No reports from the Rail Accident Investigation Branch make easy reading. When RAIB’s chief inspector describes an incident as alarming, the railway should sit up and pay attention.
Thankfully, there was no accident at Cardiff on December 29 2016 after Network Rail left a set of redundant points unsecured, unsupervised and in the wrong position. A train driver noticed them and stopped in time.
Something similar happened last August when NR left a set of points at Waterloo disconnected from signalling. A train ran over them, derailed and collided with stationary wagons.
Both echo back to Clapham Junction’s fatal accident in 1988 when signalling was not properly disconnected. That accident led to widespread changes in the way work was planned and supervised. Cardiff and Waterloo suggests that the corporate memory of Clapham has faded.
Work last Christmas was part of NR’s Cardiff Area Signalling Renewal (CASR) project. It started in 2006 and was completed this year after several phases. NR was the principal contractor with Balfour Beatty designing and delivering track changes and Atkins doing the same with signalling.
RAIB found that CASR’s senior construction manager (SCM) failed to identify which points needed securing and that no-one in the project was made responsible to checking they had been secured.
Don’t be tempted to point a finger at the SCM because RAIB reveals that there was no single project document that listed the points to be secured. This breached NR’s company standards.
There was a list of seven points ends that needed securing on one slide of a 123-slide Powerpoint presentation which was taken from the project’s commissioning management plan. Unfortunately this plan was wrong in listing seven points because there were eight that should have been locked and secured.
The deputy project engineer (DPE) did have a correct list of the eight points, which he’d created for his own purposes but shared with others. The SCM didn’t consult this list but, as RAIB comments, he should have been able to find the correct information he needed from the scheme plan or from the testing and commissioning plan.
The litany doesn’t end there. RAIB found the SCM was on his first 12-hour nightshift having just completed seven day shifts since his last rest day. This is a classic recipe for fatigue.
The tester-in-charge (TIC) was responsible for ensuring all changes in the design are completed. RAIB notes that this implies he should check that redundant equipment that is to be removed later to make sure it’s safe.
He used the signalling scheme plan to produce his testing and commissioning plan for Christmas’s ‘stage 5’ works. The signalling scheme plan showed stage five’s final layout as it would be following Easter 2017’s work to remove redundant points. It is possible, notes RAIB, that this led the TIC not to realise that he needed to check points made redundant at Christmas but left in place. The TIC was on his fifth of ten consecutive 12-hour nightshifts when the incident occurred.
To add to the pressure, the team found a damaged cable hours before the railway was due to reopen. This diverted the project engineer, DPE, SCM and TIC into working out how and whether parts of the railway could open on time. This was just at the time that they should have been concentrating on checking that work had been done properly. But it’s understandable that they would have wanted to have trains running on time giving the criticism NR receives for over-running engineering work.
As a result, NR’s operational management team decided to cancel route proving trains designed to check just such things as points lying incorrectly. Because the points were redundant they were no longer connected to signalling systems and didn’t appear on signaller’s screens. They were invisible such that the signaller called by the driver was initially confused although he then remembered where the old points were.
The SCM and a colleague walked the track before it opened to trains but they were concentrating on looking for tools or equipment left on the track.
So far, so bad. RAIB also delves into the reasons why this series of mistakes might have occurred. Most of the project team had worked together and trusted each other. This is good but it also meant they had fixed minds and didn’t consider other ways of working. Previous stages also needed redundant points securing but these stages had been smaller overall and so the risk surrounding unsecured points was more obvious. Christmas 2016’s work was much greater and so the risk around points was more hidden with the team concentrating elsewhere.
With trust established in the team, a significant amount of communication was done verbally and relied on people would remember what was said and what they’d been asked to do. Team members relied on others confirming that points had been correctly secured. According to RAIB, the team did not appreciate the need to independently check work against its design.
The team’s document management system was hard to use and it seems this was a reason why so much was done verbally. When RAIB comments that the team had difficulty providing documents to the investigators you know there’s something wrong.
Finally, RAIB reveals that over the night before the incident, one person was acting as programme manager, senior manager on duty and project manager. This neutered escalation processes because the various levels to which problems could be raised were all occupied by the same person. RAIB adds that it’s not clear whether this was the result of poor planning or a lack of staff.
There’s a word missing from RAIB’s report. Leadership. Teams need leadership. It is to people what management is to processes. On a busy railway with many passengers and ambitious plans, leadership is vital.
This article first appeared in RAIL 839, published on November 8 2017.