Safety investigation report

Transcription

1 1 Investigation Body for Railway Accidents and Incidents Safety investigation report DERAILMENT OF A PASSENGER TRAIN ON 19 NOVEMBER 2009 IN MONS 1 June 2015

2

3 Any use of this report with a different aim than of accident prevention - for example in order to attribute liability, individual or collective blame in particular - would be a complete distortion of the aims of this report, the methods used to assemble it, the selection of facts collected, the nature of questions posed, and the concepts mobilising it, to which the notion of liability is unknown. The conclusions which could be deduced from this would therefore be abusive in the literal sense of the term. In case of contradiction between certain words and terms, it is necessary to refer to the French version.

4 Inhoudstafel 1. Description of the event 5 2. Initial facts The event 2.2. The decision to open an investigation 2.3. Activation of the railway emergency plan and its chain of events 2.4. The infrastructure and the signalling system 2.5. Rolling stock 2.6. Work carried out on the site or close to the accident site 2.7. Human losses, injuries and stock damage 2.8. Meteorological conditions 3. Report of investigations and enquiries Works close to the accident site 3.2. Training of Infrabel agents 3.3. Automatic recorders of motor coach data 3.4. Source of potential distractions 3.5. Driver 3.6. Visibility of the reduce speed sign 4. Analysis and conclusions Final report on the chain of events 4.2. Analysis 4.3. Conclusion 5. Measures taken Annex 30 Glossary 4 R.D. : Royal Decree M.D. : Ministerial Decree LI : Local Instruction ECM : Entity in Charge of Maintenance RU : Railway Undertaking IM : Infrastructure Manager IB : Investigation body EBP : Electronic Command Post RGE : General Operating Regulation RGUIF : General Regulation for Railway Infrastructure Users RSEIF/VVESI : Safety Regulations for the operation of railway infrastructure SMS : Safety Management System DRSI : Department for Railway Safety and Interoperability

5 1 1. DESCRIPTION OF THE EVENT On Thursday 19 November 2009 at 23:26, the passenger train E922 coming from Tournai with the destination Charleroi-South, was travelling on the normal B track of line 97. The train, a motor coach of type AM96 composed of 3 cars, derailed after passing the open signal at the entrance to Mons station (NZ-27) on the Saint Ghislain side. The train crossed the adjacent tracks: the first car of the train (driver s cab No 2) uncoupled from the rest of the convoy, crossed a wooded area and tipped onto its right side on both tracks of line 96. The rest of the train set, or 2 cars, came to a standstill in the embankment situated between line 97 and the wooded area. A catenary portal structure was crushed on the central part of the second car. The cars suffered major damage. When derailing, the train uprooted a catenary portal structure, pulled it along, ripped up a portion of rail which broke apart with the impact, causing major damage to the railway infrastructure. There were not many passengers on board at this hour and they were not seriously hurt. The damage to the rolling stock and infrastructure was major, train traffic was suspended between Mons and Quévy (L96) and between Mons and Saint Ghislain (L97). As for personnel, we regret that the train conductor was killed. The driver had to be freed from the wreck, he was seriously injured and taken to hospital. 5

6 2. INITIAL FACTS 2.1. THE EVENT THE DECISION TO OPEN AN INVESTIGATION The accident that occurred in Mons on 19 November 2009 meets the definition of a serious accident as defined in the Directive 2004/49 and the Law on Railway Operational Safety of 19 November The Investigation body called on SNCB/NMBS Holding and particularly its Safety and Environment service to lead the investigations on the accident site. According to the available elements, the investigation body decided to prepare a restricted report THE CIRCUMSTANCES OF THE EVENT PERSONS CONCERNED THE INFRASTRUCTURE MANAGER: INFRABEL According to the Royal Decree of 14 June 2004, Infrabel is the infrastructure manager. The manager is responsible for: the acquisition, construction, renewal, maintenance and management of infrastructure; the management of regulatory and safety systems for this infrastructure; the provision to railway undertakings of services for railway infrastructure; capacity allocation for available railway infrastructure (timetable and train paths); tariffs, invoicing and payment of fees for the use of railway infrastructure and services. At the time of the accident the infrastructure manager had a valid safety authorisation issued by the Belgian National Safety Authority, the DRSI RAILWAY UNDERTAKING: SNCB/NMBS At the moment of the accident in 2009, it was responsible for: freight and passenger transport by rail; logistical services linked to freight transport; the acquisition, construction, maintenance, management and financing of rolling stock. It was in possession of a valid safety certificate issued by the Belgian National Safety Authority, the DRSI. 6

7 ACTIVATION OF THE RAILWAY EMERGENCY PLAN AND ITS CHAIN OF EVENTS The signal box operator closed the automatic signals using the emergency stop command in the section of track concerned to bring traffic to a standstill. This immediately closed or kept these signals closed. At 23:29, the cases in table 1 of line 97 were applied in accordance with the established procedure to stop traffic within a sufficient perimeter. A protection case of this type table 1 case removes the command: automatic route tracing; opening of signals in the sector; opening of signals giving access to or authorising exit of the corresponding sector. Little by little, certain cases in table 1 were removed by an agent at a supervisor level. The line regulator launched the alarm by ground-train radio link and GSM-R and launched the alarm at the signalling centres, the ES distributor and other line regulators. The catenary network switches can be commanded and controlled remotely. The control is concentrated in one post according to zone. The traction electricity distributor, or ES distributor, controls the power on the catenary network. This is who manages the supply breaks in their zone. The ES distributor cut the feed to the catenary in the sector concerned, to allow the passengers to be safely evacuated and the emergency services to intervene. A break in supply of a line involves: cutting power by manoeuvring break switches, and the placing of overhead lines on the rails, using a shunter s pole. 7

8 2.4. THE INFRASTRUCTURE AND SIGNALLING SYSTEM The line is a double track between Mons and the entrance to Boussu. The reference speed of the line is 160km/h between Mons and Saint Ghislain. From the BK , the line 97 is made up of a straight wooded section up to approximately BK The line then presents two successive curves, a slight centre-right curve followed by a major centre-left curve giving access to the Mons grid. The B431 signal is a main automatic stop signal on the normal track, placed to the left of the B track on line 97, supported by a crocodile. The speed reduction diagram is made up of a sign in the shape of an equilateral triangle, point towards the bottom. The reduced speed zone sign is supported by 6 a crocodile. It shows, in black on a yellow background, a number indicating the reduced speed in tens of km/h. It applies for the normal track and is placed to the left of the B track of the line 97. It is placed on the BK It announces the original sign for a permanent reduced speed zone and indicates that the maximum authorised speed within this zone is 60km/h. From this speed reduction sign, the train should be progressively slowed down to reach 60km/h. The signal NZ.27 is a main automatic stop signal on the normal track, placed to the left of track B on line 97, supported by a crocodile. In general, the original speed sign is a rectangular sign. It shows, in black on a white background, a number surrounded by a circle. The original speed sign is found at BK In the present case, the original speed sign did not show a black figure on a white background. According to the elements received from the infrastructure manager, the absence of a figure on the original sign (outdoor as well as on the PSS) could be justified by the fact that the signal NZ.27 could be a reduction in speed to 40km/h for some routes. 8

9 ROLLING STOCK COMPOSITION OF TRAINS The train E922 was made up of a single motor coach AM454 of type AM96, made up of 3 cars. The train conductor s room was situated behind the driving cab n 2 which was oriented towards the front on the day of the accident SAFETY OR DRIVING ASSISTANCE EQUIPMENT Automatic vigilance device TBL2, TBL1, MEMOR, Recorder of driving events of type TELOC-AS V 2.22 GSMR, ground-train radio 2.6. WORK CARRIED OUT ON THE SITE OR CLOSE TO THE SITE OF THE ACCIDENT Technicians from the infrastructure manager were present close to the site of the accident, they were involved in trying to repair damage to the electrical feed on a crocodile. This work involved a repair following a call outside of normal service hours and was not planned work. 9

10 2.7. HUMAN LOSSES, INJURIES AND MATERIAL DAMAGE PASSENGERS AND THIRD-PARTIES, PERSONNEL, INCLUDING CONTRACTORS The driver was seriously injured, he was taken to hospital. The train conductor was killed in the accident. Considering the late hour and final destination of the train, there were few passengers (4) on board. They suffered bruising DAMAGE TO THE INFRASTRUCTURE A lot of damage was noted: the rails on track A of line 97 were broken; numerous concrete sleepers were broken. Various damage was found on the catenary: severed posts, bent brackets, catenaries ripped out. 10

11 ROLLING STOCK The first car was on its side across the tracks of line 96 after crossing a small wooded area separating the two lines 96 and 97. The two other cars formed a V below line 97. A catenary portal structure was crushed on the central part of the second car. The cars suffered major damage OTHER Traffic was suspended on the tracks A and B between Mons and Quévy (L96) and between Mons and Saint Ghislain (L97) for several days METEOROLOGICAL CONDITIONS The accident occurred at around 23:26, the sky was dark and visibility was reduced to between 10 and 50m. The temperature was 7 C. There was a slight breeze but no precipitation. 11

12 3. REPORT OF INVESTIGATIONS AND ENQUIRIES 3.1. WORKS CLOSE TO THE ACCIDENT SITE REGISTER OF FAULTY CROCODILES The study of the register of faulty crocodiles shows that three faults to the crocodile supporting the reduce speed sign were reported to Traffic Control in the 24h prior to the accident. These three reported crocodile faults were made on 19 November 2009: 11:47 by the driver of the passenger train 1711, 20:38 by the driver of the freight train 49604, 22:30 by the driver of train EM COMMUNICATION OF FAULTS BY DRIVERS According to the Regulation RSEIF/VVESI 3.2 (version 1 April 2008), when a driver notices a repeating incident to a signal or signalling sign, he should send a telegram (E361) as soon as possible to the regulatory body, Traffic Control or signal box operator. Incidents with the crocodile should be communicated to the infrastructure manager by telegram. Physically, this involves telephone communication between the train driver and the line manager to Traffic Control or the signal box. According to the procedure, the driver transmits by (radio) telephone the crocodile telegram E361 according to the rules, codes and procedural terms of communication provided. Following the order of the chapters, for each of those to be taken into account, they communicate the number, title, as well as where appropriate extra additional information. There are about ten of these E361 forms on board trains for drivers to use. The completed E361 telegrams are attached to the M510 report. Everything is then given to a superior. As foreseen in the form (type E361), the drivers communicated that the first kilometre-marker to the rear was 42, the first main stop signal encountered to the rear on the opposite side was NZ.27. The drivers reported a lack of impulse where there should have been a positive impulse. Numerous trains passed this sign between 11:47 and 20:38 but only three telegrams were sent by drivers: either the fault was intermittent, or several drivers did not report the crocodile s lack of impulse. 12

13 3 According to information received by the infrastructure manager, it was revealed that the last positive impulse felt at the crocodile by the permanent sign for speed reduction was the night before the accident, or the 18 November at 20:59 1. This means that 83 trains travelled on the line and only 3 drivers reported an anomaly with the crocodile concerned See in Annex 1 an extract of the letter sent by the SNCB/NMBS to the infrastructure managers on 17 December 2009.

14 MANAGEMENT OF TELEGRAMS BY TRAFFIC CONTROL The IM, via Traffic Control, organises management of these telegrams, fills in the register of faulty crocodiles and ensures that all the telegrams relating to a single crocodile are taken into account. As soon as the TC receives, within 24h, two different telegrams relating to the same crocodile, the TC contacts the manager of the signalling block in the sector concerned and requests the scheduling of an intervention by the Infrabel technical personnel. According to the procedure, the Traffic Control agent who receives an E361 telegram from a driver communicates by telephone the contents of the crocodile E361 telegram in compliance with the rules, codes and terms of the communication procedure provided for according to the order of chapters. Communications are recorded via the ETRALI system. At 21:12, the Traffic Control made contact with the signal box in Mons. The TC agent communicated that he had just received a second telegram on the failure of the crocodile for the warning signal of signal NZ.27 and requested that an electrician be called. During the communication, there was no re-transcription of the information in document E361. The conversation ended with the fact that the faulty crocodile was on signal B431. The Traffic Control agent did not mention the existence of the crocodile supporting the speed reduction sign, and did not seem to have consulted the available schematic signalling plans EXCHANGE OF VERBAL MESSAGES BETWEEN THE SIGNAL BOX AND THE DUTY TECHNICIAN The signalling centre called the duty technician and informed him that he should verify the impulses on signal B431. The signal box in Mons called: the signalling electrician on duty at 21:08 for a fault at the level of the crocodile on signal B431, the guard on duty at 21:19 for a fault to the crocodile on the signal B431. The information in the telegram E361 was not communicated as such to the technician INTERVENTION ON SITE The intervention team went to the scene to check the B431 crocodile. The technician and the guard went to the scene to test the impulses on signal B431. The voltage measured was around 18 volts. In a normal situation, the signal functions with a feed of 19 to 20 volts by a battery designed to guarantee an electrical feed in case of power cuts. Fearing that it was an intermittent fault, the technician decided to change the power supply block. The technician and the guard went to Saint-Ghislain (their place of work) to look for a new power supply unit (battery) but could not find one. The technician carried out a switch to a direct feed of the crocodile on signal B431. In this way, the crocodile was correctly powered but would not remain operational in case of a power cut. This procedure is the normal procedure in case of battery failure. 14

15 3 He went with the guard by car to the next signal, the NZ.27, to carry out various measures. As a result, they did not pass by the crocodile with the speed reduction sign. The signalling technicians came from another zone than Mons. They did not check the signalling plan. To carry out the measures, the technician asked the signal box to change the status of signal NZ.27. He tested, in chronological order: positive impulse (double yellow), no impulse (red), negative impulse (green). The test results met expectations. The technician and the guard saw the train which passed the signal too fast and derailed further along. The technician called the signal box to stop all train traffic INTERVENTION AFTER THE ACCIDENT After the accident, the technician called his head of service. They decided to travel the line together on foot to check the signals (uphill). They then saw the crocodile on the speed reduction sign. Between 3 and 3:30am, without informing the Police and investigation services, they tested the crocodile on the speed reduction sign: it showed, according to their statements, a very low voltage, insufficient for the correct operation of the equipment. They decided to replace the element, the power cable between the junction box and the crocodile and to put the electricity feed of the crocodile in direct mode as the battery was faulty. During the day of 20 November 2009, the head of service contacted the technicians to change the faulty electrical feed unit on the speed reduction sign so as to re-establish a normal situation as quickly as possible. 15

16 3.2. TRAINING OF INFRABEL AGENTS The Infrabel agents in signalling centres and Traffic Control are considered as safety personnel. The requirements in the Ministerial Decree of 9 June 2009 on adoption of the specifications for safety personnel were in application at this time. The folder RGPS 501 outlined the training plans, trial or training periods, the regular evaluation tests on knowledge, etc. of Infrabel agents. The infrastructure manager personnel are recruited on the basis of various criteria and receive training specific to their specialisation (or the speciality that they are intended for). For example: 1. applicable procedures; 2. installations that they will be serving or where they will be called upon to use their skills; 3. the safety regulations aiming not only at safety personnel but also the safety of rail traffic. The training of agents involves theory and practical elements, on a simulator or simulator working post, regular exams, medicals. 16

17 AUTOMATIC DATA RECORDING IN THE MOTOR COACH ON-BOARD DATA RECORDER Any traction unit which operates on main running lines equipped with trackside signalling should be equipped with a device for repetition of signals in compliance with the Rolling Stock Specifications. An automatic warning system, accompanied by automatic train control system, is always included in the repetition device. The rolling stock involved was equipped with these devices. The operation of on-board equipment and the driver s acknowledgement should be recorded. The motor coach was equipped with a recorder of type TELOC AUTOMATIC WARNING SIGNAL According to the RSEIF/VVESI 3.2 (version 01/04/2008), the automatic warning system monitors the driver s attention by requiring them to acknowledge the particular nature of a signal (function, aspect). The driver s acknowledgement is considered as being compliant when they operate the notification command within 4 seconds of the start of the information receipt and frees this command at the latest 4 seconds after the start of the information receipt by the repetition device. The memory device (Memor lamp) is intended to remind the driver of the particular nature of the signal. Signal B431 Registration of a negative impulse; the signal is on green. If there is negative impulse from the crocodile, or no impulse, then the driver has nothing to do. Warning sign A positive impulse was expected by the warning sign and requires an acknowledgement from the driver. No impulse was recorded at this signal as the crocodile was defective: from then on the system did not record if the driver acknowledged receipt or not. The study of the impulses from preceding signals confirmed operation of the recording system on board the motor coach. If there is no acknowledgement from the driver, the system warns the driver of this and then forces an emergency braking of the motor coach. The IB does not have any element allowing the confirmation or not that the driver pushed the acknowledgement button. Signal NZ-27 Recording of a negative impulse: the signal is green. If there is a negative impulse from the crocodile, or no impulse, then the driver has nothing to do. The device did not allow the driver s attention in the present case to be verified. 17

18 CONVOY SPEED The reference speed on the line is 160km/h and the rolling stock affected to IC train E922 is capable of travelling at this speed. According to the study of speeds recorded over a distance of 2 kilometres, the authorised speed was not exceeded. There was no action by the driver next to the warning sign for reduced speed. The study of the recording of brake activation allows it to be confirmed that the emergency brake was engaged by the driver around 6 seconds after the signal NZ 27, or after the acknowledgement of signal NZ27, within sight of the original speed reduction sign 62 metres to the rear of said signal. The recorded speed of the train at the moment of passing the signal NZ-27 was around 154km/h. The final recorded speed of the convoy was around 145km/h. The system in place did not allow the convoy to slow down enough SOURCE OF POTENTIAL DISTRACTIONS No source of distraction was mentioned. The train conductor was at the front of the train at the time of the accident. The train conductor s room was situated behind the driving cab no 2. On the day of the accident, the driving cab no2 was oriented towards the front. What is more, the presence of the conductor in the driver s cab is justified in certain cases. According to the conductor s manual, access to the driver s cab in operation of a passenger train in movement is authorised for an urgent reason relating to traffic safety or that of passengers. We have not received elements allowing it to be established whether the conductor was in the driver s cab at the moment of the accident or in the train conductor s room. 18

19 DRIVER LICENCE After his training in accordance with legal requirements at the time, the driver completed the following exams: a theory exam, a medical exam, a psychological exam. The driver was in possession of a valid licence issued by the DRSI. The driver had been driving since September In the context of the evaluation system implemented by the railway undertaking, recently hired drivers are evaluated twice in the course of their first year of service. The driver of the E922 had been evaluated twice in his first year in accordance with the procedure: the result of the evaluation carried out by the instructor was satisfactory CERTIFICATE OF LINE KNOWLEDGE To operate a traction unit alone, the driver previously acquired knowledge of the installations to be passed, line knowledge when operating line trains. Line knowledge is considered to be sufficient (book HLT I.2 version Avis15TR/2004) if it allows, for both directions of travel, compliance with the timetable in normal conditions. The individual knowledge sheet records the list of installations. The driver signs in the column provided, next to the known installation. This knowledge remains acquired as long as the driver regularly travels in the installation. The certificate of line knowledge indicates the installations known by the driver. The driver s certificate records line 97 as being a known installation CERTIFICATE OF ROLLING STOCK KNOWLEDGE In accordance with book HLTI.3 (version Avis 16TR/2004), to be able to carry out alone the service of a traction unit, the driver acquires prior knowledge of the traction unit; knowledge unique to the hauled stock is also required for the driving of towed convoys. Knowledge is acquired in basic training or in additional training required on the basis of needs corresponding to driver allocation. The individual stock knowledge sheet records the series list of traction units. The driver signs in the column provided, next to each series of known traction unit. This knowledge remains known as long as the driver regularly uses a traction unit in this series. The certificate of stock knowledge indicates the traction stock known by the driver. The certificate from the driver shows the traction stock AM

20 3.6. VISIBILITY OF THE SPEED REDUCTION SIGN 6 There were no particular obstructions to the speed reduction sign. It was an unlit reflective sign. It was night time, it was not prominent relatively to the background. To be able to see the sign, the driver had to be alert i.e. direct his attention to precisely this warning sign. With the aim of helping the driver, the sign in the present case is supported by a crocodile, driver assistance system. The crocodile is a driver assistance device and is not considered as a safety system. It provides assistance to the driver. By the effect of the contact brush on the crocodile, the Memor system on board picks up the impulse delivered by the crocodile. The Memor system then shows a light signal and sounds an alarm, which requires a professional gesture from the driver (they demonstrate their acknowledgement by pressing the Memor button) and should allow them to redirect their attention. In addition, from this sign onwards, the driver should brake progressively to reach the speed of 60km/h at the following fixed sign, known as original reduced speed, placed 1479 metres further on. If there is no acknowledgement from the driver, the system warns the driver of this and then forces an emergency braking of the motor coach. The passage of the train on the faulty crocodile did not result in the sending of the impulse to the Sécheron events recorder. In absence of impulse, the recording system cannot confirm or negate the lack of acknowledge by the driver. Without driving assistance (MEMOR), there is a risk of the driver not seeing the sign to slow down. The driver was neither informed that the crocodile was defective, nor that the technicians were on site trying to remove the problem of a faulty crocodile. 20

21 3 21

22 4. ANALYSIS AND CONCLUSIONS 4.1. FINAL REPORT ON THE CHAIN OF EVENTS On Thursday 19 November 2009, at around 23:25, the lateral signalling showed all signals were on green, the passenger train E922 was operating on the normal B track of line 97, at a speed of around 160km/h, reference speed for the line. The train coming from Tournai, with the final destination the station of Charleroi South, was made up of a single motor coach. It was night time, it was dark, the temperature was around 7 C. There was a slight breeze but no precipitation. Line 97 has a tree-lined rectilinear section, there was nothing particularly notable about the environment. After several kilometres of straight line, line 97 presented two successive curves: a small centre-right curve followed by a major centre-left curve allowing access to the complex (grid) of tracks in Mons station. To be able to navigate the two successive curves, a speed reduction, from 160km/h, the reference speed on the line, to 60km/h, is given by a reflective, unlit warning sign and supported by a crocodile. Study of the registration system on board the motor coach showed that the driver did not decelerate from the warning sign, the crocodile did not transmit an impulse, the motor coach did not brake. The train continued and arrived close to Mons station. The driver knew that he was arriving into Mons station from the lighting but this did not give absolute certainty. He was directed to platform 2, the end of the platform was equipped with a main stop signal showing green. The driver passed the signal (NZ.27) showing green at around 154km/h. Six seconds after passing this signal, the driver engaged the emergency brake. At around 23:26, the train derailed in the parabolic transition curve area between the two curves at a speed of approximately 145km/h. The cars of the motor coach crossed the adjacent tracks, the first car of the train uncoupled from the rest of the convoy, crossed a wooded area and came to rest on line 96 on its right side. The rest of the train set, 2 cars, came to a standstill in the embankment situated between line 97 and the wooded area. In derailing, the train ripped out a catenary portal structure, dragged this along with it and ripped out a portion of the rail which broke apart with the force, causing major damage to the railway infrastructure installations. The train conductor was killed in the accident; the driver, seriously injured, was transferred to hospital. Considering the late hour and the final destination of passengers (Mons), there were few passengers on board: they were not injured in the accident. The damage caused to the rolling stock and the infrastructure was considerable: train traffic was suspended on lines 96 and 97 between Mons and Quiévrain and Quévy. 22

23 ANALYSIS Three telegrams (11:47, 20:38, 22:30) were sent by drivers to report the lack of impulse in the crocodile supporting the speed reduction sign. Several drivers (according to information received by the infrastructure manager this concerned 83 train journeys) did not report the crocodile s lack of impulse. Respecting this safety rule is however essential. Reporting a failure is an additional safety rule: the crocodile is a simple driving assistance system and therefore fallible. Reporting failures to elements of infrastructure by drivers allows the infrastructure manager (IM) to have a good idea of the situation. Following receipt of two telegrams within 24 hours for a single crocodile, an intervention was planned: the repair could have been planned more quickly in the course of the day. In accordance with the internal rules of the IM, at around 21:12, Traffic Control contacted the signal box in Mons to report the failure of a crocodile so that an electrician could be called to the site. The Traffic Control agent did not communicate by telephone the content of the E361 crocodile telegram in accordance with the rules, codes and procedural terms foreseen, according to the order of chapters. The forms (E361) indicated the signal NZ27 as the first signal to the rear of the faulty crocodile. He appears not to have checked the signalling plan. The communication concluded with the fact that the crocodile on the signal (B431) was faulty. The signal box operator called the technician on duty. He informed him that he should check the impulses on the signal (B431). The information in the telegrams was not communicated to the technician. The technician and a guard went to the scene at around 21:50 to test the impulses by the light signal (B431) and not by the reduce speed sign. The technician did not find anything unusual in the crocodile by signal B431 but fearing an intermittent fault, the technician decided to carry out a switch to a direct feed, not having found the spare electric power supply unit. The technician tested the operation of the signal, which was normal. The technician and the guard then went by car to the next signal, so they did not go past the crocodile on the speed reduction sign. 23

24 The technicians called for the intervention were from the Saint Ghislain zone and not Mons. The technician tested the signal NZ.27. In order to carry out the measures, at about 23:00 the technician asked the signal box manager to schedule an itinerary to change the aspect of the signal. The signal, which was showing double yellow, was first programmed to change to red, during the tests, and then green: the test results were in accordance with expectations. The signal NZ.27 then stayed green as the traffic conditions allowed it and to authorise train E922 to enter Mons station. The driver encountered all signals showing green. This procedure is authorised by the internal rules of the infrastructure manager. At around 23:26, the passenger train passed signal NZ.27 (green). He was not required to press the acknowledge button. The driver saw the original reduce speed sign without a black number on a white background 2. The driver pressed the emergency brake but considering the high speed of the train, this did not allow the derailment of the train, which happened just after, to be avoided According to the elements received from the infrastructure manager, the absence of a figure on the sign (outdoors as on the Schematic Signalling Diagram (SSD)) is justified by the fact that the signal NZ.27 could show a speed reduction to 40km/h for certain routes.

25 4 25

26 4.3. CONCLUSION DIRECT AND IMMEDIATE CAUSE According to our scenario, the immediate and direct cause of the derailment was the excessive speed of the motor coach in an S curve following a lack of reaction by the driver to a reduce speed sign requiring a progressive speed reduction. The driver was in possession of a licence and adequate certificates of line knowledge and rolling stock knowledge. No element allows it to be established that the driver did not possess the required line knowledge. The investigation has not allowed a source of distraction to be established THE INDIRECT CAUSES ARE 1. absence of impulse in the crocodile supporting the reduce speed sign. There was no particular obstruction reducing visibility of the sign; however it did not appear clearly in relation to the environment, due to the darkness. In the event of an impulse on the crocodile, the driver is alerted by a light signal in the driver s cab and must perform professional gestures. Without the support (MEMOR) provided by the impulse of the crocodile, it did not draw the driver s attention. The driver was not informed that the crocodile was not working. 2. the lack of reporting of the faulty crocodile by drivers to the infrastructure manager probably altered the infrastructure manager s thought process which did not allow them to intervene earlier. 3. the non-compliance with the procedure for communicating a telegram by agents of the infrastructure manager and non-consultation of the signalling plans: this did not allow the crocodile to be repaired before the train passed. 4. no particular environmental factors (long, straight line bordered by trees) during the night: this probably created a loss of reference points for the driver. 5. the fact that the driver encountered all signals showing green 3 : this neither assisted nor allowed the driver to re-evaluate his incorrect mental image This procedure is allowed based on the internal rules of the infrastructure manager.

27 UNDERLYING CAUSES Railway safety is largely based on compliance with trackside signalling and on line knowledge by the driver. While the IB considers that attitudes and behaviour adhering strictly to the established rules are necessary to prevent accidents in the sector, the IB does not consider that this compliance is sufficient to ensure safety. Despite their knowledge of the rules, even the most motivated employees can have failures, commit faults or make errors. In the majority of cases, human interpretation allows situations to be managed and accidents to be avoided. The barriers which existed were revealed to be insufficient considering the risk of derailment by excessive speed, when the signalling indicators were not correctly recognised or respected. What is more, there was no means of recovery. The absence of technical equipment to manage the speed of trains and automatically engage an emergency brake when the authorised speed is exceeded, make an accident possible. A solution for sufficiently protecting the Belgian railway system is to install automatic protection functions such as speed control devices and automatic braking, independent of human intervention. In the present case, the TBL1+ system would not have prevented a derailment as this system is intended to protect dangerous points covered by closed signals (warnings) themselves equipped with beacons and not regularly monitor the speed of a train in areas where speed reductions are required. The ETCS system level 1 or 2 installed on board the rolling stock would have allowed the accident to have been prevented. A solution would be to equip the system, in addition to the automatic functions, with a real recovery capacity. In certain situations, an additional information (extra sign, TBL-beacon, etc.) could help drivers make decisions and reinforce them, thus reducing the risk. 27

28 5. MEASURES TAKEN 5.1. MEASURES TAKEN BY SNCB/NMBS Carrying out checks on procedures for transmitting the crocodile telegram E361 by drivers. As a preventive measure, reminder of the procedure concerning the presence of third parties in a driving cab in service for reasons other than safety INFRABEL AND SNCB/NMBS Following a joint consultation between the SNCB/NMBS and the infrastructure manager, it was decided that a permanent warning sign for speed reduction sign B should be added, equipped with a crocodile for cases where there is a speed reduction of more than 50km/h on the network, like that in Mons. Revision, together with Infrabel, of the procedure for exchanging telegrams and in particular those concerning the repetition incidents E361: Amendment of the E361 form to better situate the faulty crocodile. Evaluate the feasibility of informing drivers of the fault of a crocodile via GSM-R, ground-train radio or by another means. Evaluate the feasibility of implementing a stepped braking system in areas where there is a large speed reduction (160km/h to 0km/h) INFRABEL Reminder of communication rules between agents. 28

29 5 29

30 6. ANNEX 6.1. EXTRACT FROM THE LETTER SENT BY INFRABEL TO SNCB/ NMBS ON 17 DECEMBER 2009 We have also carried out a check of the impulse on the sign in the permanent reduced speed zone prior to the signal NZ.27. On 18/11/09 we noted that the last train receiving a positive impulse was the Thalys 9499 at 20:59; The following trains did not receive a positive impulse and this was also verified for the day 19/11/09 up until the accident. 30

31 6 31

32 Investigation Body for Railway Accidents and Incidents