Getting at the Underlying Systemic Causes of SPADS:

A New Approach
Karen Wright, David Embrey & Martin Anderson
Human Reliability Associates Ltd

Introduction
Now, more than at any other time in the history of the railways, there is an urgent
need for the industry to learn lessons from near misses and incidents. In this first of
two articles, we examine the extent to which the current procedures for gathering data
on accidents such as SPADs provide support for the identification of underlying
causes. An alternative approach is outlined, which we believe has the potential to
allow a much more comprehensive and structured assessment of underlying causes to
be made during SPAD investigations. This process is based on the research findings
on the causes of SPADs, combined with the practical knowledge possessed by
experienced personnel such as drivers and Driver Standards Managers.

Approaches to Accident Analysis in the Rail Industry

The overall approach to accident analysis in the rail sector is similar to that in many
high-risk industries. It is characterised by the following features:

• The main focus of the investigation is on the individual, and it is assumed that
human error is mainly due to individual human failings or inadequacies.
• Limited information is collected on the context of the incident, i.e. the
conditions that prevailed at the time of the incident that could have contributed
to its occurrence.
• It is assumed that a single root cause exists for every incident.
• Every incident is assumed to be unique, so there is no incentive to identify
systemic, recurrent causes.

Focus on the individual

The primary focus in SPAD investigations tends to be on the individual who was the
last link in the chain of events leading to the accident. In the case of non-technical
SPADs, this is the driver of the train. Because it is usually assumed that the accident
is ‘caused’ by the driver, there is a strong bias in the incident reporting form on
questions relating to driver characteristics. These tend to focus on issues such as his
or her physical or mental state, e.g. possible alcohol and substance abuse, or fatigue,
or on issues relating to levels of experience and competency. This view assumes that
human error is primarily controllable by the individual, in that people can choose to
behave safely or otherwise. This one of the reasons why information on the
underlying causes of incidents is often not collected in a systematic manner. If the
investigator and the investigation process assume at the outset that the SPAD analysis
process is primarily intended to categorise an incident into broad groups such as

© Human Reliability Associates

1
misread, disregard or misjudge, then there is little incentive to try to understand the
underlying causes.

Context
The types and frequency of human errors depends on the context in which a task is
performed. Context refers to the specific conditions that existed when an accident or
near miss occurred. Without collecting this information in a systematic and structured
manner, it is not possible to identify the recurring causes that may be present in many
incidents. This is essential to develop preventative strategies that address the
underlying causes of incidents, rather than wasting resources in trying to apply
solutions based on a few high profile incidents. Because there is an almost unlimited
range of information that could be collected when an incident has occurred, a model
of human error is needed to select the most important factors.

Why not why?

The focus on the individual means that the information gathered about who was
involved is fairly comprehensive and will include their experience, duty rosters prior
to the incident, last refresher training etc. In addition, where and when the SPAD
occurred is described in detail. However, gaining an understanding of ‘why?’ is
hindered by the current SPAD classification scheme. The classification is not linked
to any underlying model of the accident process. The major classification groups for
non-technical SPADs are as follows:

• Misjudgement
• Misread
• Disregard
• Miscommunications.

There are a number of drawbacks to this scheme. Two SPAD incidents can arise from
quite different underlying causes yet may be classified in the same category. For
example, a SPAD incident assigned to the ‘Disregard’ category could have occurred
due to a failure to see a signal or a failure to respond to a signal. These are two
distinctly different types of failure, influenced by different factors, yet at this level of
analysis no differentiation between the two is made. This surface level classification
hampers any attempts to identify systemic trends. There is also a mixture of error
types and error causes in this classification. For example, ‘Miscommunication’ is
often the outcome of a number of fundamentally different error types, e.g. message
not heard, or message misunderstood - each of which is influenced by different factors
(e.g. attention focussed elsewhere, communication system failures in the first case, or
lack of training in the second).

Assumption of a Single Root Cause

Generally the investigation of a SPAD stops when a primary cause of an incident has
been identified from the sub-categories specified in the SPAD reporting form. This
implies that the incident only arose though a single cause. However, it is well known
in accident research that accidents do not arise from a single cause but from a
combination of conditions. Many of these conditions will have occurred in previous
incidents, but without a systematic framework for gathering information consistently

© Human Reliability Associates

2
during each incident investigation, the frequent recurrence of the same systemic
causes may not be recorded.

A New Approach
It is essential that the data to be collected in an investigation be driven by a model of
SPAD causation. Working with Railtrack and a number of Train Operating
Companies, Human Reliability Associates have developed such a model in order to
inform SPAD investigations through analysis of systemic causes. This has become
known as the ‘Model for Assessing and Reducing SPADs’ or MARS. The MARS
model consists of three categories of information processing. These represent the
stages through which a driver must progress when responding to a signal:

• Detection: acquisition of information - detecting the presence of a signal and

identifying the signal aspect.
• Decision: interpreting the meaning of the aspect and developing an intention
to act (i.e. formulate a braking strategy-normally this will be performed
without conscious thought).
• Response: executing the chosen course of action e.g. physically applying the
brake.

Signal Detection Decision Response

at Signal Signal Correct
Danger Detected Interpreted actions made

Figure 1: Stages of Information-Processing in MARS

Figure 1 illustrates these three stages of information processing. Failure to

successfully progress through any one of these stages will result in a SPAD incident.
These stages provide a top-level classification scheme for SPADs. This approach
enables incidents to be classified according to the types of failure the driver has made.
These stages are linked, in that an incorrect diagnosis at the intention formation stage
could lead to an incorrect braking strategy, even though this could be executed
correctly. For example, if a driver were unaware of leaf fall, he might decide to brake
in way that was inappropriate for the situation, which could lead to a SPAD.

Performance Influencing Factors

The context in which human behaviour occurs determines, to a large extent, the
likelihood that an error will occur. The factors that form the context in a situation are
known as Performance Influencing Factors, or PIFs. When all of these factors are
optimal, then performance will also be optimal. In this approach, it is recognised that
human performance may be influenced by factors that are not under the direct control
of the individual. The factors influencing the likelihood of SPADs in the MARS
model include:

• External factors such as signal clarity and positioning.

© Human Reliability Associates

3
 • Physiological factors such as the driver’s level of alertness and reaction speed.
• Cognitive factors such as attention focus (the extent to which the driver’s
attention is directed correctly to detect a signal), communication and multi-
tasking (the extent to which the driver has to process multiple sources of
information, for example at complex junctions).

Identifying the factors that directly affect the likelihood of SPADs is clearly very
useful in analysing incidents. However, it is frequently very difficult to directly
assess the contribution of these factors. For example, a factor such as ‘Degree of
signal clarity’ will obviously affect the likelihood of signal detection. However, in
order to assess whether signal clarity was good or bad in a particular incident, we
might want to ask questions about factors that directly influence it, such as track
curvature, and the degree of confusability between the signal and its background. The
Influence Diagram provides a method for guiding the SPAD analyst in assessing these
influencing factors, thus making the analysis process more structured and consistent.

Influence Diagrams
An Influence Diagram (an example of which is shown in figure 2) represents the
relationships between causes (both direct and indirect) for a particular class of
accidents, e.g. SPADs. Influence Diagrams are developed by combining scientific
research on accident causation with insights from the experience of ‘domain experts’,
e.g. drivers. These diagrams place a degree of structure on the complex interactions
of factors that combine to cause an incident. The direct influences on behaviour such
as signal visibility and alertness are combined in the same framework with indirect
factors, such as organisational culture and management policies.

Signal Detection
Failure

Signal visibility Attention focus Alertness

Aspect Signal Shift match

Signal clarity Signal location Fatigue
assumption position cues policy

Maintenance Weather Job route Degree of Environmental

AWS cue
policy conditions stimulation exposure to route cues

Figure 2: Example of an Influence Diagram

In the Influence Diagram shown in figure 2, signal visibility, attention focus and
alertness all influence the correct detection of a signal. Each of these three factors is

© Human Reliability Associates

4
in turn influenced by other indirect factors further down the Influence Diagram.
Moving down the chain of influences in the diagram leads us to factors that are further
away from the incident in space and time. For example, signal visibility is influenced
by signal clarity, which in turn is influenced by the maintenance policy of clearing
away visual obstruction. We can see that the Influence Diagram allows the chain of
causes to be traced back from the direct, surface causes to the indirect or policy level
decisions that may be the ultimate ‘root causes’. Influence Diagrams have been
developed for each of the three stages in the MARS model – signal Detection,
Decision-making and Response.

Summary
The use of the MARS model and the associated Influence Diagrams brings together
research findings and the expert knowledge of drivers and other experienced
individuals to provide a coherent structure for analysing SPADs.

A major benefit is that the method allows information on underlying causes from a
number of incidents to be aggregated over time, so that in the long term, the most
important causes can be identified. Such an analysis of trends has the potential to
provide a rational basis for allocating resources to address those causes that are the
most important contributors to risk.

In Part 2 of this article we provide further information on how this is achieved, and
also illustrate how the model is actually used to structure a SPAD investigation. We
shall also show how the approach is able to pinpoint the most cost effective areas in
which to apply preventative measures. In addition, we shall show how the method
can be used predictively to assess the expected number of SPADs at an ‘at risk’ site,
before and after the application of improvement measures.

© Human Reliability Associates

5
Rail Professional
September 2000

Using the MARS Model for getting at the Causes of

SPADs
Karen Wright & David Embrey

Human Reliability Associates Ltd

Introduction
In last month’s article, a new approach for incident investigation was outlined. This
used of a model of SPADs known as ‘Model for Assessing and Reducing SPADs’
or MARS. MARS consists of three stages through which a driver must progress when
responding to a signal: i.e. Detection, Decision and Response. Failure to successfully
progress through any one of these stages will result in a SPAD incident. Various
factors can affect a driver’s performance at these stages. These can range from
external factors such as ‘signal clarity’ to driver related factors such as ‘attention
focus’. The way in which these factors combine to impact upon the likelihood of
SPADs can be represented as an Influence Diagram

An Influence Diagram links the causal factors in a hierarchical manner to represent

their effects on the likelihood of failure in one or more of the stages in the MARS
Influence Diagram. The links from the factors directly influencing the likelihood of
failure (e.g. signal visibility, attention focus and alertness- see figure 2 in last month’s
article) at the top of the diagram, to more indirect factors at the bottom, represent
typical chains or pathways of accident causation that recur in many SPADs. This
hierarchical organisation makes the Influence Diagram ideal for providing a
consistent and systematic questioning structure for SPAD incident investigators. The
benefits of using Influence Diagram in SPAD incident investigation are as follows:

• Influence Diagrams allow multiple causes to be considered as contributors to

an incident.
• They provide a pre-defined structure for guiding incident investigators down
specified chains or pathways of causality to find fixable ‘root causes’.
• The use of this structure ensures that a consistent approach to investigation is
adopted, thus allowing frequently recurring (‘systemic’) causes to be identified
and addressed

The following case study illustrates the advantages of the approach.

Application of MARS to a SPAD Case Study

Prior to the SPAD, the driver of a High Speed Train was approaching a recently re-
signalled platform. There was heavy rain, but he was fresh and alert at this stage of
his shift. Due to the number of obstructions at the location, the signal was only
visible for 5 seconds on approach. However, the regular drivers on the route had not
complained about this feature of the signal. The branches of the trees near the signal

© Human Reliability Associates

6
head had grown and now partially covered the signal head so that it was obscured
until a train was close. The driver had been on the footplate for 3 years, primarily in
urban areas and had signed for this particular route six months previously. The details
of the signal changes in the area had only been available in an infrequently used
common room at his Depot. The driver said that he had not seen the signal at danger.

Questions from Influence Diagram

The first job of the incident investigator using MARS is to determine the stage in the
normal routine of approaching signals at danger where the driver failed to perform
correctly. This involves the use of a simple flow chart shown in Figure1.

Was Was Was

Start Detection NO
Interpretation
NO Response NO Update
analysis inadequate? inadequate? model
inadequate?

YES YES YES

Go to Go to Go to
Detection Interpretation Response
influence influence influence
diagram diagram diagram

Figure 1: Flow chart to determine the stages that failed

In this case study, the incident investigator would go to the Signal Detection Influence
Diagram, as the driver stated that he did not see (detect) the signal. Using the
structure of the Signal Detection Influence Diagram, a set of questions can be
generated. An example of these questions can be seen in Figure 2.

© Human Reliability Associates

7
 Alertness Questions
7. Was fatigue level an issue? Y/N
7.1 What was the quality of sleep like?

7.2 What was the time of shift?

7.3 What was the medical condition of the
driver?
7.4 Any other fatigue factors?
8. Any other alertness factors?

Figure 2: Example of question list generated from Influence Diagram

These questions are based on the factors contained within and the structure of the
Influence Diagram. Moving down the chain of influences from top to bottom, the
direct, surface causes can be traced back to the indirect or ‘root causes’. If the direct
level factor ‘alertness’ is implicated, then questions about potential causes of this
problem, e.g. ‘shift match policy’ and ‘level of fatigue’ are asked. If ‘level of fatigue’
is found to be a contributory factor, then questioning will carry on down this causal
pathway (see Figure 2 Questions 7.1 – 7.4). It should be noted that the questioning
structure is not completely rigid and there are many opportunities for new factors,
specific to the situation under consideration, to be incorporated. This feature of the
MARS investigation process means that new factors that affect SPAD likelihood, but
which were not present in the original model, can be incorporated as more incidents
are analysed. This means that incident investigation can provide information about
frequently recurring causes implicated in a number of incidents, rather than focussing
on each incident as a unique event, as is currently the case.

Identification of Root Causes

The answers from these questions can then be mapped on to the Influence Diagram
structure to help build up a graphical image of the causes of the incident. The text in
the speech bubbles in Figure 3 illustrates the type of evidence that is elicited as part of
the process. The factors that were not cited as causes in this incident have been
omitted from the diagram.

© Human Reliability Associates

8
 Signal not
detected
The weather visibility was
average,
Signal visibility Attention focus
and the signal was obstructed
from view

Knowledge
Signal clarity
Route exposure was limited, of signal
changes
and information distribution
was less than average

Weather Obstruc-
conditions tions

Information Degree of
distribution exposure to
policy route

Compliance with signal siting policy

Compliance
with signal Maintenance and maintenance policy both were
siting policy policy rated as poor

Figure 3: Graphical display of causal pathways for this incident

Using this process, insights into the combination of causes that led to the SPAD can
be generated. The driver was not fully aware of the exact new location of the signal.
The available information had not been passed to him directly and the lack of
exposure to the route since the changes contributed to his lack of knowledge about the
new signal location. Even if the driver had had his attention correctly directed at the
line side at this location, the inadequate visibility of the signal would have reduced the
likelihood of detection. The weather, positioning of the signal outside the normal 7-
second rule constraints and the overgrown foliage all contributed to the reduced signal
clarity. The combination of both the poor signal visibility and the inappropriate
attention focus of the driver gave rise to the SPAD.

Summary
MARS specifies a structured process for investigators to use during SPAD
investigations. As would be expected in any model of SPAD causation, these include
questions on infrastructure as well as factors relating to the driver. The structure of
the investigation process provided by the MARS Influence Diagram ensures that the
investigator considers the possibility of multiple causes at the outset. Although the
process considers causal factors relating to the driver, it does not make any initial
assumptions that inadequate driver performance is the most likely cause of the SPAD.
A pilot application of the approach to an incident investigation inquiry has indicated
that this give rise to a much more open attitude, which facilitates the identification of
the multiple causes usually involved in an incident. The existence of a clear causal
model behind the data collection system in MARS supports a systematic approach to
root cause analysis. Incident analysts already ask some of the questions specified by
MARS during the SPAD investigation process. However, these interviews are often

© Human Reliability Associates

9
unstructured with no guarantee of consistency of questioning between interviews or
interviewers.

Using a common MARS model of accident causation as a initial basis for all SPAD
incident analyses, means that a high level of consistency can be achieved. This in turn
allows underlying systemic patterns and trends in the factors giving rise to SPADs to
be observed and therefore tackled effectively in the long term.

© Human Reliability Associates

10