Independent report

Summary of learning - 10. Management Assurance - v1. May 2024

Published 23 May 2024

1. Purpose of this summary

The purpose of this document is to provide a repository of some of the most important areas of learning identified in RAIB’s investigations to date, cross-referenced to relevant reports. It therefore provides a reference source for those looking to understand real-world railway safety issues and potential control measures.

When preparing this document, RAIB has selected those issues which:

• have recurred in different RAIB investigations
• have still to be fully addressed
• could be a factor in the cause of a fatal accident.

RAIB is aware that many of the issues raised have already been the subject of actions by duty holders when responding to RAIB recommendations or are in the process of being addressed. The inclusion of a topic in this document should not be taken to mean that no action has been taken in response to relevant recommendations. However, its inclusion indicates that RAIB considers that the issue still needs to be actively managed by duty holders.

The current status of each recommendation made by RAIB can be checked by reference to the Index of RAIB recommendations, and details of the actions taken are published by ORR.

It is not the purpose of this document to quantify the risk associated with each of the identified safety issues. Readers seeking to understand the overall risk of harm associated with various dangerous events should refer to RSSB’s Annual Safety Performance Report. This presents historical information on actual harm caused, and estimates of risk based on extensive modelling.

2. Overview

A vital component of any safety management system is its assurance regime. Successful assurance processes allow an organisation to monitor and review the effectiveness of its planned risk control measures and how they are being implemented in practice, as well as the integrity of the assurance regime itself.

Assurance may include reactive or proactive activities. These can take the form of site visits by managers, the monitoring and analysis of data, safety audits and inspections, and reviewing processes and procedures as a result of safety concerns being raised or following the investigation of incidents and accidents.

Effective assurance will also support operational safety decisions which may rely on an understanding of risk, which may in turn be linked to an understanding of the efficacy of existing risk control measures. This means that it is imperative that there is a complete understanding of how control measures work in ‘real life’, and any limitations or gaps that might exist.

For example, a rule or a process documented in a risk assessment may well mitigate a risk when properly implemented but not if what happens in practice varies from what is written down. This is sometimes described as the difference between ‘work as imagined’ and ‘work as done’.

Rules and standards are not followed for many reasons, and if the assurance regime does not identify this then the control of risk may be less effective, and safety decisions taken on incorrect assumptions. This represents a particularly concerning potential weakness in any organisation’s safety management arrangements because it may remain hidden until more effective assurance discovers it, or an incident or accident occurs.

A number of RAIB reports have identified deficiencies in the management assurance process in an organisation as an underlying factor in an incident or an accident.

3. Important areas for safety learning

3.1 Track workers

Work involving inspection and maintenance of the railway’s track, structures and signalling equipment takes place on and around the line. Some of this work may take place while trains are running and there is therefore a risk that the workers involved may be struck by a passing train. Safe processes and procedures are therefore needed to ensure that this risk is controlled, and the purpose of the management assurance system is to identify if these risk controls are being used and are effective.

RAIB has investigated several accidents where a company’s assurance processes have not identified that process and procedure were not being correctly followed and that risk was not being effectively controlled.

A track worker was struck and injured by a train near to Chalfont & Latimer station in 2022 (report 05/2023). Our investigation found that the track worker was not familiar with the location where they were working, and that the information provided to them was not sufficient to allow them to work safely.

The risk controls in place to mitigate against track workers being struck by a train included following defined rules and procedures and giving briefings about the location and system of work, which would be recorded in logbooks. RAIB found that the assurance regime had not identified non-compliances with some of these rules nor that the processes in place to ensure safety were not being followed. Assurance activities such as checking logbooks were not being undertaken, safety issues observed by managers during site visits were not being recorded and collated to identify trends, and compliance inspections did not take place in traffic hours when trains were running.

This lack of assurance meant that the ineffectiveness of control measures was not understood and that managers had an incomplete understanding of the risk of track workers being struck by trains on the network.

A track worker was struck and killed by a train near Surbiton in 2021 (report 05/2022. Our investigation examined whether having the work group undertaking multiple tasks could compromise risk controls and found that there was a lack of understanding of the risks associated with the way that the work was being carried out on site and how that could be effectively controlled. Although not a cause of the accident, RAIB also observed that the safety assurance processes put in place had not been effective at detecting non-compliant working practices or errors and omissions in important safety documents.

At Margam in 2019, two track workers were struck by a train and fatally injured (report 11/2020). Our investigation found that some of the planning and work practices were not compliant with the mandated processes and were unsafe.

RAIB found that there was no consistently applied process to monitor and improve compliance at a local level, that self-assurance activities had become more of a ‘tick box’ exercise and that safety information gathered locally was not fed into route level or national analysis. Overall, the investigation found that the management assurance system did not identify non-compliances and unsafe working practices, and that it did not trigger management actions to address them.

3.2 Working in depots

Railway depot operations, despite generally involving low-speed train movements, still present considerable risk. At Toton sidings in 2021, a rake of 22 wagons ran away (report 09/2021). The rake passed two red signals and was subsequently derailed by trap points.

Our investigation found that the wagons ran away as they had not been secured properly the previous evening. Staff at the sidings were not correctly applying elements of the rules and routinely left trains unsecured for short periods of time. Although safety tours, health checks and safety assurance site visits had taken place, this non-compliance and unsafe practice was not identified by safety assurance activities. RAIB recommended reviewing the arrangements for supervising, monitoring and auditing safety in yards and sidings.

At Tyseley depot in 2019, a train driver became trapped between two trains when one was moved towards the other as part of a coupling operation (report 09/2020). Our investigation found that unofficial walking routes were widely used at the depot and that, while various inspection, audit and safety assurance activities were taking place, most of these activities were not effective at detecting the extent of non-compliance with the safety rules which was occurring. They also did not address the underlying attitudes which tolerated these non-compliances.

At Dollands Moor in 2018, a train arriving at Dollands Moor freight yard struck a small buggy that was stationary on a level crossing. The shunter operating the buggy attempted to jump clear of the approaching train but suffered life changing injuries as a result (report 05/2019).

Our investigation found that a subway was provided, which could accommodate the buggies, but that the requirement to use it instead of the crossing had been removed from safety documentation. RAIB also found that only one of the two subways remained open and that the lighting did not work in the one which remained. As the use of this subway was not enforced, most shunters chose instead to drive across level crossings.

RAIB found that, at the time of the accident, there were no clear rules or processes defining where the buggies could be operated and that the arrangements in place for monitoring the safety of the site had overlooked the issue of using buggies on a level crossing without signal protection. RAIB recommended improvements in safety management arrangements including checking and supervising safe systems of work.

3.3 General operation

The accident in 2020 where a passenger train collided with debris washed from a drain onto the track near Carmont in Aberdeenshire resulted in the death of three people. Among other matters, RAIB’s investigation found that the assurance processes put in place did not highlight any areas of weakness in the implementation of extreme weather processes within route control centres.

Our investigation also highlighted that operational controllers did not have the skills and resources to effectively manage complex weather-related situations. RAIB recommended improving the management assurance system relating to the safety-critical function of the route control rooms to provide a more realistic assessment of the extent to which mandated safety systems were applied.

A collision between passenger trains at Salisbury Junction occurred in 2021 (report 12/2023). Our investigation found that the one of the three causal factors in the accident was low wheel/rail adhesion on approach to the signal protecting the junction. RAIB found that the risk of low adhesion associated with the leaf fall season had not been effectively managed and that the processes to inspect and to assess risk at the locations and the subsequent dissemination of the information had not occurred. This non-implementation of control measures had not been identified by any management assurance process.

RAIB found that a 2019 audit of another area of the country had identified the need to improve the competency and training requirements for one of the main roles involved in managing low wheel/rail adhesion, but that none of these recommendations were considered or applied within the area of the country where the accident occurred. RAIB also found that an audit had identified a lack of local tree and leaf fall management plans but that no action was taken before the accident to resolve this.

In 2020, a signal was passed at danger at Loughborough South Junction in Leicestershire (report 10/2020). A train formed of two locomotives and an empty, un-braked, multiple unit passed a signal at danger south of Loughborough station. The train was travelling too fast for its braking capability, and the braking applied by the driver was insufficient to stop the train from that speed within the available distance. RAIB identified that the operator’s management assurance processes did not detect a lack of compliance with its own safety management system in areas that resulted in the driver and shunter being inadequately prepared for the movement of the train.

4. Relevant RAIB publications

• Collision between a train and utility vehicle at Dollands Moor freight yard, Kent, 4 September 2018 (report 05/2019)
• Fatal accident at Tyseley depot, 14 December 2019 (report 09/2020)
• Signal passed at danger at Loughborough South Junction, Leicestershire, 26 March 2020 (report 10/2020)
• Track workers struck by a train at Margam, Neath Port Talbot, 3 July 2019 (Report 11/2020)
• Runaway and derailment of wagons at Toton, Nottinghamshire, 17 January 2021 (report 09/2021)
• Derailment of a passenger train at Carmont, Aberdeenshire, 12 August 2020 (report 02/2022)
• Track worker struck by a train near Surbiton station, south-west London, 9 February 2021 (Report 05/2022)
• Track worker struck by train near Chalfont & Latimer station, Buckinghamshire, 15 April 2022 (report 05/2023)
• Collision between passenger trains at Salisbury Tunnel Junction, Wiltshire, 31 October 2021 (report 12/2023)