Safety Digital Box (SDB)
Swiss Cheese Model Analysis

This document applies the Swiss Cheese Model (SCM) of accident causation — originally developed by James Reason — to analyze failure modes at highway–rail grade crossings where the Safety Digital Box (SDB) provides measurable risk reduction. The primary analysis addresses the double-train awareness failure, in which road users misinterpret continued warning device activation after first-train clearance. The scope extends to single-train scenarios, cyclist-specific vulnerability, one-side pedestrian gate configurations, and signalized pedestrian crosswalk misinterpretation.

A formal reliability model is defined using probability of unsafe entry (P_enc) and system reliability (R = 1 − P_enc). The model distinguishes between absolute reliability gain and relative unsafe-entry reduction, two metrics that are mathematically distinct and must not be conflated. Illustrative calculations use representative parameter ranges; all values require field validation through controlled observational studies.

1.3 Relationship Between Design-Stage OSR and Behavioral Amplification Modeling

Purpose of This Document Structure

This document integrates two complementary but distinct analytical approaches:

1. Design-Stage Overall Safety Reliability (OSR) Framework
2. Behavioral Amplification Modeling Using the Swiss Cheese Model

These frameworks serve different purposes and must not be conflated.

A. Design-Stage OSR (System Architecture Reliability)

The OSR framework evaluates the combined effectiveness of independent safety layers at the system design level.

This framework:

• Assumes statistically independent defense layers
• Evaluates structural reliability at the engineering design stage
• Determines whether total layered protection meets target safety thresholds
• Is appropriate for comparing infrastructure configurations

B. Behavioral Amplification Model (Encounter-Level Risk)

The Swiss Cheese behavioral model evaluates encounter-level unsafe entry probability:

This model:

• Does not recompute full structural OSR
• Holds system reliability constant
• This modeling approach isolates marginal reliability improvement attributable to SDB without altering baseline structural defense assumptions.
• Studies dynamic behavioral amplification under specific cognitive conditions
• Quantifies how SDB reduces the behavioral multiplier m

C. Conceptual Integration

In this document:

• OSR defines baseline system reliability
• Behavioral amplification modeling quantifies marginal reliability gain of SDB during high-risk behavioral windows
• SDB improves overall safety by reducing the dominant behavioral failure multiplier rather than by replacing physical barriers

These approaches are complementary:

Together they provide a complete safety case.

2.1 Behavioral Failure Mode Definition

The "second-train illusion" (also termed the multiple-train hazard misinterpretation) is a cognitive failure in which a road user at a grade crossing:

1. Observes the first train pass and clear the crossing
2. Expects the warning devices (flashers, bells, gates) to deactivate
3. Experiences cognitive dissonance when warnings continue
4. Rationalizes the continued activation as malfunction, delay, or system error
5. Initiates crossing movement before the second train arrives

2.2 Information Stagnation in Traditional Warning Systems

2.3 Vulnerable User Groups

3.1 Reason's Swiss Cheese Model Applied to Grade Crossings

In the Swiss Cheese Model, each defensive layer is represented as a slice of cheese with "holes" representing weaknesses. An accident occurs when holes in successive layers momentarily align, allowing a hazard trajectory to penetrate all defenses. At grade crossings, the defense layers are:

3.2 Temporal Hole-Enlargement During Double-Train Events

The critical insight of this analysis is that Swiss Cheese holes are not static. During a double-train event, the user compliance failure probability undergoes significant increase in the temporal window after first-train clearance. Three cognitive mechanisms drive this increase:

3.3 Defense Alignment in Probability Terms

In the Swiss Cheese Model, the probability of a hazard trajectory penetrating all layers is a function of each layer's failure probability. When the user compliance failure probability increases, the overall penetration probability increases — potentially dominated by the weakest layer. The formal model in Section 5 defines these relationships explicitly.

The following diagram illustrates how defense layer failure probabilities change across three critical temporal phases of a double-train event. Hole sizes represent qualitative failure probability — formalized quantitatively in Section 5.

Figure 1 — Temporal Swiss Cheese Model: Defense layer failure probabilities across three phases of a double-train event. Phase 2 shows elevated user compliance failure without SDB (m ≈ 3–5). Phase 3 shows SDB intervention reducing the behavioral multiplier (m ≈ 1.3–1.8).

5.1 Model Definition

The probability that a road user makes an unsafe entry into the crossing is modeled as the joint probability of system-side failure and user-side violation:

5.2 Double-Train Behavioral Amplification

During double-train events, user violation probability increases by a behavioral amplification multiplier m:

5.3 Distinguishing Absolute Gain from Relative Reduction

5.4 Parameter Ranges

The cyclist is selected as the primary quantified example because cyclists combine high vulnerability (momentum commitment, balance constraints, gate circumvention capability) with measurable baseline violation rates. This section presents the full calculation using the model defined in Section 5.

6.1 Input Parameters

6.2 Baseline Double-Train (Without SDB)

6.3 Double-Train With SDB

6.4 Computed Metrics

While the double-train scenario represents the most acute failure mode, SDB also provides measurable benefit during standard single-train events. The mechanism differs: rather than counteracting a behavioral amplification multiplier, SDB reduces the baseline violation probability itself.

7.1 Mechanism of Single-Train Benefit

During single-train events, SDB improves crossing safety through four pathways:

1. Directional awareness: The SDB indicates train approach direction, providing information not available from standard flashers. This additional channel reduces ambiguity about hazard location and timing.
2. Early hazard salience: The progressive stage display (Caution → Danger → Blocked) introduces visual novelty that counteracts habituation to standard warning devices, particularly for frequent crossers.
3. Late-entry violation reduction: The stage-based escalation provides a clear "do not proceed" signal that arrives before the train is visible, addressing the late-entry failure mode where users attempt to cross after seeing the train at distance.
4. Signalized crosswalk misinterpretation mitigation: At crossings with adjacent pedestrian signals, SDB provides an independent hazard indicator that is not linked to the traffic signal cycle (see Section 8).

7.2 Modeled Effect on Baseline Violation

7.3 Illustrative Calculation — Pedestrian Single-Train

This section extends the quantified reliability model defined in Section 5 to pedestrian failure modes at signalized rail crossings. The baseline encounter model is:

Where P_sys is the probability the warning system is not usable, and P_user is the probability the pedestrian violates during active warning. Baseline parameters for this section:

Each subsection applies a condition-specific multiplier k to the baseline violation probability, yielding P_user = k × P_user,s. SDB impact is modeled as a reduction in the multiplier.

8.1 Signalized Preemption — Hazard Attribution Failure

Under rail preemption, the traffic signal controller extends red phases for the approaching train. A pedestrian arriving at the crossing observes a persistent red indication with no visible vehicle justification. The pedestrian decision model is vehicle-centered: compliance with red is calibrated to perceived vehicle conflict, not rail conflict.

With SDB reducing the multiplier by providing train-specific hazard attribution:

SDB addresses this failure mode by supplying the missing hazard attribution: the directional display communicates that a rail hazard — not merely a signal timing artifact — requires continued waiting.

8.2 ADA Late Entry Timing Vulnerability

Pedestrians with mobility impairments require longer crossing times. At rail crossings with dynamic preemption transitions, a mobility-impaired pedestrian may enter the crossing during a permissive phase but remain within the track zone when the rail preemption phase activates. This represents P_user enlargement driven by physical constraint and timing mismatch rather than cognitive failure.

With SDB reducing the multiplier through progressive hazard-state communication:

8.3 Parallel Turn Conflict

During the pedestrian WALK phase at signalized rail crossings, turning vehicles may move on paths conflicting with the pedestrian trajectory. When a vehicle turn conflict occurs simultaneously with an approaching rail hazard, the pedestrian's attention is divided.

8.4 Refuge Zone Misinterpretation (Multi-Track)

At multi-track rail crossings, pedestrians who are mid-crossing when the signal changes frequently use the center track zone as an informal refuge area, assuming temporary safety. The center zone may lie directly within the path of a second train approaching from the opposite direction.

8.5 Station-Induced Rushing

At rail crossings adjacent to center-line station platforms, pedestrians observe an arriving train at the platform and initiate a rush to board. The goal shifts from hazard avoidance to time optimization. Second-train awareness is particularly vulnerable.

8.6 Summary Table — Pedestrian Signalized Conditions

9.1 Three-Stage Progressive Display: Caution → Danger → Blocked

The SDB employs a three-stage progressive display that maps to the evolving threat level. Each stage transition provides new information to the road user, counteracting the habituation and information stagnation that increase violation probability in traditional systems.

Figure 2 — SDB multi-stage progressive display logic. Each stage transition injects new information, counteracting cognitive habituation.

9.2 Functional Comparison: Traditional vs. SDB

9.3 Mapping to the Reliability Model

Within the quantified model (Section 5), SDB's multi-stage logic reduces the behavioral amplification multiplier m through three mechanisms:

1. Stage transitions reset habituation — preventing the exponential growth of P_user with time during continued activation
2. Directional information resolves ambiguity — reducing malfunction attribution and the associated P_user increase
3. Explicit "SECOND TRAIN" display eliminates inference requirement — directly addressing the cognitive failure that drives m_{no SDB} to the 3–5 range

The combined effect of these mechanisms is reflected in the reduced multiplier m_SDB ≈ 1.3–1.8 used in Section 6.

10.1 Pedestrian and Cyclist Susceptibility

Pedestrians and cyclists represent the most vulnerable user groups during double-train events due to a convergence of behavioral and physical factors:

10.2 One-Side Pedestrian Gate Configurations

At crossings with one-side (asymmetric) pedestrian gate configurations, the gate defense layer is effectively absent for pedestrians and cyclists approaching from the unprotected side. In the Swiss Cheese framework, this means the gate "slice" has a maximally large hole for these users, making the user compliance layer the final meaningful defense.

10.3 Risk-Phase-Specific Reinforcement

The SDB is a risk-phase-specific reinforcement mechanism: it concentrates its intervention at the precise temporal window when existing defenses are weakest, rather than providing uniform additional warning across all phases of crossing operation.

Figure 3 — Risk-phase targeting: SDB provides maximum intervention during the elevated-risk temporal window, when m is highest.

10.4 Vehicle Double-Train Scenario (Brief)

Vehicles benefit from the physical gate barrier, which substantially limits the gate defense layer failure probability. The vehicle case demonstrates the model's applicability across user types, though the absolute benefit is smaller.

The vehicle case confirms that SDB provides measurable benefit across user types, though the absolute magnitude is smaller due to the lower baseline violation probability afforded by physical gate barriers.

10.5 Pedestrian Double-Train Case (One-Side Gate)

For completeness, the pedestrian double-train case with one-side gate configuration:

Side-by-side comparison of defense layer configuration during a double-train event. Hole sizes are qualitative representations of the failure probabilities defined in the reliability model (Section 5).

Figure 4 — Comparative Swiss Cheese Model during double-train scenario. Left: traditional system with elevated behavioral failure probability. Right: SDB system maintaining reduced failure probability through information injection and stage-based display.

The following table consolidates all scenario calculations. Absolute reliability gain is the arithmetic difference in R (probability units). Relative unsafe-entry reduction is the fractional decrease in P_enc (dimensionless ratio). These metrics are mathematically distinct and must not be interchanged.

14.1 Horizontal Alignment View

The following diagram provides the standard horizontal Swiss Cheese representation showing how SDB disrupts hazard trajectory alignment during double-train events.

Figure 5 — Horizontal alignment view. Left: enlarged holes align during double-train event without SDB. Right: SDB layer disrupts alignment chain through both an additional defense slice and reduced adjacent-layer failure probabilities.