Exploring an accident

The Fox Grover River accident – a case study

Group 10
Chen Yen Chou 4900278
Ting Wei Wu 4709748
Annemijn Hijner 4389964
Rogier Simons 4732839

Introduction
In this report the Fox River Grove accident of October 25th, 1995, will be analysed using
several methods from the transport safety sciences. In part 1 the accident is evaluated using
the Hazard-Barrier-Target analysis, in part 2 the evaluation is done using the accident-
deviation model. In part 3, the barriers and deviations are mapped onto the safety envelope
and the failure functions of the barriers are discussed. Lastly a short conclusion is given where
the key failures of barriers that contributed to the accident are determined.

Part 1: Hazard-Barrier-Target analysis

This section presents the Hazard-Barrier-Target (HBT) analysis for the Fox River Grove
accident. We firstly define all potential hazards and targets in the normal system, shown in
Table 1. Then the relevant hazards and targets are determined for this case. Finally, all
barriers and their characteristics are described in Table 2.

Potential hazards and targets in the train traffic system

All potential hazards and targets in the rail-traffic crossing system are presented in Table 1.
The trains are a hazard at a road/rail crossing as it is possible for them to collide with a target.
The cars/buses/trucks are also a hazard as they can collide with each other, or one of the other
targets as is always possible on a road. The crossing gate has proven to be a hazard as well, as
the Fox River Grove accident report shows that while coming down, it had struck several
vehicles on previous occasions. The utility pole (to which the lights and crossing gate are
attached) is a hazard as well, as cars and other vehicles can collide with it.

Pedestrians are almost always a target on a road, as they are a vulnerable group that are in
danger of being hit by cars and trains at a railroad crossing. Cars/buses/trucks are also a target
as they can be hit by a train at a railroad crossing. Alternatively, the train is also a target,
considering it can also sustain damage or even derail when a collision with a car occurs. The
crossing gate is a target as well, as the report shows that it had been hit and destroyed by
drivers on multiple occasions.

1
Table 1: All potential hazards and targets

Hazard Trains Cars/buses/trucks Crossing gate Utility Pole

Target Pedestrians Cars/buses/trucks Trains Crossing gate

Hazards and targets in the case study

The hazards and targets corresponding to the case study are trains and cars/trucks/buses,
respectively.

We chose cars/trucks/buses as the target according for the further analysis, as the bus involved
in the accident, clearly sustained the most damage. The train could also be considered a target,
as it also sustained damage in the accident. However, the damage to the train was very
limited, and no one on the train was physically hurt, and so it will only be considered to be a
hazard, for this report, as it inflicted so much damage onto the bus.

The crossing gate, utility pole and pedestrians seemed not to have played a role in the accident
at all and are thus deemed irrelevant and will not be discussed further.

Barriers
The following table describes all barriers between the target (cars/trucks/buses) and the
hazard (train), and their characteristics.

Table 2: Barrier characteristics between trains (hazard) and cars/trucks/buses (target)

Function Location Types Description

Equipment barrier: Wheel Flange to prevent trains from
On hazard
derailment, in case of e.g. a train going too fast.
Warning device: Flashing light and warning sounds before a train
Between crosses the road to warn the drivers that a train is coming.
hazard and
target Physical barrier: Crossing gate is lower to stop cars from moving
onto the crossing before a train crosses the road.
Separation Physical separation: Stop line to indicate the area where the cars
Prevent through space can stop safely in case of a train crossing.
Knowledge: Apply “Stop, Look and Listen" policy, which creates
awareness of the danger of crossing a railroad, and ensures the
driver checked whether a train was already visibly or audibly
approaching.
On target
Knowledge: The knowledge of the driver that they should not
stand on a railroad crossing as well as their spatial awareness of
the location of their vehicle with respect to the railroad crossing.

2
 Warning device: Train horn activation when the driver discovers
an object on the railroad.
On hazard
Equipment: Train brakes to slow down the train once the driver
observes an object on the railroad, to try to stop the train in time,
to prevent a collision from occurring.
Warning device: If a car is not in a safe area, the crossing gate
Between coming down will knock on the car, producing noise, this should
hazard and warn the driver the car is not in a safe area. This is an
target unintentional side-effect of the physical barrier purpose of the
crossing gate.
Protect Equipment: Rear View Mirror, for the driver to see whether the
car is in a safe position or not.

Equipment: The car brake, in case a car is speeding towards the

crossing while a train is passing, the driver braking, should
protect them from entering the crossing and colliding with the
On target
train.

Supervision: Passengers can often see different things than the

driver and can give warnings to the driver if a train is approaching
and the car is not in a safe area, if the passenger notices but the
driver doesn’t.
Equipment barrier: Train Brake system is used to slow the speed
On hazard
before and during collision.
Equipment barrier: Car frame and its crush zone, will absorb
some of the energy of a collision, and thus lessens some of the
injuries of passengers of the vehicle.

Equipment barrier: Wheel flange to prevent the train from

Mitigate
derailing after a collision, limiting further damage.
On target
Equipment barrier: Airbag in the car provides a buffer, reducing
injuries.

Equipment barrier: Seatbelt which limits the injury to the

passenger wearing it.

3
Part 2: Accident-deviation model
This section analyses the Fox River Grove accident using the accident-deviation model. This
model describes certain phases in an accident, as well as interventions, which can stop a
situation from developing into an accident. Deviations from the normal situation, play an
essential role in the progress of a normal situation to an accident occurring. Many deviations
played a role in the Fox River Grove accident, these will be discussed first. Afterward the
different phases as defined by the accident-deviation model will be discussed, namely the
‘choice and design of the system’, ‘normal situation with inbuilt hazards’, ‘deviation from
normal situation’, ‘loss of control’, ‘transmission’, ‘damage process’ and lastly ‘stabilization’.
Some of these phases are clearly distinguishable in the moments before, during or after the
Fox River Grove accident, and some are not. They will, however, all be discussed.

Deviations in the normal process

Multiple deviations from the normal situation contributed to the occurrence of the accident.
One of these was in progress for a longer time before the accident, namely the connection
between the railway crossing warning system and the highway signal system of the road
intersection right next to the railway crossing. After the railway crossing warning system was
activated, the light of the highway signal system was green for a period of time that was
deemed to be too short for the cars to clear the area near the railway crossing. There had been
complaints about this, at the time of the accident an investigation into the issue was being
conducted and as such, the issue was not yet resolved. So, the discrepancy between the two
signalling systems was a deviation from how the system should have operated normally.

Furthermore, several deviations happened concerning the bus driver.

First of all, both the regular bus driver as the regular substitute bus driver were unable to drive
that route, thus the bus driver who was driving the route on the day of the accident had no
experience on this particular route and even requested a student to guide her where necessary.
As there was no procedure where drivers shared information about the peculiarities of their
routes, she did not know that it was custom to stop before the railway crossing and wait until
the light of the highway signalling system turned green. The other two bus drivers would have
known to do this from their experience, thus preventing the bus from stopping on the crossing
at all. Thus, this lack of knowledge on the driver’s part was a deviation from the normal
situation.

Secondly, whilst waiting for the traffic light, the driver did not notice both the visual and
audible warnings of the crossing as the horn signal of the train. This could have been due to
the noise of the children in the bus, and the fact that the AM/FM radio and dispatcher both
were turned on at the time of impact. However, the report indicates the noise-level was not
out of the ordinary, and several children reported having heard the crossing signals. Thus, the
question remains whether the surrounding noise in the bus made the bus driver unable to hear

4
the warning signals. This inability to hear the warning signals, for any reason, could be
considered a deviation, as in the normal situation the warning signals should be audible.

And lastly, the children in the back of the bus did notice the train coming and tried to warn the
driver. However, at first the children were joking about the train, this only changed later to
serious warnings. The driver did not grasp the message of the children. The passenger
assisting the bus driver on the route said he became aware of the others on the bus yelling
about the train coming only right before the impact. The fact that the bus driver did not react
to the warning of the children in time can be considered a deviation from a normal situation,
as normally a driver should respond to such warnings.

Phases of the accident-deviation model

Firstly the ‘choice and design of the system’ could be considered to simply be the
environment. The design of the road, the railroad tracks and the crossing would fall under
this, as they are the design of the environment, including the short distance between the
crossing and the traffic lights. The bus route defined by the school falls under this phase as
well, as it is the predefined route as chosen by the school.

The bus was actually driving the route that day can be considered to be the ‘normal situation
with inbuilt hazards’, the hazards that are inbuilt in this situation are those that are always
present when driving, for example, a flat tire or a collision with another car.

The next phase, ‘deviation from the normal situation’, includes several different elements.
These will be discussed elaborately in the next section.

The ‘loss of control’ phase is perhaps the most difficult phase to define for the Fox River
Grove accident as the driver at no point was aware of the dangerous situation. Had she been
aware moments before the ‘transmission’ phase occurred, she might have been able to remain
in control and avoid the collision by driving forward. So, the fact that the driver was unable to
access the information provided to her, leading to her inability to avoid the collision, could be
considered to be the ‘loss of control’. Additionally, the inability of the train engineer to brake
in time, could be considered the ‘loss of control’ as well.

The impact of the train and school bus can be considered the ‘transmission’ phase, as that was
the moment the kinetic energy from the train was imposed upon the school bus. The ‘damage
process’ immediately follows this phase, while the passengers on the bus being thrown around
the bus. Some of the passengers were ejected from the bus. Furthermore, the chassis of the
bus was separated from the body. The train stopped hundreds of meters beyond the accident
site, but neither the passengers nor the engineer were harmed.

The ‘stabilisation’ phase is the last one. The police chief observed the accident whilst waiting
at the intersection. He immediately called for assistance. The train engineer also called in the
accident to his dispatcher, and numerous citizens called the emergency number as well.

5
The fire station was located extremely close to the site of the accident, they distributed an
ambulance, a fire engine, two paramedics and four emergency medical technicians within
minutes of the collision. The assistant fire chief, who acted as incident commander, initially
enacted a level 3 emergency plan, which means he requested the chief officer and 9
ambulances. He later extended this to a level 5 plan, which means he requested the chief
officer and 15 ambulances, after the extent of the accident became clear to him.

In total, 20 ambulances and two helicopters responded to the accident. The local hospital
enacted its disaster plan, sending out two doctors to the scene. Numerous officers and firemen
responded to the accident to help with the accident investigation and traffic control.

What actions were taken to stabilise the train-traffic is unclear.

Within 90 minutes all seriously injured passengers of the bus were transported to hospitals. It
is unclear how long it took for the traffic and train traffic to resume regularly.

6
Part 3: Safe envelope
In this section we give a short overview of the barriers from section 1 that failed and
contributed to the occurrence of the accident. Then the failed barriers will be mapped onto the
different regions of the safe envelope, which also correspond to the different phases as
discussed in section 2.

Failed barriers
Many of the barriers relevant for the railroad crossing, which are mentioned in part 1, failed in
some way. They are stated below in a condensed list.

 There was a failure in the knowledge distribution to the driver, who was not informed
of the lack of space between the railway crossing and the highway signalling system,
and thus did not know to wait before the railway crossing for the traffic light to turn
green.
 The railway crossing signalling system (the noise, lights and gate lowering) were
successfully activated, but they failed to alert the bus driver of the approaching train.
 The separation through space failed, as the bus was still on the tracks.
 The train horn did not successfully alert the driver to the danger.
 The emergency train brake was successfully activated, but it was not done quick
enough to brake in time, and thus it failed partially (it did still slow down the train to
lessen the extent of the damage).
 The driver did not pay attention to her surroundings and did not notice any signs of the
warning system in her rear-view mirror or the warnings of the children.
 There were no airbags and not enough seatbelts to mitigate the damage of passengers
sufficiently. The driver’s seatbelt, however, might have protected her from further
injury and thus this barrier was only partly effective.
 The frame of the bus was not sturdy enough to protect its passengers sufficiently. The
frame might have protected some of the passengers from worse injury, and it was thus
partly effective.

Failing barriers with respect to the safe envelope

All the barriers that failed can be divided in causing the situation to develop from one state of
the safe envelope to the next, these states are also related to the states as mentioned in part 2.
Below are the barriers per phase change. With each barrier comes a description what function
made the barrier fail, and what element (human and/or technology) should have fulfilled this
function. The colours mentioned behind the indication of the change on the safety
envelope/the phase change, indicate the colour of the arrow on the safety envelope, as seen in
Figure 1.

7
From accepted system state to controllable system state (from the normal situation to
deviation) [orange arrow]:
 The knowledge of driver about the route was lacking, she didn’t know to wait for the
green light before crossing the railway. This barrier failed due to a lack of
communication between the regular driver and the actual driver about the peculiarities
of the route. This is considered a human factor.
 The separation through space failed, as there was not enough room between the
highway signalling system and railroad crossing for the bus to stop. It would have
been more appropriate if there was more space available, this can be considered a
technological failure, as it was the layout of the road that should have been different.

From controllable system state to undamaged system state (from deviation to loss of control)
[green arrow]:
 The bus driver did not notice the railway warning system, either the noise or the
flashing light. This could be caused by an inability of the driver to hear the signals
over the noise of the children and radio, but considering the noise level in the bus was
said to be normal this failure can instead be contributed to the driver not paying
enough attention, as well as the railway signalling system not being loud enough. This
failure is thus considered both a human and a technological failure.
 The driver did not notice the train horn. The failure mode of this barrier is similar to
the last and can thus be attributed to both the driver not paying enough attention to her
surroundings and the train horn not being loud enough, making it both a technological
and a human failure.
 The driver did not notice or heed the warnings from the children. The children can be
considered observers and noticed that the train was going to collide with the bus,
whereas the driver did not. They tried to tell her this, but the driver either did not listen
(she might have considered them jokes as the children were making jokes about the
subject just moments earlier) or did not hear them. So, either the children should have
been clearer, or the driver should have paid more attention, or the driver should have
taken the children more serious. In each case, it is a human failure.
 The driver did not hear or see the gate hit the bus when the gate came down. Similar to
the failure of the driver noticing the railway signalling system or the train horn, this
can be considered both a human failure as the driver failed to pay enough attention to
notice the incident, and a technological failure as the gate was not obvious enough to
be seen.
 The train was not able to brake in time to avoid hitting the bus. This can be considered
a human and a technological failure. If the train driver had used the brake earlier, the
train could have slowed down more. However, even if the driver would have braked
immediately and as strongly as possible, upon seeing the bus, it is extremely unlikely
the train would have stopped in time. If the brake had been stronger, it might have
stopped successfully and thus this failure is mostly considered a technological factor.

8
From undamaged to damaged system state (from loss of control to transmission) [blue
arrow]:
 As mentioned before, because the train was not able to brake in time, and the bus was
still on the railway crossing without being able to drive away, the barrier of separation
of space failed. High amounts of energy were transmitted from the train to the bus.

Mitigation [yellow arrow]:

 There were no airbags in the bus, even though it could have been possible to install
them in the bus. School buses and public transport buses still do not usually have
airbags (for the passenger). If airbags had been present in the bus, this could have
diminished the injuries. It can be considered a technological failure, as it was the
absence of the airbags in the designs, who caused the failure of this barrier.
 There were only seatbelts available to the bus driver and for the seats right next to the
driver, where no one was sitting. If seatbelts had been available everywhere in the bus,
this could have diminished the injuries. As the seatbelt was worn by the driver,
diminishing her injuries, this barrier failed only partially. It is considered a
technological failure, for the same reason as for the case with the airbags.
 The frame of the bus and its ability to be compressed could have diminished the
injuries, by absorbing some of the energy of the collision with the train. It probably
did absorb some of the energy and might have diminished some of the injuries, but did
not completely protect the passengers, and therefore it failed partially. It is considered
a technological failure, as its design could have been different so that it could have
absorbed more energy.

Figure 1: The four phase changes on the safe envelope

9
Conclusion
We have determined three key barriers whose failure, in our opinion, contributed the most to
progress of the situation into an accident.
The first major contribution to the accident was the design of the intersection. The fact that
there was not enough space between the railroad crossing and the traffic light for a school bus,
and that this was not clearly indicated. This corresponds to the failure of the barrier of spatial
separation.
The other factor that, in our opinion, played a large part in causing the accident was the lack
of communication between the regular bus drivers, and the extra substitute bus driver. If this
communication had taken place, or if there was a systemic way within the organization of the
bus operators to indicate problems specific to their route, the accident might not have
happened. This failure corresponds to the barrier of knowledge of the driver, who is aware of
the dangers of railroad crossing and their spatial awareness with respect to the vehicle and the
railroad crossing.
The last key barrier failure, in our opinion, is the barrier of the railroad cross signalling
system, thus the lights and the sounds. This was the first indication of the train approaching,
and the driver should have seen and heard these warnings, but did not.

10