Better safety, not more safety

In a blog for Global Railway Review, former train driver Peter van der Mark discusses safety on Britain’s railways and looks back at the implementation of TPWS train protection system together with Automatic Warning System and its outcome on driver action.

After a recent serious SPAD incident in the UK, in which an excursion train passed a signal at danger and came close to colliding with another, the question is why the driver isolated the Train Protection Warning System (TPWS) and why he didn’t stop and call the signaller? The industry rulebook is the place where investigation results end up as binding instructions to staff, but: The more complex the rulebook, the higher the chance of non-compliance, whilst interaction with reality often causes non-adherence to the rules. Chris Carr, ERA’s Director for Safety, remarks elsewhere that we need better safety, not more safety. I’d like to put forward personal work experiences on the railways of Britain that illustrate the issue with the following findings.

Keeping track of delay performance of a high-speed train driver depot from 2002 till 2008, sometime after 2003, when TPWS train protection finally was installed, my employer’s trains were noticed to get stopped out of course in increasing numbers. The cause transpired to be drivers “failing to cancel” the Automatic Warning System (AWS). This is a system of which the basic functionality goes back to the beginning of the 20th century, but the present magnetic induction system was installed from the late fifties until well into the seventies. AWS, like Indusi in Germany or the “crocodile” in France and Belgium, warns a train driver that either a signal does not display a clear, green, aspect; that he approaches a more severe speed restriction or that he approaches a protected track-work zone. For both the latter, permanent magnets in the track are used and signals have permanent/electromagnetic magnet inductors that can undo the warning sequence. If a signal magnet has failed, however, its permanent magnet will always trigger a warning; it is a failsafe system. If a warning is triggered, the driver must push and release a button within a specific time, but due to the inaccurate electro-pneumatic on-board equipment, this could be anything between 3 and 4 seconds. Also, if a driver spotted a potential warning (signal aspects, a known warning for a speed restriction etc.) he could anticipate that warning by pushing the button and, on hearing the warning kick in, release the button. If for whatever reason a warning was unexpected, or the equipment itself failed to cancel, there was time to have another go and trains hardly ever got stopped. So why are they now?

On developing the TPWS, for unclear reasons the system was merged with the old AWS. And because the electronics were more accurate, the opportunity was taken to “bring back” the reaction time to cancel from whatever it was to exactly the originally intended 2.7 seconds on trains authorised to run up to 100 mph (160 km/h) and 2 seconds for trains authorised to run faster. Furthermore, the anticipation of having to cancel was disabled; cancelling could only be done in the 2 to 2.7 seconds window that the warning was live. Information to drivers was inexplicit and unclear about the ramifications it would have on years of experience with the old AWS system. Also, due to the poor TPWS Man-Machine-Interface (MMI), it was not clear which of the two systems intervened; the old AWS or the new TPWS. Because my employer’s driver management additionally insisted that the arm was to be brought to the cancel button only after the warning had started, the cancelling of that warning took 1.6 to 1.9 seconds of the 2 available, which left 0.4 to 0.1 second to deal with “fail to cancel” issues. It became obvious that any failed cancellation or unexpected warning would trigger a stop intervention by the AWS. But because the drivers never had such experiences before with AWS, they looked at new-fangled TPWS as spuriously stopping them, which hid the real cause for a long time. Unnecessary effort was spent on finding out what was wrong with the TPWS train protection side, instead of looking at the changes to the AWS warning side.

There was a more insidious side to it. Because so many trains got stopped, bad habits developed. Drivers would reset the system with the old AWS cancel button or switch it out as defective. They then waited for the brakes to release and depart again, not contacting the signaller. One day a train got stopped at a place where the double-track line became a single track. The driver immediately reset and went away after brake time-out, but he had completely missed the fact that this time TPWS had intervened as he had passed a red signal. An alert signaller who was good with the radio was all that stood between a fright and a head-on collision of two trains. After that, rulebook TW1/1 specifically demanded that any intervention had to be reported to the controlling signaller. Delays skyrocketed and under the British penalty system became very costly indeed.

A system meant to increase safety in fact had side-effects that demonstrably diminished safety, the ill-effects of which in all likelihood were involved in near-misses that could have taken many lives. TPWS was involved in problems in the platforms of terminus stations, where it was installed as an afterthought to diminish the severity of bufferstop collisions. Unfortunately, it stopped many trains half-way down the platforms for unforeseen technical reasons, the drivers (blamed for speeding) decided to come in at 3 mph (5 km/h) which on trains with hand-operated doors had the commuters throw them open and get off well before the train came to a stand. That was changed under media pressure and is no longer an issue. In the meantime a much better AWS/TPWS MMI has been introduced, splitting the AWS and TPWS indications again, based on reports that were already brought out after research in 2004 and 2005. The many older trains will hardly benefit from it, but it is the proper way forward nevertheless.