Carmont – So much to learn (part one)

In March last year, Network Rail published its ‘Resilience of rail infrastructure’ report setting out the actions it was to take following the fatal derailment at Carmont on 12 August 2020. This was accompanied by reports from Lord Robert Mair and Dame Julia Slingo who were, respectively, leading the Earthworks Management and Weather Advisory task forces that Network Rail had set up after the derailment.

Rail Engineer summarised the findings of Lord Mair’s 543-page earthworks report and Dame Slingo’s 77-page weather report in issue 190 (May/June 2021). Mair concluded that the dominant reason for earthworks failures is the exposure of over-steep and previously failed slopes to rainfall patterns not previously experienced. It also noted that expressed pore water pressure was a more important parameter than the soil moisture index used by Network Rail to monitor earthworks. It considered that “predicting exactly where failures will occur is like looking for a needle in a haystack” and noted that a better approach is to “search for the haystacks”, i.e., vulnerable lengths of slope.

Task Force recommendations

Mair made 54 recommendations including the importance of: drainage management and design; integrating earthworks, drainage, and vegetation management; improved earthworks asset management using intelligent infrastructure data; and better monitoring technologies to detect failures and predict possible failures.

Dame Slingo’s report noted that using weather data to best manage railway operational risks requires an understanding of how rainfall translates into geohazards, and timely operational decisions can make the best use of forecasts. Its recommendations included the need for an easily accessible new digital weather platform that integrated all relevant information and professional competencies in meteorology and hydrology. She felt a four-stage weather management framework was required which was: Awareness (recognising possible red weather alerts 4-5 days out); Preparation (assign red alerts two days out using kilometre-scale forecasts); Response (alerts from nowcasting during extreme weather); and Recovery (weather forecasts for recovery).

The final report of the Rail Accident Investigation Board (RAIB) on the Carmont derailment was published on 9 March and broadly endorsed the Mair and Slingo reports. With so many worthwhile recommendations from these reports, it might be thought that there is not that much more to learn from it. Yet, a study of its 298-pages showed it had much to recommend about Network Rail’s project management processes, control room management, corporate learning, the operational risk of failed earthworks, derailment mitigation and crashworthiness.

This feature explains why the RAIB report shows the need for improved project and asset management as well as an improved operation response to severe weather. Its summarised recommendations are shown in bold. The crashworthiness of the older trains is addressed in a following feature.

Drain not as designed

In 2011, Carmont cutting was the subject of a £1.8 million project to address its stability as it had been overtopped by drainage run-off resulting in soil and small rocks landing in the cess below. As we reported in issue 77 (March 2011), this was partly due to an increased area of farmland and the reduced effectiveness of field drains. After stabilising the cutting with netting and rock nails, a new crest drain was installed. The work was one of many concurrent projects delivered under a framework ‘design- and-build’ contract let to Carillion. A Network Rail project manager led a team overseeing the work delivered by this agreement. His team were co-located with Carillion’s project team at Bishopbriggs near Glasgow.

The new crest drain was the last part of this work. However, this required land outside the railway boundary and so had to wait until a legal agreement with the landowner was finalised. Hence in 2011, it was only possible to install the 20 metres at the bottom of the northern end of the cutting of the drain that was within the railway boundary.

By the time that the legalities had been finalised in August 2012, the original Carillion team had dispersed and so a new team installed the remaining 330 metres of drain. Although the original Carillion team had submitted technical queries about the drain to designers Arup, no such queries were submitted by the new team.

The drain gently sloped as it ran along the top of the cutting for 285 metres then, from catchpit 16 (CP16), it descended at a 1 in 3 gradient to CP19 along the side of a funnel feature which captures much of the drainage from the fields above. RAIB concluded that, as designed, it was highly likely the drain would have accommodated the high surface water flow prior to the derailment. Yet its report considered that the Carmont accident had shown that drainage design process could be improved and so recommended that: Network Rail’s design process should take full account of the issues highlighted by its Carmont report.

The report showed that various aspects of the drain were not in accordance with the design. Two particularly significant issues were that catchpit 18 (CP18) was in the wrong location and so did not have the pre-2010 drain connected to it, and a bund had been constructed seven metres upslope of CP18. This bund captured the funnel feature’s drainage and channelled it into the drain.

The 51.5mm of rain that fell on the accident site between 0550 and 0900 was considered to be a one in a hundred-year event. Drainage modelling commissioned by RAIB concluded that the bund had diverted much of the flow down the funnel feature into the drain above CP18. Hence, at this point, the flow through the drain was 140 litres/sec compared with the 14 litres/sec that could percolate through the gravel for each metre of drain. This excessive flow and the lack of damage to the drain upstream of the bund showed that it had caused the washout.

RAIB also concluded that had the bund not been built there would still have been a washout, as CP18 was installed at the wrong location so that the old drain could not be connected to it.

Project monitoring

RAIB presented convincing evidence to show that Carillion formed the bund during their 2012 drainage work. However, perhaps due to the company going into liquidation, there are no surviving records of the work undertaken at this time. Hence, there is no evidence explaining why the bund was built or any records of approval for its construction.

There was also no evidence that moving CP18 from its as-designed position had been approved by the designer. Had this been done, Arup might have resolved the mismatch between its design and the circumstances on site.

Network Rail’s asset management procedures required the project manager to complete five forms in agreement with the maintainer: (i) a schedule of the deliverables; (ii) a pre-work dilapidation survey; (iii) a construction completion certificate; (iv) a ‘taking over’ certificate; and (v) a ‘final certificate’ recording rectification of defects found. Other than the pre-work dilapidation survey on 15 December 2009, none of the other completed forms could be found.

The Designated Project Engineer (DPE) is responsible for formal acceptance of construction on behalf of Network Rail. They are required to do this by a sample review and confirmation that quality assurance processes are in place. RAIB was unable to find any such review, or evidence of formal acceptance of design changes.

Network Rail’s construction manager regularly visited Carmont and other projects. Witnesses indicated that his main responsibility was monitoring site safety arrangements and checking the standard of work which would not detect design deviations. Principal contractor audits were also undertaken but these could also not detect unauthorised design changes as they were not carried out at site level.

Project completion

The project completion process requires as-built drawings produced from the contractor’s marked up ‘Approved for Construction’ drawings. These could have been used to identify works that are not in accordance with design. RAIB report records how Arup chased Carillion for marked up drawings but got no response.

Network Rail’s standard on the engineering management of projects requires the DPE to verify that as built records accurately record the infrastructure that Network Rail takes into operational use. It also requires the project manager not to close out any project until the relevant Network Rail departments have accepted the required records. Yet there were no records to confirm how checks required by the DPE and Project Manager were undertaken in respect of the completion of the Carmont drainage works.

In addition, the Construction (Design & Management) Regulations require a health and safety file (H&S file) to be prepared with all the information needed for future construction activities which includes as-built drawings. The Client (Network Rail) is responsible for ensuring that the principal designer prepares this H&S file and that it is kept available for any person who may need it. However, no trace could be found of the H&S file or any Carmont drainage as-built records.

RAIB asked Network Rail for H&S files for other 2012 Carillion projects. Of between 48 and 64 projects, Network Rail stated that it held H&S files for only 16. They also found that only five of the 11 drainage schemes completed in Scotland between 2014 and 2019 had been transferred into Network Rail’s Ellipse maintenance system. Witnesses indicated that the inefficient asset knowledge transfer from constructors to maintainers was a known problem throughout Network Rail.

In view of the above, RAIB made a recommendation requiring Network Rail to review its contract and project management processes to substantially reduce the risk of contractors modifying the design without approval and ensure the timely provision of the accurate records needed for future management of the asset.

Drainage inspections

RAIB found no evidence that Network Rail had ever inspected the drain upslope of CP18. This was because the upper part of the drainage system, installed in 2012, was not on the Ellipse infrastructure maintenance database. The lower part of the drain, installed in 2011, was on Ellipse as it had been surveyed as part of a project to identify drains for which there were no records. This survey was done before the upper drain was installed.

Although the upper part of the drain not being inspected is of concern, it was felt uncertain whether this could have prevented the accident as the bund became covered with dense gorse in the years following its completion in 2012.

The report also considered that Network Rail’s procedures for routine cutting examinations were open to differing interpretations. Carmont cutting is a ‘mixed’ cutting of soil and rock. The earthworks examination manual requires the examiner to go up slope of such cuttings, yet the inability to do this in steep cuttings, and therefore the lack of a crest drain examination, was not always reported to Network Rail.

In view of the above, RAIB recommended that recent infrastructure projects be retrospectively incorporated into asset management processes. This recommendation was specific to Scottish projects since 2012 but required that Network Rail should consider whether to extend this exercise outside Scotland and to work constructed before 2012.

It also recommended that the earthworks examination manual should be reviewed to consider: a) the reporting of incomplete examinations; b) whether working practices are compatible with its intent; and c) clarity in respect of mixed cuttings.

Before the derailment

During the night of 11/12 August 2020, 30 recorded weather-related infrastructure failures had blocked railway lines in Scotland’s central belt and eastern areas. By 05:00 hrs, the only unaffected Scottish main line was from Inverness to Dundee via Aberdeen.

After train 1T08 left Aberdeen at 06:38, control started to receive information about weather- related issues between Aberdeen and Dundee. At 07:00 a northbound train stopped at Carmont signal box where its driver reported a landslip on the up line a mile to the south. As he did so, 1T08 passed the signal box. The signaller then immediately made an emergency call on the GSM-R system so 1T08 was able to stop 570 metres before the landslip.

Control then decided that the train should return to Stonehaven, however this required mobile operations staff to secure the Carmont crossover points. While this was being arranged, the near continuous heavy rain in the area resulted in four line blockages within 18 kilometres of Carmont. At 09:28 hrs the signaller was able to authorise 1T08 to proceed towards Stonehaven with no instruction to run at reduced speed. The train passed Carmont signal box at 09:34 and, travelling at 73mph, was derailed three minutes later by washed out debris.

Prior to the derailment, 1T08 might have hit the landslip south of Carmont had a northbound train not reported it in time. There was also no instruction to proceed at reduced speed when the Carmont signaller authorised the driver to proceed toward Stonehaven. Hence it is not surprising that nearly half of the RAIB report considers the adequacy of Network Rails operational arrangements to manage the risk of earthworks failure in severe weather.

A&EWP, EWATs and NRWS

The ‘ScotRail Alliance’ aims to encourage close collaboration between Network Rail and ScotRail whose respective route control staff are co-located in the integrated route control centre. This is led by the head of integrated control who reports to ScotRail’s operations director.

The ScotRail and Network Rail shift control teams are respectively headed by a duty operations manager (DOM) and route control manager (RCM). Reporting to the RCM on each shift are two incident controllers who manage reported defects and problems in east and west Scotland. On the night of 11/12 August the RCM’s team had three additional support staff.

Despite the forecast severe weather, there were no additional staff in the control room which is manned to deal with routine events. Hence its staff were overloaded on the morning of 12 August. RAIB considered that with more staff there might have been mitigation for the potential threat to 1T08 from the extreme weather.

Scotland’s integrated control must follow an ‘Adverse & Extreme Weather Plan’ (A&EWP) as required by Network Rail’s operational standards. This includes listings of ‘at risk’ locations and actions required if weather thresholds are exceeded. Such locations included earthworks, bridges at risk from scour, and areas subject to flooding. It did not include Carmont cutting which Network Rail had no reason to believe was at risk. National standards did not require the A&EWP to consider mitigation at locations that were not ‘at risk’ during high rainfall.

RAIB found that in the days and hours leading up to the accident, the actions taken by Scotland’s route control staff were broadly consistent with the A&EWP, but at significant variance with Network Rail national standards. This was because the RCM did not declare a ‘red’ route alert on the day of the accident given the weather forecasts during the days beforehand. This would have led to extreme weather action teleconferences (EWATs) being called to co-ordinate weather-related responses from various parts of the rail industry.

RAIB concluded that although an EWAT would probably not have prevented the accident this cannot be discounted as a factor in the Carmont accident.

A weakness of Scotland’s A&EWP was that it did not require control to respond in real-time to weather observations. Instead, RCMs were heavily reliant on the daily forecasts issued at 03:00 hrs rather than the subsequent short-term forecasts available from the Network Rail Weather System (NRWS) which was introduced in 2015. However, NRWS had not been configured to provide this information and route control staff had not been trained to use it for decision making.

NRWS provides: (i) route-specific five-day forecasts identifying whether weather thresholds might be breached in Scotland’s five forecast areas; (ii) hour-by-hour, location-specific forecasts including 21 within the ‘Perth’ weather area; (iii) real-time weather data from 44 Scottish locations including 18 in the ‘Perth’ weather area; (iv) real-time alerts set by users (e.g. rainfall, exceeding specified values); and (v) a Precipitation Analysis Tool (PAT) which combines forecast rainfall and current soil moisture index to indicate the risk of slope instability.

Geotechnical asset management staff were responsible for identifying NRWS locations which, at the time of the accident, were limited to the A&EWP’s ‘at risk’ list. If appropriately configured, NWRS could have shown when precautions were needed at locations not on the ‘at risk’ list. However, at the time Network Rail had not provided the required rainfall thresholds.

It was also found that controllers in Scotland, and elsewhere, had not been given sufficient guidance or training to enable them to effectively manage complex situations of the type encountered on the morning of 12 August 2020. Although the route control staff had been assessed in accordance with the competence management system this did not detect route alert codes not being allocated or EWATS not called as required by standards and also that Scottish route control staff had not been trained to use NRWS.

Bow tie analysis

To develop its earthworks policy, Network Rail undertook a series of ‘bow tie’ analyses, so-called from the shape of its diagram. The left-hand side considers potential causes of a particular threat and required preventative measures while the right-hand side considers the controls needed to manage the consequences should the threat materialise.

Although Network Rail has done much to minimise the risk of earthworks failures, it is not reasonably practicable to prevent all such failures. Moreover, since these are linked to rainfall, it would seem that the underlying risk has been rising over time.

In a 2019 analysis, the bowtie’s right-hand side considered that the most important mitigation for an earthworks failure was ‘operational control.’ Although no detail was provided about how such operational measures might be applied, the effectiveness of this mitigation was deemed to be ‘optimal’ which meant that Network Rail considers this to be an adequate risk control.

However, RAIB found no evidence that Network Rail had assessed the risk of its operational controls failing during extreme rainfall or had systematically evaluated their effectiveness or completeness. Hence, despite increasing awareness of the threat, the bowtie analysis did not trigger action to improve mitigation by, for example, incorporating new operational controls made possible by advanced technology. This shows that Network Rail had not understood how its processes did not adequately address the risk from extreme rainfall events.

RAIB observed that a technology-based strategy with real-time data and improved communications has real potential to manage the risk from extreme rainfall. However, this would require a higher level of control staff competence. It was felt that such a strategy would facilitate improved mitigation such as instructing drivers to run at speeds commensurate with the rainfall-related risk in the locality; improved operation of route proving trains and the development focused contingency plans.

To address the above, RAIB made recommendations that require Network Rail to:

• Review its processes for mitigating rainfall-related threats to earthworks and drainage that could affect the safety of trains
• In consultation with train operating companies, review the capability of its control rooms to manage complex, widespread and unusual situations
• Undertake a project to improve the management assurance of safety critical functions of route control rooms.
• With the assistance of RSSB and RDG define the process for operating route proving trains taking account of hazards and circumstances in which such trains operate.
• In consultation with RSSB, undertake a systematic risk assessment of the operational responses to weather-related failures of earthworks, drainage, and structures.

Lessons not learnt

RAIB has investigated 11 earthwork failures that had deposited debris on the railway as the Carmont washout had. Its reports demonstrated: a) the potential for events at locations not deemed to have a high failure risk; b) the likelihood of rain, particularly heavy rainfall, triggering the event; and c) the importance of effective drainage systems (seven of the 11 events had inadequate drainage).

There were similarities between the accidents at Carmont and Watford in 2016 as control staff had access to NRWS but did not use it. RAIB considered that more effective implementation of three of its recommendations might have mitigated, if not prevented, the Carmont accident. Two of these were from RAIB’s 2014 landslips ‘class’ investigation and the other from its 2016 report on the partial failure of Lamington viaduct in respect of control centre processes for the safety of Scotland’s railway infrastructure.

RAIB has investigated various events involving the role of route control. At Lewisham in 2018, passengers alighted onto the track in an uncontrolled manner. At Baildon in 2016 three trains ran over track where ballast had been washed away while controllers were not able to direct response staff to the correct location. Near Kentish Town in 2011, a train was stopped for two and a half hours, and the driver was unaware passengers had alighted onto the track when it started to move. Taken together, these reveal the importance of effective decision making and incident management skills in railway control rooms.

In July 2020, Network Rail audited its closure of RAIB recommendations and its own investigations and concluded that its process for tracking recommendations was working effectively. Yet this RAIB investigation established that on occasions the company appeared unaware of the effectiveness of its implementation of recommendations. RAIB concluded that Network Rail needs to ensure that valuable corporate learning is translated into practical measures for improvement.

The lack of effective learning from previous events led RAIB to recommend that Network Rail, in consultation with the Office of Road and Rail, review the effectiveness of its response to safety recommendations and identify obstacles to implementation of lessons learnt from previous events.

There is indeed much to learn from the tragic Carmont accident.

---