Informed Sources
The RAIB final report into the August 2017 Waterloo collision made chilling reading as the 30th anniversary of the Clapham accident approached
That the price of safety is eternal vigilance is a cliché. But clichés are only clichés because they are true. The February 2018 ‘Informed Sources’ provided a detailed analysis of how, on 15 August 2017, the 05.42 Guildford service off platform 11 at Waterloo could be signalled into the side of a train of hopper wagons parked on an adjacent track. The Rail Accident Investigation Branch (RAIB) final report published on 19 November provided more detail on the human and system errors that made it possible.
The diagrams opposite show how the detection of the set of points where the collision occurred (Points 1524) was configured. As an aid to commissioning, a test desk had been fitted which was connected to the Waterloo interlocking with 664 wires.
When in use it enabled signalling inputs to the interlockings to be simulated during commissioning, including Points 1524.
At the start of the test, the testers would remove the fuses from the points’ operational circuits and insert a link from the test desk. Using the desk, testers could send signals simulating the state of Points 1524 to the main interlocking. Figure 7b shows the test desk connected for use.
After the test desk had been installed, the need to move a lineside cubicle associated with Points 1524 resulted in the wiring being updated. 1524C now had its own unique circuit (Figure 7e). This had no effect on safety, as both point detection relays still had to be energised for the route to be set.
However, the test desk had been designed in 2016 and the designers had not subsequently been given updated versions of the interlocking design. They understood there to be no changes to the interlocking that would affect the test desk. But the change meant the desk could no longer simulate the signal to 1524C detection relay.
ASSISTANCE NOT REQUESTED
On 13 August 2017, a Principles Tester at Wimbledon Area Signalling Centre was testing routes that included inputs from Points 1524. When the C ends of these points were not shown as detected on the Wimbledon signallers’ display, the principles tester contacted the Functional Tester in the Waterloo relay room and asked him to resolve the problem.
According to RAIB, the Functional Tester first referred to maintenance copies of design documents available in the relay room and deduced that the problem was likely to be a consequence of wiring changes made during earlier parts of the project. He then asked for testing copies of these documents, which should identify changes made during stages of work. But the documents he received did not cover the equipment in the relay room.
RAIB notes that although the maintenance copies of the documents contained the information needed to develop a correct solution, the functional tester stated that he developed a solution by examining the wiring that had already been installed in the relay room and did not contact the Tester In Charge or ask for assistance from on-call signalling designers to resolve the problem. He told RAIB that when developing his solution, he did not realise that the detection circuits for the C ends of Points 1524 had been separated from the circuits for the A and B ends.
The solution involved installing four wires. These, like the other test desk connections to the interlocking, were a different colour to the standard black interlocking wiring.
CONFLICTING
As to the actual installation of the additional wiring there is, says RAIB, ‘conflicting evidence’. According to the functional tester, he instructed an installer to add blue wiring to the detection circuits for Points 1524 and label the wires to show their purpose. He added that the installers had not been able to find any labels.
LACK OF SAFEGUARDS
‘The actions of a functional tester were inconsistent with the competence expected of testers. As a consequence, the uncontrolled wiring was added without the safeguards required by Network Rail signalling works testing standards, and remained in place when the line was returned to service.’ RAIB Report
But both installers on site said that they had not installed any blue wires during their work in the relay room. They added that they could not have fitted wires without the labels, because labels would have been needed to identify the connections at each end.
RAIB’s examination of the site signing-in and signing-out records, ‘despite some omission’, showed that one of the installers was off-site when all the Points 1524 relays began working and that they usually took breaks together. RAIB concludes ‘it is likely therefore that the installers were not present and were probably on their lunch break, when the uncontrolled wires were fitted’.
Given the evidence, RAIB concludes that ‘it is likely that the uncontrolled wiring was installed by the functional tester’.
This temporary wiring was left in place when the railway was handed back on the morning of 14 August.
As a result, the signaller was able to set the route for the 05.42 and see it confirmed on the panel and the driver given a green signal despite Points 1524 not being detected. In fact, the points, which, irrespective of additional wiring, should have been secured with scotches and padlocked clips, were lying in an intermediate position. This was spotted by the driver, who applied the brakes.
RAIB notes that drivers are not required, and not expected, to check point positions in these circumstances. ‘The driver of train 2D03 is to be commended for noticing that they were lying incorrectly and for his prompt brake application’ comments the report.
It is worth noting that at the earlier similar incident at Cardiff East the driver spotted that points, which should also have been secured, were set wrongly and stopped.
COMMISSION
While the RAIB report is critical of numerous other failures to follow the correct processes, the proximate cause was the unauthorised changes to the wiring in the Waterloo relay room. There is an obvious parallel with Clapham, but there is also a significant difference. Clapham was a sin of omission – a technician failed to clip off a redundant wire, but bent it out of the way and failed to wrap the still live bare end in insulating tape.
Waterloo was a sin of commission – unauthorised changes were made that circumvented the basis of primary safety, the interlocking.
For those engineers and managers who where around at the time of Clapham, and who were involved in the massive restructuring of signalling management and processes that followed Sir Anthony Hidden QC’s inquiry, Waterloo and Cardiff East have been deeply worrying. But I am not alone in sensing that because it was ‘only’ a gently sideswipe and there were no fatalities its seriousness has failed to register.
In its report RAIB expresses this concern when it writes: ‘Events at Waterloo and the RAIB’s investigation of the serious irregularity at Cardiff East Junction suggest that some in the railway industry are forgetting the lessons learnt from the 1988 Clapham Junction accident in which 35 people died.
‘The major changes to signalling design, installation and testing processes triggered by the Clapham accident remain today, but the RAIB is concerned that the need for rigorous application is being forgotten as people with personal knowledge of this tragedy retire or move away from front line jobs.
This deep-seated, tacit knowledge is part of the corporate memory vital to achieve safety. Loss of this type of knowledge as previous generations leave the industry is a risk which must be addressed by organisations committed to achieving high levels of safety’. Those who boast that Britain has the safest railway in Europe would do well to read this report and tone down the hubris.
And Network Rail might ponder whether safety briefings when you sign in at reception for a head office meeting really contribute to a corporate safety culture.
THOUGHT SEPARATED FROM DEED
‘The vital importance of this concept of absolute safety was acknowledged time and again in the evidence which the Court heard. This was perfectly understandable because it is so self-evident. The problem with such expressions of concern for safety was that the remainder of the evidence demonstrated beyond dispute two things:
(i) there was total sincerity on the part of all who spoke of safety in this way; but, nevertheless
(ii) there was failure to carry those beliefs through from thought into deed… The concern for safety was permitted to co-exist with working practices which…were positively dangerous’. Sir Anthony Hidden QC, September 1989
