Oakwood Farm UWC accident 14/05/2015 - RAIB report published

[John Webb]

Published at https://assets.digital.cabinet-office.gov.uk/media/571f3fce40f0b61584000002/R072016_160428_Oakwood_Farm.pdf

RAIB Summary
On 14 May 2015, a passenger train collided with a tractor at Oakwood Farm user worked crossing near Knaresborough, North Yorkshire. The train was carrying 66 people and travelling at 65 mph (105 km/h), but did not derail. The collision caused the front of the tractor to become detached from its cab. The tractor driver suffered minor injuries, and the train driver was treated for shock. However, in different circumstances the consequences could have been much worse.
The tractor driver began crossing the railway after the illuminated warning at the crossing started to display a red light. This was probably because he was unfamiliar with the crossing’s operation; it is one of a small number in the country that had been fitted with remotely operated, powered gates. It is likely the tractor driver did not recheck the warning lights after first stopping on the approach to the crossing to press a button to open the gates. This button had not originally been intended to open the gates (it should only have been capable of being used to close them). It was situated at such a distance from the crossing that the time it took for the tractor driver to stop, open the gates and then drive onto the crossing, was greater than the time between the warning light turning red and the arrival of the train. There was no sign at the button to warn the driver to recheck the warning light before going over the crossing. The investigation also found that the warning light was not conspicuous among the many signs present at the crossing.
The underlying causes of the accident were that Network Rail did not ensure that the risks at the crossing were adequately mitigated, and that the process for the introduction of the gate operating equipment was adequately managed.
The RAIB has made three recommendations to Network Rail. The first is to improve the safety at Oakwood Farm user worked crossing and the second is to review the safety of other user worked crossings fitted, or planned to be fitted, with the remotely operated gate opening equipment. The third recommendation is for Network Rail to review the robustness of its processes for introducing new equipment on to its railway infrastructure.

[Andrew Waugh]

Just finished reading the report.

I'm not going to mince my words. That design for a UWC has to be the most stupid, dangerous, signalling design that I've ever seen.

The motorised gate was completely uninterlocked with the signalling system. Pushing the controlling button opened the gate irrespective of whether a train was on the approach or not. At least some road users would consider an opening gate as an indication that they could cross; irrespective of signs and red/green lights. Possibly all users could fall into this trap if they were tired or distracted. The design flies in the face of basic human psychology.

The completely untrained authorised user (farmer) easily identified the risk (paragraph 81b). Nothing was done. Three years later an internal risk review identified this as one of the top three risks (paragraph 91b). Again nothing was done.

Whatever could the designers have been thinking?

[John Hinson]

The motorised gate was completely uninterlocked with the signalling system. Pushing the controlling button opened the gate irrespective of whether a train was on the approach or not. At least some road users would consider an opening gate as an indication that they could cross; irrespective of signs and red/green lights. Possibly all users could fall into this trap if they were tired or distracted. The design flies in the face of basic human psychology.

It is just a motorised version of gates opened by hand, of which there are many in the UK in similar situations with red/green lights. Maybe there are psychological inferences of motorisation, but I for one can see exactly what the designers were thinking.

John

[S&TEngineer]

Yes. I understood the reason for motorising the gates (actually a hydraulic ram http://www.networkrailmediacentre.co.uk ... allation-1) was to reduce risks by preventing the user having to cross the line twice to open or close the far gate.

The overall mode of operation is no different to any other UWC. No signal interlocking is provided for the gates, only for the Miniature Red/Green lights.

The POGO arrangement can also be utilised on user worked crossings without the Miniature Red/Green lights.

[Pete2320]

Surely this arrangement has all the issues that befell "Rural Barriers).

Pete

[John Hinson]

I think it best to provide a link to this report so that all can read in entirety to understand all the issues involved:
https://assets.digital.cabinet-office.g ... d_Farm.pdf

There are many factors, but the key one that strikes me is the use of "close" buttons, which are necessarily some way from the crossing, to "open" too when a correct "open" button was provided nearer the crossing, nearer the informational signs and the red/green lights. These did this through incorrect wiring in the first trial, but the specification was modified to allow it in the second trial. The one nearer to crossing was ideal for motorists in right-hand drive vehicles but the tractor's construction prevented its use without leaving the cab.

The report makes it clears there were many failings but I would just say, in defence against the total condemnation by Andrew, that the report also says "Data from Network Rail shows that reported incidents of gates being left open at Oakwood Farm UWC reduced by 80% after the introduction of the POGO equipment" which is a massive factor in favour of this system.

John

[Nicko]

I think it is important to remember that UWCs are only meant to be used by authorised users who have been briefed on the method of operation of the crossing and who are also responsible for briefing any body who may use the crossing.

[Mike Hodgson]

When I read the term "POGO", it conjured up an image of Shaun the Sheep, the farmer and his dog all bouncing about in the four foot on pogo sticks!

Of all the accident reports I've seen about the attitude and behaviour of authorised users of private crossings, this farmer must have come in for the least criticism, and he seems to have been trying his best.

[John Webb]

I think it best to provide a link to this report so that all can read in entirety to understand all the issues involved:
https://assets.digital.cabinet-office.g ... d_Farm.pdf
.......John

Sorry! I had meant to include the link but forgot to do so; I've amended my first post.

[edwin_m]

I think it is important to remember that UWCs are only meant to be used by authorised users who have been briefed on the method of operation of the crossing and who are also responsible for briefing any body who may use the crossing.

This is indeed supposed to be the case. But the farmer has literally no idea who might choose to visit - I assume they get random deliveries from Yodel etc like the rest of us - and in this case it seems any visitor would have to use the crossing to reach the farm. Something that might have been acceptable a few decades ago (regular postie on bike, local traders etc) probably isn't today. The fact this farmer seems to have appreciated the risk and done everything possible to address it illustrates that everything possible may not be enough.

The report seems to have made very little of the suggestion of an interlock between the gates and the lights - surely it would only be a matter of a relay or two to make the actuation of the gate opening mechanism conditional on the green light feed being energised? I agree the design was intended to mitigate the hazard of gates being left open, but motorising the gates has significantly worsened the greater hazard of failing to check the lights after opening them. Most people, if having to open a gate by hand, will realise that there is no interlock with approaching trains and it is their responsibility to re-check the lights or look down the line where there are none provided. But I if people see a red/green light they will infer that the "mechanism" knows when there is a train coming, and that if the gates are powered they will also be interlocked (as they are on all forms of barrier crossing).

On a more minor note, the "STOP" sign appears to be wrongly positioned before the right hand side buttons. It ought to be possible to operate the button and observe the lights from a vehicle standing at the sign, and below this sign would also be the logical place for the instructions to drivers. Another stop sign for the closing buttons might also be worth thinking about.

[Mike Hodgson]

The report seems to have made very little of the suggestion of an interlock between the gates and the lights - surely it would only be a matter of a relay or two to make the actuation of the gate opening mechanism conditional on the green light feed being energised?

On a more minor note, the "STOP" sign appears to be wrongly positioned before the right hand side buttons. It ought to be possible to operate the button and observe the lights from a vehicle standing at the sign, and below this sign would also be the logical place for the instructions to drivers. Another stop sign for the closing buttons might also be worth thinking about.

That wouldn't have saved the day here. If the gates can only be opened whilst the light is green, what do you do when a train strikes in immediately after they've started to move, which may have been the case here? The light would turn red, and the driver is supposed to check it's still green. Do you want to close the gates on the vehicle which may have started moving? This vehicle seems to have been long and slow, so would presumably fall into the category which should phone for permission to cross, since it may be incapable of crossing within the 40 second strike-in.

There was a sign about closing the gates, facing traffic which has already crossed. Whether you can reasonably expect anybody who has already crossed to bother reading such a sign is a moot point.

I quite agree however that is unrealistic to expect that a farmer can control his visitors and educate them. No doubt he gets as many couriers, salesmen, political canvassers and religious nutters trying to convert him to their particular faith as the rest of us.

[Andrew Waugh]

The overall mode of operation is no different to any other UWC. No signal interlocking is provided for the gates, only for the Miniature Red/Green lights.

Yes, I understood that conceptually having a motor open the gates is no different to the user opening the gates by hand, and was intended to avoid having the gates left open.

But can you not see that there is an important psychological difference to the road user?

In the traditional UWC the user has to manually open the gates. It is very clear to them that opening the gates says nothing about whether a train is approaching.

With POGO, the system itself opens the gate after a request from the user. Many users would take this as authorisation to cross; after all this is the common experience of gates and doors. You ask for permission to enter, the gate or door is opened to allow you to enter (or it remains closed to deny you permission). Indeed, countering another instance of this experience/expectation is exactly what POGO was intended to address: users coming to the crossing, finding the gates open, and assuming this means they can cross without any further check.

Yes, there are lights, and signs explaining the expected behaviour. It's well known in user interface design that instructions are the very worst way of conveying information to users. Some users won't take the instructions in, or will misinterpret the instructions. Some users will attempt to follow the instructions, but get confused when the behaviour of the crossing conflicts with their expectations (I checked the green light is showing, I pushed the button to open the gate, the gate is now open but the light is red. Does this mean it's safe or not safe?)

In fact, the conflict with users' experience of gates and doors is so strong that I would expect that even users that have been instructed what to do could get trapped if they are tired or distracted.

I'll re-iterate: I think this is a stupid, dangerous, design. I think it came about because the designers focused on one aspect of the problem (gates being left open) and failed to think about how the users would experience the resulting interface. The designers' blind spots are even clearer when you consider the report's comments about the lack of any risk analysis during design, or even pilot use. It becomes glaringly obvious when you consider that the risk was clearly identified twice, and at least once dismissed as 'cosmetic'. Certainly nothing was done to address the risk.

[edwin_m]

That wouldn't have saved the day here. If the gates can only be opened whilst the light is green, what do you do when a train strikes in immediately after they've started to move, which may have been the case here? The light would turn red, and the driver is supposed to check it's still green. Do you want to close the gates on the vehicle which may have started moving? This vehicle seems to have been long and slow, so would presumably fall into the category which should phone for permission to cross, since it may be incapable of crossing within the 40 second strike-in.

There was a sign about closing the gates, facing traffic which has already crossed. Whether you can reasonably expect anybody who has already crossed to bother reading such a sign is a moot point.

I quite agree however that is unrealistic to expect that a farmer can control his visitors and educate them. No doubt he gets as many couriers, salesmen, political canvassers and religious nutters trying to convert him to their particular faith as the rest of us.

The logic could pause the opening of the gates if the green light feed de-energised in the course of opening. The vehicle should not be moving forward until the gates have opened fully or at least enough to admit that vehicle, and if it did so immediately the gates stopped (ignoring the red light) it would probably get across within the strike-in period.

Even better if the green light was itself interlocked with the gates, so neither light was lit until the gates were fully open, but that would require extra complication such as detection on the gates.

The sign on the closing buttons was small and inconspicuous, like all the other signs except the red octagonal STOP sign. Hence why I suggested another STOP sign here.

[colin1501]

I think Andrew's absolutely right on the human behaviour/expectation aspect. Not crossing related, but you only have to watch passengers disembarking from an HST these days. None of them close the slam doors any more, because they all think this will happen automatically!

Colin

[John Hinson]

Discussion on UWC crossings on public roads has been moved to:
viewtopic.php?f=10&t=7586

John