Independent report

Near miss between a train and heavy goods vehicle near Craven Arms, Shropshire, 22 July 2024

Published 18 September 2024

1. Important safety messages

This incident demonstrates the importance of:

• signallers undertaking only those tasks which they are assessed as competent to undertake
• infrastructure managers ensuring that local instructions align with the competencies of the staff required to implement them
• infrastructure managers ensuring effective assurance arrangements exist to prevent systems intended for emergency or out-of-course events becoming routinely used during normal operations
• maintenance staff effectively checking that cases intended to be secure are appropriately sealed or locked to prevent inappropriate use and to support assurance activities.

2. Summary of the incident

At around 10:00 hrs on 22 July 2024, a southbound engineering train was signalled over Craven Arms level crossing while the barriers were in the raised position and the crossing was open to road users.

A heavy goods vehicle (HGV) entered the crossing shortly before the train reached it. On sighting the HGV, the driver of the train made an emergency brake application, while travelling at around 15 mph (24 km/h). The train avoided striking the HGV by around 2 seconds. The driver of the HGV was unaware of the near miss.

The train came to a stand over the level crossing 6 seconds after the emergency brake application. Nobody was injured in the incident, and no damage was caused.

HGV on the crossing as the train approached (courtesy of One Big Circle).

3. Cause of the incident

The incident occurred because the train was able to be signalled over the crossing while the barriers to road traffic were raised. This was possible because the controls the signaller used to operate the crossing circumvented the engineered safeguards intended to prevent such an occurrence.

The railway at this location forms part of the Welsh Marches railway line which runs from Shrewsbury to Newport (Gwent). It is composed of three lines aligned in a north/south direction. The line to the east is the Down Goods loop, which has a maximum permissible speed of 15 mph (24 km/h). The middle line is the Down Main line which has a maximum permissible speed of 90 mph (145 km/h). The two down routes converge to the north of the level crossing. The Up Main line on the western side of the railway is not relevant to this incident.

Signal CA27 is located on the approach to Craven Arms from the north at a set of points which allows trains to use either the Down Main line or the Down Goods loop.

Track layout on the approach to Craven Arms level crossing from the north; not to scale and not all features shown. The level crossing barriers are shown in the raised position.

This section of railway and the associated level crossing are controlled by a signaller at Craven Arms signal box, situated adjacent to the crossing. The signaller uses levers to command the movement of points and signals, which work within an electromechanical interlocking. The interlocking controls the setting and releasing of signals, points and other apparatus to prevent a potentially unsafe condition of the signalling system from arising.

Craven Arms level crossing is a manually controlled barrier (MCB) crossing, operated by the signaller using a control panel in the signal box. The location of this control panel, next to a window, allows the signaller to have a direct view of the crossing.

When a train approaches, the signaller uses the control panel to start the crossing’s road closure sequence. This initially activates the level crossing road traffic lights and audible alarms to stop road users, followed by the barriers lowering across the full width of the road. Signallers are required to check that nothing is trapped inside the barriers and, once satisfied, confirm this by pressing the ‘crossing clear’ button. This can only be used after the crossing barriers have been proved to be in the down position. Pressing the crossing clear button releases the barrier locking lever in the signal box and allows the signaller to move it into its normal position in the frame.

With the barrier locking lever in the normal position, the interlocking allows the levers controlling signalled routes over the crossing to be operated. The placing of the barrier locking lever in the normal position also deactivates the ‘raise barriers’ button on the crossing control panel within the signal box, to prevent the crossing from being opened when trains are approaching. This is known as approach locking, and is discussed more fully in the RAIB report into a fatal accident at Moreton-on-Lugg, which occurred in January 2010 (RAIB report 04/2011).

Once a train has passed through the area, the signaller returns any levers controlling signalled routes over the crossing to their normal (stop) positions. This releases the barrier locking lever, which should be returned to its reverse position. This reactivates the crossing control panel so that the signaller can initiate the crossing reopening sequence.

Craven Arms signal box lever frame. For illustrative purposes the red levers are ‘in the frame’ in their normal positions. If they were to be pulled ‘out of the frame’ to their reverse positions they would be on the right-hand side of the image, similar to the blue levers.

In an emergency, signallers may replace a signal to stop at any time. This includes occasions when an approaching train driver may not be expecting to see a stop signal based on the previous signal aspects which they have passed. Interlockings include a time-out function which allows signals to be returned to stop immediately but maintains the interlocking for the previous route for a period of time afterwards. This ensures that any approaching train has either had enough time to come to a stand before the signal or, in the event of an overrun, prevents potentially conflicting routes from being set and trains encountering points in the mid-position.

In this instance, the interlocking for the route from signal CA27 is maintained for 70 seconds after the signal has been returned to stop. When returning the lever controlling signal CA27 to stop, signallers are required to press a plunger to permit the lever to fully return to its normal position.

Outside the signal box, next to the level crossing, there is a local control unit (LCU) for the crossing. The LCU has a switch with 3 possible positions which override the commands from the control panel and allow the crossing to be operated in the event of a failure, or to facilitate maintenance activities. The options available at the LCU are ‘raise’, ‘lower’ or ‘normal’. Returning the switch to the normal position returns control to the control panel within the signal box. Use of the LCU will operate the crossing outside of the engineered safeguards provided by the interlocking. For this reason, the LCU should be used only when authorised by the relevant rules and access to it should be controlled.

The key to the LCU at Craven Arms signal box is contained within a break-glass box situated above the lever frame to enable access by a signaller or other response staff in the event of a failure. The box is intended to be locked so that it is necessary to break the glass to gain access to the key. In the event of access being required, the signaller should record this in the train register and arrange for the glass to be replaced by the relevant signal and telecoms (S&T) maintenance team. S&T maintenance staff are also issued with keys to LCUs as part of their equipment.

LCU located outside of the signal box (left). LCU’s internal switch (right).

The signaller involved in this incident had worked for 24 years in the area around Craven Arms, 22 of those years as a relief signaller covering Craven Arms and 7 other local signal boxes.

The train involved in the incident was a track recording unit (TRU), reporting number 2Q08. The train was operated by LORAM on behalf of Network Rail and had departed from its base in Derby at 06:43 hrs on the morning of the incident. As the train approached Craven Arms, the signaller accepted it from the previous signal box, closed the crossing to road users using the control panel in the signal box, and cleared the signals for the train to pass on the Down Main line.

At around 09:48 hrs, train 2Q08 stopped at signal CA27, located on the approach to Craven Arms, while it was showing proceed. The driver then contacted the signaller to advise that the train was being signalled to use the Down Main line but needed to go through the Down Goods loop to take a measurement of the track quality on that line. The driver requested a route through the Down Goods loop and back onto the Down Main line without stopping, because this improves the quality of the track measurement data obtained. This is an unusual movement as trains using the Down Goods loop normally stop in the loop and are overtaken by trains passing on the Down Main line.

Although an email had been sent to the signal box on 19 July advising that train 2Q08 needed to be routed through the Down Goods loop, the signaller had not received this information. This meant that they were unaware that the train needed a specific routing until they were contacted by its driver.

The signaller explained that they would need to return signal CA27 to stop, reset the points, and then clear signal CA25 to allow the train to enter the Down Goods loop. The signaller told the driver that there would be a short delay while the signalling system applied a timeout to the lever controls. The driver and signaller agreed that the train would not be moved during this process.

While attempting to cancel the route set along the Down Main line, the signaller found that they could not pull the barrier locking lever to its reverse position. This was initially due to the approach locking on the level crossing being maintained by the 70-second timeout function on signal CA27.

During this time, the signaller became conscious of road traffic building up on the road outside of the signal box. Because they were unable to move the barrier locking lever to the reverse position, the level crossing controls within the signal box remained inactive. The signaller therefore decided to use the LCU outside the box to reopen the crossing to road users and clear the road traffic.

After reopening the crossing using the LCU, the signaller then went back inside the signal box and made several unsuccessful attempts to return the lever for signal CA27 fully into the frame, although by this time it should no longer have had a timeout preventing this from occurring. The data logger at Craven Arms signal box does not record the position of the lever or operation of the plunger and post-incident testing found no reason why the lever would not return to the normal position after the 70-second timer had elapsed provided the associated plunger was pressed. This means that RAIB cannot be certain why the lever would not return to the normal position during the incident.

The signaller then closed the crossing to road traffic using the controls within the signal box. Around 8 minutes after the initial call from the driver of train 2Q08, the signaller received a second call from this driver, who was still waiting at the junction, asking if there was a problem. The signaller reported that there was a problem with returning the lever which controls signal CA27 to the frame, so they were unable to set the route through the Down Goods loop. The signaller said they would try to resolve this for another 5 minutes before reporting it to the control room at Cardiff railway operating centre (ROC).

The signaller then made further attempts to replace the lever controlling signal CA27 into the signal frame before going back outside and raising the barriers, again using the LCU to do this. The signaller then returned to the operating floor of the signal box and was able to return the lever controlling signal CA27 to the frame.

The signaller had never previously signalled a train through the Down Goods loop without it stopping. When setting this route through the Down Goods loop, the signaller set the points at the entrance to the loop and cleared the entrance signal (CA25) into the loop. Once the train had entered the loop, which the signaller could see using closed-circuit television (CCTV), the signaller returned signal CA25 to stop behind the train and reset the loop entry points to their normal position. The signaller then felt that they had to rush to set the points at the loop exit and clear the loop exit signal (CA24) to avoid bringing the train to a stand, as previously requested by the driver. In carrying out these actions, the signaller did not recognise that the level crossing remained open to road traffic.

The signaller was able to set a route over the crossing while it remained open to road traffic because their use of the LCU permitted the barrier locking lever to remain in its normal position regardless of the status of the crossing equipment. This in turn permitted the signaller to set the route for the train through the goods loop and clear signal CA24.

The level crossing was fitted with overrun controls. This meant that, as the train was on the points moving from the Down Goods loop to the Down Main line, the signalling system detected a train approaching with the level crossing open to road traffic and activated the road traffic lights. However, forward-facing CCTV footage from the train shows that that the HGV cab was beyond the road traffic lights when they activated, meaning the HGV driver did not have an opportunity to react to that warning.

Having seen the near miss from the window of the signal box, the signaller spoke to the driver of the train and then immediately reported the incident to Cardiff ROC. The signaller was relieved from duty and train movements through Craven Arms were suspended until a replacement signaller arrived at 11:43 hrs.

Network Rail’s S&T fault team arrived at the signal box at around 12:54 hrs and started testing to understand if the signalling system had worked as designed. At 14:36 hrs, the S&T team reported to Cardiff ROC that no faults had been found with the signalling system or the time-outs applied by the interlocking and that there were no faults with the approach locking for the crossing. These post-incident checks did not detect that the box containing the LCU key was not locked or sealed.

Craven Arms signal box block shelf, showing the key used to access the LCU.

The signal box special instructions (SBSIs) for this location give the signaller permission to use the LCU during a failure. However, local managers working for Network Rail stated that signallers at Craven Arms are not permitted to use the LCU in this way. Although use of the LCU is covered during initial training, there is no specific competency associated with it, meaning that signallers are not subsequently reassessed on its use.

LCU data logger evidence shows that the external LCU door had been opened 359 times since 22 November 2021. Although a small number of such events could be expected due to maintenance and out-of-course operations, this number of recorded events supports witness evidence that the LCU was routinely used by signallers at this location to control the crossing for some time before this incident occurred.

There was no evidence that local managers and supervisory staff recognised that there was frequent use of the LCU or that there were inconsistencies between the instructions in the SBSIs and the competency regime for signallers.

Following this incident, RAIB visited Craven Arms signal box on 23 July 2024. During this visit, RAIB observed that the key to the LCU was still stored in a glass-fronted box that was not locked or sealed, allowing anyone within the signal box uncontrolled access to it. This meant that there was no effective control on the use of the LCU and, without the need to break the glass on the box, a source of evidence of LCU usage which could have been used by managers for assurance purposes was lost.

The relevant signal maintenance standard, NR/L3/SIG/10663, ‘Signal Maintenance Specifications’, issue 23 dated June 2022, states that one of the tasks required during the relevant check is to ‘check all block shelf components and fittings are secure and seals are correctly fitted’. In the case of Craven Arms, this would mean verifying that the LCU key box is locked or sealed. The standard requires this check to be undertaken at a nominal interval of 91 days, and a maximum interval of 364 days. The S&T maintenance team responsible for Craven Arms reported that this check had been completed in line with the requirements of the standard. The status of the LCU key box during and after the incident suggests that these examinations were not effective at detecting if it was correctly secured.

4. Previous similar occurrences

A number of incidents involving the operation of level crossings by signallers have previously been investigated by RAIB. Some of these incidents have resulted in collisions between rail vehicles and road users. RAIB reports discussing incidents with similarities to the incident at Craven Arms include:

• A fatal accident at Moreton-on-Lugg which occurred in January 2010 where a train struck two cars on a level crossing (RAIB report 04/2011). The report found that the signaller raised the barriers when a train was approaching, and there was no engineered safeguard in the signalling system to prevent this error.
• An incident at Lydney in Gloucestershire which occurred in March 2011 where a train passed over an MCB type crossing with the barriers in the raised position (RAIB report 20/2011). Nobody was injured and there was no near miss with a road vehicle. The report found issues with the communication between the signaller and the level crossing keeper, in addition to a lack of understanding of how various aspects of the signalling system were impacted by raising and lowering barriers.
• An incident at Ufton in Berkshire which occurred in September 2011 where a train passed over an automatic half barrier crossing with the barriers in the raised position (RAIB report 28/2012). Nobody was injured but a car avoided a collision by stopping suddenly. The report found that the signaller was overloaded by work activities and did not pass a message to the barrier attendant to use the LCU to lower the barriers.
• A class investigation into factors affecting safety-critical human performance in signalling operations in May 2020 (RAIB report 03/2020). This report found a common theme across incidents involving signallers which may apply to this incident.

A wider summary of previous RAIB learning, including more similar incidents relating to management assurance, can be found on RAIB’s website.