Meeting Your Waterloo: Collision at London Waterloo, 15 August 2017 Raises Questions of Competence Assessment and Remembering the Lessons of Past Accidents
On the morning of 15 August 2017, a 10 coach South West Trains (SWT) passenger train, callsign 2D03, collided with a stationary engineering train at 13 mph while leaving Platform 11 at London Waterloo station.
SWT Train Having Collided with an Engineering Train at London Waterloo (Credit: RAIB)
The Rail Accident Investigation Branch (RAIB) report that there were no injuries “but both trains were damaged and there was serious disruption to train services until the middle of the following day”.
The SWT train was diverted from its intended route by a set of incorrectly positioned points (points 1524) and impacted the stationary engineering train, parked as a safety barrier to protect adjacent track works.
Footage from the Passenger Train’s Forward Camera Showing the Points Lying in Mid-Position (Credit: RAIB)
https://youtu.be/TADSY0f0EHY
At the time of the accident, platforms 1 to 10 were closed as part of capacity improvement works.
https://youtu.be/hhQqKqpESYA
Construction work was being undertaken in phases and had “required testing of signalling and points in the area of the accident near the end of platform 11”.
The misaligned points were the result of a latent defect due to “uncontrolled wiring [in blue below] added to the signalling system”.
Design Precursors: Insufficient Management of Change and a Lack of a Shared Understanding
The RAIB explain that:
This wiring was added to overcome a problem that was encountered while testing signalling system modifications…
Test desk switch panel and isolation rack in Waterloo relay room. White links are conductive, red and orange links are dummy (isolating) links which are fitted to prevent unintentional fitting of conductive links. (Credit: RAIB)
The problem arose because the test equipment design process had not allowed for alterations being made to the signalling system after the test equipment [known as a test desk] was designed. As a consequence, the uncontrolled wiring was added without the safeguards required by Network Rail signalling works testing standards, and remained in place when the line was returned to service.
The RAIB describe how the design of the test desk had not kept pace with changes in the interlocking design (“signalling interlocking is a system of controls fitted to railway signalling equipment which prevents conflicting or unsafe routes from being set”). The interlocking and the test deck were being designed by different companies. A Network Rail’s signalling project engineer had queried how changes would be coordinated but the Mott McDonald Limited (MML) contractor’s responsible engineer (CRE) reassured him in error that OSL Rail‘s tester in charge (TIC) was taking care of this.
There was also a crucial misunderstanding on when the test desk was connected. In fact it was to still be connected for a period when the signalling was operational. It should therefore have been treated as temporary works and subject to more stringent controls and a risk assessment conducted. OSL’s TIC and the Network Rail project engineer understood it would remain connected but MML’s CRE did not and so the extra controls and risk assessment were not implemented. The OSL ‘functional tester’ was also not aware that the test deck would remained connected when the signals were operational. Furthermore:
A project decision to secure the points in the correct position had not been implemented. [While not carried out for these points] this [decision] was beyond normal requirements and the RAIB regards it as a good example of assessing site specific risks and identifying practical mitigation.
Questions of Competence
The RAIB go on to note the actions of the functional tester who they concluded had installed the extra wiring “were inconsistent with the competence expected of testers”. They discuss the qualifications and work history of the functional tester, the most front-line of personnel, in far greater detail than other staff:
He had worked on the railway since 2002… He first obtained the Institution of Railway Signal Engineers (IRSE) licences and certificate of competency needed to be a verification tester and functional tester in November 2003 and October 2004 respectively.
Individuals seeking to be licensed by the IRSE are required to undertake a two stage competence assessment process, carried out by IRSE approved assessors. The first stage involves an assessment in the workplace by a qualified and experienced workplace assessor. The second stage consists of an interview with a different qualified and experienced competence assessor. Evidence of suitable training and work experience must be provided by the candidate. If both assessors are satisfied, the assessment documentation, work experience and training evidence are submitted to the IRSE for approval. If these are acceptable, the IRSE issues a licence for the relevant category of work. Licences are valid for five years…
Employers’ competency managers assess whether an individual has reached the required standard for each category on the certificate of competency by reference to their work experience and by interview. Certificates of competency generally last for two years and are renewed by a further review of experience and a further interview with an employer’s competency manager.
So the system bears similarities, for example, to the EASA concept of becoming and Part-66 Licensed Engineer and then needing to hold a Part-145 Maintenance Organisation authorisation in order to sign to release work.
His certificate of competency to act as a functional and verification tester had [however] been revoked on 7 March 2012…. This was because of an incident in which he had signed paperwork stating that testing of points was complete based on an assurance by another person that it would be completed at an appropriate time. [He joined rail contractor OSL in 2012 and OSL created a development action plan, when it employed the functional tester, to address his revoked certification. This plan included a stated need to address his ‘soft skills’ (non-technical skills). However, the methodology in the development plan referred only to technical skills.
The mentorship comments added periodically to the development action plan by the functional tester’s mentors were positive but only refer to technical skills. There is no evidence that implementation of the plan included actions addressing his non-technical skills. However OSL stated that its managers’ knowledge of the functional tester’s behaviour before the accident led them to believe that he had been a cautious employee since regaining his functional tester certificate of competency.
His certificate of competency [was] reinstated on 14 April 2014. He had undertaken various signalling testing roles at Waterloo since 2015.
The RAIB explain that when asked to resolve a problem with the test desk observed by another test engineer:
…the functional tester referred to maintenance copies of design documents available in the relay room and deduced that the problem was likely to be a consequence of wiring changes made during earlier parts of the project. He then asked for testing copies of these documents as testing copies identify changes made during stages of work. The documents he received did not cover the equipment in the relay room.
Although the maintenance copies of the documents contained the information needed to develop a correct solution, the functional tester stated that he developed a solution by examining the wiring which had already been installed in the relay room. He did not contact the TIC or ask for assistance from on-call signalling designers to resolve the problem. Although the on-call designers were MML staff, so were not familiar with the test desk design, they did know about the changes to the points detection circuits.
The RAIB say that there was conflicting evidence about who installed what they describe as the “uncontrolled wiring”.
The Uncontrolled (Blue) Wiring (Credit: RAIB)
The functional tester claims two installers did it on his behalf. The installers claim they didn’t. Having reviewed signing in and out recorded RAIB concluded that “it is likely therefore that the installers were not present, and were probably on their lunch break, when the uncontrolled wires were fitted”.
The functional tester stated that he did not record the uncontrolled wires because he expected them to be removed, along with all the distinctive coloured wiring associated with the test desk, before the railway was returned to operational use.
The RAIB describe three options that the functional tester could have taken that would have prevented the wiring remaining when the railway was restored to normal operation.
The functional tester stated that he felt under pressure to resolve the issue [with the test desk] so that the principles tester could complete his route testing. He also stated that this did not affect his action except possibly in respect of labelling the wires.
Both OSL management and testers who worked at Waterloo reported that individual testers were regularly asked for progress reports by…project management. This was unusual as testers normally report to the TIC who would in turn update project management staff. It is possible that this made the testers more aware than usual of time pressures.
However the functional tester stated that, although he was busy, he did not feel under unusual pressure on the weekend of 12 and 13 August [when the wiring was installed].
Competence: Technical and Non-Technical Skills
The RAIB say that:
Competence of staff comprises knowledge, skills and attitudes. It encompasses both the technical and non-technical skills needed to undertake a job role.
Non- technical skills are the social, cognitive and personal skills that can influence the way that individuals undertake technical tasks. When undertaking complex tasks in a safety critical environment, it is vital that individuals have a good understanding of the equipment they are working with and the principles that underpin the mandated procedures. This understanding is essential for them to properly appreciate the consequences of the actions they take.
It appears when studying the report that the RAIB were questioning both the technical and non-technical skills of the functional tester when they commented on his competence being inconsistent with that expected of a functional tester. They do however also comment that “..the actions of both the CRE and project engineer [also] indicate that appropriate non-technical skills were not applied.” Presumably as their communication failed to fully uncover the misconceptions of the other. The RAIB observe that:
OSL, MML and Network Rail competence management processes had not addressed the full requirements of the roles undertaken by the staff responsible for the design, commissioning and testing of the signalling works
Parallels with the Clapham Junction Accident
Significantly, the RAIB contend that:
Events at Waterloo and the RAIB’s investigation of the serious irregularity at Cardiff East Junction suggest that some in the railway industry are forgetting the lessons learnt from the [12 December] 1988 Clapham Junction accident in which 35 people died.
https://youtu.be/ZCUX7r8V6Eo
The accident…happened when a train driver received a proceed aspect at a signal which should have been at danger, and collided with the train in front which should have been protected by the signal. The incorrect proceed aspect was shown because inadequate working practices during a re-signalling project had resulted in a loose, uninsulated redundant wire remaining close to, and eventually coming into contact with, other circuitry.
A public inquiry chaired by Anthony Hidden QC investigated the Clapham Junction accident. The report of the investigation, known as the Hidden report, made recommendations which reformed the way railway signalling was designed, installed and tested in the UK.
The major changes… triggered by the Clapham accident remain today, but the RAIB is concerned that the need for rigorous application is being forgotten as people with personal knowledge of this tragedy retire or move away from front line jobs. This deep-seated, tacit knowledge is part of the corporate memory vital to achieve safety. Loss of this type of knowledge as previous generations leave the industry is a risk which must be addressed by organisations committed to achieving high levels of safety.
The RAIB go on:
The accident at Waterloo and the Cardiff East Junction incident resulted from people taking actions which were inconsistent with the processes in which they had been assessed as competent. Had these processes been followed, the events would have been prevented.
However:
The RAIB found no evidence that the staff and organisations involved at Waterloo and Cardiff lacked a commitment to safety.
In this respect, the RAIB’s findings at Waterloo and Cardiff have much in common with this extract from the Hidden report chapter 17 ‘Where things went wrong – The Lessons to be learned’:
The vital importance of this concept of absolute safety was acknowledged time and again in the evidence which the Court heard. This was perfectly understandable because it is so self-evident.
The problem with such expressions of concern for safety was that the remainder of the evidence demonstrated beyond dispute two things: (i) there was total sincerity on the part of all who spoke of safety in this way; but nevertheless (ii) there was failure to carry those beliefs through from thought into deed…
The concern for safety was permitted to co-exist with working practices which… were positively dangerous.
Simon French, Chief Inspector of Rail Accidents said on the release of the report:
Some of the people involved in the signalling work connected with upgrading Waterloo station and its approach tracks did not keep proper records of temporary works, or ensure that additional temporary wiring was shown on the design documents. Leaving that temporary wiring in place when it should have been removed led to a passenger train being diverted onto a blocked line and colliding with wagons.
Compliance with the existing standards, developed since Clapham, would have provided the controls needed to stop temporary wiring being installed and used in the uncontrolled manner which resulted in this accident.
These symptoms of a deep-seated problem should give us all pause for thought. How can organisations ensure that lessons from events that happened outside the personal experience of present-day railway people are taught and retained?
Critically he also commented that:
Compliance with a standard comes more naturally to people when they understand the purpose of the requirement, and the consequences that may arise from disregarding it.
David Porter, Chair of the Institution of Occupational Safety and Health’s (IOSH) Railway Group and a former HSE inspector has commented:
Lessons are never learned once; they are learned, relearned and reapplied to the constant changing circumstances faced by the organisation. The nature of adequate control of risk is recognised as a product of constant adaptation. The need to retain corporate memory, competence and motivation in a changing, ageing workforce is constant. As is the need to maintain the sense of importance, urgency and reality of the risks as those with a personal, emotional connection with tragedy retire.
To achieve this safety climate is not something in the gift of frontline workers, supervisors or middle managers. It is for leaders. For me, some of the key questions around the RAIB findings are the suitability of the culture and the capabilities of senior managers to create and sustain an appropriate positive safety culture. As the number of incidents declines, culture becomes even more important in sustaining improvement and success.
He mentions the concept of a Just Culture and asks:
But how effective is it in practice? Is it easier now for someone to speak up about a safety concern and delay a job or possession? Or is it still that no one is confident enough to step forward and hold up the work? Or does the ‘show must go on’ approach still predominate?
Also, does the approach acknowledge that fatigue, misjudgement and error is not unique to those at the sharp end of the business? Misdirection and misalignment at the top and the middle can just as easily sow the seeds of failure as can mistakes at the bottom. How do we apply a just culture to senior managers?
…have we captured the essential skills and knowledge in culture building into the competence management system? Do these expectations include the ability to craft and oversee a meaningful strategy to continually improve safety culture as envisaged by the common safety methods on safety management systems?
We discussed this concern here: Just Culture or Just Culpability?
Safety Actions Already Taken
The Rail Safety and Standards Board (RSSB) has produced a number of safety resources relevant to corporate memory and railway safety. Network Rail and RSSB also contributed to ‘Learning from History’…published by Rail magazine.
OSL has reported that it has reinforced its behaviour awareness training and is delivering it on a yearly basis to all staff. It has also appointed behavioural partners who support the behavioural culture programme, with the aim of being approachable and engaged with their core team.
OSL has also reported that it has briefed all of its design staff on the importance of defining how works are managed when undertaking a design package with another contractor. The briefing note refers to the requirement to ensure that interfaces and scope are clearly defined before work starts. Staff are encouraged to use the company’s work safe policy if they have a safety concern. This gives them the right to speak up and if necessary refuse to work.
Safety Recommendations
The RAIB has made three recommendations:
- The first, addressed to Network Rail, seeks improvements in the depth of knowledge and the attitudes needed for signal designers, installers and testers to deliver work safely.
- Two addressed to OSL Rail Ltd and Mott MacDonald Ltd seek development and monitoring of non-technical skills among the staff working for them.
The RAIB has also identified four learning points:
- One highlights the positive aspects of a plan intended to mitigate an unusually high risk of points being moved unintentionally.
- The others reinforce the need to:
- Follow established procedures
- Prompt staff to clearly allocate duties associated with unusual activities
- Remind staff that up-to-date signalling documentation must be available and easily identified in relay rooms and similar locations.
A Last Word from Clapham
In his report on the Clapham disaster, Hidden also commented:
There is almost no human action or decision that cannot be made to look flawed and less sensible in the misleading light of hindsight. It is essential that the critic should keep himself constantly aware of that fact.
Other Safety Resources
We highly recommend this case study co-written by our founder, Andy Evans, 2008: ‘Beyond SMS’ by Andy Evans & John Parker, Flight Safety Foundation, AeroSafety World, May 2008 and this 2011 interview with Andy: How Organizational Culture Drives Safety and Quality
You may also be interested in these Aerossurance articles:
- How To Develop Your Organisation’s Safety Culture
- How To Destroy Your Organisation’s Safety Culture a cautionary tale of how poor leadership and communications can undermine safety.
- The US National Transportation Safety Board (NTSB) commented on the poor organisational culture and leadership after the loss of de Havilland DHC-3 Otter floatplane, N270PA in a CFIT in Alaska and the loss of 9 lives: All Aboard CFIT: Alaskan Sightseeing Fatal Flight
- Metro-North: Organisational Accidents: the story of shelfware
- A Railroad’s Cult of Compliance We look at lessons in a NTSB rail accident report on how a cult of compliance and over emphasis on judging front line workers can lead to disaster, lessons relevant to all industries.
- Performance Based Regulation and Detecting the Pathogens: which discusses both the Metro-North and the crude oil train derailment and fire that killed 47 people on 6 July 2013 at Lac-Megantic
- The Power of Safety Leadership: Paul O’Neill, Safety and Alcoa a real life example of safety leadership and how the stock markets reacted badly until O’Neill’s focus on safety, responding to employee suggestions and continuous improvement (not mere compliance) started to created exceptional business performance.
- Chernobyl: 30 Years On – Lessons in Safety Culture
- Leadership and Trust
- Safety Performance Listening and Learning – AEROSPACE March 2017
- Safety Intelligence & Safety Wisdom
- B1900D Emergency Landing: Maintenance Standards & Practices The TSB report posses many questions on the management and oversight of aircraft maintenance, competency and maintenance standards & practices after this serious incident. We look at opportunities for forward thinking MROs to improve their maintenance standards and practices.
- UPDATE 30 March 2019: Contaminated Oxygen on ‘Air Force One’ Poor standards at a Boeing maintenance facility resulted in contamination of two oxygen systems on a USAF Presidential VC-25 (B747).
- UPDATE 16 June 2020: CRJ-200 Landing Incident Highlighted US Maintenance Competency Inadequacies
UPDATE 6 June 2020: a study released by the US Federal Railroad Administration’s Office of Research, Development and Technology showed that regular safety culture assessments (in this case by the not-for-profit Short Line Safety Institute against their 10 Core Elements of a Strong Safety Culture) and following up the opportunities identified can improve an organisation’s culture. The study was of only two organisations so a wider study was also recommended. There could also be a halo effect, where assessors treat organisations that respond to their past advice more favourably irrespective of whether the actions were actually effective.
Aerossurance is pleased to be both sponsoring and presenting at a Royal Aeronautical Society (RAeS) Human Factors Group: Engineering seminar Maintenance Error: Are we learning? to be held on 9 May 2019 at Cranfield University.
Recent Comments