-intensive, complex engineering systems. Recently, a new accident model called System-Theoretic Accident Models and Process (STAMP) for system safety has been proposed, it is based on control theory and enforces constraints on hazards and thereby prevent accidents. In this Keywords: paper, taking the China–Jiaoji railway accident happened on April 28, 2008 as an example, the STAMP STAMP-based analysis approach has been used to analyze the railway accident and some improvement measures have been pro- Railway accident Accident spreading posed. As the occurrence of one accident can cause many other accidents happen, based on the STAMP- based analysis, the accident spreading processes have also been discussed and modeled, which will be helpful to analyze accidents spreading in a broad sense and establish effective emergent measures for accident response management. Ó 2010 Elsevier Ltd. All rights reserved. 1. Introduction in her paper (Leveson, 2008), ‘‘We don’t seem to be making much progress lately in reducing accidents in most industries. Major On the morning of April 28, 2008, a major railway accident hap- accidents keep occurring that seem preventable and that have sim- pened between Wangcun and Zhoucun, near Zibo, in Shandong ilar systemic causes. Too often, we fail to learn from the past and province, People’s Republic of China. Train T195 from Beijing to Sif- make inadequate changes in response to accidents.” In this paper, ang railway station in Qingdao derailed at 04:38 China Standard a systematic accident model called STAMP will be used to analyze Time (CST) on the inside (left) track around a bend and train the China–Jiaoji railway accident. 5034 from Yantai to Xuzhou, coming from the other direction on Accident Models can explain why accidents occur and play the outside track, collided with it at the K290 + 940 m mileage fundamental role in investigating and analyzing accidents. In marker on the double tracked Jiaoji Railway at approximately the past, there are several types of accident models proposed. 04:41 CST. The accident caused 72 fatalities and 416 injuries One type of accident models is the sequential accident models, (http://en.wikipedia.org/wiki/2008_China_Railways_train_T195 which view accident causation as the result of a chain of discrete _accident). Many media and officials reported and investigated this events that occur in a temporal order. The Domino theory pro- accident, almost all of them thought the accident was due to posed by Heinrich in the 1940s (Ferry, 1988) belongs to this human errors. Some people were arrested for their mistakes, the class of accident models. In this theory there are five factors in director general of the Jinan railway bureau and the bureau’s Party the accident sequence, namely, social environment and heredity, chief were sacked. However, about half a year latter, on October 13, fault of the person, unsafe acts or conditions, accident, injury. train DJ5506 from Qingdao to Xuzhou railway station in Jinan rail- These five factors are arranged in a domino fashion which cause way run at 42 km/h over the speed limit for 8750 meters and 3 min the fall of the first domino result in the fall of the entire row. and 23 s. It is fortunate that there was no injuries happened, but This kind of accident models are fit for accidents caused by fail- we should take a deep thought on why accident analysis and re- ures of physical components or human errors in relatively sim- sponse in the past seem useless. This is just as Nancy Leveson said ple systems (Qureshi, 2007). However, many accidents have more than one contributing factor. So another type of accident models—Epidemiological Accident models have been proposed, * Corresponding author. Tel.: +86 02787540210. E-mail addresses: [email protected] (M. Ouyang), [email protected] (L. which regard events leading to accidents as analogous to the Hong), [email protected] (M.-H. Yu), [email protected] (Q. Fei). spreading of a disease. Reason has made deep studies on this 0925-7535/$ - see front matter Ó 2010 Elsevier Ltd. All rights reserved. doi:10.1016/j.ssci.2010.01.002 M. Ouyang et al. / Safety Science 48 (2010) 544–555 545 type of accident models (Reason, 1990, 1997). But epidemiolog- 2. STAMP-based accident analysis ical models simply regard organization mistakes as management errors and do not consider the effect of organization culture Each hazard analysis technique is based on a model of accident while they emphasize on linear causality relationships and did causation. The STAMP model of accident causation can be used to not consider the non-linear relationships, including the feedback. perform STAMP-Based Hazard Analysis (STPA). In STAMP model, However, the types of systems we are attempting to build and the most basic concept is not an event, but a constraint. The cause the context in which they are built has been changing. Systems of an accident, instead of being understood in terms of a series of become more complex and system components interact with events, is viewed as the result of a lack of constraints imposed each other in more complicated manners. So some more effec- on the systems design and on operations (Levenson, 2004). In the tive models are needed and then the systemic accident models STPA process, hazards are thought to be eliminated or controlled have been proposed (Hollnagel, 2004). Systemic accident models through system design. Fig. 1 presents a basic process control loop view accidents as emergent phenomena, which arises due to in STPA (Herring et al., 2007). Based on systems control theory, the complicated interactions between system components that may following requirements must be satisfied for the system controller lead to degradation of system performance, or result in an acci- to achieve its objective (Levenson, 2004; Kohda, 2008): (1) the con- dent (Qureshi, 2007). troller must have a goal to achieve; (2) the controller must be able Railway accidents cause a great number of casualties every to affect the state of controlled process; (3) the controller must be year in our world. Causal analysis of railway accidents has at- (or have) a model of the controlled process; (4) the controller must tracted a lot of interest by many researchers. Santos-Reyes be able to estimate the state of the controlled process. As can be et al., by use of a systemic method, have respectively analyzed seen in the Fig. 1, the controlled process is subject to process inputs two accidents—the Paddington railway collision, occurred on 5 and disturbances. The process output may become input into an- October 1999 (Santos-Reyes and Beard, 2006) and the Edge Hill other linked process control loop. railway accident, occurred on Sunday 9 May 1999 in Liverpool, Based on the basic process loop, a system accident can occur England (Santos-Reyes and Beard, 2008). They have identified due to its dysfunction, which may be caused not only by its com- many ‘learning points’, which are relevant for preventing similar ponent failure, but also by an incorrect system model or incorrect accidents on the railways. Fukuda, from the standpoint of effec- control rules. STAMP provides a useful classification of control flaw tive and efficient safety management of railway transport, has leading to hazard (Levenson, 2004). This classification can be seen described the definition of accidents, method of accident analy- in the Fig. 2. sis, possibility of accident analysis, problems, etc. in railways To analyze causal factors of a system accident, the procedure of (Fukuda, 2002). Niwa thought that a new accident analysis STAMP-based accident analysis can be described as follow (Leve- method should be proposed to analyze railway accidents because son, 2002): (1) To identify the hazard involved in the loss. (2) traditional analysis methods are difficult to find causes of the re- The hierarchical safety control structure related to the hazard is cent compound accidents with technologies developing day by constructed and the constraints necessary to control the hazard day (Niwa, 2009). are identified for each controller. (3) Starting from the technical A new type of systemic accident models called Systems-Theo- process and using the proximate events and general application retic Accident Model and Processes (STAMP) recently has been knowledge, any failures and dysfunctional interactions (including proposed by Levenson (2004). This model considers technical communication problems) involved in the loss are identified. (4) (including hardware and software), human and organizational For each constraint, a determination is made about why it was vio- factors in complex socio-technical systems. In the STAMP ap- lated: either the constraint was never identified and enforced or proach, accidents in complex systems do not simply occur due the enforcement was inadequate. In addition, Any human decisions to independent component failures, rather they occur when should be understood in terms of (at least): the information avail- external disturbances or dysfunctional interactions among system able to the decision maker as well as any required information that components are not adequately handled by the control system.