Over the past 40 years, there has been a welcome, steadily declining trend in train accidents with passenger or workforce fatalities. However, while it has now been ten years since a fatal train accident, the risk remains ever present. It is important that the causes, consequences and key lessons learnt from investigations into the accidents do not, become overlooked.
It is also interesting that, over the years, there has been an evolution from blaming individual errors to identifying the reasons why such errors are made. This article provides a summary of some of the major accident reports, some of which I helped to investigate, together with the resulting improvements and mitigation measures to prevent repeat occurrences.
The accident at Potters Bar, at 12:55 on Friday 10 May 2002, was due to missing or loose nuts that were designed to hold the stretcher bars in place and keep the point ends to gauge. This resulted in the points moving underneath a train, which then derailed and mounted the platform at nearly 100mph, with seven people being fatally injured. Poor maintenance was established as a factor, with maintenance at the time undertaken by a number of large private maintenance contractors. Following this accident, a decision was taken by Network Rail to bring all track maintenance in-house.
The Grayrigg accident on the West Coast Main Line, at 20:15 on Friday 23 February 2007, was due to the absence of bolts holding stretcher bars in place on a set of ground-frame operated points, which caused a Virgin Pendolino service to derail as it passed over. The fundamental failure was due to deficient setup adjustment together with poor maintenance. The whole of the train derailed, with several coaches falling down the embankment, and one passenger was fatally injured.
On the tenth anniversary of the accident, an RSSB report stated: “Lives were also saved 10 years ago at Grayrigg thanks to the train’s crashworthiness and the use of laminated glass in the windows. Research shows these prevent people from being ejected from the train.”
Since these two accidents, the industry has made significant progress regarding the guidance and training given to staff, and new patrolling diagrams have been introduced that more accurately reflect the work required with the timescale for the patrol. This has been supported by more detailed measurements being taken of the track and much improved data capture within a new asset maintenance database model.
It was identified that neither fixed nor adjustable stretcher bars had ever been designed with the correct engineering understanding of the forces to which they would be subjected. After much investigation and development, a new design of tubular stretcher bar has been designed to address a number of failure modes. This is being progressively introduced across the rail network.
At 12:23 on Tuesday 17 October 2000, a derailment occurred at Hatfield when a rail, in which there were multiple cracks and fractures due to rolling contact fatigue (RCF), fragmented as a high-speed train passed over it. RCF consists of multiple surface-breaking cracks, which are caused by high loads where the wheels contact the rail. With repeated loading and the ‘right’ conditions, the cracks can grow, eventually resulting in the failure of the rail. The issue was known about prior to the accident but it wasn’t adequately managed and the investigation established that there was a serious problem with the experience and working knowledge of staff engaged with the maintenance of the track.
The subsequent mitigation put in place throughout the network, including 1800 emergency speed restrictions, caused significant train delays over many months and resulted in Railtrack suffering severe reputational damage. This contributed to Railtrack being placed into administration and Network Rail being created as its replacement.
There is now a much better understanding within the industry of the RCF failure mode and how to manage it through rail grinding. Improved technology, including the introduction of PLPR (Plain Line Pattern Recognition), ultrasonic testing and eddy current testing, gives engineers a much clearer picture of the condition of the rail than has ever been possible before.
As a result of the lessons learned and new techniques introduced since Hatfield, there has been a reduction in broken rails from a 40-year run rate of around 750 failures per year to a recent eight-year run rate of only 150 a year on a much busier network.
Earthworks and radio
At 18:55 on Tuesday 31 January 1995, an accident at Ais Gill on the Settle to Carlisle route was initially relatively minor, after a train ran into a landslide and derailed, injuring the driver. It escalated, however, due to a failure by the respective control offices to correctly action the emergency NRN (National Radio Network) call that the driver sent immediately after the derailment.
At the time the derailment occurred, a train was approaching Ais Gill on the opposite line, but was still seven minutes running time away. Owing to a lack of adequate training and a failure to protect the train, no emergency call was made to the driver of this second train to stop it, nor were detonators laid to warn him to the derailment. Consequently, it struck the derailed train, resulting in 30 injuries and the death of the conductor, who had incorrectly focused on the welfare of the passengers on the train rather than fulfilling his duties in providing detonator protection against approaching trains.
The Health and Safety Executive investigation only dealt in passing with the details of the landslide, noting only that the area had no history of events and that there was no sign of any landslide evident when the line was inspected earlier that day, and focused on the deficiencies with the use of the communication system.
From the ensuing enquiry, the Railtrack Zone Controls were better aligned to NRN areas and controllers were trained to react to NRN calls, even if off their ‘home’ patch. A number of other improvements were made, including dedicated emergency telephone numbers allocated to signal boxes, better recording and time stamping of radio messages, plus the need for controllers to regularly practise emergency scenarios.
These steps proved beneficial as, two years later, the NRN prevented what would have been a very serious accident. A points failure at Macclesfield had caused a southbound train to cross to another line under verbal instruction from the signaller. A misunderstanding of the instruction by the driver led to the train proceeding northwards ‘wrong line’ to a ground frame location some miles away. The signaller noticed that the train was running head-on into the path of a southbound express. A quick call to Railtrack control resulted in an emergency call being broadcast which resulted in both trains being stopped within sight of each other.
Another example on the Settle-Carlisle line determined that a freight train derailment was caused by excessive speed by measuring the time between the train being logged as entering section and the emergency NRN call being received.
Radio technology has advanced dramatically and GSM-R has become standard throughout the rail network. This allows communication directly between the driver and controlling signaller, and all trains in an area when a Rail Emergency Call (REC) is initiated, thereby providing much faster and better-targeted communications.
In addition, remote monitoring equipment designed to detect movement that could result in an earthworks failure is being developed for use across the network. The management of train operations during times of extreme weather has also significantly improved, partly in response to RAIB recommendations, which should help reduce instances of trains derailing from striking a landslide.
The investment in GSM-R has already prevented what could have been an even worse accident. At just before 07:00 on Friday 16 September 2016, a London-bound passenger train operated by London Midland struck a landslip at the entrance to Watford Slow lines tunnel. The leading coach of the eight-car train derailed to the right and the train came to a halt in the tunnel, about 28 seconds later, with the leading coach partly obstructing the opposite track.
About nine seconds later, the derailed train was struck by a passenger train travelling in the opposite direction. The driver of the second train had already received a radio warning and had applied the brake, reducing the speed of impact. Both trains were damaged, but there were no serious injuries to passengers or crew.
The landslip occurred during a period of exceptionally wet weather. Water from adjacent land flowed into the cutting, close to the tunnel portal, and caused soil and rock to wash onto the track. The site had not been identified as being at risk of a flooding-induced landslip, even though one had occurred at the same location in 1940, also causing a derailment. Drawings from the 1940s relating to a structure subsequently constructed to repair the slope were held in a Network Rail archive, but were not available to either Network Rail’s asset management team or the designers of a slope protection project which was ongoing at this location at the time of the accident. As a consequence, the project had made no provision for drainage.
The RAIB has made six recommendations. Four recommendations addressed to Network Rail relating to the improvement of drainage, improvement in the identification of locations vulnerable to washout, access by the emergency services, and to expedite a project intended to identify all drainage assets. One recommendation has been made to the Rail Delivery Group, in conjunction with RSSB, to promote a review of the circumstances when bogie or infrastructure design could provide derailment mitigation. One recommendation has also been made to Siemens, the manufacturer and maintainer of the trains, to address issues relating to the securing and location of emergency equipment which came loose in the driving cabs of both trains when they collided.
Signalling wrong side failures
The catastrophic events at Clapham Junction at 08:10 on Monday 12 December 1988 were a consequence of a culture of complacency towards safety at the time. The report into the accident records: “The appearance of a proper regard for safety was not the reality. Working practices, supervision of staff, the testing of new works… failed to live up to the concept of safety. They were not safe, they were the opposite.”
The accident occurred due to a newly installed signal that was displaying a green aspect when the section ahead was occupied by a train. As a result, a train passed the green signal and collided with the rear of another train. Shortly afterwards, it was struck by an empty train travelling in the opposite direction.
The direct cause of the wrong side failure was identified as errors by a signalling technician who had installed new wiring within a relay room as part of re-signalling works, but left old unsecured wiring in place a little over two weeks prior to the accident. This had then been disturbed during unrelated work within the relay room the day before the accident. The faulty wiring caused the signalling relays to operate incorrectly and for the signal to wrongly display a green aspect.
The report identified that the root cause was a combination of characteristic errors – poor working practices that should have been picked up by proper supervision – and uncharacteristic errors that had arisen from constant, repetitive work and excessive levels of overtime (the technician had only one day off work in the previous 13 weeks) that had “blunted his working edge”.
As a result of the findings of the report, new processes and instructions were introduced relating to the installation and testing of signalling works, including the development of the Signalling Maintenance Testing Handbook (SMTH) and Signalling Works Testing Handbook (SWTH).
Amongst other recommendations was one to “ensure that overtime is monitored so that no individual is working excessive levels of overtime” which led to criteria being developed to define acceptable levels of working and a process to monitor it. This is currently being refined with the development of a new standard on managing the risk of fatigue.
Signals passed at danger (SPAD) have, until recently, been one of the major risks of a train accident. The signalling system is designed to ensure that trains are kept separated and a red (danger) signal could mean that the signal section ahead is occupied by another train or that a conflicting route is set. Over the past 30 years, 54 people have lost their lives and over 1,000 have been injured, when a driver fails, for whatever reason, to stop at a signal at danger.
As technology has developed, the industry sought ways to mitigate the risk of a SPAD. This led to a number of initiatives including AWS (Automatic Warning System) and multiple aspect colour light signals. However, none of these physically prevented a train from passing a signal at danger.
By the 1980s, European railways had begun to introduce Automatic Train Protection (ATP), a system that automatically controls the speed of a train and forces it to stop at a signal at danger. Virtually all investigation reports into SPADs note that ATP would have prevented the accident from occurring, or supported recommendations that ATP should be introduced.
ATP was thought to be an expensive and complex option and, although two trials were introduced from the early 1990s on the Great Western main line and Chiltern lines, alternative, more cost-effective solutions were explored, which led to the development of TPWS (Train Protection Warning System) by Railtrack.
Following the two accidents at Southall and Ladbroke Grove, the respective inquiry chairs published a joint report into train protection systems. This report supported the “currently accelerated programme” for the fitment of TPWS, but noted that “its benefits are plainly limited and, despite the substantial expenditure that it represents, TPWS will still permit a proportion of ATP-preventable accidents to occur”.
The authors of the report saw TPWS as an interim “better than nothing” solution pending the introduction of the European Train Control System (ETCS) that provides ATP functionality. This was anticipated to be rolled out from around 2008, initially as part of the West Coast main line re-signalling project.
At the time, concerns over TPWS mainly related to its perceived lack of effectiveness at speeds over 70mph, but the system has been developed further with the introduction of TPWS+ to take account of those initial restraints. TPWS is now a well-established and effective form of SPAD mitigation, fitted at signals in accordance with risk-based criteria, and it also functions as mitigation to prevent buffer stop collisions and over speeding. With ETCS yet to be introduced, however, the industry TPWS Steering Group is continuing to consider yet more improvements to TPWS installations in order to further reduce the risk of SPADS.
Alongside the technical solutions designed to reduce the consequences of SPADs, the industry has taken significant steps forward in better understanding the human behaviour that can result in a driver failing to stop at a signal at danger. As recently as the Purley SPAD in 1989, it was apparent that there was a view that the driver was solely responsible, despite it being concluded in 2007 that there was “something about the infrastructure of this particular junction”. The tendency to ‘blame’ the driver for a SPAD meant that many latent failings regarding signal sighting, and the ability of the driver to read some signals that were regularly passed at danger, were not adequately considered as part of the investigation.
Managing SPAD risk and its mitigation has been a major success since 2000. There is now much better understanding of how drivers can perceive and sometimes misinterpret signals, which is now considered at the design stage along with consideration of the signal overrun risk assessment process. The introduction of LED signals has also enhanced the readability of signals and there is a greater emphasis on driver training with initiatives such as ‘defensive driving’.
TPWS protection is, however, vulnerable to driver misuse, with occasional instances of ‘reset and go’ (where a TPWS intervention brings a train to a stand, but the driver resets and continues without speaking to the signaller) or the driver isolating the equipment on the train. This led to a steam-hauled passenger train reaching the conflict point moments after a high-speed train had passed at Wootton Bassett in March 2015.
There are three accidents of note that resulted from errors made by either the signaller or driver that resulted in a collision between two trains. At Seer Green at 08:14 on Friday 11 December 1981, a signaller talked a train past a signal at danger into a section occupied by a previous train that had stopped out of course in heavy snow to clear branches from the line.
At Morpeth, at 22:20 on Friday 13 November 1992, the signaller talked a second train past a signal at danger into an occupied section, mistakenly believing he was talking to the driver of the first train.
The circumstances at Stafford at 00:40 on Saturday 4 August 1990 were different, in that the driver had been signalled legitimately into an occupied platform under permissive working signalling controls but the driver failed to slow the train sufficiently. The driver, who died in the collision, was subsequently found to have worked excessively long hours and to have consumed alcohol.
After Seer Green, rules governing the speed of trains when travelling cautiously through sections were amended and a new instruction that “the driver must always be able to stop within the distance he can see the line to be clear” was introduced. Subsequent events, particularly involving engineering trains travelling within possessions, have resulted in further work to redefine travelling at caution or not under the protection of fixed signalling. Following the Stafford incident, a greater emphasis has been placed on the implementation of monitoring procedures to restrict working hours, together with statutory standards relating to drink and drugs for safety critical staff introduced within British Rail in January 1992.
At Moreton on Lugg at 10:29 Saturday on 16 January 2010, the signaller became distracted by a work-related phone call and made the mistake of lifting the barriers at the crossing before the train had passed. The train struck two cars, resulting in the death of a passenger in one of them.
The investigation report was critical of the lack of any engineered safeguards at Moreton on Lugg, and potentially elsewhere, that allowed this to happen and subsequently ‘approach control’ was introduced at a number of level crossings nationally to prevent a similar type of occurrence. Approach control ensures that, once lowered, the crossing barriers cannot be raised by the approaching train operating the train detection system.
There are still several hundred user-worked crossings on the network which depend on signaller-user communications for their safe operation. An example of what can happen when this is not effective occurred at Hockham Road in April 2016, when a train struck a tractor on the crossing.
This is managed primarily, with regard to signallers, by regular competence assessment and assurance via supervision and observation of the task. The RAIB report also identified the need to provide improved information to signallers to enable them to judge the time for a train to reach a crossing. There is much work ongoing in all aspects of signaller competence, which includes reviewing the best practice from industry research, benchmarking with other industries, better safety critical communications, and the increased use of simulators with improved levels of assurance.
Unfortunately, trains strike vehicles on level crossings relatively frequently, on average two or three times a year. One of the most recent was on 3 January 2017 at Marston Automatic Half Barrier (AHB) crossing. As is often the case, the train remained upright and did not derail, and there were no reported injuries to anyone on the train. The car driver, however, was fatally injured.
At Ufton Level Crossing at 18:12 Saturday on 6 November 2004, a car was deliberately driven onto the crossing with the intent of being struck by a train. In this case, the impact did result in the leading wheelset of the train derailing to the left-hand side. Normally the train would have braked safely to a stop. However, less than 100 metres from the crossing was a point connection to a loop line. The derailed wheelset was turned into the loop, resulting in the leading vehicles of the train overturning.
Following the report into this accident, the industry’s level crossing risk assessment process, the All Level Crossing Risk Model (ALCRM), was enhanced to include the consideration of post-collision potential at each crossing. In the event of a crossing being identified as high risk, further solutions must now be considered to reduce or mitigate the risk. The relatively high number of fatalities (seven people) was found to be partly due to passengers being ejected through windows that pre-dated the requirement for safety glass to be installed on railway vehicles. Recommendations were made to address this.
The report recommended that a programme of research be undertaken to assess the benefits and practicalities of installing seat belts in passenger vehicles.
This research concluded that the advantages in the fitting of seat belts in reducing the likelihood of ejection from the train were more than outweighed by the possibility of becoming trapped with a loss of survival space due to structural intrusion.
The accident at Tebay at 05:56 Sunday 15 February 2004 involved a rail-mounted trailer loaded with scrap rail being dislodged from the wooden blocks being used to stop it from moving. It ran away for over three miles, down a steep gradient, before running into a workgroup who had no warning of its approach.
While hard hats are now mandated across the network, at the time they were only required on the local Network Rail North West Route as a trial. However, one of the workers commented when he was in hospital that he only survived as he was wearing his hard hat when he was bending down and was struck by the trailer.
The trailer was found to have been poorly maintained, with its hydraulic brakes disconnected due to a fault. Network Rail introduced a new code of practice in September 2004 to help develop additional control measures for road-rail vehicles and rail-mounted maintenance machines, which was developed in consultation with the industry, equipment users and suppliers, trades unions and the Health & Safety Executive.
Despite this, a similar type of runaway of rail-mounted plant occurred at Gwaun-Cae-Gurwen in November 2014, fortunately in this instance with no serious consequences. To provide an additional level of protection, and instigated by the local workforce in Cumbria, a treadle-based Vortok Rearguard system has been approved and is now in use. This is fitted to the rail near to worksites and is designed to provide a minimum of 10 seconds audible and visual warning in the event of any rail-mounted plant or vehicle approaching.
At about 06:07 on Wednesday 9 November 2016, a tram derailed and overturned on a curve as it approached Sandilands Junction, in Croydon. Seven people lost their lives in the accident and 51 people were taken to hospital, 16 of them from suffering serious injuries.
The investigation into the accident is still ongoing, however analysis of the on-tram data recorder shows that the tram was travelling at a speed of approximately 73km/h (46 mph) as it entered the curve, which had a maximum permitted speed of 20km/h (13 mph).
Trams generally operate on ‘line-of-sight’ principles, with drivers being required to control their tram so it can be stopped short of a visible obstruction. Unlike the heavy rail train network, there is no requirement on light rail tram systems for advance warning of speed restrictions, nor is there a requirement for speed control systems.
Initial indications are that a number of passengers with fatal or serious injuries had been ejected, or partially ejected, from the tram through broken windows, both in the body-side and the doors. The windows were made from either 4mm or 6mm toughened glass, unlike the safety glass fitted to main line trains which prevents passengers being ejected. Effectively, trams are considered to be road vehicles, so the lessons learned from the Grayrigg accident were not applied to them
The provision of speed control mitigation systems and safety glass for light rail tram systems may be recommendations of the ongoing investigation. This would have cost and weight implications for light rail networks, which would need to be balanced against the risks involved. However, the cost of fitting laminated glass to trams during build should not be too significant.
Understand not blame
Historically, there has been a tendency to blame an individual for their failings and not to take account of the factors that could have led to a person making a mistake.
Over time the concept of ‘human factors’ has been introduced, which allows a better understanding of any latent conditions that can have an influence on people’s actions. This has led to improved training and assessment of people, and initiatives such as defensive driving, and many more to mitigate the true causes of accidents.
The understanding of risk and its application in providing targeted, proportionate mitigation has developed significantly over the years. From its initial use in relation to signals and level crossings, it is now being applied to assets and other operational scenarios, which has contributed to the welcome reduction in accidents.
The industry now has a better understanding of why accidents have occurred and are more likely to be aware of the actions required to prevent a recurrence. To support this important requirement, RSSB now highlights individual historical accidents within its Rail Safety Review publication. This should be essential reading for all engineers and managers in the industry.
This article is based in part on “Historical Train Accidents Lessons Learnt” by Roger Long, senior investigator at Network Rail.
Written by Paul Darlington