Any student of railway accidents knows how risks slip through the smallest gap.
Gary Hart’s vehicle careered from the M62 onto the East Coast Main Line near Heck in October 2001. His tyres passed tantalisingly close to a crash barrier that would have altered his path and left him the only one in his accident. Ten people died.
At Polmont in 1984, a cow escaped from a field and an Edinburgh-Glasgow express hit it. A small part passed through the two-inch gap under the lifeguard of the leading wheels. It lifted one wheel from the rail at 85mph. 13 people died.
At Clapham in 1988, a signal technician correctly disconnected a wire in a relay room during a resignalling project. But he didn’t cut the wire back or tape over its bare end. It gradually returned to its previous position and caused a false feed that cleared a signal that should have been red. A train passed this signal and hit another. A third hit the wreckage. 35 people died.
Three accidents that all changed the railway but Clapham’s accident was a watershed in railway safety. It brought significant changes in planning, implementing and checking signalling alterations. In short, a designer doesn’t install his work and an installer doesn’t test what he has installed. Nor can the designer test. Each stage has independent checks.
These checks have three parts. Verification testers check visually that what’s been installed matches the plan. Functional testers check that it works as planned. Principles testers check that it complies with signalling principles. A separate person checks each section.
Accident at Waterloo
The Rail Accident Investigation Branch’s report into a derailment at Waterloo in August 2017 likened it to Clapham. But Clapham was over 30 years ago. RAIB said: “The major changes to signalling design, installation and testing processes triggered by the Clapham accident remain today.” It reported concerns about memories fading as people retired or moved to other jobs. “This deep-seated, tacit knowledge is part of the corporate memory vital to achieve safety. Loss of this type of knowledge as previous generations leave the industry is a risk which must be addressed by organisations committed to achieving high levels of safety.”
Clapham’s changes remain today. But their reasons are fading from memory. At Waterloo, a principles tester asked a functional tester to solve a problem in Waterloo’s relay room. Solving this problem involved designing an alteration to the signalling. RAIB believes the functional tester also installed the wires that solved the problem.
RAIB reports conflicting evidence but, after looking at records of who signed in and out of the relay room, reported: “It is likely therefore that the installers were not present, and were probably on their lunch break, when the uncontrolled wires were fitted. The site signing-in records also confirm that the functional tester was on site when the relays began working together [the result of the alteration].
“Both installers stated that they had not installed any blue wires during their work in Waterloo relay room. They also stated that they could not have fitted wires without labels as, without these, they would not have known where to run the wires to and from. This evidence, together with the signing-in and out records, indicate that it is likely that the uncontrolled wiring was installed by the functional tester.”
This breaks the rules of signalling alterations and the split between design, installation and testing.
Wider problems at Waterloo
The extra wires exposed another problem. Waterloo needed more space for trains, chiefly by making four platforms longer. This involved changing the signalling and temporarily placing a test desk into Waterloo relay room to simulate the signalling system. The desk let testers check interlocking changes before track gangs installed physical kit on the railway.
The test desk had to match Waterloo’s interlocking. If other parts of the project changed that interlocking then the test desk would no longer work. And another part of the project did change the interlocking for the points on which the train derailed.
RAIB found no effective co-ordination to make sure the test desk matched the interlocking.
It suggests that had drawings shown the 664 wires connecting the test desk to the interlocking then anyone redesigning the interlocking would have seen that their changes would affect the test desk.
This created the situation the functional tester found. He could have solved the problem using temporary wires (straps) specifically provided for testers to create temporary changes. Testers must record strap use in a log, creating a prompt to remove them when finished. Or he could have created a test log that described the problem. He would send this to the tester-in-charge who would forward it to designers. They would plan the change needed.
Stopping the accident at Waterloo
Clipping and padlocking points to stop them moving could have stopped the accident. These points were more complex than normal because they had three sets of movable blades. Only one set was clipped and locked because it was inside a possession. The other two sets were outside the possession and used by passenger trains. A risk workshop realised the need to clip them but did not tell anyone to do it.
The tester-in-charge told RAIB that he assumed that possession management staff would clip them but they only clipped the points that the railway rule book required them to. This did not include the fateful set.
This was the worst of both worlds. Those extra wires in the relay room fooled the interlocking into thinking all three sets of movable blades were in their correct position for the train. In reality only the clipped set sat correctly. The others sat incorrectly but the interlocking thought they were set correctly because it was seeing the electrical feed from the clipped set.
The added wires and missing clips are direct reasons for the train’s derailment. Behind them lie soft or non-technical skills of the way people think, act and relate to each other.
Increasing understanding of accidents
Little wonder that RAIB says: “When undertaking complex tasks in a safety critical environment, it is vital that individuals have a good understanding of the equipment they are working with and the principles that underpin the mandated procedures. This understanding is essential for them to properly appreciate the consequences of the actions they take.”
RAIB does not assign blame, responsibility or liability. But its Waterloo’s report says: “The actions of the functional tester and the actions of both the contractor’s responsible engineer and project engineer indicate that appropriate non-technical skills were not applied”.
Promoting the right soft skills comes down to culture. Testing them is harder than testing technical skills. RAIB found that Network Rail looked for technical competence and skills rather than also looking for those softer skills that ensure that people do the right things, for the right reasons, in the right way.
This prompted RAIB to specifically remind today’s railway managers and staff of Clapham’s fatal accident. Another recent incident at Cardiff reinforces this view of fading memories. At Cardiff, a set of redundant points sat unsecured after a possession. A driver noticed they were in the wrong position and stopped his train. RAIB found a culture that didn’t think widely about risks they faced. As with Waterloo, planners did not allocate responsibility for clipping the points.
TOCs train their staff to help passengers and to deal with difficult ones. Perhaps it’s time for Network Rail and its contractors to embrace similar soft skills training?
This article first appeared in RAIL 867, published on December 5 2018.