Microlearning · Module 1 of 3 · Isolation

Isolating is not securing

The light is on, and the fault is still there.

In machine and plant safety, lockout/tagout removes energy so that a person can work safely; rail does not use this term. An isolating switch in service switches off a protective function so that the train can move again. Using the Styal case, this module shows what follows for authorisation, reporting, checking and information.

About 7 minutes
4 questions with feedback
No sign-in; answers are not stored

Start the module All modules

What this is about

During a fault, a driver isolates two safety systems, one of them the door interlock. After this module you can, using the case:

distinguish the direction in which an isolation in service works from the direction in which lockout/tagout works,
match the elements of lockout/tagout to Northern’s rules for an isolation,
name which protective function still worked after the TIS was isolated and which did not,
select the information that has to be known before an isolation is authorised.

A note on terms: lockout/tagout and rail

Lockout/tagout (LOTO) comes from machine and plant safety. Before maintenance, a person isolates the energy, locks the isolation point with a personal lock (lockout) and attaches a tag that shows who is working and why (tagout). Among rail manufacturers and operators, these terms are not common.

Rail uses its own terms for related tasks:

Isolation, cut-out, bypass: switching off equipment or a safety function on the vehicle when a fault occurs in service.
Degraded mode: operation in which procedures, reporting and communication replace a missing technical safeguard.
Five safety rules and possession: disconnecting, securing and earthing overhead lines or conductor rails, and closing the track for work. This is where rail comes closest to the principle.
Securing against movement: protecting and marking a stabled vehicle in the depot, in Great Britain for example with a ‘Not to be moved’ board.

This series uses lockout/tagout only as a comparison for specialists from machine and plant engineering. Where the term appears, it means the principle, not a rail procedure. An isolation in service is not a lockout: it takes a protective function away so that the train can move. More in the case note, section ‘Rail has other words for lockout/tagout’.

Each voice is followed by a question, and an application task comes at the end. If your answer is right, you get more depth. If it is wrong, a hint shows where the answer is in the case note, and you get a second attempt; after that, the solution appears with the reasoning.

The three people are fictitious roles at another operator and at a train manufacturer, not people involved in the case. They speak about what the report describes; their view is my reading.

The scene

Operator’s control (maintenance controller and duty control manager)
Signaller
Isolating switches EBS (brake circuit) and TIS (traction interlock), vertical when normal
Light ‘safety systems isolated’
Door interlock indicator on the driver’s desk
Leading cab
Rear cab
Doors on the platform side
Driver
Conductor

Styal, 3 May 2023, after 15:09. The brakes of the train do not release. The maintenance controller guides the driver through fault finding by phone, following a flow chart.

The driver operates the EBS isolating switch, with no effect. For the TIS, which the flow chart does not mention, the maintenance controller obtains verbal authorisation from the duty control manager in a brief side conversation. With the TIS operated, the door interlock is out of action, the ‘safety systems isolated’ light is on, and the brakes still do not release.

The whole case in brief is in the overview of the modules. The drawing shows the situation after the isolation.

What isolating means here

Technical writer at a train manufacturer fictitious role, thought experiment

‘Isolating’ sounds like protection. On a train in service it means the opposite: the switch takes a protective function away so that the train can move despite the fault. Afterwards people are not better protected but less protected. When I describe an isolating switch, this direction has to come first, not in a footnote.

The report does not reproduce the manufacturer’s information. This voice shows how the case note reads the role of the manufacturer’s information.

Question 1 of 4

What distinguishes isolating the TIS in service from lockout/tagout?

Nothing fundamental: both switch something off and make the work safer.
Lockout/tagout removes energy so that a person can work safely; the isolation switches off a protective function so that the train can move.
The isolation is a shortened form of lockout/tagout, just without lock and tag.

That is not correct. In the case note, read the paragraph ‘The decisive difference’ in the section ‘Rail has other words for lockout/tagout’. Then try again.

Solution and explanation

Solution: b. The two work in opposite directions.

Lockout/tagout protects the person at the machine. The isolation in service takes a protective function away so that the train can move. There is no lock and no tag; their job is taken over by authorisation, reporting, checking and restoring. Information about an isolating switch has to name this direction, or the switch is read as a safeguard.

Rules instead of lock and tag

Maintenance controller at another operator, fictitious role

On the phone, an isolation is quickly said. At Styal, the authorisation for the TIS came about in a brief side conversation while the call with the driver went on. No form B was completed, and neither the signaller nor the conductor was told. The rules existed. But they only work when every step happens as a step of its own.

Question 2 of 4

Match each of Northern’s rules for an isolation to the element of lockout/tagout whose job it takes over.

The ‘safety systems isolated’ light, form B, and telling the signaller and the conductor
Isolation only with explicit authorisation from the duty control manager.
Until reset, the train moves only on the signaller’s instruction.
After every door release, the conductor checks all doors on both sides again.
Only depot maintenance staff or an engineering technical inspector can reset.

Choose from:

Authorisation
Lock
Tag
Check
Restore

That is not correct; at least one match is wrong. The table in the section ‘Rail has other words for lockout/tagout’ puts both sides next to each other. Then try again.

Solution and explanation

Solution: Authorisation — explicit authorisation from the duty control manager; Lock — reset only by the depot or an engineering technical inspector; Tag — light, form B and telling others; Check — a new door check after every door release; Restore — moving only on instruction until reset.

In an isolation, rules take over the job of lock and tag, and rules only work when they are followed. At Styal the light was on. Form B, the report to others, the new check and the instruction were missing.

What still protects afterwards

Train driver at another operator, fictitious role

Normally the TIS is the last step, and then the train moves. At Styal the brakes still did not release, and the isolation stayed in effect, because only the depot or an engineering technical inspector could reset it. From that moment on, only the procedure protects. And I need to know which technology still works and which does not.

Question 3 of 4

The TIS is isolated. Which protective function still worked at Styal afterwards?

The door interlock: it still prevented the train from moving off with doors open.
The low speed relay: it closed the open doors at 3.1 mph (5 km/h).
None: with the TIS, all door functions were switched off.

That is not correct. In the case note, read the step ‘The last safeguard’ and try again.

Solution and explanation

Solution: b. The low speed relay worked even with the TIS isolated.

With the TIS, the door interlock was out of action; the train could move off with doors open. The relay closed the doors only once the train was moving. Anyone who authorises an isolation needs to know which protective functions still work afterwards and which do not. This belongs in the manufacturer’s information, in control’s instructions and in training.

Before the authorisation

This task brings the three voices together. Imagine you are revising the information control uses to decide on isolating the TIS.

Question 4 of 4

What does control need to know before it authorises the isolation? Select all that apply.

Which protective functions the switch disables and which remain effective
Who can reset the isolation and what applies until then
That the ‘safety systems isolated’ light replaces telling the signaller and the conductor
What applies when the isolation does not fix the fault

That is not correct; at least one choice is wrong. In the case note, read the weak point ‘An isolation that achieves nothing’ and try again.

Solution and explanation

Solution: a, b and d. The light does not replace telling others.

The light shows only in the cab that something is isolated. The signaller and the conductor learn of it only when they are told. At Styal the remaining information was missing: the flow chart did not mention the TIS and said nothing about what applies after an isolation.

Apply it to your documentation

Think of a product in your documentation whose protective functions can be switched off, bypassed or isolated during a fault.

Your note. It stays on this screen and is neither sent nor stored.

Check the information about this function with the questions from the case note:

Which protective functions does the switch disable, and which remain effective?
Does it say at the start that the function no longer protects afterwards?
Who authorises an isolation, who has to be told, and how is this confirmed?
Who may reset it, and what applies until then?

The key points in three sentences

An isolation in service works the other way round from lockout/tagout: it takes a protective function away so that the train can move.
There is no lock and no tag. Authorisation, reporting, checking and restoring have to take over their job.
Anyone who authorises an isolation needs to know what still protects afterwards and what applies when it does not fix the fault.

Continue with module 2: What the cab showed

All modules

Read the case note

Basis and source

This microlearning does not replace instruction. Procedures, instruction and supervision in rail operation remain with the operator.

Source

Report 07/2024 of the British Rail Accident Investigation Branch (RAIB), ‘Unsafe movement of a train at Styal station, 3 May 2023’, as retold in the case note ‘Five open doors’. Roles, quotes and drawings are my own. How the series is built is described in the overview of the modules.