TRAIN DERAILMENT AT POTTERS BAR 10 MAY 2002 A PROGRESS REPORT BY THE HSE INVESTIGATION BOARD

Transcription

1 HSE Potters Bar Investigation Board TRAIN DERAILMENT AT POTTERS BAR 10 MAY 2002 A PROGRESS REPORT BY THE HSE INVESTIGATION BOARD May 2003

2 PREFACE This is a report by an Investigation Board set up in response to a Direction from the Health and Safety Commission (HSC) under Section 14(2)(a) of the Health and Safety at Work etc Act 1974 (HSWA). The Direction required HSE to undertake an investigation into the train derailment at Potters Bar that occurred on 10 May 2002, under the supervision of an Investigation Board that included members independent of the Health and Safety Executive (HSE). The Board consists of four members, two wholly independent of HSE and two senior HSE inspectors independent of HSE s HM Railways Inspectorate (HMRI). It is not the Board s responsibility to oversee any aspect of the British Transport Police s (BTP) investigation into possible manslaughter offences. This is the third public report on HSE s investigation the others being published on 14 May and 4 July It is intended that this will be the last progress report by the Investigation Board before its final report to the HSC. A final report of this kind can only be published after all HSE investigations are finalised and any legal proceedings that may arise have been completed, or ruled out. In line with its terms of reference, the Investigation Board makes recommendations aimed at furthering rail safety improvements.

3 EXECUTIVE SUMMARY 1. On 10 May 2002 a train travelling from London Kings Cross derailed at Potters Bar when passing over points 2182A, causing 7 deaths and injuring over 70 people. Since that day a criminal investigation has been in progress by the British Transport Police (BTP) and the Health and Safety Executive (HSE) into possible offences, including manslaughter and offences under the Health and Safety at Work etc Act The BTP has been in the lead in the investigation, with HSE in support, because the offences under consideration include manslaughter. HSE has supported the BTP with expert technical assistance from its Health and Safety Laboratory (HSL). Railway inspectors of Her Majesty s Railway Inspectorate (HMRI), which is part of HSE, are also assisting the BTP. The investigation is continuing. 2. The Health and Safety Commission directed HSE to undertake its part of the investigation under the oversight of an Investigation Board, which includes members independent of HSE. The Board has no supervisory role in relation to the BTP. 3. This report by the Investigation Board covers HSE s investigations up to May 2003 and follows two earlier reports published in May and July It reports the Board s observations on the circumstances of the derailment and makes recommendations for improving rail safety and the regulatory system. It is intended to be the last progress report by the Board. A final report will be made after the conclusion of any legal proceedings or if they are ruled out. 4. The HSL has looked into the technical causes of the derailment, and what happened during and after it. This part of the investigation has spanned just over a year and has resulted in some 23 detailed technical reports. The investigation has examined points 2182A and their components, both at the scene of the derailment and in laboratory conditions; other sets of points in the Potters Bar area were also studied. The coaches of the train, especially the third and fourth coaches, have been closely examined, both internally and externally. The damage caused by the derailment to the surrounding rail infrastructure, including the Darkes Lane bridge, has also been carefully assessed. Other technical experts, including points designers, have supported HSL. 5. The key conclusions from the technical investigation are: the derailment was due to the failure of points 2182A, subsequent technical work having reinforced the conclusions of the Board s July 2002 Progress Report; four main factors contributed to the failure of the points: i

4 a. components in the points were in a poor condition, notably the backdrive which transmits drive from the points machine to the rear stretcher bar and rear portion of the switch rails; b. nuts to secure the right-hand end of the rear stretcher bar were absent from the end of that bar; c. nuts to secure the left-hand end of the front stretcher bar were absent from the end of that bar; d. the lock stretcher bar failed by fatigue through one of the boltholes and became disengaged from its insulating jacket. points 2182A had been poorly maintained and were out of adjustment in some respects; other sets of points in the Potters Bar area were found to have similar, though less serious, maintenance deficiencies, indicating a wider problem; other sets of points showed evidence that attempts had been made to improve the retention of nuts on the ends of stretcher bars, suggesting there had been difficulties in the area with such nuts loosening; and the train was being driven normally and within the permissible speed. Its crashworthiness was adequate. 6. From these findings the following explanation of the circumstances associated with the derailment has been deduced: Poor adjustment of the backdrive and the poor setting of the front stretcher bar put abnormal loads into the points system, in particular onto the lock stretcher bar. The wear on the inner threads of the rear stretcher bar, and the amount of available thread on the right hand end of the rear stretcher bar and the left hand end of the front stretcher bar, meant that some nuts would have been susceptible to loosening over a period of time. Nuts absent from the ends of the front and rear stretcher bars meant that these bars were neither properly holding the switch rails at the correct distance apart, nor transmitting motion when the points were moved. This was being done instead by the lock stretcher bar, which was not designed for this purpose. This added to the normal forces on the lock stretcher bar to create a combination of forces which the bar was not designed to take. The lock stretcher bar was subject to fatigue stresses and eventually failed at one of its right-hand bolt holes, causing it to withdraw from its insulating jacket as the train passed over the points, and allowing the switch rail to which it was attached at this side to spring out against the ii

5 right-hand stock rail. This resulted in the right-hand switch rail being set for the turnout route, with the left-hand switch rail already set for forward running. This happened when the rear wheels of the third coach were travelling over the points. The wheels on each axle were then forced in two opposing directions, derailing the rear of the third coach and the fourth coach entirely. The rear of the fourth coach re-railed and took the turnout route towards the Down Slow line. The fourth coach hit the Darkes Lane bridge parapets, detached from the rest of the train and became airborne. The rear bogie of this coach was ripped off along with underbody equipment, causing damage to the bridge and causing debris to fall through the gap between the bridge parapets onto pedestrians and vehicles below. The fourth coach then slid across the station platforms, struck a waiting room and rolled through 360 degrees, eventually coming to rest wedged under the station canopy roofs. The incident took place over 5 to 6 seconds. 7. The HMRI investigation has examined the systems for managing inspection and maintenance of railway points, and points 2182A in particular. This aspect of the investigation has so far focused on assessing records and documents. The inspectors have reviewed, among many matters, technical knowledge about the design and installation of this type of points; the history associated with the operation, testing and repair of points 2182A; and the systems for managing the maintenance of the points, including issues of operative training, competence and supervision. 8. The HMRI investigation so far has indicated that: There were two separate systems for the inspection and maintenance applied to points 2182A, one involving permanent way personnel, and the other involving signalling staff. This created the possibility that roles and responsibilities were not clear. There appears at this stage to have been no guidance or instructions for setting up, inspection or maintenance of points of the 2182A type based on an understanding of the design and safety analysis of this item of safety critical equipment. There appear at this stage to have been deficiencies in the arrangements for inspection as they were applied, including in those intended to ensure that personnel were competent. There appears at this stage to have been a failure to recognise safetyrelated defects in the set up and condition of points 2182A, and to record or report them. iii

6 There were deficiencies in the response to a report of a rough ride in the area of the points south of Potters Bar station the night before the derailment occurred, 9 May HMRI also conducted two wider inspections of a sample of points of the 2182A type across the rail network, in May/June and again in October/November Those inspections revealed conditions that were not consistent with good engineering practice, and indicated to HMRI that there may have been a wider problem. The deficiencies were, however, less serious than those at Potters Bar. 10. The Board makes observations and findings, drawn from its oversight of the HSE investigation, and looking at the wider environment for rail safety before and after the derailment. The Board makes 26 recommendations in response to the direction from the Health and Safety Commission. The following are the main observations: Causes of the derailment: From the Board s consideration of all the information it has seen and heard, it is: fully satisfied that the HSE has conducted a thorough and searching technical inquiry into the derailment, including the possibility that sabotage or deliberate unauthorised interference with points 2182A caused the derailment, noting the work that the BTP are undertaking in this area; satisfied that no evidence has yet been established to support speculation that sabotage or deliberate unauthorised interference was the direct or root cause of the derailment. This reinforces, in the light of fuller technical information, the views expressed in HSE s 14 May 2002 report on the derailment, and in the Board s July 2002 Progress Report; satisfied that an explanation can be given for the failure of points 2182A based on evidence of the poor condition of these points to an extent that they were not fit for purpose for the operating environment and safety related functions expected of them. Subject to the discovery of any evidence to suggest sabotage or deliberate unauthorised interference, the Board considers that the investigations so far show that the most likely underlying cause of the derailment was the poor condition of points 2182A at the time of the incident, and that this resulted from inappropriate adjustment and from insufficient maintenance compared to what was necessary for their operating environment and safety functions. The Board notes that this situation probably arose from a failure to understand fully the design and safety requirements for this type of points in this particular operating environment and hence implement appropriate arrangements for setting them up, and for their inspection and maintenance. iv

7 Possible factors associated with the derailment occurring: Historical perspective: The Board has not seen evidence so far of a system for the reporting, recording or reviewing of safety related defects, such as missing adjustable stretcher bar nuts, in points such as 2182A, that would have informed any consideration of continued adequate operational performance of this particular safety critical component in the present day operating environment. Contractors: Contractors undertaking maintenance on points of the 2182A type do not appear to have had available relevant detailed guidance developed from an adequate understanding of the design and safety requirements for set-up, inspection and maintenance of this type of points. Railtrack went some way to addressing this deficiency after the Potters Bar derailment. Inspection practice: The absence of an adequate understanding of the design/safety limitations, and the appropriate operating and safety requirements for points of the 2182A type, meant that a relevant riskbased inspection regime could not be developed. Move to adjustable stretcher bars: This move incorporated a reduction in the number of load-bearing stretcher bars in the points configuration to two, but no assessment appears to have been made of the impact of the load sharing on the rest of the points system in the event of one stretcher bar failing. Inspection and maintenance roles and responsibilities: The involvement of both permanent way and signalling personnel created the possibility that roles and responsibilities were not clear, which might have hindered a structured, clearly defined approach necessary to maintaining points 2182A in a safe condition. Attitude to defects found with points and design: Historic practice would appear to be that loose nuts and bolts would be tightened up during maintenance. Such an approach would have been to check for deficiencies and rectify them only when found, relying on other parts of the points system to ensure safe functioning in the meantime. This does not provide the same level of assurance as an approach based on preventative design and maintenance. Rough ride report: there are questions about the response to this. People employed to respond to reports of problems associated with safety critical components need to have the appropriate training, competence, and a questioning attitude. Consequences of the derailment: Terrible as the consequences of the derailment were, had it occurred at a time of day when the platforms were crowded there could have been even more injuries and loss of life. The Board advises designers to use risk analysis (having v

8 regard to operational requirements and cost) to identify reasonably practicable improvements in relation to the siting of turnouts near to stations and bridges. Similar questions arise for designers of bridges and of the layout of the track infrastructure. There are also some lessons for the internal design of coaches. Rail industry response to the derailment and the Board s July 2002 report: Railtrack did not demonstrate a response to either of these matters that the Board expected against the principles of good risk management. For example, Railtrack did not identify early reasonably practicable improvements in points of the 2182A type to ensure that they could better fulfil their safety functional requirements. Network Rail has been more positive over recent months, starting a relevant design/safety review of points to assist in identifying a proper risk informed strategy for improvement, and it is undertaking tests on improved locking nut arrangements. Safety management and safety culture in the rail industry: The Board notes the work that has been going on to improve the safety management of the railways but has not yet received evidence that Network Rail has reviewed its management systems for safety critical components and systems in light of the circumstances of the Potters Bar derailment. This added to questions about the need to improve the safety culture within the industry. However, recently, welcome signs of change have accompanied the creation of Network Rail - e.g. a move away from a fixed attitude based on historic railway engineering and maintenance practices, to a philosophy more founded on searching for solutions to safety related problems using fundamental safety principles. The Board notes that regulators and others can have a positive or negative impact on such cultural change and recommends that all the players should operate in partnership to maximise the pace of change. It also observes that safety and good business go hand in hand, especially on a busy rail network where, for example, designing out the need for maintenance and using a risk informed approach to maintenance can lead to greater reliability, less down time, and greater inherent safety. HSE s role and the regulatory system: Even though there was no direct HSE involvement with this part of the rail network, there may be lessons for better targeting of HSE s rail related resources towards the prevention of catastrophic risks and for aligning the railway safety case regime in a similar way, building on the progress that has already made a difference. 11. As required by its terms of reference, the Board also reviewed its findings and recommendations against the recommendations of Lord Cullen from his public inquiry into the Ladbroke Grove rail crash (part 2), and the interim recommendations from HSE s investigation into the Hatfield derailment. The Board reinforces and adds to those recommendations in respect of its observations on contractors, the management of safety critical vi

9 work, safety leadership in the rail industry, the regulatory regime, track maintenance, competence, managing safety critical maintenance, record keeping and infrastructure design. vii

10 CONTENTS CHAPTER 1 INTRODUCTION AND BACKGROUND This report 1 The derailment 2 Cooperation during a fatal accident investigation 3 The HSE investigation 3 The Independent Investigation Board 4 CHAPTER 2 TECHNICAL INVESTIGATION Objectives 5 Site investigation 5 Cause and mechanism of the derailment 9 Train behaviour in the derailment 11 Condition and testing of points 2182A 14 Chemical analysis 20 Other aspects 21 Further work 22 Conclusions 23 CHAPTER 3 MANAGEMENT SYSTEMS INVESTIGATION Key areas of attention 25 Report of a rough ride dated 9 May Inspection and maintenance regimes 27 Conclusions 30 CHAPTER 4 HMRI WIDER INSPECTION OF POINTS Background to the inspections 31 Outcomes 31 CHAPTER 5 THE BOARD S OBSERVATIONS AND FINDINGS Introduction 33 The HSE investigation 33 The derailment: causes 35 Possible factors associated with the derailment 37 The rail industry s response to the derailment and the Board s July 2002 recommendations 43 Safety management issues in the rail industry 44 The rail industry s safety culture 47 HSE s approach to regulating railway safety and the regulatory system 48

11 CHAPTER 6 THE DERAILMENT IN THE CONTEXT OF OTHER RECENT RAIL INCIDENTS Ladbroke Grove 51 Hatfield interim recommendations 52 CHAPTER 7 THE BOARD S RECOMMENDATIONS The rail industry s safety culture 55 Management systems for safety 55 General design and engineering aspects 56 Points of the 2182A design 56 Selection and control of contractors 57 Investigation arrangements 57 Regulation of railway health and safety 57 General recommendations 58 EXPLANATORY NOTES 59 ANNEX A Submissions and other information received by the investigation ANNEX B HSC press release dated 17 May 2002 FIGURES 1 Photograph of the area around Potters Bar station after the derailment. 2 Photograph of the fourth coach wedged under the station canopies. 3 Photographs of the damage to Darkes Lane bridge and vehicles underneath. 4 Schematic diagram illustrating the main components of a set of points. 5 Fractured lock stretcher bar. 6 First (front) adjustable stretcher bar looking from the rear. 7 First (front) adjustable stretcher bar left hand side. 8 First (front) stretcher bar right hand side. 9 Second (rear) adjustable stretcher bar right hand side. 10 Second (rear) adjustable stretcher bar left hand side. 11 Close-up view of the backdrive connecting rod and stretcher bar. 12 Close-up view of the left hand end of the front stretcher bar. 13 Close-up view of the thread at the right hand end of the rear stretcher bar 14 Close-up view of the thread inboard of the right hand end of the rear stretcher bar 15 Close-up view of the damaged outer main nut from the right hand end of the rear stretcher bar.

12 CHAPTER 1 INTRODUCTION AND BACKGROUND This report 1.1 This is a further progress report by the Independent Investigation Board 1 set up under a direction from the Health and Safety Commission (HSC) to oversee the Health and Safety Executive s (HSE) investigation of the train derailment at Potters Bar on 10 May The report covers HSE s investigation up to May 2003 and follows two earlier reports published in May and July It is the Board s intention that this report should be the last progress report of this kind in relation to the investigation. A final report into the derailment can only be published when any legal proceedings that may arise have been concluded, or ruled out. 1.2 The Board is grateful for the assistance received from the HSE and the British Transport Police (BTP). We value too the constructive dialogue that has been possible with the bereaved and their families during what has understandably been for them a most difficult period. We also welcome the positive relationship that has developed with the rail industry s own formal inquiry, required under Railway Group Standards. The investigation has also taken full account of the many submissions received from interested parties. Annex A provides further details. 1.3 We begin our report by summarising what we know happened when the train derailed at Potters Bar on 10 May 2002 and provide context for the HSE investigation that followed. We then describe each aspect of the HSE investigation and what this tells us about how the derailment occurred and why, amplifying the previous reports with the benefit of the further work that has been done by the Health and Safety Laboratory (HSL) and Her Majesty s Railway Inspectorate (HMRI). We make observations on causes and related matters including possible contributing factors, safety management, the developing culture of safety in the rail industry, and the lessons in the context of other recent rail catastrophes, comparing our findings to those from the inquiry into the Ladbroke Grove crash (part 2) and the interim recommendations arising from HSE s investigation of the Hatfield derailment. We also comment on the regulatory system and the role of HSE. We draw together a range of findings and make further recommendations for improving railway safety. 1.4 In October 2002, control of the rail infrastructure passed from the former Railtrack to Network Rail. When reporting on matters up to 2 October 2002 we refer to Railtrack. Thereafter, we refer to Network Rail. Throughout the report when we refer to Jarvis we mean the company that was the maintenance contractor for the Potters Bar area of the rail infrastructure. 1

13 The derailment 1.5 At 12.58pm on Friday 10 May 2002, train 1T60 travelling from London Kings Cross to Kings Lynn derailed at high speed on the points south of Potters Bar station. Seven people lost their lives; over 70 people were injured, some seriously. 1.6 The train was a four-coach 2 (non standard terms are explained in the explanatory notes at the end of the report) Networker Class 365 electric multiple unit, powered through the first and last coaches. The train left Kings Cross on time at 12.45pm. At the time of the incident it was travelling at about 97 mph (the maximum permissible speed for Class 365 stock being 100 mph). The line speed (speed limit) for the Down Fast line 3 at this location is 115mph and that limit was in force on 10 May The train was not due to stop at Potters Bar station. 1.7 The rear part of the train derailed at points numbered 2182A located about 160 metres south of Potters Bar station see Figure 1. Points 2182A provided a facing left-hand crossover or turnout from the Down Fast to the Down Slow line. The points were set for running straight ahead rather than turning onto another line. Between points 2182A and Potters Bar station four lines pass over Darkes Lane on bridge spans with fabricated steel parapets. 1.8 The rear bogie 4 of the third coach and both bogies of the fourth coach derailed. The fourth coach slewed sideways so that it was moving broadside to the direction of travel, skidded along the track and detached from the rest of the train. As the fourth coach struck Darkes Lane bridge the rear bogie was torn off and the coach became airborne. The coach came to rest on its side almost perpendicular to the running lines, straddled across both island platforms and wedged under the station canopy see Figure 2. The coach rolled nearly 360 degrees at least once before coming to a stop. A small waiting shelter on the up platform was partially demolished as the coach skidded towards the canopies. Six passengers travelling in the derailed coach were killed. A number of passengers sustained varying degrees of injuries. 1.9 The leading three coaches, with the trailing bogie of the third coach derailed, continued travelling along the Down Fast line passing between the platforms at Potters Bar station. The emergency braking system had been initiated and the coaches came to a halt with the front coach about 400 metres from the northern end of the station platform The rear bogie of the fourth coach caused considerable damage to the bridge that passes over the main street (Darkes Lane) of Potters Bar -see Figure 3. Debris from the bridge structure and the underside of the rear coach fell on pedestrians and cars below, killing one person. 2

14 Cooperation during a fatal accident investigation 1.11 When people are killed in a work-related incident such as this derailment, a number of different organisations work together to ensure the incident is investigated thoroughly, that the reasons for death are understood, and that any health and safety lessons are learnt. An investigation is necessary to discover whether there is any evidence that criminal offences have been committed (including any under the HSWA), so that, if there is, the appropriate authorities can in due course considerwhether a prosecution should be brought, or other enforcement action taken Different organisations have different but important roles in this process and good co-ordination is vital so that the investigation is as smooth and as seamless as possible. The Work-Related Deaths Protocol 5 sets out the principles for effective liaison between the organisations responsible for investigating work-related deaths in England and Wales. In accordance with this Protocol the BTP took the lead in this investigation and remain in the lead In addition to the information shared under the Protocol, safety-related information arising from this investigation has been shared among the BTP, HSE, Network Rail (formerly Railtrack), the Rail Safety and Standards Board 6 (formerly Railway Safety) and the Industry s Formal Inquiry Panel 7. The HSE investigation 1.14 The emergency services, including the BTP, were at the scene of the derailment very shortly after it occurred and an investigation was started. Officers of the BTP secured the scene. They were joined soon afterwards by railway inspectors from HSE s HMRI and experts from its agency, the Health and Safety Laboratory (HSL). HSE has provided expert technical and forensic support to the BTP, and also probed in parallel for possible breaches of HSWA The BTP investigation has been extensive involving more than 50 officers at its peak; there are around 30 officers now. The BTP report they have taken over 1400 statements The HSE investigation has been conducted in close co-operation with the BTP with HMRI inspectors located in the BTP operational centre in London. As the BTP are in the lead, HMRI inspectors have concentrated on reviewing records and analysing information arising from the BTP investigation and the HSL work. The technical investigatory work led by HSL has been extensive and involved various outside experts, in particular those from AEAT Rail. The HSE investigation has also involved railway inspectors from HMRI with specialised knowledge about various aspects of the derailment. 3

15 The Independent Investigation Board 1.17 Shortly after the derailment, on 17 May, the HSC directed HSE, under Section 14(2)(a) of HSWA to undertake an investigation under the supervision of an independent Investigation Board, operating in accordance with HSE s Major Incident Investigation Policy and Procedures 8. The Board oversees only the HSE aspects of the investigation and has no locus over the BTP investigation. The terms of reference given to us by the HSC and further information about the Board are at Annex B We have reviewed the technical evidence adduced by HSL, and the investigative work undertaken by HMRI. We have also examined the physical evidence at HSL and at Crewe We have also kept the bereaved and their families informed as the HSE investigation has progressed by both meeting with them to explain the HSE investigation and listen to their concerns, and by writing to them to keep them informed of progress. 4

16 CHAPTER 2 TECHNICAL INVESTIGATION 2.1 In this chapter we describe the various strands of the technical investigation conducted by HSL, supported by consultants AEAT Rail and other experts. This part of the investigation was detailed, highly complex and, in the Board s opinion, thorough. We devote a substantial part of our report to this element of the overall HSE investigation. We explain how the investigation was conducted, its findings, and the conclusions that we have drawn. Objectives 2.2 The objectives of the technical investigation were to: determine the technical causes of the incident; explain the path taken by the coaches during and after the derailment; and comment on the coaches performance and egress issues. 2.3 The technical investigation was conducted at the site of the derailment and at the laboratory facilities of HSL in Buxton and Sheffield. In addition, the third and fourth coaches of the train where examined at the Bombardier works at Crewe. The investigation spanned just over a year and involved a team of experts from the fields of railway switch and crossing points design, mechanical engineering, metallurgy, and other specialised technical disciplines. It resulted in some 23 detailed technical reports addressing the above objectives. Site investigation 2.4 The technical investigation started very soon after the derailment and began at the derailment site at Potters Bar. This initial phase covered: an examination of points 2182A, as found; testing of other sets of points in the vicinity of Potters Bar Station; a preliminary examination of the vehicles involved in the derailment a site survey and preparation of site plan; an examination of damage to the Darkes Lane bridge; and 5

17 the preparation and recovery of part of points 2182A for transportation to HSL, Buxton for further detailed examination and testing. Points 2182A as found A is the designation of the facing end of a set of points on the Down Fast track of the East Coast Main Line (ECML) approximately 160 metres south of Potters Bar Station. The points were of a type known as "shallow depth" and they were equipped with two adjustable stretcher bars. They were fitted with UIC54B switch rails and 113A (BS 11: 1985) flat bottom stock rails. They also had the designation "type D" a reference to the turnout radius which dictates the maximum allowable speed for trains taking the turnout route. Trains using 2182A points taking the turnout route from the Down Fast to the Down Slow line were limited to 30mph. 2.6 A number of features were obvious when points 2182A were examined for the first time (see Figures 4 to 10): the lock stretcher bar had fractured, possibly due to fatigue; the main nut, lock nut and insulating bush were absent from the left-hand end of the front stretcher bar similar components were found in close proximity on the ballast and recovered by the BTP. The stretcher bar had withdrawn from its retention bracket at the left-hand end and it was in contact with the ballast at this end. This stretcher bar was positioned fully over to the right-hand side; the main nut, lock nut and insulating bush were absent from the right-hand end of the rear stretcher bar similar components were found in close proximity on the ballast and also recovered by the BTP. At the right-hand end the stretcher bar was located within the retention bracket although it was unrestrained; and both switch rails were in contact with their respective stock rails at the front end of the points. Testing of other sets of points 2.7 At HSE s request HSL, using tools provided by the maintenance contractor, Jarvis, assessed qualitatively the relative tightness of the nut assemblies on several sets of points in the vicinity of Potters Bar, and also at two other locations nearby. In all, nine sets of points were assessed and a total of 178 nut assemblies were examined. Nut assemblies on stretcher bars and connecting rods were tested. All the tests were recorded on video and still photographs were taken at each set of points. The tests were done under the full supervision of the BTP. 6

18 2.8 The results indicated that approximately one fifth of the nut assemblies were not fully tight, in that they could be undone relatively easily with a spanner. However, in 28% of cases the tightness could not be assessed with the tools provided by the maintenance contractor, due to difficulties getting the spanner solidly against the nuts because of other features of the design. There were no instances of nuts missing, or of gaps between main nuts and lock nuts. 2.9 Each stretcher bar s resistance to rotation and the integrity of the bell crank pivots associated with the backdrive were also checked at some locations. Of 23 stretcher bars tested, 19 were considered tight and the remainder could be rotated after some initial resistance. Four out of 12 bellcranks checked showed some movement between the pivot and the baseplate. In three cases the pairs of bolts attaching stretcher bar brackets to the switch rails were found to be loose On two sets of points north of Hatfield Station, it was pointed out by Railtrack staff that high friction washers on two stretcher bars assemblies were in place between the lock nut and the main nut and pop marks had been used on some stretcher bar nut assemblies in an attempt to improve nut retention. In general engineering, pop marks are used for a variety of reasons and are usually made using a centre punch with a conical end to produce an indentation. In this case the indentation appeared to be intended to distort the thread, making it more difficult for a nut to pass over it, under the action of vibration, for example. The use of high friction washers was not in accordance with design drawings and they were subsequently removed. The HSE investigation is following up the issues emerging from this Subsequently a review of the information gathered during this exercise was carried out using the site photographs and videos. Deficiencies were observed in three other set of points and it was concluded that this indicated a lack of understanding of the correct functions of the backdrive on points of the 2182A type. Examination of the coaches 2.12 The train consisted of four Class 365 Networker Express coaches. These are Electrical Multiple Units with a power car at both front and rear. The set number was The sketch below shows the actual numbers of the coaches but, for ease of reference in this report, we refer to them as coaches 1, 2, 3 and 4 (or first, second, etc) starting at the leading (north) end of the train. Coach 4 Coach 3 Coach 2 Coach Direction of travel (north) 7

19 2.13 The leading three coaches remained coupled and upright after the derailment, although the trailing end of the third coach had derailed. The fourth (rear) coach became detached and came to rest across the station platforms and under the station canopy. The preliminary examination of the leading three coaches, both internally and externally, indicated that there were no coach defects that might have caused the derailment. The structural integrity of these coaches was not compromised A preliminary internal examination of the fourth coach was carried out on site once it had been moved to a safe position, and this is described later Externally the fourth coach was photographed extensively on site. However, it was decided that the detailed examination would be deferred until the coach had been recovered and transported to a suitable depot where better access and controlled conditions could be assured. Site survey 2.16 An extensive theodolite site measurement survey, starting from Mutton Lane road-bridge northwards to Potters Bar Station, was carried out. The locations of the various sets of points, overhead line equipment (OLE) stanchions and key items of debris were recorded. These measurements were combined with information taken from helicopter photographs and the local large scale Ordnance Survey map to produce a detailed site map for subsequent use in building up a picture of what happened in the derailment and immediately thereafter. Darkes Lane bridge 2.17 The damage to this bridge was examined in some detail. The derailed fourth coach struck the right-hand inner parapet of the Down Slow line where the trailing bogie detached. The impact was such that it caused the station security cameras, over 100 metres away, to vibrate, as is evident from the video recording made at the time of the accident. This bogie, partially fragmented, deformed and fractured the end of the substantial parapet steel joist and continued along the down slow line, causing additional damage to the bridge parapets on either side. The rear end of the fourth coach swung to the left after the trailing bogie detached, striking the parapet fence on the right-hand side of the down slow track, part of which became embedded in the left-hand side of the coach. The fence was pulled free from the top of the parapet and was dragged along behind the coach. The rear of the coach also dislodged the fence above the left-hand bridge parapet on the down slow line. This fence fell down into Darkes Lane causing minor damage to several road vehicles Most of the underbody equipment was torn from the fourth coach as it passed sideways over the bridge and a substantial quantity of this equipment was forced into the gap between the right-hand side down slow parapet and the left-hand side down fast parapet. The debris was dispersed into Darkes 8

20 Lane through this unprotected gap. Falling debris killed a pedestrian on the pavement (nearer the station) under the bridge. Four road vehicles were also damaged. Recovery and transportation of evidence 2.19 Following detailed measurement and photography, the positions of all nuts on points 2182A were marked with white paint so that any subsequent movement would be detectable and measurable. BTP personnel wrapped the stretcher bars in protective covers After consultation with Railtrack staff, points 2182A were removed by cutting the rails and lifting them, including the concrete bearers, as a single piece using a crane and proprietary lifting beam. Prior to doing so, the position of the important components were marked and particular items were also secured. The points were then transported to HSL, Buxton and offloaded onto a concrete pad using a similar lifting technique before being enclosed in a tent. The components found on the ballast were removed by the BTP and subsequently sent to HSL, Sheffield after forensic tests had been performed. Coaches 1 and 2 were transported by rail to the WAGN depot at Hornsey. Coaches 3 and 4 were taken to the Bombardier works at Crewe. All four coaches were held in quarantine pending further examination. The bogie that detached from the rear of the fourth coach was transported to the AEAT Rail site in Derby. Cause and mechanism of the derailment 2.21 The failure of points 2182A was identified at an early stage of the investigation as the event that initiated the derailment. Indeed, this was clear from the site investigation and was also explained in the first HSE report published four days after the incident on 14 May Work was put in hand to determine the cause and mechanism of derailment covering an examination of the derailment marks on the rails (both on site and in HSL), a study of the track and an assessment of the track bed. Immediate cause 2.22 The preliminary results, based on site work, indicated that the immediate cause of the derailment was the failure of the support system within points 2182A to retain the right-hand switch rail in the open position during the passage of the train over the points. Once the right-hand switch rail closed against its stock rail, most of the ensuing wheelsets were forced to attempt to follow the convergence of both switch rails. The wheels were effectively squeezed, forcing the flanges to climb up the sides of the rail head into derailment. This phenomenon is known as flange climb. The trailing bogie of the third coach and the leading bogie of the fourth coach derailed but continued in the forward direction, whilst the trailing bogie of the fourth coach took the turnout route. This was an unstable situation that led to the derailment of the trailing bogie of the fourth coach. This was followed rapidly by the detachment of the fourth coach from the rest of the train and its 9

21 collision with the Darkes Lane bridge. The behaviour of the train during the incident is later considered in more detail. Derailment mechanism 2.23 A detailed examination of the derailing marks on the rails was carried out at HSL in order to deduce the mechanism by which derailment had occurred. This confirmed many of the preliminary results but also identified additional features A total of six wheels derailed on the left-hand side of the points (these being the left-hand wheels on the trailing bogie of the third vehicle and on both bogies on the fourth vehicle); however, only four distinct flange climb marks were evident on the left-hand switch rail. Of these four wheels, three landed on the left-hand stock rail and one on the diverging rail. Thus, the two wheels on the left-hand side of the trailing bogie on the fourth vehicle behaved differently. The evidence indicates that these wheels became airborne. The flange of the left hand leading wheel landed on the interface between the lefthand stock and switch rails. This wheel then dropped into a running position on the diverging rail. This effectively split the points and held the rails apart thus allowing the flange of the trailing wheel on the trailing bogie of the fourth vehicle to drop between the left-hand stock and switch rails, again into the normal running position for the turnout route. This indicates that the trailing bogie on the fourth vehicle was re-railed on the turnout route on the left-hand side and, with the right-hand wheels already on the right-hand switch rail, this bogie took the diverging route with its wheels properly engaged On the right-hand side, there was evidence of four wheels having climbed the switch rails before derailing (these were the right-hand wheels from the trailing bogie of the third coach and the leading bogie of the fourth coach). There was evidence of contact between the back of the leading righthand wheel of the leading bogie of the third coach and the back of the righthand switch rail. From this it can be deduced that failure of lateral restraint on the point switch rails occurred as this wheel was passing through the flangeway and that this wheel was struck by the right-hand switch rail moving suddenly to the right. This leading wheel effectively held open the flangeway for sufficient time to permit the trailing wheel of the same bogie to enter without coming into contact with the back of the switch rail until it had travelled 400mm beyond the tip of the switch rail. It was only after the trailing wheel had successfully passed through the minimum flangeway clearance position that the right-hand switch rail continued its unrestrained lateral movement towards the right-hand stock rail. The trailing bogie on the third coach and the leading bogie on the fourth were derailed by the mechanism described above In one area, just beyond the rear stretcher bar position, the outer corner of the rail head on the right-hand switch rail had an unusual profile, judged to be due to wear in service. This damage was not recent. It had been caused by repeated contact with wheel flanges suggesting that, at some stage during the life of points 2182A, the flangeway gap must have been small enough to squeeze the flange of the wheel into an elevated position. 10

22 Further investigation of this feature would have involved destructive testing and was not therefore carried out for reasons of evidence preservation. Quality of track and bed 2.27 Track survey evidence was gathered at Potters Bar after points 2182A had been removed. The track was measured using a Theodolite Total Workstation and this was supplemented by measurements in HSL. On the ECML and elsewhere on the UK rail network, track quality is periodically monitored using instruments mounted on a High Speed Track Recording Coach (HSTRC). When available in a suitable electronic format, this HSTRC data will be combined with the track measurements made after the incident to give a complete picture of the track quality in the vicinity of the derailment The quality of the track bed under and in the vicinity of points 2182A was assessed using video and photographic evidence taken during removal of the points. The ballast appeared to be clean, free from fines 9 and dry, indicating that it had been in good condition. There was no evidence of wet spots at, or in the close vicinity of points 2182A. Train behaviour in the derailment 2.29 The paths taken by the coaches were analysed using aerial photographs, the station CCTV video, observations of the trackside and platform damage on site, and an examination of coach damage and debris found at the site. From these it was possible to deduce a clear picture of the way in which the train behaved. What happened 2.30 In the run-up to the derailment, points 2182A were set for forward (normal) running and coaches 1 and 2 passed through the points in the normal way. As earlier described, failure in the points occurred as the leading bogie of the third coach passed over them. Although derailed, the trailing bogie of the third coach and the leading bogie of the fourth coach continued in a forward direction on the down fast track. However, the trailing bogie of the fourth coach became re-railed onto the turnout route towards the down slow track The path taken by the fourth coach was identified in a series of aerial photographs taken from a Hertfordshire Police helicopter a few hours after the derailment. On the derailment site, the path of the trailing bogie on this coach was determined by noting damage to the rails immediately north of points 2182A, damage to the concrete sleepers, track fittings and lineside equipment, and damage to points 2182B, the trailing end of 2182A. In addition, there was indicative damage to an OLE stanchion and the end of the Darkes Lane bridge parapet adjacent to the Down Slow line. It is deduced that the trailing bogie of this coach detached when it struck the bridge and its momentum subsequently carried it forward until it finally came to rest on the approach slope at the end of the Down Slow platform in Potters Bar Station. 11

23 2.32 It is likely that the coupler between the third and fourth coaches failed as the trailing bogie struck the bridge; there can be little doubt that it was subjected to excessive force for which it was not designed. At this stage the fourth coach, at an increasing broadside angle to the Down Slow track, became airborne, passed over the bridge parapets and landed essentially upright on, or near, the slope at the south end of the Down Slow station platform. The coach then slid along and across the Down platforms (in a north-easterly direction), striking a second OLE stanchion and various platform fixtures. The collision with the stanchion released a set of cheese weights 10, used to tension the overhead line, and some of these hit a window on the left-hand side and entered the coach As the fourth coach dropped/slid across the Down platforms, there was a substantial impact with the Down Fast platform edge causing a sizeable piece of concrete to become detached and penetrate the coach through the leading left-hand side doors. The coach then collided with the Up Fast platform edge before striking and demolishing part of the waiting room on the Up platforms. At this stage the coach would have still possessed considerable momentum and it appears that the collision with the Up Fast platform and the waiting room caused it to roll through almost 360 degrees before it came to rest under the platform canopy The time from failure of the points to the fourth coach coming to rest, was of the order of five to six seconds. External crashworthiness 2.35 The performance of the coaches was assessed on the basis of visual examinations at various locations. Photographic and video records made on site were also scrutinised The leading three coaches had been braked to a standstill north of Potters Bar station. There was no external damage to their body shells that might have affected their crashworthiness. Although the trailing bogie of the third coach was derailed during the incident, it remained upright and securely attached and this coach came to rest in a stable condition. The failure of points 2182A resulted in the rear bogie of the fourth coach taking the turnout route as the leading three coaches and the leading bogie of the fourth coach travelled on the through route. The coupler between the third and fourth coaches failed when it was subjected to excessive force during these events and an examination at the depot confirmed that failure was due to overload Coach 4, which came to rest under the platform canopy at Potters Bar station, displayed evidence of having collided with stanchions supporting the OLE, the waiting room on the up platform, the platform edges and a lighting standard. The trailing bogie of this coach detached after a high speed impact with the bridge parapet (Darkes Lane) and was found embedded in the down Slow platform edge. Bogie detachment under these extreme conditions would 12

24 not be unexpected and, although the bogie frame was severely damaged, the wheelsets remained attached to the frame All the underbody equipment had been stripped away, probably as the fourth coach passed over the top of bridge parapets and, at the same time, the left-hand side of the body shell was penetrated by part of a steel fence that had been located on the top of the bridge parapet. The fourth coach also suffered the damage caused to it by the cheese weights and the large slab of concrete torn from the platform edge The energy absorbing features of Class 365 Network Express trains are designed mainly to resist longitudinal impact forces (e.g. in end to end collisions) and the nature of this incident was such that these features would not have been expected to come into play. It was inevitable that side impact with lineside equipment and platforms at high speed would result in penetration of the body shell of the fourth coach. Internal crashworthiness 2.40 The interior of each of the four coaches was examined in detail in order to assess the damage to fixtures and fittings, and to provide comments on their crashworthiness. The first three coaches were examined internally at the derailment site. The first two coaches were then transported to the WAGN depot at Hornsey for more detailed assessment. A preliminary internal examination of coach 4 was carried out at Potters Bar when it had been recovered from the platforms and set upright. This coach together with coach three was later transported by road to the Bombardier works at Crewe, where it was examined in detail Coaches 1 and 2 remained upright during the incident and on the rails. As would be expected, there was no damage to the internal fixtures and fittings. The trailing end of coach 3, although derailed, remained upright and, once again, there was no significant internal damage. The windows and doors in the first three coaches were all intact Although coach 4 suffered significant internal damage during the event, some of this was due to penetration by external objects (the cheese weights and concrete). Given the extreme nature of the accident (the coach had been airborne and had rotated through almost 360 degrees as it slid along the platforms), the internal damage was less than might have been expected. All the windows had been made from toughened glass and most of them were broken during the event or immediately afterwards by the emergency services; it is not clear which were which. Some of the window frames had been distorted by either external or internal impact. With the exception of one location, the luggage racks, although made of glass, were unbroken. Where breakage had occurred, the panel had been displaced but the glass was retained Much of the internal damage was on the left-hand side of the coach, a consequence of this being the side that struck both lineside equipment and 13

25 the platforms. Many seat mountings had been broken. Some had body shell damage and, in one case, a seat had fractured completely at the junction between the seat back and the base In general, the internal damage to coach 4 was explicable in terms of the severity of the accident. One exception to this was the detachment of the internal door to the driver s cab at the rear of the fourth coach. This was a sizeable wooden door that had been held in place by 10 x 15mm countersunk wood screws only. These appeared inadequate for the task, although the mechanism by which they were pulled out is not known. The detached door would have presented a significant hazard to passengers if it had become detached during the incident. In addition, the overhead electronics in the driver s cab had been displaced due, apparently, to inadequate support. Wheel condition and profiles 2.45 The profiles of the wheels on all the coaches were recorded after recovery of the coaches. Evidence of bruising was found on the back of the flange of the leading wheel of the leading bogie on the third coach. This mark was consistent with this wheel flange contacting the back of the right-hand switch rail. The derailment damage identified all the wheels on the trailing bogie of the third coach and the leading bogie of the fourth coach was consistent with the length of derailed running. The derailment damage on the wheels of the trailing bogie on the fourth coach was consistent with a reduced amount of derailed running as this bogie did not derail fully until it approached the Darkes Lane bridge. All these observation were consistent with the conclusion drawn during the examination of the derailing marks Measurements were carried out and a photographic record of damage was made. There were some differences in wheel diameters across each axle, most noticeable on the leading vehicle, but these were not judged to be significant. In fact it is interesting to note the first wheels to derail were on the bogie that had the most closely matched wheel diameters and flange thickness It was concluded that neither the condition of the wheels, nor their profiles, played any part in the derailment. Condition and testing of points 2182A Evidence of prior condition 2.48 Video recordings, using a system known as Omnicom 11, were made on the Down Fast track in the vicinity of Potters Bar Station in April and July The relevant parts of these recordings were scrutinised to determine the condition of points 2182A at that time. Within the limits of resolution on the video, the points appeared to be in a satisfactory condition. The front stretcher bar was approximately symmetrical in relation to the amount of thread inboard of the brackets at each end. The misplaced lost motion on the connecting rod at the right-hand end of the front stretcher, noted after the 14

26 incident, was not present. The importance of a correct setting in the points to allow for lost motion is considered later. Initial assessment of condition 2.49 An initial assessment of points 2182A was carried out on site immediately after the derailment and, following transport to HSL, Buxton, a detailed examination was performed by an experienced railway switch and crossings designer. The preliminary findings of this examination were to hand at a relatively early stage of the investigation, before any substantial dismantling of the points had been carried out. At that stage some 83 observations/findings were made and these were ranked in terms of their contribution to the derailment. Three of the observations were dismissed on the basis that one constituted normal practice, and two related to activities that had been undertaken on site post-incident Fifteen items were classified as having made a major contribution to the derailment. These included the obvious features that were observed on site (missing nuts, broken lock stretcher bar, etc) as well as features indicating poor maintenance and/or incorrect setting up of points 2182A Three observations related to the incorrect positioning of the lost motion adjustment (sometimes referred to in the railway industry as escapement ) to the backdrive. This deficiency was identified early in the investigation and, as it was judged to be safety critical and to have implications for other sets of points on the network, it was brought to the attention of Railtrack immediately. A meeting, attended by HSE, BTP, AEAT Rail and Railtrack was held at HSL, Buxton on 6 June 2002 to discuss this matter. Subsequently the issue was made public in our July 2002 Progress Report. Detailed assessment 2.52 The relevant standards and drawings were identified. The inspection findings before and after the dismantling of points 2182A were reviewed against the requirements of these standards. Approximately half the initial observations were interpreted as non-compliance with standards, codes of practice and /or drawings. These were made up of a combination of installation faults, maintenance problems and issues relating to the incorrect adjustment of points 2182A A detailed visual examination of points 2182A and associated components was carried out shortly after they were delivered to HSL. See Figures 4 to 15. Representatives of interested parties were given access to the points at this stage, under BTP supervision. They were permitted to take photographs although, to preserve evidence, they were not allowed to touch any of the items. A report for the railway industry Formal Inquiry Panel, addressing some of the issues raised, was produced at this stage. The points were then dismantled and re-examined. They were subsequently re-built, using some new components, and various mechanical tests were performed 15

27 (interested parties also witnessed some of these tests, again under BTP supervision). In order to preserve evidence, destructive work was kept to a minimum and, in most cases, the normal chemical and metallurgical tests to establish materials of construction and their properties were not performed. Similarly, it was not possible to check the dimensions of some components as this may have destroyed evidence It had been noted on site that the outer nuts and insulating bush were missing from the left-hand end of the front stretcher bar and the right-hand end of the rear stretcher bar, and that the lock stretcher bar was broken. In addition, the front stretcher bar was positioned fully over to the right. Other, less obvious features were disclosed in the course of the laboratory examination, as follows: Lock stretcher bar This had failed at the front bolt-hole on the righthand side. Metallurgical examination confirmed that ultimate failure was preceeded by fatigue or corrosion assisted fatigue under reversed bending stress conditions. Fractographic information indicated that, although fatigue crack growth had been occurring for some time, probably weeks or months, the last period of growth was quite recent, having taken place no more than a few days prior to the derailment. There was a small area of overload fracture and this was the last area to fail when the remaining material was not capable of withstanding the nominal stress. The relatively small size of this area indicated that the nominal stress was low. Fatigue calculations, based on a stress analysis of the operation of the points showed that the cyclic stress was above the threshold value for fatigue crack growth (the cyclic stress arises from the varying levels of force experienced during the operation of the points). Small fatigue cracks were present in the lock stretcher bar in the corresponding position at the front bolt-hole on the left-hand side. It was concluded that, here too, the cyclic stress was above the fatigue crack growth threshold but that the stress amplitude was lower resulting in a slower growth rate. The steel from which the lock stretcher had been made complied with the specification and there was no evidence of manufacturing defects that might have contributed to the failure. Front stretcher bar: The presence of mechanical damage near the end of the thread on left-hand side of the front stretcher provided a possible explanation of why the front stretcher had been moved fully to the right. Only by doing this could the outer nuts be attached without encroaching into the damaged area. Furthermore, it was deduced that the outer bush had not been in position recently. Measurements indicated that there was only room for a main nut on the outer end of this stretcher bar, or a lock nut and part of a main nut if the lock nut had been put on first. Under these conditions it would not have been 16

28 possible to lock the two nuts together effectively and the single nut (or lock nut plus half of the main nut) would have been prone to loosening, for example, by vibration as trains passed over the points. The nuts on the right-hand side were all present and there was no indication that they had been moved recently. There are two insulating bushes, positioned toe-to-toe, in the support bracket wall towards the end of each stretcher bar. The outer bush at the left-hand end of this stretcher bar was missing and a damaged bush was found on the ballast under the bracket. The inner bush was present but it had deteriorated. At the right-hand end the bushes were in position but there had been some deterioration of the rubber sleeves. The distance between the inner sets of nuts on the front stretcher bar was too large and this would have had the effect of pre-loading the lock stretcher bar. In effect, the arms of this bar would have been forced outwards inducing a bending stress that would have been concentrated around the holes through which it was bolted to the switch rail. This bending stress would be additional to the normal loading on this component. Rear stretcher bar: At the right-hand end, observations and measurements indicated that, as found after the incident, there was only sufficient thread outside the bracket to accommodate a single nut and it was deduced that this was probably a main nut as a lock nut with a heavy coating of lubricant on both sides was found nearby (indicating that it had not been hard up against another surface). The main nut found on the ballast had a worn, domed end the shape of which matched wear marks on the inside of the outer hole in the nearby bracket. This indicated, that at some stage in its life, the nut had been in repeated contact with this hole in the bracket. There was an area of distorted thread at the right-hand side of the rear stretcher bar, inboard of and adjacent to the inner nuts. This area had a bright appearance when viewed from the right and a rusty appearance when viewed from the left; this difference was a result of the right-hand flanks of these threads having been worn/polished by repeated contact with the inner nuts under the action of compressive forces. Both of these inner nuts were a very loose fit on the thread, suggesting that both the nut threads and the stretcher bar threads had been subjected to wear and, possibly, distortion. The rubber sleeve on the inner insulating bush was missing at this location and a piece of a similar material was found nearby on the ballast. The flange of the steel part of this bush was dished inwards as a consequence of repeated impacts and wear. The bore of the steel part of this bush showed a concentric pattern of marks, the pitch of which corresponded with that of the threads on the stretcher bar. The outer bush was not present after the incident but a similar component was found on the ballast nearby. This bush showed evidence of deterioration. 17

29 It was concluded that there was considerable evidence of prolonged wear and movement of components at the right-end of this stretcher bar. However, both sets of nuts on the left-hand side of this stretcher bar were in place and showed no evidence of recent movement; the insulating bushes at this end were in position and appeared to be in relatively good condition. Flangeway gap This is the gap between the switch rail and its respective stock rail. Its position alternates with the setting of the points: for forward running the flangeway gap is on the right-hand side; for reverse (turnout) running it is on the left-hand side. The width of this gap varies along the length of the points with the curve of the switch rail but, in order to allow a wheel flange to pass, the minimum value is specified as 50mm. For 2182A points in the forward running position, this minimum value occurs just beyond (north) of the rear stretcher bar assembly and was measured to be 30mm. The flangeway gap at the rear stretcher position was 34mm (see paragraph 2.25). Backdrive The purpose of the supplementary mechanical drive (or backdrive) is to transmit motion from the front of the points to the rear and to ensure that the route setting switch rail fits closely against the adjacent stock rail. The most obvious deficiency was the presence of lost motion (or escapement) to the backdrive on the connecting rod at the front of the points and the absence of lost motion on the connecting rod at the rear of the points. The erroneous introduction of lost motion on the front connecting rod had exposed the threads of this rod to mechanical damage over a period of time as it was moving in and out of the stretcher bar support bracket. There were no signs of recent movement on the rear connecting rod where the lost motion should have been thus indicating that this fault condition had existed for some time. There were witness marks to indicate that the front crank on the backdrive mechanism had been in a previous position for some time. There was considerable play in the crank pivots indicating that excessive wear had occurred. On dismantling, it was discovered that the split pins, intended to retain each pivot, were broken. It was concluded that the backdrive was ineffective and hence was not transmitting significant force to the rear stretcher bar and possibly causing additional forces elsewhere in the system. Insulating bushes Following initial examination at HSL, the insulating bushes were referred to elastomer experts at Rapra Technology for assessment of the rubber sleeves. A number of new bushes were purchased from a railway industry supplier for comparison purposes. 18

30 Chemical analysis of the elastomer sleeves on the bushes disclosed that at least three different rubber compounds were present in that the new bushes, the intact bushes from 2182A and the degraded bushes from 2182A had different formulations. Only the intact bushes from 2182A appeared to have been made from polychloroprene, the material specified on the relevant drawing. The exact compositions were not determined, as this would have necessitated further analysis that would have destroyed a significant amount of the rubber material. The bushes from 2182A had been degraded by a combination of chemical and mechanical effects; the former appeared to be due to the absorption of aliphatic hydrocarbons while the latter was probably due to movement/vibration. These two effects are linked (synergistically), as chemical absorption would have degraded the physical properties hence making mechanical damage more likely. It was noted that fretting damage to the outer bushes from the left-hand side of the front stretcher bar and the right-hand end of the rear stretcher bar indicated that both bushes had been partially disengaged for some time before they detached finally. The new bushes were judged to be of poor quality in terms of rubber/steel bond strength, the moulding technique used and rubber consolidation. The latter was so poor that there were circumferential splits around the base of the rubber sleeves that would facilitate absorption of chemicals in service. Mechanical testing 2.55 HSL also conducted a series of mechanical tests on points 2182A that were recorded on video by the BTP. The first were conducted on the points as received in HSL, Buxton where the residual tightness of the nuts remaining on the stretcher bars and connecting rods was assessed by measuring the torque required to unfasten them. The results were variable, with torque readings ranging from 5 to 200 ft.lbs (7 270Nm) The next set of tests was done on the re-assembled points. The points were fitted with new stretcher bar assemblies and a new lock stretcher; however, the original backdrive was retained. The force to operate the points manually was measured. Subsequently the lock stretcher bar was strain gauged and the points machine was used to operate the points, thus enabling dynamic forces to be measured The effect of removal of the outer right-hand nuts from the rear stretcher on the flangeway gap was assessed and it was demonstrated that this resulted in a significant reduction of the gap as a consequence of the right-hand switch rail bowing outwards due to the release of stored energy Experiments to examine the disengagement of the lock stretcher bar by cutting the new bar to simulate the fracture, indicated that this was a progressive process. This occurred as the part of the bar still attached to the 19

31 left-hand switch rail ratcheted its way out of its nylon insulating jacket. It was deduced from this test and witness marks on the actual jacket that this phenomenon had occurred before or, possibly during, the incident The speed of closure of the right-hand switch rail against the stock rail was found to be dependent on the flangeway gap but, in the condition received, it took between 0.20 and 0.24 seconds. Given the speed of the train immediately before the derailment, it would have travelled 8.5 metres in the time taken for the switch rail to close against the stock rail. This implies that the flangeway gap could close in the distance between bogies on a Class 365 vehicle and is important in explaining the derailment sequence In a separate test, the time taken to alter the points from optimum condition into the condition in which they were found (nuts removed from front left, right rear and front stretcher bar over to the right fully) was found to be a minimum of 6 minutes. However, these tests were done with new components and the results should be compared with the tests carried out on site in the days after the incident which took considerably longer. It is clear that the HSL laboratory timing represents the minimum required 2.61 It is understood that ad hoc testing of the integrity of the stretcher assemblies and of the looseness of their components might have been achieved by a practice of kicking each stretcher bar in turn. Various configurations were tried (nuts on, off, etc) but this practice was found to be unreliable and generally ineffective. Chemical analysis 2.62 BTP and HSL staff, both on site and in the laboratory, extracted a total of 25 samples of debris and grease-like material from points 2182A and a series of chemical tests were carried out at HSL. After dissolution in a suitable organic solvent, chemical analysis revealed the presence of a range of hydrocarbons, typical of what would be found in oil-based lubricants. There was little variation from sample to sample and it was not possible to discriminate between different parts of the points on this basis Grease consists of a mixture of a hydrocarbon oil with a suitable filler material to increase viscosity and, as there was no chemical evidence of the presence of a filler, it was concluded that grease had not been used on the points. The grease-like appearance was due to a mixture of oil and general dirt/debris that had served to increase the viscosity. To investigate this further, the insoluble fraction of some of the original samples was examined in a scanning electron microscope fitted with an X-ray analysis facility. This revealed the presence of silica, probably from the ballast, and rust, from the ferrous components of the point. No other solid material was identified. 20

32 Other aspects How the train was being driven 2.64 The leading and trailing coaches of the Class 365 train involved in the derailment were fitted with data recorders, sometimes referred to as onboard train monitoring recorders. The data from these recorders was downloaded and analysed by Atkins, at the request of AEAT Rail The analysis indicated that the train was being driven in a normal manner and, at the point where the derailment occurred, it was travelling at 96.9 mph, equivalent to 43 metres/sec. Up to this point the train performed correctly and there were no indications of any faults or isolated equipment. The emergency brakes were applied as a result of electrical damage to the brake circuit, rather than by the driver; this is as expected given the circumstances of the derailment. The data recorders stopped functioning when electrical power was lost as the fourth coach detached from the rest of the train. Passenger evacuation and escape 2.66 A study of passenger evacuation and escape, based on passenger witness statements supplied by the BTP, was carried out by HSL. The purpose was to assess whether there were any specific problems relating to egress that needed addressing in the future There were 97 passengers on the train, plus the driver, and a total of eighty-three witness statements were obtained. Seventy-one of these referred specifically to the method of egress from the train of which eleven passengers, plus the driver had been sitting in coach 1; 21 had been sitting in coach 2; 27 had been sitting in coach 3; and 11 had been sitting in coach Following the incident, the first three coaches were brought to a standstill north of the station. Most of the passengers in these coaches were asked by the emergency services to remain in their seats. Subsequently they were escorted from these coaches via ladders placed against opened external doors. Some passengers jumped onto the track before the ladders were in place and one passenger lowered himself down from the coach floor, as he did not wish to use the ladder. Passengers were then escorted across the tracks to an assembly area in a nearby Sainsburys store. No problems were reported with this procedure. A member of staff was carried from coach 2 on a stretcher The fourth coach came to rest under the station canopy across the tracks. It was tilted at such an angle that the right-hand side windows were quite close to platform level. Many of the windows were broken during the incident and others were broken deliberately by the emergency services. Most of the passengers in this coach who were able to walk either climbed or were assisted through these windows. One passenger reported being propelled through one of the left-hand side windows, regaining consciousness 21

33 on the platform. Some passengers exited through these left-hand side windows and descended to the track via ladders placed there by the emergency services. It appears that egress from this coach was relatively straightforward and no-one reported been impeded, for example by detached fixtures and fittings Overall, therefore, there were no particular problems with passenger evacuation and escape after the incident. Further work Modelling coach behaviour 2.71 It is possible to model railway coach behaviour using a suite of computer programs developed by AEAT Rail and known collectively as the Vampire suite. This technique effectively combines track quality data and coach performance data to predict the behaviour of a specific coach travelling across a specific area of track. An assessment of this type for a Class 365 coach traversing points 2182A is currently underway, to establish if there are any wider lessons to be learnt from the derailment about coach design. Vibration testing 2.72 It is axiomatic that railway points are subjected to significant levels of vibration due to the passage of trains over them and that this phenomenon provides a mechanism for loosening and eventual detachment of components, particularly fasteners. As in all engineering applications where vibrations are present (e.g. mining, automotive, aircraft industries), fasteners can come loose when an assembly is either not properly designed, or where the prescribed tightening procedure is not followed or where the operating conditions are outside those assumed by the designers. A plethora of proprietary locking systems is available to overcome such vibration problems At an early stage in this investigation, it was appreciated that the role of vibration in the failure of points 2182A needed to be considered and, with the agreement of HSE and the BTP, a working group, chaired by HSL, was set up. A three-part programme was agreed as follows: a literature review to establish what is known about the effects of vibration on points of this type; design and construction of a laboratory test rig to carry out simplified vibration experiments on stretcher bar assemblies; and measurement of vibrations on representative sets of points on the railway network. 22

34 2.74 Interested parties are jointly funding the work. The literature review has been completed and shows that, while various vibration measurements have been made on plain line, there have been no reported attempts in the UK to measure the vibration induced at sets of points of this design, or any other. The review did reveal that large amplitude vibrations can exist over a wide spectrum of frequencies on the rail network as might be anticipated At the time of writing, the construction of the experimental rig was underway and the first set of network tests is being planned. The findings from this work will be reported separately as they are likely to take several months to complete. Conclusions 2.76 The technical investigation, which the Board regards as thorough and searching, is ongoing. So far, it has indicated that: The derailment at Potters Bar was due to the failure of points 2182A. Four main factors contributed to the failure: the poor condition of the backdrive and other components; the loss of nuts from the right-hand end of the rear stretcher bar; the loss of nuts from the left-hand end of the front stretcher bar; and the fracture and disengagement of the lock stretcher bar. It is probable that the lock-nut on the outer right-hand end of the rear stretcher bar had not been tightened against the outer main nut before the incident. It is probable that the outer insulating bush had been missing from the left-hand end of the front stretcher bar for some time before the failure occurred; it would not have been possible to accommodate both outer nuts on this end of the stretcher bar. The lock stretcher bar fracture was due to fatigue cracking which occurred progressively over a period of weeks or months. This set of points had been poorly maintained and was out of adjustment in some respects; this is likely to have increased the possibility of vibration-induced damage. The rubber sleeves on the insulating bushes at the left-hand end of the front stretcher bar and at the right-hand end of the rear stretcher bar had deteriorated significantly, probably due to the combined action of chemical absorption and vibration. 23

35 Other points in the area were found to have similar maintenance deficiencies, although none were in such a poor condition as 2182A. This indicates that a wider problem existed. On other sets of points, there was evidence that attempts had been made to improve retention of the nuts on the stretcher bars ends, suggesting that there had been difficulties in the area with such nuts loosening. The derailment mechanism has been explained in detail and the vehicle dynamics are well understood. The train was being driven normally and within the permissible speed. The crashworthiness of the Class 365 vehicles was adequate both internally and externally. Passenger evacuation was carried out efficiently and there were no particular problems with escape that need further attention. 24

36 CHAPTER 3 MANAGEMENT SYSTEMS INVESTIGATION 3.1 The purpose of this chapter is to describe the investigation conducted by HMRI into the systems employed for managing the inspection and maintenance of railway points, and points 2182A in particular. This element of the investigation has been based on a study of documents supplied by Railtrack (now Network Rail), Railway Safety (now RSSB) and Jarvis to the BTP and HSE. Due to the primacy of the manslaughter investigation led by the BTP, HMRI inspectors have not so far enquired of witnesses if additional company standards, procedures, instructions, and inspection and maintenance records exist that have not already been provided to the investigation. Moreover, it has not been possible to establish how those with health and safety related duties apply the requirements of the relevant standards, codes of practices and procedures. The HSE investigation team has been informed that BTP officers have so far been unable to obtain a full picture from speaking to those who may have been able to shed some light on how the points came to be in their pre-derailment condition. Key areas of attention 3.2 As indicated above, the focus of the HMRI investigation has been on maintenance and organisation issues relating to railway points. The key areas addressed in this aspect of the HSE investigation have included: technical knowledge of the points design, manufacture, and installation; history of the modification, operation, repair, inspection, testing, maintenance, incidents or events associated with points; track condition and history; traffic and track issues; management of maintenance and points, including: planning systems and procedures; management of contractors including training, competencies and control and supervision; adequacy and efficacy of testing and inspection arrangements; risk assessment and defects management. 3.3 The initial phase of the investigation included an examination of possible causes of the derailment, such as vandalism or sabotage of points 2182A, signalling faults, or deficiencies with the rolling stock. The conclusions 25

37 of this early work were reported by the HSE in its report dated 14 May 2002, produced 4 days after the derailment. Given that it was soon evident at the derailment scene that the incident was caused by the failure of points 2182A, the second phase of the HMRI investigation examined the maintenance and organisational aspects relating to railway points along with other lines of inquiry. We describe below what the HMRI investigation has so far indicated. Report of a rough ride dated 9 May At on the evening before the derailment, the documentation shows that a railway worker employed by WAGN reported a rough ride in the area of the points to the south of Potters Bar station on his journey home from Finsbury Park. 3.5 HMRI analysed the available tapes of telephone calls reporting and responding to the rough ride report. This showed that the relevant standards covering the communication of messages between various parties were not followed. The initial message was misunderstood and became confused in the course of being relayed between the interested parties. This led to a permanent way inspection team being despatched to the wrong part of the track. If the crew had instead attended points 2182A, it is unknown whether they would have spotted any faults that contributed to the derailment. This is because the customary response to a rough ride report is to look for obvious discrepancies such as broken or damaged rails, broken or damaged fishplates, significant misalignments, evidence of wet spots or voiding, or a deliberate act of vandalism such as items placed on the track. Nevertheless, the fact that the crew were sent to the wrong track is a cause for concern. 3.6 It is also concerning that the crew appear to have investigated the rough ride report without any of the required precautions attaching to red zone 12 working in the dark being applied, namely that: a pee wee (portable warning equipment operated by a look out remote to the work site) system is in use; or the speed of approaching trains is restricted to 20mph, with look outs positioned accordingly; or the work is in an engineering supervisor's worksite, and various other safeguards are met. 3.7 HMRI found no evidence of any of these requirements being applied either from their own investigations or those of the BTP. The crew responded in darkness with trains running at line speed. This action is not in accordance with the rules (the Rulebook) and was plainly unsafe. In such an environment as this, the crew would have understandably been concerned for their own safety which, had they attended points 2182A, may have resulted in a less than thorough search for possible faults. Upon finding no evidence of defects relating to a rough ride from examining the wrong area there is no evidence that they investigated further. 26

38 Inspection and maintenance regimes 3.8 Railway points are covered by two quite separate inspection and maintenance regimes one relating to the track, or permanent way ; and the other, to signalling. Points 2182A were covered by both. Permanent way inspection and maintenance 3.9 Under the industry s own standards, Railtrack was required to ensure that a valid system existed to identify faults and defects in the permanent way that, if not rectified, could affect the safety of rail traffic. An inspection plan must be created indicating when inspections are to be carried out, and used to monitor compliance. A record must be made of each inspection Railtrack s own standards provided an inspection hierarchy of three levels. The maintenance contractor Jarvis, in turn, transposed those standards into instructions for their personnel to follow. The three levels were as follows: basic patrolling at weekly intervals; supervisory level checks at two monthly intervals; and, a track engineer examination every two years The inspection regime was supplemented by a series of more detailed inspections of the permanent way There are further areas of enquiry in the light of the technical investigation that the HMRI investigation needs to address with regard to the permanent way inspections and maintenance regime applied to points 2182A. The key issues are: The inspection by track patrollers of points 2182A prior to the derailment, including questions concerning their training and assessment by Jarvis; Adherence to the inspection regime in terms of record keeping, visibility, and staff protection arrangements. The basic weekly inspection records did not contain any specific defects in relation to points 2182A. Over the period under consideration the second and third level inspections did not appear to report any defects regarding points 2182A relevant to the derailment, but did report poor track alignment at the points more than once that required remedial work. The records are not clear on what remedial work was done and when. Whether the inspection regime of Jarvis requiring level two and three inspections to assess the lower level inspections for effectiveness and make any comments was complied with. 27

39 In addition, the investigation has been informed that rolling contact fatigue 13 was identified in the left hand switch rail at points 2182A in September This required the imposition of a temporary speed restriction until rectification. A new half set of points was ordered to replace the affected set, and these were delivered to the Potters Bar station car park. Maintenance records state incorrectly that the new half set was installed. HMRI were told that this was not done: the rolling contact fatigue was remedied by grinding instead, and the line speed was restored in December The replacement set was later removed from Potters Bar station No evidence was found of any backlog of routine permanent way visual inspection work regarding points 2182A prior to the derailment. No permanent way maintenance work regarding points 2182A appears to have been recorded in the workbank as being required, planned or outstanding at the time of the derailment. There is clear evidence that maintenance work had been carried out on other sets of points in the Potters Bar area because new components could be clearly identified but no written records have been found to show whether this work was carried out. Signalling inspection and maintenance 3.14 The relevant industry standards require a formal signalling inspection and maintenance regime to be in place to ensure that the signalling infrastructure is maintained in a safe condition. In relation to points, the regime must include the checking of track gauge, testing of the facing point lock to ensure it is set correctly, and testing of the detection equipment; plus checking for signs of wear in the switch operating mechanism, in the facing point lock, and in the detection equipment. The industry standards and Jarvis own procedures require that only suitably competent personnel should undertake signalling inspection and maintenance work The requirements of the various signal maintenance tasks (at the time of the derailment) are contained in the BR Signal Maintenance Specifications, supplemented by various additional Railtrack Company Standards and Codes of Practice. Jarvis had company procedures that set out to implement those company standards There are further areas of enquiry in the light of the technical investigation that the HMRI investigation needs to address with regard to the signalling and maintenance regime applied to points 2182A. The key ones are these: The documents so far studied do not suggest that the signalling maintenance regime in relation to points is clearly stated. Nor is it clear how the regime was communicated to Jarvis. The signal maintenance specifications do not appear to prescribe any specific inspection or maintenance regime for stretcher bars, other than the lock stretcher bar. 28

40 There appear to be no inspection or maintenance instructions as regards adjustable stretcher bars. A planned joint permanent way/signalling maintenance visit to points 2182A in March 2002 appears to have taken place without permanent way personnel being present. This raises questions of whether faults were missed, or if some were spotted, how these were conveyed to permanent way people. Jarvis and Railtrack personnel conducted a one-off inspection of points 2182A jointly, also in March 2002, outside the planned inspection regime as a local initiative. A report on the outcome of that inspection was generated, but did not include any report of signalling faults or defects on points 2182A. On 1 May 2002 a signalling technician recorded on a planned maintenance visit that 2182A points needs a new rubber bush on the back lock stretcher. Existing bush perished. However, that record makes no mention of the condition of the nuts, lock nuts being off the stretcher bars or whether the technician had found this to be so and put them back on. No records have yet been identified detailing any remedial work, or additional work having been carried out, or required to be carried out, other than planned signalling related maintenance work on points 2182A. No outstanding work was identified as being required on the points from the records, except the worn bush. It appears that the system detailed in the Jarvis procedure for the managing of outstanding work was not in place at the time of the derailment. No backlog of maintenance work has been identified with regard to points 2182A. However, there is some evidence that not all maintenance work recorded was completed. Many of the Jarvis signalling personnel transferred from the previous maintenance contractor and it is unclear at this point what steps Jarvis took to assess those personnel as competent to undertake inspection and maintenance work on points. 29

41 Conclusions 3.17 The HMRI investigation so far has indicated that: There were two separate systems for the inspection and maintenance applied to points 2182A, one involving permanent way personnel, and the other involving signalling staff. This created the possibility that roles and responsibilities were not clear. There appears at this stage to have been no guidance or instructions for setting up, inspection or maintenance of points of the 2182A type based on an understanding of the design and safety analysis of this item of safety critical equipment. There appear at this stage to have been deficiencies in the arrangements for inspection as they were applied, including in those intended to ensure that personnel were competent. There appears at this stage to have been a failure to recognise safetyrelated defects in the set up and condition of points 2182A, and to record or report them. There were deficiencies in the response to a report of a rough ride in the area of the points south of Potters Bar station the night before the derailment occurred, 9 May

42 CHAPTER 4 HMRI WIDER INSPECTIONS OF POINTS Background to the inspections 4.1 Following the derailment, Railtrack undertook, over the subsequent weekend, a check of over 850 points across the country for faults similar to those found to be present in points 2182A. Railtrack also instigated a more comprehensive, systematic and detailed check, using contractors, of all the points in the network that are similar in design to those at Potters Bar, i.e. shallow depth points. 4.2 HMRI undertook its own independent sample survey of points across the rail network. This sample survey included shallow depth points (which have adjustable stretcher bars) and those of an older design with nonadjustable stretcher bars, which are more prevalent on the national network. The survey was carried out in May and early June 2002 and involved HMRI inspectors inspecting around 240 points to check their condition. This inspection covered both the main rail network and that operated by London Underground. A sample check was also made on maintenance contractors arrangements for routine inspection and maintenance of points, and the supporting record keeping. 4.3 From the HMRI sample survey no single set of points was found to be in the same condition as points 2182A at Potters Bar. However, in one area, the condition of points was such that HMRI issued two Improvement Notices requiring improvements to be made to the arrangements for inspection and maintenance. Both notices were complied with. Outcomes 4.4 The results of HMRI s sample survey were shared with Railtrack and were compared with the outcome of Railtrack s own comprehensive checks. The comparison showed that very similar results had been obtained. Both HMRI and Railtrack s checks showed a range of condition of points across the network. The HMRI sample check on maintenance arrangements, including record keeping, also showed a range of standards. 4.5 Shortly after the derailment, in May 2002, Railtrack published Special Inspection Notice Integrity of Adjustable Points Stretcher Bars (RT/SIN/080). This joint signalling/track engineering document set down parameters for the adjustment and integrity of the stretchers and fixings. A revised version (SIN080 issue 2) was produced and issued in July Railtrack advised HMRI that all points on the network would be inspected by Railtrack and its contractors, to the standards in SIN080 issue 2, within three months. HMRI advised Railtrack of its intention to carry out a further sample survey of points following that three month period. 31

43 4.6 In late October and November 2002 HMRI undertook a further sample survey looking at approximately 220 points on the rail network. Approximately 30% of the sites inspected in May were revisited; and approximately 60% of all the points seen were adjustable points. The sample survey also included checks on maintenance contractors arrangements for routine inspection and maintenance of points, and the supporting record keeping. 4.7 While there had been a significant improvement in the maintenance of shallow depth points, one was found with a stretcher bar lock nut missing. There had been less improvement in the maintenance of points of older design, with non-adjustable stretcher bars. On one, a stretcher was found to be broken. 4.8 Additionally on both designs of points a proportion were found where, in the inspectors judgement, good engineering practice 14 was not being applied. The significance of this is a matter that needs to be further debated with the industry. In any design of safety critical equipment, such as points, there will be a number of safety measures. Loss of any one measure will not necessarily result in an immediate risk, but it will reduce the safety margin. However, it is HSE s general view for safety critical equipment where failure could lead to loss of life, and HMRI s particular advice for points on the national rail network, that all the designed safety measures should be properly maintained or, where one fails, it should be brought back up to standard as soon as reasonably practicable. This is particularly important for 2182A type points with only two adjustable stretcher bars. 4.9 The numbers and types of examples found of failure to apply good engineering practice, both in May 2002 and in November 2002 (after inspections in accordance with SIN080 issue 2) led HMRI to the opinion that, while there were regional variations, this failure was endemic in points maintenance on the national network. In discussion Railtrack took a different view to HMRI on the significance of the application of good engineering practice to safety critical equipment on the railway Further to issues about applying good practice to maintenance, the HMRI sample survey of inspection arrangements and record keeping in October 2002 and November 2002 showed two maintenance areas failing to meet the timescales set down for points inspection. Improvement Notices were issued in both cases. Both have been complied with. There was also variation in the implementation of the record keeping requirements of the new SIN080 issue 2. 32

44 CHAPTER 5 THE BOARD S OBSERVATIONS AND FINDINGS Introduction 5.1 In this chapter, the Board explains how it has gone about its role in overseeing the HSE investigation, and presents some observations on the investigation and the environment in which it has been conducted. We discuss what the investigation has told us about causes and contributory factors to the likelihood and consequences of the derailment. We also review what an inquiry into the prior role of HSE has told us about HSE s approach to regulating rail safety within the present regulatory system. We review the rail industry s response to the derailment, and our earlier recommendations, and how this has developed with the creation of Network Rail. Against this background we examine what all this tells us in terms of learning lessons about safety management and safety culture in the rail industry. Our observations have suggested ways in which rail safety might be improved. 5.2 As a consequence of our review of the HSE s investigations and consideration of other related matters, we make recommendations, in Chapter 7, for improving rail safety. In doing so we are not saying that the rail network is unsafe, or that the regulatory system is ineffectual, in these respects. But we consider that by looking at the findings of such investigations and other matters there are lessons to be learnt that, if adequately addressed might improve rail safety standards further and provide for better safety regulation, particularly in preventing catastrophic events. 5.3 Our focus has been on learning lessons to minimise catastrophic risk, namely those events that could lead to multiple fatalities and severe injuries. Such events, as well as causing considerable public concern, can also lead to severe disruption of public transport systems and economic loss. In coming to a decision on minimising catastrophic risk these political, societal and economic considerations have to be borne in mind as well as the direct costs and benefits of reducing the likelihood that individuals will be harmed. 5.4 In undertaking its work the Board has greatly benefited from discussions with railway experts. This has augmented the wide experience of its individual members of the management of safety in other industries where catastrophic risk is a key consideration. We have also drawn extensively on the private sector Board level experience of our two colleagues from outside the HSE. The HSE investigation 5.5 We have met every month since the Board was created. We have visited the HSL laboratories at Sheffield and Buxton to study points 2182A and the various testing procedures, and also viewed the third and fourth coaches at the Bombardier site in Crewe. At each of our meetings we have 33

45 received presentations on the various elements of the HSE investigation, in particular the technical work led by HSL and the work of HMRI inspectors, assisting the BTP. 5.6 We have been greatly impressed by the thorough and professional manner in which this work has been carried out. We are aware of the frustration felt by many at the amount of time the investigation has taken. The Board noted the attention being given in Government to ways of reducing delays in inquiries and overlapping proceedings. For our part, we have closely questioned the reasoning behind the length of time being taken, challenging timescales and looking for ways to speed up progress where we have judged this to be warranted. We have concluded that, within the constraints imposed by the legal requirements and in the context of the present arrangements for the investigation of work-related deaths (referred to in Chapter 1), the HSE investigation has been thorough and searching, and has been conducted expediously. In arriving at this assessment, we have been mindful of factors such as: the peculiar nature of the incident, in that whereas the immediate faults were obvious, and the derailment sequence can be determined from the physical evidence, establishing how and when points 2182A came to be in the condition in which they were found has proved to be complex. This is especially so as we are informed that the BTP has so far been unable to obtain a full picture from speaking to those who may have been able to shed some light on how the points came to be in their pre-derailment condition. Furthermore, some of the records are not as full as the investigators expected. The Board is disappointed with this position; the need to be meticulous in the gathering, forensic examination and testing of evidence, and to protect its integrity from inappropriate disturbance. In HSL particularly, this has required full records to be made of its work, including video recordings. In line with BTP procedures, HSL s work has been subjected to external auditing, both by UK forensic bodies and, for some aspects, relevant experts from the USA, organised by the BTP; the scarcity of specialist personnel and facilities available for this type of investigatory work and the need to stretch them even further to provide urgent input to incidents such as the derailment at Southall East last November and the London Underground derailment at Chancery Lane in January; the requirement to accommodate the competing needs of all investigating bodies. The BTP are in the lead on the criminal investigations, and HSL priorities for the Potters Bar derailment have largely been driven by BTP needs. However, HSL has also had to assist HMRI s investigation of possible criminal offences under HSWA, assist the Formal Industry Inquiry, and accommodate the witnessing of various tests by expert representatives from both duty holders, 34

46 Railtrack and Jarvis. These complications have had an impact on the time taken on the technical investigation. In the view of the Board, the creation of the new RAIB provides a welcome opportunity to address the present obstacles to achieve the speedier arrival at the causes of rail accidents and the safety lessons to be learnt from them. 5.7 The HSL technical investigation is now largely complete and has revealed compelling facts about points 2182A, which we consider later. The Board notes that other elements of the HSE investigation - into management systems and responsibilities associated with the condition of points 2182A - still have some way to go. Owing to the primacy of the manslaughter investigation, this work has been restricted so far largely to examining records and standards to assist the investigating BTP officers to prepare for further lines of inquiry and interviews. We also note that this process was held up by difficulties experienced by the investigating officers in examining all the expected relevant files and records. 5.8 The Board considers it highly desirable for the HMRI investigation to be taken forward so that a more detailed picture can be developed about managerial systems relevant to the derailment, from which assessments of their efficacy can be made and any lessons identified to further rail safety. There are powers available to the HSE inspectors under section 20 of HSWA. For example, there is a power to require an employee, whom an inspector has reasonable cause to believe to be able to give information relevant to the investigation, to answer questions truthfully. The answers to such questions cannot be used in evidence against that employee. This is an important tool in the investigation of employers safety management and systems when responding to incidents. The legal basis for the work of the RAIB, and its protocols with other investigators, will need careful preparation in this context if the new institution is to maximise its contribution. The derailment: causes 5.9 We stated in our July 2002 progress report that the direct cause of the derailment was a catastrophic failure in points 2182A. The full technical investigation that we have described has now established four main factors that contributed to the failure of points 2182A - see Figures 4 to 15: the poor condition of the backdrive and other components; the loss of nuts from the right-hand end of the rear stretcher bar; the loss of nuts from the left-hand end of the front stretcher bar; and the fracture and disengagement of the lock stretcher bar In addition, we are persuaded that points 2182A were in a poor condition in respect of adjustment and maintenance. These factors were likely to have increased the possibility of vibration-induced damage and movement of the components. 35

47 5.11 The strength of the technical evidence leads us to conclude that it is probable that the lock nut on the outer right-hand end of the rear stretcher bar had not been tightened against the outer main nut before the incident, and that the outer insulating bush was missing from the left-hand end of the front stretcher bar for some time before the failure in the points mechanism occurred. Furthermore, it would not have been possible to accommodate both outer nuts on the left-hand end of the front stretcher bar. The maladjustment of the points had enhanced the stresses on various components and the vibrations they were subjected to Other sets of points in the vicinity of Potters Bar were observed to have similar maintenance deficiencies, although none were in such a poor condition as points 2182A. It was also observed that, in some cases, there were difficulties in tightening up the stretcher bar nuts properly with the tools available to the maintenance workers. On some of the other sets of points there was evidence that attempts had been made, by way of pop marks (i.e. indentations on threads that appear to have been made deliberately to stop nuts working loose) or other means such as friction washers, to improve the retention of the nuts on the stretcher bar ends. This suggests that there had been some concern that nuts could loosen or come off The Board has weighed the facts referred to above very carefully with other information that has been placed before us arising from: the overall outcome of the HSL technical investigation; the results of the HMRI inspection of similar points across the network, described in chapter 4; external submissions made to the Board, especially one from the legal advisers acting for Jarvis about the possibility of sabotage or unauthorised interference; details of the extensive lines of inquiry pursued by the BTP, including the taking of over 1400 statements (which have been extensively followed up), enhancement by the FBI of the CCTV recordings at Potters Bar station and its immediate environs, reconstruction of the video recording coverage of the track area near to points 2182A, DNA profiling on parts of the track, reviewing mobile phone records, and contractor vehicle records; the results so far from the HMRI management systems inspections of the maintenance and inspection records for the Potters Bar area. From our consideration of the information we have seen and heard, we are: fully satisfied that the HSE has conducted a thorough and searching technical inquiry into the derailment, including the possibility that sabotage or deliberate unauthorised interference with points 2182A 36

48 caused the derailment, noting the work that the BTP are undertaking in this area; satisfied that no evidence has yet been established to support speculation that sabotage or deliberate unathorised interference was the direct or root cause of the derailment. This reinforces, in the light of fuller technical information, the views expressed in HSE s 14 May 2002 report on the derailment, and in the Board s July 2002 Progress Report; satisfied that an explanation can be given for the failure of points 2182A based on evidence of the poor condition of these points to an extent that they were not fit for purpose for the operating environment and safety related functions expected of them Subject to the discovery of any evidence to suggest sabotage or deliberate unauthorised interference, we consider that the investigations completed so far show that the most likely underlying cause of the derailment was the poor condition of points 2182A at the time of the incident, and that this resulted from inappropriate adjustment and from insufficient maintenance compared to what was necessary for their operating environment and safety functions. We note that this situation probably arose from a failure to understand fully the design and safety requirements for this type of points in this particular operating environment and hence implement appropriate arrangements for setting them up, and for their inspection and maintenance. Possible factors associated with the derailment 5.15 We have been mindful that, in all serious incidents, a whole series of factors can influence either the likelyhood and/or frequency of an event occurring, or the consequences likely to arise from an event when it happens. We make observations on both these fronts, based on what we have seen and learnt regarding this derailment and keeping the search for ways of improving rail safety uppermost in our minds. Likelihood of the derailment occurring Historical perspective 5.16 Railtrack provided the Board with information about the history and rationale behind the introduction of this design of railway points involving adjustable stretcher bars. This type of points was introduced in the early 1990s, mainly to overcome problems of failures of a previous design of stretcher bar (consisting of flat plates drilled on site to give the required length of stretcher bar) and the difficulty of adjusting the flat plate stretcher bar to a fine tolerance to achieve consistency in the setting up of the points. Development of the adjustable stretcher bar concept took place between 1980 and This, we were told, was achieved mainly through an empirical design approach involving trials on the network and enhancements in the size of components until a robust performance was arrived at under the conditions 37

49 applicable at that time. One particular aspect of the adjustable stretcher bars used on points 2182A is interesting: once installed they were not intended to require adjustment thereafter and the design intention was that they should remain fit for purpose for many years after installation. The investigations reported here cast some doubt that adjustable stretcher bar points achieved this design intention. To date we have not seen any evidence of the reporting, recording or review of defects such as missing adjustable stretcher bar nuts that would have informed any consideration of continued adequate operational performance of this particular safety critical component Inspections of points across the network by HMRI have raised questions about the performance of adjustable stretcher bars and the associated inspection and maintenance arrangements. This is also the case for the tests done by HSL in the vicinity of Potters Bar shortly after the derailment, which found a variety of standards of condition of adjustable stretcher bar points systems across the network; variability in tightness of locking nuts; and signs such as pop marks mentioned earlier It might be that this type of points is entering a phase leading to the end of its life cycle, especially in view of the increased use they have had to face over the last few years with the significant (around 20% to 30%) increase in rail traffic, or that they are now working outside their design/safety constraints. We have received no evidence that these factors have been taken into account in any review of the design or safety analysis to demonstrate that points of the 2182A kind remain fit-for-purpose in line with the required standards for safety critical components Use of contractors 5.19 Another change that has occurred since the original adoption of the adjustable stretcher bar design is the move to far greater use of contractors in rail infrastructure maintenance. The HSC has expressed the view that the use of contractors for maintenance work does not, of itself, compromise the integrity of the rail infrastructure. However, such a change, from in-house technical expertise and maintenance to outsourcing, has to be carefully managed. The safety implications need to be properly assessed, and robust monitoring and assurance systems put in place. Contracts also need to be set in a way that puts the right incentives in place to ensure continuing attention to safety. It is not that use of contractors is inherently unsafe; more that, to ensure robust safety standards are achieved, the use of contractors must be carefully managed by a knowledgeable client who understands, and can deal with, the added complexity involved. In the specific case of points with adjustable stretcher bars, it is a matter of concern to us that the findings of the investigation suggest no such understanding and management appeared to exist, leading to a position where detailed guidance (produced from an understanding of the design and safety requirements for set up, inspection and maintenance) did not appear to be available to those responsible for maintaining points of the 2182A variety Railtrack went some way to addressing this deficiency after the derailment by the development of a good practice guide for the setting up and 38

50 maintenance of adjustable stretcher bars, although an in-depth design and safety review of the performance requirements of adjustable stretcher bars under present and anticipated future operating conditions is needed. We understand that Network Rail now intends to do this. We welcome this and suggest that the results of this more detailed work should be used to review the adequacy of the good practice guide. Inspection practice 5.21 Without an adequate understanding of the design/safety limitations, and the appropriate operating and safety requirements, a relevant risk based maintenance and inspection regime cannot be developed. As we have noted before, the inspection and maintenance requirements for adjustable stretcher bars prior to the derailment do not appear to have been set in line with the design/safety limitations, and the appropriate operating and safety requirements fully understood. (These considerations lay behind the core recommendations of our July 2002 Progress Report.) For example, a method suggested as having been employed for inspecting the capability of adjustable stretcher bars to fulfil their safety related duties was for an operative to kick each stretcher bar as he or she walked along the track. This inspection practice would have been likely to have picked up the failure mechanism of the old plate type of stretcher bar (fracture). However, tests by HSL revealed this practice, when applied to adjustable stretchers, to be unreliable and generally ineffective in detecting a prime failure mode for adjustable stretcher bars loss of mechanical connection between the stretcher bar and rail. There has also been debate about whether existing signal failure detection systems can pick up the sort of deficiencies observed on points 2182A. The move to adjustable stretcher bars 5.22 One further illustration of the need to have an adequate understanding of the important safety features of safety critical components (such as points systems) when making changes is the change in the number of stretcher bars used for a particular points system. We have been informed that, at the time of the development of adjustable stretcher bars, a different type of switch rail (UIC 54B) was coming more into use that had a higher lateral stiffness than the existing rails (BS113A). This led to a reduction in the number of stretcher bars across the range of points. For those at Potter Bar this meant that two load bearing stretcher bars were specified in the design for this turnout, this being fewer than previously specified with the old type of stretcher bar for such a turnout. A move of this kind changes the level of redundancy available if one stretcher bar should fail and the resulting impact of load sharing amongst the bars still functioning properly. We have not found evidence that such impacts as this change in the configuration of points was taken into account when considering the change in the early 1990s, or since An effective inspection and assurance regime needs to be based on an understanding of the design/safety constraints and operating environment, and also informed by an appreciation of the risk of failure in safety critical components such as railway points. Moreover, such a regime needs 39

51 revisiting and refreshing regularly to reflect operational experience and design changes. The poor state of points 2182A suggests that the inspection and assurance regime that applied to them was inadequate. If so, it was a possible contributory factor to the likelihood of this derailment. Inspection and maintenance roles and responsibilities 5.24 The apparent dual inspection and maintenance regimes revealed by HMRI s investigation for points 2182A was a matter of particular concern to the Board. We believe the separate involvement of both permanent way and signalling personnel may have led to confusion and so militated against a structured, clearly defined approach to inspecting and maintaining points 2182A in a safe condition. We noted that in 1993 recommendations were made to the then British Rail Track Design Committee that the fitting of stretcher bars should become the responsibility of signalling engineers. However, those recommendations were not implemented. We cannot say whether such a change, if implemented, would have also prompted Railtrack to move full responsibility for inspection and maintenance of railway points to signalling engineers. In our judgement this duality in the inspection and maintenance regime may have contributed to the condition of the points prior to the derailment. The attitude to points defects 5.25 We note that inspections across the network instigated by Railtrack in response to the derailment revealed a spectrum of standards of conditions with around 48% of the 870 sets of shallow depth points found to deviate from the normal condition. None were in the extremely poor condition of points 2182A. The vast majority had only one or two deficiencies per set. The breakdown of deficiencies was reported to the Board as: around 20% had stretcher bars not centrally set up (so that there was less thread at one end of the stretcher bar for a main nut and lock nut to engage on) around 11% had the supplementary (back) drive out of adjustment around 7% had nuts loose on a stretcher bar around 3½% had nuts loose on a stretcher bar bracket around 1½% had missing nuts from a stretcher bar around 0.2% had nuts missing from the stretcher bar bracket We raised the issue of loose and missing nuts on these safety critical components with Railtrack in two meetings to discuss our July 2002 Progress Report and their response to our recommendation in that report for a shortterm design/safety review. It was indicated to us that it was historic practice to accept that nuts and bolts came loose and would be tightened up during maintenance. The approach was to rely on going out to inspect for such 40

52 deficiencies and then rectifying them, relying meanwhile on other stretcher bars in the set of points to ensure safety. This, of itself, must be a questionable approach given what we have said about the limited redundancy within this design of points. We were also told the conclusion of the Railtrack commissioned short term design/safety review was that the analysis of deficiencies reported above confirmed that the design was robust and fit for purpose This does not seem to us an appropriate attitude to the maintenance of safety critical components on a railway that is a mass transport sytem. We would expect a maintenance philosophy for safety critical components to be based on maintaining the level of safety embodied in the design and safety analysis assumptions. This is especially the case for the type of points used at Potters Bar where only two adjustable stretcher bars were present. This raises issues about the safety culture and maintenance philosophy within the rail network, something that we return to later in this report. Responding to rough-ride reports, etc 5.28 In chapter 4 we described the handling of the rough ride report made the night before the derailment. Although the conditions under which an inspection would have taken place, including the prevailing inspection and assurance regime, meant that an appropriate response to the report might not have led to the discovery of the defects in points 2182A, there needs to be effective systems to ensure that reports are dealt with appropriately. This includes ensuring that people employed on responding to reports of problems associated with safety critical components have the appropriate training, competence, and questioning attitude. The importance of taking a precautionary approach, commensurate to the catastrophic risk associated with a failure in such components, needs to be more fully understood and embodied in the response systems. We consider that the systems and competences for responding to reports of problems associated with safety critical components should be reviewed and action taken to improve them. Consequences of the derailment 5.29 There are a variety of factors arising from the incident and the technical investigation that raised questions in our minds about the wider implications for reducing consequences of derailments, namely: positioning of points near to bridges and station;s bridge design; trackside infrastructure; crashworthiness of the class of coaches involved in the derailment. We consider each of these in turn and offer our views. In doing so, we are not making recommendations for definite or immediate action. Rather, that 41

53 attention should be given to the safety related issues that we raise, especially by designers of the equipment, having due regard to the considerations of operability, costs and benefts from any resulting changes that may be contemplated. Positioning of railway points 5.30 Terrible as the consequences of this derailment were, had it occurred at a time of day when the platforms at Potters Bar were crowded there could have been even more injuries and loss of life. With this in mind we have questioned the positioning of points close to bridges and stations. Of course, we appreciate that there may be strong operational reasons for locating points in such proximity to stations, which is where bridges tend to be. However, we would like to see a structured, risk informed approach in the decision making on locating new and replacement points. We envisage an approach that would deal with the issue in stages: firstly, examine whether it was really necessary to have points at the general location; if it was, then secondly examining what precise position will minimise the hazard; and thirdly, examine how the design of the points themselves at the location might minimise the hazard by, for example, employing a more inherently safe design. This approach aligns with a general safety approach in design: first try to remove the hazard, if not minimise it, then control the residual risk. Bridge design 5.31 As a consequence of the derailment, debris fell between gaps in the Darkes Lane road bridge, killing a pedestrian on the pavement underneath. Network Rail has addressed any future risk of this in its reinstatement of the bridge at Potters Bar. We see value in such risk-based considerations being given to similar improvements being introduced to other locations on the rail network, where this would be reasonably practicable. This may address the more likely event of debris from operational and maintenance activities being inadvertently dropped onto pedestrians and traffic below. Track infrastructure 5.32 The fourth coach displayed evidence of having collided in the course of the derailment with stanchions supporting the OLE, with the waiting room on the platform, and with the platform edges and lighting standard. Additionally, cheese weights (heavy circular weights with slots in them to help to tension overhead lines) from the overhead line support system were launched into the air and smashed through a window of the coach causing significant damage. Other cheese weights flew into the station car park representing a significant hazard to people there at the time. These outcomes need to be minimised as far as is reasonably practicable in the future design of track infrastructure. 42

54 Crashworthiness of the coaches 5.33 The technical investigation has shown the crashworthiness of the Class 365 coaches was adequate, internally and externally. In general the internal damage to the fourth coach was explicable in terms of the severity of the accident, with the exceptions of the driver s internal door that may have became detached during the derailment and some of the internal overhead electronics that were found to be inadequately secured. These potential hazards could be minimised by looking for reasonably practicable control and assurance measures in the construction and modification of coaches. The rail industry s response to the derailment and to the Board s July 2002 recommendations 5.34 Although it is for the rail industry to report on their response to the recommendations made in our July 2002 Progress Report, we have made observations on their response so far to assist in the identification of possible improvements in safety management and in the safety culture of duty holders We have held meetings with Railtrack about our July 2002 Progress Report and their initial response to our core recommendation for a design/safety review of points of the 2182A type. This review was intended to identify any immediate modifications, taking account of all relevant factors, to ensure better that points fitted with adjustable stretcher bars could fulfil their safety functional requirements, and to form a basis for reviewing the standards for installation, setting, maintenance, inspection, etc of these types of points. More recently we have held meetings with Network Rail to review the work, largely undertaken under Railtrack s control, in response to our recommendations, and to discuss the work Network Rail intends to take forward in this area. There has been marked progress in recent months following the change of ownership of the rail infrastructure to Network Rail Railtrack arranged for a short-term and longer-term review of the design/safety of adjustable stretcher bar points. The short-term review reported in August 2002 and the longer term review in late December Neither of these two reviews met our expectations in terms of being appropriate responses to the derailment itself, or to our recommendations. We were particularly concerned that in the short-term review due account had not been taken of: work done by London Underground Ltd, which had previously identified deficiencies in its population of points with adjustable stretcher bars and addressed some of them with engineering improvements; and the formal acceptance by Railtrack in 2000/2001 of the use of a proprietary specialist locknut system for use on various components of the rail network However, some useful aspects did flow from the two reviews: the shortterm review traced the historical background to the development of the 43

55 adjustable stretcher bar design of points; the longer term review reported on an evaluation of a range (including those suggested by members of the public) of locking nut systems and security indicators for possible use in place of the present locking nuts used on adjustable stretcher bars. This second, longer-term review suggested a further evaluation of two candidate lock nut systems by way of trials on the network Following the creation of Network Rail, the Board has witnessed in the last few months a developing change of attitude and attention to responding to the issues raised by the Potters Bar derailment. Of particular note has been a clearer understanding of the risks associated with points of the 2128A variety, a greater willingness to look for areas of genuine improvement, and a commitment to engage external expertise to develop a more appropriate design/safety review of railway points to assist in identifying a risk informed strategy for improvement. We welcome this, and encourage Network Rail to continue to move further forward along these lines. Safety management issues in the rail industry 5.39 We have examined whether there are lessons that may assist in improving the management of safety on the rail network. In doing so we have largely confined ourselves to the area of catastrophic events such as that at Potters Bar. We note that further work in the HSE investigation into management systems may reveal more lessons. However we consider that at this stage there are some important lessons that, if acted upon, could assist in furthering rail safety. We consider that these should be viewed as being not only good for safety but also good for business. We observe that safety and good business go hand in hand, especially on a busy rail network where, for example, designing out the need for maintenance and using a risk informed approach to maintenance can lead to greater reliability, less down time, and greater inherent safety Early on in the Board s work, we adopted a process model for managing what we termed safety critical components - points, rails, signals, etc. We shared this with Railtrack early in July Uppermost in our minds was the fact that this was the third catastrophic rail event in less than four years that resulted in multiple fatalities and which involved some failure of a safety critical component or system. Hence, we were concerned that gaps in the safety management arrangements for these components and systems should be identified The model is based on identifying the roles and responsibilities of those involved, along with the associated management arrangements for the various stages of the process for ensuring safety critical components/systems are fit for purpose. The hierarchy of stages in the model is set out below: an overall hazard/risk assessment of the rail system to identify the hazards and top level control measures, demonstrate their adequacy, and, crucially for our concern, identify the safety critical components/systems and their safety functional requirements; 44

56 the procurement through appropriately managed design/safety analysis, manufacture, installation, testing/commissioning of fit-forpurpose safety critical components that meet the safety functional requirements identified from the stage above; the operation and maintenance of the safety critical components in line with the constraints and requirements identified by the design/safety analysis including the operating envelope (limits and conditions), resources and capabilities for setting up/testing/inspection/ maintenance/etc, procedures/instructions/guidance; the continuous accumulation of operational experience and its feedback, the periodic review of the safety case for continued operation against present day requirements and standards to identify whether the components continue to be adequate for their safety functional requirements or whether reasonably practicable improvements could be made, or whether changes can be made that would reduce reliability or network downtime We are disappointed that we did not receive a response from Railtrack to show whether they had reviewed their management system for safety critical components and its operation against this or any other framework to look for improvements and ensure that the systems are fit for purpose However, we have received recent information from Network Rail that they have new work in hand, assisted by an outside consultant, to look fundamentally at the safety functionality requirements of railway points and the areas for improvement, based on a risk informed approach. We welcome this, and encourage Network Rail to continue to move further forward along these lines, looking to apply this to other safety critical components and systems We have discussed this matter with HMRI and we have received presentations from railway inspectors on their assessment of the Railtrack Safety Case, accepted by HSE in April This covers large elements of safety management systems, the work HMRI has in hand to inspect compliance with the accepted safety case, and the on-going work of HMRI generally to improve safety management in the railways. We are also aware that railway inspectors have pursued the question of safety analysis and design review with the industry in response to our earlier recommendations. And, we recognise too that HMRI is actively engaged with Network Rail on measures being taken forward to improve infrastructure maintenance We have been greatly impressed by this work but, as we indicated before, we recommend that it be part of a wider review to see whether there is room to target better the regulation of catastrophic risk in the railways. We particularly recommend that in this review HSE considers whether it is satisfied that there are not significant gaps in the management arrangements in the rail industry for ensuring that safety critical components or systems are fit-for-purpose, and whether further improvements are reasonably practicable. 45

57 We noted that the current HMRI Intervention Plan for Network Rail is focussed on achieving this We are particularly concerned that such gaps might exist in practice given the changes that have occurred in the industry over recent years, as suggested by the findings to date of the investigation into the Potters Bar derailment and HMRI s inspections We have been told that following privatisation of the railways, there was a reduction in the technical/engineering/research capacity available to the infrastructure controller (which Network Rail has now started to address, for example, by looking to get more deeply engaged in railway research activities). In addition, there appears to be some doubt as to contractors understanding of safety requirements and constraints associated with the design and safety assessments of safety critical components and systems. For example, it appears that before the Potters Bar derailment there was no adequate detailed guidance, based on an understanding of the safety issues associated with adjustable stretcher bar points, available either from Railtrack or from the contractors on setting up, inspecting and maintaining such safety critical components. Mapping of existing roles, responsibilities and arrangements against the process model for safety critical components, or some other similar model, at the various levels of the industry would help to ensure that no significant gaps exist. It may be that the industry is undertaking such work but is not yet in a position to review its conclusions and determine a risk informed plan of action if any gaps exist. If that is so, we encourage the industry to bring such work to an early conclusion and to share it with HMRI, the rail safety regulator We are aware that in 2001 Railtrack adopted ten strategic maintenance principles and announced in September 2002 its intention to take a greater lead in maintaining the rail network. We welcome these developments and hope that with the advent of Network Rail, they will be taken forward expeditiously and based on a risk informed analysis of the type that we recommend above. Finally, we welcome, as a considerable step forward, the progress being made by Network Rail on generating a prioritisation tool for informing maintenance management based on a better understanding of the assets right across the network. We see this as particularly important for safety critical components and systems. In doing so we commend to them the importance of basing this work on: a comprehensive understanding of the assets and their condition; the continuing need to keep it up to date; the feedback of such intelligence into an asset care programme that is informed by a clear understanding of the risks associated with particular assets The number of organisations with an interest in this area, both within the industry and outside (e.g. HSE, SRA, ORR), and the importance of an adequate asset register in ensuring safety and operability, leads to the clear 46

58 need for close co-operation by all involved. Such work would also greatly benefit from greater knowledge of the safety related requirements for each of the components/systems, given that we see cost effective operation of a reliable network going hand in hand with safety improvements through attention to design and preventative maintenance There are other safety management issues that have arisen either from our deliberations about the Potters Bar derailment, or very helpfully been raised by others in writing to us about their concerns and thoughts about improving the safety management of the railways. Such matters include the arrangements for responding to reports of defects such as rough ride reports, the complexity of the standards system and its lack of clarity in instructing front-line operatives; and the use of contractors. We have taken them into our considerations and ensured that they have been brought to the attention of HMRI who have been taking them forward as part of a continuing follow-up to the assessment of the Railtrack Safety Case. The rail industry s safety culture 5.51 As indicated above we have had the opportunity to take a snapshot of the safety culture exhibited by the infrastructure controller since the derailment. Safety culture is fundamental to ensuring the safety of industrial systems. A good safety culture is one in which the individuals in an organisation recognise the priority of safety issues and in which such recognition is shown in their attitudes, sense of responsibility and behaviour We are aware that in 1999/2000 Railtrack commissioned an independent assessment of Safety Management in the Railway Group to encompass safety culture, and since that report work has been on-going to take the work forward. HMRI have been in a positive dialogue with the rail industry on this topic. Over recent months we have observed some further signs of change, namely: from a backward and inward-looking approach, to a more forwardlooking approach that is not afraid to take account of how things are done elsewhere; looking more towards learning from experience and seeking improvements; away from a fixed attitude based on historic railway engineering practices and maintenance philosophy; towards a more proactive approach to safety related problems using fundamental safety principles The challenge for those with an influence on the safety of the rail industry, particularly the leaders of Network Rail, is to use the opportunities that occur, such as the move to Network Rail, to make significant steps forward in promoting a living and vibrant safety culture. It is also incumbent 47

59 on those who regulate or, in some other way, have significant influence on the rail industry, to examine ways in which they can assist in speeding up this process of what will be continuous change and avoid putting requirements on the industry that pull it away from this path or reverse progress. Of considerable importance in respect of this latter consideration are such matters as inspection and enforcement policies, and the use of performance targets and contractual penalties. We are particularly concerned to ensure that legal considerations of what might be used either in prosecuting or defending any legal action about an event does not stop duty holders or others maximising the learning from that event and implementing safety improvements. Such a partnership approach to developing the safety culture of the industry would ensure that changes to the design and maintenance approach to safety critical components are equally beneficial to the reliability, operability and safety of the network. HSE s approach to regulating railway safety and the regulatory system 5.54 One of our terms of reference required us to examine HSE s role in regulating railway safety prior to the incident, in the context of the existing regulatory framework, and in its role to secure compliance with the law by the rail infrastructure controller and other duty holders (e.g. contractors to the infrastructure controller). We have fulfilled this part of our remit largely by overseeing an inquiry into the prior role of HSE by senior inspectors from other parts of HSE not associated with railway safety regulation. Our supervision of this inquiry included reviewing the approach it took to getting at the facts, considering regular, full reports on its progress and reviewing the emerging findings. It has been most useful to this process to have on the Board a mixture of members independent of HSE and senior managers in HSE who are inspectors in disciplines other than rail A full prior role inquiry cannot be finally concluded until all the work of the HSE investigation has been completed because some aspects relating to HSE s regulation of the industry may not emerge until there has been a full investigation of Railtrack and Jarvis rail maintenance and inspection systems. However, the Board is satisfied that the work of the prior role inquiry so far reflects a sound understanding of the main issues associated with the derailment such that the Board can make a range of observations with confidence We make the general observation first that the approach of HSE to looking for areas of self-improvement in response to major incidents is to be commended. It is right that a public authority like HSE, in which the public invests its trust and confidence, should do this. Moreover, the prior role inquiry needs to be viewed against wider objectives to stimulate a live, vibrant safety culture in the railway industry, and finally, as part and parcel of good management: reviewing activities and offering feedback about ways to improve. 48

60 5.57 We see merit in HSE using its own inspectors to examine its role. Using HSE s inspectors means those undertaking the prior role inquiry have an understanding of the duties of inspectors, the approach to inspection, assessment of safety cases, enforcement, the discretion available to inspectors, and regulations under the general requirements of HSWA. Furthermore, we hope that the constitution of our Board and its oversight role, as determined by the HSC and as expressed in our terms of reference and in HSE s Major Incident Response Procedures, will provide confidence in the prior role process We have considered, with respect to the prior role inquiry, not only whether proper management systems were in place and whether HMRI inspectors followed the relevant procedures, but also whether the regulatory framework itself could be improved either by changing the regulations or improving guidance. We see this as an important adjunct given our constitution under a statutory direction from the HSC and its role in promoting guidance and advice, and on advising Ministers on health and safety law In that context and having regard to the main outcomes from the prior role inquiry, the Board s overall findings are: a comprehensive prior role inquiry has been conducted given the present position of the BTP and HSE investigations; there has been good progress in HMRI s development of an approach to regulating the railways based on Railtrack s accepted safety case, especially with regard to using the safety case to inform inspection activities, and further work in this area is in hand; from the incident history and records of complaints about the rail system there was no reason for HSE railway inspectors to pay special attention to the Potters Bar area; there was no specific prior involvement by HSE railway inspectors in regulating the Potters Bar area noting that finite resources will always lead to a sampling approach based on risk. In particular there was no involvement in approving the Potters Bar track layout or the design of points 2182A type of points; the current Railtrack Safety Case was accepted by HSE on 30 April 2002 in compliance with the extant safety case assessment, policies, procedures and instructions, recognising that this was to give a legal benchmark for Railtrack s safety management systems and hence a basis for future inspection activity to check compliance As regards the last finding we considered the benefits of the rail safety case regulatory regime and how it was best used. This led us to the conclusion that such regimes (as distinct to the widespread risk assessment approach to all work activity) are devised for, and best targeted on, catastrophic risk, especially those which might involve multiple fatalities. It recognises the prime reason why safety case regimes are applied to certain 49

61 industrial sectors and why the associated inspectorates are more heavily resourced. With these considerations in mind, we consider that greater attention should be paid in the use of safety cases and railway inspectorate resources to preventing catastrophic events such as the Potters Bar derailment. To further this aim we consider that: HMRI should review their regulatory strategy to see whether it can be more closely aligned on regulating the prevention of catastrophic events using hazard minimisation and risk assessment; HMRI should review their prioritisation and targeting of resources to see whether they can be more focused on regulating work streams associated with the precursors to catastrophic events; HMRI review their safety case assessment arrangements to see whether they can be more closely aligned with the prevention of catastrophic events; HSE should review its approach to railway standards work to see whether it can be more closely aligned to the prevention of catastrophic events In our judgement, the derailment has suggested that there may be gaps, or a lack of clarity, in the present regulatory system. These relate to the design/safety of safety critical components and systems that predate the present regulatory requirements for approval, etc that would apply if they were proposed for introduction onto the rail network today (i.e. those safety related items and systems covered by grandfather rights ). In view of this we consider that: HSE should review the existing legal requirements and guidance to ensure that those responsible for pre-rots safety critical systems and components are required to demonstrate that they are adequate and maintained in a state that is fit for purpose HSE should review the requirements and guidance to ensure that appropriate periodic reviews are undertaken of the safety of safety critical components/systems. The continuing development of European legislation may be of particular relevance in this connection and should be taken into account. 50

62 CHAPTER 6 THE DERAILMENT IN THE CONTEXT OF OTHER RECENT RAIL INCIDENTS 6.1 Our terms of reference included the requirement: to consider the incident in the context of other recent railway incidents and recommendations made following their investigation. In doing so we have taken account primarily of the Ladbroke Grove Inquiry by Lord Cullen (part 2), and HSE s investigation into the Hatfield derailment, the former inquiry having built upon a selection of other relevant accidents. Our earlier observations on safety management and safety culture aspects are part of our response to this requirement; in particular our push to obtain a review, based on hazard/risk assessment concepts, of the management systems employed to ensure safety critical components are fit-for-purpose in the present and future operating environments. In addition we see a need to look at whether there are ways to better focus the railway safety case system and HSE s regulation of the rail industry on the prevention of catastrophic accidents. These, we believe, add to recommendations by previous inquiries and investigations. 6.2 We have reviewed our findings and recommendations made in the course of our work against those of Lord Cullen and those interim recommendations to flow from HSE s investigation into the Hatfield derailment. We note that HSC is due to publish a progress report on the Cullen recommendations this summer. Its report on progress as of July 2002 is available at We reinforce and add to the following key recommendations, although we acknowledge that some are not subject to further progress reports by HSC in relation to the specific investigation to which they refer. Ladbroke Grove Cullen Recommendation 4. Steps should be put in place to ensure that contractors and sub-contractors are selected by a process which gives due regard to their state of training. They should be given appropriate time further to develop their training and planning as necessary before embarking on work. We would reinforce this recommendation and add that arrangements should be in place to ensure that during the contractor selection process adequate assurances are established to ensure that the proposed contractor/sub contractor has a safety culture and safety management arrangements that are compatible with those of the network controller and with those required for safety critical work. It should also be ensured that they have the necessary competencies and technical capabilities to back up such work and operate an operational feedback system commensurate with the safety implications of their activities. 51

63 Cullen Recommendation 8. The taking by Railtrack of a direct and active role in the close day-to-day management of safety-critical work is endorsed. We would take this further for safety related work on safety critical components and systems in recommending that the infrastructure controller should exercise an independent quality assurance role of work on safety critical components and system. This is over and above that exercised by the contactor or subcontractor and the infrastructure controller should have a capability to independently assure the outcome of such work. Cullen Recommendations 12 to 14. Safety Leadership within individual companies. We make the general observation that leaders in the rail industry (and in the regulators of the industry) have a responsibility to engender a live and vibrant safety culture within their organisations, and within the wider rail industry, by their actions and deeds. Cullen Recommendations 16, 18, 19, 20 and 22. Risk Assessment and Safety Cases We endorse the greater use of risk assessment and safety cases to target effort proportionately. To that end we encourage a greater understanding of design and safety analysis of safety critical components and systems as a basis for identifying reasonably practicable improvements and for setting appropriate operating constraints, inspection/testing/maintenance/ etc requirements. We note that HSE has produced guidance on ALARP and the use of good practice ( (and 2).htm). We have earlier made remarks about the need for periodic review of safety critical components and the need to cover safety critical components with grandfather rights within the system. Cullen Recommendation 24. Suppliers of products or services of a safety-critical kind for use on, or in regard to, the railways in Great Britain should be required to hold an accreditation as a condition of being able to engage in that activity. But the features of such a system require further study. We note that the HSE investigation in pursuing some lines of inquiry has identified that some components for adjustable stretcher were being supplied out of specification when compared to the drawings. This implies breakdowns in supply chain management and change control. We therefore encourage a tighter approach, involving the network controller, to these matters for items related to safety critical components/systems. Hatfield Interim recommendations Hatfield Recommendation 1.1 Health and Safety Management: All employees with responsibilities for any aspect of track 52

64 maintenance should obtain the necessary levels of both technical and managerial competence Hatfield Recommendation 1.3 The performance of infrastructure maintenance contractors, and other track-related contractors, must be managed to ensure their activities achieve the required standard of track quality and integrity,... Hatfield Recommendation 2.1 Railtrack should make a clear statement of the importance of track maintenance and implement an effective maintenance programme to ensure that the probability of a safety critical rail fracture is as low as is reasonably practicable. This... From our review of the HSE investigation into the Potters Bar derailment, and in line with our earlier comments, we would widen those recommendations to embrace all safety critical components to the extent that is reasonably practicable. We particularly note the following general recommendations from the Hatfield investigation: 1.2 Quicker and more responsive mechanisms should be established by which employees can bring safety critical matters to the attention of senior managers. 2.2 IMCs and TRCs should ensure that any contractor engaged in safety critical work on the railway infrastructure should: review their arrangements for ensuring that safety critical work is performed to meet the standards established by Railtrack and Railway Safety; ensure adequate arrangements are in place for; - reporting and recording safety critical information eg defects and - reviewing and acting appropriately on such information (eg seeking possessions, imposing speed restrictions, liaising with Railtrack) improve systems to ensure that communications from Railtrack relating to safety critical information (eg alterations to standards are acted upon and procedures are amended accordingly) 6.1 The HSE, Rail Regulator and the SRA should continue to review the regulatory regime to eliminate any potential conflict of priorities between meeting service delivery targets and the development of the safety culture cited in Lord Cullen s recommendations. 7.1 Train sets should designed, built and maintained to maximise the chance of their remaining upright and intact during high speed derailment. Particular aspects of rolling stock design, which should be reviewed, are: 53

65 bogie and suspension component retention. attachment systems should be considered; Strengthening of Tightlock couplers; their propensity to open when rotate should be assessed and the design loads reviewed. In addition, Tightlock couplers from vehicles involved in accidents should not be reused unless their integrity can be assured; strength of vehicle roofs and walls; passenger seats; the risks to passengers as a consequence of seat damage or failure should be reassessed; design of catering facilities should be reviewed to minimise the risk to staff in the event of an accident. 7.2 The design of the overhead line equipment stanchions should be reviewed with a view to making them less likely to penetrate passenger space in the event of a collision. In addition, the risk associated with trains striking any trackside equipment in a derailment should be assessed. 8.3 The new railway safety body should take responsibility for horizon scanning to ensure that it is aware of developments in best practice worldwide as regards the management of safety on the railways. 8.4 Education of engineers should deliver professionals who understand their professional responsibilities for the safety of the public, including the need to act on safety critical defects, and who can apply the principles of risk management. 9 We note that Lord Cullen, in his report of the enquiry into the Ladbroke Grove train crash, made a number of recommendations on emergency arrangements, which we endorse. 10 We note and fully support Lord Cullen s recommendations as regards the need for improved health and safety culture in the railway industry. 54

66 CHAPTER 7 THE BOARD S RECOMMENDATIONS 7.1 We have carefully weighed all the facts and other material placed before us over the last year, taking into account the recommendations of our July 2002 progress report; and the strides that Network Rail has made since it took over control of the rail infrastructure; and the changes that HMRI has made especially since the adoption of a safety case regime. From the outset of our work, we have kept at the forefront of our minds the need for our work to make a positive difference to rail safety, having regard to risk and proportionality. Against this background, we have identified further lessons that we believe, if appropriately addressed and implemented taking account of all relevant factors, would make that difference. Accordingly, we make the following recommendations: The rail industry s safety culture 1. Leaders in the rail industry should seek out, and make the fullest use of all opportunities, such as the move to Network Rail, to make significant strides forward in stimulating a living and vibrant safety culture within the rail industry. In particular, they should promote a questioning attitude in a no blame environment, and they should adopt the latest approaches to improving behavioural safety. 2. The organisations that influence the rail industry should get together with the industry to examine ways in which they can help speed up this process and identify any barriers to progress, which they should seek to minimise. Such barriers might include placing requirements on the industry that divert it away from this path or reverse progress (areas to be covered should include inspection and enforcement policies, the relationship between safety improvements and the possibility of legal proceedings, performance targets and contractual penalties). This partnership approach to enhancing safety culture in the industry should lead to a better understanding of the complementary benefits to business and safety. Those who regulate the rail industry should ask the new Rail Safety and Standards Board (RSSB) to consider taking a leading role in this work. Management systems for safety 3. Network Rail, together with the IMCs and TOCs, should review the management systems for responding to reports of defects, and the competences of those involved, ensuring that the response is fully proportionate to the safety implications of the reported defect. This requires that the personnel operating the system clearly understand the safety significance of their actions, or inaction, and adopt a questioning attitude in line with a living and vibrant culture of safety. 55

67 4. Network Rail should undertake a management review, by mapping existing roles, responsibilities and arrangements against a management model for ensuring that safety critical components and systems are fit-for-purpose, to ensure that no significant gaps exist that may compromise safety. This may reveal opportunities for improving business as well as safety. 5. Network Rail should continue to develop the use of a risk-based approach to the procurement, installation, inspection, maintenance, etc of railway points, based on an understanding of the design and safety functional requirements, to the mutual benefit of operating the rail network more reliably and more safely. General design and engineering aspects 6. Using basic safety principles, Network Rail should adopt a risk-based approach in deciding upon the need for, and siting of, turnouts and other related track layout aspects during new and renewal work. 7. Network Rail should consider what reasonably practicable improvements, similar to those applied at Potters Bar, can be made to bridges with gaps like those over Darkes Lane. 8. During the design of track infrastructure, consideration should be given to reasonably practicable measures for minimising the consequences of train derailments, such as the better securing of cheese weights. 9. Particular attention should be paid in the control and assurance measures applied to the design, construction and modification of coaches to ensuring that proportionate measures are taken to securing properly items that if they became detached in an incident would present a significant hazard to passengers and railway workers. 10. Network Rail and HMRI should formally reach agreement on the application of good engineering practice to safety critical components and systems on the rail network, in particular by promoting a risk informed preventative maintenance strategy rather than a reactive approach. This should be mutually beneficial to minimising the downtime of the network, as well as improving safety 11. HSE s Health and Safety Laboratory should complete the work in hand on vibrations affecting points, review it in light of any relevant information generated by the rail industry, and publish the results to provide a firmer basis for ensuring the safety performance of points. Points of the 2182A design 12. Network Rail should review the Good Practice Guide: The Set up and Maintenance of Adjustable Stretcher Bars and SIN 080 issue 2 in the light of the on-going in-depth design and safety review of points, and 56

68 introduce any appropriate changes and implement them. This review should take account of the results of the technical investigation reported here. 13. Using principles of risk and proportionality based on a reasonably practicable approach (eg initially when replacing or adjusting nuts or insulating bushes on adjustable stretcher bars), Network Rail should introduce across the network the short term improvements to the existing design of these type of points (such as the use of improved locking nut arrangements) as soon as is reasonably practicable. Once it has done so, the need for the extra surveillance that Network Rail and HMRI applied to those type of points after Potters Bar should be reviewed. 14. Network Rail, in conjunction with the IMCs, should review the roles and responsibilities of permanent way and signalling personnel to ensure that those roles and responsibilities are clearly defined, comprehensive and appropriate to the setting up, inspection and maintenance necessary to ensure safety in the functioning of safety critical components. A key objective should be the elimination of confusion and unnecessary duplication in those roles and responsibilities. Selection and control of contractors 15. Network Rail should provide suitable assurance to HMRI that the contractual selection arrangements for safety related work adequately ensure that the incentives, control, monitoring and assurance measures are fully aligned to the delivery of fit-for-purpose safety critical components/systems throughout their operational life. Investigation arrangements 16. Taking account of the legal basis and protocols, the arrangements setting out the relationships between the RAIB and other investigators should be carefully prepared given the different focus of the various investigating bodies. This includes, in particular, the use of witness statements, gathering of evidence and access to technical investigations. This is necessary if the intentions behind the creation of the RAIB are to be realised. This work should take account of the outcomes of the wider work being done in Government on ways of mitigating delays in inquiries and overlapping proceedings. Regulation of railway health and safety 17. HMRI should review its regulatory strategy to see whether it can be more closely aligned to regulating for the prevention of catastrophic events using hazard minimisation and risk assessment principles. 57

69 18. HMRI should review the priority and targeting of its resources to see whether they can be more closely focused on regulating work streams associated with precursors of catastrophic events. 19. HMRI should review its safety case assessment arrangements to see whether they can be more closely aligned with the prevention of catastrophic events. 20. HSE should review its approach to railway standards work to see whether it can more closely aligned to the prevention of catastrophic events. 21. HMRI should obtain, as part of its on-going work on improving safety management systems in the rail industry, confirmation that there are no significant gaps in the rail industry s management arrangements for ensuring that safety critical components or systems are fit for purpose or that reasonable practicable improvements are appropriate. 22. HSE should review existing legal requirements and guidance, and that being developed such as that on European interoperability requirements, to ensure that duty holders are clear about the need for pre-rots safety critical components/systems to be demonstrably ALARP and maintained in a state that is fit-for-purpose. HSE should also ensure that there exists a clear requirement for duty holders to undertake appropriate design/safety reviews; for example, periodic; in response and proportionate to incidents; and before significant safety related changes, etc. General recommendations 7.2 We also: 23. fully echo the recommendations of Lord Cullen, in relation to his Ladbroke Grove public inquiry, and the interim recommendations from HSE s investigation into the Hatfield derailment, and reinforce them with additional recommended actions, identified in Chapter 6 of our report; 24. encourage the rail industry to complete its work in relation to our July 2002 recommendations as soon as reasonably practicable in order to further rail safety; 25. recommend that HMRI should agree with Network Rail, and others affected, a strategy, including a valid timetable, for addressing the recommendations made in this report and publish that strategy; and 26. recommend that HSE periodically reviews progress in the implementation of the recommendations from our July 2002 Progress Report and those of this report, and publish its observations. 58

70 EXPLANATORY NOTES 1 The HSE Investigation Board has no responsibility for overseeing the BTP investigation. 2 Throughout this report the term coach is used to aid the general reader whereas parlance in the rail industry is vehicle which may confuse others. 3 Down lines convey trains away from London. 4 The bogie is the framework that supports the carriage, connecting the carriage with the wheels. 5 The Work-Related Deaths Protocol was introduced in The Health and Safety Executive, the Police and the Crown Prosecution Service agreed it. At present only the police can investigate serious criminal offences (other than health and safety offences) such as manslaughter, and only the CPS can decide whether such a case can proceed. The police will also have an interest in establishing the circumstances surrounding a work-related death in order to assist the coroner s inquest. The full text of the Protocol can be found at 6 The Rail Safety and Standards Board (RSSB) was established on 1 April 2003 implementing one of the core sets of recommendations from the second part of Lord Cullen's public inquiry into the Ladbroke Grove train accident. Further information can be found at 7 The industry s Formal Inquiry Panel is made up of three independent specialists and an independent Chair, convened in accordance with Railway Group Standard GO/RT HSE s Major Incident Investigation Policy and Procedures set out HSE s quality management arrangements for responding to and investigating major accidents. The full text of the document can be found at 9 Fines - 'dust' in railway ballast. 10 Cheese weights are flat round 40 kilo weights with a slot cut in them. They are used to tension the overhead lines. 11 Omnicom is a visual track inspection system that is installed on a specialised train to video the track, accurately record positions, lengths and details of the track at 25 frames per second. 12 Red zone working is a site of work on or near the line that is not protected from train movements. 59

71 13 Rolling contact fatigue is the development of small fractures in the rail due to wear. 14 Good engineering practice is ensuring the equipment is maintained to the original design specification, or within tolerances specified by the design. Examples include: 1) different components (eg nuts) are not used unless the change has been risk assessed by a competent engineer, authorized and the change documented; 2) single use components (eg proprietary lock nuts) are not reused; 3) all components are installed or re-fitted after maintenance in accordance with the design specification; 4) worn or damaged components are replaced. Historically, in other industries with safety critical equipment, good engineering practice is ensured by clearly separating the maintenance and inspection processes, and documenting faults found during both, to enable the effectiveness of the overall design, and the maintenance and inspection processes, to be reviewed and modified if necessary. 60

72 ANNEX A SUBMISSIONS AND OTHER INFORMATION RECEIVED BY THE INVESTIGATION Category Description of Information From Track Condition Reports on the state of the track in various areas across the rail network. Article on technology developed to alert railway staff if a rail moves out of position. Members of the public Member of the public Points & Stretcher Bars Views on: the fracture of the lock stretcher bar; possible causes of the accident in relation to points; points and signalling systems; information on duplex railway points; track layout at Potters Bar; and, adjustable stretcher bars. Members of the public Manufacturer Bolts and Nuts Views on: Suggested methods to prevent nuts coming loose; Use of lock nut and anti-vibration nuts Use of split pin to prevent nuts coming loose Theory that mismatch between threads of bolts and nuts caused the derailment Information on specification for nuts New nuts that do not work loose with vibration Missing Bolts on another part of the rail network Technical Information on Hardlock Nuts Best Practice for Locking nuts Members of the Public Manufacturer

73 Maintenance Computer system for recording and and use of storing of information. Contractors Views on management of contractors Rough Rides Personal experiences of rough rides in the Potters Bar area prior to 10 May 2002 Manufacturer Railfuture Members of the public Sabotage Suggestions that sabotage caused the derailment Thinking behind why the train derailed Tools Suggestion that use of incorrect tools contributed to the derailment Correspondence Calls for Public Inquiry from Members Judicial Review of Parliament The Use of Adjustable Shift key Spanners on the railway Concerns about negligence Potters Bar Bridge Design, Design Authority for Points and Specifications. Type of nuts used on relevant bolts securing the stretcher bars. Specification of nuts used on rail tracks in the light of the Potters Bar derailment Concern about speed of trains travelling through Potters Bar Suggestions for better safer railways Questions about sabotage, the volume of railway traffic that used points 2182A and when the last inspection took place Members of the public Jarvis Members of the public Members of Parliament

74 Parliamentary Questions Progress with the investigation. Reinstatement of points at Potters Bar Implementation of safety recommendations following railway accidents. Passenger services on Cambridge London line following the accident. Adjournment Debate 15 November 2002 Potters Bar rail accident. Steps taken in respect of nuts on adjustable stretcher bars. Date of next HSE progress report What contracts awarded to provide technical support to the HSE investigation What progress has been made in addressing findings and recommendations of 2 nd interim report. Request for correspondence with bereaved families and injured people to be placed in House of Commons Library Request for evidence of criminal negligence Members of Parliament International Liaison National Transportation Safety Board Railroad Accident Report. The time to conduct the investigation and calls for a public inquiry. NTSB, USA Taiwan Government

75 ANNEX B HSC Press Release C022:02-17 May 2002 HSC requests HSE investigation of Potters Bar derailment Following its meeting this week, The Health and Safety Commission (HSC) has formally asked the Health and Safety Executive (HSE) to investigate last week's train derailment at Potters Bar and to make a special report to HSC as soon as possible. HSE's terms of reference with regard to this incident are to: ensure the thorough investigation of the derailment and thereby establish its causation, including root causes; identify, and transmit without delay to duty holders and other appropriate recipients, any information requiring immediate attention to further rail safety; examine HSE's role in regulating railway safety prior to the incident, in the context of the existing regulatory framework, and in securing compliance with legal requirements by the infrastructure controller and other duty holders; consider the incident in the context of other recent railway incidents and recommendations made following their investigation; and make recommendations for future action. The investigation will be carried out under the supervision of a Board operating in accordance with HSE's Major Incident Investigation Policy and Procedures. The Commission requested that, in line with current HSE practice, two members of this Board are independent of HSE and these have been selected in consultation with the HSC Chair, Bill Callaghan. The Board will comprise: Dr. Mike Weightman, HSE (Chair); Mr. Stewart Campbell, HSE; Mr. Mike Roberts, formerly Group Technical Director, BAA plc; and Prof. Ernest Shannon CBE, formerly Director of Engineering Research, British Gas. The Commission will publish the findings of the special report, pursuant to section 14(5) of the Health and Safety at Work etc. Act The Commission has also requested that any information transmitted pursuant to the second indent of the terms of reference above should be made publicly available. Notes to Editors 1. HSC is an independent body of ten people, appointed by the Secretary of State for Local Government, Transport and the Regions, after consultation with organisations representing employers, employees, local authorities and others. HSC's primary function is to make arrangements to secure the health

76 and safety of workers and the public in the way work activities are conducted; including proposing new law and standards, conducting research and providing information and advice. 2. The Health and Safety Executive is a body of three people appointed by HSC with the Secretary of State's approval. The Executive advises and assists HSC and has specific statutory responsibilities of its own, notably for enforcing health and safety law. The Executive's staff of around 4,000 (inspectors, policy advisors, technologists, scientific and medical experts etc.) - is collectively known as HSE. 3. The Commission has exercised a power under Section 14(2)(a) of the Health and Safety at Work etc. Act 1974, under which it: "may at any time direct the Executive... to investigate and make a special report on any matter." 4. HSE's Major Incident Investigation Policy and Procedures can be accessed at 5. Biographies of the Board members are attached. Biographies Dr Mike Weightman, 53, is a Deputy Chief Inspector of Nuclear Installations and Head of Division 2 of HSE's Nuclear Safety Directorate. For the last two years, he has been responsible for regulating all BNFL's nuclear licensed sites, including Sellafield, and Britain's fleet of Magnox power stations. In this role he has been ensuring that BNFL responds effectively to the recommendations contained in HSE's report on an investigation of control and supervision at Sellafield, published in February This includes matters such as safety management systems and practices, control and supervision, and safety culture. He has previously been responsible for leading projects regulating structural and organisational change in the nuclear industry, and the inspection and safety assessment of a wide range of nuclear facilities. Dr Weightman is a Chartered Engineer and Chartered Physicist. He is married with two children. Stewart Campbell, 53, is currently HSE Director, Scotland. He has been an HSE inspector for over 25 years and has worked in Aberdeen, London, Bootle and Kent, where he was HSE's Principal Inspector during the construction of the Channel Tunnel. He returned to Scotland in 1993 as Area Director in Glasgow and latterly has been head of the Field Operations Directorate's Health Unit in Edinburgh. In the 1980s, he was awarded a Nuffield and Leverhulme Travelling Fellowship to study the Labour Inspectorate of the European Community, and he has maintained an interest in European approaches and comparisons. He recently led the British delegation to a series of European Union workshops on asbestos. He is married with two sons.

77 Mike Roberts, 56, joined the then British Airports Authority in 1967 after gaining a BSc in Civil Engineering at Leeds University. From 1979 to 1982 he was Deputy Chief Engineer at Gatwick Airport, responsible for civil engineering maintenance and the management of all construction projects. He then moved into general management roles, first as passenger terminal manager at Gatwick and then Operations Director and subsequently Managing Director at Heathrow Airport. In 1997, he was appointed Group Technical Director on the main board of BAA plc, with responsibilities including group construction projects. He retired from BAA in December 2001 and is currently Chairman of West London Business; Chairman of the Confederation of Construction Clients and a Fellow of the Institution of Civil Engineers. Prof. Ernest Shannon CBE, 64, spent several years in aircraft design and manufacture followed by a period in university research before joining British Gas as a specialist in metal fracture. There he worked on the development of pipeline maintenance standards and led the team developing a new form of pipeline inspection vehicle, for which he received a number of awards. Following successful exploitation of this inspection technology worldwide, Professor Shannon became Director of Engineering Research at British Gas and then Group Director of Development. He retired from British Gas in Professor Shannon is Chairman of the CEN Pressure Equipment Standards Harmonization Committee TC54; Chairman of a Nanotechnology Advisory Group; a Board member of UCF (NI) Ltd and a Board member of the European Prize Foundation Charitable Trust. He is also an independent member of HSE's Hatfield derailment Investigation Board. PUBLIC ENQUIRIES: Call HSE's InfoLine, tel: or write to: HSE Information Services, Caerphilly Park, Caerphilly CF83 3GG. Published on the HSE web site on 17 May 2002

78 Figure 1 Photograph of the area around Potters Bar Station after the derailment

79 Figure 2 Photograph of the fourth coach wedged under the station canopies (Courtesy of Hertfordshire Police)

80 Figure 3 Photographs of the damage to Darkes Lane bridge and vehicles underneath

81 Figure 4 Schematic diagram illustrating the main components of a set of points

82 Figure 5 Fractured lock stretcher bar Figure 6 First (front) adjustable stretcher bar looking from the rear (the disengaged end appears on the right hand side in this view)

83 Figure 7 First (front) adjustable stretcher bar left hand side Figure 8 First (front) adjustable stretcher bar right hand side

84 Figure 9 Second (rear) adjustable stretcher bar right hand side Figure 10 Second (rear) adjustable stretcher bar left hand side

85 front Figure 11 Close-up view of the backdrive connecting rod and stretcher bar end on the right hand side of the front stretcher bar front truncated thread damaged thread Figure 12 Close-up view of the left hand end of the front stretcher bar

86 rear compacted grease Figure 13 Close-up view of the thread at the right hand end of the rear stretcher bar rear rusted threads Figure 14 Close-up view of the thread inboard of the right hand end of the rear stretcher bar

87 rear outer main nut Figure 15 Close-up view of the damaged outer main nut from the right hand end of the rear stretcher bar.