15/08/17 Waterloo derailment and disruption (latter likely to continue to 16/8)

[Railman]

Thank you signal head you obviously understood the point (no pun intended), the discussion at that time had included opinions that the points may have been "half and Half" or fully reverse. I would still be interested to know where the rolling stock had originated (stabled or brought in ECS and when).
The RAIB are basically saying points were "frigged", "By passed" or whatever term you want to use. The who, why and testing management will be for them to sort out.
I said in early in the thread I thought it could be a "very lucky escape" and still think the outcome could have been far more serious.
Those in the industry know there could be big consequences from this incident.

 

[swt_passenger]

IIRC (but only from memory after looking at realtime trains on the day), the incoming ECS had arrived in P11 about 20-30 mins beforehand, and another ECS arrived in P12 between the incident train's arrival and departure.

 

[Railman]

The latest edition of Rail magazine seems to back up my idea that the incoming ECS ran through the points, damaging them and then went back out over the points now standing off and derailed.

 

[Taunton]

Did a works train used the points into the works overnight?

 

[Sunset route]

Did a works train used the points into the works overnight?

The engineering train played no part in the incident other doing what it was supposed to do and that was to act as blocking train to keep the live railway and the lines under possession safely apart.

 

[43096]

The latest edition of Rail magazine seems to back up my idea that the incoming ECS ran through the points, damaging them and then went back out over the points now standing off and derailed.

Which is irrelevant in terms of the derailment. If this was the case, then why did the train get a green signal out of the platform? There is something badly wrong with the work done on the points and the interlocking. The RAIB report will make for interesting reading.

 

[Sunset route]

Which is irrelevant in terms of the derailment. If this was the case, then why did the train get a green signal out of the platform? There is something badly wrong with the work done on the points and the interlocking. The RAIB report will make for interesting reading.

Yes so bad that with a probable run through they maintained their detention. Yes it's looking that as part of strapping out or slipping out the links on the detection something went badly wrong either with the plan, excursion and or the checking. This is why it will make interesting reading, just thanking our lucky stars that this was a slow speed impact and with no injuries.

 

[AndyPJG]

From the RAIB news item:-

The collision occurred because a set of points were misaligned and directed the passenger train away from its intended route. The misalignment was a consequence of a temporary modification to the points control system which also caused the train driver and signaller to receive indications that the points were correctly aligned.

(my bold)

Seems to imply the points were detected and route locked (as it seems the train had a proceed aspect), but in fact the points were detected N when physically R (or v/v) and actually set for a route that should have been locked OOU.

As has been said, RAIB report will be interesting.

 

[Peter Mugridge]

In summary, that's a wrong side failure isn't it?

 

[Chris M]

Seems to imply the points were detected and route locked (as it seems the train had a proceed aspect), but in fact the points were detected N when physically R (or v/v) and actually set for a route that should have been locked OOU.

I think it's actually that the points were detected as locked, even though they might not have been. Whether that was the case or they were locked but in the opposite position to the indication given (to driver and signaller, if those had disagreed hopefully the movement would not have been made) it is certainly a wrong-side failure.

 

[Taunton]

Not just a wrong side failure, but also not a Single Point Failure.

The whole purpose of detection is to check that the points are physically as called. Even if they were run through initially by the inbound train, they were both set wrong for the called movement, and then wrongly detected.

It will be interesting to see what the RAIB say about them not being physically clamped. When was that given up?

 

[GB]

I think too much credence is being given to one rail article regarding the points initially being run through. Think I would rather wait for the actual RAIB report.

Incidentally, is it still a WSF if human intervention has bypassed/overcome the interlocking and other safety standards?

 

[Chris M]

Incidentally, is it still a WSF if human intervention has bypassed/overcome the interlocking and other safety standards?

Yes.
The interlocking should not permit, under any circumstances, points lying reverse to be detected normal (or vice versa). It should also not permit points that are not secured to be detected a secured.

If the interlocking has been bypassed for any reason (which is sometimes required)* then some other means of proving the points are secured for the intended direction of movement is required - clamping them is one such method but not necessarily the only one. Either this alternative method has suffered a wrong-side failure, or there has been a wrong-side failure of some element of the planning or implementation process.

A wrong-side failure a category of failure, rather than a specific failure mode. Any failure that results in a dangerous or potentially dangerous condition is a wrong-side failure, a right-side failure is one where the failure results in a safe condition (for example a signal showing red when it cannot be proved if the route ahead is clear, even if it is, is a right-side failure).

*My guess is that a modification may have been needed in this case because the interlocking would not normally allow these points to move and/or allow movement over them with a train standing on the adjacent line for reasons of flank protection.

 

[SpacePhoenix]

Is there a pair of switches within the point motor housing that detect which way the point is set for?

 

[43096]

Yes.

The interlocking should not permit, under any circumstances, points lying reverse to be detected normal (or vice versa). It should also not permit points that are not secured to be detected a secured.



If the interlocking has been bypassed for any reason (which is sometimes required)* then some other means of proving the points are secured for the intended direction of movement is required - clamping them is one such method but not necessarily the only one. Either this alternative method has suffered a wrong-side failure, or there has been a wrong-side failure of some element of the planning or implementation process.



A wrong-side failure a category of failure, rather than a specific failure mode. Any failure that results in a dangerous or potentially dangerous condition is a wrong-side failure, a right-side failure is one where the failure results in a safe condition (for example a signal showing red when it cannot be proved if the route ahead is clear, even if it is, is a right-side failure).



*My guess is that a modification may have been needed in this case because the interlocking would not normally allow these points to move and/or allow movement over them with a train standing on the adjacent line for reasons of flank protection.

Roger Ford's ePreview of Modern Railways' "Informed Sources" makes interesting reading on this subject:

"For the signaller at Wimbledon to be able to set the route and the driver to receive the green signal, the detection on those points must have been either by-passed, and isolated from the interlocking, or the relevant relay false-fed.

"Either way, this would have represented a change to the interlocking and should have been identified by Level 1 (Principles) testing before being put into use.

"Long before the blockade started signalling informed sources were expressing concern about the time in the schedule allowed for testing and at T-12 the possession footprint was increased. In part this explained the extension of the blockade to include platform 10.

"Level 1 testing is complex, draws on a small pool of suitably licenced engineers and technicians – which makes it expensive – and it is also time-consuming. Note the RAIB reference to the checking and testing procedures ‘applicable to the modification’.

"So now we wait for the RAIB report, and let us hope that the inquiry proceeds with some urgency. Meanwhile there seem to be two schools of thought on the incident.

"There are those, like me and the signal engineers I talk to, who see it as a fundamental flaw which could have led to another ‘Clapham’. But chatting to a senior and highly respected railwayman recently I explained the incident and his response was ‘the points should have been clipped’.
Well yes, that would indeed have stopped the collision, but the first line of safety would still have been breached."

 

[Taunton]

All this stuff about detection failures seems to pass by a more straightforward question, which is how the points even got reversed in the first place - especially with the barrier train standing on the points at the other end of the crossover.

 

[spark001uk]

There was a whisper that the stretcher bars weren't done up, whether there's any truth in it remains to be seen. So I'm guessing if that were the case that could've left the blades flapping around in the breeze then? (feel free to correct me if I'm wrong!)

 

[Emblematic]

All this stuff about detection failures seems to pass by a more straightforward question, which is how the points even got reversed in the first place - especially with the barrier train standing on the points at the other end of the crossover.

Points machines fail and points get damaged all the time. The points should not have been set in conflict (or have been damaged) but that's a another matter, the safety failure is that the signaller and driver were given indications that the route was set correctly and clear. That should never happen, detection should always prevent it, and that will be a most interesting part of the final report.
If the points were indeed not fully connected or clamped and locked, that's an additional major failure, as it could have caused the points to move under the train. The key question is what happened to the testing and safety management, that allowed the track and signalling in this state to enter passenger service.

 

[Marklund]

Is there a pair of switches within the point motor housing that detect which way the point is set for?

Different machines have different ways of detecting the lye of the points.

Clamp locks through fixed and adjustable cams operating micro switches.

The lock body bolted on to the fixed rails house the micro switches.

Points motors of various types through rods connected to copper contacts

HW Style machine pictured. The 4 contacts at the bottom are the detection contacts.

HPSS through LVDT (Linear Variable Distance Transformers) connected to the rail, and electrically connected to the ECU.

The motor position itself isn't detected. All are set to tight tolerances.

All this stuff about detection failures seems to pass by a more straightforward question, which is how the points even got reversed in the first place - especially with the barrier train standing on the points at the other end of the crossover.

Quite. The track circuit over the B/C/D whatever other end should have locked the points moving in the interlocking.

"There are those, like me and the signal engineers I talk to, who see it as a fundamental flaw which could have led to another ‘Clapham’. But chatting to a senior and highly respected railwayman recently I explained the incident and his response was ‘the points should have been clipped’.
Well yes, that would indeed have stopped the collision, but the first line of safety would still have been breached."

Wow. That's, err, a worrying statement from a "highly respected railwayman".

 

[Bald Rick]

Not just a wrong side failure, but also not a Single Point Failure.

The whole purpose of detection is to check that the points are physically as called. Even if they were run through initially by the inbound train, they were both set wrong for the called movement, and then wrongly detected.

It will be interesting to see what the RAIB say about them not being physically clamped. When was that given up?

Big caveat that this is my guess, but it looks to me pretty straightforward. The points can't have been detected in the interlocking.

If the points detection was temporarily strapped out (used to be done quite regularly for short periods during works, not so much these days), the interlocking would be ignorant and agnostic as to where they lay. In such cases, the points must be confirmed in the correct position, clipped, scotched and padlocked. But if they weren't...

The inbound train then runs through them, leaves them split, then derails on the way out.

 

[spark001uk]

...HPSS through LVDT (Linear Variable Distance Transformers)...

Differential. That being the differential of the currents induced in the two secondary windings, depending on the linear position of the core within them.

 

[Marklund]

Differential. That being the differential of the currents induced in the two secondary windings, depending on the linear position of the core within them.

Indeed

 

[2HAP]

RAIB interim report published.

https://www.gov.uk/government/uploa...data/file/669469/IR022017_171220_Waterloo.pdf

At around 05:42 hrs on Tuesday 15 August 2017, a passenger train leaving
London Waterloo station and travelling at about 13 mph (21 km/h), collided
with a stationary engineering train. There were no injuries, but both trains were
damaged and there was serious disruption to train services.

The collision occurred because a set of points was not in the correct position and
directed the passenger train away from its intended route. When the train passed
over them, the points were in this position because of a temporary modification
to the points control system, which also caused the train driver and signaller to
receive indications that the points were correctly set.

 

[AndyPJG]

Big caveat that this is my guess, but it looks to me pretty straightforward. The points can't have been detected in the interlocking.

If the points detection was temporarily strapped out (used to be done quite regularly for short periods during works, not so much these days), the interlocking would be ignorant and agnostic as to where they lay. In such cases, the points must be confirmed in the correct position, clipped, scotched and padlocked. But if they weren't...

The inbound train then runs through them, leaves them split, then derails on the way out.

Your instincts were spot on, reading the Interim Report. Go to the top of the class!

 

[Railman]

Unfortunately, it is exactly as we suspected, the points "by passed" in the interlocking and "run through" by the inbound train, then left half and half to derail the outgoing train. could have been a lot worse and if the engineering train had not been there as a barrier. Interesting that the "Testers" thought clips had been fitted to ALL ends, but had not been fitted????? a very simple, crude but effective, means of prevention and back up for such eventualities.

 

[2HAP]

If there were three ends to be clipped, and three sets of clips to clip them with, why was the fact that there were two sets of clips left over not recognized?

 

[Chris M]

If there were three ends to be clipped, and three sets of clips to clip them with, why was the fact that there were two sets of clips left over not recognized?

We know there were three ends planned to be clipped. We don't know whether there were three sets of clips provided.
If they were provided, it could be that they were used to clip two different point ends that weren't in the plan to be clipped (whether they needed to be clipped or not is possible either way).

We equally don't know whether they were recorded as clipped, even though they weren't (this is what happened at Cardiff).

 

[rebmcr]

We know there were three ends planned to be clipped. We don't know whether there were three sets of clips provided.
If they were provided, it could be that they were used to clip two different point ends that weren't in the plan to be clipped (whether they needed to be clipped or not is possible either way).

We equally don't know whether they were recorded as clipped, even though they weren't (this is what happened at Cardiff).

The type of point machinery described in the document makes me think that the clipping is not done by a separate device in this case — perhaps someone conversant in S&C or PWay could elaborate on what that should entail?

 

[Signal Head]

Roger Ford's ePreview of Modern Railways' "Informed Sources" makes interesting reading on this subject:

...
"Long before the blockade started signalling informed sources were expressing concern about the time in the schedule allowed for testing and at T-12 the possession footprint was increased. In part this explained the extension of the blockade to include platform 10."

There were those of us who were very surprised to hear that it was going ahead, since there were (allegedly - my lawyer says!) independent reviews of the design, and commissioning strategy which advised that the job simply did not fit within the blockade, and should be reprogrammed. Part of the problem being that the major part of the design was done as a single stage, with little or no thought to the possession availability. By the time this was acknowledged at a suitably senior level, there was then insufficient time remaining to split the design up into smaller stages, without risking failing to commission any of it anyway.

After the incident, the word on the street was that each time the advice to cancel/postpone went up a level (of management) , more and more of the reasons for this advice were ignored or removed, it being seen as politically unacceptable not to do the work at the advertised time.

 

[Railman]

Well the report is out and as suspected the signalling circuits had been "interfered with" the correct and authorised work as part of the official testing proceedure, but with additional unauthorised connections that "by passed" the detection of the point end involved.
Even with this dangerous situation in the circuits, a simple "point clip" fitted to all points affected by the work would have prevented the accident, but apparently this was never applied.
It seeems to read that the additional unauthorised strap was fitted by "someone", but although that individual was believed to be part of the testing team, he/she thinks a member of the installation staff fitted it??
A very lucky close call, and possibly a "wake up" call to the industry.