Report 17/2019: Loss of safety critical signalling data on the Cambrian Coast line

Report Overview

R172019_191219_Cambrian_Coast_lineDownload

Summary

On the morning of 20 October 2017, four trains travelled over the Cambrian Coast line, Gwynedd, while temporary speed restriction data was not being sent to the trains by the signalling system. No accident resulted but a train approached a level crossing at 80 km/h (50 mph), significantly exceeding the temporary speed restriction of 30 km/h (19 mph) needed to give adequate warning time for level crossing users.

This overview has been truncated. Please refer to the official documents below for the complete canonical report.

Official Documents

R172019_191219_Cambrian_Coast_line

Download
RAIB Recommendation response for Cambrian Coast line

Download

Document Content Preview

Extracted text from the first few pages of the official documents.

R172019_191219_Cambrian_Coast_line

Report 17/2019 December 2019 Rail Accident Report Loss of safety critical signalling data on the Cambrian Coast line 20 October 2017 This investigation was carried out in accordance with: � the Railway Safety Directive 2004/49/EC; � the Railways and Transport Safety Act 2003; and � the Railways (Accident Investigation and Reporting) Regulations 2005. � Crown copyright 2019 You may reuse this document/publication (not including departmental or agency logos) free of charge in any format or medium. You must reuse it accurately and not in a misleading context. The material must be acknowledged as Crown copyright and you must give the title of the source publication. Where we KDYHLGHQWL�HGDQ\WKLUGSDUW\FRS\ULJKWPDWHULDO\RXZLOOQHHGWRREWDLQSHUPLVVLRQIURPWKHFRS\ULJKW holders concerned. This document/publication is also available at www.gov.uk/raib. Any enquiries about this publication should be sent to: RAIB Email: enquiries@raib.gov.uk The Wharf Telephone: 01332 253300 Stores Road Website: www.gov.uk/raib Derby UK DE21 4BA This report is published by the Rail Accident Investigation Branch, Department for Transport. Report 17/2019 Cambrian Coast line December 2019 Preface The purpose of a Rail Accident Investigation Branch (RAIB) investigation is to improve railway safety by preventing future railway accidents or by mitigating their consequences. It is not the purpose of such an investigation to establish blame or liability. Accordingly, it is inappropriate that RAIB reports should be used to assign fault or blame, or determine liability, since neither the investigation nor the reporting process has been undertaken for that purpose. The RAIB’s findings are based on its own evaluation of the evidence that was available at the time of the investigation and are intended to explain what happened, and why, in a fair and unbiased manner. Where the RAIB has described a factor as being linked to cause and the term is unqualified, this means that the RAIB has satisfied itself that the evidence supports both the presence of the factor and its direct relevance to the causation of the accident or incident that is being investigated. However, where the RAIB is less confident about the existence of a factor, or its role in the causation of the accident or incident, the RAIB will qualify its findings by use of words such as ‘probable’ or ‘possible’, as appropriate. Where there is more than one potential explanation the RAIB may describe one factor as being ‘more’ or ‘less’ likely than the other. In some cases factors are described as ‘underlying’. Such factors are also relevant to the causation of the accident or incident but are associated with the underlying management arrangements or organisational issues (such as working culture). Where necessary, words such as ‘probable’ or ‘possible’ can also be used to qualify ‘underlying factor’. Use of the word ‘probable’ means that, although it is considered highly likely that the factor applied, some small element of uncertainty remains. Use of the word ‘possible’ means that, although there is some evidence that supports this factor, there remains a more significant degree of uncertainty. An ‘observation’ is a safety issue discovered as part of the investigation that is not considered to be causal or underlying to the accident or incident being investigated, but does deserve scrutiny because of a perceived potential for safety learning. The above terms are intended to assist readers’ interpretation of the report, and to provide suitable explanations where uncertainty remains. The report should therefore be interpreted as the view of the RAIB, expressed with the sole purpose of improving railway safety. Any information about casualties is based on figures provided to the RAIB from various sources. Considerations of personal privacy may mean that not all of the actual effects of the event are recorded in the report. The RAIB recognises that sudden unexpected events can have both short- and long-term consequences for the physical and/or mental health of people who were involved, both directly and indirectly, in what happened. The RAIB’s investigation (including its scope, methods, conclusions and recommendations) is independent of any inquest or fatal accident inquiry, and all other investigations, including those carried out by the safety authority, police or railway industry. Preface Report 17/2019 Cambrian Coast line 4December 2019 This page is intentionally left blank Report 17/2019 Cambrian Coast line December 2019 Report 17/2019 Cambrian Coast line 5December 2019 Loss of safety critical signalling data on the Cambrian Coast line, 20 October 2017 Contents Preface3 Summary7 Introduction 8 Definitions 8 Acknowledgments 8 The incident 9 Summary of the incident 9 Context9 The sequence of events 15 Analysis 17 Background information 17 Identification of the immediate cause 20 Identification of causal factors 20 Identification of underlying factors 33 Observations34 Summary of conclusions 38 Immediate cause 38 Causal factors 38 Underlying factors 39 Observations 39 Actions reported as already taken or in progress relevant to this report 40 Actions reported that address factors which otherwise would have resulted in a RAIB recommendation 40 Recommendations and learning points41 Recommendations 41 Learning points 44 Appendices 45 Appendix A - Glossary of abbreviations and acronyms 45 Appendix B - Investigation details 47 Appendix C - Detailed description of GEST software failure 48 Report 17/2019 Cambrian Coast line 6December 2019 This page is intentionally left blank Report 17/2019 Cambrian Coast line 7December 2019 Summary On the morning of 20 October 2017, four trains travelled over the Cambrian Coast line, Gwynedd, while temporary speed restriction data was not being sent to the trains by the signalling system. No accident resulted but a train approached a level crossing at 80 km/h (50 mph), significantly exceeding the temporary speed restriction of 30 km/h (19 mph) needed to give adequate warning time for level crossing users. The line has been operated since 2011 using a pilot installation of the European Rail Traffic Management System (ERTMS) which replaces traditional lineside signals and signs with movement authorities transmitted to trains. These movement authorities include maximum permitted speeds which are displayed to the train driver and used for automatic supervision of train speed. The temporary speed restriction data was not uploaded during an automated signalling computer restart the previous evening, but a display screen incorrectly showed the restrictions as being loaded for transmission to trains. An independent check of the upload was needed to achieve safety levels given in European standards and the system designer, Ansaldo STS (now part of Hitachi STS), intended that this would be provided by signallers checking the display. A suitable method of assuring that the correct data was provided to the display had not been clearly defined in the software design documentation prepared by Ansaldo STS and the resulting software product included a single point of failure which affected both the data upload and signallers’ display functions. The system safety justification was presented in a non- standard format based on documentation from another project still in development at the time of the Cambrian ERTMS commissioning and which, before completion, made changes that unintentionally mitigated the single point of failure later exhibited on the Cambrian system. Network Rail and the Independent Safety Assessor (Lloyd’s Register Rail, now Ricardo Rail/Ricardo Certification) were required to review the design documentation but did not identify the lack of clear definition in design documents and were not aware of the changes ma

Text truncated. The original document has 57 pages.

Read the full text here

Accidents Database