A rail investigation summary from RSSB – December 2018

Contents

Australia: Runaway freight between Dombarton and Unanderra, NSW, 22 April 2017

Belgium: Track worker fatality at Oostende, 21 September 2017

Poland: Runaway of wagons between Nysa and Nowy Świętów, 10 November 2017

UK: Near miss with track workers and trolleys at South Hampstead, 11 March 2018

Germany: Collision at Bad Aibling, 9 February 2016

Belgium: Passenger train derailment at Leuven, 18 February 2017

Some of the key issues raised and/or suggested by the stories in this edition:

• Change management
• Complexity of rules
• Driver competency checks
• Driver error (braking)
• Fatigue management
• Freight train loading
• GSM-R interface
• Interlocking of signals
• Knowledge sharing
• Learning from previous incidents
• Mobile device usage
• On-site risk assessment
• Route knowledge
• Safety culture
• Signaller error
• Signaller training
• Signalling design complexity
• Signalling panel design
• Track worker protection
• Track worker safety
• Wagon braking
• Wagon maintenance

5 December

Australia: Runaway freight between Dombarton and Unanderra, NSW, 22 April 2017

Full report

On 22 April 2017, a Qube Logistics (Qube) grain train, travelling from Bogan Gate to Inner Harbour, Port Kembla, New South Wales, ran away as it descended the Illawarra Mountain between Dombarton and Unanderra.

After passing Dombarton, the driver realised he had lost control of the train. At 12:48, he contacted the Australian Rail Track Corporation (ARTC) network controller who, in conjunction with the Sydney Trains train controller, cleared a path for the consist. The maximum allowable speed for the Dombarton to Unanderra section is 30 km/h; however, the train reached a maximum speed of 107. At 12:55, the train stopped, assisted by a shallower gradient near Unanderra.

There were no reported injuries or damage.

The Australian Transport Safety Bureau (ATSB) found that the driver did not conform to prescribed train handling procedures when taking the train down the mountain. After passing Summit Tank, he made ten brake applications and in doing so did not allow the pneumatic braking system to recharge fully. This resulted in a loss of the braking capability necessary to control the train’s speed on the steep continuous descent.

The braking system was operating within specification. However, the train was loaded by approximately 10% more than that recorded on the train’s consist record. It is probable that the additional mass placed an extra load on the braking system and affected the handling characteristics of the train.

After the incident, the train controller in Sydney directed the driver to move the train from the rail network to Inner Harbour Terminal without any formal inspection following the runaway event. The Pacific National yard train controller in Inner Harbour did not alert ground personnel of the emergency event or of a runaway train being directed into their terminal.

Action taken

Immediately following the incident, the class of locomotive (QBX) and wagon type (CGSY) involved were withdrawn from the route pending testing and inspections. Both have since been cleared to return to normal operations. The operator also changed the requirements for competency assessment on the Moss Vale to Unanderra section, from a single initial assessment to every six months: if a train driver has not been rostered over the corridor within six months, he/she must be reassessed on this route.

The operator also implemented other more stringent requirements for the training of drivers and weekly auditing of train operations between Moss Vale and Inner Harbour.

A review between the various rail infrastructure managers was conducted regarding the plans and procedures enacted in emergency events, and the decision-making process to move trains from the rail network to Inner Harbour.

Safety message

In order to minimise the risk of runaway events, freight operators should ensure that train drivers receive regular training and competency assessment for steep continuous gradient routes. The standards that apply to these routes should ensure that the locomotive and wagon braking ratios are suitable for the terrain the train will encounter on its route. Contingency plans and procedures to accommodate runaway trains in this area should be continually reviewed and tested by rail infrastructure managers.

10 December

Belgium: Track worker fatality at Oostende, 21 September 2017

Full report (requires translation)

At 07:10 (local time) on 21 September 2017, a track worker was struck and killed by a train near Oostende.

The Belgian NIB determined that the accident had occurred because the track worker had been working outside the planned working hours, on an open line and without permission and protection. It was also noted that the person in charge of the works had underestimated the risk represented by the sighting (and hearing) available at the site.

Recommendations

None issues.

13 December

Poland: Runaway of wagons between Nysa and Nowy Świętów, 10 November 2017

Full report (requires translation)

At 06:20 (local time) on 10 November 2017, a broken drawbar led a freight train to divide on the gradient between Nysa and Nowy Świętów. The leading portion of the train stopped, but the loss of air in the main brake pipe rendered the brakes on the rear three wagons ineffective and they began to run away down the gradient. They eddied between this gradient and another twice – traversing six level crossings twice in the process – until being stopped on a ‘braking skid’ at Nysa.

The Polish NIB found that the crew had not performed a controlled brake test before initial departure. The driver also failed to drive in accordance with the approved procedures, neglecting to adjust the speed of the train to match the gradient profile. This was due to inadequate route knowledge, which in turn highlighted issues with staff recruitment, supervision and training. Issues re wagon maintenance also arose.

Recommendations

• Drawbar failures and the risk from running away should be added to the infrastructure manager’s risk register
• Freight trains should be stopped at signals ahead of the gradient in question, in order to help ensure the appropriate driving technique is used
• The freight operator should increase the quality and the number of audits relating to transport process implementation, with particular regard to traction and rolling stock maintenance teams
• As part of their periodic instructing exercises, freight operators should explain the rules for drivers and rolling stock auditors regarding:
  1. The correct train composition
  2. Performing technical inspections before departure
  3. The correct procedure for performing brake checks
  4. The correct technique of train operation (start, smooth driving considering the profile of the railway line section, braking, etc)
• Freight operators and entities responsible for the maintenance of freight wagons should enhance their vehicle maintenance supervision processes.

18 December

UK: Near miss with track workers and trolleys at South Hampstead, 11 March 2018

Full report

At around 00:35 on 11 March 2018, a group of track workers narrowly avoided being struck by a train while placing trolleys on the track alongside South Hampstead station, north London. The train was travelling at 49mph towards Euston station when the driver saw the group, sounded his horn and applied the brake. Three other members of the work group, who were around 100 metres away from the staff placing the trolleys on the track, saw the train seconds earlier and shouted a warning to their colleagues who managed to remove the trolleys and get clear around two seconds before the train passed. One member of the group received a minor injury and many were distressed.

The incident occurred because the track workers had placed the trolleys on a line which was still open to train movements, instead of on the intended adjacent line that was blocked. The RAIB investigation found that the safety arrangements that had been established were ineffective. The work group did not have anyone designated as the ‘Person in Charge’, an individual who has sufficient knowledge and competence, and is specifically appointed to manage all the risks associated with the work, including the danger from moving trains. There were also a number of unofficial working practices being used by the workgroup and the person asked to take charge of safety for the work group believed the open fast lines were the blocked slow lines.

The COSS appointed on the night of work believed that the open fast lines were the blocked slow lines, probably because said COSS was not sufficiently familiar with the location, the staff on site had no immediate visual indication of which line was which and the COSS did not effectively check the identity of the lines when he was challenged about which line was which.

Network Rail’s introduction of the Person in Charge role in NR/L2/OHS/019 Issue 9 (Safety of people at work on or near the line) did not make the responsibilities of the role sufficiently clear.

Although not linked to the cause of the incident, RAIB observes that the ‘Responsible Manager’ had not fully understood his responsibilities under standard NR/L2/OHS/019 and the only location information included in the safe work pack was extracts from the sectional appendix that did not clearly show the site at the access point, and would not have assisted the staff on site to orientate themselves relative to the running lines.

RAIB has identified the following key learning point:

• Those in charge of safety on site should be open to challenge from members of their team in the interests of safety and be prepared to check safety critical information if challenged.

Action taken

Following the incident, both Network Rail LNW Works Delivery (Signals) and M. J. Quinn made the following improvements to their working arrangements to comply with the requirements of standard NR/L2/OHS/019 Issue 9 better:

• LNW Works Delivery (Signals) re-briefed its safety critical staff on the principles of NR/L2/OHS/019 Issue 9. Safe work packs produced by its planners are now only being supplied to its own staff, and are being supplied individually to PiCs, instead of utilising a site-wide safe work pack (SWP).
• M. J. Quinn now undertakes the planning process and SWP production for its own work. It reports that it has employed permanent staff to undertake the duties of a planner and a PiC and collaborate on the production of the SWP. The SWPs that it produces include aerial photographs of the access points with the lines identified, and schematics of the track layout in the area in which the work is to done. M. J. Quinn has also reported to RAIB that all of its safety critical staff have been rebriefed on the principles of NR/L2/OHS/019 Issue 9.

On 23 March 2018, the programme manager for LNW Works Delivery (Signals) reissued a revised department-specific document titled Principles of 019 Application to staff. The original document was issued in July 2017 to summarise key points from NR/L2/OHS/019 Issue 9 in LNW Works Delivery (Signals). It sought to clarify areas of confusion that had been highlighted by the incident. It now also includes a requirement for all LNW Works Delivery (Signals) projects to plan how NR/L2/OHS/019 would be applied in all aspects of project delivery.

Recommendations

Network Rail should:

• Revise its standard for managing the safety of people at work on or near the line (currently NR/L2/OHS/019 Issue 9) to clarify the following aspects of the ‘Person in Charge’ (PiC) role:

1. Revise its standard for managing the safety of people at work on or near the line (currently NR/L2/OHS/019 Issue 9) to clarify the following aspects of the ‘Person in Charge’ (PiC) role:
2. A PiC should be allocated to each separate work group, and remain with that work group for the duration of the work;
3. The same PiC should be involved in both the planning process and delivery of the work (excluding exceptions stated in the standard);
4. When the COSS duties of a PiC are delegated to someone else, that individual should be appointed during the planning process, endorse the safe work pack and deliver COSS duties on site.

• Provide suitable guidance to support the understanding and implementation of the standard, and maintain access to such documentation for relevant staff and contractors.
• Brief out the changes arising to relevant staff and contractors.

Network Rail should verify that all of its staff who currently act in the role of Responsible Manager, as defined in standard NR/L2/OHS/019 Issue 9, are fully aware of their responsibilities with respect to signing off safe work packs and, where this is not the case, take action to address this lack of understanding.

Network Rail should review and improve the quality of the location information provided in its safe work packs, to help staff better identify running lines, access points and other relevant geographical features. The review should include consideration of supplementing the current minimum information specified in Appendix A of standard NR/L2/OHS/019 with detailed track diagrams, local street maps, ground level and/or aerial photographs etc, using a risk-based approach.

Network Rail should:

• Amend its National Hazard Directory to include the access point alongside South Hampstead station; and
• Provide access point signage to clearly identify each running line to staff using the access point.

Network Rail should carry out a detailed audit of how standard NR/L2/OHS/019 Issue 9 has been implemented across the network, including in its supply chain. The purpose of this audit is to determine how the standard has been interpreted and understood, and areas of good and bad practice. Network Rail should take appropriate actions to address any issues found.

Network Rail should undertake a review of how the change of NR/L2/OHS/019 from Issue 8 to Issue 9 was managed, in order to identify any areas for improvement in the management of change.

19 December

Germany: Collision at Bad Aibling, 9 February 2016

Full report (requires translation)

At 06:47 (local time) on 9 February 2016, two passenger services collided at around 150 km/h (90mph) on a curve on the single line between crossing points at Bad Aibling and Kolbermoor.

One train derailed and several of its carriages overturned.

Eleven people were killed (7 passengers and 4 members of staff, including both drivers).

Of the 89 injured, 26 were seriously hurt.

The German NIB determined that that immediate cause of the event was signaller error. The signaller completed his training on 16 January 1997, qualifying to signal Bad Aibling specifically later that year. Per his roster, he had been working at Bad Aibling, Bruckmühl and Westerham. On the day of the accident, he started work at 04:45 at Bad Aibling, his last shift (at Bruckmühl) having finished at 14:40 the previous afternoon. It was considered that the ‘required minimum rest’ had been ‘respected’.

Although the signaller had been trained to use GSM-R, the German NIB noted that the specifications for ‘establishing an emergency call connection and delivering an emergency stop order’ are incomplete. Specifically, there is ‘no distinction between emergency call train radio and emergency call route’. It was found that the former had been carried out for the last time on 15 September 2015. The implication is that – at the signaller’s last ‘refresher’ – the emergency call route function ‘was probably discussed, but not practiced’. The NIB pointed out that training exercises ‘take place in the relaxed atmosphere of a training course and not under the stress of a pending irregularity or a dangerous event in the railway operation’. The signaller had never had to make such a call in the field, and – as the NIB also clarified – ‘the likelihood of confusion between the two emergency call types is too high, especially under stress’.

On 12 April 2016, it was reported that the signaller had been arrested, as prosecutors suspect he was distracted by playing a game on his mobile phone at the time of the incident. This led him to make a signalling error, and then – in a state of some distress – dial the wrong emergency number (in fact altering all station staff along the line instead of the driver of the oncoming train). His second – correct – emergency message came too late to prevent the accident.

The game in question was ‘Dungeon Hunter 5’, which the signaller allegedly played with some regularity, even though this is prohibited during working hours. Analysis of his phone records show that his mobile use often corresponded with his working hours. Indeed, the NIB notes that the signaller’s ‘last active usage was at 06:40:47’ (ie, just over six minutes before the collision and after some 22 minutes of play). At this point, one passenger train had entered the Bad Aibling section, while the other had come to a stand at Kolbermoor. The signaller’s phone was not used again during subsequent events.

The investigation report also explains how – in the criminal case against the signaller – the subject of online gaming was discussed by an expert witness, who noted the following:

• The total duration and frequency of the signaller’s gaming actions had increased significantly since 1 January 2016
• The ‘proportion of playing time in working hours [was] 72%’
• ‘It is highly probable that simultaneous use of the computer game resulted in decreased cognitive resource allocation for the operational tasks (impairment of cognitive attention, memory and executive function, with an intense computer game continuing to linger for some time).’

Thus, ‘it can be assumed that’ the online game ‘directly contributed’ to the signaller’s error. That is, instead of allowing the trains to cross in Kolbermoor, he allowed the train at that station to enter the single line en route to Bad Aibling. He ‘looked but failed to see’ the indications on the panel showing the actual positions and routes of the trains involve. It did not help that the occupation of the single line (the signalling panel in question replacing a string of yellow route-setting lights with a single red ‘occupied’ light) was too easy to overlook.

The signaller had used a Zs-1 ‘ersatzsignal’ signal, which is not interlocked and can give authority to pass a stop signal showing danger when the main aspect cannot be cleared. Unlike the PoSA (proceed on sight aspect) signals in GB, it does not confirm the existence of a wheeled path to the end of the section of line protected, and can be cleared irrespective of a route having been set in the opposite direction.

Writing in the November 2016 IRSE News, Peter van der Mark noted that the Zs-1 ersatzsignal may only be used when the main aspect cannot show a proceed aspect for one or more of the following reasons:

• A defective signal semaphore or bulb.
• Defective point detection, but only after the turnout has been secured in the proper position.
• A defect in the signalling block system (such as a cable fault), but only once it has been established that the line ahead is clear.
• A proved clear track circuit that persistently shows ‘occupied’.

Once a Zs-1 ersatzsignal has been used, the train must travel at no more than 40 km/h (25mph) and be prepared to stop at any obstruction until the next relevant signal has been reached. When a starting signal displays a Zs-1 aspect, the train must keep to the 40-km/h rule until the train has reached the final set of points at the yard or station, after which 100 km/h is permissible. At Bad Aibling, the driver passed the Zs-1 and accelerated to 100 km/h after passing the last set of points and entering the single line section in accordance with the rules. However, the NIB noted that the ‘complexity of the rules is high’ and the rule book ‘is (under time pressure) not suitable as a reference work. The provisions to be applied are based on several directives and in different modules, sections or paragraphs.’

Action taken

The signaller was held in ‘pre-trial detention’ form 12 April 2016. The prosecutors brought the charges to the court in Traunstein in mid July 2016 with accusations on 12 counts of ‘murder by negligence’ and 89 accounts of ‘injury by negligence’. On 10 November – the first day of trial – the defendant confessed to the charges brought by the prosecutors, but his lawyer wanted the degree of guilt to be evaluated during the subsequent proceedings. The signaller showed a degree of compassion for the victims, he refused to answer questions on the intensity of his preoccupation with the mobile game.

The court ruled on 5 December 2016 that the signaller was guilty of all charges, and he was sentenced to three-and-a-half years in prison. He was released on probation in July 2018.

Recommendations

• The ‘train radio emergency call’ and ‘emergency call route’ functions in the GSM-R selection menu should be combined such that they operate after a signaller has pressed the ‘emergency call button’ on the control panel
• The signalling rules and regulations should be reviewed in full, with reference to an appropriate risk assessment
• Simulators should more extensively in training, which should also address the issues portable media devices and distraction.
• The use of the Zs-1 ersatzsignal should be subject to a risk-based reassessment.

19 December

Belgium: Passenger train derailment at Leuven, 18 February 2017

Full report

At around 13:11 (local time) on 18 February 2017, a passenger train derailed on a crossover shortly after leaving Leuven station’s Platform 7. The first carriage overturned; the second and third carriages came off but remained upright. One passenger was killed; 26 passengers and one member of staff were injured.

The Belgian NIB determined that the derailment occurred because the driver took the train through the crossover too fast. However, said driver had developed a cognitive bias, brought about by the following factors:

• The presentation of a complex environment without clear landmarks
• The ambiguous character of the ‘end-of-zone’ sign ‘9’, allowing for increased speeds, while the signal in rear of said sign imposes a speed restriction of 40 km/h at the base of the signal in advance of the ‘end-of-zone’ sign
• The ambiguous character of the reference line indicator signs posted for Line 36 in advance of Platform 7
• The incomplete definition in the rules re the line indicator sign for Line 36
• The combination – on the side of the train driver – of passive route knowledge for departure from Platform 7, combined with underdeveloped routine driving habits, on the one hand, and the amount of information to process during and shortly after the departure from Platform 7, on the other.

These factors led the driver to develop the belief that he was travelling on Line 36, when in fact the track was being switched to Line 36.

The signals observed by the driver during and after his departure and the in-cab equipment meet technical specifications. For the driver, however, the in-cab display of the train protection system used (TBL1++) and the positioning of the signal caused confusion that it did not correct his ‘inaccurate mental perception’.

The Belgian NIB also noted the absence of an efficient recovery system. TBL1++, which ‘will occasionally inter­vene if, on receiving a double-yellow signal aspect, the imposed maximum speed of 40 km/h is not reached in a timely manner or is no longer observed, having been reached earlier’. However, TBL1++ is not designed to monitor the speed of a train after receiving a ‘green yellow horizontal’ signal: when passing a signal with such an as­pect, this function is automatically disabled. The train driving support system can therefore no longer intervene when the imposed speed restriction is not observed.

Furthermore, the train was not equipped with ETCS; indeed ETCS (on the infrastruc­ture side) has yet to become operational in Belgium.

The railway undertaking neither adequately identified the risk from failing to observe the imposed speed reduction (in a timely manner) after receiving a ‘green yellow horizontal’ aspect, nor the recurring character of incidents which may indicate that some drivers do not systematically acquire the expected driving reflexes. ‘The untimely observance of a speed reduction may be the result of incorrect driving habits, dis­traction, etc, and must therefore be considered a precursor of accidents.’

The configuration of the tracks and signals in a complex environment, as can be experienced by drivers when leaving Leuven from Platform 7, complicates an intuitive de­coding of the information transmitted by the available signals. In the past, this has contributed to an incorrect mental perception with several drivers in Leuven and led to ‘various dangerous situations that show analogies with the accident in question’. Only a few incidents have been assessed and the analyses of these incidents did not result in a full identification of the problem.[1]

The Belgian NIB observes that ‘the potential risk-enhancing character of certain aspects of shift work, in particular the system with so-called backward-rotating early shifts, could result in higher than average fatigue levels. The system with backward-rotating early shifts requires a proper FRA (Fatigue Risk Analysis)’. Furthermore, ‘the communication channels between the Chief of Operations and the Leader Infrabel, on the one hand, and between the Chief of Operations/Leader Infrabel and the various disciplines (SPC (Railway Police)) and other parties (investigators, public prosecutor, etc.), on the other, are too vague and can lead to misconceptions and unsafe situations’.

Recommendations

• Rules relating to ‘end-of-zone’ signage and the definition of reference line indicators should be reviewed.
• Situations that can invoke false mental perceptions should be considered and monitored.

[1] There is a parallel here with the SPAD and collision at Ladbroke Grove in 1999, the inquiry into which revealed (inter alia), a number of incidents at the same signal (SN109), the proper assessment and analysis into which had not been undertaken before the fatal incident SPAD occurred.