Case Notes · Rail operation
Five open doors
The isolation did not fix the fault. The safeguard was gone anyway.
A regional train in North West England cannot release its brakes at Styal station. On instruction from control, the driver isolates two safety systems, one of them the door interlock. The fault remains, the safeguard is gone. After 25 minutes at the platform the train departs with five doors open, while the conductor is still on the platform. No one was hurt. This case note follows the investigation report, shows three other courses of events and asks how the weak points can be noticed.
What happened, step by step
The drawing is my own simplified top view, not a reconstruction of the train: a three-car unit at the platform, above it the operator’s control, the signaller and the switches and lights in the leading cab. Times and events are taken from the report. Three scenarios show how things could have gone differently at individual points.
- Operator’s control (maintenance controller and duty control manager)
- Signaller
- Isolating switches EBS (brake circuit) and TIS (traction interlock), vertical when normal
- Light ‘safety systems isolated’
- Door interlock indicator on the driver’s desk
- Leading cab
- Rear cab
- Doors on the platform side
- Driver
- Conductor
What happened
-
A fault with no fault found
On 24 April 2023 the brakes of this unit would not release after the doors had been operated; then the fault cleared by itself. The depot could not find it, recorded ‘no fault found’ and released the unit back into service. On 3 May it occurs again at Alderley Edge and clears after almost twelve minutes.
-
Stop at Styal
The train arrives at Styal at 15:01, 18 minutes late. The conductor dispatches it from the door control panel in the middle coach and gives the ready-to-start signal. The driver acknowledges, but the brakes do not release.
-
Fault finding by phone
At 15:09 the conductor reaches the maintenance controller on a company mobile phone and steps onto the platform because of poor reception. The driver reports the fault to the signaller by train radio and is allowed to investigate it at the platform. Control does not establish which cab the fault occurs in. During fault finding the doors are released again.
-
Two isolating switches
Following control’s flow chart, the driver operates the EBS isolating switch, with no effect. The flow chart does not mention the TIS; for it, the maintenance controller obtains verbal authorisation from the duty control manager in a brief side conversation. With the TIS operated, the door interlock is out of action and the ‘safety systems isolated’ light is on, but the brakes still do not release. There is no written guidance for this situation.
-
The doors open
At 15:18 a passenger opens a door in the middle coach and gets off. The driver walks through the train checking circuit breakers, doors and passenger alarms. More doors are opened; at 15:24 five of the six doors on the platform side are open. The driver meets the conductor on the platform twice and does not mention the isolations.
-
Departure without dispatch
At 15:25 both decide on a final attempt. The conductor asks the passengers who got off to board again and does not expect the train to move, having not dispatched it. The driver runs to the leading cab. Within 30 seconds the brakes release. The driver sounds the buzzer twice, the reply normally given to the ready-to-start signal, and moves off.
-
The last safeguard
After about ten seconds the train reaches 3.1 mph (5 km/h). A low speed relay closes the open doors; it works even with the TIS isolated. The conductor is left behind on the platform. When the signaller stops the train, the driver confirms that all doors are closed and the conductor is on board. Only at Manchester Airport does the driver notice that the conductor is missing.
-
The chain behind the incident
On 25 May the fault occurred again during shunting, this time without any door operation. This allowed it to be traced to the leading cab: intermittent high resistance at relay contacts in the brake control circuit. According to the report, the brakes at Styal would have released from the rear cab.
Scenario A: The fault is located
A thought experiment based on the report: the facts come from the report, the different course of events is my conclusion.
-
Where does the fault occur?
Control confirms which cab the brakes fail to release in and asks for an attempt from the rear cab.
-
The brakes release
The fault affected only the leading cab. According to the report, the brakes would have released from the rear cab. The fault is located without isolating any safety function.
-
The door interlock stays effective
Control and the signaller decide what happens next. As long as nothing is isolated, the train cannot move off with doors open, even when passengers open doors and no one is thinking about them any more.
Scenario B: Isolation by the Rule Book
The steps come from the British Rule Book as summarised in the report. Not a complete procedure.
-
Report and wait for instructions
After isolating, the driver tells the signaller and the conductor that the EBS and the TIS are isolated. The driver moves only when instructed by the signaller.
-
Check again after every door release
The conductor checks all doors on both sides and goes to the rear cab. This is repeated every time the doors are released, including after passengers have got off.
-
Departure in a checked condition
The train moves only with all doors checked closed and the conductor on board. Passengers are detrained at the first suitable station; only the depot or an engineering technical inspector can reset the isolation.
Scenario C: The fault does not stay in service
A thought experiment based on the investigators’ first recommendation.
-
Assess the repeat
The brake fault of 24 April is assessed as a safety risk in service, not only as a cause of delay. According to the report, Northern made this classification by undocumented professional judgement; in the year before the incident, 10% of the faults reported on this class of train went back into service as no fault found.
-
An expert on board
The unit stays in the depot or runs with an engineering technical inspector on board, as Northern did after 3 May. If the fault occurs, someone with expert knowledge looks for it on the train, instead of the driver and control having to solve it by phone under time pressure.
-
Locate instead of isolate
On 25 May an engineering technical inspector attended the train and traced the fault to one cab; it was then repaired. No safety function had to be isolated in passenger service for this.
- Previous step
- Next step
- Play
- Pause
- Where the chain breaks
- Step
- Where the chain holds
Rail has other words for lockout/tagout
Lockout and tagout (LOTO) are not common terms among rail manufacturers and operators. The principle exists all the same, under other names and in three different places: on the vehicle in service, on the infrastructure and in the depot.
In machine and plant safety, lockout/tagout means: before maintenance, the energy is isolated, and the isolation point is locked with a personal lock and marked with a tag that names the person working and the reason. The comparison is meant for readers from machine and plant engineering; rail specialists will recognise the principle in the terms below. For the Styal case, the rail terms apply.
-
On the vehicle in service: isolate and bypass
The terms are isolation, isolating switch, cut-out and bypass. Isolating or bypass switches switch off equipment or safety functions when a fault occurs, such as the door interlock, the traction interlock or parts of the brake circuit. In Great Britain, how a train with defective or isolated equipment may continue is set out in the Rule Book (module TW5) under the heading Defective On-Train Equipment (DOTE).
-
In degraded operation: the fallback
The terms are degraded mode, degraded dispatch and out-of-course situation. They describe operation in which a technical safeguard is missing and procedures, reporting and safety-critical communications have to replace it.
-
On the infrastructure: isolate and earth
Work on overhead lines or conductor rails follows the five safety rules of EN 50110-1: disconnect, secure against reconnection, verify that the installation is dead, earth and short-circuit, and cover or fence off adjacent live parts. Added to this is the possession of the track. This is where rail comes closest to the lockout/tagout principle.
-
In the depot and at the manufacturer: secure against movement
Anyone working on a stabled vehicle secures it against movement and against energy being switched back on, and marks it, in Great Britain for example with a ‘Not to be moved’ board. Manufacturers describe safety functions, isolation options and fallback modes in the safety case under the rail standards EN 50126 and EN 50129 and in operating and maintenance documentation.
The decisive difference
Lockout/tagout removes energy so that a person can work safely on a machine. An isolating switch in service works the other way round: it switches off a protective function so that the train can move again. Afterwards people are not better protected, but less.
There is no lock and no tag. Their job is taken over by authorisation, reporting, checking and restoring. The table puts the steps side by side: on the left the principle, in the middle Northern’s rules as described in the report, on the right what happened at Styal.
| Lockout/tagout | Isolation in service (Northern) | At Styal |
|---|---|---|
| Authorisation | In service, the driver isolates only with explicit authorisation from the duty control manager. | Verbal authorisation in a brief side conversation while the maintenance controller was on the phone with the driver. |
| Lock | Isolating switches are operated with the driver’s key; only depot maintenance staff or an engineering technical inspector can reset them. | The isolation did not fix the fault and still remained in effect. |
| Tag | The ‘safety systems isolated’ light in the cab, form B, and telling the signaller and the conductor. | The light was on. No form B was completed, and neither the signaller nor the conductor was told. |
| Check | Before isolating the TIS the driver checks all doors. Afterwards the conductor checks all doors on both sides, again after every door release, and travels in the rear cab. | The doors were checked before the isolation. Afterwards five doors were opened, and the train departed without a new check. |
| Restore | Until reset, the train moves only on the signaller’s instruction; passengers are detrained at the first suitable station. | The train departed without instruction and terminated at its next stop, Manchester Airport. |
What the cab showed and what was really the case
What the cab showed
Both isolating switches were turned, and the ‘safety systems isolated’ light was on. The door interlock indicator on the driver’s desk stayed dark, as it always does at Northern: it lights only when the door control panel in the cab is switched on, and that panel is not used in the active cab. The cab showed nothing about the doors.
What was really the case
Five of the six doors on the platform side were open: two had been opened by the driver during fault finding, three by passengers getting off. Only the doors immediately behind the leading cab were closed, the last ones the driver saw before boarding. The conductor was standing on the platform.
My reading: the light shows that something is isolated, not what follows from it. An indicator that is always dark in normal operation cannot report anything in a special condition. And the buzzer reply that normally confirms a signal was given without any signal: where the display is silent, habit fills the gap.
The gap: degraded operation that no automatic system detects
The door interlock and the brake control protect normal operation. What they do not know, a person has to notice. Seven weak points from the report, each with my reading of how they can be noticed.
-
A fault that clears itself
An intermittent fault is often absent when the depot tests the train. ‘No fault found’ brings the vehicle back into service, and the train crew then carry the risk. Whether a fault counted as a safety or a performance fault was decided at Northern by undocumented judgement in the depot.
How to notice it: the same report on the same vehicle several times within a short period, and a share of no-fault-found cases that nobody analyses.
-
Fault finding without a location
The fault affected only the leading cab. No one checked whether the fault was tied to one cab, and no attempt was made from the rear cab. According to the report, the conversation between control and the driver fell short of good practice for safety-critical communications.
How to notice it: an instruction for fault finding does not ask where, and in which component, the fault occurs.
-
A flow chart with no way out
The ‘Unable to release brakes’ flow chart applied to all fleets, contained actions for diesel engines although the train was electric, ended with the EBS and mentioned neither the TIS nor the rules that apply after an isolation.
How to notice it: check every instruction against the real vehicle and ask what applies when the last step does not work.
-
An isolation that achieves nothing
Normally the TIS is the last step, and the train moves afterwards. Here the brakes still did not release. The protective function was gone and stayed gone, because only the depot or an engineering technical inspector could reset it.
How to notice it: the ‘safety systems isolated’ light is on, and the fault is still there. From this moment on, only the procedure protects.
-
Doors that open during fault finding
During fault finding the doors were released. Passengers got off, the driver walked through the train. Every door release makes an earlier door check worthless.
How to notice it: the Rule Book requires a new check of all doors after every door release. In the cab there was no indicator in use that would have shown open doors.
-
Dispatch without a degraded case
The British industry standard RIS-3703-TOM requires degraded dispatch modes to be assessed and defined. Northern’s dispatch plan contained nothing for this, neither for Styal nor for any other station.
How to notice it: the dispatch plan describes only the case in which everything works.
-
Habit replaces the reply
Two buzzers without a ready-to-start signal, a confirmation to the signaller without hesitation: the report describes how expectation and stress narrow perception. The driver had received non-technical skills training only during initial training.
How to notice it: degraded situations are taught, but not practised.
One automatic system did work: the low speed relay closed the doors at 3.1 mph (5 km/h), even with the TIS isolated. Anyone who authorises an isolation needs to know which protective functions still work afterwards and which do not. This belongs in the manufacturer’s information, in control’s instructions and in training.
The chain: from the depot to departure
My reading of the report along six links. The three focal points of this case note are links 03 (isolation), 04 (display) and 05 (degraded operation).
-
Release into service
A vehicle with a known but unidentified fault goes into passenger service. The decision rests on experience, not on documented criteria.
-
Remote fault finding
Flow chart and conversation have to fit the vehicle, establish where the fault is and offer a way out when the last step does not work.
-
Isolation
Anyone who switches off a protective function needs authorisation, a report to everyone affected and a check of the condition before the train moves.
-
Display in the cab
The display has to show the special condition and its consequences, not only that something is isolated.
-
Degraded operation
Dispatch with defective equipment needs an assessed, defined procedure, not only the rule for the normal case.
-
Training and communication
Degraded situations have to be practised, with clear leadership from control and safety-critical communications.
Questions for manufacturers and operators
The same questions apply to any installation whose protective functions can be switched off or bypassed when a fault occurs.
- Which protective functions does an isolating switch disable, and which remain effective?
- Who authorises an isolation, who has to be told, and how is this confirmed?
- What does the display show in a special condition, in everyday practice and not only according to the specification?
- What does the instruction say when its last step does not work?
- How is a no-fault-found case assessed before the vehicle goes back into service?
- Is dispatch with defective equipment defined and practised?
My work covers documentation and information design. Procedures, instruction and supervision in operation remain with the operator; inspection and conformity remain with the responsible bodies.
Source
Report 07/2024 of the British Rail Accident Investigation Branch (RAIB), ‘Unsafe movement of a train at Styal station, 3 May 2023’, published in July 2024, with a press release. I retell the case in my own words. The drawing is my own, simplified and not to scale. Scenarios, chain and readings are my interpretation, not findings of the report.
According to the report, Northern has since trained all maintenance controllers and duty control managers in safety-critical communications, is developing the flow chart into an electronic decision-making tool and has confirmed the leading role of the duty control manager. RAIB made three recommendations to Northern: on trains with known faults, on isolations in passenger service and on training for out-of-course situations.
Microlearning: test what you have understood (3 modules, 7 minutes each)