Date: Thu, 01 Apr 2010 10:42:05 +0100
From: "Robert (Bob) Waixel"
Subject: Derailment of London Dockland Light Railway train, 10 Mar
2009

The following is based on a report issued by the UK's Rail Accident
Investigation Board (RAIB) but heavily paraphrased by the author.
Details
have been taken from:-
http://www.raib.gov.uk/publications/...port032010.cfm
http://www.raib.gov.uk/cms_resources...dia%20Quay.pdf
(RAIB Report 03/2010 issued March 2010)

Background

Docklands Light Railway (DLR) is an off-street rapid transit light
railway
system in London England (it is different from the London Underground
or
'Tube' system).

DLR trains are normally run under remote automatic computer control
(monitored by controllers) but from time to time are controlled by a
passenger service agent onboard, at times of so called degraded
working. At
the time of the derailment on 10 March 2009 this was the case, as the
automatic signaling had failed at a complex three way intersection.
The
person driving (for simplicity referred to as 'the driver' from now
on) was
being given instructions by a controller in a control room by radio.
When
being manually driven trains can only be driven at a very restricted
speed.

There are very few colour light signals on this railway since they are
not
needed when trains are being driven automatically. Points (US:
switches)
where lines diverge (or converge as in this case) have Point Position
Indicator (PPI) display lights (at ground level) to indicate their
setting. Such setting can also, of course, be confirmed by the
position of
the point/switch blades themselves.

In this accident the train ran through a set of trailing points at low
speed
and was derailed. There were no injuries and passengers were detrained
rapidly to an adjacent station platform.

Why did it happen?

The interest to comp.RISKS readers lie in the mix of factors that led
to the
incident, a mix of technical and human problems, including these:

* Major long term upgrade work on the whole railway caused the
signaling
in this complex trackwork area to fail for long periods thus needing
trains to be driven from onboard under manual control (giving a
heavy
sustained workload on controllers).

* A software change in the behaviour of interlocking of signaling and
these points, by the upgrade contractors had not been communicated
by the
upgrade contractor to the controllers.

* The controller did not fully follow correct procedure in authorising
the
train forward.

* The controller did not monitor progress of the train (controller was
busy
elsewhere) (their screen was switched to a different type of
display).

* The driver did not check the position of the points/switches for
their
intended route.

* that type of Point Position Indicator was hard to see by the driver
(management had postponed replacement of them as not being urgent).

* The bulb in the PPI had failed (replacement of failed light bulbs in
PPIs
wasn't considered urgent).

* The driver should not have crossed points without correct PPI
showing
(driver didn't notice that no indication was showing).

MESSAGES TO TAKE AWAY:

* Equipment that might not be safety critical in 'normal usage'
becomes so
in 'abnormal/degraded' working conditions

* People's workloads that might not be safety critical in 'normal
usage'
becomes so in 'abnormal/degraded' working conditions

* If it takes a lot of simultaneous failures for an accident to
happen, then
it will happen, sooner or later.

Robert (Bob) Waixel, MBCS, CITP, MCInstM, FHEA, Cambridge, CB4 1JL, UK

CJB wrote on 09 April 2010 09:07:59 ...
Date: Thu, 01 Apr 2010 10:42:05 +0100
From: "Robert (Bob)
Subject: Derailment of London Dockland Light Railway train, 10 Mar
2009

The following is based on a report issued by the UK's Rail Accident
Investigation Board (RAIB) but heavily paraphrased by the author.
[rest snipped]

And your point is? The RAIB report was issued a month ago, so it's old
news. Not sure why you are posting a "heavily paraphrased" summary by
someone at the BCS.

--
Richard J.
(to email me, swap 'uk' and 'yon' in address)

On 09/04/2010 09:07, CJB wrote:
When
being manually driven trains can only be driven at a very restricted
speed.

Aren't PSAs supposed to drive DLR trains on manual on Sunday mornings?

I thought that they would be able to drive them at speed.

wrote:
On 09/04/2010 09:07, CJB wrote:
When
being manually driven trains can only be driven at a very restricted
speed.

Aren't PSAs supposed to drive DLR trains on manual on Sunday mornings?

I thought that they would be able to drive them at speed.
yes, but there are 2 manual driving modes,
IIUI
in the one they use on sundays the computer still has some control which
wont let trains move if it has failed,
in emergancy shunt mode all computer systems are disabled allowing moves
to take palce at slow speed only that would otherwise not be permitted

On 10/04/2010 01:16, Daniel Smith wrote:
wrote:
On 09/04/2010 09:07, CJB wrote:
When
being manually driven trains can only be driven at a very restricted
speed.

Aren't PSAs supposed to drive DLR trains on manual on Sunday mornings?

I thought that they would be able to drive them at speed.
yes, but there are 2 manual driving modes,
IIUI
in the one they use on sundays the computer still has some control which
wont let trains move if it has failed,
in emergancy shunt mode all computer systems are disabled allowing moves
to take palce at slow speed only that would otherwise not be permitted
Thought that might be the case.

On Sat, 10 Apr 2010 01:16:15 +0100, Daniel Smith wrote:


yes, but there are 2 manual driving modes, IIUI
in the one they use on Sundays the computer still has some control which
wont let trains move if it has failed,
in emergency shunt mode all computer systems are disabled allowing moves
to take place at slow speed only that would otherwise not be permitted

I was once told that mode was 'assisted manual'. While a human is
actually driving the computer is still supervising and showing a 'target
speed' on the drivers instrument panel. If the target speed is exceeded,
the computer intervenes.

Emergency manual for when the computer/comms network is down is a
different beast and really is only intended to allow a train to be slowly
driven to the next station to allow the passengers off.


I seem to recall being told there were other modes as well, to deal with
various 'levels' of automation failure, so there are various levels of
'manual control' between emergency slow speed manual, and 'fullly
supervised manual'. I remember asking a PSA about this when they came
forward asked me to move and opened the panel - the next station had some
sort of transponder failure or something and while the automation was
bringing the train to a stand, it wasn't opening the doors. The PSA
pushed the door open button when the train came to a stand, locked up the
panel and went back to their usual spot near the door to 'flag' the train
off.
I seem to recall the drivers ATP display showing the target speed even
with the train in automatic, but I might be imaging that bit.