Thirty Centimetres of Safety: An Incident At Peckham Rye
In November 2017 a London Overground train came to a sudden halt just outside Peckham Rye station. It began a chain of events that would eventually lead to over eighty passengers standing at trackside while the electrical rail was still live.
At a quarter to seven in the evening on the 7th November 2017, a London Overground train (service 9N50) neared Peckham Rye station in south London. It had left Dalston Junction about twenty minutes before and, even at this late stage in its journey, was standing-room-only.
The driver was more than familiar with this particular part of the London railway network, having operated trains on the East London Line since its reopening in 2010. He had stayed with the line after the previous operator, LOROL, had given up this particular Overground franchise and moved to their replacement, Arriva. So far then this journey had been no different from one that he had carried out many hundreds of times before and, as he neared Peckham Rye station, he shut off power so that the train would coast smoothly in. About one hundred metres short of the platform, he began to gently apply the brake.
Four seconds later, to the surprise of both the driver and passengers, the train’s emergency brakes slammed on, bringing it to an abrupt halt.
As soon as the train stopped, the driver began to run through the normal cycle of error checking for such a situation. He checked to make sure he hadn’t missed a signal or driver prompt and then reviewed the driver’s displays for obvious errors. Nothing was immediately apparent.
Confused, the driver calmly opened up a radio channel and contacted the Arriva control room, known as ‘Strategic Command’ back in Swiss Cottage.
It was the first mistake of the day. One that started a series of mistakes that would, almost an hour later, lead to eighty passengers detraining onto the live railway.
With a few notable exceptions, almost all of the UK’s rail infrastructure is owned, managed and operated by Network Rail. This extends to signalling and, for this particular section of line, this means Network Rail’s Route Operation’s Centre (ROC) at Three Bridges in Sussex.
ROCs are high-pressure environments at the best of times, but even more so during the evening rush when even the smallest of incidents can quickly cause major problems elsewhere on the network. By 18:54 on the 7th November this was what one particular signaller was worried might be happening. In front of him, on the live signalling board, he could see that for nine minutes now 9N50 had been stopped just short of Peckham Rye station.
This was rapidly becoming a major problem. As 9N50 had approached the station the signaller had cleared the route in front of it, anticipating a speedy stop and departure from Peckham Rye itself. Something had clearly gone wrong though and both services behind and those waiting to cross the train’s path at junctions in front were now at a standstill.
What was doubly annoying to the signaller was that he had received no information about what was wrong from the driver of the train itself. Frustrated, he raised the issue of 9N50 with the Signalling Shift Manager. Both men suspected they knew what was happening. The rules said that, in the event of a sudden stop, the driver should immediately contact the responsible signaller and inform him of the reason for the delay (or at least confirm that it had happened). They guessed – correctly – that he had contacted the Arriva Strategic Command first instead.
Arriva Strategic Command had a maintenance engineer from Bombardier on site at key times such as this. Drivers knew that if a minor problem occurred with the rolling stock that they couldn’t immediately solve themselves, then the engineer would come on the line and talk them through more advanced problem-solving. Similarly, it was Strategic Command who would run through the general incident checklist with the driver and ultimately decide whether a train stayed in service or was withdrawn. From a driver perspective, the majority of decisions and information thus came from Strategic Command. Speaking to them first thus sometimes felt like a speedier way to solve the problem.
Both the signaller and Shift Manager would later tell the Rail Accident Investigations Branch (RAIB) that the signallers at Three Bridges had begun to notice that they weren’t always the first people the drivers called. This was a clear breach of standard operating practice, but perhaps because it had seemed more like an annoyance than a major issue, Network Rail had never cautioned Arriva for doing it.
Right now, however, it was more than just a niggling problem. It meant that for almost ten minutes Network Rail’s signallers had been in the dark about what was happening at Peckham Rye.
Annoyed, the Shift Manager contacted Arriva Strategic Command directly and told them to order the driver to report in.
A series of assumptions
The first person outside of the cab to learn about the brake problem on 9N50 had indeed been the duty Train Service Controller for South London at up at Strategic Command. It was he who took the call from the driver after his onboard diagnosis had failed. The driver told the Service Controller that he had come to a sudden stop “coming into Peckham Rye” but that everything was reporting clear on the monitors.
Arriva’s own procedures were clear on what should have happened next. At this point, the Service Controller should have spent two or three minutes going through a checklist of common issues with the driver. If that didn’t work, then the incident would be escalated to a more senior colleague, the Incident Response Controller.
Due to staff rostering issues, however, the Service Controller on duty that day was actually an Incident Response Controller ‘acting down’. As a result, he realised straight away that what the driver was describing was a more complex problem than the regular checklist would solve. So he skipped it and passed the driver straight on to the duty Incident Response Controller elsewhere in the control room.
It may be that both men thought that this would save time. It did, but it also cemented in place a dangerous assumption. From the driver’s brief description of what had happened the Service Controller mistakenly assumed that 9N50 was at least partially pulled in to the platform at Peckham Rye station. It was an assumption that running through the regular checklist would quickly have removed, but instead, this was passed on to the Response Controller as fact – something that train information control board at Arriva Control seemed to bear out.
What the Service and Response Controllers had forgotten, however, was that all their board confirmed was that the train was within the same track circuit as the platform at Peckham Rye, not that it was adjacent to it. At that time, there were in fact only two people who could confirm the precise location of the train – the driver, who was never asked again, and the signaller who (at that point) had yet to be contacted at all.
Without thinking to ask for more information, the Response Controller told the driver to start talking directly to the Bombardier engineer on duty and get the problem resolved.
A missed opportunity
When Network Rail’s signallers called Arriva control ten minutes later demanding to know what was happening, a resolution to the problem was still far from obvious. Indeed one of the reasons they still hadn’t heard from the driver was because he had been continuously in contact with the Bombardier engineer since then. The two men were still running through an increasingly complex series of fault-finding checklists without success.
It was now that a second opportunity to fix Arriva’s bad assumption about the train’s actual location arose, and was promptly missed. At one point during the attempted diagnosis, the driver spotted that the door interlock light wasn’t illuminated. This suggested that the train control software thought the cab door wasn’t locked, which would have triggered the emergency brakes.
The engineer suggested that the easiest way for the driver to eliminate this possibility was to “recycle the doors” – that is, open and close the doors along the entire length of the train. Confused, the driver told the engineer that he couldn’t do this as he wasn’t in the platform and he had passengers onboard. With this mistaken assumption apparently cleared up, the two men moved on to other things. Both believed that this would have cleared things up for the Response Controller too, as Arriva’s incident procedures stated that he should have been listening in on their call. What they had no way of knowing was that he had, in fact, not been doing so. With the diagnosis dragging on, he had quietly left the call to quickly deal with reports of a faulty radio on another train elsewhere.
The pressure builds
It was now that pressure began to build on both the driver and the control room team to get things moving again. Nothing the driver and engineer did, however, seemed to provide any clues as to the cause of the problem. Every test they ran came back clear, yet the emergency brakes stubbornly refused to release.
By now, the train had been stuck just outside Peckham Rye station for about fifteen minutes. As recycling the doors wasn’t an option, the engineer suggested that instead, the driver walk the full length of the train and check each door manually to make sure none were open or obstructed in some other way. The driver did so, which meant pushing through a crowded train full of increasingly frustrated passengers who demanded more information about what was going on. The driver was forced to tell them that he couldn’t say anything more than he had announced already – there was a fault with the train that was preventing them from pulling into the platform.
While he was out of the cab, the signaller tried – and failed – to get hold of the driver again.
Meanwhile, up at Swiss Cottage, things had escalated further. By now the Strategic Commander, who was in charge of the whole control room, was becoming increasingly concerned about the situation. Not wanting to interrupt the Response Controller or engineer, he contacted Network Rail’s own control room at Three Bridges to find out whether there were any known power issues in the area.
These were the men and women in charge of coordinating and managing all train movements cross-operator and the Strategic Commander discovered that they were not at all happy. They promptly replied that the power was perfectly fine, and informed him that their own signallers on the floor below still hadn’t heard from the driver directly.
As soon as he got off the call, the Strategic Commander told the Response Controller that he should order the driver to do this immediately.
No questions asked
The driver of 9N50 returned to his cab with no new answers but feeling increasingly stressed and isolated. Once again, he tried to release the brakes and once again the train refused to move.
He immediately contacted Arriva Strategic Command again, but this only made things worse. The conversation left him feeling like the control room staff no longer believed he was capable of solving the situation on his own. Indeed they had, in essence, told him to give up. He was to contact the signaller immediately, detrain his passengers and then drive the train in full manual override mode back to New Cross Gate depot.
Witness accounts differ over who at Arriva control gave the specific order for the passengers to be detrained. Two things, however, are certain: that the driver was ordered to do it and that it was absolutely the wrong thing to do. The train wasn’t in the station as Strategic Command now assumed and, as Network Rail had confirmed barely minutes before, the power in the area was still very much on.
If the driver had been in a better frame of mind he may well have finally realised, at this point, that something had gone terribly wrong somewhere and communications had become blurred. But he was stressed, isolated and lacked the confidence to object. He opted, instead, to simply trust that Strategic Command knew what they were doing.
He also lacked something more critical, which could easily have been provided – prior practical training in how to handle a crisis. Although Arriva (and the previous franchisee, LOROL) had provided plenty of documentation and classroom training on situations like this, the opportunity for drivers or control room staff to practice crisis skills in a real (or near-real) environment wasn’t considered necessary.
It wasn’t just the operators who were guilty of making this mistake. Network Rail had too. When the driver finally contacted the signaller the conversation was terse and limited, with the signaller making his annoyance and frustration at the situation abundantly clear.
It was an understandable reaction, but lacking any real training or experience in dealing with a situation like this the signaller failed to realise that his reactions were simply further increasing the risk that something was about to go very wrong.
The driver informed the signaller that he had been ordered to detrain. This was, perhaps, the last real opportunity for that mistake to be corrected. The driver told the signaller that he wasn’t in the platform and the signaller responded by asking the driver how he intended to detrain. The driver told him that he would bring the passengers up through his cab and out via its side door onto the track. If the power wasn’t turned off beforehand, this would mean that every passenger evacuated would have to climb down from the cab just thirty centimetres away from a still-live third rail.
Neither the driver, nor signaller, had any previous experience of evacuating a train this way. The last time the driver had practised any kind of evacuation at all was during his training in 2008. The closest the signaller had been to this situation had been an evacuation he had seen carried out in 1999. Nonetheless, both men should still have known what to do next.
The driver should have immediately asked for the power to be turned off and, if he failed to do so, the signaller should have proactively prompted him to do so. The driver didn’t – perhaps again trusting that if it were required Strategic Command would have asked – and the signaller simply signed off by tersely telling the driver that he should contact him “when you’re ready to move.”
It was a dangerously vague instruction, born out of frustration, and if the signaller had intended it to mean that the driver should call back when he was ready for the power to be turned off, then he failed. Instead, the driver thought that this simply referred to setting the signals he would need to take the train back to the depot.
As soon as the conversation ended, the driver contacted Arriva Strategic Command and told them he had now spoken to the signaller. The Response Controller immediately confirmed his orders:
A helping hand
The increasing scale of the disruption had, by this point, drawn the attention of others within the Network Rail facility at Three Bridges. More specifically, it had pricked the ears of the GTR Duty Manager, who sat just across from the Network Rail train controllers that the Strategic Commander had spoken to earlier.
Although that team shared a building with the signallers, they were not on the same floor. As a result, most of their information was actually coming from Arriva Strategic Command. From the conversations that the Duty Manager could hear, he understood that 9N50 might be stuck at least partially in the platform at Peckham Rye, but that Network Rail were struggling to get through to the driver themselves. Remembering that Peckham Rye station was actually managed by GTR, not Arriva, he realised that he might be able to help with this problem. He pulled up the general contact details for Peckham Rye station and put a call in. A member of GTR agency staff who had been staffing the gateline soon picked up.
The Duty Manager was aware that, as agency staff, the GTR staff member he was talking to was not trained to operate trackside but this didn’t seem to be an issue. He just needed someone to go to the platform, find the driver of 9N50 and tell him to contact the signaller at Network Rail urgently. Once he’d explained the situation, the agency staffer agreed and headed up to the platform.
A few minutes later, he checked in with the agency staff member again. Over the phone, the staff member informed him that he was now on the platform awaiting the arrival of 9N50. The GTR Duty Manager was slightly confused, but decided that he must have misheard the Network Rail chatter. He told the agency staffer to check in with him again once the train arrived.
A live detraining
Having received his instructions from the GTR Duty Manager, the agency staffer decided to move to the western end of the platform to try and get a better view of the incoming train. It was a cold, damp, dark night but as he moved closer to the platform end he finally caught sight of 9N50, sitting about thirty metres away.
It was now about ten past seven and, as he watched, he saw passengers exiting the drivers cab and, with the driver’s assistance, carefully climbing down to the ground below. Due to the distance to the ground, this meant that each passenger making the descent – which included both pensioners and children – had to jump down from the final step, passing within centimetres of the live rail as they did so.
An annotated close up view of the step and third rail positioning on a 378, courtesy of Arriva London. Distance A is approximately 30cm. At Peckham Rye there was no wooden separator board (see below).
Unfamiliar with evacuation procedures or advanced trackside working, the agency staff member didn’t spot anything wrong with this situation and assumed that the power to this section of line must be off. He did notice, however, that the driver was struggling to both help those detraining and manage the increasing number of passengers now standing trackside. Some of those were beginning to walk towards the platform whilst others were stepping over the live rail and crossing to the other side of the train so that they could take pictures and film what was happening. Behind them, separated only by a thin hedge, trains heading in the other direction continued to speed past.
Although he knew that he wasn’t trained for trackside, the agency staffer worried that the situation might be getting out of control. He decided to go and help the driver, jumping down and walking along the track towards the train.
Back at Three Bridges, the GTR Duty Manager’s sense of unease continued to develop. Across from him he could hear Network Rail staff and Arriva Strategic Command discussing what appeared to be an active detraining operation. Yet he had still not heard back from the agency staffer, who he had specifically told to call him as soon as 9N50 had pulled into the platform at Peckham Rye.
After ten minutes, he decided to phone the agency staffer again. He got through and asked for an update. The agency staffer explained that 9N50 wasn’t actually in the platform, but “approximately thirty feet” away from the station. He confirmed that the detraining was underway, however, and that he was now trackside assisting the driver.
The GTR Duty Manager instantly grasped the dangerous situation that was unfolding at Peckham Rye, unbeknownst to anyone within Network Rail or Arriva. Calmly, but loudly so that the Network Rail staff opposite would hear him, he confirmed the location of the train back to the agency staffer, then asked the staffer to immediately hand the phone to the driver.
The GTR Duty Manager instructed the driver to immediately halt the detraining because the line was live. He told him to reboard the train and contact the signaller again straight away.
Behind him, he could hear ripples of horror and realisation spread through the Network Rail control team, as they quickly informed Arriva Strategic Command that they were detraining their passengers onto a live line.
One last roll of the dice
Back on the train itself the driver halted the evacuation and told the remaining passengers to move back inside the main carriages. About four hundred remained onboard and they were now confused and angry as to why, after over half an hour onboard, eighty people had been allowed to disembark while they were being held back.
Having got the situation back under control, the driver contacted the signaller again and told him that he’d had to stop the evacuation as he’d been told the line was live.
“Yes it was.” The signaller replied, before telling the driver to do whatever he could to get the train moving again.
The driver contacted Arriva Strategic Command for help doing so, and was challenged as to why he had started to evacuate onto a live line. Trying to focus on the issue at hand, the driver asked for help to try and get the train moving. He explained that he had tried again, but the brakes still wouldn’t release. He was put through to an engineer again.
By this point, the Bombardier engineer the driver had been talking to before had finished his shift, and so he was forced to start the whole process of error finding again with the new man on duty. This eventually meant walking back through the train to check all the doors (and those on the rear cab) again. This the driver did, leading to several confrontations with, and verbal abuse from, angry passengers along the way. By this point they had been stuck outside the station for almost an hour.
On returning to the cab, the driver tried once again to release the brakes. This time, to everyone’s relief, they worked and the driver was able to finally move 9N50 forward into Peckham Rye itself.
Bombardier would later discover that the problem had been an overheated electrical relay, which was falsely causing the driver’s cab to report as empty. Although the driver and engineers had been unable to find and fix the problem, after an hour sitting outside in the cold it had eventually fixed itself.
In recent years, detraining incidents have often been the result of passenger disaffection or an unwillingness of those in charge of a railway incident to make a decision. This is something we wrote about in the aftermath of the Lewisham incident back in March, and will no doubt tackle again when the full RAIB investigation into that is completed.
What happened at Peckham Rye, however, shows that this isn’t the only way that detrainings can go wrong. This can also happen simply because too many assumptions are being made.
This isn’t exactly a surprising conclusion. Train operators and Network Rail are (in)famous for the reams of official notes and guidance documents that they put out both before and after incidents like this to ‘raise awareness’ and try and engineer out this problem.
What Peckham Rye highlights, however, is that this isn’t the way to solve the problem. Operational Notes and E-Learning don’t stop bad things happening in a crisis: people and experience do.
At Peckham Rye there were plenty of policies and procedures in place that should, theoretically, have prevented the incident from occurring. They were either ignored beforehand (such as the correct order of contact) or during the event when tensions were running high (such as the responsibility of the signaller to be proactive, not reactive, with the driver). None of those bad decisions were made from a position of malice. They were simply made because there was a fundamental lack of real-world understanding or experience as to why those procedures were important.
On the railway, real world incident experience, or even just practical (not digital) roleplay, matters. Without the opportunity to fail and learn in safety, people can only fail and learn in dangerous reality. Luckily, at Peckham Rye, this didn’t lead to a fatality. But there were at least eighty-two opportunities for that to happen before anyone noticed that things were going very wrong.
Peckham Rye also highlights that Driver Only Operation (DOO) isn’t just an easy way for operators to save on staffing. If you take the second staff member off a train then, by definition, you increase the cognitive load and responsibility on the driver during a crisis, whilst simultaneously robbing them of potential on-train support. There is little doubt that the Lewisham report will highlight the same.
Critics of DOO will point to Peckham Rye as further evidence that it is not a safe way of operating trains. This isn’t true. As with many things, the reality is far more complex than that. What Peckham Rye does demonstrate is that operators cannot see DOO as a consequence-free way to decrease staff overheads and operational complexity.
DOO may streamline day-to-day costs and operations for an train operator, but Peckham Rye shows that it also requires a far more complex approach to crisis management. That’s a problem that cannot be solved by throwing paper or policies at the problem. Peckham Rye shows that it will require some serious industry introspection and a genuine focus on staff knowledge, skills and experience too.
For different reasons, we suspect that the Lewisham report will show exactly the same.