• Our booking engine at tickets.railforums.co.uk (powered by TrainSplit) helps support the running of the forum with every ticket purchase! Find out more and ask any questions/give us feedback in this thread!

Braking issue on Caledonian Sleeper causes train to "run away" at Edinburgh

Status
Not open for further replies.

O L Leigh

Established Member
Joined
20 Jan 2006
Messages
5,611
Location
In the cab with the paper
Sort of. With the microwave oven, you get a very clear warning if you've put metal in it by mistake in the form of arcing, and it can usually be turned off (by simply opening the door) well before it has chance to cause any actual damage. Though it wouldn't totally surprise me if some more advanced microwaves had some means of detecting arcing and automatically shutting off if it happens, or that some might have some form of fire/overheat detection in case you overcook something to the point of it catching fire.

The most dangerous risk a microwave would pose to someone if misused, though, would be quite literally to cook them alive if it were to be operated with the door open. Fortunately, literally every model has a feature preventing that from happening.

Agreed. But that wasn't really my point. Like you with your crashable uncrashable car, I was merely illustrating the point that things need to be operated within their design capabilities if they are to safely work as intended.

That's a bit more like the analogy of having a feature whereby a train's brakes can be disabled without as a minimum any warning or notification that this is the case and the only visible evidence of it being a small isolating cock hidden well below platform level.

I'm not going to let this pass because even a casual reading of the RAIB shows that there are systems in place to give warning but that, in this instance at least, the novel design of the BPIC together with weaknesses in the old coupling procedure meant that they were missed. These are failings that I cannot deny, but what I will deny is that this one incident undermines the principle of the two-pipe brake system or it's inherent safety. Recommendations and learning points have come out from the investigation and will be applied to prevent any repeat, but I will state again that the two-pipe braking system is inherently safe, as the paucity of similar incidents should illustrate.

But the point I replied to regarding keying in in two places on a Voyager is an utterly ridiculous piece of design. That would be like, for instance, if you had a television set and you turned it on on the front panel, using the on button on the remote would cause it to fail and require repair. That would be ridiculous.

Not really, no. Having two keys in is more akin to plugging your TV into one socket and then simultaneously plugging it into a second. You're not merely switching the train on but rather instating a power supply.

In summary, there are some dangerous failure modes you can't design out of a product (e.g. a car that you can't crash - but they *are* working on that!) - but if there is one that you can, you really should, regardless of whether it's for professional or personal use.

Do we really want to go into the "how" right now...? You say that it can be designed out. Perhaps you'd like to have a go.

Well, er, it does. The railway was very, very lucky on a number of counts, and the incident caused nothing but embarrassment. But had it collided with another train, potentially a packed commuter DMU or EMU at that time of day, it could have killed people. That is surely a strong parallel.

The scope for potential loss of life is no way to draw a parallel. You're trying to compare a multi-national knowingly allowing people to use a product that it was aware was subject to safety concerns that it had not yet addressed to a procedural failure that allowed an honest-to-goodness mistake to occur. Chalk and cheese, mate.
 
Sponsor Post - registered members do not see these adverts; click here to register, or click here to log in
R

RailUK Forums

Bletchleyite

Veteran Member
Joined
20 Oct 2014
Messages
97,783
Location
"Marston Vale mafia"
Not really, no. Having two keys in is more akin to plugging your TV into one socket and then simultaneously plugging it into a second. You're not merely switching the train on but rather instating a power supply.

Which of course you can't do.

Regarding designing it out I'm not a rolling stock designer but I'm sure there's a way. Having a visible warning above platform level would be one thing that might help. I have noticed in the past that all SBB stock, whether LHCS or MU, has a clearly visible brake status display.
 

O L Leigh

Established Member
Joined
20 Jan 2006
Messages
5,611
Location
In the cab with the paper
Which of course you can't do.

Indeed. But that is a better analogy than yours as it more accurately represents what's happening.

Regarding designing it out I'm not a rolling stock designer but I'm sure there's a way. Having a visible warning above platform level would be one thing that might help. I have noticed in the past that all SBB stock, whether LHCS or MU, has a clearly visible brake status display.

Really? That surprises me because you seem eminently qualified on what you consider to be good and bad. Sounds like that SBB system wouldn't prevent the train being driven away if someone failed to check these indicators.

Hopefully you will feel reassured that the Rule Book is due for an update with regard to brake testing and the changes already made to the Cally Sleeper's BPICs and coupling/uncoupling procedures.

On the paucity of similar incidents note, I'm struggling to find any directly comparable incident where a train ran away due to the driver being unable to control the train brakes more recent than Nov 2000 (Lawrence Hill). I shudder to think how many other types of incidents there have been over the same 19 year period. At this rate we really should be going away and having a serious think about track, signals, electrification, doors, platforms, auto-couplers...
 

ComUtoR

Established Member
Joined
13 Dec 2013
Messages
9,432
Location
UK
Hopefully you will feel reassured that the Rule Book is due for an update with regard to brake testing and the changes already made to the Cally Sleeper's BPICs and coupling/uncoupling procedures.

...as it is doing right now about coupling and uncoupling.

Care to share ?

On the paucity of similar incidents note, I'm struggling to find any directly comparable incident where a train ran away due to the driver being unable to control the train brakes more recent than Nov 2000 (Lawrence Hill)

There was a runaway at my TOC during coupling. Thankfully just a short distance. Stonegate always springs to mind when it comes to runaway trains. Granted that was low adhesion but a simple software update on the Mitrac post incident shows how easily it could have been prevented. Another recent incident at my TOC has resulted in another simple software update. Something that would have prevented numerous incidents.
 

O L Leigh

Established Member
Joined
20 Jan 2006
Messages
5,611
Location
In the cab with the paper
Care to share ?

No secret knowledge. It’s right there in the RAIB report.

There was a runaway at my TOC during coupling. Thankfully just a short distance. Stonegate always springs to mind when it comes to runaway trains. Granted that was low adhesion but a simple software update on the Mitrac post incident shows how easily it could have been prevented. Another recent incident at my TOC has resulted in another simple software update. Something that would have prevented numerous incidents.

While these were overruns, they were not similar incidents as they were not caused by closure of the BPIC between the train and the loco.
 

Dieseldriver

Member
Joined
9 Apr 2012
Messages
973
Indeed. But that is a better analogy than yours as it more accurately represents what's happening.



Really? That surprises me because you seem eminently qualified on what you consider to be good and bad. Sounds like that SBB system wouldn't prevent the train being driven away if someone failed to check these indicators.

Hopefully you will feel reassured that the Rule Book is due for an update with regard to brake testing and the changes already made to the Cally Sleeper's BPICs and coupling/uncoupling procedures.

On the paucity of similar incidents note, I'm struggling to find any directly comparable incident where a train ran away due to the driver being unable to control the train brakes more recent than Nov 2000 (Lawrence Hill). I shudder to think how many other types of incidents there have been over the same 19 year period. At this rate we really should be going away and having a serious think about track, signals, electrification, doors, platforms, auto-couplers...
Lawrence Hill wasn't even caused by a compromise in brake continuity either. In that instance, there was still a fully functioning fail safe brake on the train in the form of the emergency brake plunger.
 

Taunton

Established Member
Joined
1 Aug 2013
Messages
10,069
It does dismay me that, while we ban from service new rolling stock where the internal information display is half an inch too small, stock with this string of issues and design features seems to be readily accepted and put into service.
 

HSTEd

Veteran Member
Joined
14 Jul 2011
Messages
16,710
I'm uncertain as to why you've seized upon these particular points nor why you consider them to merit comment. It almost feels as though you've some point you're trying to prove.

The part of the coupling operation that could cause damage is the connection of the 61 way jumper cable. The reason for avoiding having two locos connected simultaneously should be fairly obvious, as connecting a second loco effectively connects a second power supply to all the circuits on that jumper which introduces the risk of damage due to an overload. As these circuits could include controls for the doors, PASSCOMs and other safety equipment, it's clearly of great importance not to expose them to avoidable damage.

This just implies that the jumper standard wasn't really suitable for operation in the first place.
It should not be possible for connecting two locomotives to a jumper system (originally designed for multiple working in the Nightstar era) to cause damage.
 

aleggatta

Member
Joined
28 Sep 2015
Messages
545
This is very interesting reading. Yes, in normal circumstances the brake pipe is a fail safe system. It is obvious these were not normal circumstances.

I am curious as to what coach information is available from the 92 via the 61 way connector. If there is a 'master' computer located in the 92 it should be possible to have a pressure transducer on each coach that can report the brake pipe pressure, with an electronic brake pressure gauge able to show the rearmost coach's brake pipe pressure. I am also wondering whether there might be a consideration for a 'running brake test button' to temporarily cut the rheostatic braking for the running brake test.

I think the most mind blowing thing for me, is that the technology exists to monitor these systems and flag faults, and it has existed for years. on new stock the lack of monitoring system just seems crazy. At least the coupling procedure has been changed to mitigate circumstances in future.
 

awsnews

Member
Joined
13 Mar 2019
Messages
315
I'm sorry, but you're starting to allow this to get out of proportion. This sort of situation has no parallels whatsoever with the 737Max and any attempt to draw one is just emotionally charged nonsense.

The key to your misunderstanding is your use of the word "product". A train is not a consumer product which has to be idiot-proofed with different shaped plugs and a battery compartment that prevents the batteries being inserted the wrong way around. I said it earlier in this discussion but it clearly bears repeating that the railways are not operated by 5 year olds and therefore there is no need to be going around idiot-proofing the equipment.
The same over arching legislation applies regardless of terminology and does require all foreseeable hazards to be eliminated, if you are relying on procedures when a practicable engineering solution is available then, by definition, you have an unsafe product.
Given the number of RAIB reports involving failures of Safe Systems of Work highlighted on the forum the statement that 'the railways are not operated by 5 year olds' as a mitigation is seriously undermined.
I would add this type of issue is becoming more prevalent across a number of industries and activities, not just in the rail sector.
 

edwin_m

Veteran Member
Joined
21 Apr 2013
Messages
24,884
Location
Nottingham
The same over arching legislation applies regardless of terminology and does require all foreseeable hazards to be eliminated, if you are relying on procedures when a practicable engineering solution is available then, by definition, you have an unsafe product.
Given the number of RAIB reports involving failures of Safe Systems of Work highlighted on the forum the statement that 'the railways are not operated by 5 year olds' as a mitigation is seriously undermined.
I would add this type of issue is becoming more prevalent across a number of industries and activities, not just in the rail sector.
It does not require all foreseeable hazards to be eliminated. It requires hazards with unacceptable risk level to be eliminated and others to be reduced as low as reasonably practicable. However, the ERIC principle, used in engineering safety management on railways and elsewhere, states that a reasonably practicable engineering solution to Eliminate the risk should be adopted in preference to a solution relying on Control by procedure (the two in between are Reduce and Isolate).
 

TimboM

Established Member
Joined
12 Apr 2016
Messages
3,732
Thanks - I'm not familiar with the connections for Mk5s and didn't realise that the jumper is separate from the coupler.
So when ECS runs to Euston/GLC under normal operations, does the ECS loco detach and move forward before the "train" loco starts to provide power to the train?
Yes, after arrival the ECS loco detaches and moves forward a few feet. The train loco (usually brought in Dead on Rear) is then connected up ETS-wise prior to boarding.
For ECML diversions at Wembley is there a temporary lack of train power and reliance on batteries whilst the swap is done?
Yes - although it's a negligible time period. The train(s) arrive in Wembley Yard, draw-back loco detaches and the train loco on the rear/south end (already attached) is hooked up.

Also worth noting the issue is more to do with the 61-way (data/comms) jumpers being attached at each end and stray currents flowing into the loco and frazzling electronic components that can render it a failure (and are also very costly to fix). The sleepers have run without the 61-way cables attached since the incidents over the first weekend in February when there were some high profile Class 92 failures in Scotland causing significant delays. There's been no similar issues since. Will let people draw their own conclusions on that one (and note that was with just one loco attached).
This just implies that the jumper standard wasn't really suitable for operation in the first place.
It should not be possible for connecting two locomotives to a jumper system (originally designed for multiple working in the Nightstar era) to cause damage.
Agreed - the 92s were designed to operate TnT in remote multiple (both locos working on full power) on the Nightstar stock and were successfully tested as such. So it seems Brush/Met Camm were able to achieve this in the mid-1990s. Fast forward to 2019/2020 and CAF aren't able to design/produce a similar arrangement that doesn't blow the loco's electronics. Progress...?!
This is very interesting reading. Yes, in normal circumstances the brake pipe is a fail safe system. It is obvious these were not normal circumstances.

I am curious as to what coach information is available from the 92 via the 61 way connector. If there is a 'master' computer located in the 92 it should be possible to have a pressure transducer on each coach that can report the brake pipe pressure, with an electronic brake pressure gauge able to show the rearmost coach's brake pipe pressure. I am also wondering whether there might be a consideration for a 'running brake test button' to temporarily cut the rheostatic braking for the running brake test.

I think the most mind blowing thing for me, is that the technology exists to monitor these systems and flag faults, and it has existed for years. on new stock the lack of monitoring system just seems crazy. At least the coupling procedure has been changed to mitigate circumstances in future.
Assuming the 61-way jumper cable is connected, the information available in the 92 consists of some basic visual/audio alarms on the central window pillar for key issues such as window failures, fire and HABD (Hot Axle Box Detector). There's also a kick-button to over-ride passcom activation if required (note the 10 second delay mentioned in the report) and there's also a handset for comms with the Train Manager.
1590786738698.png
Detailed coach information is only available on the full TCMS screens in the coaches.

The friction brake on a 92 is pretty powerful too, so not sure disabling the rheo brake for a running brake test would really increase the chances of identifying a fault that much (as the friction brake just comes into play then) - only real way would be to disable the loco's brakes entirely somehow, which is probably not advisable.

There's that many electronics and alarms already going off on modern stock - half the time spuriously, one wonders if it'd actually be better to have less of these and allow the crews to focus on doing the basics properly without all the distractions. Also removes the false sense of security ("it's OK the computer will tell me if there's a problem") and/or the cry wolf issue ("yet another alarm... probably just another computer fault... I'll ignore it...").

The Mk5s are a good example of this - lots of fancy electronics and computerised bits that don't appear to work very well, and then the basic design of crucial components like the Brake Pipe Isolating Cock are somewhat lacking.
 
Last edited:

Class 170101

Established Member
Joined
1 Mar 2014
Messages
7,933
The fact that the loco's vacuum circuit breaker never reclosed after the overhead neutral section is significant too, as that would have meant the rheostatic brake was inoperable and the loco was braking using its friction brake instead - the report notes that as friction brakes of this type get hotter their retardation is reduced. The friction brake wouldn't be as effective as the rheostatic brake even if it was functioning perfectly (and assuming brake blocks weren't new) before the temperature significantly increased.

Is it normal for the Rheo brake to fail though having passed through a neutral section? Seems remarkably strange to me.


It’s a super report, and a classic example of the ‘Swiss cheese’ model:

* late changes to design and function of coupling / connection systems
* BPIC not designed to correct standard (as a result of above)
* BPIC positioned in a place where it could be operated inadvertently
* Procedure for timing of brake continuity test had the potential for a different interpretation to the intention of the procedure relating to the coupling / connection procedure for this stock
* VCB opened and did not close, preventing use of Rheo brake
* Train manager didn’t have a functioning radio with him for communication with driver

It is likely that if any of these had been different, the incident would not have happened (or the train would have been brought to a stand at Waverley)

Fortunately, a couple of the swiss cheese holes were not aligned:

* the train had a route set through Slateford / Haymarket to Waverley, ie no conflicting movements set against it
* the driver had the presence of mind not to press the GSMR REC button
* the driver was able to contact the signaller, and the signaller was able to action the setting of a route through Waverley in short order
* the train manager was sufficiently aware of a problem, and pressed the passenger alarm button in the train (albeit it took two attempts).

Had one or more of these been ‘aligned’, then the consequences could have been rather worse.

A lucky escape, but a very unlucky chain of events.

I would also add to your comments ref swiss cheese hole alignments the fact that the signaller wasn't otherwise engaged because I assume if he was then he wouldn't have been able to set a straight route through Edinburgh Waverley station and out the other end because the driver wouldn't have got through to him - it wasn't a GSMR emergency call according to the report so wouldn't get higher priority over other calls.
 

aleggatta

Member
Joined
28 Sep 2015
Messages
545
I would also add to your comments ref swiss cheese hole alignments the fact that the signaller wasn't otherwise engaged because I assume if he was then he wouldn't have been able to set a straight route through Edinburgh Waverley station and out the other end because the driver wouldn't have got through to him - it wasn't a GSMR emergency call according to the report so wouldn't get higher priority over other calls.

The driver would have used the yellow 'urgent call' button rather than the standard 'dial the signaller' process. one the people I used to work with got a bit of an ear bashing from a signaller for using the yellow button as opposed to dialling the panel in the normal way. The yellow button call gets priority answering.
 

Taunton

Established Member
Joined
1 Aug 2013
Messages
10,069
Yes, if a window is compromised/opened on a Mk5 alarms go off. As we all know, Mk5s don't have windows that are supposed to open.
So a series of detectors have been installed on the coach windows, in case one is somehow opened/cracked, but nothing to detect that the brakes have been switched off ...
 

awsnews

Member
Joined
13 Mar 2019
Messages
315
It does not require all foreseeable hazards to be eliminated. It requires hazards with unacceptable risk level to be eliminated and others to be reduced as low as reasonably practicable. However, the ERIC principle, used in engineering safety management on railways and elsewhere, states that a reasonably practicable engineering solution to Eliminate the risk should be adopted in preference to a solution relying on Control by procedure (the two in between are Reduce and Isolate).
You are correct in that I should have said the elimination or minimisation of any risks to health or safety, not just elimination. The actual HSWA, however, doesn't use the term 'as low as reasonably practicable', it requires 'so far as is reasonably practicable'. Easy to dismiss as semantics until corporate laywers get involved.
I think we are both in agreement that, if practicable, engineering safeguards should be implemented before relying on procedures. ERIC and his close relatives ERICPD and ESRICPD provide good advice when managing safety risks, unlike Eric who when required to do something safety critical has a high probability of failure.
 

TimboM

Established Member
Joined
12 Apr 2016
Messages
3,732
Is it normal for the Rheo brake to fail though having passed through a neutral section? Seems remarkably strange to me.
92s are quite apt to do all manner of odd things coming out of neutral sections. That said, the implication I got from reading it was that after the VCB didn't reclose properly coming out of the Curriehill neutral section and then the pan dropped (as a linked safety mechanism to protect the loco/OHLE) the loco was then not under power. By that point the driver was already trying to slow the train down for the approach to Waverley and it was at or around that time he would've been aware he had a brake issue. I doubt performing a reboot and powering the loco back up was on his list of things to do to try and slow the train down / alert the train manager / liaise with the signaller etc.

With the loco not powered up, the rheo brake won't work as it's effectively the reverse of the process used to power the train.
 

TimboM

Established Member
Joined
12 Apr 2016
Messages
3,732
So a series of detectors have been installed on the coach windows, in case one is somehow opened/cracked, but nothing to detect that the brakes have been switched off ...
Certainly on the emergency ones that are designed to be opened. Not too sure about the sealed ones - wouldn't surprise me though.
Goes back to my point above about too many gizmos/alarms.
 

TimboM

Established Member
Joined
12 Apr 2016
Messages
3,732
I would also add to your comments ref swiss cheese hole alignments the fact that the signaller wasn't otherwise engaged because I assume if he was then he wouldn't have been able to set a straight route through Edinburgh Waverley station and out the other end because the driver wouldn't have got through to him - it wasn't a GSMR emergency call according to the report so wouldn't get higher priority over other calls.
There's a good reason why the driver did not press the big red button - doing that would've stopped all traffic in the area dead in its tracks, meaning if something was in the sleeper's path, it would've stayed there until the inevitable happened. Not using the GSM-R emergency call meant the signaller had more options available to clear the route.
 

Taunton

Established Member
Joined
1 Aug 2013
Messages
10,069
With the loco not powered up, the rheo brake won't work as it's effectively the reverse of the process used to power the train.
That's a regenerative brake. Rheostatic braking is nothing to do with the overhead line supply. Plenty of rheo brakes on diesels.

I would also add to your comments ref swiss cheese hole alignments the fact that the signaller wasn't otherwise engaged
One of their greatest bits of luck is Edinburgh is, I think, the only terminus on the sleeper network that doesn't end in bufferstops.
 
Status
Not open for further replies.

Top