April 2016
This is a collation of some of the world’s railway formal inquiry reports. It includes a brief incident
synopsis, along with the main causes and recommendations from each investigation.
Readers may find some of the actions and recommendations useful to their own operations.
Co-ordinated by Greg Morse, Operational Feedback Specialist, RSSB
Contents: (Click to navigate)
UK: Animal incursion, collision
Godmersham, 26 July 2015
and
derailment
at
Australia: Signals passed at danger by passenger train at
Upwey and Upper Ferntree Gully, Victoria, 12 April 2015
Australia: Platform-train interface fatality at Heyington,
Victoria, 22 February 2014
UK: Collision between tractor and train at Oakwood Farm
UWC, 14 May 2015
Oakwood UWC
Some of the key issues raised and/or suggested by the stories in this edition:
Animals on the line
Cab-to-shore communications (including post-incident GSM-R integrity)
Fencing maintenance
Boundary management (risk assessment, inspector competence)
Obstacle deflectors
Following Rule Book post-incident
SPAD
Distraction
Safety critical communications
Lack of situational awareness
Platform-train interface (falls between trains and platforms)
Crossing user behaviour
Crossing signage
Crossing risk assessments
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk
6 April
UK: Animal incursion, collision and derailment at Godmersham, 26 July 2015
For the full report, click here: LINK
At around 21:40 on Sunday 26 July 2015, a
passenger train (Class 375) derailed after striking
eight cows that had gained access to the railway
at Godmersham in Kent.
During the course of the derailment, the train
struck the parapet wall of Trimworth Bridge,
destroying the wall and its railings, and causing
damage to the abutments. There was
significant track damage, including deformation of the rails in the vicinity of the bridge.
There had been a report of a cow on the railway an hour earlier, but a subsequent examination by
the driver of the next passing train did not find anything. There were no further reports from other
trains that passed before the accident occurred.
Despite the speed of the train at impact (69 mph) and the potentially severe nature of the accident,
the driving cab and passenger compartment sustained relatively minor damage. Furthermore, there
were no reported physical injuries.
RAIB’s analysis of the derailment path suggests that the consequences were mitigated by two
external factors. The first was the impact with Trimworth Bridge, which deflected the train back
towards the railway. Secondly, the path of the leading carriage was constrained by the right-hand
wheels running against the inside face of the left-hand rail. These factors reduced the probability of
the train falling further down the embankment.
Because the train’s radio had ceased to work during the accident, the driver ran on foot for about
three-quarters of a mile towards an oncoming train, which had been stopped by the signaller, and
used its radio to report the accident.
The accident occurred because the fence had not
been maintained so as to restrain cows from
breaching it, and because the railway’s response
to the earlier report of a cow on the railway side
of the fence was insufficient to prevent the
accident.
In addition, the absence of an obstacle deflector
on the leading unit of the train made the
derailment more likely.
Although not linked to the accident, RAIB observes that:

The actions of the driver and the signaller following the accident were not fully in accordance
with the Rule Book; and

The GSM-R radio in the leading unit of the train became inoperative as a result of the accident,
which meant the driver could not use it to contact the signaller immediately to report the
accident.
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk
The investigation identified two learning points, as follows:

This accident serves as a reminder of the importance of treating large animals within the
boundary fence as an emergency, and staff responding according to the Rule Book.

It also highlights the importance of railway staff being familiar with the Rule Book
requirements for actions to be taken after an accident. There may be some value in refreshing
drivers and signallers on the appropriate actions to take following a train accident, such as:
o
Through practising responses to emergency situations; and/or
o
Providing a simple set of basic instructions (eg a checklist or prompt card) in the
signalbox or train cab to guide them through the initial actions in case of emergency.
Action taken
Network Rail is in the process of reviewing its boundary management standard (NR/L2/TRK/5100).
This review was already taking place under a wider programme (known as Business Critical Rules) to
review its entire standards catalogue, and was not in response to the accident at Godmersham. RAIB
has seen some draft extracts of the off-track Business Critical Rules, in which there does appear to be
more detail about the nature and method of fence inspections than was present in NR/L2/TRK/5100.
However, there is currently no evidence that it fully addresses the factors identified in this
investigation, such as competence and consistency amongst fencing inspectors, and sensitivity of the
risk rating system. Network Rail is also producing standard design drawings for all its approved
fencing specifications.
In September 2014, Network Rail completed a review of the risks associated with objects obstructing
the line. The outcome of this review included a number of actions relevant to mitigating the risks
from animals on the line, including research to review the configuration of the railway boundary.
Locally, the off-track section at Ashford DU has replaced around 1300 metres of boundary fence at
Godmersham, which includes the site of the cow incursion, with chain link fencing.
Fencing inspectors at Ashford DU have been re-briefed to use a condition score 2 (ie poor) only if the
fence requires maintenance. Otherwise, the condition score 0 (good) should be used when no work
is required.
The Ashford off-track section has also instigated a process to review its boundary risk assessments
and, where necessary, accelerate the programme for repairs or renewals at high-risk sites. It has also
been trialling the use of additional measurement tools to quantify the condition of the fence (such as
wire diameter and tension).
The operator (SouthEastern) in conjunction with Network Rail and the manufacturer of the GSM-R
train radio system, Siemens Rail Automation Ltd, is in the process of investigating the nature of the
problem with the radio unit. As part of this work, the company issued a National Incident Report on
25 November 2015 (updated 26 February 2016) to raise awareness of this issue among other train
operators. Work is ongoing to confirm the failure mode, to determine the wider implications for
other electric stock types and the impact, if any, of fitting a secondary independent power supply.
SouthEastern has also instigated a programme of work to evaluate the safety case for retrofitting
obstacle deflectors to the Class 375 fleet.
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk
Recommendations

Network Rail should modify its risk rating methodology for fencing inspections to include
guidance on:
o
The design of the fence and its appropriateness for the adjacent land use; and
o
Condition ratings based on objective and relative (benchmarked) criteria.
If necessary, Network Rail should commission research to establish the relevant criteria.

Network Rail should provide clarification for signallers in terms of how they may interpret the
Rule Book regarding their response to reports of animal incursions, including guidance on how
long to continue cautioning trains and what constitutes being ‘sure’ that the line is again clear,
and re-brief as appropriate.

SouthEastern, in conjunction with Govia Thameslink Railway, Porterbrook Leasing Company
Limited and Eversholt Rail Group should develop, and then implement, a programme for
retrofitting obstacle deflectors to Electrostar units that are not currently fitted, but are
equipped with mountings for such deflectors.

RSSB, in consultation with the industry, and involving due industry process, should consider
the case for retrofitting obstacle deflectors to units that are not currently equipped, other than
those referred to in Recommendation 3. The analysis should include re-evaluation of the
findings of previous research in the light of this investigation and select for initial analysis the
fleets that are most likely to have a positive case for retrofitting obstacle deflectors.

SouthEastern, in conjunction with Siemens Rail Automation Ltd and Network Rail, should
complete their work to understand the nature of the problem with the GSM-R train radio
system in this accident, and then implement reasonably practicable measures to ensure that
its drivers have the facility to make an emergency call in similar situations in future. Examples
of such measures may include:
o
Improving the resilience of the GSM-R radio system following an accident such as a
derailment;
o
Providing drivers with GSM-R handheld units;
o
Ensuring that all relevant signal box telephone numbers are stored in drivers’
company mobile phones; and/or
o
Providing guidance to drivers on the actions to take if the GSM-R radio becomes
inoperative.
On completion of its work, LSER should update the National Incident Report it raised on this
matter.
Note: This recommendation may be applicable to other train operators.
Back to top
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk
21 April
Australia: Signals passed at danger by passenger train at Upwey and Upper
Ferntree Gully, Victoria, 12 April 2015
For the full report, click here: LINK
On 12 April 2015, just before the 15:42 Belgrave–Melbourne service arrived at Upwey station, the
signal control panel at Upper Ferntree Gully station lost functionality. As a result, the signaller no
longer had control or indication of the signals and interlocking at Upwey.
To continue train operations through the area, degraded working was instituted under the control of
the signaller at Upper Ferntree Gully. By this time, the 15:42 had been stopped at Upwey with the
departure signal at ‘stop’. Having been advised of the signalling failure, the driver contacted the
signaller at Upper Ferntree Gully for further instructions. A short time later, at about 15:51, the train
left Upwey and proceeded to Upper Ferntree Gully without authorisation.
The Australian Transport Safety Bureau (ATSB) found that the train passed both the Upwey Home
Departure and the Upper Ferntree Gully Home Arrival signals at danger without authority.
The procedures for passing Home signals following signalling system failure are well established
formal processes. At Upwey, the correct authority to proceed past the Home Departure signal that
was at ‘stop’ was a dictated ‘System Caution Order’. The train proceeded without this process being
followed and therefore without authority. In addition, the train then proceeded over no.41 points
without them first being secured by hand and the signaller being advised.
Having instructed the driver to check the points, the signaller’s expectation would have been that the
driver would proceed on foot to them, confirm their setting, and secure them by hand. The driver
would then return to his train to contact the signaller to advise accordingly and to have the ‘System
Caution Order’ dictated by the signaller and recorded by the driver.
The ATSB note that the following factors may have influenced the driver’s behaviour:

Distraction
The driver was anxious about having to operate the set of points that he had been requested
by the signaller to secure. He also reported having felt a sense of relief at seeing that the
points were set for his movement. This was probably because it was some time since he had
covered Dual Control Point Machines in his initial (2007) and refresher (2010) training. The
driver also suggested that he had never hand-operated such a machine in the field.
Nevertheless, the required procedure was straightforward and assistance was available from
the train controller or signaller if required.
Despite the ease of the task, it is apparent that the driver was apprehensive about operating
the points. It is possible that this led him to forget the requirements to check the points and
then obtain a Caution Order before departing from Upwey.

A misunderstanding of instructions from the train controller or signaller
The driver’s communication with the signaller was straightforward and there is no indication
that the controller’s instructions were misunderstood by the driver. The driver called the
signaller at Upper Ferntree Gully as instructed.
The communication between the driver and the signaller was not recorded and so its precise
nature is not known. Combined with the driver’s sense of anxiety at operating the points, it is
possible that the signaller’s instruction that the points be checked prior to receipt of authority
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk
was construed as permission to pass the signal. However, this would have been contrary to
procedure.
The driver was required then to report the state of the points to the signaller. The possibility of
a momentary lapse of awareness does not fully explain why, having observed the points, he
then continued without reporting their status.
The ATSB also found that there was a missed opportunity to contact the train after it was detected as
having departed Upwey unauthorised.
The operator has reviewed training provided to drivers in the operation of Dual Control Points
Machines. It is also considering the incorporation of SPAD alarms at this location, and modifying the
communications network to capture all safeworking communications at Upper Ferntree Gully.
Safety message
An extra degree of responsibility and situational awareness is demanded of staff under conditions of
degraded signalling and procedural safeworking.
Back to top
26 April
Australia: Platform-train interface fatality at Heyington, Victoria, 22 February
2014
For the full report, click here: LINK
At about 23:55 (local time) on 22 February 2014, an 18year-old male was fatally injured at Heyington station in
Toorak, Victoria, when he fell between a moving train
and the platform.
He was running alongside the moving train when he fell
trying to board it, as passengers inside were forcibly
holding the doors open.
The train was equipped with traction interlocking to
prevent it from moving with open doors. However, the
device, as designed, deactivated after a period of time and allowed the train to depart with the doors
held open.
Due to the curvature of the track, a wide gap existed between the middle of the carriage and the
platform.
Action taken
The operator – Metro Trains Melbourne (MTM) – has begun a risk review of the traction interlock
timing on its rolling stock.
In order to minimise the gap between the train and platform, it has also realigned the track at
Heyington; a rubber finger coping has also been installed along the entire edge of the platform face.
Furthermore, a barrier has been constructed at the platform entrance to deter passengers from
running for trains.
In addition, MTM has completed a survey of all stations, identifying those with curved track and
platforms of higher risk. In the short term, these platforms have had ‘Mind the Gap’ signs painted on
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk
them. Announcements are also made to warn passengers of the gap. Works plans have been
developed to institute further risk measures in the long term.
Safety message
The ATSB note that operators should ensure that safety systems fitted to passenger trains are
designed and operate to ensure the safety of patrons in the event of interference with the normal
operation of train doors.
Back to top
27 April
UK: Collision between tractor and train at Oakwood Farm UWC, 14 May 2015
For the full report, click here: LINK
On 14 May 2015, a passenger train collided with a
tractor at Oakwood Farm UWC near Knaresborough,
North Yorkshire. The train was carrying 66 people and
travelling at 65 mph, but did not derail. The collision
caused the front of the tractor to become detached
from its cab. The tractor driver suffered minor
injuries; the train driver was treated for shock.
However,
in
different
circumstances
the
consequences could have been much worse.
The tractor driver began crossing the railway after the
illuminated warning at the crossing started to display a red light. This was probably because he was
unfamiliar with the crossing’s operation; it is one of a small number in the country fitted with
remotely operated, powered gates. It is likely the tractor driver did not recheck the warning lights
after first stopping on the approach to the crossing to press a button to open the gates. This button
had not originally been intended to open the gates (it should only have been capable of being used
to close them). It was situated at such a distance from the crossing that the time it took for the
tractor driver to stop, open the gates and then drive onto the crossing, was greater than the time
between the warning light turning red and the arrival of the train. There was no sign at the button to
warn the driver to recheck the warning light before going over the crossing. RAIB also found that the
warning light was not conspicuous among the many signs present at the crossing.
The underlying causes of the accident were that Network Rail did not ensure that the risks at the
crossing were adequately mitigated, and that the process for the introduction of the gate operating
equipment was adequately managed.
RAIB also observed the following:

Network Rail’s retention of records relating to the acceptance of the power operated gate
opening (POGO) equipment was insufficient to show the basis on which decisions were made
during the history of the trials, and was not in accordance with Network Rail standard
NR/L2/RSE/100/05 (Product introduction and change).
It has identified the following key learning point:

Network Rail is reminded that NR/L2/RSE/100/05 requires that the acceptance history file is to
be retained for the life of the product plus seven years. The retention of records relating to the
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk
acceptance of the POGO equipment at Oakwood Farm UWC was insufficient to show the basis
on which decisions were made during the history of the trials.
Action taken
On 22 July 2015, the route level crossing manager responsible for Oakwood Farm UWC issued a
paper to the level crossing team outlining short term and medium/long term actions to be taken at
the interface. These included:

Meeting with the authorised user to discuss his legal responsibilities for invited crossing users,
and to discuss how risks could be managed;

Producing a briefing pack for the authorised user to enable him to brief his contractors;

Discussing with the authorised user the options for the closure of the crossing;

Reviewing the crossing’s signs and approaches to determine any enhancements to highlight
the risks; and

Replacing the current POGO equipment with the new nationally approved equipment.
On 12 October 2015, RAIB wrote to Network Rail asking it to consider the risks to crossing users
arising from being able to use the left-hand roadside buttons to open the gates. This was in the light
of the first standard for the POGO equipment stating that the intent of these buttons was for users
only to be able to close the gates and not open them. RAIB raised the concern that the left-hand
roadside buttons were further from the gates, gave a less direct view of the miniature stop lights
(MSLs) and that there were no instruction signs at this position.
Recommendations


Network Rail should:
o
Undertake a comprehensive review of the safety of the crossing at Oakwood Farm
UWC in the light of the findings in this report, its own hazard reviews, human factors
advice, and suggestions from the authorised user, in order to minimise the risk to
users; and
o
Implement any improvements identified in part a) above at Oakwood Farm UWC in
liaison with the authorised user.
Network Rail should develop and implement a programme for a timely review of the safety of
other UWCs it has fitted with POGO equipment and those it intends to fit in the future. The
review should include particular consideration of the following:
o
The design standard for crossings fitted with POGO equipment;
o
The ways in which users in different types of vehicles operate the crossing gates,
including the function of the gate operating buttons;
o
The clarity of instructions to enable unfamiliar users to use the crossings safely and
to minimise reliance on the briefing of all visitors by authorised users (which is not
always practicable)
o
Improving the conspicuousness of the MSLs (eg using two MSLs on each side of the
crossing, the use of larger ‘road traffic light’ style red and green lights, flashing red
MSLs, or wig wag lights) and the number and clarity of the signs, to minimise
confusion and distraction; and
o
Whether the opening of the gates should be disabled unless the MSLs are displaying
green lights.
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk
This review should draw on the findings from recent relevant research (eg RSSB’s research into
signs at private level crossings (T983) and human factors advice). Any measures for safety
improvements at such crossings should then be implemented at higher-risk locations and
incorporated into the standards for future designs.

Network Rail should review the robustness of its processes for accepting new equipment and
technology onto the railway, including particular consideration of the following:
o
Definition and adherence to an appropriate level of safety assurance;
o
The early involvement of human factors expertise, where appropriate, throughout
the product’s introduction;
o
The risk assessment processes applied to the new equipment itself and the
infrastructure into which it is to be integrated;
o
Definition and monitoring of trials, implementation of any resulting improvements,
and the roll-out of the product to other locations;
o
Maintenance of a hazard record for the life-cycle of the product; and
o
A process for undertaking regular audits to check the implementation of its product
introduction processes and correcting any identified shortcomings.
It should then, where appropriate, produce a time-bound plan for the amendment of the
standard.
Back to top
Produced by RSSB
Author: Dr Greg Morse
Email address: Greg.Morse@rssb.co.uk