The future for UK train protection systems
Rail travel is by far the safest form of land transport and annual numbers of casualties from train accidents are low: but the numbers of fatalities have been significantly increased as a result of a few catastrophic accidents. Both the Southall accident in 1997, in which seven people were killed, and the Ladbroke Grove accident in 1999, in which 31 people were killed, resulted from a "signal passed at danger" (SPAD). As part of the public inquiries into these crashes, Professor John Uff and Lord Cullen were asked to investigate the use of systems to prevent SPADs and to make recommendations on the future development of train protection systems. The results of their joint inquiry have now been published.1
More than 500 SPADs occur each year, although the numbers have decreased from 771 in 1994/95 to 596 in 1999/2000. These figures bear little relation to the number of fatal accidents resulting from SPADs, at less than one every two years. Nevertheless, the Southall (All change on the railways? ) and Ladbroke Grove crashes resulted directly from SPADs and the potential for catastrophic consequences is clear.
Traditionally, the responsibility for stopping the train before a signal at danger lay with the driver, But since the early years of the last century mechanical and electromagnetic warning systems have been developed to improve safety. Originally, these delivered a warning to the driver, but more recently systems have been developed that are capable of taking control of the train to ensure that the brakes are appropriately applied.
Automatic warning system
All passenger and most freight lines are currently fitted with the automatic warning system (AWS), which was installed by British Rail between 1950s and 1980s. The AWS works by sounding a warning to the driver when a red signal is approached and applying the brakes if the driver fails to cancel the warning. It is not considered a protection system because the brake application can be overridden by the driver. The development and performance of AWS was considered during the Southall inquiry, together with the rules and practices governing its use. The high-speed train involved in the Southall crash had the AWS turned off because of a previously reported but uncorrected fault. What the inquiry revealed was that running trains with the AWS turned off was not uncommon and that leading up to the Southall accident AWS faults on Great Western Services were running at the rate of almost 10 a week. Maintenance and renewal of AWS systems were also found to be a problem.
Evidence received by the joint inquiry suggests that current AWS equipment on the rail system generally is no more reliable than in the case of Great Western, as revealed at Southall, and possibly even less reliable. While AWS remains the only warning system available on a large part of the network, the inquiry says that it must be strongly reaffirmed that the equipment should be adequately maintained, renewed and serviced in order to provide at least a basic level of protection against SPADs. The inquiry concludes that it has no confidence this is yet being achieved.
Train protection systems
The present state of train protection in the UK is the product of decisions made over the past 20 years under widely differing regimes of management; the joint inquiry says it found little evidence of long-term planning. Train protection systems were first proposed for general use on the UK railway network in the mid-1980s. The Hidden report on the Clapham Junction rail crash recommended that Automatic Train Protection (ATP), then under development by British Rail, should be fitted to the rail network after pilot schemes on Great Western Trains and Chiltern Railways. But in 1995 it was decided to drop the proposals to fit ATP across the whole network on the grounds of cost. One effect of the Southall crash was that it provided the incentive needed to bring the pilot ATP system into full operation. Up to the date of the accident there was neither the willpower nor the commitment needed to achieve this aim and the pilot scheme on Great Western came close to being abandoned. As a result of the Southall crash, which would have been prevented had the ATP fitted in the high-speed train been in use, Great Western has brought ATP into operation, but it continues to experience reliability problems and, like AWS, ATP represents old technology.
Up until the Southall inquiry in 1999, ATP was regarded by many as the system that should have been developed and extended to cover the whole network. Since then there has been a major shift in opinion as the result of the development of more modern train protection systems that will be mandatory on a large proportion of the UK network as a result of the need to comply with European Directives. The joint inquiry recommends that there should be no significant extension of the British Rail ATP system.
Train Protection and Warning System
At the time the decision was taken to drop the nationwide fitment of ATP it was decided to proceed with an alternative package of measures known as SPAD reduction and mitigation (SPADRAM). This included a less effective train protection system, the Train Protection and Warning System (TPWS).
TPWS was conceived as a simple, cheap and quickly available means of providing train protection that would fill the gap left by abandoning the nationwide fitment of ATP. TPWS will provide an automatic train stop at a red signal and an additional speed trap positioned before the signal, where the necessary lineside equipment is fitted. Between 1995 and 1999 TPWS was developed and tested on several lines, while on Great Western Trains and Chiltern Railways ATP continued to be used.
Although TPWS was originally conceived as a quick and cheap replacement for ATP on the remainder of the network, much of the initial impetus for the project was lost during the privatisation process. There were teething problems, which have been overcome, but by the time the system began trials in 1998 it had become substantially more complex and expensive than was originally proposed. Nevertheless, it was decided in 1998 that the fitting of TPWS should become mandatory and this was given effect through regulations signed in the summer of 1999. There is also the possibility of developing more complex versions of the system that may offer more protection but that will take longer to develop and install.
Despite the decision to make the fitting of TPWS compulsory, serious issues have been raised as to its reliability and effectiveness because it uses much of the existing AWS system. Some have argued the programme should not go ahead because a much better solution would be to bring forward the introduction of standardised European train protection systems. Others have suggested enhanced and more effective TPWS - TPWS Plus and TPWS-E (electronic) - which would involve more complexity and cost. Despite TPWS being required by Regulation and fitting being under way, the Government told the inquiry that it would consider any recommendation made, including the abandonment of TPWS.
The European network
In 1996, the European Commission issued the Interoperability for the Trans-European high-speed rail network Directive (TEN) (96/48/EC). Four lines in the UK are covered by this Directive: the West Coast Main Line from London to Glasgow; the East Coast Line from London to Edinburgh; the Great West Main Line from London to Cardiff; and the Channel Tunnel Rail Link, which is currently being built. The Directive requires the fitting of a compatible train protection system, the European Train Control System (ETCS). The system will function in a manner similar to British Rail ATP but uses entirely new and non-compatible technology, which is not compatible with the earlier system. A further draft Directive issued by the European Commission will cover conventional lines and extend the requirement for a form of ETCS.
There is some uncertainty over the timing of ETCS, the type of equipment to be fitted and the feasibility of transitional measures. But neither British Rail ATP nor TPWS will comply with requirements of these Directives and both will have to be replaced on lines that are covered by the Directives.
Questions and answers
The principal questions addressed by the joint inquiry were:
The inquiry found there are divided views on the advantages and disadvantages of TPWS. Its benefits are limited and, despite the substantial expenditure it represents - currently estimated at over £450 million - it would still permit a proportion of accidents to occur that would be prevented by an ATP system. The Southall accident would not have been prevented by TPWS but the Ladbroke Grove crash would have been. In between these extremes, the effectiveness of TPWS will depend on brake performance and the safety margin provided for stopping provided by track beyond a signal in track layouts. The consequence of any accident that does occur following a SPAD may be mitigated by a reduction in speed.
A case was made to the inquiry that the TPWS should be abandoned in favour of earlier fitment of ETCS. The inquiry concludes that the cancellation of TPWS will not advance the fitment of ETCS, although it remains concerned that the fitment of TPWS should not be allowed to delay the fitting of ETCS. It believes that the original objectives of TPWS, to provide a relatively cheap and available stop-gap in place of the nationwide fitment of British Rail ATP, remains proper and sound, although it has considerable reservations about the effectiveness of TPWS.
The inquiry does not recommend that TPWS-E is pursued, while leaving it open to the rail industry to pursue that option. If trials of TPWS Plus prove successful, the inquiry suggests it should be fitted on lines carrying high-speed trains and on lines carrying other trains that cannot be stopped by the basic TPWS.
Levels 1 and 2 ETCS (see box on p.18) are already being fitted on the West Coast Main Line as part of a modernisation programme and will be followed by upgrading of the East Coast Main Line. These programmes are being driven by commercial pressures and the inquiry concludes it is inappropriate to make recommendations on the programme. But the inquiry is concerned that the wider fitting of ETCS could be hampered by the continuing fragmentation of the railway industry and the difficulty in achieving cooperation between different parties in the same project. It recommends that establishing an authoritative body as a means of resolving inter-company disputes should be made a high priority.
Other lines covered by the European Directives will have to be fitted with ETCS when they are next upgraded or renewed. Some groups, particularly those representing passengers, are concerned that having fitted TPWS, Railtrack, train-operating companies and rolling-stock owners will have a disincentive to bring forward the fitting of ETCS because of the large costs involved. The most economical solution for the companies would be to fit ETCS at the end of the natural life-cycle of signals and rolling stock, which might result in the postponement of the general fitting of ETCS for the next 30 years.
Because of this uncertainty, and because the railway industry has historically been slow to introduce new safety systems, the inquiry does not think that the introduction of ETCS can be left to the industry in its current fragmented state. It concludes that the decision of the HSE and the Government to use regulation to ensure the timely fitting of TPWS is also the best means of ensuring the fitting of ETCS, where decisions will need to be made and enforced concerning priorities and the safe operation of individual lines. During the course of the inquiry, the HSE made it clear that it agreed with this approach. The inquiry has proposed a timetable to be contained in regulations for the fitting of ETCS so that all trains running at over 100 mph should be protected by ETCS by 2010.
Reasonable practicability
Current railway safety Regulations are made under the HSW Act. Normally, the HSE may take enforcement action only by reference to what is reasonably practicable, and cost-benefit analysis is a component in assessing this. Railtrack's safety case also includes the demand for reasonable practicability, which must be given effect by creating new standards or amending existing ones. Representation and participation by all rail industry operators is required and new safety requirements cannot be imposed unless they satisfy the requirements of reasonable practicability.
But this is not the only approach to safety. Decision-makers, particularly ministers and their advisers, recognise that the approach to risk must also take account of public reaction to the consequences. Some consequences are regarded as so abhorrent and intolerable that the risk of occurrence must be reduced whatever the cost. Public reaction to catastrophic rail accidents is regarded in this way, and is taken into account in making decisions about rail safety.
If Railtrack cannot impose safety requirements beyond those that satisfy the test of reasonable practicability and cost benefit, how are safety systems to be imposed where these criteria are not clearly satisfied?
Before privatisation, the question did not arise - British Rail sought to maintain the rail system in a safe condition by gradual evolution and the introduction of new technology subject to the availability of funding. That system was shown to be inadequate when it took British Rail from the 1950s to the 1980s to achieve full fitment of AWS. The experience of introducing ATP on Great Western and Chiltern Lines during the 1990s shows the process that replaced it to be equally wanting in this respect.
In the UK rail industry as presently constituted, safety measures going beyond the conventional safety yardstick might be adopted in response to commercial pressure, particularly if they involve material benefits. But for the new safety systems currently under consideration, the only means of ensuring fitment is through regulation coupled with the assured provision of adequate funding.
This has been the approach adopted by the HSE in the case of TPWS, through the Railway Safety Regulations 1999. These Regulations are a new approach to the introduction of safety measures, which was not envisaged at the time of rail privatisation.
For the introduction of ETCS, regulations must be issued by Government to comply with European Directives. Domestic regulations are one means of ensuring that ETCS is introduced at the earliest possible opportunity and ahead of the timetable allowed by the Directives.
The inquiry concludes that cost-benefit analysis should not be taken as the only criterion for making decisions on safety. But it accepts that cost-benefit analysis is a factor to be taken into account when reaching decisions on the introduction of train protection systems. It finds that any future ATP system will entail expenditure many times higher than that indicated by any approach based on cost-benefit analysis, but there appears to be a general consensus in favour of this development. Both TPWS and ETCS are, or will be, mandated by law, and in both cases provision has been made for public funding. The cost of safety measures currently under consideration will be met substantially from the public purse through subsidies to Railtrack, the train-operating companies and the companies that own the rolling stock. The inquiry was not asked, and does not make any judgments, as to whether these systems satisfy a cost-benefit analysis.
The expenditure of massive sums of public money on ATP systems rather than other rail or road safety schemes is a matter for Government, including the European Commission.
No quick fix
Despite the potential future benefits of ETCS in preventing SPADs, there will be several years during which there is no protection beyond the existing AWS. The inquiry warns that the limited availability of experienced signal designers and technicians may mean that the programmes for the fitment of new train protection systems are dictated by resources rather than finance or management decisions.
The inquiry stresses that this makes the other measure proposed in the SPADRAM programme especially important, particularly because even after the fitment of TPWS there will still be significant potential for SPADs to occur. The inquiry concludes that now it is clear that the ability of a train running at 125 mph to stop at a red signal is dependent on the perception and reaction of the driver, aided by warnings in the cab, practical measures to sustain and enhance the driver's performance can be seen as a high priority. The inquiry agrees with the HSE that we are close to the limit of what can be expected of human response in the cab or signal box.
The other measures to reduce and mitigate SPADs include such areas as:
Professor Uff and Lord Cullen conclude that the safety systems and procedures they consider in their report will reduce, but not eliminate, the risk of a catastrophic accident due to a SPAD occurring during the next decade or more. But they believe that most of the risk will be removed when the network is fitted with ETCS and describe it as "the future of train protection".
Train Protection and Warning System (TPWS)
TPWS grew directly out of the decision announced in 1995 to abandon nationwide fitment of British Rail Automatic Train Protection. What was required was an interim system that would reduce the risk of "signals passed at danger" (SPADs) until a suitable automatic train protection (ATP) system could be found that would meet both the reliability and affordability criteria. One particular problem with British Rail ATP had been the mechanical measurement of distance travelled. One proposed solution was the development of an enhanced version of the Automatic Warning System (AWS), providing a speed trap to be fitted to signals. This proposal did not require the mechanical measurement of distance and the use of the existing AWS system would solve the problem of creating space in rolling stock for fitment of equipment and would minimise changes and additions to wiring.
This is the basis for TPWS, which in its basic form uses low frequency radio signals transmitted from loops placed on the track. The speed trap relies on a pair of loops located before the signal: the first starts a timer on the train, if the second loop is passed before the timer has finished its sequence, indicating excess speed, and the signal is at danger, the train's brakes are automatically applied. A second pair of loops situated at the signal will cause the brakes to be applied at any speed when a train passes a signal at danger. The capability of TPWS to prevent a collision relies on the ability of the train braking system to bring the train to a halt within the overlap - the length of track between the signal and the potential collision point. If the train is driven within permitted operating speeds and brought to a stop before a red signal, the system will not intervene.
The Railway Safety Regulations 1999 mandate the introduction of TPWS by 2004. In response to the Ladbroke Grove crash, Railtrack committed itself to introducing TPWS by 2003.
The technical performance of TPWS is not without problems. The system does not "fail safe": if the system fails the brakes will not be applied in a situation where they normally would, and this may be without prior warning to the driver who may be unaware of the malfunction. A second technical aspect of TPWS performance concerns its dependence on AWS and the questionable reliability of those components.
How effective TPWS may be is also questionable. The basic model of TPWS is assessed as being capable of stopping a train travelling at 74 mph within the standard overlap of 200 yards from a red signal provided the train can achieve a specific braking rate - 12%g. But around a third of UK rail mileage allows trains to travel at speeds in excess of 75 mph, many trains do not achieve the specified braking rate, and some overlaps are shorter than 200 yards (although some are substantially longer). The inquiry concludes that TPWS will reduce collision speeds to some extent and that it will reduce the likelihood of fatalities occurring from SPADs by about two-thirds.
The significant limitations of TPWS has led to proposals for enhanced versions of TPWS. TPWS Plus uses additional loops to make the system effective at higher speeds and lower braking efficiencies. TPWS-E addresses the "dead-end" aspect of TPWS by replacing track loops, which have no purpose beyond TPWS, with units that are capable of being migrated to the European Train Control System (ETCS).
European Train Control System (ETCS)
ETCS will make use of new radio communications technology to create an entirely new command and control system for the railway. Radio coverage alongside the railway line allows communication directly with the driver's cab to display movement authority for the vehicle. Full automatic control of the train will be possible from a central point, without the need for lineside signals. A particular advantage of the system is that it can be fitted in several stages, each capable of being migrated to the next level without the wholesale replacement of equipment.
There are three levels of ETCS:
ETCS 3 does not yet exist as a working system, trials of ETCS 1 and 2 are planned or under way in Europe.
The result of European Directives is to mandate the fitment of ETCS to a large proportion of the UK railway network as well as progressively replacing the plethora of train protection systems currently in use throughout Europe. The current Directive does not set a timetable but requires that fitment of ETCS is carried out when renewing or upgrading systems.
ETCS Regulations and timetable
The joint inquiry recommends that:
The inquiry also recommends that regulations should contain powers to require the fitting of ETCS progressively to routes with line speeds above 75 mph and above 60 mph if justified on safety grounds.
1"The joint inquiry into train protection systems", Professor John Uff and the Rt Hon Lord Cullen, HSE Books, ISBN 0 7176 1998 2, £19.50.
