Background

Between 1993 and 1996, the former vertically integrated British Rail (BR) organization was split into more than 100 parts and sold, privatized or franchised. Much has been said about the separation of management of the track from that of trains and about the privatization of infrastructure ownership, but the restructuring went well beyond just that. Following the recommendations of consultants, the British government split BR into over 100 legally separate parts. It is that fragmentation and the manner of certain parts of it, that in combination with severe historic under-investment has led to some problems for the UK railway system and not, in my opinion, privatization itself or the organizational separation of track and trains. The process has also produced some notable and often unrecognized successes. Amongst them is a significant underlying improvement in key safety performance indicators, achieved despite radical structural change and a public and media perception, conditioned by a few highly reported accidents, that safety has worsened.

Introduction

The separation of the management of railway infrastructure and train operations in European Member states is a legal requirement under EU Directive 91/440/EEC, which became law in 1991. The requirement is for separation at least to a level where infrastructure costs are sufficiently transparent to allow the fair costing of access by other operators. Separate ownership is not required but the British government decided to go well beyond the minimum requirements. The architects of UK rail privatization had another objective—to reduce the cost to the State of managing a declining industry. Whilst there was talk about innovation potentially bringing growth, few believed this would happen. In the later days of BR, there had been some notable successes. The ‘Business Sector’ or ‘Organization for Quality’ reorganization had delivered some good results, particularly in the InterCity area. But overall, BR had been in an underlying decline for many years; there had been short-term upswings associated with the economic cycle, but the long term trend was clearly down. Little thought was given in the privatization process to the management of innovation or growth or to how the hundreds of new interfaces would affect such matters.
Under BR, trains, signalling, electrification, etc., were usually designed or heavily influenced by the Railway Technical Centre at Derby (sometimes working with other BR departments) who also took responsibility for putting things right when they did not work as planned. For instance, rolling stock was often developed in service with design deficiencies corrected at BR's cost. The train manufacturing facilities, which had been sold to the private sector in an earlier exercise, were essentially ‘build-to-print’ organizations. The management of systems that crossed interfaces between track and trains, or between companies, had never been a significant issue because responsibility for the limited number that existed fell to individual BR functional departments with responsibilities also spanning the interfaces.
The problem was compounded because the underlying complexity of railways has been growing. The introduction of three-phase-motor electric traction, with on-board power conversion, coupled with the roll-out of the computer-based interlockings pioneered by BR in the early 1980s was increasingly making the technical interfaces more complex and harder to analyse when incremental changes were made. Easy-to-change but hard-to-reliably predict computer-based systems driven by software were making the safety validation of these systems an increasing issue too.
Additionally, as a vertically integrated organization, BR had relied heavily on local knowledge and the apprenticeship of staff who learned on the job from colleagues; there were few formal systems of the type needed to support a fragmented structure. Those who crafted the shape of, and rules for, the privatization were primarily lawyers and finance people, not engineers. The BR engineers involved came primarily from this ‘local knowledge’ culture and from the functional directorates of Signalling and Telecommunications (S & T), Mechanical and Electrical Engineering (M & EE), or Civil Engineering; their experience of such organizational and technical interface issues was severely limited. Where they had managed interfaces, both sides were controlled by their organization. The new structure was put together on the basis that interfaces would be managed by the use of contracts and standards. For instance, it was assumed that a piece of rolling stock constructed to Railway Group Standards (about which more later) and verified as being compliant with them, would be safe to run on the infrastructure with no more work. Further, only key parameters governing safety needed to be covered in such Standards, commercial issues could be left to individual companies or where necessary would be governed by contract. Even if the Standards had been inherited in much better shape than they were, such an approach has inherent problems, the more so given that the UK's earlier history of privately built railways constructed by many different companies had produced highly non-uniform infrastructure. The immaturity of many of the new companies further compounded the problems.

The Management of Safety

In the run up to privatization, the UK railway safety regulator—the State-owned but independently governed Health and Safety Executive (HSE)—wrote the report Ensuring Safety on Britain's Railways, examining the various options for managing safety in the soon-to-be-established fragmented structure. They concluded that railways should be brought fully into the regime governed by the UK Health and Safety at Work Act and subject to Safety Case arrangements similar to those introduced in the UK offshore oil industry after the Piper Alpha disaster. Railtrack, the infrastructure owner and operator, and every train operator would be required by law to produce a formal Safety Case document setting out an assessment of the safety risks affecting operation, and the systems and processes by which they would be controlled. The HSE would accept Railtrack's Railway Safety Case as the controller of ‘the premises’ but not those of the operators (see below).
Thus, when BR was split-up ready for privatization in 1994, it's Safety and Standards Directorate (S & SD), which was responsible for network-wide Standards (later to become known as the Railway Group Standards), passed to the network infrastructure owner and operator Railtrack. The HSE believed that Railtrack had special responsibilities as the owner of the network to control the risk imported by operators. The Directorate was given both the responsibility of setting network Standards regarding system safety and safe interworking and the duty to accept the Railway Safety Cases of train operators as prescribed by the Railway (Safety Case) Regulations 1994. This system, where the HSE accepted Railtrack's Railway Safety Case and Railtrack accepted those of train operators was called ‘the cascade.’ Before the split-up of BR, late in 1993, the managers tasked with setting up Railtrack had suggested that it might be better if the S & SD was established as an independent organization unconnected to any of the new commercial companies, but the HSE rejected this as ‘not giving Railtrack enough responsibility.’

Early Developments

Not too long after Railtrack was privatized in 1996, a number of people, and most importantly the Parliamentary Select Committee on Environment, Transport and the Regions, began to question whether it was appropriate for a commercial organization like Railtrack to set the Safety Standards for, and approve the Safety Cases of, other commercial companies (the operators). The government had changed in early 1997 and the new Labour government had strongly opposed the privatization of the railways when it was in opposition. Indeed it had threatened re-nationalization, but backed away from this on coming to power because of the costs and potential disruption such a move would incur. The Labour Party in the UK has always had very close links with the trades union movement, which was and remains fundamentally opposed to the principle of privatization of the railways, or any other public service for that matter.
The reforms to working practice brought about by the contracting out of maintenance were particularly unpopular with the trades unions. The BR maintenance units were sold by trade sale, largely to civil engineering companies, who as part of their reforms introduced much more sub-contracting. Sub-contractors often lacked the skills and local knowledge on which BR's practices had depended. Further, the maintenance contracts set up as part of the privatization and inherited by Railtrack were overly favourable to the contractors in many respects and included a very high profit rate (15%). These measures were intended by government to maximize the price of the former BR maintenance units when they were sold, realizing a good short-term gain for the Treasury. As well as being loaded in the contractor's favour, these initial contracts also attempted to pass maintenance responsibility on a performance basis to the contractors in a way that left Railtrack with too little control over things for which it was clearly legally responsible. Some well-publicized maintenance failures occurred, many of them associated with the inappropriate use, and/or failure to ensure the competenVØÉ of sub-contractors. The HSE reviewed matters and published a very critical report on Railtrack's management of its contractors (with little or no recognition of the problems built into the arrangements by the privatization). As some of the contractors started to report high profits (derived from the high margins built into the contracts by government), the media (encouraged by the trades unions and some politicians) started to campaign that the privatized industry was putting ‘profits before safety,’ which became something of a rallying cry for the opponents of the process.
The Select Committee and others expressed a concern that ‘safety standards were falling.’ This was taken to mean that Railtrack was relaxing the requirements placed on its contractors and that S & SD was in some way complicit in that change. In fact neither was true. It is worth noting that ‘standard’ is a word with several meanings and even a native speaker of English can be confused by it. In fact, the HSE had never had any significant criticism of the specifications (the standards as requirements documents) and S & SD was continuing to develop and improve them. Railtrack was also putting a lot of work into improving its company standards, both uniquely and in response to Group Standards changes. It was also working on better forms of maintenance contract to be introduced when the first of the initial contracts expired, but the shortest contacts were for 5 years. The problems lay in the weak (but externally imposed) maintenance contracts and inadequate funding levels that were leading to significant problems in compliance with Standards. The phrase ‘Standards are falling’ often actually means that the degree of compliance with Standards is falling, i.e. the Standards are not being worked to or enforced.

The Problems Continue

A few years after privatization, Railtrack's infrastructure was coming under significant stress. It was assumed that private management would reduce the cost of running the system, as had occurred with other utility privatizations. In reality, BR had managed the system for years on inadequate funding and had become very skilful at ‘make do and mend.’ The split of responsibilities in a contractual relationship do not favour such practices. In effect, the government-appointed (commercial) Regulator has power to control the main source of Railtrack's income by setting the level of Track Access Charges that Railtrack can charge train operators. The Regulator was pushing Railtrack for efficiency savings (cost reductions) similar to those achieved by other privatizations when, in reality, the baseline contract values for maintenance were already inadequate to maintain the system in steady state. To make matters worse, one of the successes of privatization has been a significant and largely unanticipated growth in passenger numbers and freight volumes. The franchised Train Operating Companies (TOCs) have a high fixed proportion to their costs and to increase revenues ran more off-peak trains and used innovative marketing to fill them—a desirable outcome for passengers at least. Some other elements of the commercial framework set at privatization turned out to be perverse. For example, some operators deliberately failed to recover a service after an infrastructure fault because they made more money in penalties from Railtrack than the disruption would cost them. On some routes, passenger numbers have increased by 40% to 50% since privatization and most routes have grown by at least 10%. Freight tonne-km also increased in part due to innovative marketing by the new private operators and in part due to new coal flows as power stations shifted from using local deep-mined coal to less costly imported open-cast coal. These heavy extra trains increased the wear and tear on the already under-invested and under-maintained infrastructure but Railtrack received little extra revenue from them because of the small variable element in the pricing structure. A further aggravating factor was that Railtrack had not inherited any kind of asset register or database from BR and had been much too slow in developing one due to the pressures of separation and privatization. It had little knowledge of what and where its assets were, let alone their condition. It was in a weak position to argue with the Regulator for more money because it could not provide any hard evidence. In the absence of such evidence, the Regulator (not unreasonably) looked at other external benchmarks to judge Railtrack's needs. Moreover, in some of the early years, the financial structure at privatization had meant that Railtrack had been able (foolishly as it turns out) to show good profits and it's share price was riding high, so how could it need more money?
Indicators such as track quality and broken rails started to show a worsening trend and the HSE intervened again.
Against this background and responding to the recommendations of the Select Committee, the then Minister of Transport asked the HSE to look again at the safety structure of the industry in general and at the positioning of Railtrack's S & SD in particular. They spent over a year gathering evidence and analyzing it but found little of concern and certainly no evidence that commercial issues were adversely influencing safety decisions. Indeed, the main concern came from train manufacturers, who in taking on the design risk previously borne by BR felt they were being asked to do too much to demonstrate that new trains were safe, not too little. The HSE's report was sent to the Minister and the Secretary of State just before the serious train collision at Ladbroke Grove in October 1999.
The Ladbroke Grove collision was the most serious safety failure on Britain's railways for a decade. Thirty-one people including both drivers were killed, and many more were seriously injured. The accident was headline news around the world. A commuter train belonging to Thames Trains had passed a signal at red and collided head-on with a First Great Western High Speed Train (HST) on its way into Paddington. The closing speed has been estimated at over 220 km/h, making it probably the highest speed collision between two passenger trains in history. While the immediate cause was obvious—the driver of the commuter train had cancelled his Automatic Warning System (AWS) and passed a red signal—the underlying causes were very complex and involved many management failures. The signal had been passed at danger many times before and Railtrack's responsible operating zone had (with benefit of hindsight) reacted slowly and inadequately. Another significant factor was the 1995 decision by government to abandon the nationwide installation of Automatic Train Protection (ATP) recommended after the Clapham Junction crash in 1988 because it was too expensive. As a result, although the track at Ladbroke Grove had ATP, the commuter train did not.
When Ladbroke Grove occurred, railway safety became a highly political issue and the HSE report was used as a way of distracting attention from the earlier government decision not to install ATP. (While the decision not to install ATP had been made by a different government, it had not been substantially changed by the sitting government after an earlier ATP-preventable collision occurred just a few miles away on the same route at Southall in September 1997, killing seven passengers.) On the Sunday after Ladbroke Grove, the Secretary of State came under intense media pressure to resign. In defence, the government issued a statement saying that a damning report by the HSE showed that Railtrack had put profit before safety and it would now be ‘stripped of its safety responsibilities.’ The industry had several draft copies of the report due to HSE consultation on the contents; one copy found its way into the hands of the press, who published the fact that it was not so damning after all. Actually, it said there was no significant problem. By Wednesday, the government had to back down and announced that Railtrack would retain responsibility for operational safety but the positioning of its S & SD would be the subject of both short- and longer-term inquiries. This incident damaged the reputation of both the railway and the government.
The government then launched a number of new inquiries. The Public Inquiry chaired by Lord Cullen would be the most important, but the HSE was also asked to look at Railtrack's safety management system in a shorter time-scale; a committee led by a senior civil servant would look at any short-term measures needed to fix ‘the S & SD problem.’ Du Pont was also commissioned by S & SD to carry out a revue of safety management in the industry.
None of these short-term inquiries found any problem with the way S & SD had behaved. It was shown to have been fair and even-handed, to have worked hard in the pursuit of safety improvement and no evidence was found that commercial matters had ever been put before safety. Nevertheless, the review committee recommended that pending the outcome of Lord Cullen's Inquiry, S & SD should be separated from Railtrack to the greatest extent possible without legislation. A new subsidiary company, Railway Safety, was established which while still owned by Railtrack was an independent, not-for-profit company (limited by guarantee) with its own board of directors formed of representatives of all the industry and independent safety experts.
Sir David Davies, then President of the Royal Academy of Engineering, agreed to become Chairman of Railway Safety, and a number of other eminent independent safety experts joined the new board. As Director S & SD, I was transferred to become Chief Executive of the new company. Senior managers in Railway Safety are prohibited from holding shares in any railway company. Concurrently with the establishment of Railway Safety, the ‘cascade’ was abandoned and the process of approving operators' Railway Safety Cases was passed to the HSE. However, Railway Safety has a statutory duty to review them and either recommend acceptance or point out deficiencies.
Part 2 of Lord Cullen's Inquiry was published in September 2001. It looked at the industry's safety structure and recommended the transfer of Railway Safety's functions to a new legal entity that is independent of Railtrack, but with governance by representative of the whole industry—Railtrack, the operators, contractors, manufacturers and the railway trades unions. The process to establish this new company, which will be known as the Rail Safety and Standards Board (RSSB), is complex and it will be April 2003 at the earliest before it is up and running. Lord Cullen was not critical of S & SD or Railway Safety in his report. He recommended that there should be an industry safety body separate from the safety regulator (which should remain the HSE) and not owned by the infrastructure company alone, to avoid even a suspicion of bias. All the staff from Railway Safety will transfer to RSSB. Until the transfer is complete, Railway Safety will perform its current role at the heart of the railway industry's arrangement for safety collaboration in a fragmented industry.

Safety Performance —The Real Story

So, what really happened to the safety performance of the UK main-line railway through the privatization process? The reality is different to the perception; in fact the safety process has been a significant success and safety has improved overall. Lord Cullen recognized this fact and recommended that the Safety Case system continue. This does not excuse the failures that lead to the recent high-profile accidents—there is still a need for further improvement. Anyway, the political involvement and high media profile have changed public expectations and there is now a much lower tolerance of railway accidents than there was in the past.
Figure 1 shows a graph of all collisions and derailments on Railtrack infrastructure normalized by millions of train-miles. As can be seen, the rate has improved by more than a factor of three since the restructuring in 1994. If the data are normalized by millions of train-km to be more familiar to people outside the UK and USA, the rate is now at about 0.6, which is amongst the best in Europe and within a factor of two or three of the excellent performance achieved in Japan.
Figure 2 shows the rate of Signals Passed At Danger (SPADs) for the UK main-line network. What had been a flat performance up to 1994 has, since restructuring, improved by more than a factor of two. This has been achieved by a wide range of initiatives both to improve training and awareness and measures such as improved signal sighting and a reminder device in the cab to address ‘start away from red’ SPADs. It has not involved the widespread deployment of ATP. After Ladbroke Grove, a programme was implemented to fit a national simple train protection system as quickly as possible. This so-called Train Protection and Warning System (TPWS) is functionally similar to Japan's ATS-SN. The programme is now nearing completion and further substantial SPAD rate reductions are being achieved along with a reduction in the number of more severe SPADs due to a shift to lower categories caused by the mitigating effect of TPWS.
I am the Chairman of a national Programme Board that is overseeing a national project team looking at deployment of full ATP to the new European Standard (ERTMS), in the longer term, particularly on higher-speed routes.

Recent Events

In October 2000 and during Lord Cullen's inquiry, a high-speed derailment caused by a broken rail occurred at Hatfield on the East Coast Main Line north of London, leading to four deaths and many injuries. The rail had suffered serious damage due to rolling-contact fatigue; it had been identified for replacement but had not been changed and other controls required by the Standards had not been imposed. An immediate examination of the network revealed unexpected levels of rolling-contact fatigue (and its associated damage symptoms, gauge corner cracking and head checking) at many other locations. The Railtrack management, battered by media, government and regulatory pressure, and faced with yet more criticism of its control of contractors, reacted with panic. It imposed emergency speed limits as low as 20 mph (32 km/h) at rolling contact fatigue sites all across the network, including on 200 km/h lines. Journey times became extended to a completely unacceptable degree and the timetable collapsed. The network was crippled, and to some degree, has still not fully recovered more than 2 years later. Mr Gerald Corbett, Railtrack's high-profile Chief Executive, resigned a few weeks after Hatfield. An emergency programme was initiated to replace rails, switches and crossings. It went on for many months and the costs and associated commercial penalties to operators for the resultant disruption drove Railtrack to declare a heavy loss in fiscal 2000–01.
The cries of ‘profits before safety’ were heard yet again. The public inquiries into Ladbroke Grove were still being held at the time of Hatfield. Prior to his resignation, Mr Corbett was due to give evidence and was subjected to heavy pressure regarding the balance between performance and safety. It was suggested that part of the reason for the Hatfield derailment was that the high penalties associated with delays or unplanned repair work had made Railtrack and its contractors reluctant to do essential work if it would disrupt train operations. Railtrack had been running a major delay-minute reduction campaign and it was said that the high profile of this campaign had drowned out the safety message. Although others made the point that good performance and safety are not incompatible (quoting Japan as evidence that both can be achieved simultaneously), the impression was certainly left that the drive for performance had produced a mind-set where the focus was on improving performance and that safety had been seen as secondary because it was already OK. In other words, complacency about safety had set in for some people at least.
The subsequent independent investigation into why there had been a significant increase in rolling-contact fatigue on Railtrack's network emphasized the degree to which this was a system issue, outside the control of any one of the players in the privatized industry. It had much to do with introduction of new rolling stock with better ride characteristics that reduced track wear but allowed fatigue to develop as a result. However, Railtrack's reaction and its already poor reputation acquired from prior events meant that it took the blame. The last straw came when, in an attempt to maintain at least some friends (in the financial institutions), Railtrack paid a 2000–01 dividend to its shareholders despite heavy losses and while asking for more government money. An infuriated government used its powers under the Railways Act to put Railtrack into Railway Administration in October 2001. A year later it was bought out of administration by Network Rail, a not-for-profit company established with government support. Few mourned Railtrack's demise and little recognition is given to the many problems it inherited or the things it did achieve (such as the complete refurbishment of Britain's previously crumbling large Victorian stations). Hopefully, Network Rail will succeed because it has the political support that Railtrack never had.

Managing Systems

Meanwhile, the quest continues for a satisfactory answer to the problem of managing cross-boundary systems in a fragmented industry.
The government's Strategic Rail Authority (SRA) was formally constituted in February 2001 to provide strategic leadership to the industry. Under the guidance of Mr Richard Bowker, its new Chairman and Chief Executive, it is finally providing the overall strategic direction (including at times detailed specifications) on the type of railway the government is prepared to support. While public spending on the railway has doubled in recent years, there is still considerable doubt as to whether this is enough to meet the public desire for a better system, particularly given the historic backlog remaining to be overcome.
Within this framework, if the growth in costs is to be contained and more delivered within the available funding, the industry has to find better ways to work together to deliver the outputs the SRA wants. Better management of systems that cross operational, organizational and ownership boundaries is a key element in this.
Systems are made by bringing together many components to achieve something that none could achieve on its own. A battery, two wires and a bulb can make light, an ‘emergent property’ possessed by none of the components. Management of systems requires an understanding both of the properties of the components and of the intended emergent property. The components may be physical (such as a wire) or abstract (such as a way of working). The emergent properties also may be abstract, such as safety or efficiency.
Systems can also have unintended and undesirable emergent properties. The specification of what the component will do always has some implicit and unstated assumptions of how it will be used. If the supplier's assumptions are different from those of the user, there is a danger that something unanticipated will occur. That unanticipated consequence is not a property of any component but of the way that they are brought together. It emerges from the interface between two or more components.
The problem may not emerge immediately. A component may work satisfactorily when first installed but problems may emerge later, either because the component changes (for example because of incorrect maintenance or inappropriate modification) or because the rest of the system changes or simply through the effects of aging.
The problem of unanticipated behaviour is particularly great if the component includes software. There are often very many unstated assumptions in the design of software and it is impossible in practice to test every combination of input conditions and their timing.
A full specification of a component should include a complete list of all the things that it will NOT do, as well as those that it will. This is not possible for any but the simplest of components. The only satisfactory way of ensuring safety at the interfaces between components is to empower a system architect, with an overview of the entire system assurance process, from the start of design and continuing throughout the operational life.
The Southall Inquiry led by Professor John Uff took evidence from myself and others on how such problems might be avoided in the future, accepting that a return to a single vertically integrated organization was not going to happen. I suggested the idea of a System Authority and this was supported by others. I also suggested that a recommendation from the Inquiry on development of the concept might help to speed progress. That recommendation was made as Recommendation 63 that states, ‘One or more System Authorities should be created to oversee the specific development of any new project on the railways and to oversee continuation of work on existing projects, including AWS and ATP.’ The Office of the Rail Regulator (ORR), which is the government appointed but independent economic regulator of the UK industry, took the lead in promoting this recommendation. Lord Cullen also took evidence from myself and others on this subject and made further recommendations supporting System Authority development in his reports into Ladbroke Grove.
Currently, Railway Group Standard GE/RT8049 sets out the form of System Authorities and also the criteria for when they must be established. If the need for a System Authority is identified to manage a particular system or issue that crosses organizational boundaries and if the parties do not form a System Authority, Railway Safety can issue a mandate requiring them to do so. The form selected for the System Authorities is that of a Company Limited by Guarantee. Each of the parties, owning or affected by the system concerned, must buy a share in the company. The company's legal constitution is set out so as to give it the responsibility of being the ‘system architect’ making system configuration and trade-off decisions to produce the best solution for the system overall. The company can also make decisions about redistributing costs to prevent any party being disadvantaged. If the best system solution is selected then any changes should always improve the system position overall, meaning there should always be a surplus somewhere that is larger than any loss elsewhere needing to be compensated. Railway Safety acts as the administrator and facilitator of System Authorities, it also provides them with a company address, and facilitates the drawing up of the necessary legal documents through its solicitors.
Two System Authorities are now up and running. Post-Hatfield, the Wheel Rail Interface System Authority (WRISA) now manages the critical wheel–rail interface, including proposing any changes needed to the mandatory Standards for securing safe interworking to Railway Safety. The TPWS System Authority looks after the system issues regarding the Train Protection and Warning System.
The situation continues to evolve. Since 11 September 2001, insurance companies are very wary of transportation risks and it has proved very difficult to get insurance cover for the System Authorities to protect their directors from incurring personal liabilities associated with a System Authority decision. Although WRISA and TPWS are seen as quite successful and their members wish them to continue, there is a current reluctance to form any new authorities because of the insurance problems. One solution being discussed is to form System Committees within the new RSSB. These would not be legally constituted companies but would perform the same system architect function from within the RSSB and would be covered by its insurance provisions. This significantly extends the role of RSSB into an area that is not just about safety but is also about commercial optimization of the railway system. For that reason, it is rightly generating considerable debate.
Whatever the final outcome, one very clear lesson from the experience of UK rail privatization is that some arrangement must be found in a fragmented industry to cover ownership of the performance of systems in a holistic way.

Lessons Learned from UK Rail Privatization

So, what are the key lessons from the UK experience? There are many and some that are relevant to this article are listed below:

1.	Transport safety is a matter of public policy—no government could ever be hands-off.
2.	Railway restructuring is best carried out at a time of political stability. Whether railways are public or private, governments still have a key role to play and create the climate in which railways operate. Cementing major change in a hostile political environment is very challenging.
3.	Whatever organizational structure is chosen make sure responsibilities are clear and aligned. Commercial, operational and safety responsibilities should flow through the interfaces in the same direction, i.e. the customer–supplier relationship should be in the same direction for all areas. Railtrack acting as a pseudo-safety regulator on the TOC's created conflicts.
4.	However the organization is partitioned make sure there is a clear responsibility, either by an individual party or through a collective process, for system performance. System performance cannot be assured wholly by standards on different sides of an interface.
5.	Think very carefully about ALL the possible effects of commercial incentives and be aware of perverse outcomes.
6.	Do NOT change everything at once. Phase in change and outsource activities in a controlled way within the capabilities of the organization to manage. People need time to learn new skills and adapt to new ways of working. If there are no areas of stability, the system will undoubtedly become unstable.
7.	Fragmenting the organization into too many parts will spread management too thinly to cope with change—interfaces compound rapidly with the number of organizations and interfaces consume management effort.
8.	Never be complacent about safety. However well it seems to be going, railways are amongst the most complex technical and operational undertakings in the world and require constant attention to detail.
9.	Public expectations of railway safety are continuing to increase. Unless delivered safety performance improves at the same or a better pace than the expectation, the perception will always be that things are getting worse even when they are improving. It is necessary to ‘run to stand still’ and find innovative ways to improve safety.
10.	Much can still be done to improve performance by working on the softer issues of human factors and the things that influence them rather than spending large sums on new technical solutions.

UK railway privatization has had many successes. They go largely unsung while its failures are ‘proclaimed from the rooftops.’ Privatization has not of itself caused the problems—fragmentation certainly contributed.