Developing the Whole System Risk Model

The railway is a very complex system. RSSB has developed tools for the industry to assess and target some hazards, but not all of them. Much of our risk analysis knowledge is based on the Safety Risk Model (SRM), now in version 9. One response to some identifiable hazards is to impose a blanket speed restriction. These can cover wide areas, and may themselves actually increase some types of risk.

Being able to identify specific parts of the network that may be susceptible to increased risk under certain environmental conditions can help. Building on the knowledge within the SRM, RSSB has, with Network Rail, started to develop the Whole System Risk Model (WSRM). Prompted by the Carmont incident, it’s a project that will take some time, but it has to start somewhere.

 03:00  About Marcus Dacre

03:30  Risk modelling work at RSSB

03:59  Modelling earthworks failures in the Precursor Indicator Model

05:12  RSSB’s involvement in responding to the RAIB recommendations to the Carmont incident

06:10  About the SRM

06:53  About Vincent Ganthy

07:34  Vincent’s focus on overall risk created by extreme rainfall events

09:00 Differences between the SRM and the WSRM

10:15 Establishing the level of network vulnerability

11:41  How the WSRM supports operational decision making

13:11  Current limitations and its potential for wider development

14:22  What we've found about the risk from speed restrictions

15:26  How to use the findings to respond to extreme rainfall events

16:11  Current testing and proving of the model

17:20  What’s next, the roadmap to extend the model

You may also be interested in:

How the Whole System Risk Model stops rail overcompensating for extreme weather events (RSSB web page 22 December 2022) https://www.rssb.co.uk/what-we-do/insights-and-news/blogs/how-the-whole-system-risk-model-stops-rail-overcompensating-for-extreme-weather-events 

Research project: Development of a system risk model for extreme rainfall events (T1269) https://www.rssb.co.uk/research-catalogue/CatalogueItem/T1269 

Safety Risk Model: Improving safety and reducing costs https://www.rssb.co.uk/safety-and-health/risk-and-safety-intelligence/safety-risk-model/safety-risk-model-improving-safety-and-reducing-costs 

Structures and Earthworks Rules Changes (RSSB web page 6 March 2021) https://www.rssb.co.uk/standards/using-standards/structures-and-earthworks-rules-changes 

Case Study: Risk from soil cutting failures (RSSB web page 24 November 2022) https://www.rssb.co.uk/what-we-do/key-industry-topics/data-insights/earthworks-data-insights/case-study-risk-from-soil-cutting-failures 

Any practices described in this podcast shall not be assumed to be risk free. The Rail Safety and Standards Board and other participants in this recording shall not be held liable for actions taken by third parties that lead to loss or injury. Any practices described should, specifically, not be followed in the United States of America or Canada.

Transcript

Ant 00:05

Blanket Speed restrictions are often put in place by Network Rail as a means to reduce the immediate likelihood of and risk from a possible derailment. They are usually imposed during extreme weather events; particularly extremely hot weather when rails may not stay in gauge; when there are very strong crosswinds on a route; and in situations where exceptionally heavy rainfall may affect the stability of an embankment or cutting that has been identified as being at high risk. Blanket speed restrictions may reduce the immediate risk to a train to be affected by a hazard but they also create additional knock-on risk. Trains running more slowly than usual across an area increase the number of signals approached at danger. Trains will be delayed or cancelled which. Increases the number of people waiting on station platforms and concourses, and trains stopped not at a station for long periods increase the likelihood of passengers choosing to leave the train and go onto the network. So, being able to identify sections of the network where there is an increased risk of encountering a hazard would reduce the extent of that knock-on risk by applying proportionate speed restrictions only in those sections.

Being able to identify those sections and set reasonable speed restrictions is a project that R S S B has been helping Network Rail to address. There are two interwoven strands to this. One is identifying those sections of the network at risk from a weather-related hazard. The other is to calculate the increase of knock-on risk that might be caused by the imposition of a speed restriction across the affected area. It was an extreme rainfall event that contributed to the tragic derailment at Carmont in August Twenty Twenty where two members of staff and a passenger lost their lives. Recommendation 10 in the RAIB report into the incident refers to Network Rails risk assessment analysis for implementing operational risk mitigation measures; specifically those relating to failures of earthworks and drainage, and describes them as not being optimal.

To support Network Rail’s response to that and other recommendations, R S S B is using its Safety Risk Model as a starting point to develop the Whole System Risk Model. Because it relates directly to the Carmont incident to the first phase of this wide-ranging project has concentrated on the impact of extreme rainfall events. So, to talk about the Safety Risk Model and the work that's been done to start to develop the Whole System Risk Model, I'm joined today by Marcus Dacre, our Professional Head of Risk and Safety Intelligence, and Vincent Ganthy, one of our lead system safety engineers.

Welcome both. Marcus if I can turn to you first would you please start by telling us how you came to your current position in the railway.

Marcus 03:00

Yeah, thanks Ant. I’ve been in the rail industry now for nearly twenty years, always working in a safety role and prior to that I worked in the aviation industry, modelling mid-air collision risk.

Ant 03:13

Okay, thank you Marcus. You're ultimately responsible for the railway’s Safety Management Intelligence System, or Smis, the Safety Risk Model, and the Precursor Indicator Model. So could you tell us more about Risk modelling at R S S B please?

Marcus 03:29

Yeah, so I head up R S S B’s risk and safety intelligence team and one of the ways in which we help our members solve their problems is through our well-established risk modelling capability. For example, you might remember how we applied that during the pandemic to understand Covid Nineteen transmission risk on trains; but really our bread and butter is modelling safety risk.

Ant 03:49

Ah, thank you very much. To bring it up to a sort of a contemporary issue, does this include the risk from earthwork failures?

Marcus 03:59

Yes, it does. And we've been modelling the national risk from earthworks failures for a long time. So our Precursor Indicator Model, or the PIM, tracks trends in train accident risk from over 50 different causes, including earthworks failures. We update it every 4 weeks and it shows us how much each of those causes is contributing to the overall risk and how that contribution’s changing over time. So the risk from earth works failures in particular has been a concern for a number of years and the PIM shows that it's one of the main contributors to train accident risk and it also shows a strong influence of weather, and particularly heavy rainfall, on the earthworks failures risk. So, the risk index tracked up during early Twenty Twenty when we had unusually high winter rainfall and again in the August of that year as it result of some very locally intense downpours during thunderstorms. And it was one of those events led to the tragic accident to Carmont, where debris washed from a drain onto the track and derailed a passenger train and 3 people lost their lives in that accident.

Ant 04:57

Very unfortunate, something that we all regret. I know we've done a lot of work to support Network Rail in understanding the risk from earthwork failures. So how did R S S B get involved in supporting the response to the Carmont incident?

Marcus 05:14

Yeah, so the Rail Accident Investigation Branch Report into the accident identified that industry should improve its processes for mitigating the risks associated with extreme weather. And at R S S B, as you say, we've been working closely with Network Rail and other member organizations to address some of the Carmont recommendations. So, an important operational mitigation is to slow trains when there's a forecast of heavy rainfall. But there is also a downside to slowing trains not only because of its impact on performance but also from a safety perspective. So we know that delays and disruption lead to an increased risk in a number of areas, from crowding at stations, to more signals approached at danger, to even a rise in assaults and abuse. So, previously we looked at the balance between the impact of different mitigations on both direct risk and this knock on risk to support decisions on what to do when a train radio fails. And we thought that a similar approach could help to identify the best operational response to adverse weather. And that risk was underpinned by our Safety Risk Model, which you mentioned at the start, which is a really key product. So, the Safety Risk Model provides a structured and quantified representation of the risk arising from the operation and maintenance of the G B mainline railway. It's got a very wide scope; it essentially covers everything that can harm anyone anywhere. Over the years the Safety Risk Model supported a lot of really big industry decisions, and it provided a good solid starting point to the work that Vincent's going to describe, that was specific to the Carmont response.

Ant 06:40

Marcus, thank you very much for that. I'd now like to move on to talk about the Whole System Risk Model. But before we do that Vincent, please could you tell our audience how you came to your current position in the railway?

Vincent 06:53

Thanks Ant. I joined R S S B and the risk and safety intelligence team about two years ago. My background is in technical safety and loss prevention in the oil and gas industry primarily, and renewable sectors as well.

After spending quite a number of years in consultancies I've decided to try and join the rail industry to bring some of the knowledge that I've acquired across my years in the energy sector and see what I could learn as well from the railway itself.

Ant 07:27

Thank you very much and welcome. So, we're talking about the Whole System Risk Model, what has been the focus of your work?

Vincent 07:34

Right, well following the Carmont accident that Marcus referred to previously and Network Rail extended the use of speed restrictions during severe rainfall events and those are applied across geographical areas of the network affected by the weather. And those speed restrictions are used to mitigate against increased risk of train accident due to asset failures. So as part of the research project we undertook, R S S B developed a system risk model to quantify that risk of derailment from soil cutting failures; as well as the safety risk created or increased in other parts of the system when implementing those operational mitigations. The goal was to support decision making by taking into account those local characteristics of the network affected by the extreme weather. We wanted to help address questions operational teams typically face when using blanket speed restrictions. So that is to say, for instance, what should be applied, when to use those measures, where do you apply them, and how long do you leave them on for.

Ant 08:47

That all sounds very interesting, thank you Vincent. Could you tell us then how does the Whole System Risk Model differ from the Safety Risk Model that Marcus introduced earlier?

Vincent 08:59

Sure, the Safety Risk Model estimates the underlying risk from the operation and maintenance of the mainline railway. It measures the frequency, that is often we expect something to occur, and the consequence, the expected level of harm if it does; and it combines these to estimate the risk. And the Safety Risk Model provides that residual level of risk per year. As a result you are looking at averages applying across that timescale and the scope of the operational decisions we are looking at with our System Risk Model is associated to much shorter term events which are associated to a temporary increase in the risks on the railway. So we needed to understand what direct effects those weather events might have on the railway assets. We also needed to understand the local vulnerability of the network, as blanket speed restrictions can be employed across small section of the railway, it could be as little as a few miles in length.

Ant 10:00

Very good. Getting down to that level of details obviously going to help us keep performance at the optimum levels. So how did R S S B manage to establish the level of network vulnerability?

Vincent 10:15

Well first we needed to understand how likely failures may be. And to do that the R S S B data insights team performed this statistical analysis to determine the probability of failure of individual soil cuttings and how that changes with varying severity of rainfall. So we used that relationship, and we combined it with detailed network characteristics, plus the Safety Risk Model, which includes established derailment modelling to generate local risk estimates. So that is really the risk of derailment itself. What is important to note, however, is that the focus is not on predicting asset failures here. The failures themselves do not systematically result in a direct threat to the safety of trains or the passengers. For those which do, however, the greater concern will be those susceptible to cause the most harm, and this is where the local properties of the network would have a strong impact. To give you an example, the potential consequence of a derailment would vary significantly with the speed at which trains may derail, or the frequency at which trains may circulate across that area. The ability for the model to consider those multiple dimensions affecting safety is a key enabler to derive the balanced operational responses to apply.

Ant 11:35

Thank you, Vincent. So how does the model actually support operational decision-making?

Vincent 11:41

Developing a means to estimate that immediate risk of development locally formed only one part of the equation that we're trying to solve here. We also adapted the modelling of knock on risk Marcus referred to earlier to assess the impact implementing speed restrictions may have on safety. That way we're able to have a more encompassing view of the safety of the network taking into account potential trade-offs in allowing more balanced decisions. Another key characteristic of the model is that we've designed it to easily compare alternatives. Operational situations are dynamic in nature, and we wanted to help the teams understand what happens when things change, and enable them to make those robust decisions. In practice that may be finding out what happens if the weather gets better or worse. You may be seeing how changing the speed restriction characteristics can influence the safety of the network, or even what happens if the weather extends across several sections of the railway rather under just a single one. We also wanted to allow model results to be used by personnel not having a detailed risk modelling expertise. To that end we designed outputs which are able to use the raw risk results and generate clear visual interpretations for the end users.

Ant 12:57

Thank you, Vincent. So you've talked about severe rainfall so far; can the model be used to help with other weather events? Are there limitations currently with regard to what the model can accommodate?

Vincent 13:11

So yes, there are. At the moment, the model can only assess the effect of convective rainfall events on soil cutting failures. Convective rainfall events correspond to those short duration, high intensity events; typically those experienced during the summer periods. So we decided to start with a relatively limited focus that was to demonstrate the viability of the approach on a manageable problem. However, we anticipated the potential to extend the modelling capabilities further. We have built the model to allow for easy future expansion to other types of railway assets and to all other weather events. We hope to do this through collaboration with the industry that could be by incorporating new knowledge, the Network Rail Weather Risk Taskforce is doing a lot of work in this area at the moment. But it also may be by developing new relationships to respond to other threats. You could think, for instance, about the extreme heat that we've experienced this summer and the impact this has on the railway as well.

Ant 14:11

Thank you, Vincent. So, you've mentioned that this has been part of one of R S SB's research and development projects; so what has R S S B found out so far?

Vincent 14:22

So, we've applied the model initially to multiple locations around the country to test the outputs out on a wide range of local characteristics. And we were able to confirm that the use of blanket speed restrictions could be justified on safety grounds. That is, of course we can demonstrate how the risk of derailment reduces by slowing trains down, but we can also find out how the knock-on risk can increase by doing so, and make sure that overall we're not reducing the overall safety on a network. However, we've also found that these circumstances just to find the use of those speed restrictions are strongly dependent on those local area characteristics as well as the actual severity of the rainfall event. Taking this further, we were able to conclude that applying the same identical restrictions across the whole of the network likely introduces a significant level of conservatism.

Ant 15:17

By conservativism I think you mean being over cautious. So what do your findings mean for the railway?

Vincent 15:26

Well, we've been able to provide the industry with a consistent data-driven approach to assessing the safety risks associated to extreme rainfall events. Using that model the industry should be able to develop tailored plans to respond to that threat. Local speed restrictions can be defined, proportionate to the asset’s local area of vulnerability to those particular events. In turn using the model should help reduce the level of safety risk to trains and passengers. Additionally, this should help improve train performance by not slowing trains down where it is negatively affecting the network safety.

Ant 16:04

Okay, so you've just used the phrase ‘the model should help’, is the model already in use?

Vincent 16:11

So, so far the model has been used experimentally and primarily to define the findings of the initial research project. Following its conclusion R S S B initiated the next step of the work. So we are aiming to successfully implement the model by developing a robust process to roll it out across the network. We have already started the first phase of offline testing with Network Rail’s Northwest and Central Region. We're taking the model application further by applying it to selected areas and reviewing the outputs with operational staff. This will ensure we can strike a sound trade-off between the support that the model can provide and a necessary local route knowledge. That way we can establish a clear scope to use the model to complement current operational processes. Once that's done, we aim to move on to an actual trial applied to a signalling centre. We would apply the model to the full extent of the control network and we would use the outputs to derive actual contingency plans to replace the current network-wide rules where appropriate.

Ant 17:14

This all sounds fascinating. So you've got the plans in place, what are the next steps?

Vincent 17:20

So we now have the functional System Risk Model. It is a building block, a starting point towards a wider risk-based framework for decision-making. We are currently developing a road map for the further development of the model hoping to enhance, and benefit from collaboration with other stakeholders, and focus on the industry priorities. As I mentioned earlier that includes plans to expand the model to other asset types or other weather events to further support the operational environment. However, there may be opportunities to expand beyond that and into longer-term decision support that could be helping the industry define investment priorities which in turn could improve the operational safety and performance of the railway. Also the industry has developed already a range of tools addressing various needs for the industry. We are hoping to integrate, or be able to interface with, those where this could improve consistency and confidence in a generated output.

Ant 18:19

Vincent, thank you very much for giving us a brief insight into that. So where can people find more information?

Vincent 18:25

Well, all the outcomes from the initial research projects are now published on the R S S B research catalogue. Just look for project T one two six nine and you'll find everything we've published so far.

Ant 18:39

Vincent, thank you very much, and thank you Marcus both for giving us an introduction to the Safety Risk Model and to the new System Risk Model, that obviously has the potential for great benefits for the network and running the operational railway in future. To our listeners I would say as always thank you for listening and until the next time stay well and stay safe.