Incident: Subway Car Door Software Calibration Failure Incident.

Published Date: 2020-01-08

Postmortem Analysis
Timeline 1. The software failure incident involving the new subway cars happened in January 2020 as per the article published on January 8, 2020 [94215].
System 1. R-179 subway cars' doors [94215] 2. Software defects in the R-179 subway cars [94215]
Responsible Organization 1. Bombardier - The software failure incident was caused by the doors of the R-179 subway cars not being properly calibrated by a supplier, Nanjing Kangni Mechanical & Electrical of China, which was identified during Bombardier's own investigation [94215].
Impacted Organization 1. Metropolitan Transportation Authority (MTA) [94215] 2. New York City Transit Authority [94215] 3. Bombardier (Canadian manufacturing giant) [94215]
Software Causes 1. The software causes of the failure incident were related to software defects in the new subway cars, specifically in the doors not being properly calibrated by the supplier, Nanjing Kangni Mechanical & Electrical of China [94215].
Non-software Causes 1. The doors of the subway cars were not properly calibrated by the supplier, Nanjing Kangni Mechanical & Electrical of China, leading to concerns that doors could open while trains were moving [94215]. 2. Design flaws in the subway cars, including issues with the speedometer visibility, uncomfortable master controller, and narrow space between cars, were reported by transit workers [94215]. 3. The subway cars broke down more often than older ones, indicating potential manufacturing or design issues with the new cars [94215]. 4. Delays in delivering the new subway cars by Bombardier, the manufacturer, caused the authority to incur additional costs to keep old cars in service [94215].
Impacts 1. The software failure incident led to the abrupt removal of 298 new subway cars from service, causing a significant setback in the authority's effort to modernize the subway system [94215]. 2. The removal of the faulty cars resulted in trains running less frequently on the J and Z lines, impacting the regular subway service [94215]. 3. The delays and design flaws in the software of the new subway cars caused the contract's completion to be delayed by three years, costing the authority $35 million to keep old cars in service [94215]. 4. The software defects in the new subway cars led to several cars being pulled from service in the past, highlighting the recurring nature of the software-related issues [94215].
Preventions 1. Proper calibration and testing of the doors by the supplier, Nanjing Kangni Mechanical & Electrical of China, could have prevented the software failure incident [94215]. 2. More rigorous oversight and accountability by the Metropolitan Transportation Authority towards the vendor, Bombardier, could have helped prevent the software failure incident [94215]. 3. Timely identification and rectification of software defects during the initial testing phase of the new subway cars could have prevented the software failure incident [94215].
Fixes 1. Proper calibration of the doors by the supplier, Nanjing Kangni Mechanical & Electrical of China, could fix the software failure incident [94215]. 2. Making adjustments to ensure the safe and reliable performance of the doors for the entire fleet of R-179 cars could address the software failure incident [94215].
References 1. Metropolitan Transportation Authority officials 2. Andy Byford, President of the New York City Transit Authority 3. Bombardier spokeswoman 4. Audit by Scott M. Stringer, the city comptroller

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the faulty subway cars has happened again within the same organization, the Metropolitan Transportation Authority (MTA). The incident mentioned in the article is not the first one involving the new R-179 subway cars. Several cars were previously pulled from service last January due to software defects [94215]. (b) The software failure incident related to the faulty subway cars has also happened with the supplier of the doors, Nanjing Kangni Mechanical & Electrical of China. The Bombardier spokeswoman mentioned that the doors had not been properly calibrated by this supplier, leading to the software failure incident [94215].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the article. The audit by Scott M. Stringer, the city comptroller, outlined problems with the design of the R-179 subway cars from Bombardier, which led to delays and defects in the software. The audit faulted Bombardier for performance issues and highlighted that the authority had not sufficiently held the company accountable for the design flaws [94215]. (b) The software failure incident related to the operation phase is also mentioned in the article. The article discusses how the new R-179 subway cars experienced operational issues, including doors that were not properly calibrated by a supplier, leading to concerns that doors could open while trains were in motion. This operational failure prompted the Metropolitan Transportation Authority to pull the cars out of service for inspection and replacement [94215].
Boundary (Internal/External) within_system (a) within_system: The software failure incident related to the subway cars being pulled out of service was primarily due to contributing factors that originated from within the system. The article mentions that the doors of the new subway cars had not been properly calibrated by a supplier, Nanjing Kangni Mechanical & Electrical of China, which led to concerns that doors could open while trains were in motion [94215]. Additionally, the audit by the city comptroller faulted Bombardier for performance issues and design flaws, indicating internal problems with the software and design of the cars [94215]. (b) outside_system: There is no specific mention in the articles of contributing factors that originated from outside the system leading to the software failure incident.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident related to non-human actions in this case was due to the doors of the new subway cars not being properly calibrated by the supplier, Nanjing Kangni Mechanical & Electrical of China, as mentioned in Article 94215. This led to concerns that the doors could open while trains were in motion, prompting the Metropolitan Transportation Authority to pull the cars out of service. (b) The software failure incident related to human actions in this case was attributed to Bombardier, the Canadian manufacturing giant responsible for the contract to supply the new subway cars. The audit by Scott M. Stringer outlined performance issues and design flaws with the cars, indicating that Bombardier had not met the contract terms and had not been sufficiently held accountable by the authority. This failure was a result of human actions in the form of delays, design flaws, and performance issues on the part of the supplier.
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The article mentions that the doors of the subway cars had not been properly calibrated by a supplier, Nanjing Kangni Mechanical & Electrical of China, which is a hardware-related issue [94215]. (b) The software failure incident related to software: - Several cars were pulled from service last January because of software defects, indicating a software-related issue [94215].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident related to the subway cars in New York City was non-malicious. The incident was primarily attributed to defects in the doors of the new subway cars, specifically related to the doors potentially opening while the trains were in motion. This issue was traced back to a problem with the calibration of the doors by a supplier, Nanjing Kangni Mechanical & Electrical of China, as mentioned in the article [94215]. The failure was not caused by any malicious intent but rather by a flaw in the manufacturing process. (b) The software failure incident was also exacerbated by non-malicious factors such as delays and design flaws in the contract between the Metropolitan Transportation Authority and Bombardier, the manufacturer of the subway cars. The audit by the city comptroller highlighted missed deadlines and design problems that led to delays in the contract's completion, costing the authority millions of dollars to keep old cars in service [94215]. These non-malicious factors contributed to the overall failure of the software system in the subway cars.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident related to the subway cars being pulled out of service in New York City was primarily due to poor decisions made during the procurement and oversight processes. The contract between the Metropolitan Transportation Authority (MTA) and Bombardier, the Canadian manufacturing giant, was plagued with delays, design flaws, and performance issues since the delivery of the R-179 cars in 2016 [94215]. The audit by the city comptroller faulted Bombardier for performance issues and highlighted that the authority had not sufficiently held the company accountable for the problems [94215]. The delays in delivering the cars led to additional costs for the authority and forced them to keep old cars in service, costing $35 million [94215]. The poor decisions made during the contract management and oversight processes ultimately resulted in the software failure incident where several cars had to be pulled from service due to defects. (b) The software failure incident can also be attributed to accidental decisions or mistakes made during the procurement and manufacturing processes. The Bombardier spokeswoman mentioned that the doors of the R-179 cars had not been properly calibrated by a supplier, Nanjing Kangni Mechanical & Electrical of China, which led to the software failure incident of doors potentially opening while trains were in motion [94215]. This indicates that unintentional errors or mistakes in the calibration process contributed to the failure of the software in the subway cars.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the article as it mentions issues with the new subway cars, known as R-179s, which were part of a problem-plagued contract between the Metropolitan Transportation Authority (MTA) and Bombardier. The audit by the city comptroller faulted Bombardier for performance issues and highlighted that the authority had not sufficiently held the company accountable for the delays and design flaws in the cars [94215]. (b) The software failure incident related to accidental factors is seen in the article when it mentions that the doors of the new subway cars had not been properly calibrated by a supplier, Nanjing Kangni Mechanical & Electrical of China, leading to concerns that doors could open while trains were in motion. This issue was identified during Bombardier's own investigation of the cars, prompting the MTA to take action [94215].
Duration temporary The software failure incident related to the subway cars in New York City can be categorized as a temporary failure. The incident involved issues with the doors of the new R-179 subway cars, which were not properly calibrated by a supplier, Nanjing Kangni Mechanical & Electrical of China. This specific contributing factor introduced by the supplier led to the doors potentially opening while trains were in motion, prompting the Metropolitan Transportation Authority to pull the cars out of service [94215]. Additionally, the audit by the city comptroller highlighted software defects in several cars that were pulled from service last January, indicating specific circumstances contributing to the temporary failure of the software [94215].
Behaviour crash, omission, other (a) crash: The software failure incident related to the subway cars involved a crash where the doors could open while trains were moving, leading to the entire fleet of new subway cars being pulled out of service [94215]. (b) omission: The software failure incident also involved an omission where the doors of the new subway cars were not properly calibrated by a supplier, leading to the defects in the doors opening while trains were in motion [94215]. (c) timing: There is no specific information in the articles indicating a timing-related software failure incident. (d) value: The software failure incident did not involve the system performing its intended functions incorrectly. (e) byzantine: The software failure incident did not involve the system behaving erroneously with inconsistent responses and interactions. (f) other: The other behavior in this software failure incident could be related to a design flaw in the software that led to the repeated issues with the performance of the subway cars, as highlighted in the audit by the city comptroller [94215].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence theoretical_consequence, unknown (a) unknown (b) unknown (c) unknown (d) unknown (e) unknown (f) unknown (g) unknown (h) Theoretical consequences of the software failure were discussed in the articles. The software failure incident with the subway cars in New York City raised concerns about doors potentially opening while trains were in motion. This could have led to a serious safety issue for riders, as mentioned by Nick Sifuentes, the executive director of Tri-State Transportation Campaign, who stated, "There is nothing more terrifying than the idea of a door flying open when you’re leaning against it" [94215]. (i) unknown
Domain transportation, manufacturing, finance (a) The failed system in this incident was related to the transportation industry, specifically the New York City subway system. The software failure incident involved the new subway cars, known as R-179s, which were pulled out of service due to concerns that doors could open while trains were in motion [94215]. The Metropolitan Transportation Authority (MTA) was overseeing the modernization of the subway system's infrastructure, and the problematic cars were part of a contract with Bombardier, a Canadian manufacturing company, to upgrade the subway car fleet [94215]. (h) The failed system also had implications for the finance industry as the delays and design flaws in the delivery of the new subway cars resulted in financial losses for the MTA. The audit by the city comptroller highlighted performance issues with Bombardier and the authority's failure to hold the company accountable, leading to delays in the contract's completion and additional costs to keep old cars in service [94215]. (m) Additionally, the software failure incident had broader implications beyond the transportation and finance industries. It raised concerns about the oversight of vendors, accountability in contracts, and the impact on public safety. The incident prompted discussions about holding contractors accountable and the potential consequences of disqualifying them from future projects with the MTA [94215].

Sources

Back to List