LONDON UNDERGROUND

Formal Investigation Report into the Unauthorised Wrong Direction Move (UWDM) and associated SPAD on the Bakerloo Line at Paddington Station.

Final Report – Ref: 18001611 – January 25, 2008.

Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Contents

1.0 Executive Summary Page 3

2.0 Terms of Reference Page 4

3.0 Background Page 5

4.0 Methodology Page 7

5.0 Discussion Page 7

6.0 Immediate, underlying and root causes Page 17

7.0 Recommendations Page 18

8.0 Appendices Page 22

Appendix 01 - Incident timeline. Page 23

Appendix 02 – Signal plans Paddington Page 24

Appendix 03 – Photographs. Page 25

Appendix 04 – Root cause analysis chart. Page 27

Page 2 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

1.0 Executive Summary

1.1 Incident.

On the morning of Friday January 25th 2008, the Bakerloo Line was suspended between Elephant & Castle to Paddington due to a reported fire alert on the line. As a result of this suspension, all trains on the southbound were required to reverse ‘south to north’ at Paddington. The incident Train (T234) was the first required to do so, and the Train Operator (T/Op) was instructed to do this move after berthing at Paddington. To do a reverse move such as this at the station, it is required that the train moves forward to the reversing stopping position to enable the rear cab to be positioned for the OPO equipment, and to view signal BD10 for the northbound move. The T/Op neglected to do this, and undertook the detraining of T234 whilst making his way to the rear cab.

Once there, he entered the cab and moved off a short distance, without being able to see the signal or the OPO equipment. He stopped as he had become aware of not doing the required checks, and went to the first car to check the signal aspect. Whilst there he became locked out of the cab, and had to break the glass of the J door to return; he also noted the aspect was red on BD10, but due to perceived evidence he felt he could continue. He moved off at line speed and did not pass over the points for the reversing move, which had not yet been set. The T/Op had not logged onto the Connect system and Service Control were unable to contact him. Being aware of the train movement due to a SPAD alarm the Service Controller removed traction power to stop the train (although it is not clear whether this did stop the train). Contact was now made on the radio, and the T/Op was instructed to secure. A DMT and second T/Op made their way to the train, which was moved to the depot and placed in quarantine.

1.2 Findings.

The findings of the LU investigation are that this unauthorised wrong direction move (UWDM) was initiated by the less than satisfactory site-specific conditions existing at Paddington. In particular the introduction of OPO and the requirement to have accurate stopping points to maximise sighting of platform CCTV and mirrors. The interrelationships between the required stopping points, the train length, the platform length and the need to reliably view OPO as well as signals at either end of the platform, resulted in a compromise for a solution. Insufficient mitigation in the form of a reversing stop mark, and an Operational procedure was implemented to address the residual risk. However errors are likely with systems and/or routines that are formed in such ways. In the case of Paddington, the initial error of not driving up to the correct stopping mark led to a series of errors by the T/Op. In addition the specific signalling arrangement on BD10 trainstop provided a small window of opportunity for the trainstop head to lower following a slow speed SPAD at its associated signal.

Page 3 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

1.3 Recommendations.

Eight recommendations are made which, focus on removing multiple stopping positions by modifications to OPO equipment, modification to the signalling to ensure that trains which SPAD at signal BD10 are tripped, improvements to the management of CCTV evidence for investigations, a wider review of previous UWDM incidents, surveys of potentially similar sites elsewhere on the system, a review of Connect radio functionality in comparison to the ‘legacy’ radio system, revision of the local procedures for reversing moves and a review of issues concerned with the standards for stopping positions on the system.

2.0 Terms of Reference ______

Terms of Reference Ref: 18001611.

A Formal Investigation is required into the circumstances surrounding the alleged passing at danger of signal BD10 by train 234 and its subsequent operation in the wrong direction on the southbound road towards Warwick Avenue Station.

The purpose of the investigation is to establish the basic causes of the wrong direction move and make recommendations to minimise the risk of recurrence. The investigation should review previous inquiries into similar incidents, and consider the effectiveness of any recommendations.

The investigation will be led by:

Rob Smith: Performance Manager Trains, Bakerloo Line - Team Leader.

With panel members providing support as follows:

Martin Fenge: SQE Adviser - Trained Investigator. Jason Wyatt: TU Safety Representative ASLEF. n Jim McDaid: TU Safety Representative RMT. n Ian Stephenson: Service Control Manager, Bakerloo line. Mark Dakin: DMT Bakerloo Line.

They will nominate specialists as required to assist. o

The final report to be presented to the Director’s Assurance Review Team on the 12th March 2008. p

Kevin Bootle General Manager – Bakerloo Line.

Page 4 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Note n – Subsequent to the issue of the ToR the allocated TU Safety Representatives were changed to; Mark Gilkes (ASLEF), Paul Bowman (RMT) & John Undrill (TSSA). Later still Paul Bowman was replaced by Eamonn Lynch (RMT).

Note o - Ged Neacy (Trains Systems Engineering) was nominated to be the Engineering Directorate representative on the panel.

Note p – The initial completion date was extended once evidence collection had been completed and the first panel meeting identified key aspects of the investigation.

3.0 Background

3.1 Incident Overview. On Friday 25th January at approximately 08:16 hours, the Bakerloo Line was suspended between Elephant & Castle and Paddington on the northbound due to a reported fire alert. A smell of smoke had been reported between Charing Cross and Piccadilly Circus, and the fire brigade had been requested to attend. As a result of this suspension, all trains on the southbound line were required to reverse ‘south to north’ at Paddington, with the incident train (T234) being the first to do so.

The Train Operator (T/Op) was informed by Service Control of this requirement after he had stopped at the normal stopping position at Paddington southbound (Platform 4). The T/Op made an announcement to the passengers explaining the situation and asking them to detrain. He shut down the south-end cab and started to detrain, closing the doors using the porter buttons. He did not move the train forward the required distance for the reversing move as he should have. The panel noted that at the time, the ‘S’ stopping mark used for reversing moves was missing from the track and the ‘Shunt and Reverse’ sign on the headwall was not illuminated.

On reaching the other end, he entered the north-end cab and started to move off. The train moved forward at slow speed for approximately 2m (the length of a set of double doors) and then stopped. The T/Op realised that he did not see the reversing signal BD10 on the headwall due to the north end cab being within the tunnel.

The T/Op then went to view the signal aspect from the first car, and as he left the cab he thought he heard the trainstop operate. He noted the aspect of BD10 was red but before he was able to return to the cab, the J door shut behind him and he was locked out. He then spent some time trying to break the J door glass to re-enter the cab, the delay causing the OPO Connect alarm to activate. Subsequent evidence shows that the Service Controller was attempting to contact the T/Op in response to the SPAD alarm of BD10 in the Baker Street Control Room. However, the T/Op was unable to hear the transmission because the train Connect radio was not logged onto the system.

Once back in the cab, the T/Op set off northbound on the southbound track, and was unaware that the train did not pass over the points to the northbound line as would be required for this move (the route had not yet been set). As the Service Controller had

Page 5 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington, noted that a SPAD indication had come up for T234 passing BD10 at danger (and the subsequent track circuit becoming occupied on the diagram), he realised that the train was still moving and requested that traction current be discharged under the train as Service Control staff were initially unable to make contact with the T/Op.

The train stopped possibly due to one of three reasons; it was rear tripped on signal BD2, the traction current being discharged or action of the T/Op. Communications were then established between the T/Op and Service Control and the T/Op was told to secure the train, not to move and wait for the arrival of assistance.

The Duty Manager Trains (DMT) assigned to deal with the incident arrived on site, arranged protection and made his way to the incident train with a second T/Op (T/Op 2). The train (rear) was found to be approximately 6m past (north of) signal BD1, some 292m from Paddington and 460m from Warwick Avenue. The T/Op was in the leading cab. After taking control and performing start-up checks, the DMT requested that traction current be recharged and the train was taken into Paddington by T/Op2. There, the train reversed via BD10 and was driven to Willesden Junction and then on to Stonebridge Park Depot, where it was placed in quarantine pending further investigations.

A timeline for the incident providing further detail is attached as appendix 01.

3.2 Procedure for reversing.

The procedure required for undertaking reversing moves at Paddington is set out in two documents which list the following requirements;

(a) The Bakerloo Line Supplement (issue date June 2007).

South to North.

Trains must be reversed via the southbound platform. When the train enters the platform, the ‘shunt and reverse’ sign on the south end headwall will light up. The train operator must; y berth the train level with the ‘S’ stopping mark. y carry out station duties for detraining customers. y change ends. y carry out station duties for entraining customers. y when northbound starting signal BD 10 has cleared, proceed northbound.

(b) Bakerloo SPAD awareness and route knowledge book (version 2, July 2005).

South to north via southbound platform 4. On receipt of a green aspect at signal BD2, proceed into the southbound platform (maximum speed 25mph). A “shunt & reverse” sign located at the south headwall should be illuminated. Fully berth and fully secure the train on the “s” stopping mark

Page 6 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington, at the headwall tunnel mouth. Change ends. When signal BD10 clears with a green aspect, proceed onto the northbound road via no. 7 crossover (maximum speed 15mph). The train may depart in passenger service.

3.3 Train Operator.

The incident T/Op has worked for London Underground for twenty one years, fifteen of which have been working as a Train Operator (most lately as an Instructor Operator) on the Bakerloo Line.

On the incident day he was working on duty 5 from 05:34 to 13:31 hours. The incident occurred on his second return journey of the day.

The T/Op reported that he had undertaken reversing moves at Paddington in the past, with no problems.

The T/Op was interviewed by the incident DMT and also by a SQE Investigation Adviser. During both interviews he was unable to fully explain why he had undertaken certain actions (those detailed in 5.2 below). It was considered that the lack of clarity resulted from him being upset, confused and possibly not wishing to provide information that could be used against him in subsequent examination of his actions. The panel have therefore been forced to make certain assumptions within this report concerning the decisions made by the T/Op during the incident.

4.0 Methodology

As part of the London Underground investigation, the information for this report has been obtained using the following methods:

• All relevant staff involved in the incident have been interviewed. • Site visits to examine conditions on platform 4 have been undertaken by the investigation panel. • CCTV recordings have been reviewed. • Recordings of all radio communications have been obtained and reviewed by the investigation panel. • Review of all evidence and discussions at a series of investigation panel meetings.

5.0 Discussion:

5.1 Stopping positions S/B Platform Paddington (background).

The southbound platform at Paddington on the Bakerloo Line has three stopping positions; a traditional stop mark (white diamond) in the four foot and a forward stop mark for reversing moves marked by an ‘S’ board fixed to the track approximately

Page 7 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington, two metres south of the diamond. In addition, for accurate sighting of the OPO equipment a green and yellow chevron visible from the cab side window is present. It is believed that this was a more accurate means of achieving adequate stopping and installed sometime after the OPO equipment was first put in. Although not documented in procedures, this is now is regarded by Operations as being the normal stopping position.

It is apparent from observing the positions of trains at this platform, that this is a tight berth, and when the train is correctly aligned with the normal stopping mark, the rear of the train remains within the tunnel (see Appendix 03, picture 1). The second stopping position required for reversing moves allows the train to be sufficiently forward so that the T/Op entering the north end cab is able to view both the aspect of signal BD10 and the OPO equipment.

In discussion the panel concluded that it was most likely that the normal stopping mark had been placed in its current position to ensure the optimum view of the OPO equipment, which due to its size is required to be located on the platform. It was also noted the normal stopping mark on the track had at some stage been relocated and that at the time of the incident, the reversing stopping mark was missing.

Use of the second stopping mark has been set out in both training materials and within the Bakerloo line Supplement.

5.2 Immediate mitigations.

5.2.1 Assisted Dispatch. A notice was issued to all T/Ops on the Bakerloo Line on February 1st 2008, requiring them to ensure that station staff are available to provide assisted dispatch of any train undertaking a reversing move at BD10.

5.2.2 Replacement of Stopping Mark. The missing ‘S’ sign was replaced on 3rd February 2008, and was located by using a train positioned ready for the reversing move, and considering the view of signal BD10, the OPO equipment and consideration of all passenger doors being on the open platform.

5.3 Train operator actions.

5.3.1. Deviations from procedure. The panel reviewed in detail the actions of the T/Op during the incident. A number of deviations from the agreed process were noted as follows:

- The T/Op did not pull up to the reversing stopping mark such that the rear north end cab was clear of the tunnel.

- The T/Op did not return to the first cab when he realised that he was in the wrong position to reverse.

Page 8 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

- The T/Op, after completing the detrainment task, did not check the signal BD10 nor view the associated OPO equipment, prior to moving the train (First short movement).

- The T/Op did not log onto the Connect radio when in the north-end cab, prior to moving.

- The T/Op did not request assisted dispatch via either Service Control or platform staff, which he should have done given his position past the signal.

- The T/Op left the train cab without his J door key, locking himself out. (Whilst a violation of the rules, it is considered to be a minor breach since the train was empty of passengers, the doors were closed and the intention of the T/Op was to be no more than a few seconds in the first car).

- The T/Op did not inform Service Control at any stage when he was in the north-end cab. Had he done so, an opportunity for an intervention would have arisen and it is unlikely that the UWDM would have resulted.

5.2.2 Human Factors. The panel considered in detail the above deviations from procedure made by the T/Op, and examined influencing factors on these actions; the following were noted:

- The existence of three stopping marks at Paddington is an unsatisfactory arrangement. It believed that this carries with it the propensity for latent human error.

- The T/Op was observed (CCTV) talking to a customer on the platform prior to entering the north-end first car.

- The T/Op was unable to reliably see the signal from the cab.

- After having left the south-end cab, the T/Op may have intuitively assumed that even though the north-end cab was past the headwall signal, the hazard of not stopping at the ‘S’ board was still manageable. On Bakerloo (1972) stock, the front of the cab is slightly over 2m from the centre of the first wheel and approximately 2.5m from the tripcock. Thus, although the cab was past the north-end headwall (where the signal is mounted), the train wheels may not have entered the section.

- After making the original error of the first movement, the T/Op became locked out of the cab. This is likely to have placed an additional stress on him as being directly responsible for the increasing delay, possibly making him prone to not fully consider his options.

- The OPO alarm sounding would almost certainly have exacerbated the situation, causing the T/Op to become anxious and possibly imposing pressures on him to try to get the train moving quickly.

Page 9 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

- Once the train was moving, the T/Op was not aware of taking the wrong route (not seeing the points), and proceeding along the track in the wrong direction. The T/Op at this stage in all probability believed that he had managed the earlier difficult situation, and believed he had acted and was acting correctly.

This is a recognized phenomenon termed ‘confirmation bias1’ (a general issue in the study of Human Factors and observed in the Finchley Central unauthorised wrong direction move inquiry in 2002), where there is a tendency to seek information and cues that confirm a belief, rather than discount information/cues that support an opposite belief. In this case, despite the fact that the T/Op traversed the points in the normal (as opposed to reverse) position and the absence of northbound signals, he continued driving.

- The panel considered that the T/Op’s actions may have been influenced by a natural desire to cover up earlier mistakes.

- Following the initial short move, the T/Op went back into the first car to check the aspect. Passing through the cab door he said that he heard the noise from the trainstop. He observed the signal being red, and probably rationalised that the sound of the trainstop was the head returning to the ‘up’ position when, in reality, it was lowering due to the uncharacteristic nature of the signalling arrangement. On the basis that he didn’t get tripped, this likely reinforced in his mind that the signal was initially clear, and it was the original short move which replaced it thereby bringing the trainstop head up, which was the sound he heard.

5.4 SPAD / Trainstop issues.

5.4.1 SPAD at Signal BD10. The panel considered the nature of the SPAD which occurred at BD10. It was noted that as the north-end cab was beyond the signal from the point in time T234 pulled into the station (travelling southbound), the train was at all times beyond the signal, unlike the standard model for a SPAD whereby the front of the train passes the signal.

It was agreed this should be treated as a SPAD, as the aspect was red as the train moved northbound, even though the trainstop did not operate. A SPAD is defined in LU as follows:

Signal Passed at Danger. The term used to describe an incident when any part of the train has passed a stop signal at danger. This applies even if the tripcock has not been operated or the track circuits ahead occupied. (Standard 5-454 ‘Competence Assurance for the Management of Train Operators’).

1 Confirmation Bias as a concept was developed extensively by Peter Cathcart Wason (a cognitive psychologist) in the early 1960’s.

Page 10 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

5.4.2 Trainstop Operation. The panel reviewed why the tripcock on the train was not activated when the SPAD occurred. The Panel recognised two possibilities; either the train was tripped and subsequently reset by the T/Op, or it was not tripped during the SPAD.

In the first case, the T/Op would have to reset the tripcock and have to wait for the ‘Speed Control After Tripping’ (SCAT) equipment to time out (this is a period of three minutes). Observations from the CCTV indicates that the T/Op proceeded at a speed considered to be greater than 8mph as the train left the station, and this occurred two minutes after the initial move forward; therefore, the panel conclude that there was not sufficient time to reset and wait for the SCAT to time out; additionally there was no evidence that the reset seal had been tampered with (on the trip reset equipment). This option was rejected.

The second possibility involved the train not being tripped; this can be possible under the following circumstances. The train made the first shorter move, which allowed the leading wheel to cross the blockjoint and enter the next track section. On Bakerloo Stock (1972 Tube Stock), the tripcock is set back from the leading edge of the cab by slightly less than 2m. Therefore as the train came to rest following the first short move, the tripcock did not make contact with the trainstop actuation arm.

With the wheel entering the next track section; (and due to the automatic priming of the BD10 trainstop release circuit), the trainstop would have lowered. Therefore, when the train made the second move with the aspect of BD10 at red, it was not tripped and was allowed to proceed along the track.

The panel believes that the second option is the only feasible explanation due to evidence precluding the first option.

5.5 Procedure.

The panel discussed the content of the documentation relating to reversing moves at Paddington, as contained within the line supplement and training documentation (see 3.2 above). It was noted that the process did not set out the requirement to move up to the further stopping position when the Train Operator is not informed of the need to undertake a reversing move prior to stopping at the normal position.

Certain other issues on the process for reversing were examined in detail; it was noted that the need to detrain passengers, although not required by the procedure, was considered the best option. In this incident it was fortunate that the T/Op had decided to detrain prior to the move.

A review of the content to establish clearer guidance was seen as being necessary.

Page 11 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

5.6 Communications.

During the investigation interview the Service Controller reported that he had experienced difficulty in contacting the T/Op via the train radio system. The Bakerloo Line operates the Connect radio system, which for a train comprises of the train mobile unit and a portable hand-held radio. Use of this system requires the T/Op to enter the train running number (3 digits) into the train mobile Connect unit. He is also required to enter the identification number of the personal issue hand-held portable radio (5 digits) as part of the log on procedure prior to operating the train.

In this incident it appears that the T/Op did not follow the correct log-in procedure for either the train mobile or hand-held unit. This was most likely due to the human factors issues set out above in 5.2.2. It was considered probable that the T/Op logged into the train unit when the train was moving; attending to this may have been a factor in his not being aware of the route taken, as the train did not cross the points as required by the reversing move.

The panel discussed the functionality of the Connect radio system in comparison to the previous system known as the ‘legacy system’. In correspondence with the Connect Project Manager, it was noted that there was an important difference in the operation between the two. On the Legacy system the train radio becomes live when the train control switch is operated. On Connect, it is necessary to log the train running number to receive and make calls (other than Mayday alarm operation).

Therefore, on trains installed with the Connect radio system, it is possible to set off without being in radio communication with Service Control. It appears that for a period of time this occurred during this incident.

Therefore the Connect radio is by design more subject to human errors that can cause situations where no radio contact exists when a train is operating. This situation has, to date, been mitigated by training and procedures which require the T/Op to undertake the log-in procedure. The Connect Project also reports that due to changes in design to link with the modern Train Management Systems (TMS), which exist on some lines (and will be introduced to the Victoria and SSR lines in the future), that an auto-login system will remove this condition from all lines except the Bakerloo. However, there will still remain a requirement to log into the TMS system. As such this will not eliminate the potential for human errors of this nature as trains can be moved without logging onto the system.

5.7 Signage.

The panel reviewed the level of signage used as prompts to a T/Op undertaking this move; it was noted the forward ‘S’ mark was missing on the incident day. It was also noted that under the conditions on the day, an illuminated sign on the headwall with the legend ‘Shunt and Reverse’ did not operate. This is because the ‘Shunt and Reverse’ sign only lights up when the site is taken out of auto through working for a

Page 12 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington, timetabled reversing move, illuminating prior to arrival of the timetabled train and not when the site is switched to manual. For the case of the incident train, the site was still in auto-through; as such, the shunt and reverse sign remained extinguished.

5.8 Previous similar incidents.

The panel reviewed a number of previous investigations into other ‘unauthorised wrong direction moves’. There was not an obvious set of factors shared by these events, other than some elements of human factors and disorientation. No previous recommendations were seen as being applicable to this investigation.

It was noted that there had been an increase in the number of these incidents over the last two years on the network, and that further work to understand this trend should be considered.

5.9 System Issues.

In 5.1, the particular issues associated in berthing trains at this site were considered. A number of technical issues relating to these were reviewed by the panel as below:

5.9.1 Overview. The wrong direction move was initiated by the less than satisfactory site-specific conditions existing at Paddington. In particular the introduction of OPO and the requirement to have accurate stopping points to maximise sighting of platform CCTV and mirrors. The interrelationships between the required stopping points, the train length, the platform length and the need to reliably view OPO as well as signals at either end of the platform, resulted in a compromise for a solution. Mitigation in the form of a reversing stopping mark and an Operational procedure was implemented to address the residual risk; however, errors are likely with systems and/or routines that are formed in such ways. In the case of Paddington, the initial error of not driving up to the correct stopping mark, led to a series of errors by the T/Op. In addition, the specific signalling arrangement on BD10 trainstop provided a small window of opportunity for the trainstop head to lower following a slow-speed SPAD at its associated signal.

5.9.2 Multiple Stopping Marks. The existence of more than one stopping mark is unsatisfactory. It gives rise to confusion and increases the likelihood of human error. In most cases this is insignificant; however, with site-specific conditions as experienced at Paddington, the inconsistencies in the infrastructure contribute to the risk of T/Op error. As part of the inquiry, the panel visited Paddington. Noting the dependency on OPO requirements, it was concluded that it would be technically feasible to establish one accurate stopping mark on the southbound road. This would have the effect that the north-end cab of a berthed train would always be south of the reversing move starting signal BD10, and sighting of its aspects could then be reliably achieved.

Page 13 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

5.9.3 OPO equipment Implementing this change would obviously impact on the OPO requirements, and in particular the need to view the OPO equipment reliably. Again, from the site visit, it was noted that it was technically feasible to replace the existing high level monitors on the southbound headwall with flat screen ones that could be reliably observed through the droplight window.

5.9.4 Modification to signalling arrangements Whilst the above mitigates against human error and the risk of a SPAD occurring in the first place, the circumstances of BD10 trainstop release circuit, which provides a small window of opportunity for the trainstop head to lower following a slow-speed SPAD at its associated signal is unsatisfactory. Metronet was asked to review this particular signalling arrangement at Paddington, and any similar arrangement on the rest of the Bakerloo line, to identify why the incident train was not tripped, and develop a signalling modification solution to eliminate the risk of recurrence. A signalling review has identified that it would be feasible to modify the trainstop release circuit for BD10, and a draft signalling design is currently in progress.

5.9.5 Options for switching out of auto control / short-term fix As engineering solutions described above will take some time to implement, the panel recognised the need to investigate whether the existing procedural mitigation in place at Paddington could be strengthened by any low-cost short-term modification to the control room software at Baker Street. Metronet was asked to look into the possibility of removing the ‘auto through’ facility, forcing BD10 signal lever to return to the normal position following every train, thereby disabling the priming of BD10 trainstop and the risk of it operating in conjunction with a slow-speed SPAD. This has been deemed to be possible, and is being implemented on a temporary basis until the signalling trainstop release circuits for BD10 can be modified.

5.9.6 Review of similar sites (a) LU survey At an early stage of the inquiry, LU ED issued a briefing paper to both Metronet and Tube Lines as to the initial findings, and in particular the potential risk associated with the specific signalling arrangement at Paddington.

Against risk criteria described in that paper, LU engineers undertook an initial inspection of the sites that exhibited similar characteristics to those at Paddington. From those inspections, only one other site, Hyde Park Corner on the Piccadilly line was found to have similar features. This information was passed to Tube Lines, who was asked to consider any short term engineering risk mitigation that might be possible.

(b) Metronet survey Following receipt of the briefing note, Metronet undertook to carry out a survey of sites which have the potential to exhibit similar risks to Paddington. The survey is primarily focused on sites which have auto working, king lever operation or are

Page 14 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington, controlled by power frames. This survey is now completed and a detail response is awaited.

5.10 Track Inspections and Stopping Marks.

The missing stopping mark for the reversing move had not been identified, either during track inspections by Metronet Track staff, or by Duty Manager Trains (DMTs) undertaking Planned General Inspections (PGIs). The panel considered who had responsibility to identify that all essential signage on the track was in place.

The panel discovered that the responsibility for maintenance of stopping marks lies with the Permanent Way Engineer, although the initial positioning of them traditionally rests with the Signal Engineer. Their correct implementation is confirmed at commissioning through operating agreement, and more recently sighting parties/committees. The asset information should then be passed over to the track engineer or manager (in this case within Metronet) to implement a maintenance regime in accordance with standards.

It was found that in the majority of instances, ‘stop marks’ are depicted on signalling scale plans; however, there are also some sites where this is not the case.

In addition, it is believed that the introduction of OPO and the need to achieve accurate stopping to minimise the passenger train interface risk has led to some improvements or fine-tuning being undertaken, predominantly on behalf of the Operators. Furthermore, it is doubtful that where accurate stopping is required (as in the case of Paddington) that the traditional stop mark, in practice, achieves that aim.

So whilst the introduction of the green and yellow chevron style accurate stop mark on some tube tunnel lines is clearly of benefit, it doesn’t appear to have any technical standard that governs it. They are not defined on signalling scale plans, nor are they maintained by track maintainers. Indeed, where there is both a chevron and a track mounted diamond, there is a question over which should take precedence.

Given the potential for misunderstanding and confusion, there is a need for review of the principles for the criteria for, and positioning of, stop marks, including ownership, recording, and maintenance where critical for system operation.

5.11 Evidence Collection.

During the investigation, two areas of evidence were not readily available; these were:

5.11.1 Connect data logs. Evidence from the interviews indicated that the T/Op had set off in the train without logging on to the Connect radio system. Although recording logs were made available of the radio conversations, the log which records data events was not available; this would have confirmed the late logging in of the T/Op.

Page 15 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

The panel were informed that the Connect retention of data issue had been raised before from a previous investigation and the requirement to do this was entered on LUSATS and had now been agreed; unfortunately the time to implement this change from this agreement had been excessive, and at the time of the incident, six months after the LUSATS action was initially targeted for completion, the change had not been completed. This action is logged as 631.1.10 on LUSATS, has now been extended and remains open with a target date of September 2008.

5.11.2 CCTV Station recordings. Obtaining the CCTV download of camera recordings from the platform was found to be a long and complicated process. Paddington utilises the electronic style recording, being introduced throughout the system, as opposed to the traditional VHS style cassette tapes. Firstly, obtaining the disc with the recordings required SQE staff to make enquires following the Operational staff efforts; the delays in obtaining this stemmed from the British Transport Police (BTP) initially listing the download as crime related.

Once finally received, the disc with the recording was unplayable on all company computers and DVD players. A member of the panel took it to the CCTV Manager in Albany House, and still the disc was found to be unplayable. On the recommendation of the CCTV Manager this was then taken to Goodge Street police station where finally it was viewed using the BTP video suite; who were able to save the recordings in a format playable on standard DVD players. The visit to the BTP took place on March 5, 2008; one month and one week after the incident, the images were finally available for the full investigation panel to review.

The panel agreed that these format and availability issues were a hindrance to the progress of the investigations and it was noted that similar concerns had been raised on other occasions when CCTV had been required to view incidents by Station and Train staff for local investigations.

The investigation panel raised these issues with Hawkeye (the BTP unit responsible for provision of CCTV recordings from the electronic recording equipment). It was discovered that there were a number of different recording systems used on London Underground, and these required various software packages to play back the images. Usually when Hawkeye send out these discs the appropriate software is attached to facilitate playback. This was not the case with this disc.

However, there are limitations on playback; these discs cannot be played on LU networked PCs; and only work on stand-alone PCs. The panel found that the Operational managers involved in the investigation were not aware of this limitation. It was also agreed that a more flexible approach is required to facilitate viewing of discs remote from station equipment and by managers undertaking both FIR and local investigation; or clarifying minor events involving their staff and assets.

Page 16 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

6.0 Immediate, underlying and root causes

The causes for the incident are set out in appendix 04 – ‘root cause analysis chart’ where the relationship and structure to reach the root cause can be seen more clearly.

6.1 Immediate Causes: . The immediate causes of the incident were as follows:

(a) A reversing move was required at Paddington. (b) T/Op moved the train (twice) prior to the route being set (causing a SPAD). (c) The incident train did not trip when the SPAD occurred.

6.2 Underlying Causes

The underlying causes of the incident were: (a) The Bakerloo Line was suspended from Paddington to Elephant and Castle due to a fire alert. (b) The T/Op could not see the aspect from the north-end cab. (c) The T/Op set off in the cab without seeing the aspect of the signal and he believed the route was set. This occurred because he had not berthed at the correct stopping position; and he believed his first move had changed the aspect of the signal from green to red. Contributory factors which influenced his behaviour included missing signage, and placing himself under pressure due to the perceived delay caused by being locked out of the cab. (d) The first move of the train led to the trainstop lowering, due to the blockjoint being crossed and the automatic operation setting of the signalling.

6.3 Root Causes Both of the root causes identified are interdependent; if the first root cause did not exist, the human errors of the second would not have led to the UWDM.

6.3.1 The design of the stopping positions and the signalling system in the area were not sufficiently robust to prevent this UWDM.

6.3.2 The T/Op made a number of human errors throughout the incident; there were contributory factors which may have influenced him in this.

Page 17 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

7.0 Recommendations

The intended output of these recommendations is to address the root causes and the other important issues identified by the investigation.

Root Cause 6.3.1

Context: The requirement to move forward to do a reversing move can be removed by undertaking this modification, and risk from human error in undertaking the procedure will be greatly reduced.

Recommendation 1 Action: If it is technically possible, remove the need for multiple stopping positions at the station and locate a single stopping position, such that the rear of a train is out of the tunnel; the view of BD10 is not occluded and the requirement to move up for reversing moves is no longer necessary.

Accountable Manager: Ian Hart (The Communications Engineer).

Timescale: To be completed by January 18, 2009.

Verification Activity: LU ED (Signals & Communications) to ensure that modification is subject to company standard assurance requirements. ______

Root Cause 6.3.1

Context: The current design of the signalling at Paddington and the position of the trainstop actuation arm in relation to the leading wheel on Bakerloo Line stock meant that the incident train was able to SPAD without being tripped. Modification to signalling and signalling control can ensure this does not happen again.

Recommendation 2 Action: Review and implement controls to ensure that BD10 trainstop does not lower under similar conditions to the incident. There are two stages required for this recommendation: The first stage 2(a) is a short-term requirement which would no longer be required once recommendation 2(b) is completed.

2(a) – The implementation of a short–term software (data) modification at the Baker Street Control Room, to render the auto-through function for Paddington inoperable.

2(b) – The implementation of a signalling design modification for BD10 trainstop release circuit to eliminate the hazard of a train not being tripped following a SPAD at BD10 signal.

Accountable Manager: Malcolm Dobell Train Systems Engineer (ED)

Page 18 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Timescale: To be completed by September 15, 2008.

Verification Activity: LU ED (Signals) to ensure that modification is subject to company standard assurance requirements. ______

Root Cause – N/A

Context: The investigation encountered problems in firstly obtaining the CCTV images of the incident and then the ability to view these images. The station has an electronic based recording system, which requires provision of images by the BTP Hawkeye team. Both in this case and on many other occasions the viewing of discs from the team has proved problematic.

Recommendation 3 Action: 3(a) To review the current procedures and practices for the acquiring of CCTV images for operational management purposes and Incident Investigation. On completion of the review to produce and issue procedures/guidance as required for company-wide use.

Accountable Manager: Kevin Clack (Senior Development Manager) – Operational Security.

Timescale: To be completed by October 30, 2008.

3(b) – Review, in consultation with company information technology providers, methods to enable the viewing of CCTV images within the SQE Incident Investigations team office. Output from this review to be presented to the SQE General Manager Operations for consideration.

Accountable Manager: Peter Wickham (SQEM Investigations).

Timescale: To be completed by October 30, 2008.

Verification Activity: Findings from both reviews to be sent to the Action Tracking Manager and SQE General Manager Operations on completion. ______

Root Cause – N/A

Context: The review of previous similar incidents, although not revealing many common factors did indicate an increase in these incidents over the last three years, which is not explained by the individual FIRs.

Page 19 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Recommendation 4 Action: Set up a small team to review all incidents of UWDM, occurring on the system over the last three years, to ascertain common factors and make recommendations on these findings.

Accountable Manager: Peter Wickham – SQE Investigations Manager (LU).

Timescale: To be completed by December 31, 2008.

Verification Activity: Output report to be submitted for review by SQE General Manager Operations. ______

Root Cause – N/A

Context: Whilst the incident occurred at Paddington on the Bakerloo Line, there may be similar physical characteristics/risks to Paddington elsewhere on the network.

Recommendation 5 Action: Survey all stations that exhibit similar risks to Paddington and which require similar shunt moves for reversing; provide options for technical modifications including the removal of second stopping marks where possible. Metronet has completed their survey, Tube Lines need to undertake the survey for their areas of responsibility. All findings and proposed remedial actions required, presented to the relevant engineering authorities in the Engineering Directorate for endorsement.

Accountable Manager: Ged Neacy (ED Signals).

Timescale: Completed by September 15, 2008.

Verification Activity: All changes subject to ED process control. ______

Root Cause – N/A

Context: The failure of the T/Op to logon to the Connect radio meant that Service Control were not able to contact him when the train departed Paddington. If this radio contact had been possible, the train could have been stopped earlier (the train would not have travelled so far in the wrong direction). On the previous ‘legacy’ radio system it would have been operational, as the radio became live with the application of the train control key. With the Connect system, while there is an indication in the cab to confirm to the T/Op whether or not the system is logged on, it is possible to move the train without the radio being live. The transfer of asset/procedural requirements from outgoing to replacement specifications does not appear to be comprehensive in its application.

Page 20 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Recommendation 6 Action: The inability to contact a T/Op who has not logged onto the radio system, but is operating a train is a reduction in the level of safety from that provided by the older ‘legacy’ system. The following shall be undertaken to ensure that associated risks are mitigated.

6(a) Review the options for ensuring that Connect radio is functioning at all times a train is in operation on the Bakerloo Line, and implement ALARP solutions to ensure no loss of safety related function exists in relation to the previous radio system. This review should also consider other lines where this functionality exists.

Accountable Manager: Stuart Harvey – Connect PFI Project Manager.

Timescale: Completed by December 31, 2008.

Verification Activity: Completed review shall be provided to Action Tracking Manager and SQEM Investigations (consideration shall be given to entering output actions from the review on LUSATS).

6(b) Review the adequacy of LU’s assurance arrangements in respect of loss of functionality arising from changes to assets, processes or practices.

Accountable Manager: Cathy Behan (GM SQE Contracts).

Timescale: Completed by September 30, 2008.

Verification Activity: Review findings to be provided to Action Tracking Manager and SQEM Investigations. ______

Root Cause – N/A

Context: The current procedures do not include the situation where the T/Op is informed that a reversing move is required after berthing at the normal position, and without the indication provided by the illumination of the ‘shunt and reverse’ sign.

Recommendation 7 Action: Review the procedure(s) for reversing moves at Paddington and revise to clarify moving up to second mark if the requirement to reverse is received after berthing. Note this is a short-term mitigation which will be superseded by the completion of Recommendation 1.

Accountable Manager: Steve Senior – Line Standards Manager, Bakerloo Line.

Timescale: Completed by November 30, 2008.

Page 21 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Verification Activity: Line SQE Adviser to review revised procedures against requirements of this report. ______

Root Cause – N/A

Context: In reviewing the provision of stopping positions on the system, it became clear that there is no guidance on which method takes priority, and why both the traditional track mounted stopping marks and the green and yellow-style chevron type are both required.

Recommendation 8 Action: A review to clarify the company requirements for stopping marks to be undertaken, leading to the production of revised standards/guidance setting out the requirements. This review shall consider: operational use of the stopping marks, their ownership, their maintenance, the requirement for more then one type, the positioning of them and the maintaining of site drawings and records.

Accountable Manager: Malcolm Dobell Train Systems Engineer (ED)

Timescale: Completed by January 18, 2009.

Verification Activity: Completed review to be provided to Action Tracking Manager and SQEM Investigations. ______

8.0 Appendices:

Appendix 01 - Incident timeline.

Appendix 02 – Signal Plan Paddington

Appendix 03 – Photographs.

Appendix 04 – Root cause analysis chart.

Page 22 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Appendix 01 - Incident Timeline Time Event (Approx) 08:16 Control Room staff deal with a report of smouldering in the tunnel between Charing Cross and Piccadilly Circus. 08:22 Train 234 (incident train) enters Paddington Southbound platform.

08:23 Train 214 enters Warwick Avenue Southbound platform.

08:25 Train 214 instructed to hold at Warwick Avenue.

08:25 Train 234 instructed by Service Control to reverse ‘south to north’ at Paddington, back to Willesden Junction, and then to Stonebridge Park. T/Op confirmed these arrangements. 08:27 T/Op of train 234 starts detraining and walks towards the north-end cab.

08:29 Train 234 moves forward (northbound) approximately the width of a car’s double doors.

08:31 Suspected SPAD warning appears for KB track at Paddington (signal BD10).

08:32 OPO Alarm received by Service Control and Controller requests train with car number 3562 to identify themselves (Incident train). 08:32 Train 234 moves off and leaves platform at line speed.

08:32 Service Controller notices Track 461b drop and realises that train 234 is travelling north up southbound tunnel and request that the Service Manager discharges traction current from Kilburn Park to Baker Street southbound. 08:32 Train 234 is instructed by Service Controller to ‘stop immediately’, T/Op responds to message, but Service Controller does not appear to hear the response; and repeats ‘stop immediately’ message. 08:33 Incident DMT is informed about the incident and makes way to Queens Park to meet assisting T/Op (2). 08:57 DMT and T/Op2 depart Queens Park in taxi en route to Paddington.

09:08 DMT and T/Op2 arrive at Paddington and make their way to the Bakerloo Line platforms. 09:10 DMT is briefed by station staff.

09:15 Having arranged protection, DMT and T/Op2 walk along the southbound track to train 234. 09:22 DMT and T/Op2 board the train and find T/Op1 sitting in the leading car.

09:27 – Train 234 is moved at caution speed to Paddington and on to Willesden 09:40 Junction.

Page 23 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Appendix 02 – Signal Plan Paddington.

Page 24 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Appendix 03 – Photographs.

Picture 1 – View of rear cab on southbound train when berthed.

Picture 2 – Existing OPO CCTV Screens (South Headwall)

Page 25 of 27 Final Report – 18001611 – January 25 2008. UWDM and SPAD Bakerloo Line, Paddington,

Picture 3 – Stopping position markers to side of cab.

Picture 4 – Stopping markers on track (normal position and replaced ‘S’ board).

Page 26 of 27

Appendix 04 Paddington UWDM and associated SPAD. T234 Unauthorised WDM FIR – Root Cause Analysis (resulting in loss of service).

Reversing move T/Op moved train (twice) T234 did not trip required at prior to route being set, Immediate Causes when it SPAD’d Paddington. causing SPAD at BD10. BD10

st nd Bakerloo Line 1 Move. 2 Move. Short 1st move of suspended Automatic (human) When T/Op viewed aspect T234 caused train- st Paddington to response to set off when from 1 car it was red, but stop to lower Elephant & Castle. in cab. he still decided to move. despite RED aspect.

T/Op assumed the 1st T/Op thought he Relative position T/Op could not see aspect T/Op had not T/Op did not Signalling in Auto Fire alert between T/Op believed (short move) had heard the Train of train-stop and of BD10 from cab. noticed aspect notice lack of mode permitted Charing Cross and route was set. changed the aspect stop rise as he left blockjoint permit when on platform. signal. the lowering. Piccadilly Circus. from Green to Red. the cab. this on the line. North end cab was in tunnel mouth, passed T/Op expected the The train did not trip, T/Op looking for signal. T/Op distracted by route would be set which provided the T/ RED aspect; did End. crowds on as some time had Op with confirmation Underlying causes not notice NO platform. passed from S.C of his assumption Design of aspect. initiating reversing about causing the signalling system Train was berthed too far move. signal to change. north at the normal Contributory factors; stopping position. 1. ‘S’ mark was missing. 2. The ‘Shunt and reverse’ T/Op convinced sign was not illuminated. T/Op did not move up to himself it was the reversing position okay to move. before changing ends.

Root Causes Contributory factors; Contributory factor. 1. The arrangement of two stopping positions Human error, T/Op due to being locked out complicates the process. Human error. Deficient design. of the cab, put himself under 2. T/Op did not know he would need to reverse prior pressure to move. to stopping.

Note: Recommendations 3, 4 and 6 were not related to the Recommendations Recommendations root causes of this incident. 7 & 8. 1, 2, 5.