However, what stands out for me is the part played by the "grandfather rights" accorded to the legacy BR-era design of point machine. It seems that the replacement point machine was supplied with no technical documentation, nor warnings that the internal wiring would require modification for safe operation in a double-ended point installation. Removal of the unwanted jumper wire, which was the same colour as the other internal wires, would have required the factory-fitted cable ties to be cut off the internal wiring harness of the machine. Yet this type of point machine only had a single catalogue number to cover both of the two incompatible wiring configurations.
Very true. While it is easy to say "they should have checked" it is also worth asking, "why wasn't it made obvious?"
I also wonder if the move towards "plug and play" technology might have played a part. Both on and off the railway the trend is for things to just be replaced, rather than taking something apart for an internal repair or alteration. It would also be interesting to know whether the different possible configurations in the training material for those point machines. In the courses for other configurable equipment quite a bit of emphasis was made on the fact that it can be set up in different ways and that
you must check. The SMTH states that a tester must "check that any configurable wiring or straps internal to the replacement item are correct", but when was the last time that they were made aware that the wiring was configurable in this manner?
This sounds as though a fault in a single wire (as well as the situation described above) can make points move under a train. Surely another wire from a fpl lever would be a good idea? How can a fpl be fail-safe if just trying to power the points back is enough to make them move?
The purpose of the FPL is to provide a mechanical means of ensuring that once the points are driven over to one position that they remain in that position until required otherwise. It means that you are no longer relying on positive pressure being applied to the points to prevent movement. You could strip everything else out of the point machine (motor, gears, drive rod, etc) and the points would not move as long as the FPL remained in place. It is the purpose of the interlocking to prevent the points from being moved under a train.
In any case, "another wire from an FPL lever" wouldn't really prevent the possibility of the motor becoming incorrectly energised due to a fault. The interlocking already prevents a signaller from calling a set of points under a train, so the risk of the scenario you describe really comes from a false feed to the motor.
As with most safety critical circuits the feed to the motor, and all the circuitry between the signallers' controls and the motor, is double cut. This means that there are contacts of the controlling relays present in both the positive and negative legs of the circuit. This means that one single fault won't falsely operate the circuit, two faults would need to occur to cause a fault scenario. It's not impossible, but providing things are maintained correctly to identify any developing faults (earth monitoring etc), and equipment is installed and tested correctly the risk is very small. Signalling circuits are very cleverly designed in this regard. The need for things to be tested correctly is vital though, which is why this report is so scary. The flaw at Dalwhinnie was not a deficiency in the design of the circuit, but a deficiency in the installation matching the designed circuit.
Yes at first glance I thought it unlikely that the crossover wouldn’t have been used for 9 months however the report shows that the crossover is only used for moves from the down to the up line when a disabled passenger wishes to alight at Dalwhinnie. The crossover cannot be used for moves from the up line to the down line so its use will be very infrequent.
The issue would not be apparent until a failure which caused one end not to move at all (and thus not loose detection) but the other end to complete its travel. Had the points managed to move at all then they would have correctly shown as being "out of correspondence". It's probably more typical for a point machine to manage to move at least partway before failing, but failures where they don't move at all isn't unusual, as we've seen and read here. With a typical maintenance regime the points would have been moved at least 2-3 times between the installation and the incident, but I suspect that they would have been operated more times than this.
