Wrong-side signalling failure at Wingfield

[baz962]

I do get what you're saying – but how far do you go in the rules to mitigate a situation that shouldn't ever exist in the first place? I have to say that I'd probably have been inclined to make an emergency group call if I'd been the second driver, but that's with the benefit of experience in the signalling grade and probably more of an interest than most in the inner workings of the signalling system and the finer details of what led to the accident at Clapham Junction. Up until that point, though, I don't think it was reasonable to expect anyone to realise that anything was seriously amiss – it had all the hallmarks of a straightforward right-side signal reversion.

However, it's important to point out that 1F01, even if the "contact signaller" message hadn't been sent, would've correctly received a single yellow at DY584 and thus wouldn't be approaching the scene at linespeed – it doesn't lessen the severity of the errors made, but it does at least reduce the consequences in this specific situation.

Maybe not , but after the first train ok
. But then they have 1F02 in a section as well and surely even if you don't know exactly what has happened , you surely must be thinking I have two trains in a section and something isn't right. The other thing I am thinking is that after being cautioned 1F02 was 75 yards or metres away from the first train and so 1F01 wouldn't have had that amount of room.

 

[Annetts key]

Might've let them catch the problem faster, though - the signaler could've notice the signal was yellow despite the driver reporting a SPAD.

But would they? By the time the driver contacted the signaller, if the signal box had been provided with an indication for the signal, it would have been showing red on the signallers display. For why read on…

As with the Clapham accident of 1988 this incident at Wingfield highlights the need for the actual signal aspect to be comfirmed to the signaller, not just that a particular wire has been energised.
One of the recommendations following the inquiry into the Abbots Ripton accident in 1876 was that signal aspects should be confirmed '...that they provide an indication to the signalman if they are not operating properly'. This sensible recommendation should surely apply to all signals whether semaphore or colour light signals.

Relay based interlocking systems always take indication information from the contacts of the relevant aspect control relays. Only controlled signals are normally provided with indications to the signaller. And then, the normal practice is only to provide a red and proceed indication (green on most panels/displays).

If the specification was changed, you would need four wires per three aspect signal to run from the location cupboard that houses the aspect control relays back to the signal box (although some of the distance could be in a multiplex transmission system). If this was done for every signal it would be a huge cost. Especially since there are thousands of automatic signals on the network.

Even with SSI or other computer based interlocking systems, a cross in the wiring to the signal head could result in the same failure.

It’s simply not practical to detect the actual colour of the light from the signal without completely redesigning the system. And no one is going to pay for this.

More modern installations now use a separate return wire for each aspect (two wires per aspect/colour), so it’s less likely a simple cross of two wires would have caused this failure, but it’s still possible. It depends on the actual design (there is more than one method depending on the age of the installation and who designed it).

I think the reality is that the real lessons are:

• Only staff familiar with the type of equipment should be working on said equipment. If the contractor doing the disconnection had realised before they started disconnecting wires, that it was not what they were expecting, the cross in the wiring would never have occurred. Similarly, if they knew how the control relay circuitry worked, before even starting formal SMTH testing, they would have found the problem.
• The Network Rail system of practical assessment and re-assessment (every two to three years) needs to be implemented with all contractors and sub-contractors.
• It should be made clear that detailed signalling work should only take place with proper site lighting, head torches should not be the primary source of lighting.
• All S&T staff and contractors should attend a one day briefing where the trainer goes through many of the “near misses” that have happened to remind them the importance of following SMTH. If they had correctly followed the SMTH test plan, they would have found the error.
• SMTH relies on the tester being independent of the work. It’s not independent if they get involved with the work, that includes giving detailed step by step instructions. The person doing the work AND the tester must both be qualified and competent to be working on the equipment.
• Signallers should also be briefed in detail about “near misses” and the importance of picking up quickly possible wrong side signalling failures. It has been known for a signaller to not realise that a wrong side failure has occurred until the S&T technician has contacted them to ask if they have protected the situation…
• The practice of having multiple different versions of the same circuit diagrams (prints) needs to sorted out. All amendments need to be submitted in good time so that the official records can be updated and new official maintenance copies issued.
• All people involved in renewals, new work or maintenance in Network Rail and the contractors need briefing again that staff carrying out safety critical work should not be put under pressure to finish by rushing. It’s more important that the work is completed safely before trains are allowed to run than trying to hand back on time and run the risk of another disaster.

 

[Lucan]

perhaps a colour-specific light detector within the signal head

But the connections from different light detectors or cameras could be cross-wired in a cabinet along the line too. It would provide another level of checking though.

 

[Taunton]

Ok if you have had one train report a potential failure I would understand. But you have had the first train go through a red and then the second train that you cautioned go through a yellow that should of been red and now have two trains in a section and still don't caution the next train coming through faster than the second train that you did caution.

It's actually three cues, because not only had two trains had issues at the same signal, but it had been worked on overnight with the signallers aware, and asked to do a test on completion of the works. And these were among the first trains through thereafter.

 

[Nicholas Lewis]

And that is my point. 5c23 had the spad ok fair enough that is all the signaller knew at that point. But then 1F02 ended up passing a false yellow and in the same section and so now there were two trains in the same section and 1F01 was three or four minutes away doing 100 mph and the signaller didn't stop that train , which was about to be number three in that section.

The report doesn't detail what action the signaller took after 1F02 reported its issue with DY586 so we don't know what they did and given 1F01 isn't mentioned in the report either it would seem that that train never got as far as DY586 so the signaller presumably stopped it.

 

[edwin_m]

But the connections from different light detectors or cameras could be cross-wired in a cabinet along the line too. It would provide another level of checking though.

They could, but as the actuation and the detection circuits would be independent, they would have to be cross-wired in the same way at the same time to cause a problem. But to be clear I'm not suggesting this is a viable solution.

 

[Re 4/4]

I do get what you're saying – but how far do you go in the rules to mitigate a situation that shouldn't ever exist in the first place? I have to say that I'd probably have been inclined to make an emergency group call if I'd been the second driver, but that's with the benefit of experience in the signalling grade and probably more of an interest than most in the inner workings of the signalling system and the finer details of what led to the accident at Clapham Junction. Up until that point, though, I don't think it was reasonable to expect anyone to realise that anything was seriously amiss – it had all the hallmarks of a straightforward right-side signal reversion.

Agreed, up until 1F02 spotting the train ahead, there was no indication it was anything more than a reversion (at least once a SPAD was excluded). But I still wonder if the driver of 1F02 could have thought, if the signal let me into this section even though it's occupied (which should never* happen), might it do the same again for the train behind me?

(*) Yes, calling-on signals etc. But this wasn't one.

A rule that "you should send a REC if you get a proceed aspect (not on a calling-on signal) into an occupied section" would hopefully never need to be used, but if it does, it could save lives.

 

[Deepgreen]

This reminds me of the 1988 Clapham Junction crash - a signal being returned to service with a fault in the wiring giving a green aspect when red should have shown.

 

[Annetts key]

This reminds me of the 1988 Clapham Junction crash - a signal being returned to service with a fault in the wiring giving a green aspect when red should have shown.

The problem at Clapham was with a redundant wire (that was still connected to the power supply) bypassing a track circuit relay contact in the signal relay controller circuit. Hence the signal ignored the train on the affected track circuit.

Different cause, different, but similar symptoms, and unfortunately a nasty crash. This incident is what caused the SMTH testing to be introduced.

 

[MadMac]

The problem at Clapham was with a redundant wire (that was still connected to the power supply) bypassing a track circuit relay contact in the signal relay controller circuit. Hence the signal ignored the train on the affected track circuit.

Different cause, different, but similar symptoms, and unfortunately a nasty crash. This incident is what caused the SMTH testing to be introduced.

I was just discussing this with a fellow (still active) Signal Engineer here in the US yesterday. We both came to the conclusion that those who had been sent to test this were, at a minimum, unfamiliar with a relay-based automatic signal section: quite apart from that, signing this back into use in that state is, IMHO, criminally negligent.

 

[baz962]

The report doesn't detail what action the signaller took after 1F02 reported its issue with DY586 so we don't know what they did and given 1F01 isn't mentioned in the report either it would seem that that train never got as far as DY586 so the signaller presumably stopped it.

You haven't read all of my posts. I am an EMR driver and was travelling with 1F01 . The signaller stopped it by giving a contact signaller message. A driver isn't required to respond until they stop next. It was by sheer luck that the driver decided to call the signaller on the move and was asked can you stop at the next signal , which was a no and then can you stop at the one after , which the driver did . I know exactly what happened.

 

[Nicholas Lewis]

I think the reality is that the real lessons are:

• Only staff familiar with the type of equipment should be working on said equipment. If the contractor doing the disconnection had realised before they started disconnecting wires, that it was not what they were expecting, the cross in the wiring would never have occurred. Similarly, if they knew how the control relay circuitry worked, before even starting formal SMTH testing, they would have found the problem.

Above shouldn't be an issue if competent staff are deployed. The issue here, as with many other incidents and not only signalling, is contractors staff aren't complying with process or aren't sufficiently competent to be there in the first place and the employing organisations don't know this and neither do NR. RAIB has only touched on this yet its at the root of this incident. The fact that HOTR had another signaller contractor failure a few weeks later and then had to suspend work for 17wks was a clear warning of wider systemic issues and to my mind merited more investigation. RAIB report they have improved things now but tis after the stable door has closed. This had all the ingredients to cause a catastrophic incident and seems actions of drivers and the fortuitous availability now of signaller to driver radio systems has saved the day but are we learning the right lessons?

 

[crablab]

In cab signalling doesn't suffer from this particular failure mode.

 

[Watershed]

In cab signalling doesn't suffer from this particular failure mode.

Indeed, though the underlying failure mode of signalling equipment being connected up the wrong way could still affect in-cab signalling, particularly given that this almost invariably still relies on trackside equipment such as track circuits or axle counters.

 

[crablab]

particularly given that this almost invariably still relies on trackside equipment such as track circuits or axle counters.

I knew someone was going to point this out

Depends on exactly which ETCS level and chosen method of train detection I believe, but yes.

Plus of course, the modern equivalent of "connecting the wires up incorrectly" being analogous to returning the inverse boolean from your critical function. At least we have automated testing suites for software.

 

[Signal Head]

Above shouldn't be an issue if competent staff are deployed. The issue here, as with many other incidents and not only signalling, is contractors staff aren't complying with process or aren't sufficiently competent to be there in the first place and the employing organisations don't know this and neither do NR. ..

Or their employer is well aware but doesn't say anything to avoid losing business.

Consider the case from several years ago where a design organisation was given a contract to carry out work on a particular and rather unusual type of relay interlocking, despite (presumably) knowing they had no staff with the necessary experience (how could you *not* know, everyone in the industry is supposed to have an 'Authority to Work', which details their competence levels on specific equipment types, agreed and signed by both employer and employee).

It wasn't until they provided some sample design to demonstrate progress, which was found to be based on a completely different style of circuitry that the penny dropped in NR management and the work was quickly taken off them and reassigned elsewhere. Basically, they designed according to circuitry principles for an interlocking type they did know, wholly inappropriate for the type they were contracted to work on, rather than turning down the work.

 

[John Webb]

One thing that struck me was the several references to the use of head-mounted lamps by the signal technicians. Bearing in mind the availability of power in most Location Cabinets, why isn't there some form of standard socket a floodlight or other lighting device could be plugged into to improve on-site lighting when works are in progress?

 

[The Puddock]

One thing that struck me was the several references to the use of head-mounted lamps by the signal technicians. Bearing in mind the availability of power in most Location Cabinets, why isn't there some form of standard socket a floodlight or other lighting device could be plugged into to improve on-site lighting when works are in progress?

Depending on the age of the installation and the geographical region, many location cases do have fixed lighting inside. Though the lighting in older assets aren't usually very useful - sometimes just a 40W 'rough service' lamp at the top - new cases from Siemens etc... come with LED floodlights on flexible cables allowing them to be positioned to avoid shadows.

 

[Taunton]

But I still wonder if the driver of 1F02 could have thought, if the signal let me into this section even though it's occupied (which should never* happen), might it do the same again for the train behind me?

But, if you have ever had someone go across in front of you at a traffic light-controlled road junction, it is initially in your mind once you have passed the traffic light whether it's you who has got it wrong, whether you really did have a green or not. And one can perfectly understand the driver wondering if they had misread the signal. AWS is sunflower, as it would be for a red. No information that the other train was stopped due to an anomaly at the same signal. No information it had been worked on in the night.

 

[bahnause]

Indeed, though the underlying failure mode of signalling equipment being connected up the wrong way could still affect in-cab signalling, particularly given that this almost invariably still relies on trackside equipment such as track circuits or axle counters.

The Bienenbüttel incident springs to my mind. An ICE train crossed over to the opposite track going 185 km/h (115 mph) through a crossover that was rated at 80 km/h (50 mph). The suspected cause was the faulty execution of a change to the interlocking system where the crossover speed was increased from 60 to 80 km/h (37 to 50 mph). Without that speed restriction the LZB system did continue to show the 200 km/h (120 mph) pass-through line speed on the in-cab display - the train driver applied the brakes on recognizing the line-side signal lights set to diverge and the train did not derail.

 

[Island 168]

I agree with the comments made following my post yesterday. It would be impractical and expensive to retro-fit existing signalling systems.

However, at both Clapham (1988) and Wingfield, the signal panel was not showing the aspect of the signals as seen by the drivers.

If it is thought desirable that a signaller should know the actual aspect of their signals, then for any new signalling scheme the question becomes ‘How can we do this?’

 

[Watershed]

I agree with the comments made following my post yesterday. It would be impractical and expensive to retro-fit existing signalling systems.

However, at both Clapham (1988) and Wingfield, the signal panel was not showing the aspect of the signals as seen by the drivers.

If it is thought desirable that a signaller should know the actual aspect of their signals, then for any new signalling scheme the question becomes ‘How can we do this?’

It's standard practice for new signalling schemes and has been for many years.

However, even though the Derby/Chesterfield area signalling has been modernised in some respects, the original 1960s relay-based signalling remains in use on this stretch of track, and the standards are not retrospectively applicable.

Even if the signaller had an indication of signal aspects, improper installation of the equipment can lead to all manner of faults - it is unlikely that the indication would have shown the signaller the false aspect being displayed.

 

[John Webb]

Depending on the age of the installation and the geographical region, many location cases do have fixed lighting inside. Though the lighting in older assets aren't usually very useful - sometimes just a 40W 'rough service' lamp at the top - new cases from Siemens etc... come with LED floodlights on flexible cables allowing them to be positioned to avoid shadows.

Interesting - while refurbishing a LOC for housing the unit controlling our 1970s 4-aspect display I included a 110v lamp:

Mind you, the unit doesn't take up as much space as a load of relays would!

 

[Signal Head]

One thing that struck me was the several references to the use of head-mounted lamps by the signal technicians. Bearing in mind the availability of power in most Location Cabinets, why isn't there some form of standard socket a floodlight or other lighting device could be plugged into to improve on-site lighting when works are in progress?

It's been the usual practice to fit fixed lighting for several years. Depending on vintage, this may be incandescent lamps, fluorescent tube or LED, mounted on the relay rails (typically for incandescent), or in the 'roof'. The latest idea is to fit a LED 'wander lamp' which can be positioned as required.

 

[alxndr]

In all the locs (of a couple of different vintages) that I've worked in I've always found a headtorch light more useful than the built in light. The positioning in all of the ones that I've worked in is not ideal for any detailed work, especially towards the bottom of the loc as is typical for cables, and appears to be the case from the photographs.

Admittedly my eyes have the benefit of youth but I've never experienced a problem working by headtorch, and indeed, while improved lighting might have prevented the error being made in the first place, it doesn't excuse the deficiency in testing that should have caught the error.

 

[Annetts key]

Back in the stone age before LED Lithium-ion site lights, I made up a BC lamp holder, with a large bulldog clip, cable and a plug that fits in BC lamp holders. It came in very handy when working at night.
But only if the loc cupboard had a BC lamp socket…