Microlearning · Module 3 of 3 · Degraded operation

When the automatic systems no longer help

What the technology no longer secures, the procedure has to secure.

The door interlock and the brake control protect normal operation. At Styal there was no written guidance for degraded operation. Using the chain and three scenarios, this module shows where the course of events could have held and what an instruction needs when its last step does not work.

About 7 minutes
4 questions with feedback
No sign-in; answers are not stored

Start the module All modules

What this is about

After the isolation at Styal, only the procedure protects, and there is no written guidance for this situation. After this module you can, using the case:

recognize what is missing from a fault-finding instruction that has no way out,
put the steps after an isolation into the order of the Rule Book,
match each of the three scenarios to the link of the chain it addresses,
explain why a no-fault-found case has to be assessed before the vehicle goes back into service.

Each voice is followed by a question, and an application task comes at the end. If your answer is right, you get more depth. If it is wrong, a hint shows where the answer is in the case note, and you get a second attempt; after that, the solution appears with the reasoning.

The three people are fictitious roles at another operator and at a train manufacturer, not people involved in the case. They speak about what the report describes; their view is my reading.

The scene

Operator’s control (maintenance controller and duty control manager)
Signaler
Isolating switches EBS (brake circuit) and TIS (traction interlock), vertical when normal
Light “safety systems isolated”
Door interlock indicator on the driver’s desk
Leading cab
Rear cab
Doors on the platform side
Driver
Conductor

Styal, 3 May 2023. After the TIS is isolated, the brakes still do not release. Control’s flow chart ends with the EBS, and there is no written guidance for this situation. After 25 minutes at the platform the train departs with five doors open, without dispatch and without the signaler’s instruction.

On 25 May the fault occurred again during shunting and was traced to the leading cab. According to the report, the brakes at Styal would have released from the rear cab.

The whole case in brief is in the overview of the modules. The drawing shows the analysis: control, the switches and lights, the location of the fault and the doors are marked.

A flow chart with no way out

Maintenance controller at another operator, fictitious role

On the phone, I follow the flow chart. The “Unable to release brakes” flow chart at Styal applied to all fleets, contained actions for diesel engines although the train was electric, and ended with the EBS. It did not ask which cab the fault occurred in, and it did not say what applies when the last step does not work. Then people improvise, under time pressure and on the phone.

Question 1 of 4

What was missing from the “Unable to release brakes” flow chart? Select all that apply.

The question of which cab the fault occurs in
A way out for the case in which the last step does not work
The step of isolating the EBS
The rules that apply after an isolation

That is not correct; at least one choice is wrong. In the case note, read the weak point “A flow chart with no way out” and try again.

Solution and explanation

Solution: a, b and d. The flow chart did mention the EBS; it ended with it.

A fault-finding instruction has to fit the vehicle, establish where the fault is and have a way out when the last step does not work. At Styal, asking about the cab would have located the fault: according to the report, the brakes would have released from the rear cab.

Report, check, move on instruction

Conductor at another operator, fictitious role

After an isolation, I am the check that the door interlock no longer provides. Under the Rule Book the conductor checks all doors on both sides and travels in the rear cab, again after every door release. For that, the conductor has to know that something was isolated. At Styal the conductor was not told, and the operator’s dispatch plan contained nothing for degraded operation.

Question 2 of 4

The EBS and the TIS are isolated. Put the steps into the order of the Rule Book, as summarized in the report.

Check: the conductor checks all doors on both sides and goes to the rear cab, again after every door release.
Restore: passengers are detrained at the first suitable station; only the depot or an engineering technical inspector can reset.
Report: the signaler and the conductor are told that the EBS and the TIS are isolated.
Move on instruction: the train moves only when the signaler instructs it, with all doors checked closed.

That is not correct. In the case note, “Scenario B: Isolation by the Rule Book” shows the steps one after another. Then try again.

Solution and explanation

Solution: 1. Report, 2. Check, 3. Move on instruction, 4. Restore.

The conductor can only check what they know about, so the report comes first. The check is valid only until the next door release. The report summarizes the steps; this is not a complete procedure. For dispatch in degraded operation, the British industry standard RIS-3703-TOM requires dispatch methods to be assessed and defined.

Where the chain could have held

Technical writer at a train manufacturer fictitious role, thought experiment

For me, degraded operation does not begin on the platform but in the depot. On 24 April the fault had already occurred once; the depot did not find it and released the unit back into service. According to the report, whether a fault counted as a safety or a performance fault was decided by undocumented judgment. What a manufacturer writes about intermittent faults and their consequences for safety functions can support this decision.

The report does not reproduce the manufacturer’s information. This voice shows how the case note reads the role of the manufacturer’s information.

Question 3 of 4

The case note shows three scenarios. Match each scenario to the link of the chain it addresses.

Scenario A: The fault is located
Scenario B: Isolation by the Rule Book
Scenario C: The fault does not stay in service

Choose from:

01 Release into service
02 Remote fault finding
03 Isolation
05 Degraded operation

That is not correct; at least one match is wrong. In the case note, read “The chain: from the depot to departure” and play through the scenarios. Then try again.

Solution and explanation

Solution: Scenario A — 02 Remote fault finding; Scenario B — 03 Isolation; Scenario C — 01 Release into service.

Each scenario addresses a different link, and each would have held the chain before only the low speed relay was left to protect. Scenario C starts earliest: a fault that the depot does not find otherwise stays in service, and the train crew carry the risk. The scenarios are my reading based on the report.

Back to the depot

This task leads back to the start of the chain. Imagine you are writing the information a depot uses to decide whether a vehicle goes back into service.

Question 4 of 4

A vehicle leaves the depot with the entry “no fault found”. The same fault had occurred once shortly before. What follows from the Styal case?

The vehicle can go into service because the depot found no fault.
The repeat is assessed as a possible safety risk before the vehicle goes into service, and it runs, for example, only with an expert on board.
The train crew are asked to look for the fault themselves if it occurs again.

That is not correct. In the case note, read the weak point “A fault that clears itself” and try again.

Solution and explanation

Solution: b. A no-fault-found case is information that has to be assessed.

“No fault found” brings the vehicle back into service, and the train crew then carry the risk. How to notice it: the same report on the same vehicle several times within a short period. After 3 May the unit ran with an engineering technical inspector on board, and the RAIB’s first recommendation to Northern concerns vehicles with known faults.

Apply it to your documentation

Think of an instruction in your documentation for a fault, for example fault finding, a flow chart or emergency operation.

Your note. It stays on this screen and is neither sent nor stored.

Check this instruction with the questions from the case note:

Does the instruction ask where, and in which component, the fault occurs?
What does the instruction say when its last step does not work?
Is operation with defective equipment defined and practiced?
How is a no-fault-found case assessed before the product goes back into service?

The key points in three sentences

What the technology no longer secures, a defined procedure has to secure: report, check, move on instruction, restore.
An instruction for a fault needs a location and a way out: where the fault occurs and what applies when the last step does not work.
The chain begins in the depot. A no-fault-found case is information that has to be assessed.

Go to module 1: Isolating is not securing

All modules

Read the case note

Working together

Basis and source

This microlearning does not replace instruction. Procedures, instruction and supervision in rail operation remain with the operator.

Source

Report 07/2024 of the British Rail Accident Investigation Branch (RAIB), “Unsafe movement of a train at Styal station, 3 May 2023”, as retold in the case note “Five open doors”. Roles, quotes and drawings are my own. How the series is built is described in the overview of the modules.