Incident at Chalfont & Latimer (21/06/20)

[philthetube]

I doubt there will be any need for infrastructure changes. The trainstop system is equivalent to AWS/TPWS, in fact in this application it’s better as providing everything works as calculated it should eliminate any risk of collision if the driver totally disregards the signalling, which neither AWS nor TPWS guaranteed to do. Also bear in mind this signalling is in its twilight years, in fact it should already have been resignalled some years ago, so it will be hard to justify any changes which aren’t absolutely critical.

I suspect we’ll be looking at scrutiny of procedures, both LU and Chiltern, human factors, and perhaps how the tripcock functions on Chiltern trains, in particular how a tripcock activation presents itself to a driver, reset process, and perhaps whether there should be speed control afterwards.

As a wild card, given how far the train travelled, there could be scope to consider whether there could be a SPAD alarm and to what extent a signaller might be realistically able to make an emergency stop radio broadcast.

The first thing they need to do that is a any form of radio comms

 

[edwin_m]

I doubt there will be any need for infrastructure changes. The trainstop system is equivalent to AWS/TPWS, in fact in this application it’s better as providing everything works as calculated it should eliminate any risk of collision if the driver totally disregards the signalling, which neither AWS nor TPWS guaranteed to do. Also bear in mind this signalling is in its twilight years, in fact it should already have been resignalled some years ago, so it will be hard to justify any changes which aren’t absolutely critical.

I suspect we’ll be looking at scrutiny of procedures, both LU and Chiltern, human factors, and perhaps how the tripcock functions on Chiltern trains, in particular how a tripcock activation presents itself to a driver, reset process, and perhaps whether there should be speed control afterwards.

As a wild card, given how far the train travelled, there could be scope to consider whether there could be a SPAD alarm and to what extent a signaller might be realistically able to make an emergency stop radio broadcast.

Agreed it would be difficult to modify the existing signaling but there is scope to make changes in the design of the replacement. I was quite surprised to read on here somewhere that this was going to retain the tripcocks for use by Chiltern stock and occasional use by heritage units, rather than fitting AWS and TPWS trackside equipment. S Stock would be under the control of the same communications-based system as on the rest of the sub-surface lines, though I suspect it might be operating as a fixed block system on the shared sections.

 

[357]

I was quite surprised to read on here somewhere that this was going to retain the tripcocks for use by Chiltern stock and occasional use by heritage units, rather than fitting AWS and TPWS trackside equipment.

Why? AWS/TPWS is an NR system that suits their working, and tripcocks suit LUL working. Removing the trainstops would mean LUL can't run their heritage units, and would be done totally to give some unknown benefit Chiltern?

The trainstop system has exactly the same facilities as TPWS providing the driver doesn't reset and continue like nothing has happened.

The first thing they need to do that is a any form of radio comms

I believe Chiltern can contact the Service Controller but not the Signaller.

 

[Mojo]

Broadly depends on who 'owns' the track.
eg Here LU own the track and Chiltern are the 'visitors' so LU systems/rules (tripcocks etc), whereas Wimbledon to Putney is NR and LU the 'visitors' hence NR rules (AWS/TPWS) and tripcocks only required on LU trains.

This is commonly stated, the Wimbledon branch is NOT owned by Network Rail, it is a London Underground line. It did however used to be BR, and accordingly is signalled according to main line practice, by Network Rail.

It is more than a historical thing rather than who owns the line. Parts of Merseyrail utilise tripcocks and I think I’ve seen them on the Northern City line too. There was recently a project - Lotep - to fit additional TPWS grids on the DC lines to allow non-Tripcock fitted trains at higher speeds. TPWS is also being fitted to Gunnersbury to Richmond in the same manner.

 

[SlimJim1694]

The trainstop system is equivalent to AWS/TPWS, in fact in this application it’s better as providing everything works as calculated it should eliminate any risk of collision if the driver totally disregards the signalling

My understanding is the tripcock system is equivalent to TPWS. What kind of advance warning do LU have for approaches to signals and speed restrictions? None from what I can tell. I've read up on LU signalling and my understanding is there is no AWS equivalent.

If AWS was fitted at Chalfont & Latimer the driver would have had to cancel it within 2.2 seconds at least 3 times before having the SPAD or had an emergency brake application... hopefully giving him a wake up call of what he was getting into. This is a fair bit of SPAD mitigation provision. As far as I can tell, LU have nothing but reliance on the driver to read the aspects and not doze off/lose concentration.

If the driver acknowledged AWS 3 times and still SPADded, TPWS would have stopped him before the conflict point, same as the tripcock anyway.

After an AWS or TPWS activation it takes a further minute to release the brakes after resetting, giving the driver thinking time to consider why it happened (and on NR metals to call the signaller).

On units fitted with TPWS 2 it gives further indication to the driver of the reason for an activation, eg: SPAD, missed AWS, overspeed.

With all of the above in mind I'd be very interested to know why you have come to the conclusion that LU's tripcock system is "better" than AWS/TPWS.

 

[Domh245]

With all of the above in mind I'd be very interested to know why you have come to the conclusion that LU's tripcock system is "better" than AWS/TPWS.

I think in this context it's referring to the standard LU practice of the signal being so far in advance of whatever it's protecting that a train at line speed will come to a halt with full emergency brakes before fouling. This practice is not the case on the mainline that I'm aware of (TPWS will stop the train, but it won't necessarily stop it in time where the train is at line speed)

 

[357]

It's also been proven that on the mainline, where signals are close together and speeds are low the driver can begin to cancel the AWS by force of habit.

I agree it may well have been a wake up call, but these drivers drive on this route all the time - it's not like they suddenly found themselves without AWS, they are fully trained and have full route knowledge.

Regarding speed restrictions on LUL lines, there are advance warning boards and in certain locations a trainstop that remains in the raised position until the train is proven to be below the required speed (in the same way TPWS works), and approach controlled signals are also used in various locations.

 

[rebmcr]

If AWS was fitted at Chalfont & Latimer the driver would have had to cancel it within 2.2 seconds at least 3 times before having the SPAD or had an emergency brake application... hopefully giving him a wake up call of what he was getting into. This is a fair bit of SPAD mitigation provision.

This logic is sound (at least in my opinion). Trainstops' guarantee of stopping short of conflict might have led to a certain amount of SPAD tolerance in LU's historical signalling designs, which was not fully taken into account when allowing mainline trains to share the tracks.

 

[edwin_m]

Why? AWS/TPWS is an NR system that suits their working, and tripcocks suit LUL working. Removing the trainstops would mean LUL can't run their heritage units, and would be done totally to give some unknown benefit Chiltern?

The trainstop system has exactly the same facilities as TPWS providing the driver doesn't reset and continue like nothing has happened.


I believe Chiltern can contact the Service Controller but not the Signaller.

In terms of its speed and traffic Harrow to Amersham is essentially a secondary main line rather like say Solihull to Warwick. For reasons that boil down to the expansionism of the Metropolitan Railway it happens to have its local service provided by Metro stock, and unlike the much more Metro-like Richmond branch and Watford DC lines it's now part of LUL not Network Rail. So TPWS and AWS are probably more suited to the operational reality of this route, and it only has tripcocks for historical reasons.

The decision on which system to adopt on re-signaling should be based on least overall cost and greatest overall benefit, not just one party considering its own balance sheet, so that's siloed railway thinking in action. In the end all the money comes from the farepayer or the taxpayer!

Basing your decision on the ability to run heritage stock is the tail wagging the dog. TPWS was designed to have a simple interface to existing stock and has been fitted to a wide range of traction from Black Fives to the latest units. Fitting it to the LU heritage stock shouldn't be overly difficult - the AWS function isn't required if LU retains overlaps at full braking distance on this route. Instead they've saddled themselves for several more decades with an obsolete system having moving parts that are an obvious source of unreliability.

 

[357]

@edwin_m I think you misunderstood - I was trying to make the point that the existing trainstops will be retained, and used by existing rolling stock that has a tripcock already. Not that the only reason for this is so that they can run Sarah Siddons twice a year! I then questioned what the realistic benefit to Chiltern would be.

The only change will be the signals and trainstops will be controlled by the new system and not the old system.

To rip it out the existing system and replace it with TPWS/AWS would be an enormous waste of money, especially considering LUL will not have any experience or spare parts for TPWS whereas trainstops are the S&T bread and butter and will still be on use elsewhere on the network.

However, I could see a small advantage of installing AWS for the mainline trains and keeping the trainstops.

 

[357]

Instead they've saddled themselves for several more decades with an obsolete system having moving parts that are an obvious source of unreliability.

You could say the same about TPWS now that we have ERTMS. Installing TPWS would be ripping out one obsolete system and replacing it with another obsolete system!

 

[ainsworth74]

I think it's time to draw this thread to a temporary halt again we're getting rather off the topic of this specific incident. If anyone wishes to discuss LU signalling practices more general and whether please do feel free to start a new thread. Once the RAIB report is published please feel free to report this post and we'll look at re-opening the thread for further discussion on that.

 

[ainsworth74]

The RAIB have now published their report into this incident. An extract is below and the full report can be found here.

Summary​

At around 21:43 hrs on Sunday 21 June 2020, a near miss occurred between two passenger trains at London Underground’s Chalfont & Latimer station on the Metropolitan line. A few minutes earlier a southbound Chiltern Railways train had passed a signal displaying a red (stop) aspect (known as a signal passed at danger or a ‘SPAD’). This resulted in the train being automatically stopped by a safety system, known as a tripcock, which had applied the train’s emergency brake. Without seeking the authority required from the service operator (signaller), the driver reset the tripcock before continuing towards Chalfont & Latimer station, where the train was routed towards the northbound platform, which was occupied by a London Underground train.

The Chiltern Railways train stopped about 23 metres before reaching the other train, which was stationary. There were no reported injuries, but there was minor damage to signalling equipment and a set of points.

The probable cause of the SPAD was that the driver of the Chiltern Railways train was fatigued. The driver stated that he decided to proceed without authority because he did not recall passing the stop signal and believed the tripcock safety system activation had been spurious. This decision may also have been affected by fatigue.

RAIB found that Chiltern Railways’ processes for training and testing a driver’s knowledge of what to do following a tripcock activation were not effective. A probable underlying factor was that Chiltern Railways’ driver management processes did not effectively manage safety-related risk associated with the driver involved in the incident. It is possible that this was a consequence of a high turnover of driver managers, insufficient driver managers in post and their high workload. Although not causes of the incident, RAIB also found shortcomings in other aspects of these driver management processes, and in risk management at the interface between Chiltern Railways and London Underground.

Recommendations​

RAIB has made three recommendations and identified one learning point. The first recommends that Chiltern Railways improves its driver management processes. The second recommends that Chiltern Railways and London Underground Ltd jointly establish an effective process for the management of safety at the interfaces between their respective operations. The third recommends that Chiltern Railways, assisted by London Underground, reviews the risk associated with resetting train protection equipment applicable to Chiltern Railways’ trains on London Underground infrastructure. The learning point concerns the importance of considering sleep disorders during routine medical examinations of safety critical workers.

 

[Taunton]

As ever, passenger care came last. Although the Chiltern diesel was within spitting distance of a platform, nobody could bring themselves to shunt it forward a bit so the passengers could be detrained. No, they have to get down on the track. And that means double-checking current is off and using staff who are authorised to do so, none of whom of course are readily available. So they are just left there to fester for a couple of hours.

The passengers would have been better off if the trains had collided. Then the fire service would have turned out and would have got them out pronto.

 

[CyrusWuff]

As ever, passenger care came last. Although the Chiltern diesel was within spitting distance of a platform, nobody could bring themselves to shunt it forward a bit so the passengers could be detrained. No, they have to get down on the track. And that means double-checking current is off and using staff who are authorised to do so, none of whom of course are readily available. So they are just left there to fester for a couple of hours.

The Chiltern service was stopped 23m (one coach length) from the front of the Met Line train on the same track following the SPAD. How, pray tell, would you propose they bring it into the platform even if they could do so without destroying evidence?

 

[Surreytraveller]

As ever, passenger care came last. Although the Chiltern diesel was within spitting distance of a platform, nobody could bring themselves to shunt it forward a bit so the passengers could be detrained. No, they have to get down on the track. And that means double-checking current is off and using staff who are authorised to do so, none of whom of course are readily available. So they are just left there to fester for a couple of hours.

The passengers would have been better off if the trains had collided. Then the fire service would have turned out and would have got them out pronto.

There is a serious risk of a more serious incident in the time following a serious incident. In the time following an incident, no one knows exactly what has happened. The incident will be playing on the driver's mind.
From a safety perspective, it is better if nothing moves

 

[Taunton]

There is a serious risk of a more serious incident in the time following a serious incident.

Can you describe one happening?

 

[Surreytraveller]

Can you describe one happening?

Until investigations have been completed, it could also be a brake failure, some other wrong side failure.
A SPAD, reset and continue, is about the most serious incident a driver can have short of an actual collision

 

[craigybagel]

Can you describe one happening?

Do you really think it's wise for a driver, having just been involved in the nearest of near misses, to just jump back on the train, move it even closer to the train he's nearly collided to, and then coordinate an evacuation through the only door of the train that could possibly be accommodated on the platform, all by himself?

That's before we get to the fact the service featured two units in multiple without gangways, and there definitely wasn't enough space to get the rear unit platformed.

Of all the many things that went wrong on the day to make this incident occur (and I suggest people read the full report, it's a very interesting one), leaving the passengers on the train for just over an hour is really an unfortunate side effect but definitely the right decision.

 

[Dave W]

This is a particularly interesting RAIB report. I always take note of those which go beyond their usually rather neutral language. They don't pull too many punches about the working culture at Chiltern - or indeed the response to the driver's previous incidents.

It's an astounding combination of events and circumstances, all in all - I hadn't realised the actions taken after the initial tripcock activation. That seems pretty unforgivable to me, under pretty much any circumstance - but the report suggests procedural shortcomings were a contributing factor, as well as the driver's actions.

 

[Taunton]

Do you really think it's wise for a driver, having just been involved in the nearest of near misses, to just jump back on the train, move it even closer to the train he's nearly collided to, and then coordinate an evacuation through the only door of the train that could possibly be accommodated on the platform, all by himself?

That's before we get to the fact the service featured two units in multiple without gangways, and there definitely wasn't enough space to get the rear unit platformed.

Of all the many things that went wrong on the day to make this incident occur (and I suggest people read the full report, it's a very interesting one), leaving the passengers on the train for just over an hour is really an unfortunate side effect but definitely the right decision.

Well, when you think the instruction from the same DfT about a road accident is firstly move the vehicles to a safe position, done by the drivers actually involved in an accident, not just a near miss ... meanwhile, if an aircraft overruns the runway, it's the responsibility of the commander (many paid surprisingly less than rail drivers) to coordinate immdiately any evacuation, and take charge. On a small plane, all by himself.

Are rail drivers really unable to take such equivalent responsibilities?

 

[theking]

Wow that safety of the line record already had 2 reset and continues. Ticking time bomb comes to mind

 

[bramling]

Well, when you think the instruction from the same DfT about a road accident is firstly move the vehicles to a safe position, done by the drivers actually involved in an accident, not just a near miss ... meanwhile, if an aircraft overruns the runway, it's the responsibility of the commander (many paid surprisingly less than rail drivers) to coordinate immdiately any evacuation, and take charge. On a small plane, all by himself.

Are rail drivers really unable to take such equivalent responsibilities?

It really isn’t a good idea. In this case, the train had already run through a set of points. The incident was already a mess-up, without adding a derailment to the lineup.

Wow that safety of the line record already had 2 reset and continues. Ticking time bomb comes to mind

It is quite sobering just how poor the management was, almost shades of Thames Trains in the 1990s. Quite poor that they ended up getting an ORR enforcement notice.

Seems like they got away lightly on this one.

 

[craigybagel]

Well, when you think the instruction from the same DfT about a road accident is firstly move the vehicles to a safe position, done by the drivers actually involved in an accident, not just a near miss ... meanwhile, if an aircraft overruns the runway, it's the responsibility of the commander (many paid surprisingly less than rail drivers) to coordinate immdiately any evacuation, and take charge. On a small plane, all by himself.

Are rail drivers really unable to take such equivalent responsibilities?

In this case, the vehicles concerned were already in a safe place - safer than moving them again anyway.

If an aircraft overruns the runway, do you think the captain is expected to try and move their plane across the grass closer to the terminal building for passenger convenience?

Incidentally - I note that you've managed to find the time to make a subtle dig about driver salaries but you've still not answered the question about how you'd detrain the passengers on the rear set?

 

[jumble]

This is a particularly interesting RAIB report. I always take note of those which go beyond their usually rather neutral language. They don't pull too many punches about the working culture at Chiltern - or indeed the response to the driver's previous incidents.

It's an astounding combination of events and circumstances, all in all - I hadn't realised the actions taken after the initial tripcock activation. That seems pretty unforgivable to me, under pretty much any circumstance - but the report suggests procedural shortcomings were a contributing factor, as well as the driver's actions.

I find the observations in 136 the most astonishing
Especially the final sentence
Chiltern Railways’ class 168 trains were built between 1998 and 2004 with the SCAT system fitted. This limits the train speed to 10 mph (16 km/h) for 10 seconds, significantly less than the three minutes used on LUL trains. This reduced timer was implemented to reduce delays due to spurious activations when class 168 trains are operating on the national rail network. Chiltern Railways was able to find a partly-completed form, dated 21 December 2004, requesting a derogation from the LUL standard requiring a three minute SCAT timing.

LUL was unable to find any correspondence about this derogation and stated it was unaware the class 168 trains were operating with a 10 second SCAT timing.

I am astonished because my understanding is that for many years (probably around 1901) a tripping would delay the train for quite a while to allow the brakes to pump up and the line controller would want to know why.

 

[edwin_m]

When evacuating an aircraft after an incident such as an emergency landing, time may be of the essence. Staffling levels on an aircraft are determined to, among other things, provide enough people to achieve a safe and rapid evacuation. If there's only the pilot then there will only be a small number of passenger to deal with.

In a rail incident it's nearly always safer for passengers to stay on the train until assistance arrives. The trackside has hazards such as other trains and live rails, and one or two staff members can't really control several hundred passengers.

 

[43096]

As ever, passenger care came last. Although the Chiltern diesel was within spitting distance of a platform, nobody could bring themselves to shunt it forward a bit so the passengers could be detrained. No, they have to get down on the track. And that means double-checking current is off and using staff who are authorised to do so, none of whom of course are readily available. So they are just left there to fester for a couple of hours.

The passengers would have been better off if the trains had collided. Then the fire service would have turned out and would have got them out pronto.

Given that the driver had just done a “reset and go” on the tripcock and has a shocking safety record, the last thing I’d want him doing was moving the train post incident. I sincerely hope that they’re no longer a driver (or indeed in any safety critical role).

 

[MotCO]

Given that the driver had just done a “reset and go” on the tripcock and has a shocking safety record, the last thing I’d want him doing was moving the train post incident. I sincerely hope that they’re no longer a driver (or indeed in any safety critical role).

I must admit I was a bit surprised by this casual attitude of the driver. But then the report also says that tripcocks on NR tracks, where the ground equipment is not installed, often tripped when the ballast levels were a bit too high, or other debris was on the track. So it is understandable why the driver reset, but given that he was on LUL tracks, it should not be excusable. The issue is did the driver realise s/he was on LUL tracks - s/he didn't seem to realise what s/he was doing due to fatigue.

I also think that the driver has escaped much censure due to the poor record keeping and training on Chiltern Railways.

The other issue is that surely NR should take greater care to ensure ballast levels are not too high to trip the tripcocks - thus a tripped tripcock would be such a rare occasion, and the driver realises they must investigate further rather than just reset.

 

[MikeWh]

The issue is did the driver realise s/he was on LUL tracks - s/he didn't seem to realise what s/he was doing due to fatigue.

Well they'd already passed the carriage sidings and called at Amersham, plus the 3rd/4th rail being there, I would hope they'd know they were on LUL track.

 

[Bald Rick]

The issue is did the driver realise s/he was on LUL tracks - s/he didn't seem to realise what s/he was doing due to fatigue.

The driver didn’t realise that they had passed 2 caution and one danger signal, without responding, either.

The other issue is that surely NR should take greater care to ensure ballast levels are not too high to trip the tripcocks

Ballast moves. And many spurious trips are caused by other things left / dumped on the track. But I agree in principle.