Informed Sources

Roger Ford

With the 20th anniversary of Ladbroke Grove approaching, TPWS is under the spotlight

Southall SPAD: aftermath of the accident on 19 September 1997.
Ken Brunt

Unless you were around at the time, it is hard to appreciate the intensity of the public debate over train safety around the turn of the century. In those unwoke times this column referred to ‘safety hysteria’, not a term I dare use now.

A telling observation of the level of public engagement came from my old chum Nigel Harris of RAIL. ‘Who would have thought’, he mused, ‘that a railway term like SPAD would become common usage?’

With Southall in September 1997 (seven dead, 139 injured) followed two years later by Ladbroke Grove (October 1999, 31 dead and over 250 injured), both due to Signals Passed at Danger (known as SPAD), public concern was unsurprising. That both accidents happened in London with easy access for media coverage only heightened awareness.

Add in articulate survivors and lobby groups, personified by Pam Warren, known as the lady in the mask because of the transparent plastic mask protecting the scars from facial burns received at Ladbroke Grove, and it was a perfect storm for the railway industry. A storm the newly-privatised industry was ill-equipped to handle, particularly the senior management at Railtrack when it came to the media.


Train protection was at the centre of the public inquiries held into both accidents. Professor John Uff, an engineer, was appointed to head the Southall inquiry. In parallel, Deputy Prime Minister John Prescott, whose ministerial responsibilities included railways, commissioned a ‘technical assessment’ of rail safety systems by another eminent engineer, Sir David Davies.

Both the Uff report into Southall and the Davies report were published in February 2000. But by then Ladbroke Grove had happened and Lord Cullen, a leading Scottish High Court judge, was appointed to lead the public inquiry.

Lord Cullen was clearly the ‘go-to’ man for sensitive public inquiries. He had already conducted the inquiry into the Piper Alpha North Sea oil disaster and chaired the inquiry into the shootings at Dunblane Primary School in Scotland.

Shortly after Ladbroke Grove, and while the Southall inquiry was still under way, a further joint inquiry into train protection systems was established by the Health & Safety Commission, under the two inquiry chairmen. This Uff-Cullen inquiry finished taking evidence by the end of October 2000.

Published in 2001, the report called for regulations to require that all trains running at over 100mph should be protected by the European Train Control System (ETCS) by 2010, with the East Coast and Great Western main lines fitted by 2006. Regulation, they added, had the ‘added advantages of making public funding the more secure’, when it was being claimed that ETCS ‘fell far short of meeting the test of “reasonable practicality”’.


From 1982 the frequency of SPADs on British Rail had been increasing. In 1988 there had been 843 incidents, 87 of them involving derailments or collisions. Concerned by this trend, highlighted in successive Her Majesty’s Railway Inspectorate (HMRI) annual reports, in the autumn of 1988 British Rail launched a three-year programme to produce an Automatic Train Protection (ATP) system that could be available for implementation by early 1992.


‘I can assure the House that finance will not stand in the way of the implementation of the report.’ Transport Secretary Cecil Parkinson responding to publication of the Hidden Report, 7 November 1989

SPAD-related fatal accidents at Purley and Bellgrove in March 1989 put further pressure on the programme. The then current Hidden Inquiry into the Clapham accident in December 1988 had also been expanded to include ATP following these two accidents. Published in November 1989, Hidden’s report recommended that BR should install ATP on a nationwide basis within five years of completing the pilot schemes and the selection of the specific system. BR accepted the recommendations, but with major reservations about the timescale.

A three-year programme ruled out development of BR’s own ATP system. Instead, established suppliers would be invited to bid for two pilot schemes, on Chiltern and Great Western, against a BR specification.

Sticker: a few years back, Great Western HSTs advised passengers they were travelling under the protection of BR ATP.
Colin Marsden

Service experience on the pilots would allow the initial specification to be assessed. This would determine the definitive specification for the ATP system to be rolled out across the network.


Contracts were let early in 1990 and a year later installation on track and train equipment had begun. BR expected to be able to finalise the national ATP specification by the end of 1991 and select the proprietary system to meet the specification.

In accepting the Hidden recommendation BR had caveated the five-year timescale. BR’s judgment was that it would take 10 years, the limiting factor being the availability of resources, particularly for cab fitment.At ruling prices, the estimated cost of around £600 million for the programme compared with BR’s investment in signalling and train control of £100 million a year.

As a senior signalling engineer noted at the time: ‘This signalling investment is also vital to the continuing safe and efficient functioning of the network as it will replace ageing 1950s and 1960s equipment on some key routes.ATP, therefore, requires additional funding and British Rail is in debate both internally and with government as to the preferred way of generating these funds’.Nothing changes it seems.


Anyway, while this was happening, the economy was about to crash, and rail ridership with it. John Major became Prime Minister and in 1992 his Transport Secretary John MacGregor published the White Paper starting privatisation.


‘The present national economic priorities mean that the level of investment of the existing railway is below the £1 billion annual figure needed to keep the system in good running order. Against this background of limited resources, a programme to install ATP on a network-wide basis must be weighed alongside necessary investment in modernisation.’ British Rail report on ATP, July 1994

But in calling for ATP in five years, Hidden had also recommended that Government and BR needed to ‘conduct a thorough review of its investment appraisal procedures so that a financial value can be put on safety’. The purpose of this review was so that ‘the cost effectiveness of safe operation of the railway occupies its proper place in a business-led operation’.

With hindsight this was a case of be careful what you wish for. As BR noted at the time, ‘appraisal procedures have greatly improved in the last five years’. And when the BR review was published it only emphasised the ‘conflict’ with the various recommendations on ATP. BR’s more-detailed Cost/Benefit Analysis (CBA) called into question ‘the high priority given to ATP five years ago’. Based on an installation cost of £545 million, the cost per fatality averted – or ‘life saved’ – by

ATP was around £15 million.

With chilling prescience, BR added that even if it was assumed that ATP would prevent an accident involving 50 deaths, in addition to those predicted from historic trends, the cost per fatality averted would still be in the £9-10 million range.


At the time, the ‘value of a life’ applied to road schemes was £700,000. It was the potential for multiple fatalities in catastrophic accidents that tripled the rail value to £2 million.

Completion of the report was delayed because, given BR’s commitment to implement Hidden, the evaluation results were so unpalatable that many of the figures were sent back for re-examination and verification. But in March 1994, BR submitted the report on its review to the Transport Secretary who passed it on to the Health & Safety Executive. Its broad conclusions were:

▀ network-wide ATP gave costs of £8-14 million per fatality averted;

▀ other SPAD reduction measures would produce a better payback.

Not surprisingly, HMRI, which had continued to press for ATP in its accident reports, was dismayed by the results. But even applying the most optimistic assumptions reduced the cost per fatality averted for full fitment to £10.9 million and £5.5 million for selective fitment, which was an operational non-starter. HMRI’s Deputy Chief Inspector admitted in 2000 that while there had been differences between HSE, Railtrack and BRB on the methodology to be adopted for CBA, these did not alter the conclusions of the BR Report.

TPWS principle: when the system is acting as an overspeed sensor, the trigger loop and arming loop are spaced apart, when acting as a trainstop, they are together.


On 1 April 1994 Railtrack took over responsibility for infrastructure from BR, and with it ATP. In July that year Railtrack and the BRB sponsored a conference on ‘Value for money in transport safety measures’. Released at the conference was a popular version of the ATP CBA review.

Put bluntly, this conference was a softening up exercise ahead of the announcement that network-wide ATP installation was dead. The invitation list included industrialists, academics, consultants and even technical journalists (!), all with a ‘known experience or interest in safety’. As David Rayner, then Railtrack’s Director Safety & Standards, subsequently noted, the conference endorsed BRB’s conclusion that BR-ATP ‘as designed and piloted could not be rationally justified as a cost-effective exercise of public expenditure according to the requirements of the Health & Safety at Work Act’.

So, ATP was dead. But in a note on alternative technology, the BR brochure had said that a project to extend the existing Automatic Warning system (AWS) with an additional magnet would also include looking at ‘fitting a device between signals to trip the brake of a train exceeding the design speed of approach or going too fast approaching a speed restriction’.


HMRI’s endorsement of the BR review’s findings was sent to the Health & Safety Commission in 1994 and forwarded to the Transport Secretary Dr Brian Mawhinney on 23 December – something to ponder over Christmas. On 30 March 1995, the new strategy was announced in response to a parliamentary question.

Dr Mawhinney said that ‘applications of ATP, other automatic devices or measures giving protection against ATP-preventable accidents may be justified on parts of the network’. However, network-wide fitment of ATP as piloted was not justifiable because the costs far outweighed the benefits. Meanwhile, the feasibility of a drivers’ reminder device, which would help prevent drivers inadvertently starting against danger signals when the train was ready to move, was being researched. Dr Mawhinney also confirmed that a further project was examining enhancement of the present Automatic Warning System ‘so that the brakes are applied automatically if a train approaches a red signal at excessive speed indicating an impending signal passed at danger or over-speeding incident’. A detailed specification was being drawn up.


And so the Train Protection & Warning System (TPWS) was born. It retained the warning function of AWS and added train protection.

Responsible for progressing the two systems mentioned in the minister’s statement was the SPAD Reduction & Mitigation (SPADRAM) working group.Note Reduction and Mitigation, not prevention.

At up to 40mph, TPWS would stop a SPAD within the 183-metre standard overlap beyond a signal. To cater for speeds above 40mph, an over-speed sensor would be located around 200m ahead of the signal, doubling the braking distance and covering speeds up to 70mph.

In October 1997, trial fitment of 20 trains and 10 signals on Thameslink began. Tests validated the concept. SPADRAM estimated that TPWS would eliminate 70% of the ‘equivalent fatalities’ at a cost of 10-20% of ATP.

TEETERING But, as HMRI’s Assistant Chief Inspector recalled in 2000, TPWS was ‘teetering on the brink of extinction by CBA’ when Southall reinforced the case for enforcement.

The result was the Railway Safety Regulations 1999 which required network-wide fitment of TPWS by 2004. This covered all signals protecting a junction and included fitment to freight locomotives.

Following Ladbroke Grove, completion of fitment was brought forward to 2003. A largely unsung cross-industry programme saw this target met, on time and to budget. This was despite the number of signals being fitted increasing, eventually totalling around 13,000 (42% of the signal network), plus fitment to permanent speed restrictions and buffer stops.

This is not the place for a technical description of TPWS, except to mention the later extension to cover 100mph services in the form of TPWS+. This was added to the top 100 sites prioritised on the risk of trains exceeding the normal 75mph effectiveness limit. In standard configuration TPWS+ is fully effective to around 105mph with 12%g braking rate.

As an indication of the effectiveness of the SPADRAM programme, in 1999, just before Ladbroke Grove, the SPAD rate (SPADs per million train miles) was 2.67. Ten years later this had fallen to 0.66, a 75% reduction. The SPAD risk was 12.8% of the 2001 baseline figure.


1. Ensure TPWS continues to comply with the requirements of the 1999 Railway Safety Regulations and the relevant exemptions.

2. Ensure TPWS continues to be reliable and continues to meet or exceed the minimum availability requirements specified in Railway Group Standard GE/RT8075.

3. Review the application of TPWS to infrastructure and trains on an ongoing basis to ensure that the risk mitigated by TPWS, in conjunction with other risk mitigation measures, remains as low as reasonably practicable.

Four-foot installation: TPWS grille in the Network Rail training centre in Warrington.
Courtesy Network Rail

Since installation there has been continuous cross-industry monitoring of all aspects of TPWS, both technical and operational. Currently this is the responsibility of the Train Protection Strategy Group (TPSG) on behalf of the Vehicle/Train Control & Communications System Interface Committee (V/TCCSIC) of the Rail Safety & Standards Board (RSSB).


In 2009, the TPSG published its first strategy document, which was updated in 2015.

With the growing tendency for significant anniversaries to receive high profile media coverage, train protection is likely to be under the microscope with the 20th anniversary of Ladbroke Grove in October this year. As part of its work the Group has asked RSSB to commission a review of the Uff-Cullen joint inquiry.

In 2015 the TPSG reverse-engineered the CBA of enhancing TPWS. Starting point was the residual level of risk.

At the current Value of Preventing a Fatality of £1.8 million, plus an average value of around £1.8 million per accident for material damage costs for train collisions and derailment, the exercise showed it would be reasonably practicable to spend around £2.4 million per year to mitigate all the risk from such collision and derailment events.

Assuming TPWS has a future life expectancy of 25 years at its current level of deployment, the maximum discounted spend today that would be reasonably practicable to mitigate this residual risk would be around £40 million. Clearly no level of TPWS implementation could mitigate all the risk.

Nor does this level of spending allow for the progressive fitment of the European Train Control System (ETCS). One estimate indicates that ETCS would reduce the safety benefit to be derived from TPWS over the period to 2032 by 12%.


With at least a further two decades ahead for TPWS as the UK’s front-line train protection system, the TPSG is not easing up its efforts to improve its effectiveness. Having demonstrated that expenditure can be justified, informed sources report that a significant upgrade may be imminent.

This could be timely, given the recent rise in SPAD risk from 50% to 68% between January and February 2019, the largest recorded increase in a single month since the September 2006 baseline. This rise was attributed to three high-risk SPADs in February.

Meanwhile, the TPWS story is a reminder that on the railways, stop-gaps have often turned out to be effective long-term solutions. The Deltics were a stop-gap for East Coast main line electrification and IC125 was a stop-gap for the Advanced Passenger Train.

As my old chum Dave Fenner, who was Railtrack’s Development Engineer – Train Protection, noted in 2000: ‘Modern technology enables us to conceive solutions to do almost anything, especially using computers. However, this can result in expensive and potentially unreliable systems (and) in a safety environment we may not have the time to resolve these challenges. Aiming for the possible obstructs the practical. It is essential we have a clear idea of what must be achieved and by when’.

Two decades later, and with the first main line ETCS implementation just out to tender, there is no doubt that that Mr Fenner and the SPADRAM team got their focus on the practical right. And the sentiment rings true today.

A note of thanks to Mrs Ford whose professional filing of over 40 years of conference papers gave me instant access to the documents referred to in this article.


‘When this work (SPADRAM) began, there were over 500 SPADs a year; last year there were 307 (on a much busier railway), although the fact that the risk has recently risen to 63% of the September 2006 baseline reminds us that we cannot be complacent in this area.’ RSSB Safety report 2018-19