Should train protection be provided at every signal?

[DerekC]

Moderator note: Split from

Report of collision Bedford (Elstow) - 19/06/26

Hearing reports of a collision between two trains at Bedford with one train now derailed

www.railforums.co.uk

It's very clear that this is the accident that has been waiting to happen ever since the decision was made to fit TPWS only at high risk signals. That decision was right in cost effectiveness terms, but there was never any doubt that one day the holes in the Swiss cheese would line up.

Finding out what the contributory causes were, to the extent that that is possible, is of course highly necessary and the Final Report will bring them out, but addressing them can only mitigate the risk to a minor extent.

One death is a tragedy, but it's already clear that the fact that the toll was so small is down to the vastly improved crashworthiness of trains and to luck combined with prompt action by train crew. There will undoubtedly be recommendations to mitigate the consequential risk as well - and some ideas have been discussed on this thread already.

It will be very interesting to see what the recommendations say about the fundamental problem of providing train protection at every signal.

 

[InvernessTMD]

It will be very interesting to see what the recommendations say about the fundamental problem of providing train protection at every signal.

Also, possibly about the inclusion of a "nosecone" to take the brunt of the impact in the event of an accident - the flat fronted Desiro is obviously and tragically much, much worse off in the collision with the 810. Would a collision between two 810s both with long bonnets to absorb some of the energy and crush less of the cab have changed the outcome?

 

[hexagon789]

Also, possibly about the inclusion of a "nosecone" to take the brunt of the impact in the event of an accident - the flat fronted Desiro is obviously and tragically much, much worse off in the collision with the 810. Would a collision between two 810s both with long bonnets to absorb some of the energy and crush less of the cab have changed the outcome?

Quite possibly, but there is also the aspect that simply the two train types will be to different crash regs.

Even discounting age, the threshold for greater energy absorption comes in at 190km/h (118mph), so on basic principles you'd expect the 810 to fare much better as it should be designed to the higher standard for higher speeds.

 

[Annetts key]

Apologies I don’t think I was fully clear. I meant a last-minute reaction to the red aspect, not the train ahead. IMV this seems the unusual element to it, unless there’s something about the signal sighting that we don’t yet know.

My first reaction to this accident was thinking that the 810 might have stopped close to the limit of the overlap, and the 360 didn’t have enough railway to stop. I was somewhat surprised when it emerged the 360 had travelled some way further south than that. That would be a far more logical, if unlucky, scenario.

== Doublepost prevention - post automatically merged: Saturday at 20:12 ==



If it’s the case that the driver was looking at it, for this to be the case I’d have thought it would then have to require there to be some deficiency with the signal, either in terms of its sighting, position or performance.

It’s an interesting discussion, and there is no doubt a lot still to emerge. Suspect we may never fully know the answer, unless RAIB manage to find something that gives a strong clue.

I wouldn’t be surprised this could end up being one of those incidents where even RAIB are only able to go as far as offering possibilities.

What we probably can say is that acknowledging the AWS doesn’t really tell us much apart from that the driver was conscious, as there’s a history of incidents where AWS warnings have been acknowledged in this way.

There may have been a deficiency with the signal, but I would expect the RAIB to examine the CCTV carefully to determine if the red aspect of the signal was sufficiency visable.
We know it was at least lit, because they would have reported it it wasn't. If the signalling failed to detect sufficient electrical current being used by the signal (indicating that it was lit) then the previous signal (here the junction signal) would not have shown a proceed aspect.

In any event, in daylight, when it's easier to see a signal that has a defect, if an signal aspect has a deficiency, drivers are supposed to treat it as a red and stop and report the problem.

It's very clear that this is the accident that has been waiting to happen ever since the decision was made to fit TPWS only at high risk signals. That decision was right in cost effectiveness terms, but there was never any doubt that one day the holes in the Swiss cheese would line up.

Finding out what the contributory causes were, to the extent that that is possible, is of course highly necessary and the Final Report will bring them out, but addressing them can only mitigate the risk to a minor extent. One death is a tragedy, but it's already clear that the fact that the toll was so small is down to the vastly improved crashworthiness of trains and to luck combined with prompt action by train crew. There will undoubtedly be recommendations to mitigate the consequential risk as well - and some ideas have been discussed on this thread already.

It will be very interesting to see what the recommendations say about the fundamental problem of providing train protection at every signal.

Hmm, do I need to mention that this is one of the reasons that the inquiry into the Clapham Rail Disaster recommended fitment of ATP. But it was decided not to fit this beyond the pilot schemes.
And that TPWS was supposed to be a stop gap solution that could be quickly fitted with ERTMS/ETCS being rolled out over the following years. But the percentage of railway actually provided with ERTMS/ETCS is pitifully small..

 

[edwin_m]

Hmm, do I need to mention that this is one of the reasons that the inquiry into the Clapham Rail Disaster recommended fitment of ATP.

Despite the fact that ATP wouldn’t have prevented Clapham.

 

[Taunton]

Despite the fact that ATP wouldn’t have prevented Clapham.

Such inconsistent conclusions were an unfortunate by-product of non-railway judges being appointed to handle major accident enquiries.

 

[Tester]

Such inconsistent conclusions were an unfortunate by-product of non-railway judges being appointed to handle major accident enquiries.

Sadly a prima facie example of 'something must be done'.

I was involved in certifying that the signalling could be restored to service after the accident, so am painfully aware of what was, and was not, relevant.

 

[bramling]

Sadly a prima facie example of 'something must be done'.

I was involved in certifying that the signalling could be restored to service after the accident, so am painfully aware of what was, and was not, relevant.

It’s depressing as a lot of time was spent worrying about ATP in the 90s when the time could instead have been spent developing TPWS. Realistically Ladbroke Grove, Cowden and Newton could have been prevented by a TPWS-type system, and maybe Southall and Watford.

 

[edwin_m]

It’s depressing as a lot of time was spent worrying about ATP in the 90s when the time could instead have been spent developing TPWS. Realistically Ladbroke Grove, Cowden and Newton could have been prevented by a TPWS-type system, and maybe Southall and Watford.

Agreed. For information it was sometime in 1994 that work got under way on looking at SPAD reduction and mitigation measures (short of ATP) and by the time of Ladbroke Grove TPWS was developed but awaiting government sign-off of the funding.

 

[Taunton]

It’s depressing as a lot of time was spent worrying about ATP in the 90s when the time could instead have been spent developing TPWS. Realistically Ladbroke Grove, Cowden and Newton could have been prevented by a TPWS-type system, and maybe Southall and Watford.

If it comes to that, a significant number of accidents could have been prevented, quite possibly this one, if the Southern Region's 1970 innovation of Signal Repeating AWS, as installed as a trial between Bournemouth and Southampton, where the driver had to acknowledge the particular setting of any restrictive aspect, rather than just generally cancelling, would have been developed and rolled out, apparently squelched by BR HQ on a "not invented here" attitude.

 

[Annetts key]

Despite the fact that ATP wouldn’t have prevented Clapham.

Such inconsistent conclusions were an unfortunate by-product of non-railway judges being appointed to handle major accident enquiries.

No, the type of ATP selected by BR wouldn’t have prevented Clapham. Other recommendations were made in respect of this. I have read the whole report twice (once when I first got to see a copy many, many years ago and again in the 1990s) and I thought that the vast majority was reasonable.

There were a total of 93 recommendations covering a lot of subjects including BR management and processes and crash worthiness of trains.

In relation to ATP there were just two:

46. The Court welcomes BR’s commitment to introduce Automatic Train Protection on a large percentage of it’s network, but is concerned at the timetable proposed. After the specific type of ATP system has been selected, ATP shall be fully implemented within 5 years, with a high priority given to densely trafficked lines.

47. BR shall report at 6 monthly intervals to the Railway Inspectorate on it’s progress in implementing ATP.

In paragraph 14.27 of the report it says that the Chief Inspecting Officer of Railways in his annual report for 1985 called on BR to consider a form of ATP.

In a meeting in November 1988, it was agreed that a version of ATP should be introduced.

The train crash at Clapham occurred on Monday 12th December 1988

BR announced trials of ATP in March 1989.

The report goes into some detail in paragraphs 14.27 to 14.31 and 15.8 to 15.19 including discussing costs, types of ATP and the fact that an "intermittent" ATP as proposed by BR as being the most practical would not and could not have prevented the crash at Clapham. A more expensive and impractical (for fitting to existing signalling/lines) could have prevented the crash at Clapham.

My point is that better technology exists than TPWS that is far better at preventing or better at mitigating train crashes caused by one train hitting another on the same line or converging lines (plus the other safety advantages such as preventing excessive speed over points or other S&C and on curves).

But as I have expected for a considerable number of years, eventually the Swiss cheese model holes lined up and there was no safety system to prevent a preventable accident from occurring.

Now, just to be clear, we are long past ATP of the form used on the pilot schemes being practical as they are obsolete.

What I think should happen is that the government, Network Rail and once it becomes law, GBR should move far faster in rolling out ERTMS/ETCS across the fast, busy / densely trafficked lines.

 

[Taunton]

Now, just to be clear, we are long past ATP of the form used on the pilot schemes being practical as they are obsolete.

It's a bit difficult to both advocate ATP, and then to regard the two installations as obsolete, from not having been worthwhile to continue. Let alone that both Southall and Ladbroke Grove occurred on the one main line fitted with it, because the operators saw no value in using it.

 

[Annetts key]

It’s depressing as a lot of time was spent worrying about ATP in the 90s when the time could instead have been spent developing TPWS. Realistically Ladbroke Grove, Cowden and Newton could have been prevented by a TPWS-type system, and maybe Southall and Watford.

Agreed. For information it was sometime in 1994 that work got under way on looking at SPAD reduction and mitigation measures (short of ATP) and by the time of Ladbroke Grove TPWS was developed but awaiting government sign-off of the funding.

ATP predates TPWS by many years.

ATP as I have said before proves better and more comprehensive protection and mitigation compared to TPWS.

Part of the reason that TPWS was less expensive is because the majority of signals are not fitted with TPWS.

At least on the GWML ATP system, ATP using just a signal beacon and an in-fill beacon (no infill loop) requires less maintenance compared to TPWS with OSS. Testing the ATP is quicker.

For TPWS, each additional set of loops (racks) per signal such as OSS+ further increases the resources needed for maintenance.

The GWML ATP is a both a safety critical system and a fail safe system. If an ATP fitted train does not receive a valid message where the on-train computer expects to receive it (so the beacon is not transmitting a valid message for any reason), it generates an alarm and fault code to the driver.

TPWS in comparison only transmits a simple single frequency signal on each loop. It's possible for therefore for the loop to be working as far as the signalling system is concerned, but not be in the correct position that the signal can be revived by a train.

On the area where I worked, for infrastructure failures, we had far more TPWS failures compared to the number of ATP failures respective to the number of systems fitted for each system.

We can play what if till the cows come home, but my fundamental point is that 40 years after ATP was first discussed by BR, and 37 years after ATP pilot schemes were agreed. We still don't have a comprehensive train protection system.

== Doublepost prevention - post automatically merged: Yesterday at 13:51 ==

It's a bit difficult to both advocate ATP, and then to regard the two installations as obsolete, from not having been worthwhile to continue. Let alone that both Southall and Ladbroke Grove occurred on the one main line fitted with it, because the operators saw no value in using it.

I'm not advocating that ATP (the obsolete designs or indeed any brand new design) be fitted. I'm advocating that the U.K. dramatically speed up the fitment of ERTMS/ETCS.

The government did not want to spend the money expanding ATP across the country.

The reason that First did not consider ATP beneficial is in the transcript of the relevant inquiry. But then, it doesn't appear that back then they took the on-train AWS reliability as important as they should have either. One can only imagine if TPWS was in use back then if it would have been viewed similarly.

If the accidents at Southall and Ladbroke Grove had not occurred, do you think TPWS fitment would have been as widespread as it is today?

The government and the railway had to not only do something, but also be seen to do something.

 

[Harpo]

On ETCS deployment, let’s not forget that it didn’t stop Talerddig.

 

[westcoaster]

On ETCS deployment, let’s not forget that it didn’t stop Talerddig.

Neither would ATP or TPWS, due to the railhead conditions. The only thing in my mind that would of mitigated the collision would have been a set of trap points to derail the unit.

 

[bramling]

No, the type of ATP selected by BR wouldn’t have prevented Clapham. Other recommendations were made in respect of this. I have read the whole report twice (once when I first got to see a copy many, many years ago and again in the 1990s) and I thought that the vast majority was reasonable.

There were a total of 93 recommendations covering a lot of subjects including BR management and processes and crash worthiness of trains.

In relation to ATP there were just two:


In paragraph 14.27 of the report it says that the Chief Inspecting Officer of Railways in his annual report for 1985 called on BR to consider a form of ATP.

In a meeting in November 1988, it was agreed that a version of ATP should be introduced.

The train crash at Clapham occurred on Monday 12th December 1988

BR announced trials of ATP in March 1989.

The report goes into some detail in paragraphs 14.27 to 14.31 and 15.8 to 15.19 including discussing costs, types of ATP and the fact that an "intermittent" ATP as proposed by BR as being the most practical would not and could not have prevented the crash at Clapham. A more expensive and impractical (for fitting to existing signalling/lines) could have prevented the crash at Clapham.

My point is that better technology exists than TPWS that is far better at preventing or better at mitigating train crashes caused by one train hitting another on the same line or converging lines (plus the other safety advantages such as preventing excessive speed over points or other S&C and on curves).

But as I have expected for a considerable number of years, eventually the Swiss cheese model holes lined up and there was no safety system to prevent a preventable accident from occurring.

Now, just to be clear, we are long past ATP of the form used on the pilot schemes being practical as they are obsolete.

What I think should happen is that the government, Network Rail and once it becomes law, GBR should move far faster in rolling out ERTMS/ETCS across the fast, busy / densely trafficked lines.

I’ve never understood why ATP should have been anything other than a nice-to-have as a result of Clapham. ATP is designed to ensure drivers react correctly to signals, which was not an issue at Clapham. The issue was that the signalling system was wired up incorrectly. Nothing to do with how the trains were being driven.

ATP isn’t infallible to errors, as we saw with the Cambrian incident when all the speed restrictions disappeared.

Then we come to Cowden, which would almost certainly have been prevented by a TPWS-type system.

I seem to remember some hysteria from one of the lawyers in the aftermath of Ladbroke Grove who was arguing that TPWS was an unacceptable inadequate substitute for an ATP system. I have no doubt that had TPWS not been prioritised then we probably would have little if any ATP by now, and likely a few fatal accidents would have happened in the interim.

 

[HSTEd]

Neither would ATP or TPWS, due to the railhead conditions. The only thing in my mind that would of mitigated the collision would have been a set of trap points to derail the unit.

Magnetic track brakes would probably have substantially mitigated or prevented the collision by substantially increasing the brake force available, even in low adhesion conditions. The brakes tend to scrub the rail and improve adhesion for following wheelsets, as well as generating significant braking force themselves.

More generally, I am of the view that we now have multiple units way more performant than ones that existed in the past, which has produced new emergent risks.
I think calculation has probably changed since the last serious work on ATP was done at the time TPWS was developed and deployed.

 

[fishwomp]

[..]
The reason that First did not consider ATP beneficial is in the transcript of the relevant inquiry. But then, it doesn't appear that back then they took the on-train AWS reliability as important as they should have either. One can only imagine if TPWS was in use back then if it would have been viewed similarly.
[..]

At Ladbroke Grove (October 1999), it was Thames Trains's 165, owned by Go Ahead.
If you were talking about Southall (Sept 1997) - that was Great Western Trains - which was only 24% owned by First Group at that time, 51% by ex-BR management. It was wholly acquired by First Group in 1998 - so it was First Group giving evidence.

Reading both Southall and Ladbroke Grove inquiry reports - it's clear ATP wasn't getting used nearly enough even where fitted.. which meant Thames Train's decision was not unexpected.

The Ladbroke Grove inquiry( https://www.jesip.org.uk/wp-content/uploads/2022/03/Ladbroke-Grove-Rail-Inquiry-Report-Part-1.pdf ) wrote:

Equipment problems combined with deficiencies in driver training and, seemingly, a less than committed management drive, meant that the system was operational for at best less than 30% of the time in the period up to August 1997.

The Southall service set out with non-functional AWS, and the ATP was isolated as the driver was not trained to use it. The driver went through two reds, whilst distracted by packing a bag: AWS would most certainly have prevented that. He was never prosecuted (http://news.bbc.co.uk/1/hi/uk/384011.stm) due to the psychological damage of the accident on him. GWR got a health and safety fine. Attitudes / rules of non-functional AWS were very, very quickly changed.

 

[edwin_m]

ATP predates TPWS by many years.

ATP as I have said before proves better and more comprehensive protection and mitigation compared to TPWS.

Part of the reason that TPWS was less expensive is because the majority of signals are not fitted with TPWS.

At least on the GWML ATP system, ATP using just a signal beacon and an in-fill beacon (no infill loop) requires less maintenance compared to TPWS with OSS. Testing the ATP is quicker.

For TPWS, each additional set of loops (racks) per signal such as OSS+ further increases the resources needed for maintenance.

The GWML ATP is a both a safety critical system and a fail safe system. If an ATP fitted train does not receive a valid message where the on-train computer expects to receive it (so the beacon is not transmitting a valid message for any reason), it generates an alarm and fault code to the driver.

TPWS in comparison only transmits a simple single frequency signal on each loop. It's possible for therefore for the loop to be working as far as the signalling system is concerned, but not be in the correct position that the signal can be revived by a train.

These factors were well understood at the time TPWS was developed. It was predicted to address about 80% of the ATP-preventable risk at a much lower cost and be capable of more rapid implementation because the TPWS on-train equipment was designed to replace and incorporate the existing AWS system. Experience has broadly borne this out.

I'm not advocating that ATP (the obsolete designs or indeed any brand new design) be fitted. I'm advocating that the U.K. dramatically speed up the fitment of ERTMS/ETCS.

The government did not want to spend the money expanding ATP across the country.

The reason that First did not consider ATP beneficial is in the transcript of the relevant inquiry. But then, it doesn't appear that back then they took the on-train AWS reliability as important as they should have either. One can only imagine if TPWS was in use back then if it would have been viewed similarly.

Any system that isn't used isn't effective, so fitting a more sophisticated system that also isn't used doesn't deliver any benefit. ETCS, when used "signals away", is different from TPWS and ATP, in that the train can't run unless the system is operational and in use.

TPWS, if fitted an in use, would have prevented Ladbroke Grove. TPWS or even AWS, if fitted and in use, would have prevented Southall. So neither of these is a justification to fit ATP rather than TPWS. The absence of severe SPAD-related accidents from when TPWS was fitted up until Elstow demonstrates how little extra safety benefit ATP would have delivered, had it even been possible to fit it in the same timescales as TPWS.

Hence, the safety justification to fit ATP just isn't there. ETCS is justified by cost savings from needing less equipment (with a big question mark over whether these will actually be realised) with the safety benefit being only a small part of the justification.

 

[bramling]

These factors were well understood at the time TPWS was developed. It was predicted to address about 80% of the ATP-preventable risk at a much lower cost and be capable of more rapid implementation because the TPWS on-train equipment was designed to replace and incorporate the existing AWS system. Experience has broadly borne this out.

Any system that isn't used isn't effective, so fitting a more sophisticated system that also isn't used doesn't deliver any benefit. ETCS, when used "signals away", is different from TPWS and ATP, in that the train can't run unless the system is operational and in use.

TPWS, if fitted an in use, would have prevented Ladbroke Grove. TPWS or even AWS, if fitted and in use, would have prevented Southall. So neither of these is a justification to fit ATP rather than TPWS. The absence of severe SPAD-related accidents from when TPWS was fitted up until Elstow demonstrates how little extra safety benefit ATP would have delivered, had it even been possible to fit it in the same timescales as TPWS.

Hence, the safety justification to fit ATP just isn't there. ETCS is justified by cost savings from needing less equipment (with a big question mark over whether these will actually be realised) with the safety benefit being only a small part of the justification.

Probably the most salient question to be asked a result of Elstow would be whether it would be worthwhile to devise some kind of requirement to include TPWS at the first signal after a converging junction, which would capture the “single yellow at the junction, next signal unexpectedly remains on” scenario.

Just thinking of King’s Cross to Peterborough (purely as that’s a section I am very familiar with) it would likely mean a fair few signals requiring fitment.

 

[edwin_m]

Probably the most salient question to be asked a result of Elstow would be whether it would be worthwhile to devise some kind of requirement to include TPWS at the first signal after a converging junction, which would capture the “single yellow at the junction, next signal unexpectedly remains on” scenario.

Just thinking of King’s Cross to Peterborough (purely as that’s a section I am very familiar with) it would likely mean a fair few signals requiring fitment.

I think that would be difficult to justify - noting that the Elstow report says that the accident train was the first in 2026 to approach the accident signal at red. These should be low risk signals as almost always trains are accelerating away from the junction or passing through at high speed.

What I think is more relevant here is the approach control sequence, being discussed on one of the other threads. If the junction signal had normally cleared to green well in time for the driver to see it and before the AWS magnet, then the fact it remained yellow on this occasions would have been more prominent. This does raise the issue of a failure to observe the route indicator as in the ECML incidents, but in advance of ETCS I believe a route-sensitive TPWS overspeed sensor at the junction signal would be a more effective overall risk mitigation than fitting a TPWS at the signal after.

 

[Annetts key]

These factors were well understood at the time TPWS was developed. It was predicted to address about 80% of the ATP-preventable risk at a much lower cost and be capable of more rapid implementation because the TPWS on-train equipment was designed to replace and incorporate the existing AWS system. Experience has broadly borne this out.

And was the additional cost of TPWS+ (OSS+) included at the time?

Was the cost of additional signalling controls to prevent self reversion (to suppress the energisation of the TPWS loops until the train borne antenna has passed over them where the TSS loops have to be installed closer to the IRJ than the required 3.5m, or even ahead of it) included?

Was the cost of miles and miles of extra 12 core cables (required where the signal is remotely fed at 110V AC via lineside cable rather than there being control relays in the nearby location cupboard) factored in?

Were the delays caused by "false" TPWS activations (where the train driver is driving within the speed limit and within the braking curve of their train) but over the TPWS trip speed included at the time? Did it include the resources of the S&T fault teams that often are tasked with checking that the TPWS loops (grids) are installed in the correct position?

Was the change of design of the plugboard contacts on the TPWS SIM, TSM and OSM (the plug in modules) to make them gold plated to reduce contact resistance issues included at the time? Not that this fully fixed the issue, as this problem still occurs, a white deposit can be found on the contacts. There was rumours before the gold plated plugboard contact modules became available that there were storerooms full of returned faulty TPWS SIM, TSM and OSM and that they were going to be scrapped.

Was the unreliability of the existing AWS train equipment considered at the time? My understanding is that when a train/loco/unit went in to have TPWS fitted, most of the existing AWS equipment had to be replaced which was more work than planned, so cost more. Is this correct?

And lastly, you are comparing what happened with TPWS and assuming that ATP would have been done the same way.

Whereas, if after the pilot schemes had proved that ATP worked (which they did, even if there were some initial issues), BR had specified that proper provision (space, power, cable routes) be provided for later fitment of ATP to all new trains/locos/units or for it to be fitted, the cost of providing ATP on trains/locos/units over the following years would have been more reasonable, as it's more cost effective than trying to retro fit such systems.

Yes, this would not have helped with the fitment of existing trains/locos/units that had years of service life remaining.

And as you point out, if a signal or a train is not fitted with a system (or it's not in use), that system provides no functionally in regards to preventing or mitigating collisions between trains.
ATP would in normal circumstances have been fitted to all main aspect signals on main passenger lines. That's a completely different concept to how the TPWS scheme has been done.

How much would the TPWS scheme cost if it had to fitted to all main aspect signals on main passenger lines?

In terms of experience, do you have figures for how many SPADs, overspeed incidents and drivers missing yellow aspect incidents the two pilot schemes prevented?

And in case it's not clear, yes, I have extensive experience of working on the track mounted and lineside equipment for TPWS and GWML ATP.

I would not describe TPWS as a quality product. It's really 1970s technology built using current manufacturing methods.

Yes, the GWML ATP is far from perfect, but in my mind, it was at the time a far a much better system and given it ticks multiple safety improvement boxes.

It applies brakes to try to prevent a SPAD from occurring (including applying the brakes if a train is going too fast at a signal showing a yellow aspect), tries to prevent a train from exceeding the permanent speed limit, tries to prevent a train from exceeding the junction speed limit and where the trackside equipment has adjusted tries to prevent a train from exceeding a temporary speed limit. Note for all speed limits, it monitors the train speed throughout the entire length of the speed limit unless the train exits the ATP fitted area.

Yes, TPWS has or could have (if it had been fitted) prevented or mitigated some incidents, accidents crashes. No one is denying that.

I take chances, I worked on the railways and you have to carefully consider and weigh up the risks between various choices based on a number of factors. But I'm far from the type of person to take silly risks or be risk adverse.

Railway signalling is always expensive because normally railway signalling has to be 99.99% effective and safe.

For example, a single Q‑Style/BR930 50V DC neutral line specification signalling relay with 12 front and 4 back contacts, or in more general terms, 12 normally open and 4 normally made contacts costs in the ball park of £130 to £150.

A cheap consumer grade relay from China with less contacts, 4 change-over contacts, costs around £12 to £20 for a pack of ten).

Past experience over many, many years has taught the railway that doing otherwise will eventually result in an accident due to the holes in the Swiss cheese lining up.

So I would much rather chose a system, even if it's twice the price or more, that provides rather better protection compared to a cheaper system that is only providing 80% of the ATP-preventable risk.

 

[edwin_m]

And was the additional cost of TPWS+ (OSS+) included at the time?

Was the cost of additional signalling controls to prevent self reversion (to suppress the energisation of the TPWS loops until the train borne antenna has passed over them where the TSS loops have to be installed closer to the IRJ than the required 3.5m, or even ahead of it) included?

Was the cost of miles and miles of extra 12 core cables (required where the signal is remotely fed at 110V AC via lineside cable rather than there being control relays in the nearby location cupboard) factored in?

Were the delays caused by "false" TPWS activations (where the train driver is driving within the speed limit and within the braking curve of their train) but over the TPWS trip speed included at the time? Did it include the resources of the S&T fault teams that often are tasked with checking that the TPWS loops (grids) are installed in the correct position?

Was the change of design of the plugboard contacts on the TPWS SIM, TSM and OSM (the plug in modules) to make them gold plated to reduce contact resistance issues included at the time? Not that this fully fixed the issue, as this problem still occurs, a white deposit can be found on the contacts. There was rumours before the gold plated plugboard contact modules became available that there were storerooms full of returned faulty TPWS SIM, TSM and OSM and that they were going to be scrapped.

Was the unreliability of the existing AWS train equipment considered at the time? My understanding is that when a train/loco/unit went in to have TPWS fitted, most of the existing AWS equipment had to be replaced which was more work than planned, so cost more. Is this correct?

And lastly, you are comparing what happened with TPWS and assuming that ATP would have been done the same way.

Whereas, if after the pilot schemes had proved that ATP worked (which they did, even if there were some initial issues), BR had specified that proper provision (space, power, cable routes) be provided for later fitment of ATP to all new trains/locos/units or for it to be fitted, the cost of providing ATP on trains/locos/units over the following years would have been more reasonable, as it's more cost effective than trying to retro fit such systems.

Yes, this would not have helped with the fitment of existing trains/locos/units that had years of service life remaining.

And as you point out, if a signal or a train is not fitted with a system (or it's not in use), that system provides no functionally in regards to preventing or mitigating collisions between trains.
ATP would in normal circumstances have been fitted to all main aspect signals on main passenger lines. That's a completely different concept to how the TPWS scheme has been done.

How much would the TPWS scheme cost if it had to fitted to all main aspect signals on main passenger lines?

In terms of experience, do you have figures for how many SPADs, overspeed incidents and drivers missing yellow aspect incidents the two pilot schemes prevented?

And in case it's not clear, yes, I have extensive experience of working on the track mounted and lineside equipment for TPWS and GWML ATP.

I would not describe TPWS as a quality product. It's really 1970s technology built using current manufacturing methods.

Yes, the GWML ATP is far from perfect, but in my mind, it was at the time a far a much better system and given it ticks multiple safety improvement boxes.

It applies brakes to try to prevent a SPAD from occurring (including applying the brakes if a train is going too fast at a signal showing a yellow aspect), tries to prevent a train from exceeding the permanent speed limit, tries to prevent a train from exceeding the junction speed limit and where the trackside equipment has adjusted tries to prevent a train from exceeding a temporary speed limit. Note for all speed limits, it monitors the train speed throughout the entire length of the speed limit unless the train exits the ATP fitted area.

Yes, TPWS has or could have (if it had been fitted) prevented or mitigated some incidents, accidents crashes. No one is denying that.

I take chances, I worked on the railways and you have to carefully consider and weigh up the risks between various choices based on a number of factors. But I'm far from the type of person to take silly risks or be risk adverse.

Railway signalling is always expensive because normally railway signalling has to be 99.99% effective and safe.

For example, a single Q‑Style/BR930 50V DC neutral line specification signalling relay with 12 front and 4 back contacts, or in more general terms, 12 normally open and 4 normally made contacts costs in the ball park of £130 to £150.

A cheap consumer grade relay from China with less contacts, 4 change-over contacts, costs around £12 to £20 for a pack of ten).

Past experience over many, many years has taught the railway that doing otherwise will eventually result in an accident due to the holes in the Swiss cheese lining up.

So I would much rather chose a system, even if it's twice the price or more, that provides rather better protection compared to a cheaper system that is only providing 80% of the ATP-preventable risk.

I can't answer most of this, other than to say that at the time TPWS was seen as much cheaper and quicker to install than ATP, and you can only make decisions based on what you know at the time. I did mention upthread that some later complications increased the cost. At the time also the ATP alternative was those systems that are now obsolescent, so had that been chosen then the industry would be worrying now about what to do next on far more routes than just GWML.

TPWS was fully understood to be a non-failsafe design, on the basis that for an accident to occur a SPAD (itself a very rare event) had to take place while the TPWS at the relevant signal was failed. This was seen as acceptable provided there was some means of detecting latent faults [failures that aren't evident until the equipment is called on to be used]. This was partly provided on retrofits by bringing loop health into the signal proving circuit, and no doubt there were inspection regimes too which I can't comment on.

You note your experience on the signalling side - the respective costs of the rolling stock fitments also needs to be considered. There were major issues fitting ATP to the legacy HST fleet.

 

[Annetts key]

You note your experience on the signalling side - the respective costs of the rolling stock fitments also needs to be considered. There were major issues fitting ATP to the legacy HST fleet.

Yes, there were indeed major issues fitting ATP to the HSTs. These are discussed in one of the inquiries. I forget which one.

And that's why I would have preferred an earlier decision on ATP so that there would be less of a problem in future years. As I said earlier, if all new trains/locos/units had provision built in, there would be less existing stock that would need the complex, time consuming and expensive retro fit work.

An early decision back then may also have enabled continued development of the technology that runs / implements ATP.
ATP is based on two computers, duplicated for safety reasons, both in the lineside cabinet and on the train, and computer technology has changed massively since the 1980s.

Now, with ERTMS/ETCS, my understanding is that all new trains/locos/units are supposed to have built in provision for this system.

Of course, now all trains/locos/units already are required to have TPWS. So there will always be a heavy bias because an expansion of TPWS would not involve and costs to the train fleets. It would only be infrastructure/signalling costs.

But none of that changes the principles, one of which is that TPWS is mostly a U.K. only system (although it's now used elsewhere, such as parts of Australia).

That it was allegedly a stop gap solution until ERTMS/ETCS was implemented.

And as previously discussed, does not provide the same level of protection as ATP or ERTMS/ETCS.

And as I said earlier, it's completely impractical to consider ATP now. That ship sailed a long time ago. But if the U.K. is serious about a long term solution that provides far better protection, the answer currently IMHO is to have a faster rollout of ERTMS/ETCS.

Just to be clear, that doesn't mean that some other work or alterations shouldn't take place. Certainly the approach control / approach release arrangements for older installations need to be reviewed. And alterations made where thought necessary.

And I have no problem with signals that after a review, have their risk assessment changed and hence have TPWS fitted.

What I don't want, is just the last two points to be done and nothing else done. As that still leaves too many potential risks that the holes will line up in the Swiss cheese at some point in the future.

Absolutely no one knows when a passenger train will come to a half due to whatever reason on a plain line and then another train following at speed fails to stop at the signal that is red protecting the train ahead.

 

[MarkyT]

Yes, there were indeed major issues fitting ATP to the HSTs. These are discussed in one of the inquiries. I forget which one.

And that's why I would have preferred an earlier decision on ATP so that there would be less of a problem in future years. As I said earlier, if all new trains/locos/units had provision built in, there would be less existing stock that would need the complex, time consuming and expensive retro fit work.

An early decision back then may also have enabled continued development of the technology that runs / implements ATP.
ATP is based on two computers, duplicated for safety reasons, both in the lineside cabinet and on the train, and computer technology has changed massively since the 1980s.

Now, with ERTMS/ETCS, my understanding is that all new trains/locos/units are supposed to have built in provision for this system.

Of course, now all trains/locos/units already are required to have TPWS. So there will always be a heavy bias because an expansion of TPWS would not involve and costs to the train fleets. It would only be infrastructure/signalling costs.

But none of that changes the principles, one of which is that TPWS is mostly a U.K. only system (although it's now used elsewhere, such as parts of Australia).

That it was allegedly a stop gap solution until ERTMS/ETCS was implemented.

And as previously discussed, does not provide the same level of protection as ATP or ERTMS/ETCS.

And as I said earlier, it's completely impractical to consider ATP now. That ship sailed a long time ago. But if the U.K. is serious about a long term solution that provides far better protection, the answer currently IMHO is to have a faster rollout of ERTMS/ETCS.

Just to be clear, that doesn't mean that some other work or alterations shouldn't take place. Certainly the approach control / approach release arrangements for older installations need to be reviewed. And alterations made where thought necessary.

And I have no problem with signals that after a review, have their risk assessment changed and hence have TPWS fitted.

What I don't want, is just the last two points to be done and nothing else done. As that still leaves too many potential risks that the holes will line up in the Swiss cheese at some point in the future.

Absolutely no one knows when a passenger train will come to a half due to whatever reason on a plain line and then another train following at speed fails to stop at the signal that is red protecting the train ahead.

The ATP project manager told me they knew almost from the start they were going down an obsolete route with both pilot systems, but they had to be seen to be doing something, and while ETCS was clearly the future, no tangible system was yet available off the shelf, so they were in an impossible position. Most European networks had by then already developed and improved their legacy limited supervision systems and were rolling them out more widely. For example PZB (Indusi) in Germany (originally developed in the 1930s), KVB in France (the original digital balise-based system). These were both being rolled out very widely around the millennium, after being historically rather sparsely deployed typically only on the most important and busiest lines. In the UK, we had no kind of trainstop functionality at this time apart from a few units fitted with tripcocks for tunnel working.

It was inevitable that future collisions would be more likely to occur at plain line headway signals not fitted with TPWS. They would be extremely rare but practically impossible to predict in location.

Some plain line signals are already equipped, usually protecting platforms where there's a dense passenger service and some trains don't stop. That's a scheduled and predictable traffic mix on which to base the analysis, however, not the likelihood of an unplanned stoppage on a fast segment.

Belgium faced a similar dilemma in upgrading their TBL1 protection system. This, with distant warning and trainstop functions using the same transponders as GW ATP, had been applied at selected signals only on risk-based criteria similar to TPWS. Plain line headway signals were not usually equipped.

Authorities made a decision in the upgrade to TBL1+, which replaced the legacy transponders with switched eurobalises, that they would equip every signal. During the project rollout, there were several fatal incidents where the complete new system, either on the infrastructure or the trains involved, was not yet installed or in use.

TBL1+ was subsequently upgraded, largely by software change alone, to ETCS Level 1 Limited Supervision, hence Belgium became the first EU nation to achieve full ETCS coverage over its entire rail network in December 2025, after non-EU Switzerland in 2017, of course.

Note the Belgian network, while dense, is only slightly bigger at ~6,400 track km than the UKs Southern Region, with ~5,300km today.

 

[bramling]

And was the additional cost of TPWS+ (OSS+) included at the time?

Was the cost of additional signalling controls to prevent self reversion (to suppress the energisation of the TPWS loops until the train borne antenna has passed over them where the TSS loops have to be installed closer to the IRJ than the required 3.5m, or even ahead of it) included?

Was the cost of miles and miles of extra 12 core cables (required where the signal is remotely fed at 110V AC via lineside cable rather than there being control relays in the nearby location cupboard) factored in?

Were the delays caused by "false" TPWS activations (where the train driver is driving within the speed limit and within the braking curve of their train) but over the TPWS trip speed included at the time? Did it include the resources of the S&T fault teams that often are tasked with checking that the TPWS loops (grids) are installed in the correct position?

Was the change of design of the plugboard contacts on the TPWS SIM, TSM and OSM (the plug in modules) to make them gold plated to reduce contact resistance issues included at the time? Not that this fully fixed the issue, as this problem still occurs, a white deposit can be found on the contacts. There was rumours before the gold plated plugboard contact modules became available that there were storerooms full of returned faulty TPWS SIM, TSM and OSM and that they were going to be scrapped.

Was the unreliability of the existing AWS train equipment considered at the time? My understanding is that when a train/loco/unit went in to have TPWS fitted, most of the existing AWS equipment had to be replaced which was more work than planned, so cost more. Is this correct?

And lastly, you are comparing what happened with TPWS and assuming that ATP would have been done the same way.

Whereas, if after the pilot schemes had proved that ATP worked (which they did, even if there were some initial issues), BR had specified that proper provision (space, power, cable routes) be provided for later fitment of ATP to all new trains/locos/units or for it to be fitted, the cost of providing ATP on trains/locos/units over the following years would have been more reasonable, as it's more cost effective than trying to retro fit such systems.

Yes, this would not have helped with the fitment of existing trains/locos/units that had years of service life remaining.

And as you point out, if a signal or a train is not fitted with a system (or it's not in use), that system provides no functionally in regards to preventing or mitigating collisions between trains.
ATP would in normal circumstances have been fitted to all main aspect signals on main passenger lines. That's a completely different concept to how the TPWS scheme has been done.

How much would the TPWS scheme cost if it had to fitted to all main aspect signals on main passenger lines?

In terms of experience, do you have figures for how many SPADs, overspeed incidents and drivers missing yellow aspect incidents the two pilot schemes prevented?

And in case it's not clear, yes, I have extensive experience of working on the track mounted and lineside equipment for TPWS and GWML ATP.

I would not describe TPWS as a quality product. It's really 1970s technology built using current manufacturing methods.

Yes, the GWML ATP is far from perfect, but in my mind, it was at the time a far a much better system and given it ticks multiple safety improvement boxes.

It applies brakes to try to prevent a SPAD from occurring (including applying the brakes if a train is going too fast at a signal showing a yellow aspect), tries to prevent a train from exceeding the permanent speed limit, tries to prevent a train from exceeding the junction speed limit and where the trackside equipment has adjusted tries to prevent a train from exceeding a temporary speed limit. Note for all speed limits, it monitors the train speed throughout the entire length of the speed limit unless the train exits the ATP fitted area.

Yes, TPWS has or could have (if it had been fitted) prevented or mitigated some incidents, accidents crashes. No one is denying that.

I take chances, I worked on the railways and you have to carefully consider and weigh up the risks between various choices based on a number of factors. But I'm far from the type of person to take silly risks or be risk adverse.

Railway signalling is always expensive because normally railway signalling has to be 99.99% effective and safe.

For example, a single Q‑Style/BR930 50V DC neutral line specification signalling relay with 12 front and 4 back contacts, or in more general terms, 12 normally open and 4 normally made contacts costs in the ball park of £130 to £150.

A cheap consumer grade relay from China with less contacts, 4 change-over contacts, costs around £12 to £20 for a pack of ten).

Past experience over many, many years has taught the railway that doing otherwise will eventually result in an accident due to the holes in the Swiss cheese lining up.

So I would much rather chose a system, even if it's twice the price or more, that provides rather better protection compared to a cheaper system that is only providing 80% of the ATP-preventable risk.

It’s ironic that the two accidents which brought everything into sharp focus both occurred on a route fitted with GW ATP.

As ever the problem with ATP was if one goes back to the 1990s, there just wasn’t the longer term funding available for ATP. We might have got it on a few fortunate routes, but it wouldn’t have been paid for nationwide.

Ladbroke Grove then happened which brought everything into the spotlight, at which point it would have been politically difficult going for ATP given the time it would have taken to progress, even if a politician had been prepared to commit to funding it.

It will be interesting to see what else RAIB do manage to find in respect of Bedford. If it ends up as an inexplicable mystery, as may well turn out to be the case, then clearly one could argue a case that train protection was a significant factor. If however something else emerges then that changes things entirely. One does suspect that if there was anything significantly amiss with the infrastructure then it would probably have come out by now.