Should train protection be provided at every signal?

[DerekC]

Moderator note: Split from

Report of collision Bedford (Elstow) - 19/06/26

Hearing reports of a collision between two trains at Bedford with one train now derailed

www.railforums.co.uk

It's very clear that this is the accident that has been waiting to happen ever since the decision was made to fit TPWS only at high risk signals. That decision was right in cost effectiveness terms, but there was never any doubt that one day the holes in the Swiss cheese would line up.

Finding out what the contributory causes were, to the extent that that is possible, is of course highly necessary and the Final Report will bring them out, but addressing them can only mitigate the risk to a minor extent.

One death is a tragedy, but it's already clear that the fact that the toll was so small is down to the vastly improved crashworthiness of trains and to luck combined with prompt action by train crew. There will undoubtedly be recommendations to mitigate the consequential risk as well - and some ideas have been discussed on this thread already.

It will be very interesting to see what the recommendations say about the fundamental problem of providing train protection at every signal.

 

[InvernessTMD]

It will be very interesting to see what the recommendations say about the fundamental problem of providing train protection at every signal.

Also, possibly about the inclusion of a "nosecone" to take the brunt of the impact in the event of an accident - the flat fronted Desiro is obviously and tragically much, much worse off in the collision with the 810. Would a collision between two 810s both with long bonnets to absorb some of the energy and crush less of the cab have changed the outcome?

 

[hexagon789]

Also, possibly about the inclusion of a "nosecone" to take the brunt of the impact in the event of an accident - the flat fronted Desiro is obviously and tragically much, much worse off in the collision with the 810. Would a collision between two 810s both with long bonnets to absorb some of the energy and crush less of the cab have changed the outcome?

Quite possibly, but there is also the aspect that simply the two train types will be to different crash regs.

Even discounting age, the threshold for greater energy absorption comes in at 190km/h (118mph), so on basic principles you'd expect the 810 to fare much better as it should be designed to the higher standard for higher speeds.

 

[Annetts key]

Apologies I don’t think I was fully clear. I meant a last-minute reaction to the red aspect, not the train ahead. IMV this seems the unusual element to it, unless there’s something about the signal sighting that we don’t yet know.

My first reaction to this accident was thinking that the 810 might have stopped close to the limit of the overlap, and the 360 didn’t have enough railway to stop. I was somewhat surprised when it emerged the 360 had travelled some way further south than that. That would be a far more logical, if unlucky, scenario.

== Doublepost prevention - post automatically merged: Saturday at 20:12 ==



If it’s the case that the driver was looking at it, for this to be the case I’d have thought it would then have to require there to be some deficiency with the signal, either in terms of its sighting, position or performance.

It’s an interesting discussion, and there is no doubt a lot still to emerge. Suspect we may never fully know the answer, unless RAIB manage to find something that gives a strong clue.

I wouldn’t be surprised this could end up being one of those incidents where even RAIB are only able to go as far as offering possibilities.

What we probably can say is that acknowledging the AWS doesn’t really tell us much apart from that the driver was conscious, as there’s a history of incidents where AWS warnings have been acknowledged in this way.

There may have been a deficiency with the signal, but I would expect the RAIB to examine the CCTV carefully to determine if the red aspect of the signal was sufficiency visable.
We know it was at least lit, because they would have reported it it wasn't. If the signalling failed to detect sufficient electrical current being used by the signal (indicating that it was lit) then the previous signal (here the junction signal) would not have shown a proceed aspect.

In any event, in daylight, when it's easier to see a signal that has a defect, if an signal aspect has a deficiency, drivers are supposed to treat it as a red and stop and report the problem.

It's very clear that this is the accident that has been waiting to happen ever since the decision was made to fit TPWS only at high risk signals. That decision was right in cost effectiveness terms, but there was never any doubt that one day the holes in the Swiss cheese would line up.

Finding out what the contributory causes were, to the extent that that is possible, is of course highly necessary and the Final Report will bring them out, but addressing them can only mitigate the risk to a minor extent. One death is a tragedy, but it's already clear that the fact that the toll was so small is down to the vastly improved crashworthiness of trains and to luck combined with prompt action by train crew. There will undoubtedly be recommendations to mitigate the consequential risk as well - and some ideas have been discussed on this thread already.

It will be very interesting to see what the recommendations say about the fundamental problem of providing train protection at every signal.

Hmm, do I need to mention that this is one of the reasons that the inquiry into the Clapham Rail Disaster recommended fitment of ATP. But it was decided not to fit this beyond the pilot schemes.
And that TPWS was supposed to be a stop gap solution that could be quickly fitted with ERTMS/ETCS being rolled out over the following years. But the percentage of railway actually provided with ERTMS/ETCS is pitifully small..

 

[edwin_m]

Hmm, do I need to mention that this is one of the reasons that the inquiry into the Clapham Rail Disaster recommended fitment of ATP.

Despite the fact that ATP wouldn’t have prevented Clapham.

 

[Taunton]

Despite the fact that ATP wouldn’t have prevented Clapham.

Such inconsistent conclusions were an unfortunate by-product of non-railway judges being appointed to handle major accident enquiries.

 

[Tester]

Such inconsistent conclusions were an unfortunate by-product of non-railway judges being appointed to handle major accident enquiries.

Sadly a prima facie example of 'something must be done'.

I was involved in certifying that the signalling could be restored to service after the accident, so am painfully aware of what was, and was not, relevant.

 

[bramling]

Sadly a prima facie example of 'something must be done'.

I was involved in certifying that the signalling could be restored to service after the accident, so am painfully aware of what was, and was not, relevant.

It’s depressing as a lot of time was spent worrying about ATP in the 90s when the time could instead have been spent developing TPWS. Realistically Ladbroke Grove, Cowden and Newton could have been prevented by a TPWS-type system, and maybe Southall and Watford.

 

[edwin_m]

It’s depressing as a lot of time was spent worrying about ATP in the 90s when the time could instead have been spent developing TPWS. Realistically Ladbroke Grove, Cowden and Newton could have been prevented by a TPWS-type system, and maybe Southall and Watford.

Agreed. For information it was sometime in 1994 that work got under way on looking at SPAD reduction and mitigation measures (short of ATP) and by the time of Ladbroke Grove TPWS was developed but awaiting government sign-off of the funding.

 

[Taunton]

It’s depressing as a lot of time was spent worrying about ATP in the 90s when the time could instead have been spent developing TPWS. Realistically Ladbroke Grove, Cowden and Newton could have been prevented by a TPWS-type system, and maybe Southall and Watford.

If it comes to that, a significant number of accidents could have been prevented, quite possibly this one, if the Southern Region's 1970 innovation of Signal Repeating AWS, as installed as a trial between Bournemouth and Southampton, where the driver had to acknowledge the particular setting of any restrictive aspect, rather than just generally cancelling, would have been developed and rolled out, apparently squelched by BR HQ on a "not invented here" attitude.

 

[Annetts key]

Despite the fact that ATP wouldn’t have prevented Clapham.

Such inconsistent conclusions were an unfortunate by-product of non-railway judges being appointed to handle major accident enquiries.

No, the type of ATP selected by BR wouldn’t have prevented Clapham. Other recommendations were made in respect of this. I have read the whole report twice (once when I first got to see a copy many, many years ago and again in the 1990s) and I thought that the vast majority was reasonable.

There were a total of 93 recommendations covering a lot of subjects including BR management and processes and crash worthiness of trains.

In relation to ATP there were just two:

46. The Court welcomes BR’s commitment to introduce Automatic Train Protection on a large percentage of it’s network, but is concerned at the timetable proposed. After the specific type of ATP system has been selected, ATP shall be fully implemented within 5 years, with a high priority given to densely trafficked lines.

47. BR shall report at 6 monthly intervals to the Railway Inspectorate on it’s progress in implementing ATP.

In paragraph 14.27 of the report it says that the Chief Inspecting Officer of Railways in his annual report for 1985 called on BR to consider a form of ATP.

In a meeting in November 1988, it was agreed that a version of ATP should be introduced.

The train crash at Clapham occurred on Monday 12th December 1988

BR announced trials of ATP in March 1989.

The report goes into some detail in paragraphs 14.27 to 14.31 and 15.8 to 15.19 including discussing costs, types of ATP and the fact that an "intermittent" ATP as proposed by BR as being the most practical would not and could not have prevented the crash at Clapham. A more expensive and impractical (for fitting to existing signalling/lines) could have prevented the crash at Clapham.

My point is that better technology exists than TPWS that is far better at preventing or better at mitigating train crashes caused by one train hitting another on the same line or converging lines (plus the other safety advantages such as preventing excessive speed over points or other S&C and on curves).

But as I have expected for a considerable number of years, eventually the Swiss cheese model holes lined up and there was no safety system to prevent a preventable accident from occurring.

Now, just to be clear, we are long past ATP of the form used on the pilot schemes being practical as they are obsolete.

What I think should happen is that the government, Network Rail and once it becomes law, GBR should move far faster in rolling out ERTMS/ETCS across the fast, busy / densely trafficked lines.

 

[Taunton]

Now, just to be clear, we are long past ATP of the form used on the pilot schemes being practical as they are obsolete.

It's a bit difficult to both advocate ATP, and then to regard the two installations as obsolete, from not having been worthwhile to continue. Let alone that both Southall and Ladbroke Grove occurred on the one main line fitted with it, because the operators saw no value in using it.

 

[Annetts key]

It’s depressing as a lot of time was spent worrying about ATP in the 90s when the time could instead have been spent developing TPWS. Realistically Ladbroke Grove, Cowden and Newton could have been prevented by a TPWS-type system, and maybe Southall and Watford.

Agreed. For information it was sometime in 1994 that work got under way on looking at SPAD reduction and mitigation measures (short of ATP) and by the time of Ladbroke Grove TPWS was developed but awaiting government sign-off of the funding.

ATP predates TPWS by many years.

ATP as I have said before proves better and more comprehensive protection and mitigation compared to TPWS.

Part of the reason that TPWS was less expensive is because the majority of signals are not fitted with TPWS.

At least on the GWML ATP system, ATP using just a signal beacon and an in-fill beacon (no infill loop) requires less maintenance compared to TPWS with OSS. Testing the ATP is quicker.

For TPWS, each additional set of loops (racks) per signal such as OSS+ further increases the resources needed for maintenance.

The GWML ATP is a both a safety critical system and a fail safe system. If an ATP fitted train does not receive a valid message where the on-train computer expects to receive it (so the beacon is not transmitting a valid message for any reason), it generates an alarm and fault code to the driver.

TPWS in comparison only transmits a simple single frequency signal on each loop. It's possible for therefore for the loop to be working as far as the signalling system is concerned, but not be in the correct position that the signal can be revived by a train.

On the area where I worked, for infrastructure failures, we had far more TPWS failures compared to the number of ATP failures respective to the number of systems fitted for each system.

We can play what if till the cows come home, but my fundamental point is that 40 years after ATP was first discussed by BR, and 37 years after ATP pilot schemes were agreed. We still don't have a comprehensive train protection system.

== Doublepost prevention - post automatically merged: Yesterday at 13:51 ==

It's a bit difficult to both advocate ATP, and then to regard the two installations as obsolete, from not having been worthwhile to continue. Let alone that both Southall and Ladbroke Grove occurred on the one main line fitted with it, because the operators saw no value in using it.

I'm not advocating that ATP (the obsolete designs or indeed any brand new design) be fitted. I'm advocating that the U.K. dramatically speed up the fitment of ERTMS/ETCS.

The government did not want to spend the money expanding ATP across the country.

The reason that First did not consider ATP beneficial is in the transcript of the relevant inquiry. But then, it doesn't appear that back then they took the on-train AWS reliability as important as they should have either. One can only imagine if TPWS was in use back then if it would have been viewed similarly.

If the accidents at Southall and Ladbroke Grove had not occurred, do you think TPWS fitment would have been as widespread as it is today?

The government and the railway had to not only do something, but also be seen to do something.

 

[Harpo]

On ETCS deployment, let’s not forget that it didn’t stop Talerddig.

 

[westcoaster]

On ETCS deployment, let’s not forget that it didn’t stop Talerddig.

Neither would ATP or TPWS, due to the railhead conditions. The only thing in my mind that would of mitigated the collision would have been a set of trap points to derail the unit.

 

[bramling]

No, the type of ATP selected by BR wouldn’t have prevented Clapham. Other recommendations were made in respect of this. I have read the whole report twice (once when I first got to see a copy many, many years ago and again in the 1990s) and I thought that the vast majority was reasonable.

There were a total of 93 recommendations covering a lot of subjects including BR management and processes and crash worthiness of trains.

In relation to ATP there were just two:


In paragraph 14.27 of the report it says that the Chief Inspecting Officer of Railways in his annual report for 1985 called on BR to consider a form of ATP.

In a meeting in November 1988, it was agreed that a version of ATP should be introduced.

The train crash at Clapham occurred on Monday 12th December 1988

BR announced trials of ATP in March 1989.

The report goes into some detail in paragraphs 14.27 to 14.31 and 15.8 to 15.19 including discussing costs, types of ATP and the fact that an "intermittent" ATP as proposed by BR as being the most practical would not and could not have prevented the crash at Clapham. A more expensive and impractical (for fitting to existing signalling/lines) could have prevented the crash at Clapham.

My point is that better technology exists than TPWS that is far better at preventing or better at mitigating train crashes caused by one train hitting another on the same line or converging lines (plus the other safety advantages such as preventing excessive speed over points or other S&C and on curves).

But as I have expected for a considerable number of years, eventually the Swiss cheese model holes lined up and there was no safety system to prevent a preventable accident from occurring.

Now, just to be clear, we are long past ATP of the form used on the pilot schemes being practical as they are obsolete.

What I think should happen is that the government, Network Rail and once it becomes law, GBR should move far faster in rolling out ERTMS/ETCS across the fast, busy / densely trafficked lines.

I’ve never understood why ATP should have been anything other than a nice-to-have as a result of Clapham. ATP is designed to ensure drivers react correctly to signals, which was not an issue at Clapham. The issue was that the signalling system was wired up incorrectly. Nothing to do with how the trains were being driven.

ATP isn’t infallible to errors, as we saw with the Cambrian incident when all the speed restrictions disappeared.

Then we come to Cowden, which would almost certainly have been prevented by a TPWS-type system.

I seem to remember some hysteria from one of the lawyers in the aftermath of Ladbroke Grove who was arguing that TPWS was an unacceptable inadequate substitute for an ATP system. I have no doubt that had TPWS not been prioritised then we probably would have little if any ATP by now, and likely a few fatal accidents would have happened in the interim.

 

[HSTEd]

Neither would ATP or TPWS, due to the railhead conditions. The only thing in my mind that would of mitigated the collision would have been a set of trap points to derail the unit.

Magnetic track brakes would probably have substantially mitigated or prevented the collision by substantially increasing the brake force available, even in low adhesion conditions. The brakes tend to scrub the rail and improve adhesion for following wheelsets, as well as generating significant braking force themselves.

More generally, I am of the view that we now have multiple units way more performant than ones that existed in the past, which has produced new emergent risks.
I think calculation has probably changed since the last serious work on ATP was done at the time TPWS was developed and deployed.

 

[fishwomp]

[..]
The reason that First did not consider ATP beneficial is in the transcript of the relevant inquiry. But then, it doesn't appear that back then they took the on-train AWS reliability as important as they should have either. One can only imagine if TPWS was in use back then if it would have been viewed similarly.
[..]

At Ladbroke Grove (October 1999), it was Thames Trains's 165, owned by Go Ahead.
If you were talking about Southall (Sept 1997) - that was Great Western Trains - which was only 24% owned by First Group at that time, 51% by ex-BR management. It was wholly acquired by First Group in 1998 - so it was First Group giving evidence.

Reading both Southall and Ladbroke Grove inquiry reports - it's clear ATP wasn't getting used nearly enough even where fitted.. which meant Thames Train's decision was not unexpected.

The Ladbroke Grove inquiry( https://www.jesip.org.uk/wp-content/uploads/2022/03/Ladbroke-Grove-Rail-Inquiry-Report-Part-1.pdf ) wrote:

Equipment problems combined with deficiencies in driver training and, seemingly, a less than committed management drive, meant that the system was operational for at best less than 30% of the time in the period up to August 1997.

The Southall service set out with non-functional AWS, and the ATP was isolated as the driver was not trained to use it. The driver went through two reds, whilst distracted by packing a bag: AWS would most certainly have prevented that. He was never prosecuted (http://news.bbc.co.uk/1/hi/uk/384011.stm) due to the psychological damage of the accident on him. GWR got a health and safety fine. Attitudes / rules of non-functional AWS were very, very quickly changed.

 

[edwin_m]

ATP predates TPWS by many years.

ATP as I have said before proves better and more comprehensive protection and mitigation compared to TPWS.

Part of the reason that TPWS was less expensive is because the majority of signals are not fitted with TPWS.

At least on the GWML ATP system, ATP using just a signal beacon and an in-fill beacon (no infill loop) requires less maintenance compared to TPWS with OSS. Testing the ATP is quicker.

For TPWS, each additional set of loops (racks) per signal such as OSS+ further increases the resources needed for maintenance.

The GWML ATP is a both a safety critical system and a fail safe system. If an ATP fitted train does not receive a valid message where the on-train computer expects to receive it (so the beacon is not transmitting a valid message for any reason), it generates an alarm and fault code to the driver.

TPWS in comparison only transmits a simple single frequency signal on each loop. It's possible for therefore for the loop to be working as far as the signalling system is concerned, but not be in the correct position that the signal can be revived by a train.

These factors were well understood at the time TPWS was developed. It was predicted to address about 80% of the ATP-preventable risk at a much lower cost and be capable of more rapid implementation because the TPWS on-train equipment was designed to replace and incorporate the existing AWS system. Experience has broadly borne this out.

I'm not advocating that ATP (the obsolete designs or indeed any brand new design) be fitted. I'm advocating that the U.K. dramatically speed up the fitment of ERTMS/ETCS.

The government did not want to spend the money expanding ATP across the country.

The reason that First did not consider ATP beneficial is in the transcript of the relevant inquiry. But then, it doesn't appear that back then they took the on-train AWS reliability as important as they should have either. One can only imagine if TPWS was in use back then if it would have been viewed similarly.

Any system that isn't used isn't effective, so fitting a more sophisticated system that also isn't used doesn't deliver any benefit. ETCS, when used "signals away", is different from TPWS and ATP, in that the train can't run unless the system is operational and in use.

TPWS, if fitted an in use, would have prevented Ladbroke Grove. TPWS or even AWS, if fitted and in use, would have prevented Southall. So neither of these is a justification to fit ATP rather than TPWS. The absence of severe SPAD-related accidents from when TPWS was fitted up until Elstow demonstrates how little extra safety benefit ATP would have delivered, had it even been possible to fit it in the same timescales as TPWS.

Hence, the safety justification to fit ATP just isn't there. ETCS is justified by cost savings from needing less equipment (with a big question mark over whether these will actually be realised) with the safety benefit being only a small part of the justification.

 

[bramling]

These factors were well understood at the time TPWS was developed. It was predicted to address about 80% of the ATP-preventable risk at a much lower cost and be capable of more rapid implementation because the TPWS on-train equipment was designed to replace and incorporate the existing AWS system. Experience has broadly borne this out.

Any system that isn't used isn't effective, so fitting a more sophisticated system that also isn't used doesn't deliver any benefit. ETCS, when used "signals away", is different from TPWS and ATP, in that the train can't run unless the system is operational and in use.

TPWS, if fitted an in use, would have prevented Ladbroke Grove. TPWS or even AWS, if fitted and in use, would have prevented Southall. So neither of these is a justification to fit ATP rather than TPWS. The absence of severe SPAD-related accidents from when TPWS was fitted up until Elstow demonstrates how little extra safety benefit ATP would have delivered, had it even been possible to fit it in the same timescales as TPWS.

Hence, the safety justification to fit ATP just isn't there. ETCS is justified by cost savings from needing less equipment (with a big question mark over whether these will actually be realised) with the safety benefit being only a small part of the justification.

Probably the most salient question to be asked a result of Elstow would be whether it would be worthwhile to devise some kind of requirement to include TPWS at the first signal after a converging junction, which would capture the “single yellow at the junction, next signal unexpectedly remains on” scenario.

Just thinking of King’s Cross to Peterborough (purely as that’s a section I am very familiar with) it would likely mean a fair few signals requiring fitment.

 

[edwin_m]

Probably the most salient question to be asked a result of Elstow would be whether it would be worthwhile to devise some kind of requirement to include TPWS at the first signal after a converging junction, which would capture the “single yellow at the junction, next signal unexpectedly remains on” scenario.

Just thinking of King’s Cross to Peterborough (purely as that’s a section I am very familiar with) it would likely mean a fair few signals requiring fitment.

I think that would be difficult to justify - noting that the Elstow report says that the accident train was the first in 2026 to approach the accident signal at red. These should be low risk signals as almost always trains are accelerating away from the junction or passing through at high speed.

What I think is more relevant here is the approach control sequence, being discussed on one of the other threads. If the junction signal had normally cleared to green well in time for the driver to see it and before the AWS magnet, then the fact it remained yellow on this occasions would have been more prominent. This does raise the issue of a failure to observe the route indicator as in the ECML incidents, but in advance of ETCS I believe a route-sensitive TPWS overspeed sensor at the junction signal would be a more effective overall risk mitigation than fitting a TPWS at the signal after.