How responsible can individual staff be made for the occurrence of an accident?
Posted: 28 April 2016 | Peter van der Mark | 4 comments
In his latest blog for Global Railway Review, Peter van der Mark looks at a number of recent rail incidents and questions how responsible can individual staff be made for the occurrence of an accident when Automatic Train Protection has been disabled by the operator?
It is well known that rail accidents always have a chain of interlinked precursor issues; it never is only one person who is completely responsible. Following publication of the CIAF report on the Santiago de Compostela high-speed derailment in Spain – which blamed driver Garzón Amo in full for the accident – a number of people expressed unease with the conclusion reached. This is important because, in recent history, several accidents have occurred in which the operator of a rail vehicle did indeed make the final fatal mistake, yet on further investigation Automatic Train Protection (ATP) safety equipment, provided solely to avoid such accidents, turned out to have been ineffective due to having been switched off. This doesn’t diminish the responsibility of staff primarily involved for what happened at all; it just adds to the responsibility of other people. Nothing will ever improve if those ‘others’ can walk away from an accident without reproach. The question is: If safety equipment such as Automatic Train Protection (ATP) doesn’t function properly, as was the case in Spain, can an operator disable it any time he likes? Or does he have a responsibility to protect passengers against inevitable staff mistakes by ensuring the equipment is improved within a set time until it functions reliably? Furthermore, is the operator obliged to switch it back on before passengers are allowed to travel on that type of train?
“If safety equipment such as Automatic Train Protection (ATP) doesn’t function properly, as was the case in Spain, can an operator disable it any time he likes?”
On superficially looking through inspection of the recent history of accidents where this issue played a role, the compilation also shows uncomfortably high fatality figures. Working ATP appears to protect well against the most violent of the possible accidents.
- In Britain at Southall on 19-09-1997 there were seven fatalities. The AWS failed and ATP was switched off, causing a distracted driver to overlook two cautionary signals and – going unhindered past the red aspect – crash at slightly less than 200 km/h into a crossing freight train. Measures to have working AWS up front were not taken and the maintenance regime was less than robust.
- Also in Britain, the Ladbroke Grove collision with 31 fatalities occurred on 05-10-1999, when an insufficiently trained driver passed a red signal aspect and hit an incoming express at a combined impact speed of more than 200 km/h. Obsolete AWS, incapable of stopping a train in this situation, was available but the ATP was switched off on one and not available on the offending train, despite being fitted to the track and in working condition.
- On 06-02-2000 a derailment occurred at Brühl near Cologne in Germany. It left nine people dead and was caused by a driver, unsatisfactorily trained, misinterpreting rules to pass an associated signal fitted to allow trains to move past failed main signals. This associated signal was incorrectly used to make trains pass a stop displaying main signal and – even worse – a portable PZB’90 ATP magnet, which would have prevented the crash, was not fitted apparently for financial reasons. The instructions in the notices were erroneous and a temporary speed sign was badly placed, all wrong-footing the offending driver.
- On 24-07-2013 a high-speed derailment occurred at Santiago de Compostela in Spain, causing 79 deaths. ETCS ATP had been switched off in the previous two years due to malfunctioning on that Alvia type of bi-mode and gauge-changing Talgo train. Trackside ASFA ATP equipment had not been installed properly to catch erring drivers. This accident was viewed around the world as a video camera caught the derailment on tape and revealed issues with the stability of the diesel generator cars between the leading and rear electric power cars and the train. It turned out that the train in this configuration had not been fully approved for passenger service and also that without those diesel generator cars the train might in fact have made it through the curve at the overspeed it did.
- A variation on this type of accident occurred on 14-11-2015 at Eckwersheim in the Alsace, France, during the last trip of the commissioning tests of LGV Est from Paris Est to Strasbourg. With the TVM 430 and ETCS ATP both switched off to allow 10% overspeed above line speed, the driver of the test train missed the braking point for the tight curve into the junction with the classic line and the train catastrophically derailed, during which 11 people died. No less than seven people had been present in the cab, whilst the train itself must have resembled a moderate office party with family, among whom were four children, on board. SNCF admits that this was a silently allowed way of concluding such tests.
“ATP is fitted because experience proves that 100% scores are impossible if we rely solely on human beings to uphold safety”
In each of the above cases (except the French accident) it appears that capable ATP equipment was viewed as something one fits as a gesture of goodwill for the benefit of frightened customers, to be taken away at will in case of problems, rather than being an essential part of safety requirements to be satisfied before high-speed operations are permitted. An aeroplane is full of such safety equipment that must be operative before it is allowed to take off with passengers on board; why should that be different for passenger trains? ATP is fitted because experience proves that 100% scores are impossible if we rely solely on human beings to uphold safety. The 25-04-2005 Amagasaki accident in Japan with its 106 fatalities and 562 injured, illustrates how easily such accidents can occur. ATP is a last ditch safety net to preserve life and property when all else, notably the driver, fails. Human beings, however well trained, are like that: They fail occasionally, and something to be avoided at all costs with official accident reports, is that they are made to serve party-political purposes – usually to see responsibilities placed away from people who often are well placed to carry them. The incident in Spain could have seen that happen. This is why those protesting voices are so important.
In the case of the Ladbroke Grove accident I doubt very much that the collision would have been avoided if ATP was operating on the HST. By the time the Turbo passed SN109 at danger the HST was so close to the signal in the opposite direction it would be very close in terms of timing.
If you consider both the driver and signaller actions as part of the human factors analysis post-accident (Neville Stanton), the “system” has allowed the human to “err”. If my memory serves me correctly, the signaller was criticized at the public inquiry; however, an alarm initiated action review post-accident demonstrated that he reacted well within acceptable limits. Likewise, a similar review of psychological factors involved with respect to the actions of driver’s actions makes perfect sense from an experienced operator’s viewpoint. These reviews by Neville Stanton are excellent in my view and directly associate human factors and cognitive behaviour in an operational railway.
Even the most technologically advance train control systems will allow “human error” to occur. If they did not then in case of a signalling or train control system failure the train would be stopped and not moved until the failure is rectified.
Steve, looking at the situation “as was”, you are absolutely right. My point is, then, that the class 165/166 set should have been fitted. It was a political decision to not do that and the people responsible were never really called to explain themselves. The cost of the Ladbroke Grove accident probably would have paid handsomely toward completion of fitting, add Southall and the accidents were more expensive than equipping and operating the line and all regularly using rolling stock with ATP. Always remember that the fast layout from Paddington westward had been conceived with ATP protection in mind. When that was called off other measures should have been taken, such as flank protection, substantially lower speed limits and less variety in the way trains could be signalled in and out.
Thank you for this Blog Post. With the discussion I joined on LinkedIn for the Santiago de Compostela accident we came to the same conclusions. For Eckwersheim I myself came to the same conclusion after reading the published report and later got extra information via LinkedIn to finalize my conclusion. And the frontal collision near Bad Aibling I analysed with a friend of mine. I also still remember the high speed train accident in China in 2011 which I also discussed on LinkedIn. It gives a variety of root causes that shows you never can give up on to take responsibility for the safe movement of trains.
Regards, Rob van Looveren
Hi Rob, thanks for your comment. I think the Bad Aibling crash was an outsider in this litany, in that an error by a signaller bypassed the PZB’90 train protection. Going by numbers it was a very German accident, the rumpus in the press about the way signallers dealt with the use of the Zs1 Ersatzsignal was very interesting to follow indeed. Given that Austrian Railways use PZB as well, it is remarkable to notice that this issue does not appear to cause problems there.