7 years, 4 months and 18 days

7 years, 4 months and 18 days ago, a train crashed in Cumbria. So it seemed like an appropriate moment to post this extract from another project that I’ve been working on. It’s all a draft so your comments and corrections on matters of style and fact are very much welcome.

Just before 8am on the 5th of October 1999, a commuter train left London Paddington bound for Bedwyn in Wiltshire. A few minutes later, just as it was getting into its stride through the inner suburbs, it approached the location where the bidirectional terminus station tracks cross over one another and organise themselves into strictly segregated “up” and “down” direction main lines in a great tangle of points. The train passed straight through a yellow warning signal without slowing, and soon after skipped the red stop signal that was all there was to protect those Ladbroke Grove crossovers ahead.

The morning InterCity from Cheltenham hit the commuter train head on at a closing speed of 130mph. The front car of the commuter train was crushed by the heavy express locomotive, which in turn shed its diesel across the tracks while its rake of coaches, full of momentum and still propelled by a second locomotive at the rear, jackknifed into the flaming wreckage. Thirty one people were killed on that occasion; more than 500 were injured.

The driver of the Bedwyn commuter train was obviously unavailable to explain why he failed to respond to the two signals warning him of the danger ahead. The front carriage of his train was completely destroyed in the impact; neither driver was available to defend against media speculation and blame. An Inquiry was ordered, and Lord Cullen was appointed to get to the bottom of the matter and find out what went wrong.

Cullen was unusually thorough in his investigations into what went wrong at Ladbroke Grove, eventually publishing not one but two reports. The first, as you would expect, looked at the immediate cause of the crash. It reconstructed the story of how the driver of the commuter train jumped the lights, but found that far from being one man’s mistake, a catalogue of errors had added up to the catastrophe. The driver had only graduated from his training two weeks before the crash, and the inquiry uncovered multiple problems with the train company’s training programme, including inadequate instruction in signal procedures. The train was equipped with an Automatic Warning System, with audible in-cab alarms to warn the driver when the train passes signals — but the system was too simple to differentiate between yellow warning signals and red stop signals, and each time the Bedwyn train passed a signal, the driver had pressed the acknowledgement button to prevent the system from automatically stopping the train, as was the correct practice for yellow signals. The signals themselves had been erected in confusing arrays on gantries over the tracks, with views restricted by nearby bridges and by the line’s newly installed overhead power supply. And the position and design of the signal lights meant that at 8am on a bright October morning, westbound train drivers would see the reflection of the sun “lighting up all the signals like Christmas trees”, as one driver told the inquiry, making it far from obvious that a signal was set to red rather than yellow. The inquiry concluded that a momentary lapse of concentration caused the driver to respond incorrectly to the first signal, while the poor visibility and reflections led him to incorrectly read the second.

The inquiry revealed that the crash on the fifth of October was just the visible tip of an iceberg. The failures that led to the Bedwyn train jumping the lights had led eight others to do exactly the same at that one signal in the previous six years, with a 67 red signals in total passed on the tracks out of Paddington during that time. So-called “signal passed at danger”  events — SPADs — were endemic, and railway management had never taken the problem seriously enough. It was only by chance and good fortune on those previous occasions that there was no oncoming express train. In fact, it was later calculated that, at the rate that signal jumping was occurring at Ladbroke Grove, a catastrophic crash was absolutely inevitable in that location, and at an expected rate of one every 14 years.

In short, Ladbroke Grove revealed that there were widespread failings in the railway system that enabled mistakes to happen and to go uncorrected, and the risks resulting from these failings were accepted as an inevitable fact of life. Cullen realised that his inquiry into the one incident couldn’t ignore the much bigger problem on the railway. And he was proved right even before he could publish his conclusions. One year after the Ladbroke Grove crash, an InterCity bound for Leeds at 115mph derailed on poorly maintained track at Hatfield, killing 4 passengers and revealing the scale of the failings that would soon lead to the collapse of Railtrack, the privatised owners of the railway infrastructure.

Cullen knew that the failings on the railway were far too numerous to identify and fix in one report — he had identified a dozen serious problems in the Ladbroke Grove case alone — and besides, fixing problems would not guard against new ones creeping in. Instead, Cullen introduced the systems that would enable a continual process of identification and correction of problems, and a long-term plan for improvement. Key amongst these were the creation of the Rail Safety & Standards Board (RSSB) and the Rail Accident Investigation Branch (RAIB) to oversee an overhaul of the railway’s safety culture. RAIB, modelled on the older Air Accident and Marine Accident Investigation Branches, was created to ensure that an independent investigator got to the bottom of every incident on the railway, rooting out the failures at all levels of the industry. RAIB does for railway incidents today what Cullen did for Ladbroke Grove: the investigator makes extensive enquiries, consults the detailed operational records, and reconstructs events, leading to thick reports highlighting the lessons that are to be learned. Working practices get revised, enforcement of rules is tightened, and investment is made in new technology.

RAIB investigates incidents with the aim of preventing anything like them from ever happening again. But the one thing RAIB does not do is assign blame. It inherits from Cullen the recognition that in a complicated system like the railway, it takes more than one person to mess up. Malice and incompetence, laziness and greed, and momentary lapses of concentration are surely all characteristics that can be expected of people from time to time. But if those traits are ever allowed to lead to a catastrophe, it is the system that has failed at least as much as any individual.

As Cullen put it, describing the problem of the epidemic of jumped signals — SPADs — at Ladbroke Grove:

Underpinning my approach to these matters is the following. On the one hand the public quite rightly expects that there should be no SPADs which run the risk of causing injury. On the other hand human nature is fallible: no matter the training and experience — and they are extremely important — it is impossible to exclude the possibility of such an event. … if and to the extent that the safe operation of a train is dependent on one person it is essential that the demands which the railway system makes on him or her take adequate account of human factors.

This is a central principle of the systems that Cullen put in place. Ladbroke Grove was not the fault of one driver for failing to stop at a signal: the life and limb of 500 passengers should never have been placed entirely in the hands of one fallible human, just a single momentary lapse of concentration between him and disaster. So in Cullen’s system, the railway industry now identifies situations where one easy mistake could have terrible consequences, and it eliminates them.

Frequently, this means re-configuring track to reduce the kind of the movements that could allow a crash to happen, and introducing new technology to automatically protect trains from the minor mistakes that human drivers and signallers inevitably make. Cullen’s report, for example, specifically advised that Britain roll out technology called Automatic Train Protection (ATP). This system, coupled with other advances in modern signalling technology, makes it pretty much impossible to accidentally crash a train: the positions of all the trains on the line are automatically detected by circuits in the rails and the system keeps them apart by lengths of several train braking distances, refusing to allow the person operating the signals to put trains on collision courses; and the trains are sent information about speed limits and signal states, preventing their drivers from speeding and, even if the driver fails to do so, stopping automatically at red lights. ATP had been investigated by British Rail before privatisation, but the government at the time was not prepared to pick up the billion pound bill for installing it across the network. Once the inevitable had happened at Ladbroke Grove, it was perhaps a source of shame to some that the technology which would have made the crash impossible had been rejected on these cost grounds.

Equally important to the success of mechanisms like RAIB in building a safe system is a recognition of the Heinrich Triangle. This, remember, is the pyramid of the many near misses, minor incidents and major injuries that sits below every fatality. RAIB investigates all of these things, not just the headline crashes and fatalities. Even if nothing serious ever came of the near misses and minor lapses, understanding and eliminating the could-have-been calamities is vital if actual catastrophes are to be avoided. In 2013, for example, RAIB investigated such incidents as a part on a poorly maintained engineering train working loose, causing minor damage to track; a team of maintenance workers coming within 2 seconds of being hit by a train, when processes in place should have ensured they always clear the tracks with at least 10 seconds to spare; another in which a farmer was given the go ahead to use a manually operated level crossing while a train — which she saw in plenty of time to stand clear — was approaching; and a signal passed at danger on a minor line that had yet to be equipped with a full train protection system. None of these incidents had any consequences for life or limb — but it was only luck that there were not worse outcomes. So, rather than dismiss them as inconsequential, RAIB investigated and made recommendations for revised working practices and improved technology. New maintenance regimes were implemented for the engineering trains; the planning process for work teams was tightened; and a software bug in the signalling system for the farm crossing was identified and quickly eliminated. By tackling the could-have-been tragedies at the bottom of the pyramid, RAIB have stopped the tragedies at the top before they ever happen.

—

Ladbroke Grove was just one of a series of catastrophic train crashes that occurred during the short tenure of Railtrack as the privatised owners of the railway infrastructure. Before that, British Rail presided over regular train crashes — diminishing slowly in number and severity over time, but a fact of life nevertheless, from the 112 killed at Harrow and Wealdstone in 1952 to the 35 killed in a similar three train pileup at Clapham Junction in 1988. The pre-nationalisation rail companies were worse still, from the death of William Huskisson in 1830 on the opening day of the original passenger railway, through the dark decades of the late 1800s when sometimes rail disasters could be expected monthly, to the railway’s worst year, 1915, when 265 were killed in four catastrophic crashes. And these are merely the numbers for train crashes, not including the poor neglected navvies who built and maintained the lines or the men operating the freight yards. In the early years, such lowly workers were expendable labour, while politicians agreed with the railway companies — in which many owned shares — that safety regulations would be too burdensome a barrier to bigger profits.  The railway was a different world.

The last time anybody died on a train that crashed in Britain was on the evening of 23 February 2007 when a Virgin Trains express to Glasgow derailed on mistakenly unmaintained track at Grayrigg in Cumbria, the lead carriage performing an impressive backflip as the trailing carriages rolled down an embankment. Thanks to the sturdy design of the modern carriages, just one person died. The Grayrigg crash happened just 7 years, 4 months and 18 days after Ladbroke Grove. It’s impossible to say “never again”, and we must always guard against complacency, but as that incident fades ever further into history, it has started to feel like train crashes simply don’t happen any more. The world changed, and it only took 7 years.

Postscript

For the blog it made sense that I let this little extract stand on its own as a story by itself, but really it’s meant to be understood as one piece within a larger story that I assembled early in the year, topped and tailed with an edited version of this story. In it I try to tie together a few disparate strands that I had been thinking about, using as a theme the imagined “different worlds” that Dave Horton talked about and the real different worlds that have come about, in surprisingly short time, in the Netherlands and on the railways. And in it, the 7 years, 4 months and 18 days of fatal train crash free days are contrasted with the 27 days during that period when we can expect there to have been zero fatal crashes on Britain’s roads. Hopefully it might one day be fit to see the light of day…