Is too much safety stuff dangerous?

[Llama]

A brake application initiated by failure to cancel the AWS warning at the first restrictive signal aspect would always bring the train to a stand before the respective signal at danger, not including extreme cases of low adhesion. The longest period between receiving the warning and the brake application being initiated would be less than three seconds.

 

[MarkyT]

My understanding (which I'm more than happy to have corrected) is that if a train is running at linespeed (e.g. 125mph), AWS is triggered by a restrictive signal, and the driver fails to cancel it, there is not always going to be sufficient time/distance for the train to be brought to a halt by the automatic systems before it passes the signal. That's what was behind my point about it potentially being a mitigation for passing a signal which should not have been passed, as opposed to a way of preventing that happening in the first place.

EDIT: The discussion above has been very informative. My concern (for want of a better word, it doesn't actually concern me at all because it's so rare) about AWS is that there are still edge cases where a train can pass a signal at danger, due to human error. The question isn't (shouldn't be) whether AWS is completely ideal, but whether it's the best way of managing the risk.

After a series of greens with bells, the first horn and sunflower should be encountered at the first cautionary aspect before a red, a double or single yellow depending on whether there is a 3 or 4 aspect sequence in the vicinity. From that point there should be a full braking distance available to the danger signal ahead at service braking which is what type of braking is initiated if the driver does not acknowledge the warning. Once initiated, the braking intervention cannot be overridden until the train has completely come to a stand. If the driver acknowledges the warning before the braking intervention, there is no control or restriction on further forward progress and the driver could theoretically disengage any normal braking and even accelerate if they wanted.

 

[big all]

aws does 2 things
one it tells the driver the magnet is live or dead [green/black indication or dead sunflower caution horn] if the driver cancels it takes no further part till the next dead or live magnet
if the driver does nothing a full bake application happens after a preset short time to allow for cancelation perhaps 3-5 seconds
a live magnet is a magnet canceled out by an electro magnet [green signal ]

 

[Taunton]

Once initiated, the braking intervention cannot be overridden until the train has completely come to a stand.

This is a related question, but when did it start that if the braking was initiated you couldn't stop it. My physical experience was long ago, but then braking stopped once you cancelled it. On WR steam locos a brake valve actually opened together with the horn starting (it was the air going into the brake pipe that went through the horn and made the sound), but if you were quick on the canceller there was not time for any meaningful amount of air to flow. I actually thought it only came with TPWS, but am maybe mistaken.

 

[al78]

http://www.selectinternational.com/safety-blog/risk-compensation-affects-personal-safety

 

[Mathew S]

A brake application initiated by failure to cancel the AWS warning at the first restrictive signal aspect would always bring the train to a stand before the respective signal at danger, not including extreme cases of low adhesion. The longest period between receiving the warning and the brake application being initiated would be less than three seconds.

After a series of greens with bells, the first horn and sunflower should be encountered at the first cautionary aspect before a red, a double or single yellow depending on whether there is a 3 or 4 aspect sequence in the vicinity. From that point there should be a full braking distance available to the danger signal ahead at service braking which is what type of braking is initiated if the driver does not acknowledge the warning. Once initiated, the braking intervention cannot be overridden until the train has completely come to a stand. If the driver acknowledges the warning before the braking intervention, there is no control or restriction on further forward progress and the driver could theoretically disengage any normal braking and even accelerate if they wanted.

Thank you both - very interesting indeed.

So, assuming I have understood correctly, the AWS both acts as a warning device (at a restrictive signal, do something or I'll do it for you), and as a 'backstop' to bring the train to a halt if the driver does not act.

The one circumstance which springs to mind as a potential issue is where a train passes a restrictive (e.g. single yellow) signal, then stops at a station. The driver then pulls away, forgetting the restriction and approaches a signal at danger, at line-speed. Now, I know that the DRA exists precisely as a mechanism to prevent such mishaps but in such a situation would the AWS have sufficient time/distance to prevent the train passing the next signal at danger?

Perhaps more to address the original question this thread posed, AWS is a system which safeguards against human error. As long as humans are part of the decision-making process of driving a train, that means it remains a valuable addition. However, would it not be safer to take the human (and so the potential for human error) out of the system altogether? What I'm getting at is, the most dangerous part of the system seems to not be the safety system, but the imperfect human.

 

[SHD]

I'm not arguing that AWS doesn't have its limitations, it does. However, the vast majority of the time, once a Driver has cancelled an AWS warning, they will take steps to react to it by shutting off and applying the brake. It is extremely rare for this not to be the case. Together with TPWS, AWS has ensured that in October of this year, we will have suffered zero fatalities in the UK due to a SPAD for twenty years. This is an incredible achievement brought about by a combination of widespread AWS, the national rollout of TPWS and the improved understanding of human factors and non technical skills. AWS on its own is still massively better than no system at all but in the vast majority of cases it is supplemented with TPWS which had contributed to our enviable safety record over the last couple of decades.

Well I certainly agree with that

Comparing with the situation in France, although the crocodile has been around since the late 19th century as pointed out by MarkyT, and was deployed throughout the network by the 1930s with functions very similar to AWS (*), several disasters in the 1980s proved (at the price of blood unfortunately) that it was not sufficient. This is what led SNCF to roll out KVB, based on a system already implemented in Sweden. KVB controls that the speed of a train approaching a protected point/zone (signal, points, temporary work zone...) where a "target" speed has been set (obviously the target speed is zero for a signal at danger) remains within an acceptable envelope until the protected point has been cleared. The envelope takes into account the distance until the protected point, the target speed, and the train braking parameters. If the train speed gets dangerously close to the permissible envelope, the driver receives an audible warning. Unless very fast action is taken by the driver, the emergency brake is applied (and the driver is in for a tea with no biscuits moment). KVB may be compared to an elaborate version of TPWS.

KVB has been very beneficial for safety, although it has drawbacks regarding operational efficiency and driving responsiveness. As an example, if a driver approaches a signal at under KVB protection, and the signal aspect changes, KVB will normally prevent re-acceleration until the signal is cleared (only a specific version of KVB allows that, and it is installed in the Paris region), which means that a driver may find himself crawling at 10 km/h in front of a signal that is not anymore at "danger" aspect, until their train clears the signal.

(*) Since the 1920s/1930s, block signals and certain speed reduction indicators have been protected by crocodiles. France has a mixed signalling philosophy, with elements of route signalling and speed signalling. In particular, transitions to a lower speed may be imposed through special block signal aspects and/or specific speed reduction indicators. This helps at junctions/diverging points as a driver encountering a speed reduction signal is informed in advance that s/he is about to be directed to another track.

 

[Panupreset]

I have read recently:
The field guide to understanding human error - Professor Sidney Dekker
Safety I and Safety II The last and future of safety management - Dr Erik Hollnagel

Learned so much and now applying it to how I drive.
One thing these books explain is that the more technology and the more automation you put in the system the more you need a human at the helm. Technology and automation suffers from ‘bimodality’ - that is it either works or it does not, it’s either on or off. The more is that you put in the system the more opportunity the system has to be placed in a sub optimal or non standard way of working. This has to be compensated for by variable human performance. When things go wrong people up their game.
Traditional view of safety - the system is safe, the erratic unreliable behaviour of people causes unsafe conditions.
New view of safety- the system is not inherently safe, people make it safe. The system creates and sometimes encourages opportunity for people to make errors.
‘Don’t be late’
‘Don’t cost us money’
‘Keep the customers happy in disruption by making lots of announcements’ (when actually this is the time you should be most focussed on safety)

 

[PeterC]

Didn't the early railways claim that enclosed cabs would make drivers too comfortable and hence inattentive?

As a general rule I think that the benefit of any safety system can be partially offset by user complacency so that the benefit can be a little less than originally anticipated. However getting 95% of the projected improvement rather than 100% doesn't invalidate the system.

 

[BluePenguin]

No I don't think so. People do not drive on the road more recklessly because know that their car has an airbag to save them in the event of a crash so I doubt anyone would drive a train dangerously and expect safely equipment to save them. It's not safe to be too reliant on anything

 

[SHD]

Didn't the early railways claim that enclosed cabs would make drivers too comfortable and hence inattentive?

As a general rule I think that the benefit of any safety system can be partially offset by user complacency so that the benefit can be a little less than originally anticipated. However getting 95% of the projected improvement rather than 100% doesn't invalidate the system.

This kind of thinking (comfort is antithetic to attention and safety) was certainly favoured by railways of yore.

 

[bramling]

This comment prompted this thread


So is a driver thinking he is protected by AWS likely to drive in a less defensive way than one with AWS, and therefore be actually more dangerous?

Are we too reliant on safety backups so we dont look out for safety, but sit cocooned in a bubble not sufficiently aware for when something unexpected happens?

They say people drive less safely because of all the safety stuff (air bags, crumple zones, side impace protection) thinking they are protected. Jeremy Clarkson said driving standards would improve if a large spike was welded to the centre of all steering wheels!

And on the mountains, we have an excellent mountain rescue system manned by volunteers. But how many go on the hill ill equipped and have silly accidents, secure in the knowledge that 'they' will come and get them when in difficulty.

So is safty equipment actually dangerous?

Not knocking the safety guys, just a general discussion.

One thing I would say is it's generally not a good thing to have someone who is so worried about having an incident that it completely knocks their confidence.

Likewise a positive safety culture arises from openness and honesty regarding mistakes, which should be part of a mutual trust and respect between employer and employee. A supportive approach to safety works far better than a draconian one, though of course a line needs to be drawn at some point if someone is a liability.

 

[Panupreset]

One thing I would say is it's generally not a good thing to have someone who is so worried about having an incident that it completely knocks their confidence.

Likewise a positive safety culture arises from openness and honesty regarding mistakes, which should be part of a mutual trust and respect between employer and employee. A supportive approach to safety works far better than a draconian one, though of course a line needs to be drawn at some point if someone is a liability.

There is a lot of evidence that organisations with strong confidential/anonymous reporting systems kill fewer people.

Sandilands is a great example. Zero, yes zero, (source RAIB report), to the operators confidential reporting system in the 5 years leading up to the accident. 7 dead.

505 reports to the confidential reporting system at Faslane nuclear submarine base in a 12 year period. Zero deaths (source BBC news, Nov 2018).

 

[ComUtoR]

So is a driver thinking he is protected by AWS likely to drive in a less defensive way than one with AWS, and therefore be actually more dangerous?

No. Drivers act professional and generally have a high safety work ethic.

Are we too reliant on safety backups so we dont look out for safety, but sit cocooned in a bubble not sufficiently aware for when something unexpected happens?

A good example of the human factors involved and how common this phenomenon is, is the 'lift door' Vs 'train door' debate. People are willing to stick their arm in a closing door, whilst an alarm is sounding because they firmly believe that the door will reopen. Another example is where you are reversing back into a car parking space and will continue to reverse until the proximity alarm sounds. An extreme railway example is the Interlock Light. For years we have assumed that when we get interlock, nothing is trapped in the doors. We have relied on that for years almost to the point of complacency. A few high profile incidents later and we are now much more vigilant than ever. I think there was an article posted a few days ago somewhere about there is a belief that we are on the brink of a major disaster. Safety is so high we are again becoming complacent. SPADs are more acceptable now because TPWS saves us.

Specifically for your quote. The AWS has it's limitations, as others have highlighted. What happens is that the human factors creep in. You are on restrictive aspects and end up cancelling AWS after AWS. Your brain, being quite clever, will filter it out and you end up cancelling it without thinking. You are on yellow after yellow and end up sailing past a Red :/ The other one is the DRA. It has a similar issue. You reset it so many times a day that it becomes habitual to remove it. Especially at locations where you always get a Red. SAS SPADS (starting against signal) highlight this. Even if you set the DRA, you reset it and still pass the Red. This over use of the DRA contributes to the SPAD. As highlighted already, your workload just tips over and you have an incident.

Offside doors releases are the same. We have a route where there has never been an offside release. Now one of the stations has been rebuilt there is now one station which an offside. The left side release becomes habitual and just when your workoad tips over or fatigue kicks in or any other random human factor; you pop the wrong side door. One unit I drive has CSDE (correct side door enable) As it turns out; it doesn't always work, it doesn't work at every location, can be easily overridden, and sadly the way in which it is taught has misled Drivers into believing that the safety system will prevent doors being released incorrectly. As two Drivers I know have now discovered to their detriment. Both said they didn't think it was actually possible.

They say people drive less safely because of all the safety stuff (air bags, crumple zones, side impace protection) thinking they are protected. Jeremy Clarkson said driving standards would improve if a large spike was welded to the centre of all steering wheels!

"Don't stand near the edge of a platform. Trains pass through at high speed". If they put a fence at the platform edge, I guarantee people will lean against it.

So is safty equipment actually dangerous?

In itself, no. However; we need to understand how, and why they are being used and understand their limitations.

 

[Panupreset]

I agree with the comment we maybe on the brink of a major disaster. I remember seeing a Government Minister saying on TV recently ‘we have the safest railway in the workd’. I thought remarks like that so often preceed catastrophe.

 

[MarkyT]

I agree with the comment we maybe on the brink of a major disaster. I remember seeing a Government Minister saying on TV recently ‘we have the safest railway in the workd’. I thought remarks like that so often preceed catastrophe.

Logically there will always be a next major disaster at some time. Predicting when is impossible but if someone makes a congratulatory comment like that, it is bound to happen sometime afterwards, but not neccessarily within the public memory of the statement. The likelyhood is a future disaster will not be a major junction collision because that risk is well managed now but is more likely to be something else, perhaps totally unforeseen today. Level crossing collisions and subsequent derailments, civil or track structural failures may be a more likely.

 

[ComUtoR]

I just pulled this from the RSSB. Its just a small quote but highlights its a real phenomenon.

https://www.rssb.co.uk/library/rese...novation/2010-09-guide-operational-safety.pdf

T344 Assessing the effectiveness of an in-cab signal reminder device

Description : Assessing the practicability, and effectiveness in reducing ‘automatic cancellations’ by train drivers, of an in-cab reminder device displaying the aspect of the last signal passed.

Abstract : This research evaluated an in-cab bolt-on modification to the Automatic Warning System (AWS), designed by a South West Trains driver, to address the problem of drivers automatically cancelling the AWS without first checking the signal aspect.

https://www.rssb.co.uk/rgs/standards/gogn3652 iss 1.pdf

...Habituation is a process by which we stop noticing things because of repeated presentation of the same information. Train drivers are repeatedly presented with the same information day in day out, which can lead to them becoming ‘over-used’ to the information around them. Their sensitivity decreases and therefore performance decreases. A good example of this is habituation with the AWS system. The purpose of the system is to provide an attention/alerting feature. However, the provision of auditory warnings for all signals is likely to actually lower the relative effectiveness of the warning system: the driver becomes habituated to the sound of the AWS and the repeated presentation of yellow signals, which results in a lack of awareness of the red signal.

3.11.3 Automatic response There may be occasions when employees are not fully engaged in the task and relying on your mental models to perform. This can sometimes lead to the feeling of not being able to remember what has just happened. The task is learned so thoroughly that it does not require conscious responses and the task can be undertaken automatically

Sometimes it sounds like I'm speaking out my rear cab but other times....

Another thing to note is the difference between 'contribution and causation' There are many many factors that contribute to an incident/accident but again, I don't believe that safety systems specifically cause them.

 

[Ken H]

Logically there will always be a next major disaster at some time. Predicting when is impossible but if someone makes a congratulatory comment like that, it is bound to happen sometime afterwards, but not neccessarily within the public memory of the statement. The likelyhood is a future disaster will not be a major junction collision because that risk is well managed now but is more likely to be something else, perhaps totally unforeseen today. Level crossing collisions and subsequent derailments, civil or track structural failures may be a more likely.

I reckon the big safety hole on the railways is when the railway is near a road.
So level crossings, and under and over bridges
Someone could still go a Gary Hart and we end up with another Great Heck
or someone will hit an overbridge just as a high speed train is approaching.
or someone will slide an HGV off a motorway onto a parallel railway, like between Tebay and Greyrigg

 

[Ken H]

I just pulled this from the RSSB. Its just a small quote but highlights its a real phenomenon.

https://www.rssb.co.uk/library/rese...novation/2010-09-guide-operational-safety.pdf


https://www.rssb.co.uk/rgs/standards/gogn3652 iss 1.pdf


Sometimes it sounds like I'm speaking out my rear cab but other times....

Another thing to note is the difference between 'contribution and causation' There are many many factors that contribute to an incident/accident but again, I don't believe that safety systems specifically cause them.

I think this habituation thing is the nub of the issue.
But assuming the technology has got it right is also a recipe for disaster, because the tech is set up by fallible humans.
We assumed signalling was safe, and then we had the 1988 Clapham Jct rail crash.

I write computer programs for a job - business ones so no safety critical stuff. But i know how easy it is to write in hidden bugs that only surface later. Especially with old code that has been modified again and again. So an error could get live in some safety system, despite testing. But users wont challenge the machine cos the machine is always right.

 

[PeterC]

One thing I would say is it's generally not a good thing to have someone who is so worried about having an incident that it completely knocks their confidence.

Likewise a positive safety culture arises from openness and honesty regarding mistakes, which should be part of a mutual trust and respect between employer and employee. A supportive approach to safety works far better than a draconian one, though of course a line needs to be drawn at some point if someone is a liability.

I haven't worked in a safety critical environment but agree about openness about mistakes. One company that I worked for had a blame culture in the warehouse. As a result mistakes there were covered up and we had difficulty fixing them properly. The main office was open about things and problems were mostly resolved either through training or a system fix before they had a significant impact on customers.

 

[LAX54]

Hasn't TPWS basically replaced it in any meaningful sense, though?

Not every signal has TPWS, plus there is no TPWS at ESR's etc, unlike AWS, and of course TPWS will not always prevent a train passing a signal at Danger.

 

[Dieseldriver]

Hasn't TPWS basically replaced it in any meaningful sense, though?

No, they both serve very different purposes.

 

[Carlisle]

just as a high speed train is approaching.
or someone will slide an HGV off a motorway onto a parallel railway, like between Tebay and Greyrigg

There’s already additional crash barriers along parts of that route intended to prevent anything that rolls down the cutting getting onto the railway .

 

[atraindriver]

<deleted>

 

[ComUtoR]

I assume there are no Morpeth boards

What are Morpeth Boards please?

 

[Dieseldriver]

What are Morpeth Boards please?

PSR warning boards. Many people refer to them as Morpeth boards due to the derailments at Morpeth that were caused by trains approaching and travelling through the lower PSR for the curve at excess speed.

 

[adrock1976]

I have found this to be a really good thread, but the one thing that spoils it is the large amount of the use of acronyms/abbreviations/jargon without first saying what it means.

For example, I have seen KVB, TPWS, DRA, ESRs, and EROSs in posts above, but nobody has actually said what they mean. Could they be translated please?

 

[ComUtoR]

Cheers DieselDriver.

 

[atraindriver]

<deleted>

 

[ComUtoR]

I have found this to be a really good thread, but the one thing that spoils it is the large amount of the use of acronyms/abbreviations/jargon without first saying what it means.

It's a bad habit when your in professional mode. I think a lot of it is caused by treating what is technically an acronym as a single word. I never think of the DRA as Drivers Reminder Appliance and simply think of is a a noun :/

TPWS - Train Protection Warning System (grids in the track)
AWS - Advanced Warning System (magnets in the track)

KVB I know what it is but sod knows what it stands for, I don't use it.

RAIB - Rail Accident Investigation Branch
SPAD - Signal Passed at Danger

PSR - Permanent Speed Restriction

BBC - British Broadcasting Corporation
HGV - Heavy Goods Vehicle