RHDR - two trains in single track section at same time, going in opposite directions.

[notverydeep]

The RAIB has issued a Safety Digest for the incident

https://www.gov.uk/government/publi...g-irregularity-at-romney-sands-28-august-2019

It is unusual to see direct criticism of the people involved in RAIB reports, but the last paragraph drawing the clear parallel with Abermule and prominently noting that nearly a century has elapsed since, is as close as an impartial body can get to saying, "what on earth were you all thinking?"...

 

[45669]

It is unusual to see direct criticism of the people involved in RAIB reports, but the last paragraph drawing the clear parallel with Abermule and prominently noting that nearly a century has elapsed since, is as close as an impartial body can get to saying, "what on earth were you all thinking?"...

There are so many worrying factors here. One can understand a trainee, not familiar with the staff and ticket system, simply following instructions and doing what he was told by writing out the ticket. However, he could, indeed should, have double checked with the senior member of staff to see whether he was doing the right thing.

But even more worrying is the driver accepting the ticket without asking to see the token to which it applied, and the qualified stationmaster overseeing the whole event without realising that the token for the section was not in their possession.

However, having the tickets in a locked box openable only by a key chained to the token should prevent such an incident happening again. One can't help wondering whether a situation like this could arise on any other heritage railway; they are all, wholly or partially, single lines. Hopefully, operating managers and signalling staff will be making sure that they, too, have suitable safeguards in place to prevent it.

 

[MarkyT]

The locked blank ticket storage box is a good measure but probably doesn't prevent multiple blank tickets being removed each time the box is opened. I've been musing on a modern tech solution with a unique RFID tag attached to the token that could be beeped on a reader attached to a small computer terminal that automatically prints out a single use time limited ticket for the appropriate section (with some keyboard input from the operative; train ID, time etc). I would do this for all trains including the last in direction carrying the token. It would become a 'token protected train order system'. All activity would be logged by the terminal. A more advanced version could include an IP based line clear release as well for each movement where two signallers have to cooperate for a movement. Perhaps Park Signalling could help...

 

[ComUtoR]

However, having the tickets in a locked box openable only by a key chained to the token should prevent such an incident happening again.

In the incident, nobody followed what looks to be a very simple safety procedure. : Do not issue or accept a ticket without seeing the token first. This is because humans are inherently lazy and will take some kind of shortcut to make their lives easier. Human factors are very real and the railway is learning the hard way.

As MarkT has stated; multiple tickets will get removed. What will also happen is that there will be a pad of tickets left in a drawer somewhere for easier access, or quite simply, someone will use a copy of the key.

One of the best way to help prevent incidents is look at what the people on the ground are doing. Robost training, good competence management, strong safety culture etc etc.

I hope that other operators look at this incident and put similar procedures in place to help with further mitigation.

 

[Bletchleyite]

The locked blank ticket storage box is a good measure but probably doesn't prevent multiple blank tickets being removed each time the box is opened. I've been musing on a modern tech solution with a unique RFID tag attached to the token that could be beeped on a reader attached to a small computer terminal that automatically prints out a single use time limited ticket for the appropriate section (with some keyboard input from the operative; train ID, time etc). I would do this for all trains including the last in direction carrying the token. It would become a 'token protected train order system'. All activity would be logged by the terminal. A more advanced version could include an IP based line clear release as well for each movement where two signallers have to cooperate for a movement. Perhaps Park Signalling could help...

If you're going to do that, just implement something like RETB. There's no point reinventing the wheel.

 

[MarkyT]

If you're going to do that, just implement something like RETB. There's no point reinventing the wheel.

There is if it was ten or more times the price. My suggestion would have no special equipment on the train, no radio network etc. It wouldn"t have an expensive SSI cubicle with its site specific configuration. The station operative and driver would still be responsible for reading through and checking the orders issued before handing over and acting on them. The terminal could be programmed only to issue orders at a minimum frequency and not to issue duplicated orders unless a special reset procedure was followed which would require a logged explanation to be typed, i.e. 'dog ate', 'tea spilt' or similar. A small UPS could be provided to ensure each terminal could continue to operate even during a local power failure. The physical token would remain as the primary directional interlocking mechanism, so the new order printing terminals would not need to demonstrate the same high level of processing integrity required of processor based interlockings systems.

 

[etr221]

In the incident, nobody followed what looks to be a very simple safety procedure. : Do not issue or accept a ticket without seeing the token first.

As it states on the ticket (see illustration): "Having been shown the tablet...." (my emphasis)

Something that I saw mentioned elsewhere, was a similar incident of gross abuse of Staff and Ticket procedures, but with rather more serious consequences, on the Zig Zag Railway in New South Wales in 2011: see http://www.otsi.nsw.gov.au/rail/Interim-Factual-Statement-Zig-Zag-Collision-2011-04-01.pdf .

I feel bound to wonder whether the RAIB has any communication with its corresponding bodies already to - perhaps as a minimum - exchange reports on, and hence lessons to learned from, incidents elsewhere, and so - hopefully - enhance safety round the world. Or whether each country learns its own lessons the hard way...

 

[Bletchleyite]

I feel bound to wonder whether the RAIB has any communication with its corresponding bodies already to - perhaps as a minimum - exchange reports on, and hence lessons to learned from, incidents elsewhere, and so - hopefully - enhance safety round the world. Or whether each country learns its own lessons the hard way...

Or doesn't learn. Germany still has single lines that have no protection bar the signalling, and people still die when signallers make a mistake and signal two trains onto the single line in opposite directions with no way to stop them once power has been taken and the cab gone past the offending signal. It's chilling.

 

[MarkyT]

Or doesn't learn. Germany still has single lines that have no protection bar the signalling, and people still die when signallers make a mistake and signal two trains onto the single line in opposite directions with no way to stop them once power has been taken and the cab gone past the offending signal. It's chilling.

To be fair the most recent German example you allude to had full 'track circuit block' type interlocking controls (using axle counters) without any physical tokens, just like many single track installations in UK. The danger was the complete override of all interlocking and train protection offered by the 'Ersatz' (substitute) signal Zs1, a concept invented in the 1920s, then widely applied to keep Nazi troops and supplies moving during WW2, but not appropriate in that form at all for a modern single track passenger railway.

 

[45669]

As it states on the ticket (see illustration): "Having been shown the tablet...." (my emphasis)

Something that I saw mentioned elsewhere, was a similar incident of gross abuse of Staff and Ticket procedures, but with rather more serious consequences, on the Zig Zag Railway in New South Wales in 2011: see http://www.otsi.nsw.gov.au/rail/Interim-Factual-Statement-Zig-Zag-Collision-2011-04-01.pdf .

Having had some experience as a volunteer on heritage railways, I find that report on the Zig-Zag Railway more than disturbing. How a railway could be operated in such a slip-shod fashion is completely beyond me.

Going back to the RHDR incident, I believe that on at least some railways the guard is also responsible for inspecting the staff as well as the driver and fireman. Thus a third pair of eyes can confirm that the driver not only has the staff, or token, but also that it is the correct one for the section ahead.

In my innocent way, I thought that keeping the tickets in a locked box which can only be opened by the key chained to the token would be foolproof. It never occurred to me that people would be so deviant that they would grab the opportunity to help themselves to a handful of tickets from an opened box and put them aside for future use! Sorry. I can't help being naive.

Would a divisible train staff overcome this? To unscrew the removable ticket end from the staff would require the presence of the actual complete staff and prevent incidents such as that a Romney Sands.

 

[Paul Hitchcock]

Would a divisible train staff overcome this? To unscrew the removable ticket end from the staff would require the presence of the actual complete staff and prevent incidents such as that a Romney Sands.

Itr would be a considerable improvement and I am surprised to see the written ticket procedure still in use.

 

[MarkyT]

Would a divisible train staff overcome this? To unscrew the removable ticket end from the staff would require the presence of the actual complete staff and prevent incidents such as that a Romney Sands.

It may be a traditional method, but I don't really like it as there's still plenty of room for human error. Sometimes a driver will be accepting either part of the staff as sole movement authority, and safety relies on him acknowledging seeing the main part of the staff just as they failed to do at New Romney. A more fundamental disadvantage is that only one train can follow in the same direction with a two part staff. Any more parts to allow more following trains would become ever more complex and risky to manage; how could you ensure reliably that ALL parts were reassembled correctly at one end before reversing direction? Perhaps you could have different threads on each part which couldn't allow the two end cap pieces to be joined together without all the intermediate parts also assembled.

Here's an interesting S&T training document covering single line working methods:
http://dickthesignals.co.uk/onewebmedia/9 operation of single lines.pdf

 

[Paul Hitchcock]

It may be a traditional method, but I don't really like it as there's still plenty of room for human error. Sometimes a driver will be accepting either part of the staff as sole movement authority, and safety relies on him acknowledging seeing the main part of the staff just as they failed to do at New Romney. A more fundamental disadvantage is that only one train can follow in the same direction with a two part staff. Any more parts to allow more following trains would become ever more complex and risky to manage; how could you ensure reliably that ALL parts were reassembled correctly at one end before reversing direction? Perhaps you could have different threads on each part which couldn't allow the two end cap pieces to be joined together without all the intermediate parts also assembled.

Here's an interesting S&T training document covering single line working methods:
http://dickthesignals.co.uk/onewebmedia/9 operation of single lines.pdf

What happened at Romney Sands could not have happened with a divisible staff as there would have been nothing to give the driver of the train heading to New Romney until the arrival of the train from there. The system in use adds to the possible dangers arising from foolishness.

 

[Meerkat]

As an outsider this sounds bad enough that there should be prosecutions. Either staff did something they knew to be wrong, and dangerous, or they were never trained properly.
It sounds a bit like an individual getting hauled up in court might be needed to concentrate some minds in the industry. This might help managements convince volunteers they really do need to do things properly (at a risk of scaring volunteers away)

 

[MarkyT]

What happened at Romney Sands could not have happened with a divisible staff as there would have been nothing to give the driver of the train heading to New Romney until the arrival of the train from there. The system in use adds to the possible dangers arising from foolishness.

Yes sorry, quite right. Brain fade there. Of course the complete staff would have had to arrive on the opposing train. With locked ticket box that SHOULD also be the case assuming no irregularities.

 

[MarkyT]

There are still some 'holes' in the divisible staff system. If the driver is offered the incomplete token part of the staff without the ticket part, that is perfectly legitimate, and would only normally occur if the the ticket portion had gone on ahead with a preceding train. It's possible though that the ticket portion could have been retained incorrectly and then offered alone to a subsequent following train. If the driver, also incorrectly, accepted it as movement authority without seeing the token part, then the risk of two in section could still be present, albeit possibly reduced as it would take more incorrect steps to get to the hazardous state. I expect the locked numbered ticket box system is probably as safe as reasonably practicable though, as long as proper training and supervision is undertaken.

 

[trebor79]

There are so many worrying factors here. One can understand a trainee, not familiar with the staff and ticket system, simply following instructions and doing what he was told by writing out the ticket. However, he could, indeed should, have double checked with the senior member of staff to see whether he was doing the right thing.

Perhaps the trainee simply didn't understand the implications of writing a ticket without having possession of the staff - if he hasn't been trained then why should he be expected to know of the potential consequences or understand that he ought to be seeking advice from someone else?

The RAIB report says in a very guarded way that the telephone conversation was confused. Perhaps the signaller should have asked the trainee to go and get someone qualified to speak to him.
I agree also that the station master and driver both ought to have checked the staff was present.

The RAIB report also gives me the impression that the whole operation is rather casual.

 

[45669]

I expect the locked numbered ticket box system is probably as safe as reasonably practicable though, as long as proper training and supervision is undertaken.

And somebody from 'The Management' makes frequent, but unannounced, spot check visits to signal boxes and stations with a pass key to the locked ticket boxes to check that none of the tickets are missing other than those used in a legitimate fashion. If the tickets are numbered in sequence and a record is kept so that those issued are accounted for, any missing tickets 'under the table' would be immediately obvious.

None of these safeguards are foolproof though. Apart from trap points, or a padlocked stop block in front of the train, there is nothing to stop a driver entering a single line section without a staff or token, and passing a stop signal at danger in the process. If Romney Sands separates two block sections, does it also have starter and home signals to control train movements does anybody know?

 

[Paul Hitchcock]

There are still some 'holes' in the divisible staff system. If the driver is offered the incomplete token part of the staff without the ticket part, that is perfectly legitimate, and would only normally occur if the the ticket portion had gone on ahead with a preceding train. It's possible though that the ticket portion could have been retained incorrectly and then offered alone to a subsequent following train. If the driver, also incorrectly, accepted it as movement authority without seeing the token part, then the risk of two in section could still be present, albeit possibly reduced as it would take more incorrect steps to get to the hazardous state. I expect the locked numbered ticket box system is probably as safe as reasonably practicable though, as long as proper training and supervision is undertaken.

I could almost believe you were associated with somewhere that used staff and written ticket! It is a pernicious system where, in the past, staff found that the supposedly locked ticket box was accessible in the absence of the train staff by judicious use of the poker from the stove. Divisible staff is a better system but no arrangement is perfect.

At Abermule, a more sophisticated system was used which was not proof against undertrained, undersupervised, junior staff and failure to carry out safety checks. These issues were present in the current instance, thankfully without a tragic outcome.

 

[45669]

Perhaps the trainee simply didn't understand the implications of writing a ticket without having possession of the staff - if he hasn't been trained then why should he be expected to know of the potential consequences or understand that he ought to be seeking advice from someone else?

The RAIB report says in a very guarded way that the telephone conversation was confused. Perhaps the signaller should have asked the trainee to go and get someone qualified to speak to him.
I agree also that the station master and driver both ought to have checked the staff was present.

The RAIB report also gives me the impression that the whole operation is rather casual.

Although it is pretty obvious that the trainee hadn't come across this situation before, the ticket does start with the words 'Having been shown the tablet coloured red...', so the trainee might have wondered whether it was o.k. to write out the ticket as he hadn't got a tablet coloured red to shown the driver. Clearly he didn't but, as I said before, he was only doing what he was told by a senior colleague - the signalman at New Romney. He, no doubt, assumed that the person to whom he was giving the message wold be fully aware of the fundamental requirement to actually have the tablet in his possession before carrying out the instruction.

But then, it can be dangerous to assume anything. All three of them assumed that the opposing train wasn't coming. Had one of them 'phoned the signalman at New Romney, they would have discovered that it was!

 

[MarkyT]

And somebody from 'The Management' makes frequent, but unannounced, spot check visits to signal boxes and stations with a pass key to the locked ticket boxes to check that none of the tickets are missing other than those used in a legitimate fashion. If the tickets are numbered in sequence and a record is kept so that those issued are accounted for, any missing tickets 'under the table' would be immediately obvious.

None of these safeguards are foolproof though. Apart from trap points, or a padlocked stop block in front of the train, there is nothing to stop a driver entering a single line section without a staff or token, and passing a stop signal at danger in the process. If Romney Sands separates two block sections, does it also have starter and home signals to control train movements does anybody know?

From the video here, it looks like stop boards protect the single lines at Romney Sands:

Possibly train operated points for the loop, with a points indicator on approach? In the video, the tablet is exchanged directly between the drivers and station staff actions are interesting. It looks like they may be preparing a ticket on the platform, or they could be making movement entries in a register This was filmed less than two weeks before the incident.

 

[MarkyT]

I could almost believe you were associated with somewhere that used staff and written ticket!

No no no! Strictly electric key token working with long and short section switching!

 

[Paul Hitchcock]

From the video here, it looks like stop boards protect the single lines at Romney Sands:

Possibly train operated points for the loop, with a points indicator on approach? In the video, the tablet is exchanged directly between the drivers and station staff actions are interesting. It looks like they may be preparing a ticket on the platform, or they could be making movement entries in a register This was filmed less than two weeks before the incident.

Very interesting. I wonder if was originally a one engine in steam token for the Dungeness section which has a written ticket system "bolted on" at some time.

 

[Fireless]

Germany still has single lines that have no protection bar the signalling, and people still die when signallers make a mistake and signal two trains onto the single line in opposite directions with no way to stop them once power has been taken and the cab gone past the offending signal.

The accident sounds very much like the one that happened at Dahlerau in 1971 (https://en.wikipedia.org/wiki/Dahlerau_train_disaster) where the signalman was left with no other option than calling the emergency services telling them that a fatal colision was about to happen.

A key consequence of that accident was making radio communication systems the norm on the german railways.
The "big railway" (DB Netz infrastructure) is nowadays pretty much completely covered by GSM-R.

A consequence of the Bad Aibling accident (https://en.wikipedia.org/wiki/Bad_Aibling_rail_accident) where the signaller overrode the safety systems by using Zs1 and failed to place the correct GSM-R emergency call in time was both to simplify the procedure of making the right railway emergency group call (from various options towards "big red buttons") and appropriate training and competency management.

 

[dgl]

Going on from the RFID idea, fit a chip inside the train staff if possible and have it on a timed system where use of the RFID system print off a ticket, but only 1 within a certain length of time to stop someone just issuing a lot at one time. Of if a simpler system is required then have a similar system but it is the key that either activated the printer or opens the box where the necessary controls to operate the printer are located.
As for designing such a system a serial printer would be easy to link a microcontroller (picAXE or similar would do) and generate a time stamped ticket using simple BASIC programming.

 

[Llanigraham]

And somebody from 'The Management' makes frequent, but unannounced, spot check visits to signal boxes and stations with a pass key to the locked ticket boxes to check that none of the tickets are missing other than those used in a legitimate fashion. If the tickets are numbered in sequence and a record is kept so that those issued are accounted for, any missing tickets 'under the table' would be immediately obvious.

None of these safeguards are foolproof though. Apart from trap points, or a padlocked stop block in front of the train, there is nothing to stop a driver entering a single line section without a staff or token, and passing a stop signal at danger in the process. If Romney Sands separates two block sections, does it also have starter and home signals to control train movements does anybody know?

The other thing that I can find no mention of is entries in the TRB. Recording the number of the Ticket, and the time that it was issued, plus details of the Tablet exchange, would give another checking level.
It was always stressed to us that the TRB is a legal document and had to be completed in full at ALL times.

 

[Tomnick]

Are these rather ambitious solutions really necessary, or are they solutions looking for a problem? There's a clear distinction between someone making an error through confusion, poor training (or poor supervision), not following procedure or whatever, and someone deliberately seeking to defeat the system. Locking the ticket box with a key attached to the staff/tablet is a straightforward way of ensuring that the staff has to be present to obtain a ticket from the box. Yes, there's the opportunity to defeat the system by grabbing a handful of tickets and leaving them on the desk, but there's far bigger problems to worry about if you've got people who are willing to do that (to achieve what?). There was certainly slack working evident here, but no indication that anyone was deliberately seeking to circumvent the inherent safety features.

 

[Randomer]

Interesting that RAIB used Abermule as the previous example. Does anyone know of any similar incidents or accidents that have occurred more recently prior to the RHDR incident?

Also the report from the Australian example is absolutely appalling in terms of anyone running a railway with passengers with disregard for fairly simple rules. Especially giving the operations manager (who was also the driver the ability to completely suspend the rule book for operational expediency in case of delay!

On a happier note I'm amused that they employed somebody with the actual job title of "Trainee Fettler" and that such an employment made it into the report.

 

[MarkyT]

Going on from the RFID idea, fit a chip inside the train staff if possible and have it on a timed system where use of the RFID system print off a ticket, but only 1 within a certain length of time to stop someone just issuing a lot at one time. Of if a simpler system is required then have a similar system but it is the key that either activated the printer or opens the box where the necessary controls to operate the printer are located.
As for designing such a system a serial printer would be easy to link a microcontroller (picAXE or similar would do) and generate a time stamped ticket using simple BASIC programming.

A mobile hand held unit perhaps. Put tags on locos too. The platform staff procedure would be to go and meet the driver, as shown in the video above. Beep the loco, beep the token, print the ticket for one movement only of that engine through the section in the stated direction, both read, check and understand the orders detailed on the ticket and make sure the driver acknowledges the station operative is retaining the token. Dispatch train as normal.

 

[Re 4/4]

How close a call was this - what's the braking distance of those trains?