Tube Train Running With Doors Open.

[Belperpete]

I don’t think so. Having some idea how these trains work, I’d suggest that this would only be the case if they had been released by the driver pressing the open buttons. Without checking I’d also suspect there’s speed sensing which prevents the doors being released above slow speed.

The report does say that some doors opened without the driver releasing them:
para 48

Some doors opened at Finchley Road station without being commanded by the train operator

 

[Belperpete]

To be fair the RAIB give this impression. I don’t doubt the driver was flustered, but he really shouldn’t have been.

An excellent bit of advice I was given by a very experienced engineer I worked with was "If you are under pressure to do something quickly, the best thing to do is put the kettle on and think about what you are doing". Whilst kettles aren't always available, the underlying meaning is very true.

 

[bramling]

The report does say that some doors opened without the driver releasing them:
para 48

I *think* this may be sloppy wording from the RAIB. They don’t give a full timeline of the incident, and the extract from the train download they show doesn’t show everything, however we can assume that the first thing the driver did after initially berthing in the platform was to press the open buttons. My reading is that the TMS issue defaulting to passenger open mode then allowed some doors to open.

A very sloppy report IMO as it simply doesn’t give a full timeline of everything which happened. Not the first sloppy RAIB report.

 

[bramling]

An excellent bit of advice I was given by a very experienced engineer I worked with was "If you are under pressure to do something quickly, the best thing to do is put the kettle on and think about what you are doing". Whilst kettles aren't always available, the underlying meaning is very true.

Absolutely. No one should be worrying immediately about causing a delay nor about inconveniencing the punters. I don’t blame the driver for this, but I do blame his training.

 

[samuelmorris]

Ah, para 15 states that the warning sounds and the display shows when it is 10s before departure, and para 16 states that the display goes out when the ATO start button is pressed. Para 15 doesn't say whether it is a momentary or continuous alarm, I incorrectly assumed it was continuous. Apologies.

Is that not just the sound that plays at (among other times) 0m31 in this video?

 

[bramling]

Is that not just the sound that plays at (among other times) 0m31 in this video?

Yes that’s exactly the sound. It only plays once.

 

[bionic]

It's no surprise people aren't able to handle incidents very well when all they do is press buttons day in, day out and the train drives itself. It must be completely mind numbing. They aren't really drivers on the ATO lines, not any more than the bloke on the DLR is. I guess the job has probably become so de-skilled since ATO that competency has been allowed to lapse drastically. If you cut out the traction interlock then its imperative you walk the train and physically check every single door is closed before moving. That goes for LU or the mainline. Every driver should know that. Its bread and butter stuff. If the guy didnt know to do that then training and competence management needs to be looked at.

 

[lonogrol]

Am I reading this correctly? If both TMCCs reboot together, then a passenger pressing a door open button will cause the door to open - and this can happen between stations!

I *think* this may be sloppy wording from the RAIB. They don’t give a full timeline of the incident, and the extract from the train download they show doesn’t show everything, however we can assume that the first thing the driver did after initially berthing in the platform was to press the open buttons. My reading is that the TMS issue defaulting to passenger open mode then allowed some doors to open.

A very sloppy report IMO as it simply doesn’t give a full timeline of everything which happened. Not the first sloppy RAIB report.

I agree with bramling summary. That isn’t what happened according to L.U.L’s own internal report. What they state is that the level of TMS faults effectively cause the train to think that the Passenger/Operator selector rotary(1) to think that it is set to “Passenger” and open the doors when the customer open buttons are pressed. Because these buttons haven’t been used in so long they were no longer maintained, accordingly some doors opened because the button was faulty and the train thought they were being depressed, and some doors that customers tried to open by pressing the button didn’t open because the buttons didn’t work. The doors would not have opened on their own accord, only when the train operator actually released them in the cab.

1. some people might have heard of terms such as the P.O.G.O switch and others, basically dates from when doors could be set to be operated by the push buttons rather than them all open as current practice

 

[lonogrol]

It's no surprise people aren't able to handle incidents very well when all they do is press buttons day in, day out and the train drives itself. It must be completely mind numbing. They aren't really drivers on the ATO lines, not any more than the bloke on the DLR is. I guess the job has probably become so de-skilled since ATO that competency has been allowed to lapse drastically. If you cut out the traction interlock then its imperative you walk the train and physically check every single door is closed before moving. That goes for LU or the mainline. Every driver should know that. Its bread and butter stuff. If the guy didnt know to do that then training and competence management needs to be looked at.

I don’t think it’s anything to do with not knowing, more the fact he operated the switch in error, as for the fault symptoms present he should not have not operated that switch.

 

[bionic]

I don’t think it’s anything to do with not knowing, more the fact he operated the switch in error, as for the fault symptoms present he should not have not operated that switch.

If someone is bypassing the traction/door interlock "in error" then once again it points to a training and competence management issue. I've been driving trains for many years and trust me... you don't just isolate a safety system "in error". The second you touch any of those isolation switches you are a) out of service and b) thinking about your rules. But this guy did isolate it in error and that's very worrying!

Its frightening that the guy could have done this and then just cracked on - in ATO mode!

If the driver did it in error then it's a competency issue, if they did it deliberately it's a disciplinary issue.

From reading the report it's pretty clear the driver did it in error... he thought he was bypassing the system that checks the train is correctly positioned in the platform before allowing door release. What he was actually doing was bypassing the door interlock circuit. The fact he operated this switch two seconds after opening his cab door shows he was rushing (presumably because of the pressure put on drivers by control not to lose time - something also identified in the Peckham Rye incident). He rushed, operated the wrong safety switch, still didn't solve the problem of some doors not opening, and carried on - all in less than TWO MINUTES after coming to a stand!

A couple of things strike me about the design of these trains that. Firstly that the safety isolation switches are located on the same side as the drivers seat. Secondly that they can be operated in ATO with safety systems isolated.

This reminds me a bit of the steam train SPAD in the west country where the guy had isolated the TPWS or the Stafford SPAD with a loco where there were known issues with the brakes. Although I get the impression they were due to the deliberate actions of the driver rather than something done in error due to rushing and lack of competence.

 

[SamYeager]

This all sounds a bit overkill to me. Firstly, the doors on the 95 and 96 stocks are often doing strange things - whilst the basic function is hardwired, everything else like chimes, timings and the like is added through the TMS, so any failure of TMS components can cause strange (but not necessarily unsafe) door behaviour, in the worst case the doors on one car or the whole train closing of their own accord with no warning. Likewise trains always have minor warnings on the TMS, especially things like heat and vent faults, the TMS on these trains being quite slow (think mid 1990s computers!).

As I understand the report the issue with the doors stemmed from the volume of error messages being logged about the aircon and PIS. These faults weren't being addressed because there was no procedure to check the logs and fix the faults being logged. RAIB's recommendation is aimed at ensuring the logs are checked and faults fixed which will then in turn mean the likelihood of similar door issues will be much lower in future as an underlying cause will have been addressed.

 

[bramling]

If someone is bypassing the traction/door interlock "in error" then once again it points to a training and competence management issue. I've been driving trains for many years and trust me... you don't just isolate a safety system "in error". The second you touch any of those isolation switches you are a) out of service and b) thinking about your rules. But this guy did isolate it in error and that's very worrying!

Its frightening that the guy could have done this and then just cracked on - in ATO mode!

If the driver did it in error then it's a competency issue, if they did it deliberately it's a disciplinary issue.

From reading the report it's pretty clear the driver did it in error... he thought he was bypassing the system that checks the train is correctly positioned in the platform before allowing door release. What he was actually doing was bypassing the door interlock circuit. The fact he operated this switch two seconds after opening his cab door shows he was rushing (presumably because of the pressure put on drivers by control not to lose time - something also identified in the Peckham Rye incident). He rushed, operated the wrong safety switch, still didn't solve the problem of some doors not opening, and carried on - all in less than TWO MINUTES after coming to a stand!

A couple of things strike me about the design of these trains that. Firstly that the safety isolation switches are located on the same side as the drivers seat. Secondly that they can be operated in ATO with safety systems isolated.

This reminds me a bit of the steam train SPAD in the west country where the guy had isolated the TPWS or the Stafford SPAD with a loco where there were known issues with the brakes. Although I get the impression they were due to the deliberate actions of the driver rather than something done in error due to rushing and lack of competence.

A good post, and you make some very good points, especially that the driver was clearly rushing. I’m in full agreement that there’s no way someone should operate the wrong switch in error just like that. Drivers undergo what should be a thorough training and selection process, and are well paid in recognition of this, such that they don’t just nonchalantly flick a safety switch in error during a moment of dither.

Like at Peckham Rye this points to a more serious issue with TFL’s operations training and competence management. Next time they might not be so lucky.

I do question how much value has been achieved by this RAIB investigation. Nearly a year’s worth of work to come up with some pretty obvious conclusions and a report which is not that easy to read and understand.

 

[rebmcr]

I find this section particularly damning:

95 A requirement for an audible warning if attempting to start with the TDIC switch operated was contained in the LUL technical specification for the 1996 stock.
Clause 11.12 of the technical specification related to the train door interlock cut-out switch and required:
‘Switch position ‘cut-out’ - Proving interlock with Driving Controls bypassed, Door Closed Visual not illuminated, Cab Audible Warning if motoring attempted’.
This requirement was then included in Clause 9 of LUL rolling stock standard RSE/STD/036 ‘Door control systems’ issue B, dated November 1993. Clause 9 remained in force when modifications were made to the trains to permit the introduction of ATO in 2006/07.
96 Post-incident testing showed that there was no audible warning fitted to the 1996 stock in service on the Jubilee line when the Finchley Road incident occurred.
The circumstances which led to this situation are unclear because:

• an LUL compliance check dated 12 June 1998 records the feature was fitted as specified;
• LUL has stated there was no intention to remove the functionality when the trains were converted to ATO, or at any other time; and
• LUL staff familiar with train operation before and after ATO conversion do not recall the feature being present.

 

[bramling]

I find this section particularly damning:

Yet meanwhile elsewhere RAIB are saying the driver felt under pressure. Personally I don’t think it’s desirable to have audible warnings for every safety switch, as otherwise in some scenarios there would be warnings galore. The seal on the switch should have provided enough warning had the driver been well enough trained to realise what he was doing.

It might have helped to have had an alarm sound which would need to have been acknowledged, but only if the driver was thinking what he was doing. The counter argument is that people go into information overload, which I think is ultimately a bigger risk.

 

[Belperpete]

It might have helped to have had an alarm sound which would need to have been acknowledged, but only if the driver was thinking what he was doing. The counter argument is that people go into information overload, which I think is ultimately a bigger risk.

It is easy to acknowledge an alarm, and then forget what you have done if you then have to do other things to try and fix the fault. For example, if the driver has to walk down the train then he may well get distracted by passengers asking about the delay, and when he eventually gets back to the cab he may have forgotten that he operated the switch. A better option is to prevent ATO if the switch has been operated. He is then likely to query why he has to drive manually, and contact control.

 

[bramling]

It is easy to acknowledge an alarm, and then forget what you have done if you then have to do other things to try and fix the fault. For example, if the driver has to walk down the train then he may well get distracted by passengers asking about the delay, and when he eventually gets back to the cab he may have forgotten that he operated the switch. A better option is to prevent ATO if the switch has been operated. He is then likely to query why he has to drive manually, and contact control.

That wouldn’t always work, as in practice people don’t always seek permission to drive in protected manual mode. Likewise in an ATO-not-permitted area the train would already be in PM. Again RAIB are taking a rather rose-tinted view of reality and not really thinking things through.

The traction interlock isn’t really a switch which one should be forgetting having operated. It’s not something a driver will be touching in anger very often - perhaps only a few times in a career. Also in terms of defect handling normal practice is to put switches back after having tried something - notably this is something else this driver omitted to do (had he operated the switch he thought he’d operated the train wouldn’t have moved when he tried to depart until the switch was replaced).

The Northern Line trains are arranged differently and the emergency door open switch is rarely if ever used. It’s a bit of a strange setup in all honesty.

 

[Belperpete]

While it is easy to blame the driver, who did after all make an error, this incident raises a large number of very serious underlying issues:
- trains routinely running with a significant number of faults because nothing in place to detect and rectify them
- inadequate data logging meaning that there is no record of what happened, particularly of systems rebooting
- inadequate refresher training due to lack of facilities
- safety critical indications and screens that cannot be viewed properly in sunlight
- trains that do not meet the specification
- inadequate testing of trains to ensure that they are to spec

I am not convinced that all these issues are addressed by the recommendations.

I am worried by

LUL ... was unable to establish with certainty the effect of correctly following the procedures, including operation of the ESDC switch

So, even if the driver had operated the ESDC switch as he had intended, and not the TDIC switch in error, there may well still have been an incident!

LUL is uncertain whether this is effective in all circumstances when parts of the train management system are rebooting.

LUL was ..... unaware of the duration or frequency of rebooting

So LUL don't know how their trains will behave in certain circumstances, and don't even know how often these circumstances are occurring!

 

[bramling]

While it is easy to blame the driver, who did after all make an error, this incident raises a large number of very serious underlying issues:
- trains routinely running with a significant number of faults because nothing in place to detect and rectify them
- inadequate data logging meaning that there is no record of what happened, particularly of systems rebooting
- inadequate refresher training due to lack of facilities
- safety critical indications and screens that cannot be viewed properly in sunlight
- trains that do not meet the specification
- inadequate testing of trains to ensure that they are to spec

I am not convinced that all these issues are addressed by the recommendations.

I am worried by

So, even if the driver had operated the ESDC switch as he had intended, and not the TDIC switch in error, there may well still have been an incident!



So LUL don't know how their trains will behave in certain circumstances, and don't even know how often these circumstances are occurring!

I completely agree LU aren’t blameless in this. Indeed that’s what happens when politicians change an engineering company into a “people” company. Once knowledge and experience are lost in this way it’s very hard to get it back. Especially for trains which date from an era where they have certain software “quirks” which can cause strange things to happen.

Unfortunately which ever way I look at it I still come back to it being basically the driver’s error. I don’t blame him for this however, as it’s quite clear his training had not equipped him for the situation. Likewise RAIB themselves say he felt under time pressure, it’s strange they didn’t further elaborate on why he might have felt that.

 

[Rogmi]

An excellent bit of advice I was given by a very experienced engineer I worked with was "If you are under pressure to do something quickly, the best thing to do is put the kettle on and think about what you are doing". Whilst kettles aren't always available, the underlying meaning is very true.

At the school, the instructor used to say "Stop and have a fag and think" (this was prior to KX and no smoking on the Underground). Perhaps this is why Motorman (Top Rate) Percy always did so well when dealing with his defects

As a slight aside, it's very easy to create more defects by not dealing with the first one correctly. A favourite thing when taking a Guard for the Motorman's exam at the school was for the Instructor to give the Guard the scenario (e.g. "you get the bell, prepare to motor but get no movement") then see how deep a hole the Guard could dig for himself by missing something out or doing something wrong.

 

[SamYeager]

That wouldn’t always work, as in practice people don’t always seek permission to drive in protected manual mode. Likewise in an ATO-not-permitted area the train would already be in PM. Again RAIB are taking a rather rose-tinted view of reality and not really thinking things through.

Throughout this thread you've been fairly critical of the RAIB report. What do you think the conclusions and recommendations should have been?