Chiltern parliamentary - RAIB investigation

[westcoaster]

Not wishing to be inflammatory, but perhaps I should ask what you understand by a flashing Isolation/Fault light if not that the system is not working.

O L Leigh

We had it drilled into us about this, if it's flashing it's not moving. As you can not distinguish between an isolation and a fault you go worst case and say it's isolated. We have this problem at kent house in south London but only with 8 car trains tuning back, I've only had it once flashing, tried shutting the desk down which did not work, so called the signaller to draw forward two feet, hey presto the fault cleared and of I went.

 

[Muzer]

Sounds to me like the driver should have to explicitly press an override button before being able to set off with a TPWS light flashing. Alternatively (or in addition), something more noticeable like an audible warning should be present. I'm sure it's quite easy to quickly look at a TPWS light when doing a check, see it in the "off" state of the blinking cycle and assume everything is fine, as others have said.

In addition, is there anything to prevent the TPWS bulb/LED from malfunctioning? Surely it would be better as a positive indication (ie solid yellow when TPWS is working)?


Finally, I would certainly have thought it should be possible to "reboot" the TPWS system alone, without having to wait for ATP (in this case) to come back up too? Surely this would be a good idea for timing purposes if nothing else.

 

[GB]

Sounds to me like the driver should have to explicitly press an override button before being able to set off with a TPWS light flashing. Alternatively (or in addition), something more noticeable like an audible warning should be present. I'm sure it's quite easy to quickly look at a TPWS light when doing a check, see it in the "off" state of the blinking cycle and assume everything is fine, as others have said.

Or maybe spend a few seconds actually looking at the panel when setting up the cab rather than a passing glance?

 

[Muzer]

Yes, but still - for such a system deemed safety-critical not to have any interlocking with the traction power is pretty bad. Of course drivers should spend a few seconds looking, but mistakes can (and obviously do) happen. Should we just get rid of door interlocking, since the drivers should check the "doors closed" indicator before departing from each station so it should never be a problem?

 

[bystander]

I certainly have, I thought it was well known that the flashing fault/isolate light indicates the system is isolated and needs resetting? Part of setting up the desk is checking the AWS/TPWS and if any of the tpws lights remain on after cancelling the AWS you would certainly look into it before departing.

It's a common problem at kings x platforms 9,10&11 with single 313s as the country end is right on the grid. That is why 313s stop half a coach short of the stops at kings x.

Yep I've most definitely been told that on numerous occasions; and prior to cancelling the AWS on setting up the cab it is an inviolable part of my routine to make sure I'm looking at the TPWS console as I do so.

At Paddington, it can arise due to the cab lying over the outbound OSS grids for the starter signal - in which case once the signal clears you key off and on and the fault clears. However, with two-cars units, it can be that the country end cab is left sitting over the INBOUND sensors for the buffer stops - which are always live. So in that situation you do physically have to move the train before dealing with the fault light.

Regards,

B

 

[O L Leigh]

Yes, but still - for such a system deemed safety-critical not to have any interlocking with the traction power is pretty bad. Of course drivers should spend a few seconds looking, but mistakes can (and obviously do) happen. Should we just get rid of door interlocking, since the drivers should check the "doors closed" indicator before departing from each station so it should never be a problem?

You think a lot but seem not to have thought quite far enough.

If you "key in" to a train with the cab over the TPWS grids and it prevents you from getting the brakes off or taking power, how can you drive the train off the grids so that you can reset the system? All you can do is isolate the system fully to allow for a brake release, etc, but that would render the entire system out of use unless reset by a fitter.

"Keying in" with the cab over the grids is not a fault that requires the full isolation of the system. Likewise, it is still possible (and permitted by the rules) for a train to operate in normal service with the TPWS isolated on routes not equipped with TPWS. But a full isolation of the TPWS also fully isolates the AWS, and that means game over.

O L Leigh

 

[Muzer]

Isolate, drive off, THEN reset. My point is that it should require active effort on the part of the driver in order to prevent it being overlooked. Admittedly, as you say, not quite as straightforward as door interlocking, so perhaps not the best example - but my point was just that a small flashing light, no matter how good driver training is and how vigilant the drivers, is (in my opinion) too easy to miss to protect a system deemed safety-critical.

As I stated in my other post, an alternative to the interlocking could just be some sort of audible warning. I would expect it would have prevented the TPWS from being disabled during this incident (though obviously we don't know that for sure until the report comes out), and it would certainly make the flashing light significantly more noticeable without having to have the whole interlocking thing.

Finally, if isolating the TPWS also isolates the AWS, then this isn't the form of isolation I had in mind - I'm talking about solely isolating the TPWS system, so it would be in exactly the same state (ie not working) as it is when the LED is flashing, but would allow the driver to take power to get off the grid (ie bypassing the interlocking). Please correct me if this is technically impossible, I'm not aware of how the safety systems are actually implemented in the trains. But since the interlocking I'm talking about doesn't currently exist, surely it could be implemented in a way that would allow a bypass switch without also bypassing AWS interlocking.

But yeah, this does seem to be a little overthought - certainly an audible warning would be a lot cheaper and simpler

 

[O L Leigh]

Whatever you think it should do, what it does do is different.

O L Leigh

 

[455driver]

Isolate, drive off, THEN reset.

Once it is isolated it is isolated and needs a fitter to reinstate it.
If it has been isolated then the train has to be taken out of service immediately and go straight to the depot to be repaired.

You seem to think a lot but know very little!

there is a way of temporarily isolating it but it has to be with permission and is a bit of a rigmarole.

 

[dysonsphere]

Well as far as i can see the driver went thru 2 reds or semphores at stop that is what needs explaining. TPWS is an aid not an automatic driver.

 

[PermitToTravel]

Once it is isolated it is isolated and needs a fitter to reinstate it.
If it has been isolated then the train has to be taken out of service immediately and go straight to the depot to be repaired.

You seem to think a lot but know very little!

there is a way of temporarily isolating it but it has to be with permission and is a bit of a rigmarole.

I think Muzer is trying to explain how it should work rather than how it does

 

[A-driver]

Well as far as i can see the driver went thru 2 reds or semphores at stop that is what needs explaining. TPWS is an aid not an automatic driver.

Whilst that is true it is also the case that the second spad would have been prevented by the tpws kicking I'm after the first. There are 3 seperate incidents here and the TPWS being isolated is only one, comparably minor, one. SPADs are always thoroughly investigated regardless of outcome so the industry will find out what caused the spads and ensure that action is taken to prevent a repeat of them.

 

[Tom C]

If it has been isolated then the train has to be taken out of service immediately and go straight to the depot to be repaired.

Not quite!

If you continue to drive from the cab with the equipment isolated then yes, it is forward at reduced speed (or provide a second driver) and out of service at the first suitable location but it does not HAVE to go immediately back to a maintenance depot. A get out of jail card with an 8 or 12 is to get it off the running line (if you can use the other end more the better) and the box the cab in. There are some faults which MUST go to a maintenance depot without delay but units with isolated TPWS or AWS can still stay out so long as the cab is not used.

 

[Muzer]

I think Muzer is trying to explain how it should work rather than how it does

Indeed - perhaps "isolate" was the wrong term to use since it has existing implementation-specific connotations. What I intended to mean by it was "temporarily disable the 'TPWS fault condition' interlocking". Maybe "override" would be a better word. It's a feature that doesn't currently exist because that interlocking doesn't currently exist, so pointing out how it doesn't work like that hardly makes sense because it doesn't exist! Apologies for any confusion, I admit that was partly my fault.


If anyone could politely point out any actual problems with my suggestion, that would be great and I'd learn something - rather than misunderstanding my suggestion and then being rather rude. Thanks.

 

[TDK]

Not wishing to be inflammatory, but perhaps I should ask what you understand by a flashing Isolation/Fault light if not that the system is not working.

O L Leigh

Exactly what I was told, there is a fault with the TPWS because it is over a grid or there is some other sort of fault but I was never told it will self isolate itself. If I get a fault light on setting up the cab I will rectify it obviously. I was always led to believe that a solid yellow light indicates when the TPWS is isolated so therefore maybe it should go to a solid yellow light indicating that it has self isolated itself.
--- old post above --- --- new post below ---

We had it drilled into us about this, if it's flashing it's not moving. As you can not distinguish between an isolation and a fault you go worst case and say it's isolated. We have this problem at kent house in south London but only with 8 car trains tuning back, I've only had it once flashing, tried shutting the desk down which did not work, so called the signaller to draw forward two feet, hey presto the fault cleared and of I went.

You can because if you isolate it you get a solid yellow light and not a flashing one.
--- old post above --- --- new post below ---

You think a lot but seem not to have thought quite far enough.

If you "key in" to a train with the cab over the TPWS grids and it prevents you from getting the brakes off or taking power, how can you drive the train off the grids so that you can reset the system? All you can do is isolate the system fully to allow for a brake release, etc, but that would render the entire system out of use unless reset by a fitter.

"Keying in" with the cab over the grids is not a fault that requires the full isolation of the system. Likewise, it is still possible (and permitted by the rules) for a train to operate in normal service with the TPWS isolated on routes not equipped with TPWS. But a full isolation of the TPWS also fully isolates the AWS, and that means game over.

O L Leigh

Mr. Leigh it shouldn't happen and if the designers knew it would happen it would have been rectified before being distributed so therefore in my eyes it is a fault with the complete system that was overlooked on design.
--- old post above --- --- new post below ---
To put everyone in the picture here. The TPWS is an add on to the AWS system and to isolate it fully you have to isolate the AWS as well. There are 2 ways of temporally isolating the TPWS. One is a train stop over ride, a button you press for the train to be able to pass a TPWS equipped signal at danger with authority and the other is a toggle switch that will temporarily isolate the TPWS without the AWS and this will be used in such circumstances such as TBW and being assisted this can be reset. When this switch is used a solid yellow light will be illuminated until the toggle switch is reset and then the yellow light will be extinguished. If you isolate the AWS then you also isolate the TPWS as the system is linked.

 

[Domh245]

Will any of these features change with the new TPWS V2 I've heard about (as fitted to the 68s, 350/3s & /4s) or is the only change that it talks at you

 

[RPM]

Once it is isolated it is isolated and needs a fitter to reinstate it.
If it has been isolated then the train has to be taken out of service immediately and go straight to the depot to be repaired.

You seem to think a lot but know very little!

there is a way of temporarily isolating it but it has to be with permission and is a bit of a rigmarole.

That's not the case across the industry. We can reinstate safety systems once they've been isolated, as long as it is done in consultation with the signaller and in accordance with the rules.

As a matter of interest, how do you get out of situations where your cab is right on top of the AWS magnet? Do you have to isolate and go out of service? Strikes me that would cause some unnecessary cancellations. Procedure here is to contact signaller, isolate AWS, move a few feet forward, de-isolate AWS. Job done, back in service.

 

[Muzer]

That's not the case across the industry. We can reinstate safety systems once they've been isolated, as long as it is done in consultation with the signaller and in accordance with the rules.

As a matter of interest, how do you get out of situations where your cab is right on top of the AWS magnet? Do you have to isolate and go out of service? Strikes me that would cause some unnecessary cancellations. Procedure here is to contact signaller, isolate AWS, move a few feet forward, de-isolate AWS. Job done, back in service.

You see, this makes sense to me. All I'm asking is why it can't be the same with TPWS?

 

[LowLevel]

That's not the case across the industry. We can reinstate safety systems once they've been isolated, as long as it is done in consultation with the signaller and in accordance with the rules.

As a matter of interest, how do you get out of situations where your cab is right on top of the AWS magnet? Do you have to isolate and go out of service? Strikes me that would cause some unnecessary cancellations. Procedure here is to contact signaller, isolate AWS, move a few feet forward, de-isolate AWS. Job done, back in service.

Whenever I've seen it done as long as it's not a 153 where there's only the 1 receiver it's been a case of jump in the other cab, move a few feet and then go back to the first cab again. We had a stopping position for a joining move with a 3 car set - if a 2 car substituted then it just so happened that the rear cab would be sat on a magnet. After discovering this the hard way I made sure to check each time that it was a 3 car not a 2

 

[Pumbaa]

Will any of these features change with the new TPWS V2 I've heard about (as fitted to the 68s, 350/3s & /4s) or is the only change that it talks at you

It's TPWS Mk4. True specs are linked from below and from the RSSB.

https://www.thalesgroup.com/en/united-kingdom/tpws-mk4-control-solution-2013

 

[TDK]

Whenever I've seen it done as long as it's not a 153 where there's only the 1 receiver it's been a case of jump in the other cab, move a few feet and then go back to the first cab again. We had a stopping position for a joining move with a 3 car set - if a 2 car substituted then it just so happened that the rear cab would be sat on a magnet. After discovering this the hard way I made sure to check each time that it was a 3 car not a 2

Logic would tell me to stop the 2 car train at the 3 car mark or if that is the problem stop short to avoid the walk of shame but then again if the other unit is always there it would be ideal to move the other unit before you attach?

 

[LowLevel]

You actually end up drawing the 3 car unit up to pretty much the 8 car board (it's a station with platform staff) so that when the following 2 car unit arrives, the 5 car lashup is relatively conveniently located for the platform entrances - it departs back to the place it came from and there are short platforms, so you want the front of the train accessible, as it were.

If you were to stop it at the 5 car board, it would occupy the first track circuit in the platform (there are 3, it's a through platform) which stops the signaller from clearing the cat's eyes sub so you basically have to use a bit of nous and there is an unofficial stopping point that everyone uses. Unfortunately as I mentioned it wasn't till a 2 vice 3 appeared that we realised the AWS magnet issue

 

[moggie]

Not being a driver I have no idea what drivers experience. Neither am I about to speculate what the driver of the errant train actually experienced from the TPWS system at the commencement of the journey or during the journey. But it's interesting to read the following from the appropriate RSSB Principles of Operation document and the stated rationale;

GE/RT8075 issue one 3.2.6 Trainborne TPWS equipment in-service monitoring:

3.2.6.5 A TPWS fault shall not be indicated solely as a result of powering up the system while the train is standing over an active TPWS loop.

GE/GN8675 clause G 4.2.6.6 Rationale: Powering up over a TPWS loop can interfere with the system self-test, as the frequency transmitted by the loop may interfere with a test frequency. The self-test routine should be able to accommodate this situation without indicating a TPWS fault; otherwise, TPWS would need to be isolated to enable the brakes to be released so that the train could be moved clear of the loop and re-tested.

So it's clear that contrary to some of the 'claims' on here the scenario has been considered. It also implies that there would be no indication of a fault for the reason given.

However the RAIB preliminary description states that the TPWS system had 'self isolated' and that a flashing indication to this affect was present. This to me implies that a state of transition has unexpectedly occurred.

All very technical and ultimately for those who understand the technicalities involved in the system design and equipment.

Why however the driver has passed two semaphore arms in broad daylight is another question.

 

[O L Leigh]

You see, this makes sense to me. All I'm asking is why it can't be the same with TPWS?

Because things are getting mixed up.

You cannot simply isolate and reinstate the AWS because the isolation requires to use of a switch that is latched into the isolated position and cannot be reset except by a fitter. That's fine if you happen to have one nearby, but even then it is unlikely that an isolation would be granted or even necessary if you found your train "stuck on a magnet". All you'd need to do is "key out" of that cab, change ends and move the train a short distance so that the affected cab is no longer on the magnet.

Dealing with a train stuck on a TPWS grid is even easier because you can still move the train from that cab. There is no need to isolate the TPWS.

Also, for clarity:

The TPWS Train Stop Override and Temporary Isolation Switches are there solely to prevent the TPWS from activating and initiating a brake application when the TPWS receiver passes over a set of live TPWS grids.

A steady TPWS Temporary Isolation light means that the system has been temporarily isolated by the driver. Any other issues relating to the TPWS and it's ability to function would be indicated by a flashing light denoting a fault.

Setting up the cab with the TPWS receiver over a live TPWS grid interferes with the self-test, as indicated by Moggie. However, the information he gives is slightly incorrect (no doubt an issue with the source material). You can get a brake release with a TPWS fault indication. I suspect there is some confusion between a TPWS fault and a TPWS false activation.

To go on:

Whether or not this problem was foreseen at the point where the system was designed and developed or whether it simply came to light later as a result of operational experience is unknown. Arguing it one way or the other is impossible, as is trying to use it to attribute blame.

The fact of the matter is that the problem exists. However, I don't know of a single driver who is unaware of it or does not understand how to deal with it. It really is no biggie.

O L Leigh

 

[455driver]

That's not the case across the industry. We can reinstate safety systems once they've been isolated, as long as it is done in consultation with the signaller and in accordance with the rules.

once ours are isolated thats it, some can be temporarily isolated but by the time somebody has made a decision and given permission the train would be an hour late anyway!

As a matter of interest, how do you get out of situations where your cab is right on top of the AWS magnet? Do you have to isolate and go out of service? Strikes me that would cause some unnecessary cancellations. Procedure here is to contact signaller, isolate AWS, move a few feet forward, de-isolate AWS. Job done, back in service.

Lowlevel has already answered it, key out, go for a walk and move the train from another cab (once permission is given), key out of there, walk back to the original cab, key in and set off.
All nice and quick, not!

Edit, if the TPWS self test fails it will give a flashing yellow light but the train can be driven normally with the light flashing, I have done it quite a few times when the 458 is parked on the 12 car mark at guildford platform 6 which puts the London end cab on top of the grids so when that cab is set up in the morning for the run to Aldershot it will set up the flashing yellow. I used to move the train a few feet and key out but then I got fed up with that and just took the train to Aldershot with it flashing. Notes were put up in the messroom to stop the train between the 12 car marmk and the signal but some drivers insist on parking it on the 12 board coz that is wot it sez to do on the schedule card!

 

[bystander]

That's a very big surprise to me - as in, your being happy to drive a train out there with a fault on a critical safety system. I haven't, ever, done anything other than the minimum move to shift the cab off the grids before rectifying the TPWS. If I get a fault light I couldn't then clear then I wouldn't be going any further. Naively I believed that's what all drivers would have thought.

 

[TDK]

Edit, if the TPWS self test fails it will give a flashing yellow light but the train can be driven normally with the light flashing, I have done it quite a few times when the 458 is parked on the 12 car mark at guildford platform 6 which puts the London end cab on top of the grids so when that cab is set up in the morning for the run to Aldershot it will set up the flashing yellow. I used to move the train a few feet and key out but then I got fed up with that and just took the train to Aldershot with it flashing. Notes were put up in the messroom to stop the train between the 12 car marmk and the signal but some drivers insist on parking it on the 12 board coz that is wot it sez to do on the schedule card!

I think this is exactly what happened to the driver with the OP incident. I hope you have reconsidered as this will be monitored now that an incident has occurred
--- old post above --- --- new post below ---

That's a very big surprise to me - as in, your being happy to drive a train out there with a fault on a critical safety system. I haven't, ever, done anything other than the minimum move to shift the cab off the grids before rectifying the TPWS. If I get a fault light I couldn't then clear then I wouldn't be going any further. Naively I believed that's what all drivers would have thought.

You stand correct - what 455driver has or is still doing is poor practice.

 

[34D]

I for one would be very happy to be a passenger on a train driven by 455driver cos he's a top bloke

 

[Muzer]

Naturally. Even without TPWS, given the good training and stringent tests most* drivers get, even with the TPWS disabled you would be very unlikely to have an accident. However, since TPWS is deemed a safety-critical system (if it isn't, why is the signal in rear held at danger when a TPWS loop isn't working?), I really think there should be something to help prevent drivers from driving considerable distances like this Chiltern driver or 455driver when the TPWS is in this (non-functioning, apparently) condition. If I'm wrong about the TPWS not functioning in this condition, I of course take it all back - I think that's the assumption that almost everyone in this thread is going on. Making it easier to re-run the self test to reinitialise the system without having to key out and in again might be worth it for units that have other lengthy processes to go through when starting up (eg initialising ATP/ERTMS), as well as providing a clearer indicator that something is wrong (eg an audible warning) or physically preventing the train from moving (eg my interlocking suggestion that some people, through poor wording choice on my behalf, misunderstood) without positive action.



* Obviously not Devon & Cornwall Railways

 

[455driver]

I for one would be very happy to be a passenger on a train driven by 455driver cos he's a top bloke

Excuse me?
You seem to have confused me with somebody else!

Re driving with the TPWS in self isolated mode, the train from Guildford to Aldershot in question is an ECS move, I would never drive a train in passenger service with the TPWS in that position,at least not without some other safeguards in place as per the rools. Sorry for not making that clear in my first post. I have probably driven with it flashing on 6 or 7 occasions over the last few years, it certainly isnt a lot.
Oh they can monitor it as much as they like, I dont have any booked 458 work now. Its 456s now.