Philip Haigh

PHILIP HAIGH ex­am­ines a Rail Ac­ci­dent In­ves­ti­ga­tion Branch re­port that draws sim­i­lar­i­ties be­tween a de­rail­ment at Water­loo in 2017, and the Clapham crash that claimed the lives of 35 peo­ple 30 years ago

Rail (UK) - - Contents -

Safety pro­ce­dures.

ANY stu­dent of rail­way ac­ci­dents will know how risks can slip through the small­est gap.

Oc­to­ber 2001’s fa­tal col­li­sion near Heck hap­pened af­ter Gary Hart’s ve­hi­cle ca­reered from the M62 onto the East Coast Main Line. His tyre marks passed tan­ta­lis­ingly close to a crash bar­rier that would surely have al­tered his path and left him the only one in his ac­ci­dent. Ten peo­ple died.

At Pol­mont in 1984, a cow got through a bound­ary fence onto the rail­way, and was struck by an Ed­in­burgh-Glas­gow ex­press. Part of the an­i­mal passed through the two-inch gap un­der the life­guard of the lead­ing wheels, to lift one from the rail at 85mph. Thir­teen peo­ple died.

Dur­ing res­ig­nalling at Clapham in 1988, a sig­nal tech­ni­cian cor­rectly dis­con­nected a wire in a re­lay room. But he didn’t cut it back or tape over its bare end, so when it grad­u­ally re­turned to its pre­vi­ous po­si­tion, it caused a false feed that cleared a sig­nal that should have been red. When a train passed this sig­nal, it hit an­other and a third struck the wreck­age. Thirty-five peo­ple died.

Clapham was a wa­ter­shed in rail­way safety. It led to sig­nif­i­cant changes in the way that sig­nalling al­ter­ations are planned, im­ple­mented and checked. In short, the de­signer doesn’t in­stall his work and the in­staller doesn’t test what he has in­stalled. Nor can the de­signer do the test­ing. Each per­son’s work is checked sep­a­rately.

Test­ing is fur­ther di­vided into three sec­tions. Ver­i­fi­ca­tion testers check vis­ually that what’s been in­stalled matches the plan. Func­tional testers check that it works as planned. Prin­ci­ples testers check that it com­plies with sig­nalling prin­ci­ples. Each sec­tion must be done a by sep­a­rate team or per­son.

Novem­ber’s re­port from the Rail Ac­ci­dent In­ves­ti­ga­tion Branch into a de­rail­ment at Water­loo in Au­gust 2017 ( RAIL 834) likened it to Clapham, be­cause of the er­rors made as changes took place to sig­nalling.

But Clapham was over 30 years ago. RAIB added: “The ma­jor changes to sig­nalling de­sign, in­stal­la­tion and test­ing pro­cesses trig­gered by the Clapham ac­ci­dent re­main to­day, but RAIB is con­cerned that the need for rig­or­ous ap­pli­ca­tion is be­ing for­got­ten as peo­ple with per­sonal knowl­edge of this tragedy re­tire or move away from front line jobs.

“This deep-seated, tacit knowl­edge is part of the cor­po­rate mem­ory vi­tal to achieve safety. Loss of this type of knowl­edge as pre­vi­ous gen­er­a­tions leave the in­dus­try is a risk which must be ad­dressed by or­gan­i­sa­tions com­mit­ted to achiev­ing high lev­els of safety.”

The changes made af­ter Clapham re­main in place to­day. But it seems that the rea­sons for them might be fad­ing from mem­ory. At Water­loo, a prin­ci­ples tester asked a func­tional tester to solve a prob­lem in Water­loo’s re­lay room. Solv­ing this prob­lem in­volved de­sign­ing an al­ter­ation to the sig­nalling. RAIB be­lieves the func­tional tester also in­stalled the wires that solved the prob­lem.

RAIB re­ports con­flict­ing ev­i­dence, but af­ter look­ing at records of who signed in and out of the re­lay room, it says: “It is likely there­fore that the in­stall­ers were not present, and were prob­a­bly on their lunch break, when the un­con­trolled wires were fit­ted. The site signingin records also con­firm that the func­tional tester was on site when the re­lays be­gan work­ing to­gether [the re­sult of the al­ter­ation].

“Both in­stall­ers stated that they had not in­stalled any blue wires dur­ing their work in Water­loo re­lay room. They also stated that they could not have fit­ted wires with­out la­bels as, with­out these, they would not have known where to run the wires to and from. This ev­i­dence, to­gether with the sign­ing-in and out records, in­di­cate that it is likely that the un­con­trolled wiring was in­stalled by the func­tional tester.”

This breaks the rules of sig­nalling al­ter­ations and the split be­tween de­sign, in­stal­la­tion and test­ing.

The need to in­stall these ex­tra wires ex­posed an­other prob­lem. Water­loo’s work was part of a wider project to in­crease the sta­tion’s ca­pac­ity, chiefly by mak­ing four plat­forms longer. This in­volved chang­ing the sig­nalling, and to help this a test desk was placed into Water­loo re­lay room to sim­u­late parts of the sig­nalling sys­tem. This would help testers check changes to in­ter­lock­ing be­fore phys­i­cal kit was in­stalled on the rail­way - for ex­am­ple, the in­ter­lock­ing for a set of points be­fore track gangs had in­stalled those points.

The de­sign of this test desk had to match Water­loo’s in­ter­lock­ing. If other parts of the project changed that in­ter­lock­ing, then the test

desk would no longer work prop­erly.

An­other part of the project did change the in­ter­lock­ing for the points on which the train de­railed, to bring it into line with mod­ern prac­tice. But RAIB found no ef­fec­tive co­or­di­na­tion to make sure the test desk re­flected changes to in­ter­lock­ing.

It sug­gests that had the 664 wires con­nect­ing the test desk to the in­ter­lock­ing been shown on draw­ings, as they should have been, then it would have been ob­vi­ous to those re­design­ing the in­ter­lock­ing that their changes would af­fect the test desk.

This all cre­ated the sit­u­a­tion that the func­tional tester found. He could have solved the prob­lem us­ing tem­po­rary wires (called straps) specif­i­cally pro­vided to testers to cre­ate tem­po­rary changes. Us­ing these straps must be recorded in a log, cre­at­ing a prompt to re­move them when fin­ished.

Or he could have cre­ated a test log that de­scribes the prob­lem, and is then sent to the tester-in-charge for for­ward­ing to de­sign­ers to plan the mod­i­fi­ca­tion needed and its re­moval when no longer re­quired.

The de­rail­ment could still have been pre­vented had the points been clipped and pad­locked to stop them mov­ing. These points were more com­plex than some, and con­sisted of three sets of mov­able blades. Only one set was clipped and locked be­cause it was in­side a posses­sion. The other two sets were out­side the posses­sion and used by pas­sen­ger trains. A risk work­shop iden­ti­fied the need to clip them, but did not as­sign the task to an in­di­vid­ual.

The tester-in-charge told RAIB that he as­sumed the posses­sion man­age­ment staff would clip them, but they only clipped the points that the rail­way rule book re­quired them to. This did not in­clude the fate­ful set.

This was the worst of both worlds. Those ex­tra wires in the re­lay room fooled the in­ter­lock­ing into think­ing all three sets of mov­able blades were in their cor­rect po­si­tion for the train. In re­al­ity, only the clipped set was. The fate­ful set was left in nei­ther one po­si­tion nor the other, but the in­ter­lock­ing thought they were set cor­rectly be­cause it was see­ing the elec­tri­cal feed from the clipped set.

The added wires and miss­ing clips are di­rect rea­sons for the train’s de­rail­ment. But be­hind them lie soft or non-tech­ni­cal skills of the way peo­ple think, act and re­late to each other.

Lit­tle won­der that RAIB says: “When un­der­tak­ing com­plex tasks in a safety-crit­i­cal en­vi­ron­ment, it is vi­tal that in­di­vid­u­als have a good un­der­stand­ing of the equip­ment they are work­ing with and the prin­ci­ples that un­der­pin the man­dated pro­ce­dures. This un­der­stand­ing is es­sen­tial for them to prop­erly ap­pre­ci­ate the con­se­quences of the ac­tions they take.”

RAIB re­ports do not as­sign blame, re­spon­si­bil­ity or li­a­bil­ity. But its Water­loo re­port says: “The ac­tions of the func­tional tester and the ac­tions of both the con­trac­tor’s re­spon­si­ble en­gi­neer and project en­gi­neer in­di­cate that ap­pro­pri­ate non-tech­ni­cal skills were not ap­plied.”

Pro­mot­ing the right soft skills comes down to cul­ture. Test­ing them is harder than test­ing tech­ni­cal skills. RAIB found that Net­work Rail looked for tech­ni­cal com­pe­tence and skills for those re­spon­si­ble for Water­loo’s work, rather than also look­ing for those softer skills that en­sure that peo­ple do the right things for the right rea­sons in the right way.

It is this that prompts RAIB to specif­i­cally re­mind to­day’s rail­way man­agers and staff of Clapham’s fa­tal ac­ci­dent. That me­mories of it are fad­ing are re­in­forced by an­other re­cent in­ci­dent at Cardiff, where a set of re­dun­dant points was left in place and un­se­cured fol­low­ing a posses­sion. A driver no­ticed they were not in the right po­si­tion and stopped his train short of them.

RAIB found a cul­ture that didn’t think widely about risks faced. As with Water­loo, re­spon­si­bil­ity for clip­ping points was not clearly al­lo­cated.

Train op­er­at­ing com­pa­nies train their staff to help pas­sen­gers and to deal with dif­fi­cult ones. Per­haps it’s time for Net­work Rail and its con­trac­tors to em­brace sim­i­lar soft skills train­ing?


On Au­gust 15 2017, South West Trains 456015 rests at an an­gle at Lon­don Water­loo. It had de­railed mo­ments af­ter leav­ing the ter­mi­nus, strik­ing a bar­rier train.

Newspapers in English

Newspapers from UK

© PressReader. All rights reserved.