Why would a train automatically derail if a signal is passed at danger?

Question

In a recent incident in London

Network Rail said an empty train had travelled past a red signal, which resulted in an automatic derailment. No one was injured. [link]

The derailment has caused quite a bit of damage, and a lot of travel disruption along this track.

My reading of the National Rail statement is that the derailment was a feature of the system, a response to the signal being passed at danger. While I'm sure it caused less damage than a train collision, it still seems dangerous and expensive.

Things like train stops, to trigger the brakes exist, or one could imagine diverting the train into a sand trap. Why weren't options like these used instead of derailing?

Answer 1

Firstly, the incident happened as the train was leaving a siding passing a shunt signal. These provide less authorisation than a normal signal does, even when they are not at danger (the train can permit as far as the line is clear or the next signal, there is no guarantee the track ahead is clear).

Now, in the UK, there are four train protection systems: AWS, TPWS, ATP, and ETCS. However, these are all primarily designed for trains on normal running lines, rather than those on sidings. I'll examine each of these in turn insofar as they protect signals:

AWS

The Automatic Warning System (AWS) is a simplistic system using magnets/electromagnets to signal an alarm to the train driver which must be acknowledged within 3–4 seconds or an emergency brake application is initiated, which per the rulebook they may not override. (It can be overridden through use of an isolating switch/cock, but without someone else in the cab one would be breaking the rules by leaving their seat to override it—regulations forbid the switch from being anywhere they can reach.)

Magnets are positioned 150–250m away from the signal, to give the driver a chance to view the signal before acknowledging it. In the case of a siding, it is assumed that the train will be parked there for some duration of time, and given sidings are normally roughly the same length as the trains that typically park in them, the train would not pass over a magnet if one were installed when leaving the siding. As a result, magnets are not installed for sidings.

TPWS

The Train Protection & Warning System (TPWS) is a comparatively modern system, dating from the 90s, which causes an emergency brake application when a train passes a signal at danger or when approaching a signal above a set speed (designed to bring any train to a stop within the "safe overrun distance", i.e., prior to any junction on the track). It was designed to be a cheaper to rollout solution than ATP (below), while stopping the majority of accidents ATP would stop.

In principle, it could be used to protect sidings, as given the typically low speed limit in sidings, one would typically be able to have only the loop at the signal, as the stopping distance would be short. It's largely not been used to protect sidings, likely because such incidents are rare, leading the cost/benefit to conclude it's not worthwhile.

ATP

Automatic Train Protection (ATP) is really a group of systems, two of which were installed in the UK as part of trials before a proposed national rollout, which ultimately never happened due to an estimated £1 billion cost. These systems are designed to prevent a train from ever passing a signal at danger.

Essentially, two systems developed elsewhere were installed: the Belgian TBL1 on the Great Western Main Line, including Paddington station; and SELCAB, which was a development of the German LZB, used on the Chiltern Line. Neither TBL1 nor SELCAB (nor LZB) has ever been used to protect sidings. (LZB especially is very expensive to install, as it requires a continuous wire along the track.)

However, trains operating on these lines are not required to have the systems installed (at least trains fitted with the equipment that run on the Great Western Main Line are required to be taken out of service if the system fails), and the train that derailed was not equipped with it (though obviously given the sidings not being equipped this isn't a cause).

ETCS

The European Train Control System is a system that is starting to be rolled out in the UK, currently only active on the Cambrian Line which was used as an experimental implementation. There's plenty written about this, but because it's not (yet) installed on the GWML I'm not going to discuss it here.

So… derailment?

A number of other mechanisms exist to protect the line. Traditional ones are catch points (where you have points to direct a train away from other lines that may be occupied, typically with some short section of track beyond) and derailers (designed to immediately derail a train, primarily used around places like depots where movement speeds are low).

In this case, the train passed over catch points which were set to protect the mainline. While derailing a train causes disruption, had it run into a busy commuter train the outcome could've been a disaster.

The other options you mentioned are train stops and diverting the train into a sand trap. Train stops are pretty much not used on mainline rail systems because the mechanical parts limit the possible speed of they can be used at limiting their use to low-speed track like sidings and depots, where incidents are relatively rare. A sand trap is essentially something you can put following catch points (and is something often used, or a sand bank) but this requires space for it, which in a congested area near to a station is unlikely to exist.

Ultimately, a lot of this comes down to cost/benefit of various solutions, and the fact that catch points have frequently been installed in such locations for over a century, and do avoid crashes in the rare cases when the signal is passed at danger. If somewhere frequently had signals passed at danger ("frequently" by railway standards, that is!), I would expect another approach to be used.

Answer 2

While I'm sure it caused less damage than a train collision

Exactly. This is a last-resort response intended to avoid a full-on collision.

A derailed train causes some damage and is a mess to clean up. A collision between two trains will likely cause much more damage, be even harder to clean up, and quite likely get people killed. It can also impact the surrounding area if hazardous chemicals were being transported. Derailing a train in a (somewhat) controlled way makes it much less likely that a tanker car, for example, breaks and spills its contents, compared to a much less predictable and more violent collision between two trains.

Triggering the brakes is a totally different mechanism that isn't as fail safe. For one thing, it assumes the braking system of the train is functioning. For another, it requires logic on the train to detect the problem. That's not so desirable if this logic on the train failed and is what caused the problem in the first place.

Derailing a train is a last resort, and as such needs to be fail-safe. It also needs to not be triggered except when all else has already failed. This condition needs to be independently detected, and then independently acted upon from the normal train systems. Automatic braking might be a reasonable safety system, but derailment by external means would still be a last resort when that didn't work for whatever reason. Basically, automatic braking and automatic derailment are two independent and different system, with the latter something you probably want regardless of what system is in place for the former.

Answer 3

Why derail?

If the train went past a red signal, then all of the other safety systems already failed! The method of last resort is to make absolutely sure that the train will not travel down the track. That is done by derailing it.

How did it get to this point?

The real question is how did it get to the point of passing a red signal? At that point, something bad is already happening, so without knowing which bad thing is happening, there needs to be one solution that can work for every situation. That is what was used here.

Answer 4

Why would a train automatically derail if a signal is passed at danger?

When the cost of derailment is lower than the cost of a train collision, and the possibility of train collision exists, then a train derailment device may be used.

A red signal means danger, stop. If a train continues past that point it is likely to encounter another train or similar danger, and result in a collision or uncontrolled derailment.

Controlled derailment costs:

• One damaged train and all its train stock
• Injury/fatality to those on train and those in derailment path

Train collision costs:

• Two damaged trains and all their train stock
• Train line/tracks unavailable for use until trains cleared
• Track damage
• Injury/fatality of those one two trains and those in path of uncontrolled derailments in both directions

Things like train stops, to trigger the brakes exist, or one could imagine diverting the train into a sand trap. Why weren't options like these used instead of derailing?

First, a train stop would not necessarily save the train. Once beyond a red light, the train is in danger of collision even if it does stop, as the oncoming train may not have enough warning to also stop, particularly in adverse weather conditions and around track bends.

Situations like this are very rare, and so the cost of upgrading all derailment devices to sand traps or spurs is even more than the cost of derailment. These devices are placed as a last resort, and are only used after several other systems have failed and a collision or significant damage/death is imminent.

In other words, the money to upgrade such devices to non-derailing safety catches is better spent on preventing them before they trigger than on saving the trains after they trigger.

Answer 5

A derailer is used rather than a device to trip the brakes because there is no guarantee there are any brakes to trip. These things are not intended to stop trains moving under power with their air compressors pounding and their brake reservoirs at pressure. They are intended to stop loose strings of cars which have started rolling and are headed for the main line.

Answer 6

It should probably be noted that this incident occurred on a section of multiple track railway just outside a very large passenger terminus. Based on the photograph linked to above, I'd estimate the train ended up close to Westbourne Bridge, at 51.518867, -0.183969. The signalling along this track is famous for its complexity, and had lead to at least one notable rail accident with multiple fatalities, the Ladbroke Grove rail crash in 1999.

As such there has obviously been a very high incentive on ensuring that the track arrangement in the area causes signals passed at danger to terminate safely and without any possibility of trains fouling other lines (the concept of flank protection), especially the main up and down lines carrying high speed trains. Evidently the track engineers decided that for this signal and for a train travelling at the speed that one was, that would result in a derailment of the train.

Answer 7

The short answer is because it's cheaper and there's less loss of life.

Let's look at a simple example. Now, I only really know about US trains, so forgive me if some of this doesn't translate exactly correct.

First a train can only go where the rails are. It's not an automobile where you can pull off to one side.

Usually there are "side lines" that allow trains to pass, or allow cars to sit without blocking traffic.

Signaling is two fold (mostly). There are the lights next to the track that signal, essentially, that the next segment of track is clear and to proceed. There are "in cab" signals in the engines that signal that the next segment of the path is clear and to proceed.

Different areas have different coverage with signals. Some well traveled lines have the nice in-cab automated signals. Some areas have the lights by the side of track.

Signals are places far enough apart that (with speed limits) a train should be able to stop before sitting the next segment

====|==<T=|=====|=<T==
    G     R     G

In that figure the R (red) signal should stop a train from entering the section of track that is occupied by a train. The G (green) signals that the next segment is clear.

====|<T==<T|=====|====
    G      R     G

This figure is an accident waiting to happen. The second train WILL run into the first (as far as the system is concerned).

Next, there are many safety system in place to make sure that the rails stay clear and there are no accidents.

 =================================\=/==========================
 ====|====T>=====|===========|=====X=====|=========|==<T=======
     R           R           R           R         R 
     5           4           3           2         1    

Let's say this is a normal track segment and were looking at the signals from the train headed left.

1. First, were all ready in an "high alert situation" because (for our example) <T should not be on that track. It's true it could divert at the junction but (for this example) that's not normal, the trains are too close and something is already wrong.

2. Signals are turned all Red. Meaning STOP NOW. Auto brake systems kick in.

=================================\=/========================== ====|====T>=====|===========|=====X=====|===<T====|=========== R R R R R 5 4 3 2 1

3. On crap, T> stopped, but <T isn't stopping.
4. Divert <T!!!! (note sometimes the diversion isn't possible)
5. Evacuate T> (note, not possible unless it's a passenger train)

=================================\=/========================== ====|====T>=====|===========|===<TX=====|=========|=========== R R R R R 5 4 3 2 1

6. OMG, It didn't divert.
7. Call emergency crews, get them to T>
8. A crash WILL happen. Do everything you can to minimize damage.

=================================\=/========================== ====|====T>=====|===||==<T==|=====X=====|=========|=========== R R R R R 5 4 3 2 1

9. Auto derailment at ||
10. No lives lost, Damage in money, crappy press, but no loss of life. Clean up crew is a repair crew not a hearse.

Some notes:

• Usually, an engine under power would not have this problem. They are basically set to stop at any serious failure.
• Wagons may have this problem. A train can be some loose wagons that got away from a rail yard. The brakes on wagons are like on semi-trucks it takes air pressure to disengage them, with no pressure they should engage. So if there moving without an engine there are no brakes.
• Trains usually take a very long time to get up to speed, and a very long time to stop. Miles, not feet.
• When trains are running in the same direction they can run closer together. The trailing train just has to be going slower than or at the same speed as the leading train.
• There is always enough distance between trains to stop, but in a crammed line, stopping may take several segments, and can be done at the same time. Train 1 slows and Train 2 slows. This allows more trains per line.
• With two trains going towards each other on the same line, you are supposed to keep enough distance between the trains that both can stop if the junction is missed.