• Our new ticketing site is now live! Using either this or the original site (both powered by TrainSplit) helps support the running of the forum with every ticket purchase! Find out more and ask any questions/give us feedback in this thread!

Wrong-side signalling failure at Wingfield

Status
Not open for further replies.

edwin_m

Veteran Member
Joined
21 Apr 2013
Messages
28,610
Location
Nottingham
OK we don't have the facts but the issue here is was the test done though? Also you need to do a wire count first before you test so theoretically two lines of defence. Anyhow we will just have to wait out safety digest and see what else RAIB reveal.
If you've just swapped the wires leading to two aspects, then a wire count won't show anything amiss.

Would use of plug couplers, often now preferred on new schemes, have allowed this disconnection to take place with less risk of wires being re-connected wrongly?
 
Sponsor Post - registered members do not see these adverts; click here to register, or click here to log in
R

RailUK Forums

Nicholas Lewis

Established Member
Joined
9 Aug 2019
Messages
7,991
Location
Surrey
If you've just swapped the wires leading to two aspects, then a wire count won't show anything amiss.
a wire count should be to diagram and tags should be used if cables were unidentified which is probable given vintage of trackside installation
Would use of plug couplers, often now preferred on new schemes, have allowed this disconnection to take place with less risk of wires being re-connected wrongly?
for sure if the cable and coupler could be withdrawn from the affected track area so the no physical cable cores were being disconnected.
 

Annetts key

Established Member
Joined
13 Feb 2021
Messages
3,792
Location
West is best
Doesn't matter how "simple" the test is, perform it enough times and eventually something will get through.
Keep in mind the following:

The person doing ALL the testing (the tester) is supposed to not be the same person doing the work, the tester should remain independent. Failure to be independent is a breach of the procedure.

For planned work (which this was), the appropriate manager should have issued a (written) test plan which identifies the tester and the test plans that are required to be followed.

There are numerous checks and tests that should be performed by the tester before any (disconnection) work starts. All the checks and tests are listed.

After reconnection, there are further checks and tests that the tester is required to perform. Once all the checks and tests are completed, the tester fills in a log sheet (in their log book) with details of the work done and the testing, this includes a tick column where the tester has to indicate that each check or test is completed. Network Rail staff then have to photograph this and email a copy to their manager. Only after this is the signalling equipment supposed to be “booked back on” with the signaller.

Plus then, you must submit the top paper copy from the log book to the manager.

I forget the exact interval, but every few years a tester has to perform practicals in front of a trainer to demonstrate that they both understand and can perform an aspect test (amongst others). The trainers that assess staff in my area watch you like a hawk. Get it wrong and you are not allowed to carry out these duties until you’ve been on a full training course again and passed it.

If a manager is not happy with either your log sheet, or your work, they will ask you to explain yourself.
Failure to follow the procedures may lead to a disciplinary case against you.

The importance of picking up errors or mistakes and of full, proper independent testing is a fundamental thing within the S&T engineering staff in my area.

I obviously can’t speak about other areas, other parts of the Network Rail organisation or for contractors.
 

alxndr

Established Member
Joined
3 Apr 2015
Messages
1,678
Unlikely TPWS was fitted. This is one of the weaknesses of the majority of signals not being provided with TPWS. TPWS is a mitigation against the worst case scenario of a collision at a junction or a level crossing.
Indeed, looking at Google Maps it doesn't appear to have a TPWS fitted.
Hence why I’ve always been of the opinion that ATP should have been introduced rather than the “quick win” of TPWS. But that’s a debate that has already been had and is now irrelevant. Or rather if ERTMS had been introduced to a time line as originally intended, it should have been.

If this signal had been fitted with the GWML ATP system or TPWS, because this equipment would have been controlled from the equipment location case, the train would have received a brake application IF the signal was supposed to be red. This would not have made any difference to the first train in this incident. But it would likely have applied the brakes for the second train.
That would only be true if the error was made on the signal side of the ATPLITs (the current sensing component of an ATP system) or where the input to the TPWS was terminated. If the error was made on the relay/module side then either the ATP would behave in accordance to the signal lamp actually illuminated and the TPWS would not receive the input to command it to energise its loops.

It's less likely that maintenance works would introduce an error the relay/module side of the ATP or TPWS as works are more likely to involve the outgoing portion (as has been hypothesised was the case here) but it's not impossible and could occur during installation works. There's less opportunity for this to happen in SSI circuits as well, as SSI circuits tend to have fewer terminations between the module and the point were the ATP and TPWS interfaces with the rest of the signalling system than they did in RRI circuits.

Would use of plug couplers, often now preferred on new schemes, have allowed this disconnection to take place with less risk of wires being re-connected wrongly?
If it was plug coupled both ends, and if the couplers were able to pass through any glands or trunking needed to move the cables clear of the works.

I forget the exact interval, but every few years a tester has to perform practicals in front of a trainer to demonstrate that they both understand and can perform an aspect test (amongst others). The trainers that assess staff in my area watch you like a hawk. Get it wrong and you are not allowed to carry out these duties until you’ve been on a full training course again and passed it.
I believe assessments are 3 yearly now. If you only make minor errors then you don't need to do the full training again, you can be mentored and then have a second attempt at the assessment. If you fail that as well then you need to go on the full training. A full training course is required if you make major errors.
 

Annetts key

Established Member
Joined
13 Feb 2021
Messages
3,792
Location
West is best
If you've just swapped the wires leading to two aspects, then a wire count won't show anything amiss.

Would use of plug couplers, often now preferred on new schemes, have allowed this disconnection to take place with less risk of wires being re-connected wrongly?
S&T often use the term ‘wire count’ to mean rather more than just counting the number of wires, but what is actually involved includes a CORRELATION CHECK (checking that the equipment to the wiring diagrams) and a check to confirm that each individual wire is uniquely labelled. Hence why if two wires are swapped, this check should pick it up.

Yes, some equipment does use plug-couplers. E.g. some types of point operating equipment. But older equipment does not.
 

philthetube

Established Member
Joined
5 Jan 2016
Messages
4,162
Ummm. Not sure why it’s important to distinguish between NR staff and contractors. RAIB reports and digests are not designed to be in the blame game. All staff need to work together and to the same standards, irrespective of employer.
I recall that the RAIB have previously taken interest on contractors staff relating to checks on how many hours are being worked, so could be relevant, sorry cannot find relevant report to link to.
 

david1212

Established Member
Joined
9 Apr 2020
Messages
1,754
Location
Midlands
I do not work in any way for rail but I do work on safety critical systems and risk mitigation.

The target during design is that a single installation error or system fault can not generate show good status instead of stop / error. For various reasons this is not always practical.

After installation and repair a test procedure is carried out to check correct operation including the status of fault conditions. Where a single installation error can create good instead of stop / fault status the testing of this item is done as early as practical in the procedure. The item is then tested again near the end of the procedure with the individual steps carried out in a different sequence.

Hence for a fault to get through there has to be three errors
- during installation
- the first set of tests be that the tests not carried out in full to the procedure or the procedure itself
- the second set of tests again be that the tests not carried out in full to the procedure or the procedure itself

Here and previously at Dalwhinnie and Waterloo likewise any single error should not have resulted in the system being handed back with a fault that could wrongly show a safe ( green aspect ) or warning ( yellow aspect ) rather than stop ( red aspect ) status.
 

dgl

Established Member
Joined
5 Oct 2014
Messages
3,041
I understand that the work was running late and as such a test of the signal was not carried out, maybe they were of the idea that they didn't change anything so no test was needed?
 

Annetts key

Established Member
Joined
13 Feb 2021
Messages
3,792
Location
West is best
I do not work in any way for rail but I do work on safety critical systems and risk mitigation.

The target during design is that a single installation error or system fault can not generate show good status instead of stop / error. For various reasons this is not always practical.

After installation and repair a test procedure is carried out to check correct operation including the status of fault conditions. Where a single installation error can create good instead of stop / fault status the testing of this item is done as early as practical in the procedure. The item is then tested again near the end of the procedure with the individual steps carried out in a different sequence.

Hence for a fault to get through there has to be three errors
- during installation
- the first set of tests be that the tests not carried out in full to the procedure or the procedure itself
- the second set of tests again be that the tests not carried out in full to the procedure or the procedure itself

Here and previously at Dalwhinnie and Waterloo likewise any single error should not have resulted in the system being handed back with a fault that could wrongly show a safe ( green aspect ) or warning ( yellow aspect ) rather than stop ( red aspect ) status.
Which is the whole point of the person testing the work to be independent of having carried out the work. Which is the principal of SMTH that is discussed above. Assuming there were no existing installation errors, for an unsafe error to have been missed, it means that the person doing the work must have made an error, and the person testing must have either not done the checking and testing, or made multiple serious errors.

I understand that the work was running late and as such a test of the signal was not carried out, maybe they were of the idea that they didn't change anything so no test was needed?
If signalling equipment was disconnected by removing wire(s) or cable(s), SMTH is very clear that checks and testing is required. If things were running behind the planned timings, the signal should never have been returned to service until all checks and testing had been completed.

However, it would not be the first time that equipment was not properly tested because the staff on site were under pressure to hand back on time.

We obviously will have to wait to see what actually happened and why.
 

alxndr

Established Member
Joined
3 Apr 2015
Messages
1,678
Here and previously at Dalwhinnie and Waterloo likewise any single error should not have resulted in the system being handed back with a fault that could wrongly show a safe ( green aspect ) or warning ( yellow aspect ) rather than stop ( red aspect ) status.
Multiple errors would indeed have had to be made. If the cause was indeed a cross in the wires, the opportunities for this to be prevented by following the proper procedure would have included:
  • Before disconnecting it should have been checked by the tester that the cable cores were correctly labelled.
  • During the work the installer should have reconnected the wires correctly, and any decent installer would have checked that they were happy with their work prior to handing it over to the tester. If a mistake is made here it isn't a major issue, although would cost time, providing the following testing is carried out correctly and the installer instructed to correct their errors.
  • After the disconnection it should have been checked by the tester that the cable cores were replaced as labelled (an error/failure to check prior renders this step pointless).
  • During testing the supply voltage to each aspect there was an opportunity to notice that the aspect requested didn't match the one given. Depending on the test location in relation to the wiring error the voltages may or may not have been present where they should have been.
  • An aspect test should have definitively shown the issue.
Even if someone is foolish enough to rush and cut as many corners as possible, at the very least there is absolutely no excuse for not checking that the signal will show a red when it's supposed to. It's no means a substitute for full testing and I don't condone it at all, but failing to do that shows a complete lack of disregard to safety and commonsense. That, most minor and insufficient of testing, alone would have been enough to pick up that an error had been made.
 

dgl

Established Member
Joined
5 Oct 2014
Messages
3,041
If signalling equipment was disconnected by removing wire(s) or cable(s), SMTH is very clear that checks and testing is required. If things were running behind the planned timings, the signal should never have been returned to service until all checks and testing had been completed.

However, it would not be the first time that equipment was not properly tested because the staff on site were under pressure to hand back on time.

We obviously will have to wait to see what actually happened and why.
Quite, Clapham happened due to an overworked member of staff and potentially that's happened again which is frankly ridiculous.
If maintenance budgets are slashed to save money then there is the potential for issues like this to become more frequent. I would hope issues like this show the government that slashing maintenance budgets in the desire to balance the books is risky.
 

ComUtoR

Established Member
Joined
13 Dec 2013
Messages
9,562
Location
UK
Hence for a fault to get through there has to be three errors
- during installation
- the first set of tests be that the tests not carried out in full to the procedure or the procedure itself
- the second set of tests again be that the tests not carried out in full to the procedure or the procedure itself

- Malicious
- Human error - Non exhaustive list
- Error post installation and testing
 

Nicholas Lewis

Established Member
Joined
9 Aug 2019
Messages
7,991
Location
Surrey
Ummm. Not sure why it’s important to distinguish between NR staff and contractors. RAIB reports and digests are not designed to be in the blame game. All staff need to work together and to the same standards, irrespective of employer.
Yes they both work to the same standards but contractors need to earn money to stay solvent and too many self certify their own staff with insufficient external checks and audits done to ensure they are compliant. Fortunately the vast majority know that any disregard of the processes to ensure competent staff are employed could mean they lose their NR certification to supply staff, and thus their solvency, so are very rigorous.
 

HSTEd

Veteran Member
Joined
14 Jul 2011
Messages
20,275
Procedural control is all well and good, but it is far from foolproof, no matter how intricate you make it.

The only way to eliminate these sorts of errors is to eliminate this sort of wiring entirely, but that will take time. You would make every signal head or similar equipment a sealed unit and use network based control solutions.

But that is obviously no help for old schemes, but they will have to be replaced for these errors to be totally eliminated.
 

Annetts key

Established Member
Joined
13 Feb 2021
Messages
3,792
Location
West is best
Procedural control is all well and good, but it is far from foolproof, no matter how intricate you make it.

The only way to eliminate these sorts of errors is to eliminate this sort of wiring entirely, but that will take time. You would make every signal head or similar equipment a sealed unit and use network based control solutions.

But that is obviously no help for old schemes, but they will have to be replaced for these errors to be totally eliminated.
Your suggestion is fine in principle, but not in practice. All that happens is that the risk of error is moved to the manufacturer. So if testing either by the manufacturer is inadequate or the testing when the item of equipment is changed is inadequate, an unsafe situation could still occur. Items of signalling equipment that suffered from manufacturing faults have been found before.

Also, there are many other items of equipment which use individual wires or cable connections. Even if you could magically redesign everything and make new equipment available tomorrow, it would take many, many decades to replace everything.

And if track circuits are required, or relays for isolation purposes, it’s not possible to completely avoid using individual wires or cable connections.

To understand what actually happened, we will have to wait until the report.
 

Tim M

Member
Joined
9 Jul 2016
Messages
204
Yes they both work to the same standards but contractors need to earn money to stay solvent and too many self certify their own staff with insufficient external checks and audits done to ensure they are compliant. Fortunately the vast majority know that any disregard of the processes to ensure competent staff are employed could mean they lose their NR certification to supply staff, and thus their solvency, so are very rigorous.
Maybe the model of using multiple small contractors isn’t ideal. When I started in the industry there were just three big contractors, GEC-General Signal (my first employer), ML Engineering in Plymouth (nearly my second employer), and Westinghouse (where I worked until I retired). Looking from the outside today I am truly mystified at how the signalling industry works today.
 

philthetube

Established Member
Joined
5 Jan 2016
Messages
4,162
Multiple errors would indeed have had to be made. If the cause was indeed a cross in the wires, the opportunities for this to be prevented by following the proper procedure would have included:
  • Before disconnecting it should have been checked by the tester that the cable cores were correctly labelled.
  • During the work the installer should have reconnected the wires correctly, and any decent installer would have checked that they were happy with their work prior to handing it over to the tester. If a mistake is made here it isn't a major issue, although would cost time, providing the following testing is carried out correctly and the installer instructed to correct their errors.
  • After the disconnection it should have been checked by the tester that the cable cores were replaced as labelled (an error/failure to check prior renders this step pointless).
  • During testing the supply voltage to each aspect there was an opportunity to notice that the aspect requested didn't match the one given. Depending on the test location in relation to the wiring error the voltages may or may not have been present where they should have been.
  • An aspect test should have definitively shown the issue.
Even if someone is foolish enough to rush and cut as many corners as possible, at the very least there is absolutely no excuse for not checking that the signal will show a red when it's supposed to. It's no means a substitute for full testing and I don't condone it at all, but failing to do that shows a complete lack of disregard to safety and commonsense. That, most minor and insufficient of testing, alone would have been enough to pick up that an error had been made.
would the signaller be aware that this had not been done and should track be accepted back after a possession in this case?
 

Bertone

Member
Joined
5 Nov 2021
Messages
205
Location
Hertfordshire
Maybe the model of using multiple small contractors isn’t ideal. When I started in the industry there were just three big contractors, GEC-General Signal (my first employer), ML Engineering in Plymouth (nearly my second employer), and Westinghouse (where I worked until I retired). Looking from the outside today I am truly mystified at how the signalling industry works today.
Like yourself Tim M, my involvement in the industry was similar (and as long) as yours but working in reverse order for the big two, i.e. GEC last (now called Alstom).
Until the early 1990’s, all our projects were resourced by company staff but when a very large and complex Asia project was awarded, we didn’t have enough skilled in-house permanent staff and had no alternative but to employ contractors, reasonablably successfully (but at quite a cost) for design, checking and subsequent testing.
We even used you Chippenham chaps ;)for some interface design as you had previous knowledge of that specific area.
 
Last edited:

Chris M

Member
Joined
4 Feb 2012
Messages
1,060
Location
London E14
would the signaller be aware that this had not been done and should track be accepted back after a possession in this case?
I don't know for certain, but the impression I get as a layperson who reads RAIB reports is that the person who hands the track back after a possession is asserting to signaller that it is in a safe condition for trains to run.
 

Nicholas Lewis

Established Member
Joined
9 Aug 2019
Messages
7,991
Location
Surrey
I don't know for certain, but the impression I get as a layperson who reads RAIB reports is that the person who hands the track back after a possession is asserting to signaller that it is in a safe condition for trains to run.
Correct the SMTH competent person books the equipment off with the signaller then books it back on when installation and testing complete. The signaller should observe the correct function of equipment for the passage of first train. In this situation that would have been track circuits showing occupied as no signal indications provided to the panel / VDU.
 

Annetts key

Established Member
Joined
13 Feb 2021
Messages
3,792
Location
West is best
As above, but the signaller, unless asked to operate controls or report on his/her indications and hence involved, would be completely unaware of the details. They obviously take note if any equipment has been formally taken out of use (which is or should be recorded on a form), and will query if any equipment has not been formally returned to service. They will also check their indications, and most will also test any affected equipment as best possible either at the time it is formally returned to service or as soon as practical after the engineering occupation has been handed back.

Note however that not all work which may take place in a engineering occupation will follow the procedure where individual equipment is formally taken out of service and then later formally returned to service, if all work is planned to be fully completed before the engineering occupation ends.
 

alxndr

Established Member
Joined
3 Apr 2015
Messages
1,678
Note however that not all work which may take place in a engineering occupation will follow the procedure where individual equipment is formally taken out of service and then later formally returned to service, if all work is planned to be fully completed before the engineering occupation ends.
This is a key point. I did some routine replacements last night and as the work was wholly within the possession the signaller knew we'd done some work to the points as we asked them to be operated at the end, but they have no details of what was done. It's not the signaller's job to check up on what people are doing.

Occasionally you might get a signaller that pre-empts what you're going to ask for if they know what work has gone on, but more often than not they'll do what they're asked and nothing more. If there's a lot of work on it's not reasonable to expect them to keep track of the minutae of the work that's being done and the testing requirements for each portion of work if it doesn't directly affect their safe running of trains or ensuring the safety of those on the line.
 

philthetube

Established Member
Joined
5 Jan 2016
Messages
4,162
What I was asking was would the signaller have to operate the "levers" in order for the testing to be done, and should he/she know if it has not happened.
 

Chris M

Member
Joined
4 Feb 2012
Messages
1,060
Location
London E14
What I was asking was would the signaller have to operate the "levers" in order for the testing to be done, and should he/she know if it has not happened.
If they are asked to operate some equipment (points, signals, etc) then the signaller on duty at the time of the testing will know that work of some sort has taken place that affected/has the potential to affect that specific equipment but not necessarily the details. The signaller on duty at the time or testing may or may not be the same signaller who is on duty when the possession is given up and/or the first trains after the possession operate.
 

Annetts key

Established Member
Joined
13 Feb 2021
Messages
3,792
Location
West is best
And it's just a click on a computer mouse these days.
Not for older installations/systems. It could be, depending on the technology and design:
  • Icon on a computer screen
  • Push/pull button(s)
  • Rotary switch
  • Rotary switch and push button
  • Lever

Or for an automatic signal, with no emergency signaller control function, no control at all.
 

plugwash

Established Member
Joined
29 May 2015
Messages
1,990
Would I be right in thinking that automatic signals would be tested by manually activating the corresponding track circuits or axle counters?
 

Tester

Established Member
Joined
5 Jul 2020
Messages
1,663
Location
Watford
Would I be right in thinking that automatic signals would be tested by manually activating the corresponding track circuits or axle counters?
Not necessarily.

Correspondence of the signal can be by any convenient means clear of the affected area. What is important is that all states of the signal are corresponded.

[Caveat: I'm not currently active in the field]
 
Status
Not open for further replies.

Top