Having had the privilege of working with a railroad this year, I have learned a lot about how “safety” functions in an industry sector I knew absolutely nothing about. But in this time, I have come to really like the Federal Railroad Administration’s (FRA) approach to managing safety across this industry. The FRA had to pass a rule to meet a mandate from the Rail Safety Improvement Act of 2008 (RSIA) and they took a playbook from OSHA/EPA process safety standards. The final rule requires the nation’s largest freight railroads, known as Class I, to each DEVELOP and IMPLEMENT an FRA-approved Risk Reduction Plan (RRP). These comprehensive, system-oriented safety plans are required to identify and analyze hazards and their associated risks and develop and implement plans to eliminate or mitigate those risks. An RRP is designed to improve operational safety, complementing a railroad’s adherence to all other applicable FRA regulations. Each railroad must tailor an RRP for its individual operations, and the RRP must reflect the substantive facts on any hazards associated with each railroads’ operations.
An RRP is implemented by a written risk reduction program plan (RRP plan). The RRP rule sets forth various elements that a railroad’s RRP plan must contain to properly implement an RRP. As part of its RRP plan, a railroad must also describe the various procedures and processes for implementing this rule’s requirements. This includes procedures and processes for, but not limited to, the following RRP components:
- Risk-based hazard management program;
- safety performance evaluation;
- safety outreach;
- technology implementation plan;
- RRP employee/contractor training;
- railroad employee involvement; and
- internal assessment
The main components of an RRP are:
- the risk-based hazard management program and
- risk-based hazard analysis
A properly implemented risk-based hazard management program and risk-based hazard analysis will
- identify the hazards and resulting risks on the railroad’s system,
- develop methods to mitigate or eliminate (if practicable) these hazards and risks, and
- set forth a plan to implement these methods.
As part of its RRP, a railroad will also consider various technologies that may mitigate or eliminate the identified hazards and risks.
An RRP will affect almost all facets of a railroad’s operations. To ensure all railroad employees an RRP directly affects have an opportunity to provide input on the development, implementation, and evaluation of a railroad’s RRP, the rule requires railroads to consult in good faith, and use their best efforts to reach an agreement with, such employees on the RRP plan contents and any substantive amendments to the plan. Appendix A to the rule contains guidance on what constitutes good faith and best efforts.
An RRP can be successful only if a railroad engages in a systematic assessment of the hazards and resulting risks on its system.
Within 90 days of receipt of a railroad’s RRP plan, FRA will review the plan and determine if it meets the requirements of the rule. If FRA determines the railroad’s RRP plan does not comply with the rule, FRA will notify the railroad of how the plan is deficient. The railroad will then have 90 days to correct the deficiencies and resubmit the plan to FRA. Whenever a railroad amends its RRP plan, it must submit the amended plan to FRA for approval and provide a cover letter describing the amendments. (FRA approval is not required for amendments limited to adding or changing a name, title, address, or telephone number of a person, although a railroad must still file the amendment with FRA.) A similar approval process and timeline will apply whenever a railroad substantively amends its RRP.
Risk reduction is a COMPREHENSIVE, SYSTEM-ORIENTED APPROACH to improving safety by which an organization FORMALLY IDENTIFIES and ANALYZES applicable hazards and takes action to mitigate, if not eliminate, the risks associated with those hazards. It provides a railroad with a set of DECISION-MAKING PROCESSES AND PROCEDURES that can help it plan, organize, direct, and control its railroad operations in a way that enhances safety and promotes compliance with regulatory standards. As such, risk reduction is a form of SAFETY MANAGEMENT SYSTEM, which is a term generally referring to a comprehensive, process-oriented approach to managing safety throughout an organization.
The principles and processes of risk reduction are based on safety management systems (SMS) developed to assure high safety performance in various industries, including aviation, passenger railroads, the nuclear industry, and other industries with the potential for catastrophic accidents. SMS methodologies have evolved through experience to include a multitude of equally important elements without which the organization’s safety performance does not reliably improve.
These SMS elements are typically grouped into the following larger descriptive categories:
- An organization-wide safety policy;
- formal methods for identifying hazards and prioritizing and mitigating risks associated with those hazards;
- data collection, data analysis, and evaluation processes to determine the effectiveness of mitigation strategies and to identify emerging hazards; and
- outreach, education, and promotion of an improved safety culture within the organization
This rule even has a “contractor safety” element… the final rule’s language clarifies that the person must be utilizing the railroad’s significant safety-related services to conduct railroad operations. For example, if a railroad contracts with a company to perform bridge maintenance, that company provides a significant safety-related service to the railroad on behalf of the railroad. If during the bridge maintenance the company uses the railroad’s roadway worker protection, that company is then also utilizing a significant safety-related service (roadway worker protection) provided by the railroad.
Risk-Based Hazard Management Program (HMP)
271.103 requires a railroad’s RRP to include a risk-based HMP that PROACTIVELY IDENTIFIES HAZARDS and MITIGATES THE RISKS ASSOCIATED WITH THOSE HAZARDS. A risk-based HMP must be
- integrated,
- system-wide, and
- ongoing
The scope of a risk-based HMP would be scalable based upon the size and extent of the railroad’s system. The risk-based HMP must be fully implemented (i.e., activities initiated) within 36 months after FRA approves a railroad’s RRP plan. Full implementation means that a railroad will have completed its risk analysis and begun mitigation strategies within 36 months of plan approval.
A railroad must conduct a RISK-BASED HAZARD ANALYSIS as part of its risk-based HMP. The types of principles and processes that inform a successful risk-based hazard analysis have already been well-established by programs, such as MIL-STD-882, APTA’s “Manual for the Development of System Safety Program Plans for Commuter Railroads”, and FRA’s “Collision Hazard Analysis Guide.” A railroad subject to a final RRP rule could use any of these programs for guidance on how to conduct a risk-based hazard analysis, pursuant to FRA’s approval of the processes in the railroad’s RRP plan under proposed § 271.211.
As described in the “Collision Hazard Analysis Guide,” a risk-based hazard analysis is performed to identify hazardous conditions for the purpose of mitigation and could include several analysis techniques applied throughout the lifetime of an RRP. A full hazard analysis could consist of various analyses, including a
- Preliminary Hazard Analysis,
- Failure Modes and Effects Analysis,
- Operating Hazard Analysis, and
- others,
although existing operations already designed, built, and operating may not require all these analyses.
At a minimum, a RISK-BASED HAZARD ANALYSIS must address the following components of a railroad’s system:
- Infrastructure;
- equipment;
- employee levels and work schedules;
- operating rules and practices;
- management structure;
- employee training; and
- other areas impacting railroad safety that are not covered by railroad safety laws or regulations or other Federal laws or regulations.
While the RSIA directed railroads to address safety culture in their risk-based hazard analyses, FRA chose not to be prescriptive regarding this requirement, as prescribing how risk-based hazard analysis would identify hazards generated by a safety culture would be difficult. FRA would require railroads to measure their safety culture, however, in proposed § 271.105(a), and believes that this proposed approach would adequately address any related safety concerns presented by a railroad’s safety culture. With respect to measuring safety culture, the proposed rule would permit railroads to identify the safety culture measurements methods that they find most effective and appropriate to their local conditions. When measuring safety culture, FRA would expect a railroad to use a method that was capable of correlating a railroad’s safety culture with actual safety outcomes. For example, such measurement methods could include surveys that assess safety culture using validated scales, or some other method or measurement that accurately identifies aspects of the railroad’s safety culture that correlate to safety outcomes. Ultimately, FRA would expect a railroad to demonstrate that improvements in the measured aspects of safety culture would reliably lead to reductions in accidents, injuries, and fatalities.
A risk-based hazard analysis must identify hazards by analyzing the following:
- Various aspects of the railroad’s system (including any operational changes, system extensions, or system modifications); and
- accidents/incidents, injuries, fatalities, and other known indicators of hazards (such as data compiled from a close call reporting program).
A railroad must then calculate risk by determining and analyzing the likelihood and severity of potential events associated with the identified hazards.
These risks must then be compared and prioritized for the purpose of mitigation.
Paragraph (c)(1) would require a railroad, based on its risk-based HMP, to design and implement mitigation strategies that improve safety by mitigating or eliminating aspects of a railroad’s system that increase risks identified in the risk-based hazard analysis and enhancing aspects of a railroad’s system that decrease risks identified in the risk-based hazard analysis. FRA anticipates that railroads will design and implement mitigation strategies that are either cost-beneficial or cost-neutral. FRA requests public comment on this assumption. FRA is specifically interested in the experience of any railroads that may have already utilized risk reduction strategies, and whether or not such railroads have realized cost benefits from the design and implementation of risk mitigation strategies. In railroads’ experiences, how much have mitigation strategies related to risk reduction activities cost?
Additionally, the proposed regulation does not define a level of risk that railroads must target with their risk-based HMPs. FRA’s Passenger Equipment Safety Standards require passenger railroads, however, when procuring new passenger cars and locomotives, to ensure that fire safety considerations and features in the design of the equipment reduce the risk of personal injury caused by fire to an acceptable level using a formal safety methodology such as MIL-STD-882.
Section 271.105—Safety Performance Evaluation
This section would contain requirements for safety performance evaluations. Safety performance evaluation is a necessary part of a railroad’s RRP because it determines whether the RRP is effectively reducing risk. It also monitors the railroad’s system to identify emerging or new risks. In this sense, it is essential for ensuring that a railroad’s RRP is an ONGOING PROCESS, AND NOT MERELY A ONE-TIME EXERCISE.
The FRA will require a railroad to develop and maintain ongoing processes and systems for evaluating the safety performance of a railroad’s system. A railroad must also develop and maintain processes and systems for measuring its SAFETY CULTURE. For example, a railroad could measure its safety culture by surveying employees and management to establish an initial baseline safety culture, and then comparing that initial baseline to subsequent surveys. FRA would give a railroad substantial flexibility, however, to decide which safety culture measurement was the best fit for the organization. FRA’s primary concern would be that the selected measurement would provide a way to demonstrate that an improvement in the safety culture measurement would reliably lead to a corresponding improvement in safety. Overall, a safety performance evaluation would consist of both
- a safety monitoring and
- a safety assessment component
The rule would establish the safety monitoring component by requiring a railroad to monitor the safety performance of its system. At a minimum, a railroad must do so by establishing processes and systems for acquiring safety data and information from the following sources:
- Continuous monitoring of operational processes and systems (including any operational changes, system extensions, or system modifications);
- periodic monitoring of the operational environment to detect changes that may generate new hazards;
- investigations of accidents/incidents, injuries, fatalities, and other known indicators of hazards;
- investigations of reports regarding potential non-compliance with Federal railroad safety laws or regulations, railroad operating rules and practices, or mitigation strategies established by the railroad; and
- a reporting system through which employees can report safety concerns (including, but not limited to, hazards, issues, occurrences, and incidents) and propose safety solutions and improvements.
The requirement for a reporting system would not require a railroad to establish an extensive program like FRA’s Confidential Close Call Reporting System (C3RS). Rather, a railroad would have substantial flexibility to design a reporting system best suited to its own organization (or, if a railroad already has some sort of reporting system, to modify it to meet the needs of the railroad’s RRP). For example, a railroad could decide whether or not it wanted its reporting system to be confidential or non-punitive. Or, in the alternative, the reporting system could be something as simple as a suggestion box made available to employees.
Paragraph (c) would establish the safety assessment component, the purpose of which is to assess the need for changes to a railroad’s mitigation strategies or overall RRP. To do so, a railroad must ESTABLISH PROCESSES to analyze the data and information collected pursuant to the safety monitoring component of this section, as well as any other relevant data regarding the railroad’s operations, products, and services.
At a minimum, this safety assessment must:
- Evaluate the overall effectiveness of the railroad’s RRP in reducing the number and rates of railroad accidents/incidents, injuries, and fatalities;
- evaluate the effectiveness of the railroad’s RRP in meeting the goals described in its RRP plan pursuant to proposed § 271.203(c);
- evaluate the effectiveness of risk mitigations in reducing the risk associated with an identified hazard (any hazards associated with ineffective mitigation strategies would be required to be reevaluated through the railroad’s risk-based HMP); and
- identify new, potential, or previously unknown hazards, which shall then be evaluated by the railroad’s risk-based HMP.
RISK-BASED HAZARD MANAGEMENT PROGRAM (risk-based HMP)
The primary component of an RRP would be an ongoing RISK-BASED HAZARD MANAGEMENT PROGRAM (risk-based HMP), supported by a risk-based hazard analysis. A properly implemented risk-based HMP would
- IDENTIFY HAZARDS and the associated risks on the railroad’s system,
- COMPARE AND PRIORITIZE the identified risks for mitigation purposes, and
- DEVELOP MITIGATION STRATEGIES to address the risks.
An RRP would also be required to contain the following additional components:
- a safety performance evaluation;
- a safety outreach component; and
- a technology analysis and technology implementation plan (which would consider various technologies that may mitigate or eliminate identified hazards and the associated risks).
A railroad would also be required to provide RRP training to employees who have significant responsibility for implementing and supporting the railroad’s RRP.
Implementation of an RRP would be supported by a WRITTEN RISK REDUCTION PROGRAM PLAN (RRP plan) describing the railroad’s processes and procedures for implementing the requirements for an RRP. An RRP plan would not be required to contain the results of a railroad’s risk-based hazard analysis or to describe specific mitigation strategies. An RRP plan would also be required to contain certain elements that support the development of an RRP, such as
- a policy statement,
- a statement of the railroad’s RRP goals,
- a description of the railroad’s system, and
- an RRP implementation plan
An RRP could affect almost all facets of a railroad’s operations. To ensure that all employees directly affected by an RRP have an opportunity to provide input on the development, implementation, and evaluation of a railroad’s RRP, a railroad would be required to consult in good faith and use its best efforts to reach an agreement with all of its directly affected employees on the contents of the RRP plan and any amendments to the plan.