Course Handout - Transportation Disasters - Rail

Copyright Notice: This material was written and published in Wales by Derek J. Smith (Chartered Engineer). It forms part of a multifile e-learning resource, and subject only to acknowledging Derek J. Smith's rights under international copyright law to be identified as author may be freely downloaded and printed off in single complete copies solely for the purposes of private study and/or review. Commercial exploitation rights are reserved. The remote hyperlinks have been selected for the academic appropriacy of their contents; they were free of offensive and litigious content when selected, and will be periodically checked to have remained so. Copyright 2001-2018, Derek J. Smith.


First published online 08:10 BST 9th May 2001, Copyright Derek J. Smith (Chartered Engineer). This version [2.0 - copyright] 09:00 BST 4th July 2018.


Transportation Disasters

Key to Abbreviations:

ATC = automatic train control, a 1906 electro-mechanical SPAD warning and prevention system [for further details, see the annotation of the Lewisham (1957) disaster].

ATP = automatic train protection, a 1970s partly computerised SPAD warning and prevention system [for further details, see the annotation of the Clapham (1989) and Paddington (1999) disasters].

AWS = automatic warning system, a cab visual and/or audio warning that a train has just passed a signal at danger, which the driver then has to acknowledge in order to cancel.

DVT = driving van trailer, the unpowered unit in a push-pull (see below) pair.

ETCS = European train control system, a state-of-the-art SPAD warning and prevention system [for further details, see the annotation of the Clapham (1989) and Paddington (1999) train disasters].

HSC = Health and Safety Commission.

HSE = Health and Safety Executive.

NTSB = National Transportation Safety Board.

push-pull = train with streamlined units at both ends - one "blunt" or "hollow" (ie. unpowered) - and therefore capable of operation in either direction without being turned round.

SPD/SPAD = signal passed (at) danger.

TPWS = train protection warning system, a 1990s SPAD warning and protection system [for further details, see the annotation of the Clapham (1989) and Paddington (1999) train disasters].

The Rocket Train Disaster, 1830: In this incident on 15th September 1830 at the official opening of the 31-mile long Liverpool and Manchester Railway, one of the VIPs was run over by George Stephenson's Rocket. The VIP was the Liverpool MP William Huskisson, one of the main proponents of the new railways. He had stepped from the inaugural train - drawn by Northumbrian - while it was taking on water, and was too "feeble in his legs" to get out of the way quickly enough when Rocket - which according to one eye witness "was parading up and down merely to show its speed" - passed by on the adjacent track. George Stephenson then personally drove him the 12 miles to Eccles, where a doctor was called, but he died from his injuries that evening. [For fuller eye witness accounts, click here.] What we have here, therefore, is an incident in which the first de facto minister for railways was run over by the first locomotive having stepped from the first train to run on the first all steam railway, and not even the fastest ever medevac could save him. The Americans tried hard to compete, however, opening their first railroad - the South Carolina Canal and Rail Road Company - on Christmas Day 1830. Unfortunately, the boiler on their first locomotive - Best Friend - had an irritating habit of making hissing sounds from its safety valve, and on 17th June 1831 - while its fireman was holding said safety valve shut - it blew itself (and the fireman) to pieces. [Note the training issue - safety valves work by hissing!]

Preferring to ignore these portents, the next 30 years saw an explosion of railway building across the world; locomotives were simply "the most perfect of machines" (Scientific American, April 1851), regardless of how many people chose to fall in front of them or wilfully deviated from safe operating procedures. Depending on whose testimony you believe (other eye witnesses said that Rocket was not speeding), this might well be an early instance of a "show off" accident, such as the RMS Titanic in 1912 and the USS Greeneville in 2001.

Armagh Train Disaster, 1889: In this incident on 12th June 1889, the rear coaches of an overloaded seaside excursion train ran back down a steep hill and collided with the train behind. 80 people, mostly children, lost their lives. The incident is historically significant for two reasons, (a) because the subsequent public outcry forced the introduction of the (already invented) fail-safe braking system, that is to say, a braking arrangement where the brakes apply automatically in the event of power failure rather than go slack, and (b) because it forced the introduction of "block working" signalling, whereby a train cannot enter a given section, or "block", of track until the train in front is known to have cleared it. 

Quintinshill Train Disaster, 1915: In this incident on 22nd May 1915, a fast 15-coach troop train was allowed by signalling failure to run at full speed into the back of a stationary local train near Gretna Green, Scotland. The troop train was concertina'd into about one third its original length, and wreckage thrown into the path of another express going the other way, thereby causing a secondary collision. The official death toll was 227 killed, including many who had survived the first crash only to be mown down by the second, and many others who survived both impacts only to be burnt alive in the fire which followed. The Board of Trade enquiry listed five contributory factors (Muir, 1997):

  • (1) the practice of late reliefs by the signalmen; (2) the failure of the fireman of the local train to ensure the safety of his train; (3) the failure to use the signal lever collar; (4) the late running of the northbound express; (5) the coincidence of the special.

For more on SPAD-type accidents, see under Lewisham (1957).

Harrow and Wealdstone Train Disaster, 1952: In this incident on 8th October 1952, a Perth to Euston express ran a red signal and collided with a stationary commuter train. The locomotive of the express was derailed into the path of a northbound express, causing a second collision. 122 passengers lost their lives. This is one of two high-profile incidents in the 1950s where signals were passed at danger, the other being Lewisham in 1957 .....

Lewisham, 1957: In this incident on 4th December 1957, a steam train passed signals at danger and ran into the rear of a London suburban electric train. The locomotive destroyed the rear carriage of the electric train, and in being derailed demolished the support column of a railway bridge, bringing a thousand tons of steel down on top of the wreckage. 90 people died. The problem of SPADs now became politically sensitive enough to force the adoption of ATC. This system had been invented as long before as 1906, but had not been compulsory due to the set-up expense. However, the ATC is itself far from foolproof, and failed to prevent the Clapham (1988), Southall (1997), and Paddington (1999) SPAD disasters.

The pioneer academic researcher into SPAD-type accidents was D. Russell Davis of the University of Bristol. In one paper (Davis, 1966) he presented the results of a comprehensive survey of 23 SPAD drivers aged over 55 on British Railway's Eastern Region in the period 1960-1961. No one factor, medical or psychological, emerged as critical, although there were significantly more psychiatric and psychosomatic symptoms in the target group compared to an age- and experience-matched control group. Momentary distraction was the critical factor in only 3/23 events, and longer-term preoccupation in 4/23. Case 10, for example, was in a hurry to get off shift because his daughter was ill with measles and his wife needed to get the other children to school. Indeed, so varied were the causes that Davis concluded that it would never be possible to select and/or educate SPADs out of the system. "Signalling systems," he wrote, "must therefore be designed to take account of the kinds of errors that are likely to be made when the drivers' efficiency has fallen off" (p220).


Davis, D.R. (1966). Railway signals passed at danger: The drivers, circumstances, and psychological processes. Ergonomics, 9(3):211-222.

Moorgate Train Disaster, 1975: In this incident on 28th February 1975, a London underground train failed to stop at a cul-de-sac platform and crashed at around 40mph into the buffers at the end of a 66 foot overrun tunnel. There was considerable damage to the first two coaches, and the driver and 42 passengers were killed. Rescue was slow and difficult due to access problems, and the final body was not retrieved until 4 days later. Subsequent investigations confirmed that there had been no problems with the braking system, and there was no evidence that the driver had been ill, suicidal, drunk, or under the influence of drugs. Indeed, witnesses on the platform had seen him in the normal position in his cab. The investigation was unable to rule on exactly what had happened, but the main theory was that the driver had lapsed into some sort of trance. 

Clapham Train Disaster, 1988: In this incident on 12th December 1988, a fully loaded commuter train into Waterloo passed a defective signal and ran into the back of the train in front, derailing it into the path of an empty train coming the other way. 35 people lost their lives, and 69 were seriously injured. It emerged that a major signal modernisation programme had been under way, and that a short in one of the circuits being worked on had switched a red signal to green. In the resulting enquiry, a number of contributory factors emerged, including the following:

  • Quality of Maintenance: More than 20 loose wires were subsequently found within two miles of the crash site (The Times, 12th April 1989). An inherently unsafe and banned practice - working on circuits at an outstation without isolating them electrically at source - had, because it called for less effort, become standard practice. The practice is highly dangerous, however, because any circuit left unrepaired due to oversight or at end of shift is a live one, and a short circuit waiting to happen.

RESEARCH ISSUE: Why do humans so willingly replace established patterns of work with "minimum effort" regimes of their own devising? Is it poor education? Poor training? Lack of supervision? Laziness? Personality factors? Sheer perversity?

  • Quality of Management Supervision: And not only were mistakes made, but there was no effective programme of quality control to detect them. There was evidence that the British Rail signal modification work in the Clapham area had not been under any effective management control; indeed, the Area Signal Engineer (Works) admitted to the enquiry that he had failed to enforce BR testing practice. (The Times, 13th April 1989.)

This was not strictly a SPAD-type disaster, because the driver of the following train had seen a green light. Nevertheless it raised questions why trains were not more adequately protected by automatic braking systems when advancing into track blocks at risk. For a technical analysis of the error sequence (cognitive and otherwise) click here, and for an introduction to the technicalities of the ATP concept click here.

Fox River Grove Train Disaster, 1995: In this incident on 25th October 1995, a train sliced the back off a school bus stuck on a level crossing due to a red traffic signal. Seven children died. The subsequent NTSB investigation judged that this was due to an intermittent fault with the traffic signal control unit, and that following seven earlier near misses it had been checked repeatedly. This is an interesting incident because it shows what can go wrong with split responsibility. Highway engineers had confirmed that there was nothing detectably wrong with the road signals, and railroad engineers had confirmed that there was nothing wrong with the track signalling. Both had a "my box" mentality which on this occasion - when the two systems interacted and became a superordinate system - proved fatal. Here are some of the key factors [See abstract of Final NTSB Report]:

  • Safety Critical Software Errors: A year before the accident, the road signals had been reprogrammed with an extra 12-second delay to allow pedestrians time to cross.
  • Policy Error: It is possible that the recruitment policy covering school bus drivers was defective.
  • Training Error: The NTSB's third conclusion was that "the guidance provided in the Illinois school bus driver training curriculum about vehicle positioning on the roadway is ineffective". 
  • Communication: The NTSB's fifth conclusion was that "had the school district ensured that all school bus drivers exchange information about any identified route hazards, such as the short queuing area, the accident bus driver might have avoided the collision". Its 15th conclusion was that "had a coordinated program to ensure effective communication between transportation modes about all aspects of grade crossing safety been in operation, the ineffective communication between the [Illinois Department of Transportation] and the railroad might never have occurred".
  • Design Error: Design faults in allowing a traffic queue to span a level crossing [since the accident the signals have been moved to the other side of the railway track].

Southall Train Disaster, 1997: In this incident on 19th September 1997, a Great Western Intercity express passed a signal at danger and collided with an empty freight train. Seven people lost their lives. The HSC official enquiry published its report in February 2000 and noted that the express had been sent out despite having its AWS out of order. It also criticised the fact that the ATP system which had been recommended in the aftermatch of the Clapham disaster in 1989 had still not been implemented. Great Western were fined 1.5 million for having no system to prevent trains operating with the AWS isolated and no alternative in place.

Eschede Train Disaster, 1998: In this incident on 3rd June 1998, one of Germany's state-of-the-art Inter City Expresses, en route from Munich to Hamburg, derailed at 124 mph and crashed into the supports of a bridge over, killing 101 passengers. In the subsequent investigation, it transpired that the proximate cause of the derailment was a wheel cracking due to metal fatigue. The wheels in question had a steel hub and a steel running surface, but the two were separated and cushioned by rubber bushes. This design, known as the "duoblock" wheel, was introduced to counter vibration problems in the restaurant car, and relied on the integrity of the outer steel tyre.

As with the Challenger disaster in 1986, there were underlying errors as well. There had, for example, been some friction between the manufacturer of the wheels and the railway operator, Deutsche Bahn (DB). The manufacturer regarded the design as insufficiently tested for the proposed high speed exposure. However, DB had gone ahead with their implementation regardless, because they had been getting a bad press on the issue of vibration. Then in January 1997, a technical report on duoblock wheel failures on the Hannover tram service was forwarded to DB but not acted upon. This incident is thus one of many where warnings had been given prior to the event, but substantially ignored.

Paddington (Ladbroke Grove) Train Disaster, 1999: In this incident on 5th October 1999, a commuter service heading west out of Paddington failed to stop at a red signal, and crossed the path of an Intercity express from South Wales. 31 people lost their lives, including the driver of the commuter train. In the subsequent Railway Inspectorate investigation, it transpired that the signal in question - signal 109 - had in fact been passed at red eight times in the preceding six years (International Railway Journal, November 1999). Indeed on the network as a whole there are a total of 22 signals which have been passed at danger on seven or more occasions. There are a number of reasons for this, including poor siting and sun glare. The official enquiry was headed by Lord Cullen and Professor John Uff.

The ATP system (see the Clapham disaster, 1988) was by now obsolete, and though it had been requested by the Clapham enquiry it had not been widely implemented. Its successor, TPWS, would have prevented this tragedy by automatically stopping the commuter train. This system is currently being rolled out at an estimated cost of 450 million, and should be in place by 2003. However, it is far from the perfect solution because it is only intended for speeds up to 75 mph. For higher speeds, it will be "barely half as effective" (The Daily Telegraph, 30th March 2001). Even safer still is the European train protection system, ETCS, but this is more expensive again, and could not be in place until around 2015. In other words, not only did Britain introduce its 100mph-plus service in the 1960s without a servicable SPAD system, but has little chance of having one more than half a century later.

Here are some of the important issues:

  • General System Overload: 774 trains pass in and out of Paddington each day.
  • Staffing Procedures: The driver of the commuter train was only recently qualified. The procedure of having such drivers accompanied by experienced drivers (as in aviation) was discontinued. 

STOP PRESS: It is worth noting that responding to a traffic signal is not always a single perceptual act. In December 2000 another train went through Signal 109. The driver reported seeing and noting it, but then had to look away momentarily; it was only when he looked back up and re-checked the signal - by then occluded by overhead equipment - that the error occurred and he wrongly marked it as having cleared. The psychological processes controlling the sort of visuospatial working memory required by "second glance" eye movements such as this are far from fully understood (see the neural circuit in Smith, 1997; Figure 4.6, if unconvinced). In response to this latest incident, the HSE has written to Railtrack demanding urgent action to improve visibility at this signal. (The Railway Magazine, May 2001.)


Smith, D.J. (1997). Human Information Processing. Cardiff: UWIC. [ISBN: 1900666081]

Hatfield Train Disaster, 2000: In this incident on 17th October 2000, a northbound GNER express fouled a broken rail near Hatfield, and crashed, killing 4 passengers. This incident achieved a deal of notoriety because it revealed the true extent of cost cutting and deterioration of the rail network - inspectors had detected the cracks in January, but the repair work was not due to begin until November (The Times, 19th October 2000) - and was followed by "the Great Repair" of Winter 2000/2001. The HSE report is due to be published in July 2001.

Virgin Trains' CEO Chris Green said in a speech to the Institute of Logistics and Transport on 13th February 2001 that three things had gone wrong with Britain's railways since they had been privatised in 1994. To start with, the new owners had underestimated the complexity of railway operation. Secondly, they had got rid of too many junior and middle managers in ill-considered cost-cutting initiatives. And thirdly, they had lost sight of their core assets in the rush to contract work out. They forgot, in other words, how to run a railway (The Railway Magazine, April 2001)!

Kaprun Train Disaster, 2000: In this incident on 11th November 2000, a fire broke out in the funicular railway leading from Kaprun in the Austrian Alps up to the Kitzsteinhorn Glacier. It totally destroyed the two-coach train, and killed 159 people. The fire broke out in the lower carriage when the train was 600 metres into the 3200 metre tunnel, and, once alight, it simply turned the 45 tunnel into a gigantic flue. The few passengers who survived did so by breaking windows and making their way down rather than up. Here are some of the factors under investigation:

  • the doors were locked.
  • the train was an extremely tight fit in the tunnel so that passengers exiting the front car had no option but to try to escape upwards, into the ascending smoke.
  • there was no fire-fighting equipment on board.
  • there was no sprinkler system, because "the funicular railroad is theoretically something that cannot burn" (Swiss Federal Transportation Office spokesman, after the event; The Times, 13th November 2000). Sadly, thickly padded ski-suits are not so immune.
  • the safe working load (while not exceeded) had been set too high.
  • there were no fireproof refuges or safety tunnels adjacent to the main tunnel.
  • there were staff shortages in the government department responsible for safety checking the various alpine lift systems.

Selby Train Disaster, 2001: In this incident on 28th February 2001, an express train passing under a road bridge struck wreckage from a road accident above. The impact derailed the front of the train into the path of a 1600-ton coal train coming the other way at around 50mph, and in the resulting head-on collision 10 people lost their lives. The accident was fundamentally a sad combination of coincidences (a 67 billion-to-one freak accident, according to The Railway Magazine, April 2001), but there is nevertheless room to criticise the adequacy of the crash barriers separating the road and rail traffic at such crossing points, and there is also some suggestion of a fundamental concept fault in the push-pull arrangement of modern high speed trains. The problem is that only one of the two cab units is powered, and therefore the two units - whilst superficially identical - do not weigh the same. Unless the train is loop-turned at both ends of its journey, therefore, every other trip is with the heavy unit pushing rather than pulling the rest of the train. The driver, of course, sits in whichever happens to be the leading unit, so there is no problem unless and until there is a derailment, whereupon it is considerably more stable to have the heavy unit in front of the passengers than behind them. That is to say, it is considerably easier to derail the Class 91 DVT (at 45 tons) than the matching locomotive (at 84 tons). This has been common knowledge within the railway industry since an earlier accident at Polmont in Scotland in 1984, when nothing more substantial than a cow derailed a similar configuration train, killing 13 passengers. The HSE have since announced that there were 35 incidents in the last two years involving motor vehicles on tracks (excluding level crossing events), so there is a distinct base level of risk (The Railway Magazine, May 2001).

Hither Green Train Near-Disaster, 2001: In this incident on 12th March 2001, two commuter trains collided just outside Hither Green station, in South London. Damage was comparatively light thanks to last moment braking by one of the trains. Investigations are still under way, but preliminary reports indicate that the SPAD was committed by a driver with only 12 weeks' experience. The technical press has already suggested that inadequate training for route familiarisation purposes led to the driver misjudging which of several signals applied to him (The Railway Magazine, May 2001). The Managing Director of the network, Olivier Brousse, put his finger on it when he remarked in an interview: "Safety is not a perfect science" (The Daily Mail, 13th March 2001).

STOP PRESS (1): London Underground drivers were guilty of 658 SPAD-type events in 2000, compared with 340 in 1994. Monthly returns on the national system as a whole revealed 33 SPADs in January 2001 and 42 in February 2001 (The Railway Magazine, May 2001).

STOP PRESS (2): On 18th April 2001 Virgin Trains unveiled 2 million's worth of new driving cab simulators at its Driver Training Centre at Crewe. Virgin Train's CEO, Chris Green, said: "This is the first major use of driver simulators in the UK and it really is time that rail joined the air industry in using these high-tech safety aids" (Rail, April 18th 2001).

STOP PRESS (3): Class 66 locomotives are fitted with the Westinghouse Datacard 6100 data recorder. The software for this railway equivalent of an aircraft's "black box" is currently being updated to allow it to record from up to 60 sensors ten times a second. This data will eventually be routinely analysed to detect individual locomotives developing faults and/or individual drivers developing poor habits (The Railway Magazine, May 2001). The HSC is proposing to make black box recorders legal requirements by the end of 2005.



[Disasters Database Menu]