Well I was wrong

Hardly any fun and games to report on Thursday (sorry for the late post, I was writing the extra stuff :P). After a nice, relaxing lie-in, I made it to ROV in time to catch the 14:55 train to WOO. At WOO, I had a little look at the sidings, before changing onto a NOR (Northolt) service which took me into LIS (Liverpool Street) nice and smoothly. It was very dark, though, the rain was coming, and by the time I'd reached the sub-surface line platforms at LIS, it was raining. I changed onto a Circle line S7 which took me to Euston Square and, happily, the rain had pretty much stopped when I left the station.

On the way back, I caught a Hammersmith & City line train (to Barking), which took me to LIS. I changed for a Central line train to DEB (Debden) and that took me home to WOO. Unfortunately, I just missed the HAI train and was left in the cold for a bit. At least it had stopped raining. Naturally, when the HAI train finally left 21 road (I arrived before it had even reached WOO from the Hainault loop), I caught that back to ROV.

Before that, however, I did notice one small thing of note. Usually, the semi-automatic starter signal at WOO's westbound platform 2 (signal WOO 7266) doesn't clear until the train heading on to SOW (South Woodford) has arrived (or, at least, is close to arriving). The next signal up (I don't know its number), which is placed just before the points at the end of 21 road (that's the SOW end, used by a train from 21 road heading westbound, and for direct access to 21 road from the eastbound track), usually clears shortly afterwards. These signals are semi-automatic signals, which I've described before on this blog.

A semi-automatic signal may be controlled by the signalling computer, or by a signaller through manual intervention. The key point, though, is that semi-automatic signals are kept at danger (i.e. they display a red aspect) by default and will remain at danger until explicitly instructed to clear by the computer, or the signaller. Automatic signals will clear to green once the block ahead of them has been proved clear, whereas semi-automatic signals remain at danger, even if the block ahead is clear, until explicitly instructed to clear. Obviously, however, they will not clear if the block ahead is occupied.

Now, in the case of these two signals at WOO, they obviously control the passage of trains westbound onto SOW, from WOO platform 2. WOO 7266 also protects 21 road and will prevent any train from leaving WOO if a train is pulling out of 21 road into eastbound platform 3. So signal WOO 7266 and the signal clearing trains out of 21 road work in conjunction with another.

Now, naturally, it doesn't actually matter when WOO 7266 clears, because the signal controlling access to WOO from 21 road will not clear trains onto a conflicting path if WOO 7266 has cleared. So, for that reason, WOO 7266 can be instructed to clear the moment the block ahead of it is clear of a train and this is perfectly safe, as no train can leave 21 road and cross the westbound track from platform 2. (A train could be cleared from 21 road into platform 1, or into the sidings, but that doesn't matter, because, in this case, the train would not be routed into the path of any train heading west from platform 2). However, as I've said, WOO 7266 is usually cleared fairly late. Obviously, everything needs to be proved safe (e.g. the points must be checked to be set in the correct position, the block ahead must be proved to be unoccupied, etc.) but then the signal can clear whenever it's instructed to do so, usually in accordance with the timetable. I imagine it usually clears fairly late to enable a train to easily be cleared out of 21 road early, if - say - there was a reason to do this ahead of the timetabled time. But I'm just speculating, it could merely be an artifact of the way the signalling system is programmed and set up.

Today, however, WOO 7266 (and then the next signal on the westbound) had cleared 2 or 3 minutes before the next train through was due to arrive. I don't think it can have left BUH (Buckhurst Hill). This isn't all that special, as I say, it's perfectly safe and perfectly doable, it just caused me to do a bit of a double-take, as I'm not used to seeing that. But maybe it's more regular than I realise and I'm simply not at WOO enough to notice. It just made me think that perhaps those signals were being controlled manually, since this is uncommon. Maybe not though, I really only brought it up to talk a bit about signals and because I haven't seen it before, it caught me by surprise.

---

Since I didn't have much to say about my journey on London Underground today, I thought I'd mention that one of the things I've been doing recently is reading the HSC report into the Ladbroke Grove rail crash. The report was prepared by the Rt Hon Lord Cullen PC of The Ladbroke Grove Rail Inquiry and was split into two parts. The report, and other documentation, are available here: http://www.rail-reg.gov.uk/server/show/nav.1204.

This was a terrible incident involving a 3-car British Rail Class 165/1Turbo  DMU (Diesel Multiple Unit) and an InterCity 125 HST (High Speed Train). Specifically, the InterCity 125 consists of a set of Mark 3 coaches (in this case, eight), with a British Rail Class 43 diesel-electric power car at each end. The Turbo was operated by Thames Trains and the HST was operated by FGW (First Great Western).

At ≈08:06 on 05/10/1999 the Thames Turbo, driven by Michael Hodder, left Paddington's platform 9 bound for Bedwyn. At 08:08:25, the Thames Turbo passed signal SN109 (SN stands for Slough New, referring to the Slough IECC (Integrated Electronic Control Centre)) at danger. "Danger" is railway terminology for a red signal and this type of incident is referred to as a SPAD (Signal Passed At Danger). As a result of this, the Thames Turbo was inevitably routed into the path of the HST - the 06:03 from Cheltenham, which was approaching Paddington - its final destination. Action was belatedly taken by signallers in Slough IECC, who put back the signal in front of the HST (SN120) in the hope of stopping the HST before it could reach the Thames Turbo. This action was taken far far too late and had almost no effect. An emergency stop message was also broadcast to the Thames Turbo over Cab Secure Radio. It is not possible to determine whether it was received before the crash, if at all, however, this action was also taken far too late. Although both trains braked hard before impact, the braking was much too late to have any appreciable affect. As a result of the SPAD at SN109 the two trains collided - almost head-on - at a combined speed of approximately 130 mph. The effect of this was devastating. 31 lives were lost, >520 people were injured.

The report into this incident is some 299 pages so you understand that I am about to abbreviate the reasons for this, but it was largely due to the unusual layout of this signal, the extremely poor sighting of this signal (and other signals in the area), large deficiencies in the training of Michael Hodder (who seemed, by all accounts to have been a good trainee) and the lack of any robust system for the prevention of SPADs. A system called AWS (Automatic Warning System) was in use, but this was not sufficient to prevent the accident.

AWS works by warning the driver of the aspect of the next signal. If the next signal is green, a bell sounds (it has the sound of a very clear 'ping'), whereas if the next signal is not green (and therefore showing a restrictive aspect) a horn will sound. This horn must be acknowledged by the driver within a set period of time, or else the brakes will apply automatically. Further, a visible indication (known as the sunflower) will be illuminated in the cab as a reminder. This system is incapable of distinguishing a red aspect from any other restrictive aspect (the other two possible restrictive aspects are yellow and double yellow, although some signals cannot display double yellow and some cannot display either). It, also, only gives the driver an additional early warning. It is an aid, nothing more. (Although, to be fair, the requirement that the horn be acknowledged would allow a train to be stopped automatically if the driver were incapacitated, say.)

Further, the poor layout around Paddington station, serious deficiencies in the safety management of Railtrack (who owned the track and signals in the area), the poor training regimen and driver management of Thames Trains all played a part. Allied to these factors was the failure of the signallers in Slough IECC to take swift and immediate action. This was due, in large part to substandard procedures, rules and training; as well as complacency on the part of the signallers and the view that SPADs were the responsibility of the drivers.

---

Further details for those who are interested are given below:

At 08:06:20, the Thames Turbo passed signal SN17, which controlled departure from platform 9 at Paddington. SN17 was showing a clear aspect.

On the mainline, we have two-aspect, three-aspect and four-aspect signalling. A two-aspect signal will display a red (danger) aspect if the block ahead is occupied and a green (clear) aspect if the block ahead is clear. Drivers must stop their train at a danger signal as it is unsafe to proceed. A green signal indicates that the driver is cleared to proceed up to the next signal. The next signal after a green signal could be red or green, there is no way of knowing. This looks something like this:

A diagram showing the operation of two-aspect signals. The signal to the right is at danger, because the block which it controls is occupied by a train (in blue). The signal to the left is at clear, because the block which it controls (i.e. the section of track up to the next signal (generally including an additional overlap, for safety)) is clear

A three-aspect signal obviously also displays danger if the block ahead is occupied. If the next signal is at danger, then a three aspect signal will display a yellow (caution) aspect, warning drivers that the next signal is at danger. This makes sure the driver has enough time to slow down and is especially necessary if the line speed limit is quite high. If the next signal is displaying a proceed aspect (i.e. not red (i.e., in this case, green or yellow) - an aspect which would allow a train to proceed and would not require it to stop), the a three aspect signal will display a clear (i.e. green) aspect, like so:

A diagram showing the operation of three-aspect signals. The signal on the right is at danger because of the train occupying the block it controls. The middle signal is at caution because the signal to the right is at danger. The signal on the left is at clear because the next signal is showing a proceed aspect

Finally, with four-aspect signalling, we have an additional warning. Obviously a four-aspect signal will show danger if the block ahead is occupied and caution if the following signal is at danger. It will additionally display a double yellow (preliminary caution) aspect if the next signal is at caution. It will display a clear (green) aspect if the next signal is green or showing double yellow:

A diagram showing the operation of four-aspect signals. The signal on the far right is at danger because of the train occupying the block it controls. The next signal to the left is at caution because the following signal is at danger. The next signal to the left of that is at preliminary caution because the following signal is at caution. The signal to the far left is at clear because the following signal is at preliminary caution

Now, that's just a bit of background. I do believe SN17 was a four-aspect signal, but I can't be sure. Anyway, SN17 also had a theatre indicator, which is a route indicator, indicating which route is to be taken by means of a letter(s) or number(s) which the driver will be able to interpret from their route knowledge. Such a display is achieved by an LED matrix.

For example, on London Undeground's Bakerloo line (and London Overground's Watford DC line (Euston-Watford Junction)), there is a three-aspect signal, with theatre route indicator, which controls the approach to Willesden Junction on the northbound (from Kensal Green). A letter "M" displayed on the theatre route indicator, indicates that the train is cleared into northbound platform 3 at Willesden Junction. A highly simplified depiction of this is given below, with a grossly oversized signal for illustrative purposes:

An extremely simplified diagram showing a three-aspect signal (WS21, I believe) which is displaying a clear aspect, with theatre route indicator indicating the route into platform 3 at Willesden Junction is set (by means of a letter "M")

So, back to the point at hand, SN17 was displaying a green aspect, along with the number 4, indicating that the train would be routed onto "line 4". Having departed Paddington's platform 9, the Thames Turbo accelerated up to 46 mph.

At 08:07:00, the Thames Turbo passed signal SN43, which was also displaying a green aspect, along with the number 4 on its theatre route indicator. This indicated that the Thames Turbo was cleared to proceed along line 4.

At 08:07:20, having made its way out of Paddington on line 4, the Thames Turbo passed signal SN63 at preliminary caution. SN63 did not have a theatre route indicator, but a feather indicator, consisting of five white lights arranged in the direction of any diverging route.

So, to exemplify, a feather indicator will be illuminated if a diverging route is set, whereas "main aspect only" (i.e. feather indicator off) indicates the straight(est) route, continuing on the current path, is set. The diagram below (with another grossly oversized signal) demonstrates this:

A diagram showing the operation of a feather indicator. The lit feather indicator (with green aspect) indicates the diverging route to the right is set. If the feather indicator were not lit, that would indicate that the straight route is set

There may be multiple feather indicators, each set at the angle which best represents the path to be taken. One counts through the indicators in a clockwise direction, with the indicator at the highest angle to the vertical (in the clockwise direction) indicating the rightmost route and, of course, the indicator at the highest angle to the vertical in the anti-clockwise direction indicating the leftmost route:

A diagram showing the operation of multiple feather indicators. This signal indicates that route 4 (the rightmost route) is set. If none of the feather indicators were lit, that would indicate that route 1 is set. Route 2 is indicated by the first feather indicator (at the lowest angle to the vertical) and route 3 by the second indicator, which is at 90 degrees.

Now SN63 only had one feather indicator and it was not lit - instead SN63 was displaying main aspect only, indicating that the Thames Turbo was to continue along line 4. Since SN63 was at preliminary caution, the AWS horn had previously sounded and was cancelled. Because of the double yellow aspect, driver Hodder applied step 1 braking and reduced speed to 38 mph.

At 08:07:50, the Thames Turbo passed signal SN87 at caution. The feather indicator was also lit, indicating a move from line 4 to "line 3". Again, the AWS horn had sounded and was cancelled. For about 740 m, the Thames Turbo coasted, before Notches 1, 5 and then 7 of the throttle were engaged, increasing the speed, eventually, to 41 mph.

At 08:08:15, the AWS horn corresponding to signal SN109 sounded on the Thames Turbo and was cancelled.

At 08:08:25, the Thames Turbo passed signal SN109 at danger. SN109 was arranged in a curious, reverse L pattern, like this:

A diagram of signal SN109. Note the curious position of the red light. (All lights are shown to demonstrate the position of each of the colours). On the left we have a theatre route indicator. Above the red light is a shunt signal of the type used on the mainline. It isn't important

Since the signal was at danger the theatre route indicator was not illuminated - itself a potential clue that the signal was not displaying a proceed aspect. The speed at which the Thames Turbo was travelling when it passed SN109 at danger was 41 mph. It continued to accelerate, eventually reaching 51 mph. Shortly (a few seconds) before the collision, driver Hodder applied service brake 3, followed (0.05 seconds later) by the emergency brakes, the throttle slammed shut.

Meanwhile, the HST was approaching signal SN120, which had turned green at 08:08:40. At 08:08:50, SN120 was put back to danger. This was an emergency measure taken by the signallers in the hope of stopping the HST. This action was taken belatedly, because the signallers had believed the Thames Turbo would stop without their intervention (they had believed it to be a simple over-run, that the Thames Turbo had simply not stopped in time, rather than not having been slowed at all.) An emergency stop message was also broadcast (it is unknown exactly when) to the Thames Turbo. When SN120 was put back, the HST was 179-278 m in rear of the signal, travelling at 81-84 mph. At approximately 08:09 the HST passed signal SN120. According to passengers aboard the HST, the train braked heavily but this was immaterial. The two trains collided, almost head-on, at approximately 130 mph. Both trains sustained extreme damage, far beyond what could reasonably have been mitigated against. Although the larger, heavier HST fared better than the smaller Turbo.

The fuel tanks, which could not be reasonably expected to survive any such impact ruptured and fuel was expelled under pressure. A fireball was ignited, possibly by the overhead line equipment, possibly by thermite sparking, or, perhaps, by on-board electrical equipment. This fireball caused further damage to the trains - particularly coach H of the HST - and further devastation. It appears that diesel had entered that coach through one or more of the numerous openings caused by the crash, allowing the fireball to propagate through the coach and for flammable materials inside the coach to burn. Trackside fires were also started in the aftermath of the accident.

Lord Cullen does an admirable job of assessing the cause of this incident and is to be commended on his consideration of the root causes. He undertakes a laudable, broad analysis of events and - quite correctly - includes discussions about Railtrack and the infrastructure, signal sighting, procedures, driver training, and management at various levels in Railtrack and Thames Trains. I can really merely abbreviate his discussion, but I will try to flesh out what I said above, with respect specifically to why driver Hodder SPADed SN109. Signal SN109 was a multi-SPAD signal (although the inexperienced driver Hodder was unaware of this), with a curious layout, as I have already remarked. The training programme operated by Thames Trains was severely deficient and did not seem capable of dealing with the substantial recruitment process that they had recently initiated. Route training was sub-standard and Michael Hodder appears not to have been formally assessed on the route around Paddington station. It seems to me that Lord Cullen is (for, in my opinion, very good reasons) happy to conclude that Michael Hodder was under the opinion that the he had a proceed aspect at SN109 (a single or, perhaps, double yellow). This mistaken belief is likely to have been formed due to the bright sunlight, allied to the extreme difficulty of sighting SN109. Whilst sunlight can, in principle, make signals difficult to read anywhere, the problems with SN109 made it difficult to correct any misreading - one's window of opportunity for realising one's mistake was very small at this signal, for one could not see it for very long, nor ever very clearly). Also, it should be obvious that a particularly difficult signal will make any sighting problems caused by the sunlight very much worse. In particular, the position of the red aspect, which is non-standard, made SN109 a novelty, meaning that a driver's sighting heuristics could be compromised, especially for an inexperienced driver with no specific instruction regarding SN109. In short, it doesn't behave like other signals, it doesn't do what you're used to. The signal was obscured by a low bridge and over-head line equipment for much of the approach to it. This makes it difficult to see the signal in the first place, gives you less time to read it and take in its message, and less time to notice an earlier error. Finally, the absence of any robust system to bring a train to a halt after a SPAD, or to prevent them in the first place, meant that there was no failsafe in place to mitigate against the risks of a SPAD at SN109.