Greg Morse
In September 1997, a fatal collision occurred after a signal was passed at danger at Southall. GREG MORSE looks at the causes - both immediate and underlying - and asks what the industry is doing about SPADs 20 years on
“Harrison rammed on the brake. There was nothing more he could do. He left his seat and hid behind the bulkhead door. By the time he emerged again, his train would be in disarray - six people would be dead.”
Nine miles out. Nine miles from Paddington. You wouldn’t know as you passed today, your train cruising at a hundred or so as it comes into the capital from Truro or Taunton, Westbury or Weston-super-Mare. You wouldn’t know as Southall flashes by, and you glance over at the old depot to glimpse
Bodmin or Sir Nigel Gresley steaming up, or a ‘47’ or ‘33’ standing by. Twenty years ago it was different - 20 years ago the outlook was darker.
Suppose it’s 1997… Friday September 19. You’re on the 1032 from Swansea, and you’d had a pleasant enough time of it since you got on at Reading. No problems, no worries, just you and your paper sitting quietly by the window somewhere near the back in Standard Class. There had been a bit of slow running - speed restrictions, you’d presumed (rightly) - but Slough had slipped by, so had Langley, so had Iver, West Drayton, Hayes & Harlington.
You felt the train was performing well. You couldn’t know its protection systems weren’t working, couldn’t know the signaller back at Slough was setting a route for a train of empty hoppers to cross over in front of you. Your driver hadn’t banked on it either…
At around 1310, Larry Harrison started packing up his holdall with his diagram and notices.
Rounding the left-hander ahead of Southall, he suddenly saw a red signal ahead. As the lines straightened in front of him, he saw something else - a Class 59 at what he’d later describe as ‘a funny angle’. A collision was inevitable.
Harrison rammed on the brake. He knew there was nothing more he could do. He left his seat and hid behind the bulkhead door. By the time he emerged again, his train would be in disarray, six people would be dead (with another soon to join them) and 139 would be injured. By seven that evening, he’d be arrested, too.
Many of the passengers were journalists returning from a vote on Welsh devolution. One, BBC researcher Nick Sutton, said that as he left the train, he “saw a body lying by the side of the tracks. No one was touching it. His shirt was ripped and there was blood all over him ... Everyone was shocked.”
Dr Michael Hellier, from Aldbourne in Wiltshire, suffered cuts to his head and almost lost an eye. He told reporters how there’d been “a tremendous bang and everything went black”. “Something hit me very hard on the head,” he added. “I was thrown across the compartment as the coach rolled over, and my first thought was that I was dreaming. Then I realised it was not a dream.”
It wasn’t: the leading power car had ploughed into the side of the freight train’s seventh hopper, before striking the eighth and successive wagons, causing them quickly to derail.
The leading coach became detached, fell on its side and slid along the ballast before colliding with an OLE mast. The second coach struck the rear of the freight, the impact lifting it and the last wagon into the air before the latter was trapped by another mast, causing it to come down on the former, which was
in turn jack-knifed by the momentum of the coach behind.
Inside half an hour, around 100 rescue workers had reached the scene. Air ambulances took the seriously injured to hospital, while firefighters quelled the flames in front of and beneath the HST, before moving in with cutting equipment to free the 16 who were trapped. One rescue worker marvelled that more hadn’t been killed, such was the damage caused to the carriages. Andy Reynolds, Assistant Divisional Officer with the London Fire Brigade, called it “a scene of complete carnage”.
Deputy Prime Minister John Prescott was soon there to offer his condolences to the relatives and friends of the dead. “I have talked to the Railway Inspectorate,” he said. “They have inspectors on site and will make a detailed examination to establish why the accident happened. I have asked for an urgent report on the crash. In the meantime, if there are any immediate lessons to be learned, we will of course take the appropriate action in the interests of safety.”
Jimmy Knapp, leader of the RMT union, demanded that the inquiries consider whether the fragmentation of the rail industry had been a factor, this being close to the end of the privatisation process that split one company into over a hundred.
Railtrack’s Chief Executive John Edmonds kept his options open. “We are content professionally that we have a proper system of maintenance,” he told the media. “But clearly there has been a major fault somewhere. It’s conceivable there was a technical failure and it’s also conceivable there was a human error.” His words were to prove more prophetic than he probably realised.
A spokesman for the British Transport Police said Harrison had attended Southall Police Station voluntarily, passed a breathalyser test and was interviewed before being released on police bail. He had been questioned in connection with manslaughter charges, but not actually charged. Alan Bricker, the driver of the freight train, was also questioned before his release.
As Railtrack inspectors began to examine the wreckage, it was announced that the Health and Safety Executive (HSE) would hold a public inquiry. As the players gathered to play their parts, there was speculation about the signaller routeing a train across the path of an express, as well as speculation about Harrison after it was reported that he’d been spotted pulling in to Bristol Parkway with both feet on the driving desk.
The problem for Harrison was that while his record was excellent - unblemished bar a couple of slow-speed SPADs (Signals Passed at Danger) in the 1970s and an incident in 1996 when he’d set off without the ‘right away’ - he had not only passed SN254 signal at red, but had also unheeded SN270 (yellow) and SN280 (double yellow) in the run-up. In the following April, those manslaughter charges would return.
By this time, the public inquiry proceedings had begun. Chaired by lawyer, arbiter and academic Professor John Uff QC, it would reveal the accident to have been - to some extent - “classic James Reason”. Reason had theorised a company or industry’s defence mechanisms against failure to be a series of barriers, but they - like slices of Swiss cheese - usually have holes or hitherto unrecognised weaknesses in them. When all the holes in each of the slices align, it creates a “trajectory of opportunity”, allowing a hazard to pass through to an accident.
Most accidents are thus multi-causal. In this case, while the ‘SPAD’ was clearly the “immediate cause”, there would have been several underlying causes, the absence of some or all of which might have prevented the collision from occurring regardless of Harrison’s final act (or inaction).
That said, Uff spent many pages deliberating the driver’s behaviour… and the weight of his bag. The issue here was that the bag could have been used to hold down the driver’s safety device (DSD) pedal - at least it could, according to the British Transport Police. Harrison chose to use a sports bag instead of the smaller ‘railway issue’ used for carrying Bardic lamps, hi-vis vests, notices, keys, food and so on. The bag recovered after the crash was “found to contain two cans of fizzy drink and a railway issue metal vacuum flask, together with a jar of tea bags”.
Harrison’s preference “was for decaffeinated tea”, the report went on. “Why, then, did the bag also contain soft drinks?” Harrison said he “occasionally preferred this when he wanted a long drink”.
Uff wrote that the explanation seemed “plausible enough”, although some investigators had been concerned that he had deliberately weighted the bag “in order to be able to use it to hold down the DSD pedal”, which would have left him “around 55 seconds between pulses”, during which “he could stand up, stretch and carry out other activities inconsistent with keeping a proper lookout”. The trouble was the bag wasn’t heavy enough to depress the pedal or even hold it down.
In the event, the inquiry concluded that there wasn’t enough evidence that Harrison had been “deliberately misusing the train”. Indeed, the “most likely explanation” was that “he was involuntarily inattentive either for
The HST was also fitted with Automatic Train Protection (ATP), although as it was not functioning that day, arguably it might as well have not been there.
two periods of seven and ten seconds or for one longer period, sufficient to pass signals SN280 and 270” without observing, or at least registering, their aspects and meaning. It was possible that Harrison had been “lulled into inattention between the regular pulses of the DVD”. He may indeed have “microslept”.
Why so much speculation? Harrison had done himself no favours in driving with one foot (or two) up on the desk. It was a rash thing to do, it had rattled the passengers who’d reported it, and it lent some weight to the need to consider the matter more fully. It was unwise, it was unprofessional, but it didn’t make him a criminal - particularly not when there were many systemic failings also contributing to the accident.
Take the signals, for example. As Stanley Hall pointed out in Hidden Dangers (1999), long-range sighting of SN280 was “restricted by an overbridge at [Hayes & Harlington] and the gentle left-hand curve of the line”, while SN270 was “grossly misaligned”, being “focussed into the ground approximatley 90 yards from the signal instead of at driver’s eye level 220 yards away”. Hall says the beam of the latter’s single yellow would have been in
Harrison’s view “for less than one second at the speed at which he was travelling”.
The inquiry disagreed, citing expert testimony - and three drivers whose trains preceded Harrison’s on the day of the accident (all of whom saw all the signals in question, at green). “In the light of this evidence” (inter alia), wrote Uff, “it appears to be the case that signal SN270, while incorrectly aligned, was adequately visible […] to a driver keeping a proper lookout”.
Regardless of Uff, we have a situation in which driver inattention coupled with less than optimal signal sighting (in at least one case) may have combined. Add now a change in traffic emphasis. In BR days, says Christian Wolmar in On
the Wrong Line (2005), “high-speed passenger trains always had priority over goods trains, which sometimes sat in sidings for a long time before being allowed to proceed”. The first post-privatisation regulator changed that “after consultation with the industry” to create “a system of minimum overall delay”. There was scant evidence that this policy change affected the course of events on September 19 1997, and Uff was unable to conclude it to have had any safety implications.
The story of train protection in Britain began with a fatal SPAD and collision at Slough on June 16 1900, the most disturbing thing about which being not that the driver hadn’t obeyed the signals, but that he couldn’t explain why. In response, the Great Western Railway developed apparatus that would sound a bell in the cab if a Distant signal was ‘clear’ and a siren if it was at ‘caution’. This recognised that - as trains were getting faster - distant signals were becoming more important, as they gave drivers advance warning of the need to start slowing for a Stop signal up ahead.
Trialled in 1906, the equipment was later developed so that if a driver passed a Distant at ‘caution’ and failed to acknowledge the warning, the brakes would automatically apply. In this form, what became known as Automatic Train Control would be fitted to 3,250 locomotives and 2,850 Great Western track miles by 1939.
On nationalisation in 1948, British Railways inherited all those ex-GWR miles, along with 37 between London and Southend, on which the LMS had installed a similar set-up, activated by magnetic induction. Seeking to make progress, BR entered into several studies, experiments and trials to find the form its own version should take. ATC was favoured at first, but its need for mechanical contact was thought to be a disadvantage at high speed. There was also a possibility of stray earth return currents in electrified areas leading to the equipment giving a false indication.
It was therefore decided to adapt the LMS system, although it proved very difficult to make the desired modifications and the design was not finalised until August 1952. Before the first test run could be made, its value was demonstrated by a SPAD and a multi-train collision at Harrow & Wealdstone (October 8 1952), an accident that claimed 112 lives.
The investigation confirmed that the ‘SPAD’ train had passed the colour-light Distant at ‘caution’ and two semaphore signals at ‘danger’. BR was urged to continue with its ‘Warning Control’ programme, having already announced that (as soon as the equipment was working satisfactorily) it would launch a five-year plan to fit 1,332 miles of main line, with a further 4,000 miles earmarked for the longer term.
‘Warning Control’ (or AWS, the Automatic Warning System) was fitted between King’s Cross and Grantham in 1956. By 1960 it had reached York, and would soon spread to other routes. In time, it would help reduce the number of fatalities in train accidents. It would have saved the lives lost at Southall. The trouble was, it wasn’t working that day in 1997. Why?
A fault had occurred in the leading power car (43173), when arriving at Oxford the evening before. Having been tripped by the ‘red’ at the platform end, the AWS brought the train to a stand part-way along. The driver was unable to reset it, so he isolated it and was given permission to take the set on to Paddington.
The trouble was the fault was never dealt with. At Oxford, the driver told the station supervisor, who told the signalman that the brakes had come on, but not why. This meant the fault didn’t get passed to Operations Control, Swindon, which would have meant it being logged in the Rail Vehicle Records System (RAVERS), thereby bringing it to the attention of Old Oak Common.
The driver did make an entry in 43173’s ‘fault book’, but when he took the train ECS to the depot, he didn’t fill in a defect report or an incident report form - either would have plugged the gap left by the ‘comms’ error and made sure the fault ended up in RAVERS. As it was, the only record of 43173’s AWS problem was in that book, a book to which the fitters came late as they had other faults to deal with.
Old Oak had been reorganised after GWT took it over in February 1996. Staff numbers had been cut and (as Uff put it) the men “were working under more pressure, and cannot have been motivated to spend more than the minimum time necessary to carry out
The action of the signaller in stopping an express to allow a slow freight to cross in front of it was criticised.
etc 1974 that it had failed to ensure “that the public were not exposed to risks to their health and safety”. It was fined £1.5 million.
The action of the signaller in stopping an express to allow a slow freight to cross in front of it was criticised, and the delay minimising policy that had allowed it was reversed by Tom Winsor (as Regulator) in November 2000. The fact that there was no requirement for the signaller to have been informed that the HST was in service with its AWS isolated was dealt with by a Rule Book amendment that remains to this day.
Another key point identified by Uff was that drivers had become increasingly reliant on AWS with single-manning and high speeds, and that it was no longer acceptable to run trains at full speed if the equipment was out of action. The rules here were also changed, such that if AWS be isolated, then a train may only run at high speed with a competent person accompanying the driver in the cab. This person must have full knowledge of the route and know how to stop the train.
By the time Uff’s report had been published, another fatal SPAD incident had occurred - also on the Great Western Main Line, this time at Ladbroke Grove (see panel). This second accident led to a joint report into train protection systems, headed by Uff and Lord Cullen, who was leading the Ladbroke Grove inquiry. Their report, published in January 2001, said that both AWS and ATP “now represent old technology”.
It continued: “As a result of other systems now being developed, there is no longer any serious demand for general fitment of [ATP]”. One of those ‘other systems’ was the Train Protection and Warning System (TPWS), which had been conceived as a development of AWS by a joint British Rail/Railtrack working group in 1994 after it had been concluded that the nationwide installation of ATP was not reasonably practicable.
TPWS was indeed cheaper than ATP, but like ATP it also improved on AWS by automatically applying the brakes on a train that has passed a fitted signal at ‘danger’ or is approaching one too fast.
Successful trials had been conducted between 1997 and 1999, with wide-scale installation beginning from the early part of 2000 and completed around 2004. The joint inquiry supported the programme, but noted that its benefits were plainly limited, as “despite the substantial expenditure that it represents, it will still permit a proportion of ATP-preventable accidents to occur”.
Clearly, the inquiry saw TPWS as an interim “better-than-nothing” solution, pending the introduction of the European Train Control System (ETCS), which provides ATP functionality, and which they anticipated being rolled out from around 2008.
At the time, concerns over TPWS mainly related to its perceived lack of effectiveness at speeds over 70mph. But although it would slow a train significantly, the system was later improved (‘TPWS+’) to incorporate additional overspeed sensors, thereby making it effective up to 100mph.
TPWS is now well-established and has played a recognisably large part in cutting the numbers of SPADs from around 500 a year to fewer than 300 (the vast majority totally benign) on a railway that’s getting ever busier. Yet while SPADs are now relatively low in frequency, one occasionally has the potential for high-consequence loss. With this in mind, and ahead of wider ETCS implementation, an industry-wide steering group continues to consider whether TPWS installation has reduced the risk as far as possible.
Elsewhere, the introduction of LEDs has greatly enhanced the conspicuousness of many signals, while the potential risk from overruns is now considered following incidents, before service adjustments and at the design stage of new signaling schemes.
In addition to these technical solutions, the industry has taken significant steps towards a better understanding of the human behaviours that can result in a driver failing to stop at a ‘red’. As recently as the Purley SPAD of 1989, it was apparent that many thought the driver to be solely responsible, despite it later (in 2007) being concluded that there was “something about the infrastructure of this particular junction [that] was causing mistakes to be made”.
RSSB (Rail Safety & Standards Board) is currently considering the human element of the SPAD phenomenon more deeply, while its Board agreed the need to develop a strategy for the continued risk management of SPADs, in order to co-ordinate effort to drive it down further.
On the point of publication, this strategy will pool industry knowledge and good practice in SPAD management, and consider future mitigation before the widespread installation of ECTS. It will also be proportionate to the risks SPADs present to the industry in relation to other train accident precursors.
Managing SPAD risk and mitigation has been one of the industry’s major success stories since 2000. The industry means to make sure this continues. After all, it only takes one SPAD to make a Southall… and no one wants that.