On the evening of Wednesday 4 December 1957, in foggy conditions, the 16:56 train from Cannon Street to Ramsgate, hauled by ‘Battle of Britain’ Class 4-6-2 steam locomotive 34066 ‘Spitfire’, passed a red signal near Lewisham and collided with the rear of a stationary EMU bound for Hayes that was stopped under a bridge. A scene of utter devastation followed. Not only was the accident itself severe, but the wreckage dislodged a bridge pier causing the bridge itself to collapse and crush two coaches. In total, 90 fatalities occurred and 109 were detained in hospital.
There was no AWS and TPWS
Fast forward nearly 60 years to March 2015 and an event at Wootton Bassett in Wiltshire described by the Rail Accident Investigation Branch (RAIB) as a ‘Dangerous occurrence’. Another member of the locomotive class involved at Lewisham, this time 34067 ‘Tangmere’, hauling a charter special train 1Z67, approaching from Chippenham, had passed signal SN45 at danger protecting the junction of the South Wales main line and come to a stand across the junction. 34067 is now a preserved heritage steam locomotive and is fitted with AWS (Automatic Warning System) and TPWS (Train Protection & Warning System) for operation on the main line.
The signal was displaying a red aspect to protect a train proceeding along the Up Badminton towards Swindon. This train had already passed over the junction and continued on its way. The route at the junction had in fact already been set for 1Z67 to proceed but the relevant section track circuit/s had not yet been cleared by the previous train to allow SN45 to display a proceed aspect.
If the timings had been slightly different with trains passing on both Up and Down Badminton lines at the line speed of 70 mph, the outcome could have been very different. So what exactly went wrong at Wootton Bassett, and why is it that, sixty years after Lewisham, and despite the provision of AWS and TPWS, the network is still apparently exposed to a potentially dangerous SPAD (signal passed at danger)?
As to the first part of the question, the RAIB is currently investigating the incident and will report in due course on the causal factors involved. However, the industry takes SPAD risk very seriously and Rail Engineer will elucidate some of the extensive activities underpinning SPAD prevention and mitigation, with further safety benefits still to come with the national deployment of ETCS (European Train Control System).
Over the period March 2001 to September 2006, the implementation of TPWS together with other industry improvements brought about a significant reduction in SPAD risk of around 80%. September 2006 is a new baseline for measuring SPAD risk, as it is representative of the system risk management in the post- TPWS implementation era. As of March 2013, the SRR (SPAD Risk Ranking) process shows SPAD risk to have reduced further, with levels standing at around 60% of the September 2006 baseline.
Driving a train requires utmost concentration on the line ahead at all times, observing every signal and speed limit, interpreting the information displayed correctly, and controlling the speed of the train appropriately. From the early days of railways, faced with possible consequences of such human error, the industry procrastinated for many decades over a fool-proof cost effective solution. After the SPAD at Harrow & Wealdstone in 1952 (112 killed, 88 detained in hospital) there was to be no further ducking the issue. BR decided on a national rollout of AWS though the project took nearly fifty years to complete.
Permanent and Temporary Speed Restrictions
In addition to keeping focus on signals flashing by at speed, drivers have to ‘know the road’ and be aware of all locations at which the line speed limit changes so that, if a reduction is required, then the braking process should be started at the right moment.
Following a serious lapse at Morpeth in 1969 (six killed, 21 injured), AWS was extended to give warning of a significant step-down of permissible line speed. For this purpose, a warning is given in the cab by means of a single permanent AWS magnet.
Similarly, temporary speed restrictions (TSRs) were added to the AWS portfolio after a disaster at Nuneaton in 1975 (six killed, 38 injured). A small portable permanent magnet is clamped to the web of the rails for the duration of the TSR but has to be carefully positioned in accordance with complex planning rules specified in Railway Group Standard (RGS) GK/RT0075, to enable drivers to correctly correlate AWS warnings in the cab with signals or speed restriction indicators on the line ahead. In particular, such portable AWS magnets shall not be positioned between any other AWS equipment and its associated signal, board or indicator.
AWS Achilles’ Heels
After receiving and acknowledging a warning, the safety of the train is entirely in the hands of the driver in comprehending the warning and driving appropriately in accordance with signals and speed limits. It was never foreseen that a driver, having acknowledged the warnings leading up to a red signal, would then just drive on.
Secondly, if a station stop intervenes between an AWS warning and the signal at red, there is the risk that once station duties have been completed, the guard gives ‘ding-ding’ and the train starts away but the driver fails to check whether the signal is still red. Also, it is possible to isolate the AWS and drive without protection as happened with an HST at Southall in 1997 (seven killed, 139 injured).
Train Protection Warning System (TPWS)
Acknowledging the weaknesses of AWS, BR commenced work in 1988 on a more effective system which became known as the Train Protection Warning System (TPWS). It was mandated by the 1999 Railway Safety Regulations. Fitment was completed in 2003 with suppliers including Thales, Redifon, and Unipart Rail. Sadly, whilst the project was being planned, a further disastrous SPAD occurred at Ladbroke Grove in 1999 (31 killed, 227 hospitalised).
TPWS is designed to stop a train in three situations. At selected signals a train stop (TSS) will be provided at the signal and apply the brakes in the event of a SPAD. At selected signals an overspeed (OSS) facility will operate and apply the brakes should a train approach a red signal too fast. TPWS is designed to stop a train before reaching a point of conflict. Additional overspeed sensors may be provided (TPWS+) to cope with higher speeds. At other locations, such as on the approach to a permanent speed restriction or buffer stop, the OSS will apply the brakes in case of excessive speed.
A weakness of TPWS is that the driver may ‘reset and continue’. Like AWS, TPWS may also be ‘isolated’ thereby removing the ability to protect the train. Furthermore, TPWS is not fitted at every signal as the primary objective is to protect junctions.
The standard TPWS driving cab display unit delivers a flashing visual indication for a brake demand, leaving the driver to work out whether the brake application was due to SPAD, Overspeed or AWS, leading to possible confusion and belief that the equipment is faulty. If the TPWS system initiates a brake application, the TPWS brake demand indicator will flash. There will be no audible warning. Once the AWS/ TPWS acknowledgement button is pressed and released, the TPWS brake demand indicator will go steady. The brakes will release and the indicator will clear 60 seconds after the brake demand was initiated.
An enhanced TPWS control panel has recently been developed with three indicator buttons ‘SPAD’, ‘Overspeed’ and ‘AWS’. Whenever a brake demand is initiated because of a SPAD or overspeed, the respective flashing indicator is accompanied by a spoken message, preceded by an ‘alert’ tone. This says ‘SPAD alert, contact signaller’ or ‘Overspeed, contact signaller’ as appropriate and continues until the driver presses the appropriate indicator button.
In the signal box
Signallers were criticised for not responding quickly enough when they became aware of the SPAD at Ladbroke Grove but it is unrealistic to expect a signaller to continuously monitor the progress of every train moving within their sphere of control, particularly in a busy box with the intensive operational activity that is in progress and ever changing. The signaller may, for example, be engrossed in conversation with a depot about an impending freight movement, or have momentarily left the workstation to read a notice about an emergency speed restriction that has just printed out.
If a SPAD takes place, a signaller needs to become immediately aware of the potential seriousness of the situation and make a split second decision as to the best course of action to stand any chance of avoiding a collision. The options are limited and may include sending a STOP radio message to driver/s in the locality, putting signals back to danger, and trying to divert the errant or other trains away from possible conflict although the latter may be prevented by the SPAD train occupying train detection sections and deadlocking points that could otherwise divert the train away from danger.
In response to recommendations of the inquiry into the Ladbroke Grove accident, SPAD alarms were introduced, requiring the signalling control system to monitor the states of train detection sections and signals in order to identify a SPAD. The location of the overrun is highlighted with a yellow background on the main track layout diagram, accompanied by a loud distinctive audible alarm. Such a SPAD alarm is relatively easy to incorporate into the software of a computer- based signalling system, whereas SPAD alarms are not generally provided on hard-wired signalling panel systems as this would require extensive, complex and costly additional wiring.
Cab forward visibility and driver competence
In the Lewisham accident report, forward vision from the footplate of the ‘Battle of Britain’ steam engine with its ‘air-smoothed’ streamlined boiler casing was described as “adequate” with the “close range view of signals on the right hand side much restricted by the long boiler”. It was stated that these viewing problems would be resolved with the replacement of all steam trains with electric or diesel-electric trains controlled from driving cabs with no obstructions in front of them.
Today RGS GM/RT2161 mandates onerous requirements for train builders with the objective of ensuring clear unobstructed lines of sight for the driver.
Considerable importance is attached to route learning for which route-specific packages are available such as from Track Access Services Ltd. Train operators have their own professional driving policies and competence programmes. Signal engineers are well acquainted with IRSE licences and now it is the turn of train drivers. ‘Train Driving Licences and Certificates Regulations 2010’ have come into force, requiring all new drivers operating on the mainline railway to hold a licence and certificate. Existing drivers will have to comply by 2018.
Signal positioning and visibility
The end of steam on the BR network occurred in 1968 and, from the following day, steam locomotives were banned on the network.
The world moved on, and Signal Sighting Committees (SSC) that had traditionally sighted signals very high up to aid visibility from steam cabs were now placing semaphore arms and red aspects of colour light signals at drivers eye level relative to the cab of electric and diesel locomotives. Although the steam ban was relaxed in 1971 to enable steam specials to run, visibility of signals from the cabs of steam engines never really made it back onto the agenda of SSCs.
Following the Ladbroke Grove accident, RGS GE/RT8037 became the new ‘bible’ for SSCs with principal requirements that signals shall be positioned and aligned so as to ensure that:
a) the driver of an approaching train has sufficient time to identify, observe and interpret the information being displayed;
b) the information being presented is clear and unambiguous;
c) the risk of reading the wrong signal is minimised;
d) the presentation of information displayed to the driver is such as to avoid information overload.
Membership of the SSC includes representatives of the infrastructure controller, train operators, station operators and those with signal scheme design knowledge. Meetings may be convened out on the railway but desktop sighting tools are becoming increasingly popular. Track Access Services Ltd Survey Data and Virtual Track Models provide a comprehensive data set for signal sighting which is compatible with the Bentley Signal Sighting Tool which provides an accurate solution for interactive desktop signal sighting exercise. Network Rail has devised a signal sighting tool using OmniSurveyor3D lineside surveys. In addition to achieving the best possible sighting of signals, SSCs may recommend special controls within the signalling system that may, for example, obviate the risk of a driver mistakenly reading the proceed aspect on a signal further ahead.
European Train Control System (ETCS)
Following the SPAD accidents at Southall and Ladbroke Grove the ‘The Joint Inquiry into Train Protection Systems’ was produced in 2001 which reviewed and assessed the value of all train protection systems in use at the time or shortly to be available. Readers who have reached this far in the article will not be surprised with the report’s cautionary statement: “Until ETCS is generally available on UK lines the risk of a catastrophic accident following a SPAD remains. This will continue to be the case after fitment of TPWS.”
In context the report also makes it clear that the risk from SPADs is not large in comparison with overall casualties on the railways. SPADs, however, also give rise to the much more significant danger of a catastrophic accident in which many tens of fatalities might occur. ETCS includes ‘Automatic Train Protection’ (ATP) whereby the speed of the train is continuously monitored in relation to the extent of the movement authority and speed limits, with the brakes automatically applied if the driver makes a digression.
The report considered the AWS system and BR’s trials of ATP on Great Western and Chiltern routes but conceded that both systems represented old technology, with ATP being very expensive for widespread fitment. BR and Railtrack had already been developing the cheaper and much simpler TPWS and this approach was vindicated. “We recommend that the current mandated fitment of TPWS should not be reversed”.
The provision of TPWS was seen as an interim solution and the report noted that European law requires the fitting of a modern continuous ATP system known as ETCS. It concluded that, for not involving high speed running or large volumes of traffic and not covered by present or future European Directives, other cheaper train protection systems may be appropriate including TPWS.
TPWS is a success story, affording acceptable protection with high levels of reliability.
The downside of this is that it makes the business case for replacement with the more sophisticated ETCS on safety grounds alone extremely difficult. However, Network Rail and stakeholders have recently produced a strong whole ‘railway industry’ business case based on ETCS Level 2. This has been achieved by including factors such as increases in capacity, performance and availability as well as safety. Using the ‘Distance to Go’ concept contained within ETCS, it is been demonstrated by modelling that a 40% increase in capacity is possible.
The East Coast and Great Western main lines will be the first high-speed lines to receive ETCS in UK.