G-FORCE Case Studies

G-FORCE stage

Go / no-go: Go

Is there a rule that can be applied: Yes, a relevant company instruction is in place, but something unusual about the situation meant it couldn’t be applied or if applied it would’ve led to a bad outcome.

Facts

The problem

• Driver stopped short at a station.
• Driver made a mistake and stopped at the two-car stop board (thought they had two cars rather than four).

The context

• The company instruction states the driver should be removed from duty.• The driver realised his/her mistake straight away.• Driver did everything correctly by contacting the relevant people. By contacting the guard, the driver ensured no doors were released then contacted the signaller and control to explain the situation.

Options

1. Follow the company instruction, remove driver from duty.
   Risk = Delays and cancellations as day progresses. 
   People stranded.
   
   
2. Give the driver permission to draw forward.
   Risk = Driver has already made one mistake and may make another if distracted by previous error or it is an indication of a more significant issue such as fatigue.
   
   Option chosen:
   The signaller gave the driver permission to draw forward and the driver manager allowed the driver to continue with his/her shift.

Evaluate

Continuous process of evaluation

No information.

Considerations after the event

No information.

G-FORCE stage

Go / no-go: Go

Is there a rule that can be applied: No. This scenario was not explicitly covered by a rule that could be directly applied. 

Facts

The problem

• Train stranded in a tunnel near the terminus station due to overhead damage.

The context

• Train with two cabs. 
• Only one power car was working but had been reported earlier due to overheating. 
• The working power car was at the wrong end. The front power car was not working due to electrical damage from the overheads. 
• There was a fully working brake at both ends of the train.
• The driver depot manager was able to consult others.
• The train needed to be moved or there would be no chance of a train service in the morning. Access was needed for repairs to be made.
• Hot weather.
• Issues with overhead lines across the network.

Options

1. Evacuate the train and leave the train. 
   Risks = Evacuation in a tunnel.
   Passenger disruption may lead to angry or aggressive passengers.
   Disrupted train service the following day. 
   
   
2. Drive the train from the back cab or other than the leading cab.
   Risks = Unusual movement.
   Opportunity for errors, reliant on communications.
   Another competent member of staff needed
   
   
3. Allow the train to roll under gravity forwards building up speed to allow the train. under green signals to get into terminus station.
   Risks = The train stops or is stopped before reaching the station.
   
   Option chosen:
   The train was allowed to roll forwards, under gravity, building speed to enter the station under a green signals. A second option was put into place another driver who was ready to drive from a cab other than the leading cab in case the train stopped or was stopped before the station to mitigate the risks.

Evaluate

Continuous process of evaluation

Constant communications between the front and rear power where another driver was ready to drive from other than the leading cab or apply the emergency brake.

Considerations after the event

The plan worked allowing the train to reach a decent speed which was enough for a brake test, and to climb the raising gradient outside the station.

G-FORCE stage 

Go / no-go: Go

Is there a rule that can be applied: Yes, there is a relevant rule, but something unusual about the situation meant it couldn’t be applied or if applied it would’ve led to a bad outcome.

Facts

The problem

• A late-night service had become stranded around 300m short of a station after a fault on the train. 

The context

• The rule is to wait for a Mobile Operations Manager (MOM) to attend and appoint a Train Operator Liaison Officer (TOLO).
• The weather was good, but it was dark.
• There were around 8 passengers wanting to get off and they appeared to have been drinking. They started to become restless and were threatening to leave the train, knowing they were close to the station.
• The driver was happy to lead an evacuation.

Options

1. Follow the rule. Try to keep everyone on the train and wait for a MOM to attend and appoint a TOLO. At that time of night and at that location, this would have taken some time. 
   Risks= There could be a long wait for help to arrive or before the train could move.
   Potential for passengers to become aggressive.
   People may let themselves off the train.
   
   
2. Try to fix the train. 
   Risks= It may not be possible to fix the train without help.
   There could be a long wait for help to arrive or before the train could move. 
   Potential for passengers to become aggressive.
   
   
3. The driver carries out a controlled evacuation, provide lighting using his lamp, making sure that all de-trained passengers were accounted for.
   Risks= Evacuation risks (Slips, trips and falls, and passengers may be unaccounted for).
   Passengers under the influence of alcohol and so compliance with instruction and ability to alight without slips and trips may be compromised.
   
   Option chosen:
   The Operations Standards Manager agreed that the driver could carry out the controlled evacuation and provide lighting using his lamp, making sure that all de-trained passengers were accounted for. This was deemed to be the lowest risk option.

Evaluate

Continuous process of evaluation

Making sure passengers accounted for.

Considerations after the event

All carried out smoothly.

G-FORCE stage 

Go / no-go: Go

Is there a rule that can be applied: Yes, there is a relevant rule, but something unusual about the situation meant it couldn’t be applied or if applied it would’ve led to a bad outcome.

Facts

The problem

• The end coach of a high-speed train required door locking out of use due to an operational issue.

The context

• The Defective on-Train Equipment (DOTE) rules and company policy require the coach to be locked out of use. 
• The train was full, and some passengers were standing. 
• The driver manager was contacted by Control who informed him/her of the issue as explained by the Train Manager.

Options

1. Follow the rule: In line with the defective on-train equipment (DOTE) regulations, put the coach with the defective door out of use.
   Risk= Irate passengers. 
   Further overcrowding of other services.
   
   
2. Keep the coach in use, with a member of on-board staff remaining at the door. In the case of an emergency the door could be unlocked and used for evacuation purposes.
   Risk= Risk that in case of emergency the door would not open.
   Mitigation: a member of on-board staff remained at the door. 
   
   Option chosen:
   It seemed a sensible decision not to follow DOTE in these circumstances, and to keep the coach in use with a member of staff present. Arranged for a member of on-board staff to remain at the door so in the case of an emergency it could be unlocked and used for evacuation purposes.

Evaluate

Continuous process of evaluation

No information.

Considerations after the event

The operations manager knew why the rule applied but had an alternative solution that would cause less harm.
After a call from Control, the operations manager had time to reflect and concluded it was the safest decision, in the circumstances.

G-FORCE stage 

Go / no-go: Go

Is there a rule that can be applied: No, more than one rule could be applied but the course of action is unclear. 

Facts

The problem

• Track circuit actuator (TCA) fault which was not clearing.

The context

• There are two procedures in the SMS standard which lead to each other so just bounce between the two.
• The bodyside indicator light (BIL)/ external orange hazard light remained lit. This light should go out when doors are closed, and traction interlock is gained successfully. If the TCA fault does not clear, the BIL light will remain lit.
• This occurred on a line where reaching rail replacement services (RRS) is very challenging. 

Options

1. Take train out of service. 
   Risks= Passengers stranded, particularly at unstaffed stations.
   
   
2. Run back to terminus in service with BIL lit and fault still not clearing.
   Risks= Potential fault with train masked by this one not clearing.
   
   Option chosen:
   The train was run back to terminus where it was taken out of service.

Evaluate

Continuous process of evaluation

No information.

Considerations after the event

No information.

G-FORCE stage 

Go / no-go: Go

Is there a rule that can be applied: Yes, there is a relevant rule, but something unusual about the situation meant it couldn’t be applied or if applied it would’ve led to a bad outcome. 

Facts

The problem

• The Drivers Assistant door was defective.

The context

• Rule SMS1640 says all doors in cab need to allow the driver access. 
• There was no fitter. 
• Possession on that line tonight.
• It was ‘Super Saturday’ (first day of the pubs reopening after the first Covid-19 lockdown).
• The unit required boxing in (coupling another unit onto a defective cab) to continue in service but also in theory to get back to the depot therefore taking another unit of traffic.

Options

1. Follow the rule: Box the train in and run unit back to depot. Suspend the branch line whilst rescued. 
   Risk = ‘Super Saturday’ (first day of pubs reopening after Covid-19 lockdown) so suspending branch line would have an impact on passengers/stations. 
   Boxing in the train meant cancelling another service and using that unit to box the stranded train in (cancelling two services rather than one).
   A possession scheduled for that evening which would have blocked the unit in if that moved quickly. 
   
   
2. Run the unit back to depot without boxing in, with the Driver aware he could access via saloon.
   Risk = The driver’s door defective would potentially mean risk of the driver exiting via live lines (risk of electrocution) or via saloon with passengers (compromising company procedures for staff safety in relation to COVID-19).
   Mitigation: Carriage was locked out to avoid driver contact with passengers in this instance.
   
   Option chosen:
   The unit was run back to depot without being boxed in. The driver was happy to exit via the saloon and cess if required, that carriage was locked to avoid his contact with passengers in this instance. 

Evaluate

Continuous process of evaluation

No information.

Considerations after the event

No information.

G-FORCE stage 

Go / no-go: Go

Is there a rule that can be applied: No, this scenario is not explicitly covered by a rule that can be directly applied. 

Facts

The problem

• A UK Power Network Service (UKPNS) circuit breaker had failed, and an attempted repair overnight was unsuccessful. 

The context

• The circuit breaker was a faulty critical asset impacting operations and maintenance.
• The UKPNS team requested an additional night to attempt a repair of the circuit breaker, but confidence was low. They also requested to reconfigure the electrical supply. 
• Until the circuit breaker is fixed, a power trip will require the Local Operations Manager [EMMIS] to respond to an alarm within 10 seconds or all trains in the area will stop. 
• There was only one EMMIS on the shift and the interface he/she deals with is very information-heavy, therefore it would be very challenging to respond accurately within 10 seconds.
• Other planned critical overhead centenary system (OCS) electrical works were due to take place that night.
• Stakeholders were available for discussion.
• The incident took place in the evening, when a number of international train services would be affected.

Options

1. Continue with plan to do OCS works that night and allow UKPNS access to attempt a repair of the circuit breaker the following night. 
   Risks = Until the circuit breaker is fixed, if there is a power trip a EMMIS controller needs to respond to an alarm within 10 seconds or all trains in the area will stop and there could be technical SPADs. If the circuit breaker didn’t automatically reclose it would take a while to manually deal with it, and for about 15 minutes everything would come to a stand.
   Mitigation: Get an extra EMMIS controller to improve the likelihood of responding to an alarm within 10 seconds. 
   
   
2. Cancel the OCS critical works. Allow UKPNS access to attempt the circuit breaker repair there but delay the electrical reconfiguration of the railway and facilitate the reconfiguration of the railway that night.
   Risks = Reputational risks for Network Rail because planned critical OCS maintenance work planned for over a year and involving many stakeholders would need to be cancelled.
   Infrastructure and operational risk of losing maintenance work would also lead to operational consequences (and more reputational risk). There would be impacts on performance, as one depot would need to be de-energised for the duration of the UKPNS maintenance. It would have to move the configuration from one location to another resulting in loss of maintenance opportunities for over five hours and potential knock-on effect on other trains. Any trains in one station would need to lower their pantographs and lose power used to prepare the trains. If it was critical this might have affected trains the following day, depending on how much of a problem it turned out to be. 
   
   
3. Refuse the request for the UKPNS repair there and then because trains were still running but do allow OCS (attempt to reconfigure electrical supply).
   Risks = Impact on all services planned to run if reconfigure there and then, including internationally, as passengers could become stranded.
   
   
4. Review staffing levels and get extra EMMIS controller in to increase the chances of being able to respond within 10 seconds in the case of a power trip.
   Risks = The risk that a second EMMIS controller is not available at such short notice, resulting in too much work for a single EMMIS Controller (who is already monitoring alarms, monitoring the screen for long periods, potentially dealing with distracting phone calls etc). This could lead to a switching irregularity or fatigue, introducing task overload, safety and performance risks. 
   There is also a safety Covid-19 risk with two people on shift.
   Mitigation: operational briefing so only one person at the desk at a time, and 2m apart during handover briefing.
   
   
5. Review schedule of maintenance (UKPNS and project and OCS) work in collaboration with technical leads.
   Risks = There is a reputational risk as cancelling planned maintenance work which has taken time to arrange and involved a lot of stakeholders.
   
   Option chosen:
   Option 4. Review the roster and increased staffing levels to ensure two EMMIS Controllers are available at a time to respond promptly to a trip of the OHLE allowing adequate breaks and support (improving the chance of being able to respond within 10 seconds). 
   Option 1. Delay the electrical reconfiguration of the railway to allow OCS critical maintenance to take place. 
   Option 5. Ensure there were no electrical clashes with the proposal to undertake additional maintenance on the night and allow UKPNS request for maintenance.

Evaluate

Continuous process of evaluation

Safety and performance were considered throughout. Stakeholders were engaged early and updated throughout.  

• Reviewed with technical experts including project management, maintenance departments, UKPNS, planning, OCS and operational staff. 
• Escalated to Director of Delivery (Executive Lead) to gain support.
• Briefed relevant staff including operations front line staff and on call. 
• Informed line manager so they were aware of the issue and the financial impact upon return to work.
• Communication was excellent.
• Reviewed impact on upcoming maintenance work.

Considerations after the event

• This was more about managing the risk and exhausting all the control measures available to reduce it as far as reasonably practicable. 
• Overall, the right decision was made because a collaborative decision was made between senior management and other staff.  OCS critical works were successfully completed. The reconfiguration was successful. There were zero safety or performance implications. 

G-FORCE stage 

Go / no-go: Go

Is there a rule that can be applied: Yes, there is a relevant rule, but something unusual about the situation means it cannot be applied or if applied it would’ve led to a bad outcome.

Facts

The problem

• Door Interlock issues.

The context

• Rule SMS1640 states vehicle to be locked out of use (LOOU). 
• Guard believed fault was in A2 door of end vehicle. 
• Train very busy with schoolchildren.
• School children due to alight at next station.

Options

1. Follow the rule: lock carriage out
   Risks = All the school children would be crammed into one coach, leading to crowding and problems for social distancing. 
   
   
2. Continue with guard providing emergency access.
   Risks = In event of fire kids could not get out.
   Mitigation: arranged for guard to be by door and allow people to get out if needed.
   
   Option chosen:
   Guard remained by door and locked out when schoolchildren had got off at next station. Chose to remain coach in use but with guard able to patrol door to unlock if necessary.

Evaluate

Continuous process of evaluation

No information.

Considerations after the event

No information.

G-FORCE stage 

Go / no-go: Go

Is there a rule that can be applied: Yes, there is a relevant rule, but something unusual about the situation meant it couldn’t be applied or if applied it would’ve led to a bad outcome.

Facts

The problem

• On board hot axel box detector (HABD) alarm on approach to terminus station. 

The context

• Rulebook states Driver should examine set. 
• Alarm flickering on and off so suspect cable fault. 
• In a busy area immediately outside the station.

Options

1. Follow the rule: Block lines, examine set. After examining the axel box, the train would need to be moved even if it was a genuine HABD.
   Risks = High risk to multiple stranded trains, delays, and risk of passengers deciding to self-evacuate, or safety risk to vulnerable passengers. 
   Leading to overcrowding at stations, a potential Covid-19 risk.
   Risk to Driver in busy area, possible slips and trips, train strike. 
   Risk of passengers becoming frustrated while waiting for the set to be examined (could take up to half an hour).
   
   
2. Run train at 20mph into terminus station for inspection by a fitter.
   Risks = If it is a genuine hot axel box, the risk would be the axel locking up which could lead to low-speed derailment and a stranded train. 
   Derailment at low speed could lead to minimal risk to passengers (e.g. from luggage moving about), damage to train or infrastructure, reputational damage, stranded trains. 
   
   Option chosen:
   Run train at 20mph into station for inspection by fitter. Signaller made aware and happy. The risk of it being a genuine hot axel box is considered low due to flickering alarm indicating it is a cable fault. There are also lineside HABDs which would indicate an actual hot axel box.

Evaluate

Continuous process of evaluation

No information.

Considerations after the event

No information.

G-FORCE stage 

Go / no-go: Go

Is there a rule that can be applied: No. A scenario that is not explicitly covered by a rule that can be directly applied.

Facts

The problem

• The control systems that EMMIS controller uses needed to be upgraded and this involved installing and carrying out electrical testing of cabinets. 
• The documents that are usually written in advance when technical work is proposed (and are then reviewed and signed by heads of department, published in the Daily Notice and used to brief staff) were only produced and presented to the shift manager on the night. 

The context

• On a previous occasion the correct documents were not published in the Daily Notice as they should have been and caused issues. 
• As there was no detail in the Daily Notice, other (conflicting) maintenance work was planned for the same time period.

Options

1. Continue with the majority of the upgrade work as it is safe to do so.
   Risks = Safety risks include when this work was done before, all graph availability was lost and the shift manager’s workstation was shut down. This meant the shift manager was not able to control signals or other important functions. Frontline staff would be involved in something that had not been adequately planned/ documented.
   There are operational risks as other trains on the line would be impacted. Planned maintenance work would also be impacted.
   
   
2. Cancel the upgrade work as it had not been planned properly.
   Risks = Cost a lot of money to project team by delaying the whole upgrade project.
   
   
3. Reschedule the electrical connection part of the upgrading process to a night with no possessions or train movements to reduce risk.
   Risks = The cost of delaying the electrical connection part of the upgrading process.
   
   Option chosen:
   On the night the maintenance team raised concerns with shift manager, the problem was escalated and the decision was made to allow most of the planned work to go ahead but to postpone the electrical connection stage. It was considered that the majority of the work could go ahead safely but that the electrical connection part should be rescheduled to a trace free night and planned properly including the Daily Notice. The electrical connection work was rescheduled for a couple of days later, after time had been taken (approximately two days) to consider all the potential risks.

Evaluate

Continuous process of evaluation

G-FORCE was not used at the time of making the decision but was successfully used afterwards to help explain the decision that was made. 

Considerations after the event

Because of how useful G-FORCE was in explaining this event after the fact, the organisation are now taking action to integrate G-FORCE into the company culture when making decisions.