In November 2017 a London Overground train came to a sudden halt just outside Peckham Rye station. It began a chain of events that would eventually lead to over eighty passengers standing at trackside while the electrical rail was still live.
At a quarter to seven in the evening on the 7th November 2017, a London Overground train (service 9N50) neared Peckham Rye station in south London. It had left Dalston Junction about twenty minutes before and, even at this late stage in its journey, was standing-room-only.
The driver was more than familiar with this particular part of the London railway network, having operated trains on the East London Line since its reopening in 2010. He had stayed with the line after the previous operator, LOROL, had given up this particular Overground franchise and moved to their replacement, Arriva. So far then this journey had been no different from one that he had carried out many hundreds of times before and, as he neared Peckham Rye station, he shut off power so that the train would coast smoothly in. About one hundred metres short of the platform, he began to gently apply the brake.
Four seconds later, to the surprise of both the driver and passengers, the train’s emergency brakes slammed on, bringing it to an abrupt halt.
As soon as the train stopped, the driver began to run through the normal cycle of error checking for such a situation. He checked to make sure he hadn’t missed a signal or driver prompt and then reviewed the driver’s displays for obvious errors. Nothing was immediately apparent.
Confused, the driver calmly opened up a radio channel and contacted the Arriva control room, known as ‘Strategic Command’ back in Swiss Cottage.
It was the first mistake of the day. One that started a series of mistakes that would, almost an hour later, lead to eighty passengers detraining onto the live railway.
The view from the cab of 9N50, courtesy of the RAIB
Radio silence
With a few notable exceptions, almost all of the UK’s rail infrastructure is owned, managed and operated by Network Rail. This extends to signalling and, for this particular section of line, this means Network Rail’s Route Operation’s Centre (ROC) at Three Bridges in Sussex.
ROCs are high-pressure environments at the best of times, but even more so during the evening rush when even the smallest of incidents can quickly cause major problems elsewhere on the network. By 18:54 on the 7th November this was what one particular signaller was worried might be happening. In front of him, on the live signalling board, he could see that for nine minutes now 9N50 had been stopped just short of Peckham Rye station.
This was rapidly becoming a major problem. As 9N50 had approached the station the signaller had cleared the route in front of it, anticipating a speedy stop and departure from Peckham Rye itself. Something had clearly gone wrong though and both services behind and those waiting to cross the train’s path at junctions in front were now at a standstill.
What was doubly annoying to the signaller was that he had received no information about what was wrong from the driver of the train itself. Frustrated, he raised the issue of 9N50 with the Signalling Shift Manager. Both men suspected they knew what was happening. The rules said that, in the event of a sudden stop, the driver should immediately contact the responsible signaller and inform him of the reason for the delay (or at least confirm that it had happened). They guessed – correctly – that he had contacted the Arriva Strategic Command first instead.
Arriva Strategic Command had a maintenance engineer from Bombardier on site at key times such as this. Drivers knew that if a minor problem occurred with the rolling stock that they couldn’t immediately solve themselves, then the engineer would come on the line and talk them through more advanced problem-solving. Similarly, it was Strategic Command who would run through the general incident checklist with the driver and ultimately decide whether a train stayed in service or was withdrawn. From a driver perspective, the majority of decisions and information thus came from Strategic Command. Speaking to them first thus sometimes felt like a speedier way to solve the problem.
Both the signaller and Shift Manager would later tell the Rail Accident Investigations Branch (RAIB) that the signallers at Three Bridges had begun to notice that they weren’t always the first people the drivers called. This was a clear breach of standard operating practice, but perhaps because it had seemed more like an annoyance than a major issue, Network Rail had never cautioned Arriva for doing it.
Right now, however, it was more than just a niggling problem. It meant that for almost ten minutes Network Rail’s signallers had been in the dark about what was happening at Peckham Rye.
Annoyed, the Shift Manager contacted Arriva Strategic Command directly and told them to order the driver to report in.
A series of assumptions
The first person outside of the cab to learn about the brake problem on 9N50 had indeed been the duty Train Service Controller for South London at up at Strategic Command. It was he who took the call from the driver after his onboard diagnosis had failed. The driver told the Service Controller that he had come to a sudden stop “coming into Peckham Rye” but that everything was reporting clear on the monitors.
Arriva’s own procedures were clear on what should have happened next. At this point, the Service Controller should have spent two or three minutes going through a checklist of common issues with the driver. If that didn’t work, then the incident would be escalated to a more senior colleague, the Incident Response Controller.
Due to staff rostering issues, however, the Service Controller on duty that day was actually an Incident Response Controller ‘acting down’. As a result, he realised straight away that what the driver was describing was a more complex problem than the regular checklist would solve. So he skipped it and passed the driver straight on to the duty Incident Response Controller elsewhere in the control room.
It may be that both men thought that this would save time. It did, but it also cemented in place a dangerous assumption. From the driver’s brief description of what had happened the Service Controller mistakenly assumed that 9N50 was at least partially pulled in to the platform at Peckham Rye station. It was an assumption that running through the regular checklist would quickly have removed, but instead, this was passed on to the Response Controller as fact – something that train information control board at Arriva Control seemed to bear out.
What the Service and Response Controllers had forgotten, however, was that all their board confirmed was that the train was within the same track circuit as the platform at Peckham Rye, not that it was adjacent to it. At that time, there were in fact only two people who could confirm the precise location of the train – the driver, who was never asked again, and the signaller who (at that point) had yet to be contacted at all.
Without thinking to ask for more information, the Response Controller told the driver to start talking directly to the Bombardier engineer on duty and get the problem resolved.
A missed opportunity
When Network Rail’s signallers called Arriva control ten minutes later demanding to know what was happening, a resolution to the problem was still far from obvious. Indeed one of the reasons they still hadn’t heard from the driver was because he had been continuously in contact with the Bombardier engineer since then. The two men were still running through an increasingly complex series of fault-finding checklists without success.
It was now that a second opportunity to fix Arriva’s bad assumption about the train’s actual location arose, and was promptly missed. At one point during the attempted diagnosis, the driver spotted that the door interlock light wasn’t illuminated. This suggested that the train control software thought the cab door wasn’t locked, which would have triggered the emergency brakes.
The engineer suggested that the easiest way for the driver to eliminate this possibility was to “recycle the doors” – that is, open and close the doors along the entire length of the train. Confused, the driver told the engineer that he couldn’t do this as he wasn’t in the platform and he had passengers onboard. With this mistaken assumption apparently cleared up, the two men moved on to other things. Both believed that this would have cleared things up for the Response Controller too, as Arriva’s incident procedures stated that he should have been listening in on their call. What they had no way of knowing was that he had, in fact, not been doing so. With the diagnosis dragging on, he had quietly left the call to quickly deal with reports of a faulty radio on another train elsewhere.
The pressure builds
It was now that pressure began to build on both the driver and the control room team to get things moving again. Nothing the driver and engineer did, however, seemed to provide any clues as to the cause of the problem. Every test they ran came back clear, yet the emergency brakes stubbornly refused to release.
By now, the train had been stuck just outside Peckham Rye station for about fifteen minutes. As recycling the doors wasn’t an option, the engineer suggested that instead, the driver walk the full length of the train and check each door manually to make sure none were open or obstructed in some other way. The driver did so, which meant pushing through a crowded train full of increasingly frustrated passengers who demanded more information about what was going on. The driver was forced to tell them that he couldn’t say anything more than he had announced already – there was a fault with the train that was preventing them from pulling into the platform.
While he was out of the cab, the signaller tried – and failed – to get hold of the driver again.
Meanwhile, up at Swiss Cottage, things had escalated further. By now the Strategic Commander, who was in charge of the whole control room, was becoming increasingly concerned about the situation. Not wanting to interrupt the Response Controller or engineer, he contacted Network Rail’s own control room at Three Bridges to find out whether there were any known power issues in the area.
These were the men and women in charge of coordinating and managing all train movements cross-operator and the Strategic Commander discovered that they were not at all happy. They promptly replied that the power was perfectly fine, and informed him that their own signallers on the floor below still hadn’t heard from the driver directly.
As soon as he got off the call, the Strategic Commander told the Response Controller that he should order the driver to do this immediately.
No questions asked
The driver of 9N50 returned to his cab with no new answers but feeling increasingly stressed and isolated. Once again, he tried to release the brakes and once again the train refused to move.
He immediately contacted Arriva Strategic Command again, but this only made things worse. The conversation left him feeling like the control room staff no longer believed he was capable of solving the situation on his own. Indeed they had, in essence, told him to give up. He was to contact the signaller immediately, detrain his passengers and then drive the train in full manual override mode back to New Cross Gate depot.
Witness accounts differ over who at Arriva control gave the specific order for the passengers to be detrained. Two things, however, are certain: that the driver was ordered to do it and that it was absolutely the wrong thing to do. The train wasn’t in the station as Strategic Command now assumed and, as Network Rail had confirmed barely minutes before, the power in the area was still very much on.
If the driver had been in a better frame of mind he may well have finally realised, at this point, that something had gone terribly wrong somewhere and communications had become blurred. But he was stressed, isolated and lacked the confidence to object. He opted, instead, to simply trust that Strategic Command knew what they were doing.
He also lacked something more critical, which could easily have been provided – prior practical training in how to handle a crisis. Although Arriva (and the previous franchisee, LOROL) had provided plenty of documentation and classroom training on situations like this, the opportunity for drivers or control room staff to practice crisis skills in a real (or near-real) environment wasn’t considered necessary.
It wasn’t just the operators who were guilty of making this mistake. Network Rail had too. When the driver finally contacted the signaller the conversation was terse and limited, with the signaller making his annoyance and frustration at the situation abundantly clear.
It was an understandable reaction, but lacking any real training or experience in dealing with a situation like this the signaller failed to realise that his reactions were simply further increasing the risk that something was about to go very wrong.
The driver informed the signaller that he had been ordered to detrain. This was, perhaps, the last real opportunity for that mistake to be corrected. The driver told the signaller that he wasn’t in the platform and the signaller responded by asking the driver how he intended to detrain. The driver told him that he would bring the passengers up through his cab and out via its side door onto the track. If the power wasn’t turned off beforehand, this would mean that every passenger evacuated would have to climb down from the cab just thirty centimetres away from a still-live third rail.
Neither the driver, nor signaller, had any previous experience of evacuating a train this way. The last time the driver had practised any kind of evacuation at all was during his training in 2008. The closest the signaller had been to this situation had been an evacuation he had seen carried out in 1999. Nonetheless, both men should still have known what to do next.
The driver should have immediately asked for the power to be turned off and, if he failed to do so, the signaller should have proactively prompted him to do so. The driver didn’t – perhaps again trusting that if it were required Strategic Command would have asked – and the signaller simply signed off by tersely telling the driver that he should contact him “when you’re ready to move.”
It was a dangerously vague instruction, born out of frustration, and if the signaller had intended it to mean that the driver should call back when he was ready for the power to be turned off, then he failed. Instead, the driver thought that this simply referred to setting the signals he would need to take the train back to the depot.
As soon as the conversation ended, the driver contacted Arriva Strategic Command and told them he had now spoken to the signaller. The Response Controller immediately confirmed his orders:
“Detrain.”
A helping hand
The increasing scale of the disruption had, by this point, drawn the attention of others within the Network Rail facility at Three Bridges. More specifically, it had pricked the ears of the GTR Duty Manager, who sat just across from the Network Rail train controllers that the Strategic Commander had spoken to earlier.
Although that team shared a building with the signallers, they were not on the same floor. As a result, most of their information was actually coming from Arriva Strategic Command. From the conversations that the Duty Manager could hear, he understood that 9N50 might be stuck at least partially in the platform at Peckham Rye, but that Network Rail were struggling to get through to the driver themselves. Remembering that Peckham Rye station was actually managed by GTR, not Arriva, he realised that he might be able to help with this problem. He pulled up the general contact details for Peckham Rye station and put a call in. A member of GTR agency staff who had been staffing the gateline soon picked up.
The Duty Manager was aware that, as agency staff, the GTR staff member he was talking to was not trained to operate trackside but this didn’t seem to be an issue. He just needed someone to go to the platform, find the driver of 9N50 and tell him to contact the signaller at Network Rail urgently. Once he’d explained the situation, the agency staffer agreed and headed up to the platform.
A few minutes later, he checked in with the agency staff member again. Over the phone, the staff member informed him that he was now on the platform awaiting the arrival of 9N50. The GTR Duty Manager was slightly confused, but decided that he must have misheard the Network Rail chatter. He told the agency staffer to check in with him again once the train arrived.
A live detraining
Having received his instructions from the GTR Duty Manager, the agency staffer decided to move to the western end of the platform to try and get a better view of the incoming train. It was a cold, damp, dark night but as he moved closer to the platform end he finally caught sight of 9N50, sitting about thirty metres away.
It was now about ten past seven and, as he watched, he saw passengers exiting the drivers cab and, with the driver’s assistance, carefully climbing down to the ground below. Due to the distance to the ground, this meant that each passenger making the descent – which included both pensioners and children – had to jump down from the final step, passing within centimetres of the live rail as they did so.
An annotated close up view of the step and third rail positioning on a 378, courtesy of Arriva London. Distance A is approximately 30cm. At Peckham Rye there was no wooden separator board (see below).
Unfamiliar with evacuation procedures or advanced trackside working, the agency staff member didn’t spot anything wrong with this situation and assumed that the power to this section of line must be off. He did notice, however, that the driver was struggling to both help those detraining and manage the increasing number of passengers now standing trackside. Some of those were beginning to walk towards the platform whilst others were stepping over the live rail and crossing to the other side of the train so that they could take pictures and film what was happening. Behind them, separated only by a thin hedge, trains heading in the other direction continued to speed past.
A daylight recreation of the train position in relation to the platform, courtesy Arriva London
Although he knew that he wasn’t trained for trackside, the agency staffer worried that the situation might be getting out of control. He decided to go and help the driver, jumping down and walking along the track towards the train.
Realisation dawns
Back at Three Bridges, the GTR Duty Manager’s sense of unease continued to develop. Across from him he could hear Network Rail staff and Arriva Strategic Command discussing what appeared to be an active detraining operation. Yet he had still not heard back from the agency staffer, who he had specifically told to call him as soon as 9N50 had pulled into the platform at Peckham Rye.
After ten minutes, he decided to phone the agency staffer again. He got through and asked for an update. The agency staffer explained that 9N50 wasn’t actually in the platform, but “approximately thirty feet” away from the station. He confirmed that the detraining was underway, however, and that he was now trackside assisting the driver.
The GTR Duty Manager instantly grasped the dangerous situation that was unfolding at Peckham Rye, unbeknownst to anyone within Network Rail or Arriva. Calmly, but loudly so that the Network Rail staff opposite would hear him, he confirmed the location of the train back to the agency staffer, then asked the staffer to immediately hand the phone to the driver.
The GTR Duty Manager instructed the driver to immediately halt the detraining because the line was live. He told him to reboard the train and contact the signaller again straight away.
Behind him, he could hear ripples of horror and realisation spread through the Network Rail control team, as they quickly informed Arriva Strategic Command that they were detraining their passengers onto a live line.
One last roll of the dice
Back on the train itself the driver halted the evacuation and told the remaining passengers to move back inside the main carriages. About four hundred remained onboard and they were now confused and angry as to why, after over half an hour onboard, eighty people had been allowed to disembark while they were being held back.
Having got the situation back under control, the driver contacted the signaller again and told him that he’d had to stop the evacuation as he’d been told the line was live.
“Yes it was.” The signaller replied, before telling the driver to do whatever he could to get the train moving again.
The driver contacted Arriva Strategic Command for help doing so, and was challenged as to why he had started to evacuate onto a live line. Trying to focus on the issue at hand, the driver asked for help to try and get the train moving. He explained that he had tried again, but the brakes still wouldn’t release. He was put through to an engineer again.
By this point, the Bombardier engineer the driver had been talking to before had finished his shift, and so he was forced to start the whole process of error finding again with the new man on duty. This eventually meant walking back through the train to check all the doors (and those on the rear cab) again. This the driver did, leading to several confrontations with, and verbal abuse from, angry passengers along the way. By this point they had been stuck outside the station for almost an hour.
On returning to the cab, the driver tried once again to release the brakes. This time, to everyone’s relief, they worked and the driver was able to finally move 9N50 forward into Peckham Rye itself.
Bombardier would later discover that the problem had been an overheated electrical relay, which was falsely causing the driver’s cab to report as empty. Although the driver and engineers had been unable to find and fix the problem, after an hour sitting outside in the cold it had eventually fixed itself.
Drawing conclusions
In recent years, detraining incidents have often been the result of passenger disaffection or an unwillingness of those in charge of a railway incident to make a decision. This is something we wrote about in the aftermath of the Lewisham incident back in March, and will no doubt tackle again when the full RAIB investigation into that is completed.
What happened at Peckham Rye, however, shows that this isn’t the only way that detrainings can go wrong. This can also happen simply because too many assumptions are being made.
This isn’t exactly a surprising conclusion. Train operators and Network Rail are (in)famous for the reams of official notes and guidance documents that they put out both before and after incidents like this to ‘raise awareness’ and try and engineer out this problem.
What Peckham Rye highlights, however, is that this isn’t the way to solve the problem. Operational Notes and E-Learning don’t stop bad things happening in a crisis: people and experience do.
At Peckham Rye there were plenty of policies and procedures in place that should, theoretically, have prevented the incident from occurring. They were either ignored beforehand (such as the correct order of contact) or during the event when tensions were running high (such as the responsibility of the signaller to be proactive, not reactive, with the driver). None of those bad decisions were made from a position of malice. They were simply made because there was a fundamental lack of real-world understanding or experience as to why those procedures were important.
On the railway, real world incident experience, or even just practical (not digital) roleplay, matters. Without the opportunity to fail and learn in safety, people can only fail and learn in dangerous reality. Luckily, at Peckham Rye, this didn’t lead to a fatality. But there were at least eighty-two opportunities for that to happen before anyone noticed that things were going very wrong.
Peckham Rye also highlights that Driver Only Operation (DOO) isn’t just an easy way for operators to save on staffing. If you take the second staff member off a train then, by definition, you increase the cognitive load and responsibility on the driver during a crisis, whilst simultaneously robbing them of potential on-train support. There is little doubt that the Lewisham report will highlight the same.
Critics of DOO will point to Peckham Rye as further evidence that it is not a safe way of operating trains. This isn’t true. As with many things, the reality is far more complex than that. What Peckham Rye does demonstrate is that operators cannot see DOO as a consequence-free way to decrease staff overheads and operational complexity.
DOO may streamline day-to-day costs and operations for an train operator, but Peckham Rye shows that it also requires a far more complex approach to crisis management. That’s a problem that cannot be solved by throwing paper or policies at the problem. Peckham Rye shows that it will require some serious industry introspection and a genuine focus on staff knowledge, skills and experience too.
For different reasons, we suspect that the Lewisham report will show exactly the same.
You can read the full RAIB accident report into Peckham Rye here.
LR is funded largely by its community. Like what we do? Then help us to do more!
Absolutely horrific that this happened. I realise that you could probably never be 100% certain the power is off, but I am a bit surprised that it could not be detected from the cab that the power was still on.
“They promptly replied that the power perfectly fine”. Missing a “was”?
Somewhat surprised that such a chain of event is possible, although no system is foolproof. I thought 3rd rail trains carried a shorting bar to switch the power off though?
I thought 3rd rail trains carried a shorting bar to switch the power off though?
Only works if you actually use it…
“At that time, there were in fact only two people who could confirm the precise location of the train – the driver, who was never asked again, and the signaller who (at that point) had yet to be contacted at all.”
The signaller would also only know that the train was in the same track circuit as the platform but not potentially at it. Though, the signaller is more likely to be aware that this is a possibility. The only person certain of the precise train location is the driver, or other observers on the platform.
Peckham Rye shows that it will require some serious industry introspection and a genuine focus on staff knowledge, skills and experience too.
There’s a word missing there, the most important one of all: communication.
I had previously read the HMRI report – and the overall impression is of a total failure of communication.
The signallers (etc) were told, by the driver, where the train was ( Not in a platform )
And the driver was ordered, by his “superiors” to evacuate the train, in unsafe circumstances.
The failures very close to Lewisham, also referred to, that occurred in the very bad weather early this year also seemd to depend upon a complete failure of communications.
Though, IIRC, the full report is not out yet.
Absolutely shocking, luckily not in more than one way.
If an accident was to have happened, I presume that due to not following procedures the driver and the train service controller at Arriva would have potentially been charged with manslaughter?
Also language and clarity is important. If the driver had been told to ‘detrain onto the platform’ rather than just ‘detrain’, then he would obviously have replied that he couldn’t, he could only detrain onto the trackside.
Also language and clarity is important. If the driver had been told to ‘detrain onto the platform’ rather than just ‘detrain’, then he would obviously have replied that he couldn’t, he could only detrain onto the trackside.
Bingo. One of the reasons why I went with the specific quote there. I thought it was important that this came through.
@ John Bull
Indeed… but a quick scan of the RAIB report doesn’t mention those, so do the trains still carry them?
I’m surprised that there’s no mentions of checklists for these situations. I would have thought that each driver would have a little book of laminated checklists for out-of-course operations, like detraining onto the trackside. After all, these events happen rarely (if ever) for a given driver, and hoping they can remember all the details from their training – however recently that happened – carries the risk of mistakes.
The same applies to signallers. Checklists for them might help in these situations where they know what they want to say but accidentally use unhelpful phrases or make assumptions about the situation. If the signaller was following a checklist I’m sure that the checklist would be designed to prompt the driver more accurately, like “instruct driver to call back to request power isolation”.
Airline pilots carry these checklists on every flight covering all sorts of situations. When something goes wrong, they don’t rely on remembering what they are supposed to do, and they don’t rely on the hope that a controller will run them through what to do next. They follow the checklist. Surgeons do so too – even for routine minor operations. But it seems like the concept hasn’t been taking up by the railways yet – does anyone have any idea why not?
@IGNOREDAMBIENCE The display at control would probably only have showed TD berths, not track circuits. I’m not sure what the layout of track circuits is like at Peckham Rye but it’s possible/probable that the platform itself has its own track circuit which the driver had not yet entered; thus the signaller would have been able to tell the difference but control wouldn’t.
“Having received his instructions from the GTR Duty Manager, the agency staffer decided to move to the western end of the platform to try and get a better view of the incoming train.”
Is this what the RAIB report says? It would appear from the photographs that a train standing 30m off the east end of the platform should have been visible from any point on the platform – moving to the west end, furthest from the train, would be unlikely to improve his view of it. (The platform is long enough for an 8 coach train, I believe, so is at least 160m long)
I had understood that the GTR Duty manager first went to the west end of the platform in order to meet the driver of the incoming train when it arrived in the platform as he was expecting (paras 37, 41). Para 43 suggests that he only moved to the east end of the platform when he saw passengers walking up the eastern ramp.
Andy Allan. Completely agree with you about the value of checklists. But in the name of pedantry, need to mention that they only save lives if pilots use them.
British Airways have checklists and their crew use them to good effect if an emergency arises. Compare and contrast the Air France pilots who lost their speed indicators mid Atlantic en route from Rio – they didn’t use any checklist – they effectively panicked and stalled their plane, killing all on board.
Perhaps a checklist for train drivers would have reduced the ‘overload’ factor from the driver and would have guided him to stick to the proper procedure.
Re Muzer & Ignored Ambience,
The rear of the train was about 10m inside the platform track circuit so the signaller couldn’t have known without asking, which probably would have happened if the driver phoned the signaller first. If the Train at been an 8car Southern service it one have also been detected by the neighbouring track circuit.
The short section of the 3rd rail between the tracks (usually on the outside between stations on 2 track sections) where the cab is only 25m long but the GTR manager in Three Bridges had previously worked at Peckham Rye and guessed from his knowledge and experience that the driver cab steps would be directly above the 3rd rail.
Re John Bull
“the agency staffer decided to move to the western end of the platform to try and get a better view of the incoming train.”
Surely the eastern end?
Re Timbeau,
Western vs Eastern – Agreed has to be Eastern unless the agency staff member has X-ray vision or light has started bending round corners in Peckham!
The 1960s lift shaft at the east end of the platform blocks the view well unless you go to the eastern end.
Right on cue. Another incident of a train failed within sight of the platform – passengers stuck on board for three hours.
http://www.fromthemurkydepths.co.uk/2018/10/21/southeastern-train-stuck-leaving-passengers-stranded-for-three-hours-just-yards-from-platform/
If the train could be moved in override and all doors had been checked as closed why could not the driver move the train to the platform then detrain?
If a driver receives a message from what he takes to be an authorised source, that the current has been turned off, what if any indication is there to confirm it has happened? Given the errors and communication issues in this incident, if an officious passenger challenges the driver’s instruction, in a non-threatening and non-abusive manner, what evidence can the driver offer to overcome well-meaning hesitation? Perhaps the answer is none, as it might be if one was to be instructed by appropriate people to evacuate a scene because of some impending, yet invisible, danger.
Scariest article I’ve read for a long while. Thank you.
Something seriously wrong with a design that includes a relay that can ‘overheat’, and a computer that doesn’t know someone is in the cab even though he is (presumably) pressing keys or buttons.
Wouldn’t it be obvious from the way the lights etc. were behaving that the 3rd rail was still live?
Re Roger B,
1. defective relay easily replaced, it happens
2. the rear cab rather than the one the driver was driving from
3. Agreed it should have been very very obvious
Re TwoPenny tube,
Traction current on/off status – the AC/DC supply selection switch and status LEDs are above the DOO monitor on the front left corner of the cab (above seated head height).
Checklists are fine when they work, see US airways flight 1549 for an example of checklists not fit for purpose. They ended up trying to restart the engines when they should have turned back.
I would suggest a Rule book that can fit in a jacket pocket, like my old railway one (1961 ed.)
I don’t see how having some sort of Guard would have helped, would yet another member of staff with only theoretical understanding of the rules be of any use? The Signalman appears to not have been as helpful as he could have been, but as he had no experience what do we expect. The Driver also had no experience and so the red flags were not obvious.
I would prefer that we have a member of experienced staff with practical knowledge, in charge of events like these. We could call him a Station Master / Foreman and he would be in charge of a number of stations and the lines inbetween.
Is/was there no independent traction current pilot lamp or some other indicator on the driver’s console that he could have used to confirm power on/off?
The report as summarised here does not reveal anything about the driver’s knowledge of whether the power had been turned off. If he/she was not explicitly asked during the investigation, that may have been just as well for the driver’s ongoing mental health.
The point is that the driver would not have obeyed the instruction to detrain the passengers onto the trackside unless EITHER the driver believed that the power was off, OR the driver believed that it had been judged necessary by an appropriate person to detrain regardardless.
Obeying an order that you KNOW to be wrong or unsafe is culpable. But if the pressure of the situation deprives you of that certainty, as seems to be the case here, then the fraction of blame to put on the driver is, in my view, quite small.
The biggest culpability here is with whoever caused or allowed responsibility for handling a major incident (which this was) to be so awkwardly split between two different “persons in charge”.
Re Mr SW,
Yes there is – see my comment at 1829
NGH @ 17:29
Curiouser and curiouser. The train wouldn’t go because it thought there was no one in the rear cab?
Re Roger B,
No very simple – because of the relay failure the TCMS didn’t know the rear cab doors were closed and hence treated the situation as if they were open and applied the emergency brake as it should do in the case of an open door. (e.g. fails safe if status detection lost).
If a different but identical relay had failed it could have though a different set of doors had failed it just happened to be a rear cab door.
I was truly horrified as I read this article and it was by luck rather than judgment that no one was injured / killed. Check lists are all very well and good but they do need to be followed and perhaps they should have explicit questions that need to be asked to get a specific answer – Is part of the train on the platform? Has the power been turned off? with specific authorised replies that get repeated back.
Even in day light the route to the platform looks to be very rough with plenty of trip hazards (not just from the ballast) but what looked like to be a pole or branch just in front of the train and a slab of concrete / paving stone a little farther on. If a passenger had stumbled over either they would have more than likely ended up on the 3rd rail. Efforts should be made to clean up track sides of such objects during track closures. They also reduce the objects vandals can use to cause damage
@NGH
The photograph taken from the cab of the train appears to show the full length of the platform, (or at least the part a 5 car train would stop in) which is concavely curved. And if you can see the far end of the platform from the train, the train would have been visible from the far end of the platform. But in any case, what the report says is that the GTR person first went to meet the driver of what he thought was an incoming train, and the driver’s cab of a westbound train would stop at the west end of the platform.
To those who understand these things better than me, I would thought it fundamental that if something occurs that stops the train dead the computer would know what it was and should display it? Who wrote the software?
Muzer
The signaller would probably have been looking at this diagram – or something exceeding like it – which doesn’t contain the really fine details required.
Malcom
Yes, the responsibility was so divided up that no competent person appeared to be wholly in charge of the whole thing …
Which ties back to ID’s post @ 16.40 …
And the realisation, after the previous incidents … that people should be trapped on a train for an absolute maximim of TWO HOURS, according to offical procedures, agreed by everyone, including the operating TOC’s.
I thought the class 378s had emergency steps incorporated into the cab’s centre door. While still less than desirable, had passengers exited this way, they would have been in the four foot, further from the conductor rail.
On the other hand, there’s an AWS magnet which would have been a potential trip hazard, and it’s before the point that the conductor rail moves from the platform side to the non-platform side.
When the only communication with trains were Signal Post Telephones, the driver could only talk to the signalman. NRN radios were provided but never used in the first instance. I ceased to be a signalman in 2009, before GSM-R was introduced, but CSR (Cab Secure Radio) for DOO(P) trains had been around for a while and since privatisation it was becoming more and more noticable that drivers were calling their TOC controls on CSR sometimes before contacting the signaller. This seems have got a lot worse with GSM-R now in all cabs and allowing phone calls to ‘anywhere’. There was a recent ‘near miss’ incident at Bethnal Green where the Arriva Rail London controller told a driver to pass a signal at danger and the driver acted on the instruction!
The explanation of how the tension between the signaller and driver, and the way that was expressed, made the situation worse is very interesting. The airline industry learned the hard way about the importance of ‘crew resource management’.
@TJ: I would prefer that we have a member of experienced staff with practical knowledge, in charge of events like these
There was a member of experienced staff with practical knowledge in charge, the Strategic Commander. They made a false assumption. The driver, who was the only person who had access to the correct information about exactly where the train was, did not feel able to speak up and contradict the Strategic Commander. It sounds like a problem of too much (or the wrong kind of) authority, not too little.
Just to clarify, the report refers to two GTR managers, one at Three Bridges and one at Peckham Rye.
At Three Bridges was what the article calls the GTR Duty Manager (the term used in the report is variously “duty operations manager”/”duty manager”/”operations manager”); at Peckham Rye was an “on-call duty manager”/”on-call duty station manager”/”on-call area station manager”/”duty station manager” (again the report uses various terms), “responsible for station staff and managing station incidents” (para 37). He was in his office at Peckham Rye during the evacuation, but “he was unaware of the incident until a member of station staff told him that something unusual was taking place ‘upstairs’. He went up to the platform at about 19:25 hrs to find that the evacuation had already been stopped” (para 52.)
So someone who presumably was “a member of experienced staff with practical knowledge” (TJ’s words) was actually on site, but nobody thought to tell him.
The report also makes it clear that the agency staff member went to the western end of the platform to wait for the driver (para 41), and then “observed passengers walking from the track side up the ramp at the far [i.e. eastern] end of the platform” (para 43).
And a minor point: it’s “Investigation” (singular) in the RAIB’s title.
@ngh – “The short section of the 3rd rail between the tracks (usually on the outside between stations on 2 track sections)” can be viewed on this video:
https://www.youtube.com/watch?v=hV9sdxYU5NE
If you go to 5:50 and follow the conductor rails from Queen’s Road Peckham as far as approaching Peckham Rye, just after Cow Lane overbridge and the now redundant/removed trailing crossover beyond, you will see much more clearly than the daylight photo in the article above that the conductor is on that inner side because the track runs on the overbridge over Rye Lane just outside the station and has to be located remote from the ironwork of that overbridge on the outside. Indeed, if you run from earlier in the video (only 25 mins to Vic from London Bridge, then, anyway!), you will see that on most overbridges from South Bermondsey the conductor rail is totally absent.
Also the comment “usually on the outside between stations on 2 track sections” doesn’t really count on the South London Line because that section was laid for three tracks as far as Peckham Rye from London Bridge and the two outside tracks were not significantly realigned when the centre one was removed from South Bermondsey to Peckham Rye. However many original overbridges have since been replaced by twin single-track bridges with a gap in between and hence those conductor rail gaps across them.
I remain astonished that there were two major failures, in that nobody sought to shut down the train in such a way to enable it to release the brakes so that it could be drawn forwards in ‘safety mode’ or similar to the platform, or that nobody thought of isolating the third rail power supply, either trackside (with a portable circuit breaker) or otherwise before detraining. At least in the olden days, another train behind could have been drawn forwards, coupled up, the brakes isolated on the failed train and then pushed forwards into the platform – a matter of a minutes to sort that one out to get the passengers off.
@timbeau – “The photograph taken from the cab of the train appears to show the full length of the platform, (or at least the part a 5 car train would stop in) which is concavely curved.” – not quite so because ‘short’ trains are stopped if possible further on along the platform in order to alleviate the overcrowding (which can be acute) at the stairway at the eastern end. Have a look at the video for the station layout and ignore where the 2-EPB’s on the South London Line service used to stop.
Astonishing in the modern age that we still rely on track circuits (which can be as long as a mile) in so many areas to know where trains are. Surely GPS could be used in such situations (accepting some areas such as tunnels would be challenging)
The biggest risk was probably stepping from the bottom step onto the conductor rail as people would have been holding the handrails ensuring they had a good ‘earth’ contact ( I assume that they are not insulated to prevent shocks unlike tram handrails ?). It is not clear how good an insulator shoes are – the standard on prevention of shock when moving from the platform to the train assumes a quite high value but I am not sure if there is any evidence to justify this.
Walking alongside a live conductor rail is not to be recommended but is not immediately fatal – you either need to touch it with your (bare) skin either by staggering into it or falling on it. . Graffiti vandals normally get away with it as do most other trespassers.
Also the comments above indicate it was the rear cab door relay that failed – from my skim reading of the report I thought it was a relay that disabled the active (front) cab. Otherwise I would have thought the fault finding system would have shown where the fault was located and allowed the doors to be cut out.
Lack of training and practice in response to failures or emergencies is a common problem seen in lots of incidents.
James: – Reliance on GPS – don’t forget that the American Military can turn off GPS at any time they want due to threats, also it is very easy to jam. In the past they moved the satellites over conflict zones reducing the performance in the UK. The UK (NATO ?) military have experimented with area GPS denial by jamming during military excercises – see the GPS warning notices published at intervals.
This is one of the reasons for the EU having their own system (Galileo) so it is EU control. The UK are taking about having our own GPS system post Brexit but it will be at least 20 years to be in place. Until then we need to rely on the Americans, Russians EU or in the future the Chinese for a reliable service.
I would not want to use a short circuit bar to short the third rail power supply. The main purpose of those bars are to ensure that power isn’t turned on. If used to shord a live third rail there will be a non-neglible amount of sparks…
Also the only really safe option to move a train with broken brakes is to have a wehicle with working brakes coupled on each side of the train. It might usually work with just a wehicle on one side, but what if the coupler breaks? Downwards slope – runaway train. Upwards slope – train continues to move for a while and might start moving backwards, slamming in to the helper train. Flat surface – the train might move a bit, pass a signal at danger and come into another trains path and in worst case cause a collision.
I don’t know how the couplers work on theese trains, but at least on some trains (worldwide, that is) the couplers also connect electrical control circuits. With two compatible trains, the trains will probably try to behave as one unit, i.e. door control signal is propagated to the working train. With two incomaptible trains, all sorts of trouble might arise. This can be avoided by just sticking some insulating stuff between the electrical parts of the couplers, but that’s not really a nice solution. Also if coupling the air break lines (also a part of some automatic couplers) you might void the waranty of one of the trains (for example the clas X60/X61/X62 in Sweden mustn’t be coupled with other trains).
James
Track-circuits are very useful.
I have just read another RAIB report & immediately wondered how much more damage & confusion would have occurred if axle-counters had been in use, as then, the first “detection” would have been when a train ran over one of the several broken rails …..
Accountability, “line of command” & communications.
If you look at Page 13 of the RAIB report, there is a diagram of the supposed communication routes & lines of responsibility involved in this incident.
Anything but straightforward & (IMHO ) how not to do it.
@Rogerb My completely uninformed speculation is the train maybe has a “dumb” failsafe circuit for the safety critical interlocking that the computer is not involved in.
The computer will be monitoring the inputs from the same sensors (which would have been showing as normal) but may not have had a sensor in the right place to detect the output from this particular relay was incorrect.
(NB this is a total guess. I am literally making this stuff up)
You might not want to rely completely on GPS, not because of the very unlikely scenarios of it being turned off or spoofed, but because reception problems in cuttings and tunnels. But it would still give very accurate results at nearly all times, and its very cheap to deploy. So adding it as an overlay to provide extra information seems very useful. As a belt I expect it would work better than track circuit braces.
A few observations
Checklists,
You don’t need a checklist. Or rather the checklist need only have one question.
Have you already contacted the signaller ?
The case of the checklist on flight 1549 is exceptional. As the subsequent film showed, there was a very small window of opportunity to turn round. Checklists aren’t meant to guarantee a good outcome. They are meant to instigate a procedure that gives the greatest probability of getting out of a bad situation (or preventing one occurring). They won’t catch everything and can make situations worse. But are generally, not always, better than not having one.
Single point of contact,
Ideally there should be single point of contact. This was rigidly enforced throughout the Apollo missions. I imagine if there was a genuine need to talk to someone else (.e.g. a doctor) they would have ensured that he would have been standing next to ‘capcom’. However in the real world that is not possible but it seems people need reminding that only the signaller can authorise a movement. It follows from that (Bethnal Green) no-one else should say anything that could be construed as authorising a movement and the driver should certainly not feel intimidated to do something as a result of anything said by anyone else.
Modern trains,
The railway is a very different railway from the days of low tech EPB stock. One consequence of this is that coupling up in an emergency (especially one involving brakes applied) should be very last resort. Drivers are not expected to know their stock when it comes to fault-finding which is now quite complex. So they should phone the signalman for a brief call to explain the situation, put the phone down and then phone the fitters on the helpdesk located within the Regional Operations Centre at Three Bridges – unfortunately on a different floor to the signallers. Drivers are encouraged to do this. It is down to the specialist on-call fitters to talk to the driver to sort out the issue. The on-call fitters are located within the control element of the operations centre so any controller can wander over to listen in or talk to the fitter.
Communications,
I can understand bungles but I was very disappointed to read that no correct voice procedure was used. As well as liberal use of the phonetical alphabet, all instructions should be read back to ensure they haven’t been misheard and to firmly establish that an instruction has been made to do something.
Technology,
Most cabs nowadays have forward facing cctv in the cabs (can save hours if an apparent suicide might have a more sinister explanation which involves a crime scene). If that was available to the control centre then the situation would have been immediately apparent. Note: signallers do not have access to cctv screens. They have enough to do just looking at the signalling diagrams.
Why couldn’t the signalling centre contact the driver directly, rather than having to ask the operators control room to tell the driver to contact the signalling centre? Is there only one communications channel which was engaged whilst the driver was talking to the operators control room and engineer?
This and similar situations have parallels with the Airline industry back in the 1960s & 70s. Poor communications and processes led to a number of accidents, including the worst aviation accident in history at Tenerife North in 1977. These accidents led to an overhaul of communications procedures and processes, standardising the way in which communications between the aircraft and controllers was performed, as well as standard checklists for dealing with incidents.
Stopping this happening requires significant structural change. There should be single points of contacts to the drivers, there should be dedicated incident managers controlling things, there should be properly structured and checklisted responses and there should be more training for everyone on how to deal with such incidents.
Nevertheless, I don’t think this incident was serious enough to cause anything to significantly change. If some of the detrained people had been electrocuted, then maybe there would be enough realisation in the industry and enough external pressure to make changes, but as it is, everyone involved is too busy to make significant structural changes. Maybe I am too cynical, but I would expect the official reports will make a number a recommendations, which probably won’t go far enough, but will be largely ignored anyway. The collective response will be “Phew, we dodged that one, time to carry on”.
Is there only one communications channel which was engaged whilst the driver was talking to the operators control room and engineer?
Yes. Because the last thing you want during general operations is multiple voices talking over each other, or multiple calls for attention.
What happened is why you you’re meant to contact the signaller first – because if you then get caught up talking to SC then at least the signaller knows what’s going on.
Of course, the problem was then compounded by the fact that the driver had to go back and check the rear cab – that meant that, when he wasn’t talking to the engineer, he wasn’t in the cab, and thus not hearing the signaller’s attempts to get in touch.
This is, of course, one of the few things where having a second person on the train would definitely have helped – because it would have meant that one person could watch over their shoulder and do ‘comms’ while the other ‘fixes’. Which is standard practice in the tech industry for stuff like this.
Which was partially what I was trying to get at with my conclusion at the end. There was some spectacularly bad comms behaviour by Arriva SC and the driver here. Reading between the lines, no one seemed to recognise that you have to have way more comms discipline (and your practices and procedures have to acknowledge that) when you have a single-point-of-contact for everyone at the scene-of-crisis.
The talk comments regarding in-cab indications as to whether the line is live or not I feel are irrelevant and could potentially confuse matters in exactly the type of way where the report has highlighted serious failings based on assumptions. There is a white line light in the cab but this can go out on occasions other than when there has been a switch off of the electrical current. It would be a danger to start second guessing whether the line was live by the presence, or otherwise, of a line light.
The only way to establish that a switch off has taken place is with clear communication with the signaller or via direct contact with the Electrical Control Operator. Protocol dictates that that first attempted contact should be with the signaller for the very good reason that the driver also has to request for signal protection (a block) of the adjacent running lines. In a relatively recent rule book change the driver now has to be provided with a line block authorisation code which they to give back to the signaller for the block to be lifted.
Regarding the use of a short-circuiting (isolation) bar there is no rule book requirement to use one if the ECO has confirmed that the traction current has been switched off. I believe however that most drivers would consider it prudent to use one as a ‘belt and braces’ approach, although the ECO must be informed when and where it has been used.
On the subject of aviation parallels:
@PoP. Flight 1549 was the one that landed in the Hudson. I think the previous reference was to Air France 447; where the crew had a solvable problem (iced-up pitot tube), disregarded the check list, made bad decisions and stalled. All lost in the Atlantic.
@Jimbo. The Tenerife accident, if I recall correctly, was primarily caused by the confusing and alternating use of the terms ‘depart’ and ‘take-off’. Subsequently terminology was tightened up and they now each mean specific and different things.
@GREG TINGEY That’s something much more like what control would have been looking at – showing TD berths and perhaps routes set, but not much else. The signaller would have been looking at something that also has track circuit indications, as I said in my last comment.
Re Latecomer,
The BIG problem is that because of the relay fault and knock on effects the 3rd rail supply indicator may have shown nothing when the supply was actually live, hence the importance or contacting the signaller for isolation and not having blind faith in what systems tell you as they might be wrong.
@Littlejohn – The primary causes of Tenerife North was confusion about terms, and the due to fog, the controllers could not see what was happening with planes. At Peckham Rye, there was confusion about the term “Detrain” and various control rooms were not clear where the train was. Interesting parallels.
JohnB – with regard to GPS and train position you also need an accurate model of the railway GPS co-ordinates – positions and the railway have not always been accurate in the past – I am thinking of the user crossings that were shown on the wrong place on the diagram following re-signalling. Also the diagrams are not fail safe – if they show a track circuit as empty there is no fail safe guarantee this is correct.
Also with the inevitable errors in GPS signals if the train is shown on the adjacent line do you shut it due to the risk of a collision ?
In terms of the references to the failed relay paragraph 70 of the report describes the function as ‘to monitor the active status of the driving cab, so when it changed state the train’s systems detected that the cab was no longer active,’
Littlejohn,
We are going off topic and I am sure you knew this but the Tenerife crash caused massive changes to airline practice.
Part of the problem was the co-pilot (who appeared to realise what was happening) did not dare question the actions of the very senior caption who had a reputation for being authoritarian. No longer is it the case that a pilot is unquestioned. Others are encouraged to question decisions. To do this they are taught to do this in a non-threatening way. Psychologists were brought in to introduce standard phrases devoid of implication e.g. ‘I have control’, ‘You have control’. There are even standard phrases of escalation e.g. ‘I do not feel comfortable with that decision’. When there is time, experienced pilots are encouraged to explain their reasoning to more junior pilots in case they have missed something.
What is more, a lot of the changes in operating theatres and on the railway can be traced back to what happened at Tenerife and I suspect the tightening up of wording of messages that is supposed to have happened could be traced back to this (take-off v depart). It is one situation where you really have to be pedantic. ‘I am located 30m from Peckham Rye station in sight of the platforms’ not ‘I am at Peckham Rye’.
ngh,
Interesting that the Underground has a special trackside ‘signal’ to show that the following electrical section is not live. It consists of three red lights that are only illuminated when there is no traction current available. Presumably these can be relied upon at the instant they are viewed. I have often thought this counter-intuitive (power indicates there is no power) and wonder how they are electrically connected. It may be that these cannot be relied upon as they are intended as a warning to a driver not to enter the electrical section and make it live.
I’m surprised that the GRT Duty Controller at TBD ROC didn’t contact the GTR CCTV operators (also based at the ROC) to ascertain the presence or otherwise of the faulty train via the station CCTV on the platforms at Peckham Rye (GTR managed ). Instead he choose to call the station (agency ticket line staff) to get them to check the presence of the train.
However, as this excellent article points out, it was probably too late by then, as the events had already spiralled out of control.
I would have thought the above is simply a realisation that “lights can fail” and it is better to falsely indicate that there is power than to falsely indicate there is none.
Really fascinating (and scary) read.
As a former SR driver I am appalled by this incident. In my day we had it rammed into us right from day 1 that the dangers of the juice rail and shoe gear had to be to the forefront of everything we did trackside. No-one I knew and worked with would have contemplated detraining passengers without checking the traction current had been discharged and deploying an SCB to make sure it stayed off. I accept the driver in this incident was in a difficult position but it was he who initiated the sequence of events by failing to advise the TB signaller before doing anything else. He then compounds that by apparently not even considering the state of the juice rail thereafter. This is the second time recently on the former SR where train crew failed to consider the juice rail in the immediate aftermath of an incident.
This reinforces a view I’ve held for a while that driver training is too rushed and cutting important corners resulting in train crew showing a lack of understanding of the rule book or a failure to apply its provisions when under pressure. The collision at Plymouth is another example. Whilst none of these incidents is anything like as serious as Ladbroke Grove the underlying basic issue of the quality of driver training has a similar feel to it to me despite changes following that collision. Someone needs to get a grip on this before there is a really serious incident.
@JOHNM That’s an example where GPS is much more accurate *along* the direction of travel, and a track circuit more accurate *across* it. I hope the railway do have accurate maps of their systems, to the accuracy of the differential GPS used for surveying, which is cm.
I feel so sorry for the driver in this incident; the pressure must have been extraordinary with hostility from all sides and a profound lack of support from the people who were there to help.
Elements of the incident bring to mind the 2012 film “Compliance”, a true dramatisation of an incident in a fast food restaurant in the US, and in turn the Milgram Experiment. With Compliance it was widely reported that many cinemagoers found the film quite implausible, despite the fact that it was carefully written and produced to reflect what really happened – a malicious caller masqueraded as law enforcement and, through a clever process of escalation, persuaded the store manager to take increasingly outrageous action against a young female employee.
In this case we have a clear voice of authority on the end of a phone, who genuinely represents the driver’s employer. It may seem incredible to us that the driver never asked about the status of the power, but the well-documented psychology of the Milgram Experiment demonstrates that in many cases, true or perceived authority over-rides rational thought.
Yes, the signaller should have been called first, but the command centre should also have asked “have you informed the signaller” as well as determining exactly where the train was. In a state of panic under pressure one can understand why the driver effectively called their bosses for support as the first step, however incorrect that might have been.
As an aside, I think “signalling” is an increasingly inadequate term for what takes places at ROCs. IMO a change to “Rail Traffic Control” would underline the importance and sheer criticality of this work for all concerned, by drawing a clear parallel with the air equivalent.
@Graham F
“stopped if possible further on along the platform in order to alleviate the overcrowding (which can be acute) at the stairway at the eastern end”
I don’t understand the logic of this – surely the train should stop with as much of it as possible under the awning, and alongside the entrance/exit to the platform? To do anything else not only enforces a long walk on any passengers joining or alighting the train, (part of that walk being alongside a steep drop off the platform – particularly dangerous if the entrance is beyond the front of the train), but it also causes crowding on the platform near the carriage closest to the entrance/exit, increasing dwell times).
But it does seem to be becoming a thing – Network Rail in their wisdom have recently moved the 8-car stop on the down platform at Kingston to the end of the platform, with all the consequences listed above – plus the fact that when you have come up the stairs, the station buildings hide the rear of the train from view, so you can’t actually see that there is a train in the platform
The initial cause of this incident was a sticking relay. Has anything been done to prevent a re-occurrence? (Or at least add it to the diagnostic checklists the driver and/or service controller should go through?)
Pedantic of Purley et al The power on lights on the Underground were originally a non-fail safe indication for the driver. The instructions were that you should stop before the illuminated lights if possible if not coast to the next station if possible. Originally the gap between two sections was shorter than the distance between the two sets of shoes on a motor car so the section in advance would be energized for a short time as each motor car passed. This probably goes back to standard tube stock with 600 V control circuits which would ‘drop out’ on loss of traction supply. Modern standards have increased the length of gap so they are no longer bridged but short gaps probably still exist. There was one at the exit of London Road depot and a train managed to weld itself to the track there when the driver passed an illuminated traction indicator and connected to the depot traction supply to the next section where the traction had been discharged and a short circuiting device placed due to an incident.
The ‘modern’ ATO systems such as that on the Victoria line treat the traction indicator as a stop signal and will stop automatically before they reach them. In some cases the design is such that they will be held at the previous station where the traction gap is some way in advance of a platform. To show the operator what is happening there is a traction supply repeater at the platform – I seem to remember this has a yellow background – with yellow lamps but I might be wrong.
CHZ – you need to consider that stopping trains in a tunnel carries it’s own risks so you want to avoid this if possible.
A long while ago I walked past a traction indicator that was not illuminated during a trial evacuation, at the time I was not confident enough to raise the alarm. I never did discover if the next traction section was still alive or not however a couple of hundred people involved in the trial survived including a number in wheelchairs.
@Timbeau
“I don’t understand the logic of this”
Isn’t the point that there’s often still a crowd of people from a previous train waiting to go up the stairs, so it’s unhelpful for an incoming train to open directly onto this?
Interesting and well written article. Suitably horrendous circumstances and potential, but thankfully avoided, consequences.
I’ve read enough safety reports in my time to not be overly surprised by the failings that were identified. I am left wondering whether the increasingly fragmented structure and further narrowing of roles and skills in the railway is a factor in these incidents.
We also seem to be seeing more instances of trains failing within sight of station platforms but with very long incident durations – often several hours. I may be deluding myself but this didn’t seem to happen so much 10 or 20 years ago especially when trains were still on the track (i.e not derailed which is a different situation altogether).
I find it hard to understand how there can be any doubt whether the power supply is on. Even on a stationary train you can hear the ventilation and lighting (and probably other) equipment humming away – unless the defect also caused the ancillary systems to shut down too. In the RAIB report, there is another case of poor communication in paragraph 26, in which the report says the driver reported losing all power. That’s not the same as losing the ability to start due to the brakes remaining on, and the report does not clarify what the driver meant by saying this, and whether it influenced the decision higher up the command to detrain without checking with the signaller. These reports are usually a great example of clarity, but this one left me wondering and still asking questions.
At any rate, many years ago I witnessed a mass line incursion at Putney when there was a ‘final straw’ platform alteration, and a load of people went straight across the tracks to the opposite platform. Fortunately, those who trod on the live rails happened to have sufficient footwear, and the incident was over before anyone in authority had time to react and close the line.
@Anonanonanon @Timbeau: I took it as a way of preventing passengers awaiting the next train from crowding around the same pinch points that passengers exiting the previous train are trying to exit through.
Or to stop passengers crowding by the entrance to the platform and blocking it.
On the tube, the cab telephones used to work by the driver attaching crocodile clips to the two bare wires suspended along the tunnel wall.
It is my recollection that, in an emergency, the driver could personally cut off the track power automatically by short circuiting the telephone wires. Now that there is cab to shore radio, have these wires been left in place?
Paul’s comment above indicates that certain safety aspects of training are not being given the appropriate emphasis. It looks like this area needs to be thoroughly reviewed.
BGORUG SECRETARY mentioned a SPAD near-miss at Bethnal Green.
Thank you – this is relevant to this discussion IMO:
https://www.gov.uk/government/publications/safety-digest-042018-bethnal-green/operational-incident-following-signal-passed-at-danger-bethnal-green-8-april-2018
Both cases seem to be Driver incorrectly accepting authority from Company rather than Signaller.
@PoP Not quite so off-topic perhaps, as the parallels are so marked and the lessons to be learned so similar.
However, to round off, apart from standardisation of dialogue the big advance resulting from Tenerife was the introduction of the snappily-named Crew Resource Management so that we now have (most of the time) a team rather than a collection of individuals.
“then drive the train in full manual override mode” – why not override immediately and move to the platform with the passengers?
@Greg Because a door might be open or something. There are good reasons why some of the overrides shouldn’t be used with passengers aboard. See https://assets.publishing.service.gov.uk/media/547c8fb7ed915d4c0d000159/R052014_140306_Lebanon_Road.pdf (in that case it was accidental rather than intentional activation but it should give you an idea of the sorts of things that can happen)
‘then drive the train in full manual override mode’ this would not work as the train had no active cab !
Stunt Pants et al – you stated ‘Both cases seem to be Driver incorrectly accepting authority from Company rather than Signaller’. In my view the primary error are the representatives of the ‘company giving instructions they had no right to give – the driver not accepting it is a second line of defence but is very weak as they are in an unfamiliar stressful situation and probably think they are subserviant to the company and need to accept their orders.
@Muzer/Phil E
” I took it as a way of preventing passengers awaiting the next train from crowding around the same pinch points that passengers exiting the previous train are trying to exit through…..Or to stop passengers crowding by the entrance to the platform and blocking it.”
But then they just crowd round the point where the end of the train is going to be which, in the case familiar to me, happens to be a much narrower part of the platform. (And at only 4tph on my line, if the passengers from one train are still clearing when the next one arrives, something is dangerously wrong at the barrier line)
Unless people know that’s what’s going to happen, they will all have to hurry to the nearest point of the train from where they were waiting near the entrance, when the train does arrive, thereby getting in the way of everyone alighting from the train and trying to get to the exit. (And then crowd onto the end carriage because they can’t get any further down the platform because of the press of people coming the other way)
Back on topic, in the days of slam door stock when it was almost impossible to prevent passengers “self-evacuating” it did seem, from my experience of such an event that most people were aware the rails (which had to be crossed to reach the platform ramp) could be live. In fact the lights went out on the train, presumably because the power had been shut off, almost as soon as the first people had baled out.
@JohnM
“the primary error are the representatives of the ‘company giving instructions they had no right to give – the driver not accepting it is a second line of defence but is very weak as they are in an unfamiliar stressful situation and probably think they are subserviant to the company and need to accept their orders”
Or indeed the driver may have assumed that the signallers had given the Strategic Commander authority to instruct the driver to proceed – i.e the instruction was from the signaller, but relayed through the StratCom.
Two observations:
1. This is probably the second ‘near-miss’ I have read about that was caused by a misunderstanding during communication between the driver and controller/signaller. I can’t remember the date of the first one – it was when a Grand Central HST suffered a brake lock near York, and the driver jumped out to investigate thinking the signaller had already blocked the adjacent line only to have to jump face down into the gravel as an East Coast (as it was then) train whooshed past him.
If I remember correctly, the French have a set ‘railway vocabulary’ for use in radio communications on the railway, with enforced repetition of commands (yes, commands) issued by the signaller. Much like every pilot is forced to repeat commands issued by Air Traffic Control. Sounds like something that should be adopted on the UK railway sooner rather than later.
2. I fully understand the driver was stressed and suffering from cognitive overload. But – frankly – it is astonishing he decided to evacuate the train without first checking whether the power was off. We can discuss policies and training as much as we like, but how difficult is it to hammer the message home to third rail drivers during any kind of training: if the juice is on, nobody leaves the train. End of.
straphan:- there is a simulation of the event you described on ‘Red Alert’ there were two people on the track – the driver and someone with train knowledge. If you want to be frightened listen to it.
2: In terms of your second comment ‘hammer the message home to third rail drivers during any kind of training: if the juice is on, nobody leaves the train’ so we are going to have the traction current turned off every time a driver exits his cab via the side steps ? The problem is the driver learns ‘it is alright for me’ and then applies this in a situation where there are untrained people. What you do often will always come to the top of the thought process. Requiring two similar but different responses do not work well unless they are frequently trained to reinforce the alternative message and the situations that it is applicable.
“a member of experienced staff with practical knowledge”
If this member of staff is at 3 bridges, and is in charge of say the South Central section, he is not going to be as useful as a member of staff at say Peckham Rye in charge of say 10 stations and the railway in between.
Having worked as a (trainee) Signalman, I can think of lots of things that I would authorise after looking outside my ‘box window, but would not authorise after looking at a signalling diagram while sat in an air-conditioned room in 3 bridges.
Proximity and detailed local knowledge regularly updated by being in the area on a daily basis make a big difference.
As for a railway language, I though we had one, I certainly remember using fixed terms such as “Advance”, “in the rear of”, “up”, “down”, “normal”, “reverse” etc. to reach the CLEAR UNDERSTANDING demanded by the Rule book then in force.
As for criticism of the driver, my understanding from reading the report, was that he thought he had been given permission to detrain the passengers… If this has been given it is easy to assume that the person giving this permission has ensured that the power is off. I admit that I would not be happy and would not consider this a ‘clear understanding’ that the power is off and I would want at least verbal confirmation of this.
@straphan
“it is astonishing he decided to evacuate the train without first checking whether the power was off”
Yes it absolutely is. But as per my earlier post this is in line with the outcomes of the Milgram Experiment, which has been repeated many times all over the world, partly because the results are so difficult to believe.
In essence, it has been scientifically demonstrated over and over again that a large majority of intelligent, conscientious, well-intentioned people from all cultures and backgrounds will take irrational and irresponsible actions when a source of authority tells them to do so.
Straphan:
Wait — is there not even a rule on the books in the UK demanding that spoken safety-relevant messages be read back?
I can vividly imagine compliance with such a rule slipping away over time, but not having it in the first place sounds … curious.
We should remember that humans always make errors – the best measurements of human error rates are somewhere in the range of one in ten to one in a thousand. Some may be caught by the person making the error but the normal safety view is that the second or more independent check should catch most errors that pass the previous level(s). Hence the three levels or more levels of checking in signal design & testing, though even here design errors manage to get through hopefully they are discovered before the accident occours.
This leads to the so called Swiss Cheese model of safety where there are a number of layers of Swiss cheese with holes in. These layers move about randomly. If the holes in the different layers line up the arrow of fate shoots through the aligned holes and the incident happens. The idea of investigating near misses ( or near hits if certain people read this post) is that action can be taken to reduce or remove one of the holes in a particular layer thus making the actual incident less likely to happen.
The rates are very dependant on the nature of the task, the training as well as the time of day and factors such as fatigue.
I always thought the aviation industry was a paragon of safety and thought that there would be some feedback from the AAIB to the RAIB following them being co-located to the same offices in Farnborough. I was quite suprised that the first report I saw where there was an interaction between the two branches was the other way round where the AAIB report pointed out in two places that the Railway Industry do it better than the aeronautical industry. Have a look at https://assets.digital.cabinet-office.gov.uk/media/55a4bdb940f0b61562000001/AAR_1-2015_G-EUOE.pdf if you are interested (but not before you are due to fly).
When I started in incident investigation I thought a lot was about technical failings but soon came to realise that it is the humans that mess it up. There are very few instances where an accident is due to a unknown technical failure.
One of the features of the aviation industry is a check list. Check lists in this situation would have helped.
However, it is not helped that the poor person on the ground is dealing with groups of support people in two different location who were not ‘at one’, even if they were communicating.
Like many of the situations in control rooms, the number of people required for the routine activity is small, but increases rapidly as the conditions degrade. This is a factor built into commercial aircraft crewing and ought to be built into a rational, unemotional review of how normal, degraded and emergency situations are dealt with on railways. This might include a second safety trained person on the train………but I am not starting a debate about who works the doors!
The advantage of a formal checklist on rails as opposed to in the air or in space is that once you’ve stopped moving horizontally you don’t need to worry about the vertical. The driver, in this instance, failed to follow the rule to contact the signalling centre first and that compounded as time passed. Whether there had been recent pressure on him, or other drivers, to contact his company’s op centre first isn’t clear, but by them not contacting Three Bridges either they are additionally culpable.
As a passenger I’d have wanted to be told the power was off before I stepped out the cab, no matter how long it had been. I’m surprised if no-one did (which might have prompted a recheck).
Sorry, but I do think that this one of many reasons why all trains should have a minimum of 2 staff. Just the additional customer interface, with all that implies, would improve rail travel (especially off-peak).
Unclear radio communication and divided lines of communication between control and signallers were also a factor at Ais Gill in 1995, where Control said “We’ll arrange all that, Driver” and this may have been interpreted by the train crew as meaning the signaller had blocked the line.
Multiple factors added together here to produce an unpleaseant outcome.
A couple of things to point out:
ARL Strategic Command asked the driver to detrain because they believed the train was in the platform. This is a standard daily request to drivers with faults that will cause the line to be blocked for more than 3 minutes.
If the ARL controllers had understood the location of the train, then the driver would have been asked to trip everything to get the train in to the platform.
If this didn’t resolve it, then a controlled evacuation via the front detainment steps would have been undertaken, but only once the NR MOM, ARL driver manager, and ARL duty station manager for the area were on site. In this scenario, the NR MOM is in charge and will authorise the evacuation to begin once they have ensured that the power has been discharged.
With regards to the Bethnal Green incident – comms and authority issues again, but the ARL controller did not give a driver authority to pass a red signal as the BRORUG secretary states earlier.
Re reinstating guards – there are already thousands of people on each train (at least during rush hour).
Maybe some of them should be trained in: first aid, evacuation procedures, and train radio procedures.
As has been pointed out, driver isolation under stress is a big factor. Having an “assistant” (even a partially trained one) would cut down the feeling of having to be in two places at once.
Training could be paid for with a season ticket discount.
No need for scheduling as it’s only additive to existing assets, and provided you train enough people statistics will take care of the rest (at least on the most used trains, ie the ones which are the hardest to control and evacuate).
A barrister with a check list is certainly a force to be reckoned with!
Re: JOHNM 24 October 2018 at 17:52
“I always thought the aviation industry was a paragon of safety and thought that there would be some feedback from the AAIB to the RAIB following them being co-located to the same offices in Farnborough. I was quite suprised that the first report I saw where there was an interaction between the two branches was the other way round where the AAIB report pointed out in two places that the Railway Industry do it better than the aeronautical industry.”
I am not in the least surprised. The aviation industry is VERY safety conscious and actively looks for ways to improve safety. The rail industry has far too many people who think that the long pedigree of their industry must have ironed out all but a few minor kinks by now. They therefore believe that they have nothing to learn from anybody else. As a consequence they fail to look for ways to improve safety.
The industry has changed. People need to get up to date with the consequences of those changes.
Anon^n
In this case we have a clear voice of authority on the end of a phone, who genuinely represents the driver’s employer.
Who is a TOC, not the track-owner, nor the maintainer or owner of the train. Fragmentation & divided lines of communication.
WW
We also seem to be seeing more instances of trains failing within sight of station platforms but with very long incident durations
Almost all on “South Eastern” too?
I note that you too, finger “fragmentation”
Stunt Pants
Fragmentation again.
John M
Yes – to get an actual accident where people are injured or killed takes quite a lot of work – all the “holes” have to line up, or all the safety precautions have to fail in exactly the “right” ( i.e. wrong ) order.
The paradigm for this is surely Hull Paragon, 14/2/1927.
130
However, it is not helped that the poor person on the ground is dealing with groups of support people in two different location who were not ‘at one’, even if they were communicating. fragmentation.
“..drive the train in full manual override mode”
Can you clarify what you mean by this? As a 378 driver this makes no sense. They’re driven fully manually as it is. I think you mean something more like “isolating one or a number of safety systems to get brake release”.
Nameless,
It is true that tube drivers could cut off the power by pinching the wires. I am pretty sure this is still true. But, unless the rules have changed, it cannot be relied upon for an evacuation. If the electrical controller does not hear within eight minutes he is to presume it is just an intermittent fault and reinstate the power. So it is still essential to ensure that the power has been properly isolated and get confirmation of that.
Re Bob,
It has already been happening on some Southern services unofficially for years.
e.g. (I have seen this particular one several times) person falls ill on a train (455) into London Bridge, someone who doesn’t understand the ramifications of pulling the emergency lever on BR era stock (brake application and consequent delay due to reset procedure) is informed why they shouldn’t by multiple people. Patient is cared for by several others, others check latest info on arrival platform at LBG and pass the information on to the person who has called 999 and is talking to LAS who also informs them which car and door to head for. The duty cycle paramedic at LBG is waiting by the correct door on arrival and waits till enough people have got off and out of the way before boarding. Ambulance waits on the forecourt till the duty cycle paramedic confirms patient location.
Perhaps, by analogy, the “fail-safe” principle should be renamed “fail-safer”. The much discussed relay “failed safe”, but the failure nevertheless put people at risk (indirectly). The safest way to fail is not to fail at all.
“The safest way to fail is not to fail at all” brings to mind the famour Douglas Adams quote.
“The major difference between a thing that might go wrong and a thing that cannot possibly go wrong is that when a thing that cannot possibly go wrong goes wrong, it usually turns out to be impossible to get at and repair.”
Pedantic of Purley & Nameless et al: ‘It is true that tube drivers could cut off the power by pinching the wires. I am pretty sure this is still true.’ I am not aware of the current situation as there were lots of arguments both for and against removing the Tunnel Telephone Wires. The proper method of operation is to use the Tunnel Telephone Handset which has a button to short circuit the wires and also allows the train operator to speak to the service controller (not the electrical control room operator). Following operation of the Tunnel Telephones the Tunnel Lighting should come on automatically. If detrainment is to be carried out a short circuiting bar is placed on the track close to the train to ensure that if any attempt is made to recharge the traction current it will trip out on overload preventing electrocution and also reducing the risk from moving trains. If the customers have to cross a substation gap where there will be a traction gap indicator the next section will have to be discharged via the service controller as it is not possible to reach the wires from track level. Another SC bar should also be placed after the gap and at the station where customers regain the platform.
There are also rules about not placing the SC bars near junctions following an event where due to mis configuration of the current rails the positive conductor rail of parallel section was connected to the negative of the discharged section. resulting in both rails in the discharged section being raised to +400V.
Note only tunnel sections have TT wires – outside you have to rely on the radio or signal post telephones to get the traction current discharged or in extremis place the short circuit bar on live track. This should work but needs to be done properly and with confidence if you are not to risk injury from the electrical arc.
I’m with AlisonW – I would want to know that the power was off and I would ask if I hadn’t been told. As an SWR commuter, there’s a tiny chance I might have to do this one day. Just looking at the third rail makes me a little queasy, knowing what it is capable of.
The report hints that even apart from the trend to contact the wrong person, radio procedures at both ends were lax. Maybe GSM-R could be reconfigured to limit where the calls can go if people won’t do it for themselves. I would like to have seen transcripts of the calls in the report, as you sometimes see in air accident reports, although perhaps not those from the AAIB.
Standardisation is the key I think. Decades ago I was on a DLR train that was stuck in a signalling failure and it was notable how structured the message over the radio was and how the staff member on the train repeated it back word for word to confirm. Perhaps big trains have something to learn from small ones.
I am on the other side regarding asking the driver. If a driver is visibly stressed then I would have reasoned that the last thing they want is each of 700 passengers individually asking for the same bit of re-assurance. Before reading this report, I would have assumed that it would have been turned off as part of standard procedure, and that me asking would just make other passengers more nervous than they already would have been.
Mind you, whatever I had been told or assumed, I would also have done my best to avoid coming into contact with any rail, just in case.
Of course, I probably will ask now, I won’t be able to stop myself. But that is with hindsight.
What still amazes me is gtl had a duty station manager at the station (according to raib) and nobody used him/her to manage the situation.
Since a major issue seems to have been uncertainty about who was “managing the situation”, bringing in yet another person to stick their finger in the pie is unlikely to have made things better.
Though of course the duty station manager should have been involved, and could probably have made a useful contribution. But as a skilful carrier-out of instructions, rather than yet another person issuing them.
@ Malcolm – I’m in the “would have asked” gang. I have not read the RAIB report but if the train still had all its lights working, air con going and passenger info displays working after an hour stood still I’d assume the juice was still on. If the juice was off then I’d expect the train to go into a degraded state of in-car lighting cover and for non essential systems to be off.
This is purely from having worked for a railway and being lucky enough to have done the old LU “voluntary classes” years ago. This was a form of “night class” for the office wallahs to learn first hand about how the operational railway actually worked. I was lucky enough to have done a decent number of the courses which gives you insight into how things work. I know the “big” railway is a bit different but the basic concepts carry across.
Later contact and discussion with engineering colleagues always brought new insight on a vast range of topics like civils, track, rolling stock, signals etc which I’d not normally encounter. Ditto having the “safety role” for the Directorate I was in gave a lot of insight into how H&S professionals approach matters. I am very fortunate to have had all that learning even if most of it was not directly translated into day to day operational use. I fully accept the general public don’t have that knowledge / awareness hence their willingness to obey instructions given to them without a second thought.
WW: If it had occurred to me to wonder why the lights etc were still on, then yes, I too would have asked. (Though I might have instead asked the driver whether he needed help in managing the detrained passengers, rather than directly challenging his instructions to climb down). But sadly, I am one of those people whose brain tends to turn to mush when under pressure, and I am entirely capable of missing the most obvious of signs. For that reason, I would not recommend myself as a person to be put in charge of anything much, though of course if put on the spot I would do my best.
Re. WW and the degraded lighting state &c., I often wondered whose responsibility it was to light the candles in the corners of every car on the unmodified 1967 Vic. Line stock in such an event….
Apropos candles on the Victoria line 1967 stock…..already obsolete when the trains were delivered. We should be aware that technology has moved at such a pace that virtually every passenger carries their own torch. (App on smart phone!), compared with the situation just a decade ago.
Richard R – DLR may be better now but I remember an occasion around 2000 when I was on a westbound DLR train that came to a halt before the facing junction where the Bank & Tower Gateway routes diverge. The train captain announced there had been a complete radio failure and trains were not allowed to proceed to Bank without a working radio. DLR does not have trackside telephones so the train captains response was to ask the passengers if anyone would lend her a mobile phone so she could call control to ask what to do (that was when mobile phones were still rare). One of the passengers lent her his phone and we got permission to proceed to Tower Gateway instead of Bank.
100ANDTHIRTY: ‘Apropos candles on the Victoria line 1967 stock’ I thought they were oil lamps but I might be wrong. I suspect the reason they were still provided is that the emergency lights were supplied by electronic invertors and most early electronics were very unreliable. As it turned out those lighting invertors were very reliable despite using Germanium transistors and not having any surge protection against the high transient voltages occouring on the 50V when relays and valves operated. The same could not be said for the original auto-driver boxes.
I think the Victoria Line was the second application of these lighting invertors after their installation on the 1960TS motor cars – only 6 of these went into regular service on the Hainault loop so not much reliability experiance before 67TS was designed.
John… all LU train up to and including the 1967 tube stock had candle holders too and their emergency lights were filament lamps fed from the battery – very reliable. I think the inverter argument is a red herring. By the way, there were two types of inverter – the reliable on by Ferranti (remember them) and another supplier whose name is better forgotten (just as well because I have forgotten it!)as they were not reliable.
@Malcolm Failing safer is indeed the best we can do – and I think that needs to come with recognition that, in practice if not in theory, trapping passengers for several hours may be less safe than e.g. moving with the doors unlocked.
I remember being horrified by the report into a Central Line incident where passengers trying to escape a smoke filled carriage via the end doors were injured trying to climb over the zig-zag barriers that block exiting the train that way… and the conclusion was that these barriers should be made taller and firmer!!
If this evacuation had been controlled it would certainly have involved advising all passengers that the traction current was off once this fact had been established. Even when this has been confirmed passengers would have been briefed in small groups to only step on ballast not on sleepers. If it was necessary to step over the third rail people would have been asked to do so in a single ‘confident’ step (easy to ask I know). There would have been more than one person on hand at the point that people need to step over.
In darkness additional lighting would have been used along with glow sticks if need be. People would have been counted off the train and onto the platform to ensure that no one had gone astray.
AND …..
People should not be held on a train more than 2 hours, or alternaively, an evacuation should be complete by the time 3 hours is up …
See the article & discussion here
Somewhere ( I can’t find it right now ) is the agreement between all the various TOC’s the RSSB & other interested parties, including NR, as to waht the set procedures are ( should be ) for information, communication & detraining people.
Could some kind person please re-provide tha appropriate link, as it is directly relevant to this problem, especially as it’s all too obvious that it’s going to happen again …..
If if been stuck on a train for 3 hours is probably be willing take my chances with 400V live rails even if I had figured out that the power was still on. But I’m an impatient CEng with a good level of agility…
I think the travelling public think of railways as very safe, expensive and unreliable. There is always a danger that increasing the first of these increases the last two as well, and people will turn to road transport, where they have more control. You might live longer in a H&S culture, but all the extra time is taken up with the delays it introduces.
@STRAPHAN The French Railways do indeed have formal procedures for specific incidents and until recently I had the training material produced for UK Eurostar drivers. From memory each procedure had a code (a bit like IKEA products) and the driver would seek permission to carry out procedure BLANCO and both driver and signaller were required to follow a set script with read back (a vous) . Moral – don’t throw anything away.
@JOHNM The tunnel telephone wires on the Underground are now decommissioned and therefore cannot be used to discharge traction current. They are still in situ in the majority of the tunnels but have started to be removed on the Piccadilly Line.
@POP If traction current is discharged and the Service Controller is not notified of a reason why they will ask for current to be recharged after 5 minutes, was 7 minutes until last year.
Traction current has a habit of switching off when there are too many trains in a section. Rail Gap Indicators are provided at the start of a new section, they are triangular in shape with red lights on a white background. If one is illuminated we have to treat it as a danger signal and stop by it and contact the Service Controller for information. If the RGI is in an area with poor sighting a repeater is provided with a yellow background and yellow lights.
No harm in someone providing the link that Greg has asked for, if convenient. But just to point out that the minutiae of agreements is probably not too relevant here, as this article is really about the sort of thing that happens when, for the explained reasons, the proper procedure utterly fails to be carried out. Since human error remains, it is possible that something similar could happen again. Obviously the responses to the report of this one will be aimed at minimising this risk, though. It may not be too much to hope that another unplanned lineside detraining does not happen for many years.
Meanwhile, the amount of third-rail line should (ideally) be much diminished, partly for this reason. But on this occasion, people were also put at risk of other mishaps (see reference to trains still running on adjacent lines, for instance).
ATOC NR/GN SP01 Issue 3 June 2014 ATOC / Network Rail
Guidance Note – Meeting the Needs of Passengers when Trains are Stranded
https://www.rssb.co.uk/rgs/oodocs/atocnr%20gn%20sp01%20iss%203.pdf
Aleks
Thanks, that’s it.
In the context of this particular case & discussion, may I point everyone to pages 33-36 of that report?
And note how the procedure was not followed?
Some excellent comments above but one thing that has been nagging at me generally is the way that the railway seems to be using more untrained agency platform staff. You can see this every day at Clapham Junction on the SWR side, with a constantly changed group of staff who take very differrent approaches to how they approach the job. It would seem to be very sensible to make sure anyone in these roles has to be trained to go trackside, even if their day-to-day job is platform based.
We have much to learn from Japan here. There is quite high awareness here I think of the point and call system they use, and I think that mindset may have helped here. But for some reason there seems to be a real resistance to using it/introducing it here, which as far as I can tell comes from staff feeling silly doing it, despite the proven safety benefits.
More interestingly though I was at a recent talk in London by a JR East employee. He said that JR East have a large residential training facility at which several weeks attendance is manadatory for all new staff, including those who work on platforms. Part of this facility is a full size station and a three-quarter sized larger area of track and signalling. Both of these are used for training and he showed pictures of full scale training rehearsals being carried out with new members of staff. It seems that an approach to training like this would have really helped here. But it is very hard to see how it would be funded and implemented given the current fragmented state of the industry.
I’m a driver for a different company on this route.
It appears there are some misconceptions about what happened here. Allow me to clarify some points:
1. The train could not be driven from the front cab regardless of which systems were isolated, because the failed relay cut off the power to the driving controls. It was only the relay having cooled down after an hour or so that allowed the driver to key back on and release the brakes. This is not a common fault, if it’s ever happened before at all.
2. GSM-R train radio is kind of a misnomer because it works like a GSM mobile phone. Except in the case of an emergency where you want all the trains connected to the same mast to stop immediately (the Red Button), you’re just making a direct phone call to either the NR signaller or the TOC control centre. While the driver was on a call to the control centre, the line would have been engaged when the signaller tried to phone the driver.
3. It appears the driver didn’t stop to think about whether the conductor rail was live or not, and nobody else prompted him to check. Drivers (at least at my company and it would seem ARL too) only get the bare minimum evacuation training because both Network Rail and TOC policies stipulate that controlled evacuations would never be authorised or take place until senior managers from both NR and the TOC were on site to lead the process. Therefore a Quick Reference Handbook full of checklists like the airlines use would not have helped because a driver should never be leading a non-emergency evacuation.
4. A member of station staff sent to the platform to meet the driver of a train on the Down road (away from London) would go to the stop mark at the western end of the platform. He would have moved to the eastern end (where the train was) once he noticed that the train wasn’t moving.
I think that’s all the unanswered questions I noted from skimming the comments. If there are any remaining questions I’d be happy to try to clear them up.
Re: CP&SLR at 12:33
Point and Say uses basic psychology in that it uses two communication channels, audible and visible, and these reinforce and provide cross reference for each other. Just saying something uses only one channel. There is therefore a lack of both reinforcement and cross referencing of channels. The verbal only directions are therefore understood by less people. This is true for all people irrespective of nationality or anything else.
@Rayk
How does point and say assist in deciding who to call?
Re: NAMELESS 27 Oct at 23:07
I wasn’t implying that it did.
The general principle of using more than one communication channel does apply to training. Being told verbally what to do uses our audio channel. Reading words, even the same words, and studying diagrams, uses our visual channel; as does watching someone else do something. Practical exercise of the instructions uses our kinaesthetic (muscular) channel. The latter appears to be the most effective; even for something as simple as what to do first.
I know from personal experience that I benefit from using all three together.
Parvinder I think they are referring to Emergency Bypass System.
There is a line light indicating that the third rail is live.
As a DOO driver in the area I can confirm that we are under immense pressure to get trains moving, that Control AND Signallers are frequently unrealistic and unsympathetic in their dealings with drivers, and that the presence of a guard to deal with passengers while we are fault finding and talking to the relevant people should never have even been up for debate.
Re Ian and parvinder
I wondered if the TIS (Traction Interlock Switch) would have allowed the driver to get the train moving again? If not then the EBS (Emergency Bypass Switch) potentially as the usual last resort?
However maybe these were tried and failed (I’ve not read the RAIB report and certainly we’ve had cases where the EBS has failed to release the brakes when there was a fault). Irrespective I certainly would have been using my short circuit bar and this reiterates the “treat the conductor rail as live at all times”.
Of course, the signaller could have still contacted the driver even while he was out of the cab. GSM-R gives the signaller the function to make an announcent via the PA in exceptional circumstances. He could potentially have asked the driver to contact him as a matter of urgency. It may also be the driver was using GSM-R while in the cab to contact his TOC control and so the signaller did try contacting him and he was permanently engaged, though again the signaller could have overrode this call by making an ‘urgent’ call, thus overriding any other call being made on GSM-R.
However, I should note that I’m currently sat in the comfort of my own house reading this, where I can exercise the grey matter far more easily that the enormous stresses the driver was under. I also have the benefit of hindsight. I can certainly attest to the intense stresses of things starting to go wrong and having the signaller on one phone, control on another and platform a staff at my cab wanting to know what’s happening. Not easy or pleasant.
There’s any number of things signallers can do but don’t do for some reason. We were told that GSMR would allow us to receive updates on delays via Group Broadcasts. Instead we find ourselves stuck at red signals with no explanation just as much. If you call the box you are frequently given short shrift as the signaller is dealing with the cause of the delay. Yet even when there is a long running problem that no one is having to deal with at that exact moment, no broadcast is forthcoming most of the time,
My impression of the industry is that it sees cutting staff as an easy way to supposedly increase efficiency. This seems to lead to reducing efficiency and certainly the level of customer service by making it harder to get the job done! Paradoxically one cost is reduced (wages) but others are increased (delay fines). Technology is used to reduce staffing but it does not necessarily entirely replace the functions of those lost. I see so many examples of this on a daily basis sadly.
I think we should think very carefully before introducing the guard on London Overground, as implied by a poster.
Firstly the cost. Not having a guard has saved probably 80 million pounds in wages & other costs since LO began. TfL & the country are under severe financial pressure.
Secondly not a single passenger’s life or limb would have been saved by having guards up to now, & including even this bad incident.
Thirdly, the guard trying to contact the driver would have been an extra pointless pressure on the driver, when control & signaller & perhaps platform staff were all eager to talk to her/him too.
Fourthly, what would a guard in the rear cab or hemmed in by rush hour travellers do?
TL driver’s authoritative post demonstrates that things went wrong when they needn’t have.
Training & checking it has been understood & remembered can put that right.
@Pi**ed off driver
My impression of the industry is that it sees cutting staff as an easy way to supposedly increase efficiency. This seems to lead to reducing efficiency and certainly the level of customer service by making it harder to get the job done!
Amen to that. This isn’t just the case in “the” industry but in many industries and workplaces across the country, if not the world. Staffing has been cut too far to attempt to reduce costs, but the net result has been lost productivity because fewer people trying to do the same work get overworked, overwhelmed, demoralised and demotivated. The net result is negative to efficiency, so the bean counters come back and say “cut more staff” and so the cycle continues and gets worse and worse.
A long time ago, in another life, I was responsible for all the manpower variations across all of RAF Strike Command (both in the UK and overseas). I tried to do my job professionally and impartially but even in the last century it was a struggle to make the financiers understand that having too few people was just as inefficient as having too many, and the inevitable result was that either some things didn’t get done at all or that a lot of things didn’t get done properly. Of course, over-staffing only led to the loss of some money. Under-staffing potentially led to the loss of aeroplanes or the people in them (and even more money).
Reading that accident report makes me think that the rail industry needs standardised phraseology such as exists in the airline industry (introduced after the 1977 Tenerife airport disaster).
Also feel so sorry for the driver. Poor guy was put in such an unreasonable, unsafe position.
100andthirty :- I don’t have access to the original drawings now but I am pretty convinced that 67TS was the first stock to have invertor driven emergency lights – the 2007 Rolling Stock data sheet that is on the web states that 67TS had invertor driven emergency lighting . Was this fitted at refurbishment ?? I thought A Stock was the last with bulb emergency lighting ? I am not too sure about 60TS – that had lots of innovations but my memory of days & nights spent on them is not good enough to recall the details. I can remember starting the MAs by pushing the 600V MA contactor in with a wood ice scraper – not sure that would be allowed now ! It was also that train that taught me that the ‘compressor synchronising wire’ charged up the battery on the other motor car as long as the air pressure was low hence the high current circuit breaker on a wire that in theory did very little.
I remember Ferranti well – on the back of their successful invertor design they got a contract to prodide some other power electronics – they were also the suppliers of the trial MIL-Std1553 data bus system – the system was used by the military at the time but when we told Ferranti that we wanted to have four control positions and be able to switch between them their comment was no one has tried anything that complicated !
I think the other invertor supplier was AEI or AEC but that may be wrong.
@ JohnM – (to save 130 the trouble) I know my memory isn’t what it was, so I checked with “Tube Trains under London” (J. Graeme Bruce 1970) and the kit is described as follows:
“The fluorescent lighting tubes…are fed with a 115-volt, 850-cycle a.c. supply, two of the tubes being fed with d.c. through a static converter from the battery, and therefore remain alight if the motor alternator set shuts down with the lights switched on….The motor cars carry the motor alternator sets of which there are two separate designs.
Those provided by A.E.I. generate 850-cycle a.c. supply at 230 volts, which is stepped down by transformer to 115 volts to supply the lighting and to 58 volts to supply the rectifier feeding the 50-volt battery. The English Electric M.A.R. units consist of an alternator providing 60 volts, 850 cycles, the lighting supply at 115 volts being obtained by a step-up transformer. The alternator supply is connected directly to a rectifier which feeds the 50-volt battery.”
My memory suggested that there was some tungsten lighting on the ’67 Stock but, upon reflection, I was thinking of the 1959/62 Tube Stock with such that stayed on under battery power.
@John M
AEC would be unlikely to provide invertors – they built lorries and buses. AEI or GEC would be more likely. (the former was taken over by the latter in 1967)
Well this talk about early fluorescent emergency lighting is all very well, but it was sparked (!) off by a mention of candles. Which would have been far more anachronistic in 1967 (89 years after the first electric light bulb – batteries were earlier) than any AC/DC issues. What were they thinking of?
Malcolm, the story starts from when all lighting on the trains was run in series formation from the traction supply and the trains had no batteries. In such a case, of course, the train would be plunged into darkness in tunnels upon power failure, so a regulation was introduced, not repealed until post-1967, for candles to be supplied in each car. They were in small candle holder cabinets (I have one, with unused candle, obtained one day from Northumberland Park depot…), latterly just above the fire extinguishers in the corner pillars at the ends of the cars. After removal, the recesses were plated over. Despite the advent of more satisfactory emergency lighting, it’s obvious that nobody got round to rescinding the candle regulation for a long time. I can’t recall now but it was likely to be a Statutory Instrument.
The candle lights were in the corner of 1967 tube stock on the automatic Victoria line, but I am pretty sure they weren’t fitted to the 1972 stock version for the Northern line. Trainmen were issued with matches for use in emergency, even after oil tail lights were removed from running trains. The battery fed emergency lighting did not last long with traction current discharged.
I used the Vic line from day one, but never realised that particular anachronism was in place.
A bit like taxi-drivers supposed to be carrying a small hay-bale for the horse, I imagine?
I always wondered what that space used to contain!
Graham Feakins :- the Motor Alternators supplied the main lighting not the emergency lighting. They were at high frequency as the efficiency of flourecent lamps was higher at high frequencies and that allowed the tubes to be run at a lower rating and extend their life.
There was a large flywheel diode across the DC side to ensure the rotational energy of the MA set kept the lights on for as long as possible. They were something like 40A 100V diodes, we used to test a lot of them in ‘Electronic Development’ where I worked as no one else at Acton or the depots had any facilities to check diodes of that rating.
There is a copy of the 2007 Rolling Stock data sheet at https://www.whatdotheyknow.com/request/66598/response/170252/attach/4/Rolling%20stock%20Data%20Sheet%202nd%20Edition%201.pdf which describes the 67TS emergency lighting as ‘Emergency lighting: 2 inverter-fed, 50V dc powered, fluorescent tubes per car’ . I don’t remember this being altered when the trains were refurbished. Does anyone have access to the original ‘Car Examiners Drawings’ that would show the circuits ?
Because Jim Elson, a stitch in time saves nine. Once the driver has made as full an announcement as he can, he has to hope that passengers don’t start to do anything silly while he talks to the box and control. Extra pressure. My experience tells me that even safely in a platform they will very quickly badger the driver for information even when he has already told them he doesn’t know anything more at this time, preventing him from getting on with whatever he needs to. With a guard, even one who has to force his way through a packed train, at least the driver knows someone with authority has been seen by the punters and they don’t feel as if they have been left to it.
JohnM – Thank you for your response. The link you provided to the “What do they know” page was particularly interesting.
I never experienced a power failure on the Vic. Line, so when you say “There was a large flywheel diode across the DC side to ensure the rotational energy of the MA set kept the lights on for as long as possible”, I wonder just how long that was, bearing in mind, I suppose, that any draw on such power would tend to slow the flywheel down, or am I missing something in the equal and opposite reaction equation?
As for your final question, perhaps you could ask the London Underground Railway Society (LURS):
http://www.lurs.org.uk/index.htm
Its members comprise many who may have spirited such documentation away for safe keeping. To put that another way, I have some files of the maintenance records of a Northern Line ’38 Stock unit…
Graham Feakins/JohnM…….'”There was a large flywheel diode across the DC side to ensure the rotational energy of the MA set kept the lights on for as long as possible”, I wonder just how long that was, bearing in mind, I suppose, that any draw on such power would tend to slow the flywheel down, or am I missing something in the equal and opposite reaction equation?’
Without doing the calculation, I can’t be certain, but the time would have been a matter of a few, single digit seconds. The value was to reduce the number of restarts of the light tubes with the notion of lengthening their life.
I’m surprised at the amount of assumption in these comments, so I’ll try and correct a few things.
Firstly the trains does not have a ‘power supply on’ indicator, it has an indicator (commonly called a line light) that shows if the train is receiving power. This is an important difference. The train could be gapped, have lost shoes or be in a dead section, which would turn the indication off, but says nothing about the supply in the rails. Also the supplies may be out temporarily but ‘behind the scenes’ may be in the process of recharging it, so it must be checked with the person responsible.
Secondly there is common language for these incidents. The rule book term is a controlled evacuation. I’m not sure if detrainment is formally in the national rail rule book (not the tube one) but really refers to taking people off the train in a platform eg when going out of service. The rule book also uses emergency evacuation if the crew have to take matters into their own hands.
Not for the first time this forum has reshaped my evaluation of an issue. In this case two issues.
I used to be agnostic concerning DOO.
This article and the subsequent discussion has shown that, whilst a single staff member may be sufficient to run a train when all things are as they should be, when thing are other than a.o.k. at least one other staff member needs to be present. The situations which are other than a.o.k. are far more diverse than that covered by this article.
The second issue is that of training.
It is clear that classroom training has a useful place. It is clear that, in any situation regarding safety, practical exercises are irreplaceable. Once someone has performed an operation they have physical experience which is cannot be substituted. The classroom training can only prepare a person for practical exercise. Real situations are far too late and to fraught for practice.
100andthirty & Graham Feakins,
You are correct – the time was only long enough to stop the lights going out when power was lost over a conductor rail gap. The other thing it did was reduce the arcing as otherwise the rotational energy was converted into an arc when the circuit was broken. Thus it reduced the risk of fires and also reduced shoe and conductor rail ramp erosion. Interestingly modern trains turn of the traction equipment in sequence after the leading car detects a gap – that saves arcing and also reduces the emc created by the inrush current into the filter capacitor. The train calculates the time delay dependant on the speed and the same on switching back on.
I am not sure if the auxillary convertors that have replaced the MA’s do the same ?
And another, again involving Overground / Arriva.
Worryingly, it looks (to my eyes at least) that lessons have not been learned. Hopelessly inadequate and confused / communications at the heart of this again.
https://www.gov.uk/government/publications/safety-digest-092019-north-pole-junction/passengers-self-evacuating-at-north-pole-junction-15-july-2019