Philip Haigh
PHILIP HAIGH examines a Rail Accident Investigation Branch report that draws similarities between a derailment at Waterloo in 2017, and the Clapham crash that claimed the lives of 35 people 30 years ago
Safety procedures.
ANY student of railway accidents will know how risks can slip through the smallest gap.
October 2001’s fatal collision near Heck happened after Gary Hart’s vehicle careered from the M62 onto the East Coast Main Line. His tyre marks passed tantalisingly close to a crash barrier that would surely have altered his path and left him the only one in his accident. Ten people died.
At Polmont in 1984, a cow got through a boundary fence onto the railway, and was struck by an Edinburgh-Glasgow express. Part of the animal passed through the two-inch gap under the lifeguard of the leading wheels, to lift one from the rail at 85mph. Thirteen people died.
During resignalling at Clapham in 1988, a signal technician correctly disconnected a wire in a relay room. But he didn’t cut it back or tape over its bare end, so when it gradually returned to its previous position, it caused a false feed that cleared a signal that should have been red. When a train passed this signal, it hit another and a third struck the wreckage. Thirty-five people died.
Clapham was a watershed in railway safety. It led to significant changes in the way that signalling alterations are planned, implemented and checked. In short, the designer doesn’t install his work and the installer doesn’t test what he has installed. Nor can the designer do the testing. Each person’s work is checked separately.
Testing is further divided into three sections. Verification testers check visually that what’s been installed matches the plan. Functional testers check that it works as planned. Principles testers check that it complies with signalling principles. Each section must be done a by separate team or person.
November’s report from the Rail Accident Investigation Branch into a derailment at Waterloo in August 2017 ( RAIL 834) likened it to Clapham, because of the errors made as changes took place to signalling.
But Clapham was over 30 years ago. RAIB added: “The major changes to signalling design, installation and testing processes triggered by the Clapham accident remain today, but RAIB is concerned that the need for rigorous application is being forgotten as people with personal knowledge of this tragedy retire or move away from front line jobs.
“This deep-seated, tacit knowledge is part of the corporate memory vital to achieve safety. Loss of this type of knowledge as previous generations leave the industry is a risk which must be addressed by organisations committed to achieving high levels of safety.”
The changes made after Clapham remain in place today. But it seems that the reasons for them might be fading from memory. At Waterloo, a principles tester asked a functional tester to solve a problem in Waterloo’s relay room. Solving this problem involved designing an alteration to the signalling. RAIB believes the functional tester also installed the wires that solved the problem.
RAIB reports conflicting evidence, but after looking at records of who signed in and out of the relay room, it says: “It is likely therefore that the installers were not present, and were probably on their lunch break, when the uncontrolled wires were fitted. The site signingin records also confirm that the functional tester was on site when the relays began working together [the result of the alteration].
“Both installers stated that they had not installed any blue wires during their work in Waterloo relay room. They also stated that they could not have fitted wires without labels as, without these, they would not have known where to run the wires to and from. This evidence, together with the signing-in and out records, indicate that it is likely that the uncontrolled wiring was installed by the functional tester.”
This breaks the rules of signalling alterations and the split between design, installation and testing.
The need to install these extra wires exposed another problem. Waterloo’s work was part of a wider project to increase the station’s capacity, chiefly by making four platforms longer. This involved changing the signalling, and to help this a test desk was placed into Waterloo relay room to simulate parts of the signalling system. This would help testers check changes to interlocking before physical kit was installed on the railway - for example, the interlocking for a set of points before track gangs had installed those points.
The design of this test desk had to match Waterloo’s interlocking. If other parts of the project changed that interlocking, then the test
desk would no longer work properly.
Another part of the project did change the interlocking for the points on which the train derailed, to bring it into line with modern practice. But RAIB found no effective coordination to make sure the test desk reflected changes to interlocking.
It suggests that had the 664 wires connecting the test desk to the interlocking been shown on drawings, as they should have been, then it would have been obvious to those redesigning the interlocking that their changes would affect the test desk.
This all created the situation that the functional tester found. He could have solved the problem using temporary wires (called straps) specifically provided to testers to create temporary changes. Using these straps must be recorded in a log, creating a prompt to remove them when finished.
Or he could have created a test log that describes the problem, and is then sent to the tester-in-charge for forwarding to designers to plan the modification needed and its removal when no longer required.
The derailment could still have been prevented had the points been clipped and padlocked to stop them moving. These points were more complex than some, and consisted of three sets of movable blades. Only one set was clipped and locked because it was inside a possession. The other two sets were outside the possession and used by passenger trains. A risk workshop identified the need to clip them, but did not assign the task to an individual.
The tester-in-charge told RAIB that he assumed the possession management staff would clip them, but they only clipped the points that the railway rule book required them to. This did not include the fateful set.
This was the worst of both worlds. Those extra wires in the relay room fooled the interlocking into thinking all three sets of movable blades were in their correct position for the train. In reality, only the clipped set was. The fateful set was left in neither one position nor the other, but the interlocking thought they were set correctly because it was seeing the electrical feed from the clipped set.
The added wires and missing clips are direct reasons for the train’s derailment. But behind them lie soft or non-technical skills of the way people think, act and relate to each other.
Little wonder that RAIB says: “When undertaking complex tasks in a safety-critical environment, it is vital that individuals have a good understanding of the equipment they are working with and the principles that underpin the mandated procedures. This understanding is essential for them to properly appreciate the consequences of the actions they take.”
RAIB reports do not assign blame, responsibility or liability. But its Waterloo report says: “The actions of the functional tester and the actions of both the contractor’s responsible engineer and project engineer indicate that appropriate non-technical skills were not applied.”
Promoting the right soft skills comes down to culture. Testing them is harder than testing technical skills. RAIB found that Network Rail looked for technical competence and skills for those responsible for Waterloo’s work, rather than also looking for those softer skills that ensure that people do the right things for the right reasons in the right way.
It is this that prompts RAIB to specifically remind today’s railway managers and staff of Clapham’s fatal accident. That memories of it are fading are reinforced by another recent incident at Cardiff, where a set of redundant points was left in place and unsecured following a possession. A driver noticed they were not in the right position and stopped his train short of them.
RAIB found a culture that didn’t think widely about risks faced. As with Waterloo, responsibility for clipping points was not clearly allocated.
Train operating companies train their staff to help passengers and to deal with difficult ones. Perhaps it’s time for Network Rail and its contractors to embrace similar soft skills training?