The current COVID-19 crisis has focused many people’s attention on the question of risk and how governments go about ensuring public safety. I have no epidemiological experience that enables me to comment knowledgably upon the UK government’s strategies, and if I did claim to have any I am sure there would be someone out there who would choose to dismiss such claims as ‘uncheckable credentialism’. Nevertheless, I do know a thing or two about how the UK government persuaded itself that a particular road transport system would be sufficiently safe in operation – namely the UK’s Smart Motorways System. Having such experience provides me with some insight regarding how government agencies handle the ethics of setting public safety targets.
I have previously published on the subject of Smart Motorways in a specialist newsletter produced by the SCSC, a long-standing society set up for the benefit of professional safety engineers wishing to exchange best practice in the field of safety-related systems engineering. Inspired by news reports, I recently chose to publish once again on the same subject (Safety Systems vol. 28-2). I enclose below the second SCSC article in full. However, for those who prefer not to waste their valuable lockdown time wading through the detail, I also offer the following synopsis:
Synopsis of the SCSC Article
The government believes that if it takes a stretch of motorway and implements an upgrade to its infrastructure, then it will be morally and legally in the clear if the resulting rate of killed and seriously injured is no greater after the upgrade than it was before.
In the case of the Smart Motorways upgrades, two adjustments to the infrastructure were entailed. The first was expected to reduce the accident rate. The second (which is contingent upon the first adjustment being made) was expected to increase the accident rate but not by so much that it would overturn the benefits from the first.
The government had the option of only introducing the first adjustment, thereby maximising road safety. They chose not to take this option, arguing that they have no legal obligation to make the roads safer than they already are but only to ensure that through their actions they do not make them less safe.
The first adjustment I refer to is known as Controlled Motorways and its effect is to ‘calm’ traffic flow. The second adjustment I refer to is the removal of the hard shoulder as a breakdown zone in preference for its use as an extra lane for live traffic running.
The UK government knew that opening the hard shoulder up as a live lane would be unsafe but they expected the extra deaths and serious injury to be hidden by the road traffic safety statistics because of the benefits of traffic calming.
I have always argued that this approach is ethically dubious and potentially illegal. Smart Motorways have since gained a reputation in the public eye as death traps and Grant Shapps is now desperately backtracking on their further deployment. At least one grieving family is now planning to sue the UK government for a failure in its duty of care.
And the moral of the story is that governments are quite willing to cause death if it can be hidden within a statistic that accompanies a presupposed greater good. However, they often fail to appreciate the human story behind the statistics and just what this can sometimes mean in terms of political fall-out.
And Now the SCSC Article In Full (How Smart Are Our Motorways?)
In view of recent adverse publicity  surrounding the UK government’s Smart Motorways, I thought it might be useful to draw attention to two articles posted in this newsletter back in 2010. The first , an article written by myself, discussed ethical issues that may arise when setting safety targets. Particular reference was made to Active Traffic Management (ATM), a pilot for Smart Motorways hard-shoulder running. The second , an article written by David Boulton of Arthur D. Little’s Risk Practice, sought to outline the approach taken by the Highways Agency (HA) in the setting of safety targets and addressed some of the issues I had raised. To summarise, I had concerns that the HA’s adoption of the Globally At Least Equivalent (GALE) principle could lead to ethical difficulties, particularly if this were to entail the abandonment of the principle of reducing safety risk As Low As Reasonably Practicable (ALARP). A main purpose of  was to point out that the application of GALE did not preclude the aspiration to reduce risk further in a manner akin to ALARP—though I believe I would be correct in saying that any such endeavour on the HA’s behalf would still not be as a result of a perceived legal imperative.
I shall not seek to review in detail the two articles referenced above. However, since I believe recent events have vindicated the concerns I had raised back in 2010, I shall expand upon those concerns below. As was the case with my initial article, I trust there will be those amongst the readership of this newsletter who will be in a position to correct any errors made and, indeed, redress any imbalance or misrepresentation of which I may be guilty.
The Safety Argument as I Understand It
In order to understand how the Highways Agency could arrive at the conclusion that Smart Motorways with live hard-shoulder running would be acceptably safe, one has to appreciate the following:
Regarding the setting of safety targets for the Smart Motorway system (and indeed for its ATM predecessor), the HA maintained that the Health and Safety At Work etc. Act 1974 (HSAWA) did not apply. Consequently, they felt under no legal obligation to reduce safety risks to a level in accordance with the ALARP principle. This position is clarified in .
Instead of using ALARP to set safety targets, the HA looked towards the GALE principle, in which safety risks associated with a system should be Globally At Least Equivalent to the risks encountered prior to the introduction of the system (or upgrade thereof). This idea was taken from the UK rail industry (which, in turn, obtained the idea from the French railway’s concept of Globalement Au Moins Equivalent (GAME)). When assessing whether Smart Motorways were likely to comply with the GALE principle, the HA took into account that Smart Motorway schemes require the simultaneous introduction of a previously developed technology known as Controlled Motorways, in which variable speed limits are used to achieve a ‘calming’ effect on traffic flow. Since previous Controlled Motorway systems had been demonstrated to reduce levels of speed-related deaths and serious injury, this could be taken into account when making a GALE calculation. Accordingly, an increase in the rate of death and serious injury resulting from the removal of the hard shoulder safety zone could be offset by a presupposed equivalent reduction in the level of speed-related death and serious injury on the main carriageway.
The safety dividend resulting from the introduction of a Controlled Motorway scheme can be estimated based upon the accident statistics of previously operated Controlled Motorway systems (e.g. the M25’s scheme, incorporating Motorway Incident Detection and Automatic Signalling System (MIDAS) queue protection). On the other hand, the estimation of the safety penalty resulting from the removal of a hard shoulder safety zone would have to be based upon a theoretical safety model. Such a model-based risk assessment was conducted, and the HA concluded that the projected increase in deaths and serious injury due to the removal of the hard shoulder safety zone was no greater than the reduction that employing Controlled Motorway traffic calming could be expected to bestow.
The system was therefore predicted to meet the GALE target, i.e. a Smart Motorway operation (necessarily entailing Controlled Motorway traffic calming) would be at least as safe as a stretch of motorway lacking any traffic management system (to be accurate, I should point out that an adjustment was factored into the GALE calculation, which I believe provided for a proposed 10% safety improvement).
In all of the above, it should be appreciated that a fully functional Smart Motorway scheme is not feasible without the installation of Controlled Motorway technology (traffic calming is a necessary precursor for the opening of the hard-shoulder to traffic). However, a Controlled Motorway system is itself perfectly feasible as a stand-alone traffic management scheme (e.g. as previously operated on the M25).
I had always thought that the Highways Agency’s approach towards the setting of the Smart Motorway safety targets was problematic.
Firstly, it is ethically dubious to allow for an increase in deaths and serious injuries due to taking one action just because one can expect a compensating decrease in deaths and serious injuries due to taking another. For example, a car manufacturer that introduces air bags into the design of one of its vehicles could not use such a safety upgrade as an excuse for removing an engine fire management system from the same vehicle. By the same token, the removal of the hard shoulder as a safety zone for breakdowns cannot be justified by referencing the posited lives saved as a result of the simultaneous introduction of Controlled Motorway traffic calming. The fact that Smart Motorways require Controlled Motorway traffic calming is circumstantial and covers up the fact that key aspects of Smart Motorway operation are inherently dangerous.
Admittedly, GALE is supposed to apply to system installation and upgrades rather than to dynamic transitions from one mode of operation to another. Nevertheless, there is an argument that the GALE baseline for a Smart Motorway system, with live traffic running on the hard shoulder, should be a Controlled Motorway with the hard shoulder closed to traffic, since the latter provides the context in which hard-shoulder running is dynamically introduced. For its GALE baseline, the HA used a conventional stretch of motorway prior to the installation of any traffic management system. However, in those circumstances where an upgrade had actually been from a Controlled Motorway system to a full functionality Smart Motorway system, would the HA still insist on using the conventional motorway as the baseline for its GALE calculation?
Secondly, it is politically naïve to assume that the families of victims killed as a result of the removal of the hard shoulder safety zone would be satisfied with the argument that such deaths can be condoned simply because it may be presupposed that speed-related deaths on the main carriageway of the same stretch of motorway will have been avoided as a result of separate measures taken (i.e. Controlled Motorway traffic calming). In the eyes of the public, the perception of safety for a given action will be established by considering those deaths and serious injuries that have occurred as a result of that action; there will be no allowance made for the hypothetical deaths or serious injuries that may have been avoided by taking any separate, albeit attendant, actions. Such statistical arguments carry no weight with the bereaved, and the public mood is always going to be established by the factual and not the counterfactual.
Finally, the Highways Agency’s assertion that the HSAWA does not apply when deciding upon acceptable levels of safety for safety-related systems installed on the motorway was always questionable. Certainly, such legislation would apply to the designers, suppliers and installers of such systems. Accordingly, all such parties would be expected, under law, to reduce safety risks As Low As Reasonably Practicable. However, the Highways Agency (now Highways England) was the design authority for all traffic management schemes installed on England’s motorway network and, as such, they stipulated the safety requirements. If a system supplier’s customer (the government) is not applying ALARP when stipulating the system safety requirements, the possibility then arises that an accident resulting from system failure could place the supplier on the wrong side of the law, if the safety integrity of the system had been engineered only to meet the government’s own safety targets. Furthermore, as the ultimate design authority for traffic management schemes, the HA would surely have a duty of care to ensure that whenever two GALE compliant alternatives are reasonably available, then the lower risk alternative is taken. A motorway subjected only to Controlled Motorway traffic calming provides a lower safety risk alternative to full functionality Smart Motorways, so the Highways Agency had it as a GALE and ALARP compliant alternative. Denying the legal applicability of ALARP enabled the HA to justify not taking that option. A more germane justification may be that Controlled Motorways technology on its own (whilst alleviating congestion) would not enable the HA to meet its motorway network capacity targets. To meet those targets required the adoption of the less safe system.
Any suggestion that the deaths and injuries caused as a direct result of the removal of the hard shoulder as a safety zone could not have been foreseen is unsupportable. They were not only foreseen by the HA, they were analysed and quantified as part of the GALE calculations.
The GALE calculation alluded to above was based upon an assumed separation of 500m between Emergency Refuge Areas (ERAs). Having calculated that a Smart Motorways scheme employing ERAs spaced at 500m meter intervals would just meet the GALE safety target, it is inconceivable that GALE compliance could be assumed for a system employing ERAs every 1.5 miles (even working with a GALE-10% tolerance). The spacing of the ERAs was a critical factor in the risk model used by the HA’s safety consultants (as, indeed was the installation of technologies to detect hard shoulder breakdowns). I have no knowledge of whether the safety case was reviewed when Smart Motorways was rolled out with increased ERA spacing and, if so, what the logic would have been for concluding that the safety case could still be made.
Current statements from politicians, along the lines of ‘one death is one too many’ or ‘we need the motorways to be as safe as possible’ are inconsistent with the safety policies that had been adopted by the HA throughout the specification, development and operational phases of Smart Motorways. These are political sound-bites aimed at an electorate; they have not previously informed the safety management process and it would be naïve to believe that they will do so in the future.
The HA’s insistence that they had no legal requirement to apply the ALARP principle when deciding upon safety targets is now likely to be challenged in the courts. I understand that at least one bereaved family plans to charge Highways England with corporate manslaughter for failing in its duty of care . This duty is premised in law upon the application of ALARP, therefore I assume that adherence to the GALE principle would not be a sufficient defence (notwithstanding a 10% margin). Even if my concerns regarding the HA’s approach to GALE calculations should be ruled as immaterial, it is difficult to see how extending the spacing between ERAs could be seen as an ALARP approach to safety risk management. Highways England may still be able to make a case based upon an improvement in risk efficiency (i.e. the number of deaths for a given traffic volume) but I have no idea where this would stand legally.
 See, for example, https://www.bbc.co.uk/news/uk-51236375
 J. Ridgway, “The Bogeyman – Fact or Fiction” Safety Systems, Vol 19, Number 2, 2010, https://scsc.uk/r111.2:1
 D. Boulton, “GALE or ALARP: Which to Choose” Safety Systems, Vol 20, Number 1, 2010, https://scsc.uk/r114.1:1
 M. Halbert, S. Tucker, “Risk Assessment for M42 Active Traffic Management, Developments in Risk-based Approaches to Safety”, Springer, London, 2006, https://scsc.uk/r6/2:1
John Ridgway is a retired traffic systems consultant who led the software development team responsible for the M25 MIDAS computer control system. Subsequently, he undertook a functional safety management role whilst working for a contractor commissioned to provide a computer control system for the Highways Agency’s M42 Active Traffic Management system. All opinions expressed in this article are entirely his own and do not reflect the views of any previous employers.
The author retains copyright of this article.