A nasty little collision between a passenger train and a Network Rail barrier train, that was protecting workers at Waterloo station, was the subject of a report in issue 156 (October 2017). Although the accident could have led to serious injury and even death, thankfully, it didn’t.
As a matter of course, the collision was referred to the Rail Accident Investigation Branch (RAIB), the independent railway accident investigation organisation for the UK that is concerned with the investigation of accidents and incidents on the national railway networks, to improve safety and prevent further accidents from occurring. Its investigations are entirely independent and are focused solely on safety improvements with no apportionment of blame or liability. RAIB does not enforce law, nor carry out prosecutions.
RAIB aims to identify the causes of accidents along with any other factors that contributed to the event or made the outcome worse, such as technical, operational factors or management system failings.
It can take many months for a full RAIB report to be published. This can be because of the depth and scale of the investigation, which may have to extend into further scope based on the initial findings. The time also has to allow for extensive stakeholder consultation. The RAIB, however, may issue safety bulletins and an interim report to share their findings. This happened with regards to a signalling issue at Waterloo in August 2017 and the full report has only now been published.
The initial report revealed that, on Tuesday 15 August 2017, the 05:40 to Guildford, a 10-car train made up of a combination of Class 455 and 456 units, pulled out of Platform 11 on time. Having reached a speed of 15mph, it veered to the left and struck a train of empty Network Rail wagons. Of the 23 passengers and two employees that were on the train, only three were treated at the scene by paramedics, and fortunately no one required hospital treatment.
An early investigation by the RAIB revealed that the points were misaligned and had directed the passenger train away from its intended route. The misalignment was a consequence of a temporary modification to the points’ control system. It was identified that the points were around mid-position as the train left the platform.
The full report has now identified the reasons why the temporary modifications had been left in place, and it makes some uncomfortable reading for the industry.
The wagons were deliberately placed to protect the workforce behind them from the live railway (and not a train entering the worksite). It was therefore a step well taken – without them the diverted train could have ploughed into people working on the station improvements. Had the points been clipped, however, there would not have been a derailment, which was another of the questions to be answered by the full report which was issued on 19 November 2018.
RAIB final report
The final investigation report identifies that the train was diverted away from its intended route by a set of points which were positioned incorrectly as a result of uncontrolled wiring added to the signalling system. This wiring was added to overcome a problem that arose because the test equipment design process had not allowed for alterations being made to the signalling system after the test equipment was designed.
Soon after moving away from the platform, the driver noticed that 1524 points were not correctly set and applied the train’s brakes. The collision occurred about three seconds after the brake application which had reduced the train’s speed to 13 mph (21 km/h). Drivers are not required, and not expected, to check point positions in these circumstances, therefore the driver was commended by RAIB for noticing that they were lying incorrectly and for his prompt brake application.
Immediately after the accident, the train driver made a GSM-R railway emergency call that caused an emergency stop message to be broadcast to all trains in the Waterloo area.
The Clapham Junction incident in 1988 occurred because a driver stopped to telephone and report a signalling equipment irregularity caused by uncontrolled wiring. The uncontrolled wiring resulted in signalling equipment not protecting the train. 35 people died when another train ran into the back of the stationary train. One recommendation from the Clapham Junction inquiry was for a nationwide driver radio system, which became GSM-R.
Summary of RAIB findings
The RAIB identified that, in the 2017 Waterloo incident, the train was signalled to run over a set of points which were not correctly positioned for the passage of the train. Uncontrolled wiring had been added to points-detection circuits, such that the position of 1524 points was incorrectly detected. This wiring was added during testing when the test desk was found to no longer simulate the detection of 1524 points correctly, a consequence of an incomplete design process.
The actions taken to make the test desk simulate the operation of the points correctly were not in line with the signalling works testing standard, and the uncontrolled wiring was not removed before train services restarted.
Furthermore, the actions of the functional tester were inconsistent with the competence expected of testers. Electrical disconnection, scotches and padlocked clips had not been used to secure the point ends in a safe position as required by the test plan.
In addition, the competence management processes had not addressed the full requirements of the roles undertaken by the staff responsible for the design, commissioning and testing of the signalling works, the relay room maintenance drawings did not provide a definitive description of the equipment in the relay room and the absence of the spur wires on the interlocking detailed design documents would have adversely affected the integrity of the final wire count.
The incident is a classic example of the ‘Swiss Cheese’ effect of hazard control measure failure. All the defence layers of design, checking, testing (any one of which should have been prevented by another control measure) had errors or deficiencies. When all the ‘holes’ in the cheese lined up’ the train was wrongly diverted.
Points not secured
The points had not been secured in the correct position because of a breakdown in communications and because the responsibility for securing the points had not been allocated effectively.
The list of points included in the project documentation included, among others, 1524A, 1524B and 1524C points. Securing of these points would have avoided them moving to an unsafe position, either due to a route setting error or to a wiring problem in the complex circuits being modified.
The requirement to secure the points was included in a risk workshop. The associated action was initially allocated to the tester in charge (TIC), but the risk register published later showed the owner as ‘project team’ with the TIC to supply the padlocks. There was then no individual named in the risk register as responsible for implementing the securing of the points.
The TIC prepared the signalling test plan, which detailed the testing process for the blockade, and the final version of which including a list of points to be secured. Testers in charge are responsible for the implementation of test plans and should check that all testers involved in the work are briefed and fully conversant with their duties. However, in this case, the TIC assumed that possession management staff would secure the points, so he did not instruct anyone to secure any points nor did he check, or instruct anyone else to check, that any points were secured.
The possession management staff had only been asked to secure points required by the railway rulebook to protect the blockade. These requirements do not include points on the blockade flank, such as 1524 points. Separately, an email from a project manager requested that points which would be under the engineering train should be secured to protect against inadvertent movement while the track circuits, which would normally prevent them moving, were disconnected. This led to 1524C points being secured, but not 1524A and 1524B point ends as they were not under the train.
RAIB said that the actions of a functional tester were inconsistent with the competence expected. As a consequence, the uncontrolled wiring was added without the safeguards required by the signalling works testing standards, and remained in place when the line was returned to service.
An underlying factor was that competence management processes operated by Network Rail and some of the contractors had not addressed the full requirements of the roles undertaken by the staff responsible for the design, testing and commissioning of the signalling works.
One of the most alarming facts, as observed by RAIB, was that there were certain similarities between the factors that caused the Waterloo accident and those which led to the serious accident at Clapham Junction 30 years ago in December 1988. The RAIB has therefore expressed the concern that some of the lessons identified by the public inquiry, chaired by Anthony Hidden QC following the Clapham Junction incident, may be fading from the railway industry’s collective memory.
The RAIB has made recommendations, addressed to Network Rail, to seek improvements in the depth of knowledge and the attitudes needed for signal designers, installers and testers to deliver work safely. There are also recommendations addressed to the suppliers involved, to seek development and monitoring of non-technical skills among the staff working for them.
The RAIB has also identified four learning points. One highlights the positive aspects of a plan intended to mitigate an unusually high risk of points being moved unintentionally. The others reinforce the need to follow established procedures, prompt staff to clearly allocate duties associated with unusual activities, and to remind staff that up-to-date signalling documentation must be available and easily identified in relay rooms and similar locations.
Corporate memory loss
Events at Waterloo, and the RAIB’s investigation of the serious irregularity at Cardiff East Junction that occurred on 29 December 2016, suggest that some in the railway industry are forgetting the lessons learnt from the 1988 Clapham Junction accident in which 35 people died.
At Cardiff East Junction (RAIB Report 15/201722), a set of redundant points was left unsecured in the railway when it was returned to service after an engineering possession. They were not secured because the team that was responsible for this activity did not identify all of the redundant points that required securing.
The major changes to signalling design, installation and testing processes triggered by the Clapham accident remain today, but the RAIB is concerned that the need for rigorous application is being forgotten as people with personal knowledge retire or move away from front line jobs.
“This deep-seated, tacit knowledge is part of the corporate memory vital to achieve safety,” the report states on page 46. “Loss of this type of knowledge as previous generations leave the industry is a risk which must be addressed by organisations committed to achieving high levels of safety.”
Normalisation of Deviance
The incidents at Waterloo and at Cardiff East Junction resulted from people taking actions which were inconsistent with the processes in which they had been assessed as competent. Had these processes been followed, the events would have been prevented.
The RAIB found no evidence that the staff and organisations involved at Waterloo and Cardiff lacked a commitment to safety. In this respect, the RAIB’s findings at Waterloo and Cardiff have much in common with this extract from the Clapham Junction Hidden report chapter 17 ‘Where things went wrong – The Lessons to be learned’:
The vital importance of this concept of absolute safety was acknowledged time and again in the evidence which the Court heard. This was perfectly understandable because it is so self-evident. The problem with such expressions of concern for safety was that the remainder of the evidence demonstrated beyond dispute two things:
(i) there was total sincerity on the part of all who spoke of safety in this way; but nevertheless
(ii) there was failure to carry those beliefs through from thought into deed…
The concern for safety was permitted to co-exist with working practices which… were positively dangerous.
The observation that people were committed to safety but were not working safely has also occurred in other industries and has been developed as a concept by the American sociologist Diane Vaughan and called “Normalisation of Deviance”.
She developed the theory when looking at where conflicts, mistakes, and disasters find their roots. She summarises her theory of normalisation of deviance as: “Social normalisation of deviance means that people within the organisation become so much accustomed to a deviant behaviour that they don’t consider it as deviant, despite the fact that they far exceed their own rules for the elementary safety.”
It is fortunate that the incident caused by the wiring error at Waterloo only resulted in a low-speed collision. The consequences could have been far worse and could have easily been a bigger disaster than Clapham Junction was in 1988.
Working practises and the safety record of the signalling industry have improved tremendously over the last 30 years, with complex projects being delivered safely and competently. It is to be hoped that the Waterloo incident does not create even more process and complexity, nor stifle the innovation and creativity the industry strives for.
All the required safe working practises are in place and the industry just needs to use the incidents at Cardiff and Waterloo as a ‘wake-up call’ and make sure everyone learns the lessons from the past, while at the same time delivering tomorrow’s railway safely.