Formal Investigation Report into the Service Disruption on the Northern Line - 7th October 2008

Reference Number: 07-2008-09-060 LU incident No: 18011119

Report Status Final: 16th February 2009.

CONTENTS 1.0 Executive Summary Page 3 2.0 Terms of Reference Page 4 3.0 Methodology Page 5 4.0 The Incident Page 5 5.0 Immediate actions in response to the incident Page 16 6.0 Background to the incident Page 17 7.0 Discussion Page 21 8.0 Review of previous events Page 25 9.0 Conclusions Page 26 10.0 Immediate, underlying / contributory and root causes Page 28 11.0 Recommendations Page 30 12.0 Observations supporting identified existing actions Page 32 Appendix One: Timeline of incident Page 33

Page 2 of 40 1.0 Executive Summary 1.1 Following the derailment of a 1995 Northern Line Tube Stock train (T161) between station and the depot on 7th October 2008 at 00:28, serious disruption to train services was experienced on the line. 1.2 Other trains were prevented from entering Morden Station and subsequently caused 17 trains to become held in platforms on the southbound road. Two further trains (T033 & T016) had stalled in the section between South Wimbledon and Signal Y2 approaching Morden Station. All passengers were detrained by 01:17. 1.3 Trains started to enter at 02:25 with the last train entering at 05:00. 1.4 The first train (T42) departed Morden Depot for service on the northbound road at 06:32 and the last northbound train entered service at approximately 09:28. In all, 24 trains were brought into service with 12 trains being cancelled. Service trains were then terminated and turned at Broadway with subsequent disruption to the morning peak service. 1.5 The incident train was re-railed by 09:58. Delays were then experienced in moving the train into the depot, which was finally completed by 12:21 with full running resumed at 12:41. 1.6 Due to the serious nature of this incident and the resulting consequences a Formal Investigation was commissioned. 1.7 The immediate causes of the incident were: • Delays bringing trains in and out of Morden Depot; • Delays in moving re-railed train. 1.8 Underlying causes include: • Delays in clearing routes to enable entry/egress to depot; • Train T161 de-railed on 19 points; • Train Operator moved in wrong direction back across spring worked toggle points (trailing) without authority; • Failure to report train defects to Service Control; • Lack of recovery plans for trains stalled between station and depot; • Loss of traction shoes causing defective Traction Package on car 3; • Numerous gaps in traction current rails over the points and crossings; • Number 18a points blown over and secured (locked out of correspondence); • Traction current kept on until all trains stabled. 1.9 The Root Cause was Lack of Management Control. 1.10 Recommendations are made to address the identified causes and include: • Review of the role and understanding of Silver Control and associated training; • Creation of recovery plans for stalled and derailed trains at key locations; • Identification of all required boundaries between the operational railway and the depots.

Page 3 of 40 2.0 Terms of Reference A Joint Formal investigation being led by is required to investigate the derailment of Train 161 at Morden Depot on the 6th October 2008 and the subsequent management of the incident. Trevor Bellis has been appointed as Formal Investigation Leader. The other members of the Investigation Team to support the Investigation are:-

Peter Wickham LU HSQE Trained Investigator Rob McNeill-Wilson LU Line Engineering Manager Syd Ward TLL Safety Performance Manager Darren Hillier TLL Network Response Manager Russell Gell TLL Signals and Control Asset Engineer Andy McGlauchlan Alstom Production Manager Dave Thomas LU Train Operations Manager Mick Fraser LU TU RMT Representative Kevin Chown LU TU ASLEF Representative Tony Alfred TLL H&S Representative

The Remit for the Formal Investigation is to: • Investigate events leading up to Train 161 becoming derailed and to identify the root cause of the derailment • Investigate the subsequent management of the incident response, with particular reference to the length of time taken to re-rail and move Train 161 into Morden Depot and to restore through running and whether the optimal measures were put in place to minimise the consequential disruption to the Northern line’s Train Service • Make recommendations to prevent similar incidents in the future and minimise the impacts of any future, similar events • In developing conclusions and recommendations, review previous relevant incidents and investigations, in particular to give consideration to the recommendations contained in and actions arising from the Local Investigation Report into the incident involving a defective train at Morden on 30 July 2008

An interim report setting out the facts of the incident, its consequences and any immediate recommendations is required by 12:00 hours Friday 24th October 2008

Commissioned by: Jeff Ellis - Northern Line General Manager, Underground. Diarmaid O’Tuathail – Director of Health Safety and Environment, Tube Lines.

Page 4 of 40 3.0 Methodology As part of the TLL / LU Investigation the information for this report has been obtained using the following methods. • All relevant staff involved in the incident have been interviewed • All reports relating to the incident have been reviewed • Recordings of all radio communications have been obtained and reviewed by the investigation panel • The train downloads have been reviewed by the investigation panel • All evidence has been reviewed at a series of investigation panel meetings

4.0 The Incident Date of Incident: 07/10/2008 Time of Incident: 00:28 through 12:41 Location of Incident: Northern Line The full time line is shown in Appendix One

Train Derailment Note: Car number (e.g. Car One) is taken from the normal direction of travel in service i.e. southbound. 4.1 On the 6th October at 16:10 Train Operator (T/Op) of the incident train T161 booked on to start his rostered duty (714) which was due to finish at 00:40. The T/Op went about his duties as normal with no unusual circumstances to report. At 22:41 he picked up Train T161 at , travelled to then reversed, departing southbound at 23:06 4.2 At 00:08 on the 7th October at , the train developed a traction pack fault which caused the TMS to go into alarm mode. The TMS message read ‘Traction Supply Lost – Car 3’. The ‘Help Text’ which the T/Op accessed stated ‘Inform C/C. No motors - Car 3. Check train not gapped, if fault persists change over when convenient.’ (This requires the T/Op to report the fault to the Service Controller) The T/Op acknowledged the alarm and cleared the message, before continuing in service. The fault was not reported to the Service Controller (SC) as the train is going into the depot and there appears to be no loss of power. In consequence as part of normal operations the train is routed into platform 5 at Morden in preparation for being taken out of service into the depot. 4.3 When the Train reached Morden platform 5, the T/Op completes his platform duties and returned to the leading cab ready to stable the train. 4.4 Signal Y8 is cleared and the train departs from platform 5 across 16 points then across number 17/18 crossover and number 19 points towards the shunters stop board on 44 road. The train reached a speed of 15.79 kph when the train operator shuts off as the speed limit for this area is 16 kph. The T/Op attempted to re-motor after a few seconds, but the train did not

Page 5 of 40 accelerate and continued to slow down until it stops with the cab on the leading car between the location of Signal Y28 (depot outlet signal) and number 7b points (see figure 1 and photograph one). 4.5 The T/Op made repeated attempts to motor and the train moves forward slightly on 4 occasions, but reaches no more than 1kph. During this time he operated the GOB (Gap Override Button) on 5 occasions. 4.6 On noticing that the train has stopped short of the entrance to the depot, the Alstom Cabin Shunter (CS1) contacted the T/Op to establish what the problem was and a second Alstom Cabin Shunter (CS2) joined the train to offer assistance. CS2 made several attempts to restore power to the train moving to car 3 in the process and when this did not work, suggested that the T/Op should roll the train back a little in order to bring the pick up shoes of car 6 (51680) over the traction current rails on 18 crossovers. The T/Op was not content with rolling the train back from the front cab, but decided to change ends and make a wrong direction move in order to get car 6 (51680) back on to traction current. At the same time the SC noticed from the signal diagram in the control room that the train had stopped on the crossover and started to issue instructions to hold trains in platforms in anticipation of a delay. SC was unable to contact the train and contacts CS1 to determine what is happening. 4.7 The T/Op shut down leading cab, car 1 (southbound 51679) and opened up the rear cab, car 6 (northbound 51680) The T/Op allowed the train to roll northbound (wrong direction move) back towards No 18 crossover, reaching a speed of 3.44kph travelling approximately 17 metres (approx 1 car length). The train started to judder and came to a stop and the T/Op dropped the dead-man. Both C&D axles of car 5 (52680) came off the rails across number 19 points and car 4 (53680) A&B axles travelled wrong road, but did not derail. This prevented any other trains from entering Morden Station and subsequently caused 19 trains to become stalled on the southbound road as far back as Charing Cross. 17 were held in platforms but two (T033 & T016) had become stalled in the tunnel section between South Wimbledon and Signal Y2 approaching Morden Station 4.8 The SC in the Control Room at Coburg Street sent the Morden DMT1 (Duty Manager Trains) to the depot to ascertain what the problem was with T161, as the board indications showed the rear of the train was still over 18 points, thereby preventing any other trains entering Morden Station

Page 6 of 40 Page 7 of 40 Page 8 of 40 Page 9 of 40 4.9 DMT1 made his way from Morden Platform to the incident train. He established what had happened and contacted the SC at Coburg Street to inform that T161 had derailed over 19 points, on 44 reception road. The SC immediately informed all trains that they were to remain in stations where possible. Formal Incident Management was implemented, with DMT1 appointed as Silver Control and an additional DMT(2) was sent from East to assist. Arrangements were put in place to get passengers off the stalled trains and bring the trains into Morden Depot. (see section 4.18 onwards) The ERU (Emergency Response Unit) were also called to assist with the derailed train. 4.10 ERU Team arrived at Morden Depot at 01:35 where they liaised with LU Silver Control and the Alstom Duty Depot Manager (DDM). The initial ERU assessment concluded that traction current would need to be discharged to allow transportation of necessary equipment from the depot car park to incident site before work could commence. They estimated it would take around four hours to re-rail the train once they are able to start work. LU Service Manager (SM) decided that all remaining trains (19) should be stabled before arranging for Traction Current discharge. ERU started preparing all necessary equipment in readiness for transportation to the incident site but because the Traction Current was still on, were unable to do so.

Page 10 of 40 4.11 The Alstom DDM tried to drive the front 4 cars forward by a few inches: this was at the request of the ERU to relieve the pressure off the 4th (52680) and 5th (53680) cars. When this failed, Alstom & ERU decided to uncouple the leading 3 car unit from the rear unit. This allowed the leading unit to be moved approx 1.5 m releasing the pressure from the derailed units and allowed the ERU access to assess for further damage. Alstom arranged for the Shunters to undergo a Drugs and Alcohol test which proved negative. At 03:00 train movement was halted for twenty minutes as the north side of the depot was full and the routing was changed to permit trains to be stabled in the south side. 4.12 At 05:00, 18 Trains were stabled in Morden Depot with 1 train left in platform 1 as protection for the de-railment worksite. The Traction Current was then discharged until 05:27 to let the Cable Linesman make the necessary isolations and allow ERU to bring their equipment to site before Traction Current was recharged to bring trains back out of Morden Depot to start the morning service. 4.13 ERU placed Short Circuit Devices at both the front and rear of incident train. The train was scotched, targets placed and the team started to work on re- railing the train. 4.14 Car 52680 was on plates and ready to pull at 08:15 and Car 53680 on plates and ready to pull at 08:50. (Although car 53680 did not come off the rails, it needed to be lifted and pulled onto road 44 in readiness for moving) 4.15 All wheels were back on track at 09:58, the site cleared of equipment and the re-coupling of 3 car units commenced. 4.16 The train was handed back to LU / Alstom and attempts to move the train commenced at 10:10. 4.17 ERU remained with the train until 12:25 when the train was fully stabled.

Service Disruption 4.18 At 00:21 the SC at Coburg Street spoke to the Morden CS1 and established that T161 which was shown on the signalling diagram as stopped on "the Bank" entering the depot had stalled with traction problems. This caused trains to block back with T16 stopped at Signal Y2, T33 stopped at Signal A719. 4.19 The SC sent Morden DMT1 to the depot to ascertain what the problem was with train T161. 4.20 The SC started to regulate the service and to hold as many trains in platform areas as possible. 4.21 DMT1 approached Train T161 and saw the T/Op in the rear cab (northbound 51680). He indicated to the T/Op to stay where he was and approaches the cab. 4.22 The T/Op left the cab by the M door and met DMT1 who asked him what had happened.

Page 11 of 40 The Train Operator stated that the Alstom Shunter (CS1) had asked him to roll the train back, but feeling this was not right, decided to make a wrong direction move which caused the train to de-rail over 19 points. 4.23 DMT1 contacted the SC at Coburg Street to advise him that train T161 had derailed over 19 points on 44 reception road, blocking the crossover. 18a and 17b points were unobstructed and 43 reception road was clear. 4.24 DMT1 advised the T/Op to make his way to the train crew accommodation and report to the DMT’s Office. DMT1 then spoke to the CS2 who was at 19 points (location of the derailment) with the Alstom DDM before making his way back to Morden Station. 4.25 LU Service Control Manager who was now aware of the derailed train, authorised wrong direction moves for trains T16 and T33 back to South Wimbledon to enable customers to be detrained to the platform through the trains. 4.26 Formal Incident Management was implemented by the SM and arrangements were put in place to get the remaining passengers off the trains left on the southbound road and to bring the trains into Morden Depot. The ERU were also called to deal with the derailed train via the Network Control Centre. 4.27 DMT1 is appointed as Incident Manager (Silver Control) with Night Turn DMT2 dispatched from to assist. 4.28 Train radio contact is lost with the T/Op of Train 33 who is waiting to commence a wrong direction move. 4.29 Train T16 was tasked with completing a wrong direction move, up to train T33, and establish contact with the T/Op of T33. The Traction Current was discharged between South Wimbledon and Morden to allow for the T/Op of T16 to cross over to T33 4.30 The T/Op of T33 was told by T/Op of T16 to shut down and re-open his train controls. Radio contact was re-established with T33. T/Op of T16 made his way back to his own train and Traction Current was then recharged. 4.31 T33 completed a wrong direction move into South Wimbledon, 20 customers were detrained. 4.32 T16 completed a wrong direction move into South Wimbledon, 21 customers were detrained. There were no related customer issues from either these or other trains during the service suspension. 4.33 T/Ops were told of the reasons for the delays and that arrangements were being made to get them home via special taxis if needed. 4.34 DMT3 on the desk at Morden Train Crew depot received an initial written statement from the T/Op of T161. Due to his distressed state his was allowed to go home, driving himself although a taxi was offered. In consequence no Drugs and Alcohol test was completed on the T/Op of T161. 4.35 The SM and DMT1 agreed the route to be secured and DMT1 along with Technical Officers started to secure the route from Signal Y2 through platform 3 in readiness for stabling trains. 4.36 Night Turn DMT2 arrived at Morden Depot. Advised by DMT1 (Silver Control) that a memo had been provided by the T/Op of T161 and that he had been sent home due to his emotional state. DMT2 was asked to make his way to the Incident train to monitor situation. There was no further direct contact with Silver Control.

Page 12 of 40 4.37 The LU SM informed ERU via DMT1 (Silver Control) that all remaining trains (19) would be stabled before the ERU would be allowed access to the site with the equipment necessary to re-rail the train across the access roads. 4.38 With the route secured, arrangements were made for 18 trains still out on the line to be worked into Morden Depot via Y2 signal, with one train to be stabled in Morden Platform 1/2 to provide protection to the derailment site. 4.39 First of the stalled trains (T114) was worked into Depot at 02:25. By 03:00 the north side of the depot was full and arrangements were made to secure No3/4 crossover to facilitate passage of the remaining trains into the south. DMT1 (Silver Control) confirmed that 4a/b points were now secured reversed to facilitate stabling the remaining trains on the south-side. All trains were stabled by 05:00. 4.40 The Traction Current was then discharged to allow the Cable Linesman and ERU to prepare the site ready for re-railing the train. Traction Current was then recharged to allow train movements to commence via 43 road. 4.41 The SC advised DMT3 to send T/Ops to the depot to pick up their trains, but had to cancel several trains until all arrangements are in place to start bringing the trains out. The Shunter and Signal Operator were kept informed. 4.42 DMT1 handed over Silver Control to DMT2 via the SC. 4.43 DMT2 (Silver Control) informed the SC that the route was secured ready for trains to exit the depot into platform 3/4. 4.44 Signal Operations Manager at Morden confirmed that 18 points in Morden Depot could not show a normal indication to allow home signal Y2 to be cleared, allowing a normal service to operate. Also confirmed that this situation will prevail until the train was re-railed. This has the impact of having to terminate trains at Tooting Broadway, restricting the number of trains that can be used in service. 4.45 The SM then disseminated the information that the Northern Line would be suspended Tooting Broadway to Morden southbound only with a Northbound Service provided by trains from Morden Depot. 4.46 CS3 was asked by SC to let first train into service, but was told there were no T/Ops available. The T/Ops had gone to the depot but returned to the train crew office due to lack of information regarding the required train service. 4.47 SC contacted the Morden Train Crew desk DMT3 and instructed him to make sure the T/Ops were sent back to the Depot to bring their trains into service 4.48 SC asked CS3 to allow trains into service. CS3 stated that he could not do this as he would not know when the departing trains had cleared the signal as the route lights would not function due to points being scotched and clipped out of signalling correspondence. 4.49 The SC with assistance from Alstom staff set up a Safe System of Work whereby the CS3 would be informed when the section ahead was clear by the Alstom Team Leader who was placed at Signal Y30. 4.50 At 06:50 the first northbound train (T42) entered service from Morden Depot, tripping past Y30. DMT2 (Silver Control) gave the T/Ops the authority to trip and proceed. 4.51 DMT2 made his way to Morden Train Crew Accommodation to complete the EIRF after being relieved by DMT4 (Silver Control)

Page 13 of 40 4.52 The last train entered service from Morden Depot at 09:30. One train was held in platform 3/4, to be available to assist in any potential push out. In consequence northbound service between Morden and Tooting Broadway was then suspended.

Movement of Incident Train once Re-Railed 4.53 ERU finished re-railing at 09:58 and the site was cleared of equipment and handed back to Silver Control at 10:10. 4.54 Tube Lines Fleet Systems Engineer confirmed that all positive shoes were in place. However one negative shoe was missing on each of the UNDM's, (Unit Non Driving Motor) car 3 (53679) and car 4 (53680). These were not found at the incident site and it was concluded that the shoes were missing prior to the de-railment. 4.55 Staff from Tube Lines, Alstom and LU made several attempts to move the train commencing at 10:41. However, the train did not have sufficient power (car 3, 53679 & car 6, 51680 being off power) to motor up the gradient, and started to run back over 19 points.

Incident Train Status

Car 6 Car 5 Car 4 Car 3 Car 2 Car 1 51680 52680 53680 53679 52679 51679

Off Traction On Traction Off Traction On Traction

4.56 The train in Morden platform 3 / 4 was called up to push out the incident train. It was attempted to couple the two trains but the couplers were misaligned. 4.57 The Traction Current was discharged so the coupler latch could be released on Incident train (car 6, 51680) and the coupler was swung over to align with assisting train (car 1, 51667) 4.58 The Traction Current was restored and the trains coupled together. Sustained motoring was attempted and the train started to move, powered by 3 motor cars on the assisting train (car 3, 53667 was off juice over the gaps within the crossover). Over the next 38 seconds, the 12-car train moved 26.4 metres. In consequence Traction Supply was also lost to car 4 (53666) and the train stalled as there was insufficient power to motor up the gradient.

Page 14 of 40 Assisting Train Status following Initial Move

Car 6 Car 5 Car 4 Car 3 Car 2 Car 1 51666 52666 53666 53667 52667 51667

On Traction Off Traction Off Traction On Traction

During this movement, only the assisting train was being driven. 4.59 There then followed various attempts to move the 12 car train, using both the assisting train in FORWARD and the incident train T161 in REVERSE. However, none of the attempts that followed were successful due to insufficient traction power. 4.60 It was then decided to discharge Traction Current and install the Gap Jumper Leads into assisting train car 1 (51667). The assisting train then had power to cars 51667, 53667 and 53666. However, when an attempt was made to move the train the TMS showed “loss of round train circuit (RTC)” and the brakes did not release. There were various attempts to move the unit as a 12 car train. However, due to insufficient traction power none were successful. 4.61 Following some consultation between Alstom & LU, car 51667 was shut down and a full Traction & Auxiliary trip and reset was carried out. The car was opened up again into “reverse” but the Round Train Circuit still showed as lost. After the reset, the TMS reaffirmed that the traction supply was lost on cars 53667, 53666 and 51666, with 51667 being the only powered car due to the jumper lead.

Assisting Train Status – Rail Gap Jumper Inserted

Car 6 Car 5 Car 4 Car 3 Car 2 Car 1 51666 52666 53666 53667 52667 51667

Off Traction Off Traction Off Traction On Traction

4.62 It was decided to remove the Rail Gap Jumper Lead and uncouple the assisting train, returning it back to Morden platform 3 / 4. Following the removal of the Rail Gap Jumper Lead the “Traction & Aux Supply Lost – Car 1” was reset, indicating that at least 1 pair of shoes on Car

Page 15 of 40 1, (51667) was on traction current and indicating that the use of Rail Gap Jumper Leads was unnecessary. The assisting train made its way back to Morden Station where all 4 motor cars came back on to traction current and the train went into passenger service for the remainder of the day. 4.63 It was then decided to insert the Rail Gap Jumper Leads into the incident train car 6 (51680). This was followed by several attempts to move the train. These proved unsuccessful and when checks were carried out it was established that one of the traction packages on car 53680 was locked out and the other was showing Traction Supply Lost. 4.64 Alstom then carried out full TAT & TAS from car 51679 and advised that the locked out package had come back on but cars 53680 and 51680 were still showing Traction Supply Lost. (TAT and TAS is re-booting of the train on board computers)

Incident Train Status – Rail Gap Jumper Leads Removed

Car 6 Car 5 Car 4 Car 3 Car 2 Car 1 51680 52680 53680 53679 52679 51679

Off Traction Off Traction On Traction On Traction

Motoring was attempted with the train moving forward slightly before stopping again. The Rail Gap Jumper Leads had been removed from car 51680 by this time. 4.65 It was then decided to prepare a train in an attempt to pull the incident train into the Depot 4.66 The assisting train was moved up from the depot, coupled to the incident train and successfully pulled the train into the Depot were it was stabled. 4.67 The Northern Line Signals Operations Manager commenced checking the operation of signals and track. No defects were found and through running commenced with train T065 at 12:41.

5.0 Immediate actions in response to incident 5.1 Incident Train T161 was quarantined for inspection and repair. 5.2 The Alstom Shunters were Drugs and Alcohol tested – result negative. 5.3 The Train Operator of Incident train T161 was stood down pending initial investigation. 5.4 Communication bulletins were issued by London Underground in respect of • Rule Book 6, General Train Operations (reporting of defects).

Page 16 of 40 • Post Incident Drugs & Alcohol Testing. 5.5 Joint Formal Investigation (led by Tube Lines) commissioned.

6.0 Background to the incident Train Operator 6.1 In the week commencing 21st September 2008 the Train Operator involved in the incident had completed a refresher training course (commonly known as “Block Training”). 6.2 The training course is part of the CDP (Continuous Development Programme) and replaced the ATOR (Annual Test of Rules) on the 27th May 2008. The duration of this course is 4 days and consists of 12 modules. Each delegate spends 2 days in the classroom, 1 day on stock refresher training and 1 day depot training. 6.3 Of the 12 modules, 7 deal with operational problems (SPAD, Defect Handling, Applying the Rule, Wrong Direction Moves etc) and the procedures that need to be followed when dealing with an incident. During the training the delegates undergo two written papers which establish the delegate’s knowledge and competence. It was established during interview with the training specialist that the Train Operator involved in the incident was deemed competent to continue his duties. 6.4 The procedures for dealing with incidents are also covered in New Rule Book No 6, General Train Operations, Section 2. Specifically Sections 2.13 Leaving the Cab and Section 2.15 Examination of trains and reporting defects. In both circumstances the Train Operator must notify the Line Controller. Also, that the train must be operated from the leading cab (Section 2.7) unless authorised. Additionally if stopped over catch/trap points the train must not be set back unless the points have been secured. 6.5 On completion of the training the Train Operator was rostered off for 3 days followed by 3 late turns, 1 day’s annual leave (on the 3rd October 2008) and 3 further late turns, the last one (714) being the duty being performed at the time of the incident.

Other staff involved 6.6 Both of the Alstom Cabin Shunters were trained and competent to carry out their prescribed tasks at the time of the incident. (Although it should be noted that the Depot Shunters training only applies within the confines of the depot up to shunt signals Y28 and Y 30). 6.7 DMT1 (Silver Control) certificates were current and he had completed Silver Control training.

Services levels 6.8 At 24:00 prior to the incident the Northern Line was running a full service with 63 scheduled trains running.

Page 17 of 40 Rolling Stock 6.9 The Northern Line runs 1995 Tube Stock which was introduced in 1996. The stock was designed and built by Alstom (formally GEC – Alstom). Tube Lines lease the trains from the leasing company Alstom – NLSP under a contractual arrangement whereby Alstom undertake all of the maintenance of the rolling stock - primarily at Morden and Golders Green Depots.

6.10 A train on the Northern Line is made up of two three-car units. Each three-car unit is made up of a Driving Motor car (DM), Trailer car (T) and an Uncoupling Non-Driving Motor car (UNDM). The Incident Train T161 consisted of two three car units made up by the following cars. Only the DM and UNDM cars have traction current pick-up shoes.

Car 6 Car 5 Car 4 Car 3 Car 2 Car 1 51680 52680 53680 53679 52679 51679

6.11 The Incident Train T161 had lost traction power on car 3 (53679) at Colliers Wood which was indicated on the TMS in the leading car (51679). The train was also missing two D bogie negative shoes on both the UNDM cars (53680 & 53679) which was not known until after the incident. It is probable that the train fault recorded was due to the loss of negative shoes but this cannot be proved.

Track Layout 6.12 The approach to Morden Depot has a steep incline (1 in 40) starting at just before the crossover going into the depot. This is commonly known as the “Bank”. 6.13 Y19 points were originally installed to protect trains and passengers in the station platform from runaway trains from the depot, by diverting their path on to a short run off with a sand drag and fixed buffer at the end. They are spring toggled points, and unless reversed by the signaller to let trains exit the depot, will always set a route onto the sand drag as a normal position. When entering the depot from service, the flanges of the train wheels on the train are used to push the points across in favour of the train, with the point blade springing back to their normal position when the wheel has passed. This set of points falls outside of the Morden Depot Limits and are under the control and operation of LU at all times.

Page 18 of 40 Photograph 2: Track layout showing Y19 points leading to the sand drag (location of derailment) towards Morden Station

6.14 The depot is generally thought of as being divided into two parts, the south side (from 1 – 18 roads) and the north side (from 19 – 34 roads).

Depot and Operational Boundaries 6.15 The physical boundaries are clearly defined as part of the PPP contract, identifying who is responsible for maintenance of what. Since the contract was issued there have been changes of responsibility for maintenance between Tube Lines and Alstom, but those changes do not affect the stated boundaries. Less clear are the “operational” boundaries e.g. who has control during normal and ad-normal operations. Whilst it is clearly stated that LU will take the lead in the case of any “incident” it is unclear where the boundary for operational responsibility is, or what happens when a train is across the boundary. 6.16 It is generally accepted that the Cabin Shunter controls movements made within Morden depot (South of the stop boards by the shunters cabin). Movements out of the depot towards Morden station must be agreed with the signallers in the control centre at Coburg Street and are controlled by shunt signals Y28 and Y30. 6.17 Train radio beacons in the incident area caused the Train Operators to lose direct contact with Service Control. Contact would only be achieved via the Depot Shunters cabin even though the train was still on the operational railway. This is now resolved through the implementation of Connect radio system with the T/Op able to listen to and communicate with both SC and the Depot shunter. 6.18 During the interviews with those involved in this incident and subsequent investigation of both LU Operational staff and Alstom staff, it has become evident there are variations of understanding as to the defined boundaries that distinguish between the Operational Railway and the Depot Limits. This

Page 19 of 40 also applies to the procedures to follow when trains are crossing those boundaries.

Train Maintenance 6.19 Derailment train 51679/51680 The morning TAS (Train Availability Sheet) for 6th October shows that the incident train entered service as Train 164 at 06.30 from depot, stabling at Golders Green depot at 10.00. It re-entered service as T161 at 15:25 travelling to Edgware then completed four round trips to either Morden or the loop. No faults are logged for these journeys. Departing from Edgware, it was on its last trip of the day to Morden when the incident occurred. The TMS logs from 51680 shows that, prior to this the train last ran in service on Thursday 2nd October. It spent all of Friday the 3rd and the weekend of the 4th and 5th in Highgate depot during which time it was prepped each day, at around 21.00 on the 3rd, 22.15 on the 4th and 22.30 on the 5th. The Unit History reports have been reviewed going back 3 months and enquiries regarding the train’s service availability over that period have identified the following: The train underwent A Exam (14-daily) on the 08/08/2008 and A2 Exam (28- daily) on the 25/08/2008 On the 26/08/2008 the train was stopped for a report of juddering under braking. Whilst stopped the train underwent wheel turning, reliability modifications, bump stop adjustment, and a number of once-round checks. Despite exhaustive investigation, no defective equipment was found to be the cause of the juddering. It was suspected that unmatched wheel diameters may have contributed to the problem and this was corrected when the wheels were turned and released for service on the 14/09/2008 On the 19/09/2008 the train was again stopped for a report of excessive side- play on car 51680. This was diagnosed as the body end bracket on one of the lateral dampers adrift from its fixings due to broken bolts. After awaiting delivery of materials, bolts replaced and released for service on the 30/09/2008. On the 01/10/2008 the train was deep cleaned and underwent a winterisation exam.

Assisting train 51666/667 The IR logs show that on the day preceding the derailment, this train carried out a full day’s passenger service. It ran as train 117, leaving Edgware depot at 05.55 and stabling at Morden depot at 19.21 on 6th October 2008. The train’s last reported service defects were door problems on car 53667 on 27th September and a saloon heat & vent problem on car 52666 on 18th September. On the morning of 7th October this train was in a serviceable condition.

The unit histories show the train had undergone full maintenance with the last A2 (28 day exam) being carried out on the 19/09/2008.

Page 20 of 40 7.0 Discussion 7.1 The key findings arising from Investigation Team discussions and information gathered from witness statements and interviews are:-

Track and Signals 7.2 There have been no allegations against or fault found with either the Track or Signals involved in this incident.

Loss of shoe gear and Traction Faults 7.3 The initial event was the indication of a traction fault (car 3) on the train, which was probably caused by the loss of negative shoes. Whilst loss of shoes is not uncommon, over the last 12 months instances of lost shoe gear on the Northern line have increased. The worst four week period showed a loss of over 130 shoes from operational trains. Whilst this has decreased, work is ongoing to identify and deal with the causes. 7.4 The initial fault was not reported to Service Control by the Train Operator as there was no apparent loss of power and he felt that the train would be able to complete its journey to Morden depot where the fault could be reported on the train defect sheet. This meant that Service Control was unable to plan mitigating action at Morden (using a straight run into the depot avoiding the crossover on the Bank) as they were unaware.

The Derailment 7.5 The T/Op was aware of the conditions on the crossover and of the need to maintain power on the approach to the depot, without exceeding the speed limit over the points and crossing. However in cutting the power to keep within the speed limit, with the loss of at least one traction package and others off traction current due to rail gaps, momentum was lost causing the train to stop. 7.6 Given the evidence that the rear of car three was over a gap by 19 points, it would seem that at best, two of the four traction packages were available to then move the train. From a stopped condition on the crossover and on an adverse incline into the depot, the train was unlikely to move forward under those conditions. 7.7 As seen from previous incidents, stalling of trains on this crossover is not uncommon. 7.8 The decision to undertake an unauthorised Wrong Direction Move (WDM) is against the Operational Rule Book requirements. There was an understanding by both the T/Op and the shunter on the train that other trains (and customers) were being held up behind the incident train. This desire to resolve the difficulties facing them meant that the position of the train over the catch points and the rules requirements were ignored. The consequence was to complete the unauthorised Wrong Direction Move and derail the train. 7.9 The shunter was also a train technician and as such was familiar through experience with the routes into the depot. He was also known to the T/Op. However shunters are not trained and assessed in track layout from the station to the depot as their responsibility is within the depot limits.

Page 21 of 40 The responsibility for actual movement of the train is with the T/Op. In this case he took what he believed to be assurance from the Shunter that the points were secured and it was safe to complete a WDM over the catch points. 7.10 With the train derailed there was still no attempt to contact Service Control, which in turn delayed the initial response to the incident. However the seriousness of the derailment was immediately realised by the T/Op and the shunter.

Operational decision to put trains into the depot 7.11 Faced with the derailment the Service Manager and Controller had several issues to consider. 7.12 Firstly the customers on the two trains stalled in the tunnel between South Wimbledon and Morden. Due to the prompt action of the SC in holding trains in platforms on noticing the lack of train movement on the “Bank”, only these two trains were stalled in the . This was resolved by authorising wrong direction moves for both trains to take them back to South Wimbledon. Problems were encountered by one T/Op closing the lead cab down and losing radio contact with the SC. This was resolved by moving the other train close to the first, allowing the T/Op to move across contacting the other T/Op which then established communications. 7.13 Having resolved this, the decision had to be made on what to do with the trains being held on the south bound line. As it was established that it would be possible to get the trains into the depot via 43 road, it was decided to do this as: • This would enable the trains to be prepared for morning service • Most of the train operators were based at Morden and it would be easier to get them home • It would be possible to get prepared and crewed trains back out of the depot for the morning service • Leaving trains at stations to be stabled overnight then restarted at start of traffic would require a large number of T/Ops to be available at the same time, logistically very difficult to achieve • If the derailed train could be re-railed and moved in time it would have minimal impact on the morning service. If that was not possible then a limited service could be operated by reversing at Tooting Broadway. Having looked at possible options, the investigation panel understands the logic behind the decision taken at the time. However as discussed later, there could have been opportunities to speed up the full return to service.

Silver control – support resources 7.14 DMT1 was appointed silver control but was tasked with setting up a clear route into the depot. This meant he was unable to complete the overview and control on site that a silver control would normally be expected to do. Whilst another DMT was despatched to site, there were initially insufficient resources to deal with all the tasks required. Consideration could have been

Page 22 of 40 given to bringing in Managers and staff from other lines to assist, relieving more locally based staff to use their line knowledge to best effect. Drugs and Alcohol Testing 7.15 The Alstom Shunters involved in the incident were removed from site and arrangements were put in place for them to undergo a Drugs and Alcohol test. The alcohol screening and results of the drugs test both showed a negative result. 7.16 Whilst it is accepted that the T/Op of T161 was distressed by the incident, he had been given time to make a written statement and assessed as being able to drive home by himself (offer was made to provide a taxi or a companion to see him home). However, it is difficult to understand why no Drugs and Alcohol test was given. Certainly there was just cause (derailment) and opportunity. The LU procedures are clear as to when a Drugs and Alcohol test should be completed following an incident. There is no evidence to indicate a systemic failure as to the application of these rules. At the request of the investigation panel, a line circular was issued to remind Managers when a Drug and Alcohol test should be completed.

Access to site by ERU 7.17 On arrival ERU based themselves in the Morden Depot car park as close to the incident site as possible. Whilst able to access the site they were unable to take equipment to site as this meant crossing the live track (43 road). An opportunity to do so was lost when trains were prevented entering the depot as one side was full. It may have been possible to have discharged traction current at that time to enable access. Additionally there was no consideration of accessing via other routes, possibly with assistance with British Transport Police. 7.18 Once on site with their equipment, ERU indicated that it would take around four hours to re-rail the train, though to some parties this was communicated as “within the hour”. This miscommunication placed unnecessary pressure on ERU when re-railing.

Silver Control – access to the incident site 7.19 As the incident progressed and more people started to arrive at the start of the operational day, there was limited site control. The derailment site was fenced off with a temporary plastic fence whilst trains were moving in and out of the depot. However, once the train was re-railed and the area handed back to LU, the incident site was ill defined and access arrangements were at best ad-hoc. With increasing numbers attending site (see photograph 3) vital evidence could have been lost and staff put at risk due to the Silver Control not being aware of who was on site or in the vicinity. 7.20 Whist there is an interest element and a natural desire to assist from other members of staff, the investigation has to question if this was best use of their time. Indications are that there were around 24 people on site, (LU, Alstom and Tube Lines) that were not either directly involved nor had been requested to be available. This issue of excessive numbers on incident sites has been noted at other operational incidents, especially derailments.

Page 23 of 40

Photograph 3: Site of derailment just after the train was re-railed looking towards the station. The leading car is closest in the picture.

Recovery of the incident train 7.21 Once re-railed the attempt to push the train out failed principally because the pushing train, sited over the crossover and points, was gapped in several places. This resulted in only two traction packages being available to push out a 12 car train, up an incline from a standing start. It is therefore not surprising that this failed. 7.22 Further attempts using rail gap jumper leads also failed, principally due to the loss of the round train circuit, which prevented the brakes being released on the incident train. 7.23 The train was finally removed when another train was brought from the depot to pull the incident train into the depot. 7.24 The decision to initially push the train out was based on normal practice applied when a train is stalled in a tunnel. Also there was a perception that the auto-couplers were not designed to take the load of pulling another train. 7.25 Discussion with the Chief Rolling Stock Engineer indicates that the auto couplers are designed to take such a load. Correctly coupled and with the brakes released on the incident train, a recovery train pulling with all traction packages available, will successfully move even on an adverse incline. This is supported by review of derailed and stalled train in the same area, where recovery is initially more successful and quicker through pulling the incident train as opposed to pushing out.

Page 24 of 40 7.26 There are no pre-agreed plans for the recovery of stalled trains on the approaches to the depot, even though previous incidents are not uncommon. 7.27 Additionally LU operational staff are not clear as to their role when involved in recovery of trains, as often this is outside of the operational rules. This could also apply to 3rd parties e.g. Tube Lines and Alstom personnel. 7.28 Whilst the investigation has not reviewed other lines arrangements for similar scenarios, there are likely to be lessons learnt from this incident in the recovery of stalled trains which may be applicable elsewhere on the LU Network.

8.0 Review of Previous events There are a number of previous incidents which cover the following: • Unauthorised wrong direction moves • Trains stalled on the “Bank” at Morden • Incident management 8.1 Unauthorised wrong direction moves Four investigations have been linked to wrong direction moves, namely: • Paddington 25th January 2008 Incident No 18001611 • 10th June 2007 Incident No 17014398 • Goldhawk Road 15th June 2007 Incident No 17010680 • High Street Kensington 29th April 2006 Incident No 16008500 These investigations identified a common cause as being failure to follow operational rules when carrying out WDMs. Following the Paddington incident an action to review WDMs to identify common trends and make recommendations to address has been agreed. This work is on-going. 8.2 Trains stalled on the “Bank” at Morden A number of similar incidents have been identified with the most recent being on 30th July 2008. The resulting local investigation identified the same lack of planning in dealing with such incidents. Work has already started on this issue through desk top simulations. 8.3 Incident management The most recent incident involved a person under a train at Liverpool Street on 5th November 2008 which identified a lack of understanding and poor implementation of Silver Control. This resulted in a lack of cohesive response with the emergency services. Prior to this several other investigations have highlighted the lack of understanding on the role and responsibilities of staff when involved in incidents. These include: • Oval Person Under a Train 21st April 2006 • Aldgate uncontrolled train movement 20th July 2005 • Camden Town derailment 19th October 2003

Page 25 of 40 Whilst it is agreed that the operational procedures for incident management are robust, the lack of application and understanding, particularly at Duty Manager and staff level, is a common theme.

9.0 Conclusions 9.1 Delays in clearing routes to enable entry/egress to depot: Because the derailed train was across the signalled route into the depot from platform 5 to 43 road, it effectively locked out other possible routes into the depot. Therefore each route required had to be set up by hand on site and in some cases, point to point working was used. There were delays in completing this as the staff involved had to ensure it was correct and that the appropriate arrangements to brief T/Ops were in place. Therefore the time taken is understandable. 9.2 Violation of operational rules: When the traction package fault was first indicated at Colliers Wood, the T/Op decided not to report this to SC. This was because the train was still moving satisfactorily and he did not wish to delay other trains behind him. Also he could report the fault in the train defect log book when in the depot. With the train stalled the immediate concern of the T/Op was to try and get the train moving again, hence the use of the GOB. He was also aware of the need not to roll back as the train was across the spring toggle points (STP). With the appearance of the shunter to assist, during the conversation between the two the T/Op was under the impression that the STP were cleared for a reverse move. Both were also aware of the number of trains and potentially customers stuck in tunnels as a result. With this in mind it was decided to complete a wrong direction move. As such these were violations of the rules without fully realising the consequences in: • not contacting SC when prompted by the TMS message; • not contacting the SC when leaving the cab to deal with the incident; • not seeking authority for a wrong direction move. Whilst violations, it is concluded this was done with best intent to endeavour to keep the service moving. As the training and the competency assurance pick up on the reasons behind the need for the operational rules, checks their understanding and ongoing knowledge, it is difficult to identify any further remedial action. 9.3 Lack of recovery plans for trains stalled between station and depot From previous incidents and evidence from staff involved, trains stalling on the “Bank” are a frequent event. This is primarily caused by the physical layout of the track and particularly the points and crossings creating numerous gaps in the traction current rails. Specific driving instructions for T/Ops for this section/route are in force. However it was not possible to identify recovery plans for the most likely resulting scenarios. This is an area that requires prompt action to reduce the consequences of incidents.

Page 26 of 40 9.4 ERU could not gain access to incident site for their equipment Due to the requirement to keep traction current on, it was not possible for ERU to transfer their equipment to site to start the re-railing. There were later opportunities to achieve this. Firstly when trains were halted as one part of the depot became full and the route was changed. Secondly, other possible access points to site do not appear to have been investigated or pre-planned, given the frequency of this type of event at the same site. This lack of pre planning and lack of flexibility in taking opportunities as events unfold needs to be addressed. 9.5 Loss of traction shoes causing defective Traction Package on Car 3 The traction package fault indication on car 3 was probably caused by loss of shoe gear. As indicated earlier the issue of lost shoe gear on the Northern Line has been evident for sometime and remedial action has been implemented. This work continues at the time of the report and the investigation panel fully recognises its progress to eliminate the causes. 9.6 Steep gradient from the crossover onwards and numerous gaps in traction current rails over the points and crossings. The physical layout from Y2 signal onwards significantly contributed towards the incident. Whilst it is recognised it will require significant capital funding to eliminate the current physical conditions, the investigation panel believes there may be more cost effective mitigation that could be identified and implemented. 9.7 Inadequate site control In the early stages of the incident, Silver Control was diverted from taking an overview of the incident to undertaking the task of securing the route and then controlling the movement of trains into the depot. This was due to the lack of suitable support being provided. Consequently the time taken to resolve the incident may have been extended. This leads the investigation panel to conclude that there is a lack of understanding of: • the roles and responsibilities of Silver Control • the levels of resource required to support Silver Control. 9.8 Site control and attendance: Later in the incident, there were up to 24 managers and staff on site with no clearly defined role. The uncontrolled manner of site attendance is of particular concern and is demonstrated in Photograph 3. Preservation of evidence and site safety would be of particular concern in these circumstances. The issue of on-site attendance of both managers and staff with no clearly defined role needs to be addressed. 9.9 Lack of management control The root cause of this incident is lack of management control. This is exhibited in: • lack of pre-planning for known types of incident at this location • lack of management resources at critical times during the incident • failure to take advantage of opportunities as the events unfolded • lack of effective site control

Page 27 of 40 10.0 Immediate, underlying/contributory and root causes The extensive service disruption lasting over twelve and a half hours were as a result of the following causes:- Immediate causes: • Delays bringing trains southbound into Morden • Delays bringing trains out of Morden Depot for the morning service. • Delays in moving re-railed train Underlying and contributory causes • Delays in clearing routes to enable entry/egress to depot • Train T161 de-railed on 19 points • Train Operator moved in wrong direction back across spring worked toggle points (trailing) without authority • Failure to report train defects to Service Control • ERU could not gain access to incident site for their equipment • Lack of recovery plans for trains stalled between station and depot • Loss of traction shoes causing defective Traction Package on Car 3 • Steep gradient approaching depot from crossover onwards • Numerous gaps in traction current rails over the points and crossings • Position of block joints protecting approaches to all platforms associated with shunt signals Y6, Y7 & Y8 • Number 18a points blown over and secured (locked out of correspondence) • Traction current kept on until all trains stabled Root cause: • Lack of management control (Please see below Figure 4: Root Cause diagram)

Page 28 of 40 Figure 4: Root Cause Diagram

Page 29 of 40 11.0 Recommendations 11.1 Recommendation One: Context: The lack of understanding and completion of the role and responsibilities of silver control on site is reflected in this and other recent incidents. E.g. Liverpool Street - Person Under a train on 5th November 2008. Recommendation: A review of the level of understanding and competence of staff that are expected to undertake the defined roles in Incident Management should be completed. The review should include but not be limited to: • Compliance to Formal Incident Management (FIM) procedures and processes • How FIM is implemented • Impacts of resource availability on implementation and completion of FIM • Understanding of actions to be taken by Silver Control when incidents escalate in seriousness or time and resulting resource implications • Competence of those able to be appointed Silver Control/Task Leader • Considerations to be taken into account when nominating a Silver Control • Effectiveness of any training provided (including post training table tops exercises) and on-going assurance of competence of those trained • Identification of possible metrics for FIM including the competence of staff Any recommendations from this review should be implemented via an action plan. Effectiveness of this action plan should be checked at a suitable time period after completion of the plan. Actionee: Andy Barr, Network Co-ordination Manager Create plan for review: by end March 2009. Implement review plan: To be determined from the review Verification of remedial actions: Peter Wickham - SQE Manager (Incident Investigation) To be determined from the review. 11.2 Recommendation Two: Context: The crossover on 17/18 points at Morden, given the incline into the depot at this point, is noted as being a known area for stalled trains. Whilst the reasons for stalling are often due to gapping between Traction Current rails, there is a variation of views as to the best method of recovery. Recommendation: London Underground to determine the best and most appropriate working methods for recovery of trains stalled in this area. Table Top exercises may assist this review. The proposed methods should be verified in practice and then prioritised as to their use given specific site circumstances. Outputs from this review should then be reflected in appropriate line procedures and Defect handling guides. The review should also include the use of Rail Gap Jumper Leads. Appropriate training and awareness for staff (including Tube Lines and Alstom) should be identified and implemented. Note should be taken of the work from recommendation Five.

Page 30 of 40 Actionee: Jeff Ellis - General Manager Northern Line Time scales: Table Top exercise to be completed: End February 2009. Prioritisation report to be completed: End February 2009. Issued to staff if required: End April 2009. Review of use of rail gap jumper leads: End February 2009. Appropriate training on the use of rail gap jumper leads if required Start April 2009: Complete by end August 2009. Verification of remedial actions: Peter Wickham - SQE Manager (Incident Investigations) Review of prioritisation plan and rail gap jumper lead review: Completion date plus two weeks.

Review revised Line Procedures and defect handling guidelines: Completion date plus two weeks. 11.3 Recommendation Three: Context: The issues identified within this report could be applicable to all other LU operational lines and Engineering vehicle operations. Recommendation: The outputs of this report and in particular recommendation 2 should be reviewed by all lines to determine their applicability for each lines specific requirements. Any identified actions should be implemented. Actionee: Jeff Ellis - Northern Line GM on behalf of all Line GM’s and Transplant. Time scale: Review of LUL Operational Lines: By end September 2009 Resulting Action plan if required: Completion of review plus two months Verification of remedial actions: Peter Wickham - SQE Manager (Incident Investigation) Review of Action plan: Completion of review plus two weeks 11.4 Recommendation Four: Context: Delays in accessing the derailment site may have been avoidable through improved site awareness and pre planning. Recommendation: ERU to review the Emergency Planning procedures to demonstrate consideration and planning for alternative arrangements to provide options for parking and provision of access to incident sites. Actionee: Daren Hillier, Tube Lines, Timescale: By end March 2009 with any resulting action plan to be issued within one month. Verification of remedial actions: Trevor Bellis – Tube Lines Review of completion of the review of procedures: End April 2009.

Page 31 of 40 11.5 Recommendation Five: Context: Longer term consideration needs to be given to eliminating the in built physical constraints posed by the current site conditions, track layout and signals in the Morden area. It is recognised that some of the possible options may be constrained by the potential cost. Recommendation: In conjunction with LU Northern Line Operational Management a review should be completed to look at the operational constraints posed by the track and signal layout from the preceding station to as far as the depot. In particular, it should provide greater clarity and understanding of the signalling and overlap arrangements in the Morden area. Recommendations should be made as to the possibility of introducing modifications, including diagram and information updates re speed limits and stock type, track layout changes and potential civil engineering works. Outputs should be fed into Recommendation Two and the Transmission Based Train Control Project. Actionee: Russell Gell, Tube Lines Timescales: End March 2009 Verification of remedial actions: Trevor Bellis – Tube Lines 11.6 Recommendation Six: Context: The investigation has determined that there is variation of opinions as to where the “boundaries” between the operation railway and the depot are and who is responsible for what, especially when a train is across any boundary. Whilst based on the Morden incident this could apply to other depot/operational railway interfaces. Recommendation: Each LU line should determine: • Where each of the “Boundaries” between depot and the operation are • Determine the responsibilities either side and across the each boundary • Ensure these responsibilities are reflected within the appropriate procedures • Where appropriate cost effective signage is to be provided which meets LU standards. • Identify where this is reflected with training courses and change to reflect if required, supported by appropriate awareness campaigns Note: this action will also reflect any identified actions from recommendation two. Actionee: Jeff Ellis - Northern line GM on behalf of all Line GMs Timescale: by end September 2009. Verification of remedial actions: Peter Wickham SQE Manager (Incident Investigation) by end October 2009. 12.0 Observations supporting identified existing actions: 12.1 Loss of shoe gear has been identified as a probable contributory cause of this incident. The investigation panel has noted that incidents of lost shoe gear on the Northern line had initially increased but ongoing work has reduced this. Work continues to investigate and resolve this issue. Therefore no recommendation has been made.

Page 32 of 40 12.2 Whilst Drugs and Alcohol tests were completed on the two shunters involved in the incident (negative result), no test was completed by LU on the Train Operator. In consequence this was raised with the line GM and a line circular issued to remind managers that D&A tests must be completed on staff involved in an incident. Therefore no recommendation has been made. 12.3 The Operational Rule Book requires that Train Operators report the following to the Service Controller: • (Book 6, Section 2.15) (where required) a defect on the train • (Book 6, Section 2.13) when leaving the cab to deal with an incident • (Book 5, Section 2.2) when authorisation of a wrong direction move is required This was again raised with the line GM and a Line Circular was issued to remind all Train Operators of these requirements. Therefore no recommendation has been made.

Page 33 of 40 Appendix One: Time Line of Events 6th October 2008 16:10 The Train Operator of the incident train booked to start his rostered duty (714) which was due to finish at 00:40 7th October 2008 00:08 On the last trip southbound towards Morden Train 161 experienced motor problems at Colliers Wood and the TMS (Train Management System) indicated Traction Pack Fault in Car 3 (536790) 00:13 Train 161 arrives at Morden Station Platform 5 where the Train Operator carries out normal platform duties ready to stable the train 00:16 Signal Y8 Clears & Train departs platform 5 towards depot. Train reached a speed of 15.79 kph (Depot PSR 16 kph) when the Train Operator shuts off. The Train Operator attempts to re-motor after a few seconds, but the train does not accelerate. 00:18 The train remains in motoring but continues to slow down until it stops between Signal Y28 and number 7b points The Train Operator makes repeated attempts to motor and the train moves slightly on 4 occasions, but reaches no more than 1kph. During this time the train operator operates the GOB (Gap Override Button) on 5 occasions. Cabin Shunter 1 (Alstom 1st Cabin Man) called Train Operator to establish what was happening. He was informed that the train had stalled and was experiencing traction problems on car 3. Cabin Shunter 2 (Alstom 2nd Cabin Man) leaves the cabin and joins the train to find out what was wrong and to assist. He made several attempts to restore power to the train and when this did not work, suggested that the Train Operator should roll the train back a little in order to re-establish power. The Cabin Shunter 2 confirmed that they wanted to stop on the crossover so car 51680 (north end unit) is on juice The Train Operator was not happy with rolling the train back, but decided to change ends and make a wrong direction move in order to get car 6 (Unit 51680) back on to traction current. There was some communications between the train and Cabin Shunter 1 during this time. Cabin Shunter 1 was aware of the traction problems and that the train operator was changing ends in an attempt to move the train. He was not aware the train was going to make a wrong direction move 00:20 Cabin Shunter informs the Production Manager (Steve Fisher) of the stalled train 00:21 The Service Operator working the Morden desk at Coburg Street notices a problem with T161 on his signalling diagram and calls the Morden Depot Shunter 1 to ask why T161 was stopped on "the Bank" entering the Depot. The Service Operator was informed the train had stalled and was experiencing problems with traction on car 3. The Service Operator starts to regulate the service and hold trains in platform areas.

Page 34 of 40 00:25 Trains start to block back with T16 stopped at Signal Y2, T33 stopped at Signal A719 00:26 Train Operator of Train 161 (Incident Train) shuts down leading cab (51679) 00:28 Train Operator opens up rear cab (51680) Train Operator allows train to roll northbound (wrong direction move), reaching a speed of 3.44kph travelling approximately 17 metres (approx 1 car length). Train 161 starts to judder and comes to a stop & the Train Operator drops the dead-man. Both D&C axles of car 52680 comes off the rails across number 19 points and car 53680 A&B axles travel wrong road, but did not derail. 00:30 The LU Service Manager in the Control Room at Coburg Street sends Morden DMT1 (Silver Control) to the depot to ascertain what the problem is with T161, as her indications show the rear of the train is still over 18 points, (reversed) thereby preventing any other trains entering Morden Station 00:32 DMT1 makes his way from Morden Platform to the incident train. He establishes the train has de-railed and contacts the Service Operator at Coburg Street to inform her that T161 has derailed over 19 points, on 44 reception road. DMT1 establishes that the Train Operator has been shaken up by the incident and sends him back to Morden Train Crew accommodation, asking him to complete a memorandum describing his version of the incident. 00:37 LU Service Control Manager authorises wrong direction moves for T16 & T33. Service Operator contacts T16 & T33 to start the process for completing the wrong direction moves back to South Wimbledon. 00:40 Vauxhall ERU receive call from NOC (Network Operational Centre) asking for assistance in dealing with derailment Alstom Team Leader contacts Alstom Production Manager informing him that T161 has derailed 00:42 Alstom on call manager receives a call telling him of the derailed train 00:43 Alstom on call manager calls Morden Production Manager for an update and to ensure he follows the incident investigation process, taking as many photos as possible 00:44 Service Manager appoints DMT1 as Incident Manager (Silver Control) 00:45 Vauxhall Team leave Depot for site Alstom Production Manager arrives at the incident train 00:50 Night Turn DMT2 dispatched from East Finchley to Morden Depot to assist Alstom Production Manager phones the RST (Alstom Rolling Stock Technician) to ascertain whether trains could be stabled in Golders Green, but when this was suggested he was informed by the Service Controller and Service Manager that all trains will be sent to Morden to be stabled 01:00 Train Radio contact is lost with the Train Operator of Train 33 who is waiting to commence a wrong direction move. 01:02 Train 16 is tasked with completing a wrong direction move, up to train 33, and establish contact with the Train Operator. The Traction Current switched off

Page 35 of 40 between South Wimbledon and Morden to allow for the Train Operator of T16 to cross over to T33. Special Taxis are ordered for the Operators of the 19 trains waiting to be stabled 01:05 Vauxhall Team arrive at Morden Depot and liaise with Alstom Production Manager & DMT1 (Silver Control) 01:06 Traction Current recharged - contact re-established with the Train Operator of train 33 01:11 Train 33 completes Wrong Direction Move into South Wimbledon platform, 20 customers detrained - no issues 01:17 Train 16 completes the wrong direction move into South Wimbledon platform, 21 customers detrained - no issues 01: 24 Service Control Manager & DMT1 (Silver Control) agree route to be secured to enable the remaining trains to access the Depot. This would be from Signal Y2 to via platform 3 (14 a/b normal, 13a/b reversed, 16 reversed, 18a normal, 17b normal). 01:27 Alstom on call manager arrives at Morden Depot and makes his way to the incident site. 01:32 Night Turn DMT2 arrives at Morden Depot. Advised by DMT1 (Silver Control) that memo has been provided by Train Operator and that he was being sent home due to his emotional state. DMT2 makes his way to the Incident train to monitor situation. No further contact with DMT1 (Silver Control). DMT1 (Silver Control) confirms 18a are secured normal & 16 are secured reversed. 01:35 Vauxhall Team arrive at the incident site to determine what protection arrangements and plant & equipment would be needed. Initial assessment concluded that traction current would need to be discharged to allow transportation of necessary equipment from car park to incident site before work could commence LU Service Manager decided that all remaining trains (19) should be stabled before allowing ERU to site. ERU started preparing all necessary equipment in readiness for transportation to incident site 01:45 Alstom on call manager was informed by RST that there were still 19 trains on the Southbound that needed to be stabled, he asked how many could be stabled at Golders Green and outlying stations. The RST conformed that 8 trains could be stabled at Golders Green and a couple could be left at outlying stations. However, the Service Control Manager had previously declined this suggestion. 02:04 DMT1 (Silver Control) confirms 17b are secured normal 02:08 DMT1 (Silver Control) confirms 14a/b are secured normal & 13a/b are secured reversed. 02:13 DMT1 (Silver Control) confirms all routes are now secured, arrangements can be made for the 19 trains still out on the line to work towards Morden Depot

Page 36 of 40 via Y2 signal (one train to stabled in Morden Platform 1 / 2) used to protect incident worksite. 02:16 Service Controller authorises the first train (T114) to depot. DMT1 (Silver Control) remains at signal Y7 where he stops trains to give them a briefing before flagging them past the Signal towards the Depot. 02:25 First of the stalled trains (T114) arrives in Depot 02:50 Alstom DDM tried to move the front 4 cars forward by a few inches: this was at the request of the ERU to relieve the pressure off the 4th (52680) and 5th (53680) cars. This failed. 02:52 Alstom DDM and ERU decide to uncouple the leading 3 car unit from the rear unit. This allowed the leading unit to be moved 4 to 5 feet releasing the pressure from the derailed units and allow the ERU access to assess for further damage 03:00 Five trains now stabled on the North (T114, T016, T033, T116, T145). The north is now full and arrangements made to secure No4 crossover to facilitate passage of the remaining trains into the south. 03:21 DMT1 (Silver Control) confirms 4a/b points secured reversed to facilitate stabling the remaining trains on the south-side. 03:25 Stabling of the remaining trains re-commences 05:00 Remaining 13 trains now stabled (T073, T035, T041, T147, T064, T105, T146, T102, T030, T101, T014, T106, and T103). Service Controller advises DMT3 to send Train Operators to the depot to pick up their trains. LU Train Operators started to arrive in the Depot and stood around waiting to see what was going on before going back to the station at around 05:30 (confusion caused by communication issues between Service Operator and DMT3) 05:01 DMT1 (Silver Control) goes back to Train Crew accommodation where he liaises with Service Controller and hands over Silver Control to DMT2. He then goes on meal relief before assisting with desk duties. DMT2 (Silver Control) and Technical Officer now commence securing routes to allow trains to enter service from Morden Depot via 45 reception road The Service Controller advises DMT3 to send Train Operators to the depot to pick up their trains, but has to cancel several trains until all arrangements are in place to start bringing the trains out. The Shunter, DMT and Signal Operator are all kept informed. Early turn train crews start to book on at Morden. Some going to depot but returning after a short while (some confusion during this stage as to what’s going to run and what’s being cancelled) 05:05 Traction Current Discharged to allow the Cable Linesman and ERU to prepare site Information disseminated that Northern Line suspended Southbound Tooting Broadway to Morden southbound only. Northbound Service provided by trains entering service from Morden Depot 05:27 Cable Linesman has isolated the incident site by operating section switches 501, 502. The ERU has brought all necessary Plant & Materials to the incident train and have fenced off the area around the worksite.

Page 37 of 40 05:30 Traction Current recharged on the northbound road and arrangements being put in place to start bringing trains out of Morden Depot for service 05:40 Short Circuit Devices are placed at both the front and rear of incident train Incident train scotched and targets placed Vauxhall ERU Team start to work on re-railing train. The Alstom on Call Manager and Production Manager were informed by Technical Officer that the Cabin Shunter 3 (Alstom AM Cabin Shunter) was refusing to call trains into service. The On Call Manager contacted the Cabin Shunter 3 who said he did not refuse; he just informed the Service Controller that he would not know when the departing trains have cleared the signal as the route lights were not functioning due to points being scotched and clipped out of correspondence. 05:47 DMT2 (Silver Control) confirmed route was secured for trains to come from the depot into platforms 3/4. This information passed to the Service Controller DMT2 (Silver Control) informed by the Service Controller to let the Regulator know when each train had cleared the Depot and was in the Station To assist with this process Alstom stationed their Team Leader at the outlet signal with DMT2 so he could radio their Cabin Shunter to inform him when trains had cleared and he could call up the next train. Service Controller asks the Cabin Shunter 3 to call the first train into service, but the Cabin Shunter 3 tells the Service Controller there are no Train Operators in the Depot Service Controller contacts the Morden desk DMT and tells him to make sure the Train Operators are sent to the Depot to bring their trains into service 06:20 First of the Train Operators start to arrive in the Depot to bring the trains into service 06:32 First Northbound Train (T42) entered service from Morden Depot, tripping past Y30. The DMT2 (Silver Control) manned Signal Y30 to give Train Operators the authority to pass the signal and was resetting their trip-cocks when tripped. 07:30 Signal Operations Manager at Morden confirms that 18 points in Morden Depot cannot show a normal indication to allow home signal Y2 to be cleared, allowing a normal service to operate. Also confirms this situation will prevail until train is re-railed and points are set in correspondence. 07:46 DMT2 (Silver Control) relieved by DMT3 DMT2 made his way to Morden Train Crew Accommodation and completed EIRF (Electronic Incident Report Form) 08:15 Car 52680 on plates and ready to pull (approx 3ft) 08:50 Car 53680 on plates and ready to pull (approx 1ft) 09:10 ERU Team from Acton arrived on site to assist 09:30 Last train enters service from Morden depot. No service between Tooting Broadway & Morden on both roads 09:55 Sometime between 09:55 & 10:01 Train 51666 / 51667 which was a serviceable train was shunted from Morden depot to Morden platform 3/4 to be held in reserve to push the re-railed train if it was unable to move under its own power.

Page 38 of 40 09:58 All wheels now back on track, re-coupling of 3 car units commenced, site being cleared of equipment Vauxhall ERU handed over to relief crew and prepares to leave site (left at 10:30) 10:10 TLL Fleet Systems Engineer attends site and confirms all positive shoes in place. However, both D negative shoes were missing on the UNDM's, 53679 and 53680 10:30 Shift change over for Vauxhall ERU Team. Night turn go home, early turn take over 10:41 Several attempts to move the train are unsuccessful owing to 53679 and 51680 (cars 3&6) being off juice and 51679 and 53680 having insufficient traction power - train will not motor up gradient, and starts to run back over 19 points 10:53 Assisting train taken from Morden Platform 3/4 into Morden Depot to push out the defective train 10:56 Assisting train attempts to couple to defective train in Morden depot but the couplers were misaligned 10:57 Traction Current was discharged so the coupler latch could be released on Incident train (51680) and the coupler was swung over to align with assisting train (51667) 11:06 Traction Current is restored 11:08 Assisting Train couples up to defective train 11:10 Sustained motoring is attempted and the train starts to move, powered by 3 motor cars (car 53667 still off juice). Over the next 38 seconds, the 12-car train moves 26.86 metres. During this time Traction Supply is restored to 53667, but lost again. After a further 18 seconds traction is also lost to 53666. At this point the train stalls. There were various attempts to move the 12 car train. However, none of the attempts that followed were successful. 11:16 The train records various fault modes, including Trip-cock Operated and Train Status (Round Train Circuit) going low. There were also numerous PWM out of range messages for traction current and braking and a Service Brake Fault followed a short while later by the trip-cock pressure switch 3 dropping out. 11:18 Acton ERU team finished cleaning up the site and left at 11:18 11:22 Traction Current was discharged so the Gap Jumper Leads could be installed into assisting train (51667) 11:26 Traction supply to cars 51667, 53667 and 53666 is restored, Train Status goes high and the Service Brake Fault indication is reset. However, 51667 shows on the TMS as Trip-cock tripped (due to low air). 11:30 There now follows various attempts to move the 12 car train, using both the assisting train in FORWARD and the incident train T161 in REVERSE. During this stage traction power is restored to the assisting train, Car 3 (53667) and Car 4 (53666) but lost to Car 1 (51667) and Car 6 (51666). However, once again none were successful 11:41 Following some consultation between Alstom & LU the cab of 51667 is shut down and a full Traction & Auxiliary trip and reset is carried out. The cab is opened up again into REVERSE at 11.42 but the Round Train Circuit is still

Page 39 of 40 showing as lost due to ‘Unidentified Cause’. After the reset, the TMS reaffirms that the traction supply is lost on cars 53667, 53666 and 51666, 51667 being the only powered car, indicating that the jumper lead was the source. 11:43 The Gap Jumper Lead is removed from Car 51667 followed by a reset of the traction supply to car 51667, indicating that that car was in fact on juice and suggesting that the gap jumper made no difference (other than losing the Round Train Circuit because of the discrepancy!). 11:46 The assisting train is uncoupled from defective train, problem getting coupler wedges back 11:48 The assisting train is moved back into Morden station. After tripping past the approach signal, it berths in the platform at 11.49.14 and stops after covering 121 metres. The train comes out of load shed and returns to normal at 11.48.46 once all 4 motor cars are back on juice. The train went back into service for the remainder of the day. The defective train then attempts to move under its own power from 51679 but this fails. 11:50 Traction Current discharged and Rail Gap Jumper leads inserted in defective train (51680). 12:03 Attempts to move train from 51679 are still unsuccessful. 51679 is then shut down, and the TMS records traction supply lost on car 51680. It is likely that this was caused by the discharge of traction current to remove the gap jumper leads form 51680 12:07 51679 is once again opened up and a traction test carried out. The TMS records a test failure in 53679 and 51680. Further attempts are made to move the train. However, it was established that one of the UNDM’s on car 53679 were locked out 51680 showing Traction Supply Lost (jumper lead removed). Alstom then carried out full TAT & TAS from car 51679 and advised that locked out package had come back on but cars 53679 and 51680 were still showing Traction Supply Lost. Motoring was again attempted with the train moving forward slightly before stopping again. (It was possible that the train might have moved further if jumper had been left in) It was then decided to prepare a train ready to pull defective train into the Depot 12:21 Defective train being pulled fully into the depot by another train 12:25 Defective train fully in depot and stabled, Northern Line Signals Operations Manager commences checking operation of signals 12:41 Through running commences with train 65

Page 40 of 40