Braking issue on Caledonian Sleeper causes train to "run away" at Edinburgh

[ComUtoR]

but the Stonegate overrun was quite different in that the train's brakes were working fine but the sanders were empty.

Hence me saying 'similar' in that the train couldn't stop. Stonegate was shocking and caused more than a few ripples internally. Caused by human error. Potential to cause major harm (sheer luck it didn't tbh) and a modern train failing to stop when required. It's also worth noting that during the investigation for the Stonegate incident. RBTs were also brought up. The Driver was exonerated because they followed procedure and carried out RBTs at the critical moment where they actually needed to stop, they couldn't.

 

[ac6000cw]

My own personal feelings on this matter is that this stock's use of Delner autocouplers with built-in air connections may have been confusing to the shunter, as the instructions for coupling and brake-testing these trains will be new and different to all other loco-hauled stock. These couplers will use star valves or similar that are effectively automatic in operation (they are held closed by the air pressure in the pipe and are opened when pressed together during coupling) and, as such, I'm wondering if the air cock on the loco bufferbeam controlling the supply to the coupler head had been left open. This may have confused the shunter who will have been used to coupling trains and opening the air cocks prior to departure and tricked him/her into accidentally isolating the supply.

I was thinking along similar lines (*assuming that the incident was caused by human error, and not mechanical failure*) i.e. someone assumed that just pushing the couplers together did all that was necessary in terms of brake system connections, whereas it was actually still necessary to check that the brake pipe cocks were open at the loco end of the flexible pipes. But if that *was* the case, why wasn't that problem picked up when the brake continuity check was performed before departure - finding that sort of issue is the whole point of doing it, and why it's been a fixture in the rulebook since trains were first equipped with continuous brakes (a very long time ago).

I wonder a bit, since operation of conventional loco-hauled passenger trains is now relatively rare (almost everything passenger is now MU or fixed-formation push-pull) if there is a certain 'loss of institutional knowledge' happening slowly re. the importance of some of the traditional safety checks when locos are being coupled to trains. (Yes, I know this is everyday stuff in the freight sector, but that is now separate from the passenger operations, and equally the freight people don't get to deal with auto-couplers much either, day-to-day).

There have been some general comments from the RAIB recently about the 'loss of institutional knowledge' situation i.e. people being aware of rules and proceedures, but not understanding *why* they are important and hence tending to forget about them.

 

[O L Leigh]

Hence me saying 'similar' in that the train couldn't stop.

Noted. I just wanted to clarify for the benefit of @syorksdeano that this is not the same sort of incident in that, while the outcome was similar, the causes were not.

 

[O L Leigh]

I was thinking along similar lines (*assuming that the incident was caused by human error, and not mechanical failure*) i.e. someone assumed that just pushing the couplers together did all that was necessary in terms of brake system connections, whereas it was actually still necessary to check that the brake pipe cocks were open at the loco end of the flexible pipes. But if that *was* the case, why wasn't that problem picked up when the brake continuity check was performed before departure - finding that sort of issue is the whole point of doing it, and why it's been a fixture in the rulebook since trains were first equipped with continuous brakes (a very long time ago).

I have said that I will not speculate further on this but that the information so far seems to strongly suggest a procedural error rather than a technical fault. Therefore I shall be keeping my own counsel on this.

I wonder a bit, since operation of conventional loco-hauled passenger trains is now relatively rare (almost everything passenger is now MU or fixed-formation push-pull) if there is a certain 'loss of institutional knowledge' happening slowly re. the importance of some of the traditional safety checks when locos are being coupled to trains. (Yes, I know this is everyday stuff in the freight sector, but that is now separate from the passenger operations, and equally the freight people don't get to deal with auto-couplers much either, day-to-day).

I would be very surprised if the shunters at Carstairs are unfamiliar with coupling and uncoupling locos, and believe that they would be working for one or other of the freight or infrastructure operators. This is not a once-in-a-blue-moon operation for them but rather their bread and butter. They will have been trained on how to deal with the Cally Sleeper and on the Mk5 stock that it uses, including the use of the Delner autocoupler and the procedures for brake-testing the train. If done correctly all should be fine and dandy, just as it would be for any other train of wagons or coaches. It would seem that something went wrong that morning to have affected the train's brakes, and this is what the RAIB will be looking into.

 

[Bromley boy]

I'm afraid that failsafe electronic interloccking of brakes to prevent train moving if the braking system is incorrectly configured or inoperable is manifestly necessary. If its found to be human error in the first instance, say in connecting pipes or cables (all humans make mistakes) or in maintenance then one must look at the manufacturer, its employees , its safety case and regulators who approved the DESIGN, TESTING and IMPLEMENTATION of the failsafe system, as its clearly NOT failsafe. Caledonian sleeper operatonal personnnel (or whoever they subcontract to) training should be examined, but that is a side issue, with braking, no one individual person on the coalface should have to be solely responsible.

If the stock is back in use there is clearly no underlying problem with the design.

Whilever you have a power unit capable of travelling independently of what it is pulling you will have separate braking systems that can be isolated from one another.

The key is ensuring these isolations are only made where appropriate!

Some very OTT comments on this thread.

I can't find your first incident in the archive,

If it’s the one I’m thinking of it was a coupling incident where a unit was erroneously left in “forward” with brakes “off” when the driver left the cab to close the door on the unit he had just detached from. The gradient caused it to roll a few feet with nobody in the cab.

A human error which was self limiting since the DSD/vigilance would have dumped the brakes after a few seconds even if the error hadn’t been noticed.

Not sure if it ever reached the RAIB but some contacts of mine who work there have stated it was reportedly internally. AIUI changes were made to the coupling/uncoupling procedure as a result.

 

[ComUtoR]

If it’s the one I’m thinking of it was a coupling incident where a unit was erroneously left in “forward” with brakes “off” when the driver left the cab to close the door on the unit he had just detached from. The gradient caused it to roll a few feet with nobody in the cab.

That's the one

Not sure if it ever reached the RAIB but some contacts of mine who work there have stated it was reportedly internally.

I was reading it a few weeks ago but for the life of me I can't find the bloody thing.

 

[Antman]

If the stock is back in use there is clearly no underlying problem with the design.

Not necessarily true. There may be a problem with the design which allows a mistake in operation and this happens. Just because it's in service doesn't mean that there's no problem. There are a myriad of reasons/risk assessments/RAG ratings which will have been quickly done to work out what happened. The conclusion to continue to keep Mk5s in revenue earning service does not mean there isn't a problem, it may well be that there is, but they have put in place extra steps to manage it out (but the risk remains).

Heathrow Express pulled the entire 332 fleet when they found a fault. Others decide to deal with matters and at upgrade at an overhaul or quicker. The cynic in me, and I have no grounds for this, is that the Serco management would not be best pleased if their new flagship had to be pulled from service for safety reasons. So they'd immediately offer up all sorts of workarounds to avoid it....

[I still feel sorry for whomever has made a mistake... given the scale of the project, design and cost, it would be reasonable to expect this not to be able to happen]

 

[aleggatta]

Not quite the same but Southeastern had a runaway in 2016 (I think)

Also similar (were a train couldn't stop) Again on Southeastern. The Stonegate incident.

That's the one

I think I remember hearing about something on a Thameslink unit (maybe wrong about the operator, but sure it was an Electrostar) that had a pass comm activation, the driver left brakes off and left the cab (but brakes being held on by the pass comm) reset the alarm, Driver proceeded to walk back to the cab, with his train starting to overtake him... I was told that he had a little run down the platform and got back in the cab (I think it was a 4/8 in a 12 platform)

 

[Bromley boy]

Not necessarily true. There may be a problem with the design which allows a mistake in operation and this happens. Just because it's in service doesn't mean that there's no problem. There are a myriad of reasons/risk assessments/RAG ratings which will have been quickly done to work out what happened. The conclusion to continue to keep Mk5s in revenue earning service does not mean there isn't a problem, it may well be that there is, but they have put in place extra steps to manage it out (but the risk remains).

It might be that the “risk” is a procedural irregularity in the coupling process that could be made when attaching any loco hauled stock. An operation that is undertaken hundreds of times per day up and down the country without incident.

It’s important to keep a sense of perspective.

 

[O L Leigh]

Not necessarily true. There may be a problem with the design which allows a mistake in operation and this happens. Just because it's in service doesn't mean that there's no problem. There are a myriad of reasons/risk assessments/RAG ratings which will have been quickly done to work out what happened. The conclusion to continue to keep Mk5s in revenue earning service does not mean there isn't a problem, it may well be that there is, but they have put in place extra steps to manage it out (but the risk remains).

As @Bromley boy says, you are losing your sense of perspective. Trains are not designed to be operated by 5 year olds but by highly trained professionals. They already have a lot of failsafe systems built in but, as has been explained to you more than once already, these also need to be capable of being overridden in order to deal with a fault.

There is no dispute over the potential severity of this incident, but pulling the entire fleet as the consequence of what will almost certainly be a procedural failing is a massive overreaction. I have no doubt that the RAIB inspectors will have already visited the site, inspected the train, interviewed the traincrew and the ground staff at Carstairs and understood the primary cause for the brake malfunction that caused this train to overshoot Waverley. If Cally Sleeper are still being permitted to operate the Mk5 + Cl92 fleet as a whole and this particular loco and coaches combination then we can be happy that there are no immediate problems with the design, build and operation of the stock. Therefore the causal factors must be somewhere else in the training of the staff, the way that their competency is assessed or hidden in the murky world of human factors.

Heathrow Express pulled the entire 332 fleet when they found a fault. Others decide to deal with matters and at upgrade at an overhaul or quicker. The cynic in me, and I have no grounds for this, is that the Serco management would not be best pleased if their new flagship had to be pulled from service for safety reasons. So they'd immediately offer up all sorts of workarounds to avoid it....

Yes they did, but that is because these units WERE ACTUALLY FAULTY, which the Cally Sleeper appears not to be. I agree that it would be a bloody nose for Serco if these trains had to be withdrawn from service, but you a giving too much credence to your cynical side. If there was a technical fault that affected the safety of these trains and they required modification in order to continue in service then this would be done. Such withdrawals have happened before and will continue to happen in the future. But the fact that these trains have not been withdrawn should be sufficient evidence for you that no technical issues have been identified.

[I still feel sorry for whomever has made a mistake... given the scale of the project, design and cost, it would be reasonable to expect this not to be able to happen]

While outwardly sympathetic, this statement simply serves to underline your lack of understanding of this incident, railway technical and operational requirements and human factors. The railways are rightly intolerant of mistakes, so training, assessment, staff fitness for duty and so on are high priorities. However, just every now and then a mistake can and does happen. Failsafes are already built in, but we're not here to operate a child-proofed network.

 

[Bassman]

Not necessarily true. There may be a problem with the design which allows a mistake in operation and this happens. Just because it's in service doesn't mean that there's no problem. There are a myriad of reasons/risk assessments/RAG ratings which will have been quickly done to work out what happened. The conclusion to continue to keep Mk5s in revenue earning service does not mean there isn't a problem, it may well be that there is, but they have put in place extra steps to manage it out (but the risk remains).

Heathrow Express pulled the entire 332 fleet when they found a fault. Others decide to deal with matters and at upgrade at an overhaul or quicker. The cynic in me, and I have no grounds for this, is that the Serco management would not be best pleased if their new flagship had to be pulled from service for safety reasons. So they'd immediately offer up all sorts of workarounds to avoid it....

[I still feel sorry for whomever has made a mistake... given the scale of the project, design and cost, it would be reasonable to expect this not to be able to happen]

I agree with this. I do not trust that just because the problem is understood, it is presumed to be solved. I am sure those of you in the industry know mistakes or problems arise from technical failures or human ones. They both have a probability (and hence certainty) of failing at some point. Protocols and technical solutions rely then on double checks to minimise the probability of something slipping through. This sleeper incident has happened out of relatively few occasions of this particular train being split, so that indicates a vulnerability with a potential high disasterous outcome. It needs a certain assurance (through RAIB ?) of an additional protocol and/or technical double check.
Of interest:
Boeing maintains that 737 Max disasters were a complex product of probability of events. The view from others is that their new system of stabilisation of the 737 Max to level it in flight depends on only one sensor, which when failed caused the plane to push nose down. Boeing 737Max have already flown massively larger numbers of times and more hours, before the probability of failure kicked in, and then in disasterous ways. The solution looks like quietly to be installing two sensors. Corporate culture and economics are not always open to being respondent to risk.

 

[bahnause]

It might be that the “risk” is a procedural irregularity in the coupling process that could be made when attaching any loco hauled stock. An operation that is undertaken hundreds of times per day up and down the country without incident.

Thy typical outcome of a irregularity in the coupling process is usually being unable to release the brakes. Any other outcome is very unlikely. I'm curious about the results of the investigation.

 

[O L Leigh]

I do not trust that just because the problem is understood, it is presumed to be solved.

Pardon me, but where has anyone claimed that the problem has been solved? I certainly haven't said anything of the sort. What I said was that the problem is almost certainly not a technical one due to the design or construction of the Mk5 coaches.

I am sure those of you in the industry know mistakes or problems arise from technical failures or human ones. They both have a probability (and hence certainty) of failing at some point.

I'd like to claim that railstaff are more than aware of this. The number of times that trains are coupled and uncoupled every single day and the rarity of incidents like this should give you reassurance that the existing systems work adequately well. That is not to abdicate responsibility for ensuring that the job is done correctly, but the procedures are there to be followed and, if followed correctly, there should be no incidents. To add an additional layer on top of the existing procedures would be overkill.

Where things are new it is with the use of autocouplers with loco-hauled stock, and this (together with the lack of withdrawal of these coaches) persuades me that this incident was the result of a procedural failing. Either the procedure itself is not robust or it was not followed correctly or there were human factors involved (e.g. over-reliance on the automatic operation of the "star valve" air connectors, overfamiliarity with the coupling and brake-testing process or maybe a case of getting the position of the air cocks muddled up). Whatever the cause, the RAIB will be letting Cally Sleeper know so that remedial action can be taken.

Parallels with the 737Max are not helpful, nor particularly pertinent.

 

[Sleeperwaking]

I agree with this. I do not trust that just because the problem is understood, it is presumed to be solved.

The post above yours by O L Leigh is a decent summary. Either way, if the rumours are correct and it was an accidentally isolated brake valve (human / operator error), then the mitigating action (additional instruction to staff to make damn well sure it's not isolated when they finish all activities) could be implemented pretty much immediately with an emergency brief / instruction, and would close the immediate risk. If Serco want to implement a technical solution as well, then that could be done in parallel - right now, (assuming human error was the cause) the risk is minimal as everyone will be double checking everything as a result of the near miss. The key thing is ensuring that in X months time when everyone has relaxed again, the procedures / processes are robust enough to avert this error re-occurring.

 

[Antman]

I wonder how many of you have stood there with a crying mother, telling a court about the death of her baby, three feet in front of you, and pointing at you, and her crying uncontrollably (entirely reasonably) that it was you, your company, that killed him. That he didn’t have to die, that your systems weren’t failsafe. That he died because you chose to take the risks. To suit yourself.

I have. It’s not an experience I wish anyone would have to repeat. Least of all the poor mother.

In that case, We had systems that were foolproof, that meant people couldn’t get it wrong. They were tested. We found risks and problems (multiple parties involved in setting up our systems) and we put rules, mandatory requirements and prohibitions on actions on place. Genuinely mistakes here would kill. Not could. Would. The foolproof systems didn’t work due to human error (someone not following those rules). A baby died. Two young parents lost their son.

Sound familiar?

And yes, I have sat and debated (with litigators and QCs and insurers and Comms and investors) what happens if the board gets charged with manslaughter. Who will they blame? More than once.

It is never the Execs... it’s the person on the ground. And they will serve up those people on a plate.

I’d agree everyone is now being more vigilant. But On the technical solution, it’s brand new stock, put in a failsafe ASAP. Much of the CAF stuff hasn’t been put into service yet. Those of us who don’t do railway engineering are relatively amazed that it doesn’t already have it ... given potential harm and the cost of the assets, let alone the human cost of it goes wrong.

 

[edwin_m]

I agree with this. I do not trust that just because the problem is understood, it is presumed to be solved. I am sure those of you in the industry know mistakes or problems arise from technical failures or human ones. They both have a probability (and hence certainty) of failing at some point. Protocols and technical solutions rely then on double checks to minimise the probability of something slipping through. This sleeper incident has happened out of relatively few occasions of this particular train being split, so that indicates a vulnerability with a potential high disasterous outcome. It needs a certain assurance (through RAIB ?) of an additional protocol and/or technical double check.

Isn't the brake continuity test the double check to ensure that the brakes have been connected up correctly and are continuous through the train? Assuming it is a situation the contlinulty test should pick up, then for this situation to occur then the brake must have not been connected correctly, and the continuity test must not have been done properly. The running brake test may provide another mitigation.

 

[O L Leigh]

But On the technical solution, it’s brand new stock, put in a failsafe ASAP. Much of the CAF stuff hasn’t been put into service yet. Those of us who don’t do railway engineering are relatively amazed that it doesn’t already have it ... given potential harm and the cost of the assets, let alone the human cost of it goes wrong.

There is nothing that I can do to allay your amazement, but the solution to this problem is going to be procedural not technical for reasons that I have endlessly explained.

I'm sorry that you've had bad experiences when thing have gone wrong, but your experience must show why sometimes a risk cannot be mitigated by technical means alone. Proper training, assessment of competency and correct procedure gives the required level of safety when a technical solution either cannot be implemented or would not provide the necessary protection. If you're used to dealing with incidents you may be more familiar than most here with human factors and non-technical skills.

 

[InOban]

And BTW, having a double check has been found to increase the risk because each person will assume that the other has or will check it. That's why the pilot walks round the plane before they board.

 

[Ben Glasgow]

Question: So folk have been saying that the TM was the one to activate the emergency brakes in one coach which helped to slow the train down. Was that the one brake for that carriage or would it have activated all braking in the subsequent carriages? Would the isolation been exactly where the engine couple to the first carriage?

 

[Robertj21a]

Isn't the brake continuity test the double check to ensure that the brakes have been connected up correctly and are continuous through the train? Assuming it is a situation the contlinulty test should pick up, then for this situation to occur then the brake must have not been connected correctly, and the continuity test must not have been done properly. The running brake test may provide another mitigation.

This ^^^^^

I also don't understand. I thought it became a fail safe system because of these checks, but if both aren't done properly then we really are in worrying territory.

 

[HSTEd]

There is nothing that I can do to allay your amazement, but the solution to this problem is going to be procedural not technical for reasons that I have endlessly explained.

Because the company decided to procure brand new stock which had design flaws that made it possible?
It is very difficult to understand why you would ever have a system that allowed vehicles to be coupled without brake continuity - certainly without lighting up warning lamps on the driver's desk like a christmas tree.

Despite what people say, procuring this self contained rolling stock fleet (and it is self contained, it's not even fitted with standard couplers!) without EP/ECP brakes was a mad decision, and it is only by good fortune that we aren't seeing pictures of the fire brigade and police picking through debris in the middle of Edinburgh station.

I'm sorry that you've had bad experiences when thing have gone wrong, but your experience must show why sometimes a risk cannot be mitigated by technical means alone. Proper training, assessment of competency and correct procedure gives the required level of safety when a technical solution either cannot be implemented or would not provide the necessary protection. If you're used to dealing with incidents you may be more familiar than most here with human factors and non-technical skills.

There is a reason that the hierarchy used in most industries to justify SFIRP puts adminstrative controls at the very bottom of list of mitigating steps.
Because they are by far the least reliable controls available.

And whatever adminstrative controls were in place to prevent this eventuality have clearly failed miserably, at which point the entire system is suspect.

Electronic brake continuity and self testing would probably have avoided this incident entirely.

This is not a minor operating accident, this is a catastrophic incident that very nearly became a catastrophic accident.

EDIT:

I will await the RAIB report with interest...... it sounds like it is going to be quite an interesting read.

 

[Highlandspring]

This thread is astonishing. I’ve never read so much drivel on the internet in my life.

 

[edwin_m]

This ^^^^^

I also don't understand. I thought it became a fail safe system because of these checks, but if both aren't done properly then we really are in worrying territory.

If the couplers and brakes are connected properly through the train and the loco is supplying air then the brakes should work and be failsafe in the sense that they will apply automatically if the train is parted or the train pipe vented for any other reason. In a traditional continuous brake, the continuity test is a quick way of checking that those things have been done. It won't detect situations such as too many brakes being isolated, but isolation is a specific action by someone who should be aware of the consequences.

The running brake test was introduced (as mentioned above) after incidents of brakes freezing up, but applying the brake soon after starting away also proves the continuity of the train pipe and that at least a reasonable number of the brakes are functioning.

So there are in effect two checks that should detect if the train has set out without effective brakes, after which it should be failsafe in any credible situation.

 

[47271]

This thread is astonishing. I’ve never read so much drivel on the internet in my life.

Oh, I don't know, the main Caledonian Sleeper thread can give it a run for its money. The same few posters were about as upset about breakfast arriving in a cardboard box or haggis running out at Crewe as they are now about this incident.

 

[Chrism20]

This thread is astonishing. I’ve never read so much drivel on the internet in my life.

You’re not alone. It’s giving twitter a run for its money.

 

[Esker-pades]

This thread is astonishing. I’ve never read so much drivel on the internet in my life.

Try reading the EU Referendum threads....

 

[ainsworth74]

That's enough thank you. Whilst some people maybe getting slightly carried away we do ask that if there are posts which you feel break the Forum Rules or otherwise cause concern that you report them and do not reply (replying makes more work for us!). I'm happy to let things slide prior to this posting be we do need to get back on topic after this.

 

[O L Leigh]

The problem is that the air brake system is technical (although not beyond the ken of most readers here) but that no-one has bothered to read up on it's operation. Therefore they are labouring under a misapprehension about what happened, about why it may be possible to successfully complete both static and running brake tests and why it took until almost journey's end for the problem to have manifested itself to the driver. To them, the train ran the entire leg from Carstairs unbraked, but if this was really true the driver would have been very aware of it. Some people believe that this is due to a design defect on the train itself, but in reality it is far more likely that it was an operational error that could have affected any two-pipe train.

 

[GB]

Its entirely possible that the loco was attached to the train, brake continuity test carried out successfully, then maybe the shunter (or whoever) later found a small air leak between the loco and first vehicle (because the brake pipes had been connected but slightly ajar) went in to rectify, closed the cocks, reconnected the pipes then forgot to open the cocks again. This is all speculation but I very much doubt it was a stock fault.

 

[modernrail]

It might be that the “risk” is a procedural irregularity in the coupling process that could be made when attaching any loco hauled stock. An operation that is undertaken hundreds of times per day up and down the country without incident.

It’s important to keep a sense of perspective.

One of the elements of perspective for me here is that this is new stock and in UK terms rare loco hauled passenger carrying stock that is split. I will be h

Did you not see @ainsworth74's reply to your previous post, clarifying your misunderstanding about the role of RAIB?

I'll take the rest of the post with a pinch of salt!

I did. That is my point.

Anyway I am sure these things are totally fine and safe and meant to happen all the time just to get us a little bit excited and in no way was this a lucky escape at all.

What I can say is I am done with the Sleeper for now. It has become a shambles. I very much hope they sort it all out but there is an awful lot to sort out and there is no way I am handing over £200 for:
- a fantasy check in time;
- on a new train full of niggles,
- on which the staff are so unhappy they have voted to strike;
- with a cancellation rate so regular I stand a good chance of having a really bad night when I could just get an evening train and hotel if I really want to avoid unnecessary flying (which I do because I want to avoid chucking carbon into the air willy nilly);
- on a train on which the brakes don't make the train stop, nobody knows that until they try to make the train stop and that is all fine because it is not a technical error it is just some other problem that is to he expected from time to time.

Maybe OBB need to take this one over...I am as intrigued as to how they have broken even as I am as to what the RAIB report will set out.

Most of all, I am glad this ended without serious incident.