Rail Accident Report

Signal passed at danger and subsequent near

miss, Chalfont & Latimer station
21 June 2020

Report 04/2021
July 2021
This investigation was carried out in accordance with:
• the Railway Safety Directive 2004/49/EC
• the Railways and Transport Safety Act 2003
• the Railways (Accident Investigation and Reporting) Regulations 2005.

© Crown copyright 2021

You may reuse this document/publication (not including departmental or agency logos) free of charge in
any format or medium. You must reuse it accurately and not in a misleading context. The material must
be acknowledged as Crown copyright and you must give the title of the source publication. Where we
have identified any third party copyright material you will need to obtain permission from the copyright
holders concerned. This document/publication is also available at www.gov.uk/raib.

Any enquiries about this publication should be sent to:

RAIB Email: [email protected]

The Wharf Telephone: 01332 253300
Stores Road Website: www.gov.uk/raib
Derby UK
DE21 4BA

This report is published by the Rail Accident Investigation Branch, Department for Transport.
Preface

Preface
The purpose of a Rail Accident Investigation Branch (RAIB) investigation is to
improve railway safety by preventing future railway accidents or by mitigating their
consequences. It is not the purpose of such an investigation to establish blame or
liability. Accordingly, it is inappropriate that RAIB reports should be used to assign
fault or blame, or determine liability, since neither the investigation nor the reporting
process has been undertaken for that purpose.
RAIB’s findings are based on its own evaluation of the evidence that was available at
the time of the investigation and are intended to explain what happened, and why, in a
fair and unbiased manner.
Where RAIB has described a factor as being linked to cause and the term is
unqualified, this means that RAIB has satisfied itself that the evidence supports both
the presence of the factor and its direct relevance to the causation of the accident or
incident that is being investigated. However, where RAIB is less confident about the
existence of a factor, or its role in the causation of the accident or incident, RAIB will
qualify its findings by use of words such as ‘probable’ or ‘possible’, as appropriate.
Where there is more than one potential explanation RAIB may describe one factor as
being ‘more’ or ‘less’ likely than the other.
In some cases factors are described as ‘underlying’. Such factors are also relevant
to the causation of the accident or incident but are associated with the underlying
management arrangements or organisational issues (such as working culture).
Where necessary, words such as ‘probable’ or ‘possible’ can also be used to qualify
‘underlying factor’.
Use of the word ‘probable’ means that, although it is considered highly likely that the
factor applied, some small element of uncertainty remains. Use of the word ‘possible’
means that, although there is some evidence that supports this factor, there remains a
more significant degree of uncertainty.
An ‘observation’ is a safety issue discovered as part of the investigation that is not
considered to be causal or underlying to the accident or incident being investigated,
but does deserve scrutiny because of a perceived potential for safety learning.
The above terms are intended to assist readers’ interpretation of the report, and to
provide suitable explanations where uncertainty remains. The report should therefore
be interpreted as the view of RAIB, expressed with the sole purpose of improving
railway safety.
Any information about casualties is based on figures provided to RAIB from various
sources. Considerations of personal privacy may mean that not all of the actual effects
of the event are recorded in the report. RAIB recognises that sudden unexpected
events can have both short- and long-term consequences for the physical and/
or mental health of people who were involved, both directly and indirectly, in what
happened.
RAIB’s investigation (including its scope, methods, conclusions and recommendations)
is independent of any inquest or fatal accident inquiry, and all other investigations,
including those carried out by the safety authority, police or railway industry.

Report 04/2021 July 2021

Chalfont & Latimer
 This page is intentionally left blank

Report 04/2021 4 July 2021

Chalfont & Latimer
Signal passed at danger and subsequent near
miss, Chalfont & Latimer station, 21 June 2020

Contents

Preface3
Summary7
Introduction8
Definitions 8
The incident9
Summary of the incident 9
Context9
The sequence of events15
Background information 20
Analysis22
Identification of the immediate cause  22
Identification of causal factors  22
Identification of a probable underlying factor 34
Observations  41
Previous occurrences of a similar character  45
Summary of conclusions 47
Immediate cause  47
Causal factors  47
Underlying factor 47
Additional observations 47
Previous RAIB recommendations relevant to this investigation 48
Previous recommendation that had the potential to address one or more
factors identified in this report  48
Actions reported as already taken or in progress relevant to this report 50
Actions reported that address factors which otherwise would have resulted
in a RAIB recommendation 52
Recommendations and learning point53
Recommendations53
Learning point  55

Report 04/2021 5 July 2021

Chalfont & Latimer
Appendices56
Appendix A - Glossary of abbreviations and acronyms 56
Appendix B - Investigation details 57

Report 04/2021 6 July 2021

Chalfont & Latimer
Summary

Summary
At around 21:43 hrs on Sunday 21 June 2020, a near miss occurred between
two passenger trains at London Underground’s Chalfont & Latimer station on the
Metropolitan line. A few minutes earlier a southbound Chiltern Railways train had
passed a signal displaying a red (stop) aspect (known as a signal passed at danger or
a ‘SPAD’). This resulted in the train being automatically stopped by a safety system,
known as a tripcock, which had applied the train’s emergency brake. Without seeking
the authority required from the service operator (signaller), the driver reset the tripcock
before continuing towards Chalfont & Latimer station, where the train was routed
towards the northbound platform, which was occupied by a London Underground train.
The Chiltern Railways train stopped about 23 metres before reaching the other train,
which was stationary. There were no reported injuries, but there was minor damage to
signalling equipment and a set of points.
The probable cause of the SPAD was that the driver of the Chiltern Railways train
was fatigued. The driver stated that he decided to proceed without authority because
he did not recall passing the stop signal and believed the tripcock safety system
activation had been spurious. This decision may also have been affected by fatigue.
RAIB found that Chiltern Railways’ processes for training and testing a driver’s
knowledge of what to do following a tripcock activation were not effective. A probable
underlying factor was that Chiltern Railways’ driver management processes did
not effectively manage safety-related risk associated with the driver involved in
the incident. It is possible that this was a consequence of a high turnover of driver
managers, insufficient driver managers in post and their high workload. Although not
causes of the incident, RAIB also found shortcomings in other aspects of these driver
management processes, and in risk management at the interface between Chiltern
Railways and London Underground.
RAIB has made three recommendations and identified one learning point. The first
recommends that Chiltern Railways improves its driver management processes.
The second recommends that Chiltern Railways and London Underground Ltd
jointly establish an effective process for the management of safety at the interfaces
between their respective operations. The third recommends that Chiltern Railways,
assisted by London Underground, reviews the risk associated with resetting train
protection equipment applicable to Chiltern Railways’ trains on London Underground
infrastructure. The learning point concerns the importance of considering sleep
disorders during routine medical examinations of safety critical workers.

Report 04/2021 7 July 2021

Chalfont & Latimer
 Introduction
Introduction

Definitions
1 Metric units are used in this report in accordance with normal practice on the
London Underground Ltd (LUL) infrastructure involved in the incident. Train
speeds are given in miles per hour where this is normal railway practice, with the
equivalent metric speed also given.
2 The report contains abbreviations which are explained in Appendix A. Sources of
evidence used in the investigation are listed in Appendix B.

Report 04/2021 8 July 2021

Chalfont & Latimer
The incident

The incident
Summary of the incident
3 At around 21:43 hrs on Sunday 21 June 2020, a near miss occurred between two
passenger trains at London Underground’s Chalfont & Latimer station (figure 1).
A southbound Chiltern Railways train travelled towards a stationary northbound
Metropolitan line train on the same track, and stopped about 23 metres before
reaching it (figure 2).
4 A few minutes earlier, the Chiltern Railways train had passed a signal displaying a
red (stop) aspect (an incident of this type is known as a ‘signal passed at danger’
or a ‘SPAD’) and had then been stopped automatically by a safety system,
known as a tripcock. The driver reset this system and continued towards Chalfont
& Latimer station without seeking authority to do so as required by London
Underground rules.

Location of incident

© Crown Copyright. All rights reserved. Department for Transport 100039241. RAIB 2021

Figure 1: Extract from Ordnance Survey map showing location of the incident

5 No one was physically hurt, but a set of points was damaged, there was minor
damage to part of the signalling system and train services were disrupted.

Context
Location
6 The incident occurred on LUL’s Metropolitan line, between Amersham and
Chalfont & Latimer stations. LUL’s infrastructure meets the national rail network
at a boundary approximately 2.2 km (1.37 miles) northwest of Amersham station
(figure 3). Chiltern Railways operates some of its London Marylebone services
over the Metropolitan Line between Amersham (the north-western limit of the
Metropolitan line) and Harrow-on-the-Hill.

Report 04/2021 9 July 2021

Chalfont & Latimer
The incident

London Underground Ltd train Signal

JT80

Direction of travel of
Chiltern Railways train

Figure 2: Image from forward facing CCTV camera fitted to the Chiltern Railways train (image courtesy
of Chiltern Railways)

National rail network line and station

Metropolitan line and station
Aylesbury Vale Parkway

Aylesbury

National rail network –

Stoke Mandeville London Underground Ltd
boundary
Wendover

Great Missenden
Chesham
Chalfont & Latimer
Amersham

To London Marylebone
via Harrow-on-the-Hill
Figure 3: Chiltern Railways route onto LUL infrastructure

Report 04/2021 10 July 2021

Chalfont & Latimer
7 The lines between Amersham and Chalfont & Latimer are designated the

The incident
southbound and northbound lines. Both have a maximum permitted speed of
60 mph (97 km/h) and a predominant gradient of 1 in 105 falling towards Chalfont
& Latimer. The Metropolitan line branch to Chesham leaves the main line at a
junction north-west of Chalfont & Latimer station. Trains in this area are controlled
from the LUL signal cabin1 at Amersham.
8 Chalfont & Latimer station is a surface station (meaning it is not located
underground) operated by LUL and has three platforms. Platform 1, where the
near miss occurred, is the northbound platform used by trains heading towards
either Amersham or Chesham (figure 4). Platform 2 is used by southbound
Metropolitan line trains from Amersham or Chesham and Chiltern Railways
services from Aylesbury to London Marylebone. Platform 3 is a bay platform
serving the Chesham branch line only.
9 A crossover immediately north of Chalfont & Latimer station allows northbound
trains to cross from the northbound main line to the southbound main line. The
crossover comprises a short length of track linked to the main lines by a set of
points at each end. A further set of points, described as the Chesham branch
junction in this report, links the southbound main line to the single line serving
Chesham station. In normal circumstances these three sets of points form the
route to the Chesham branch from Chalfont & Latimer platform 1.

Amersham Signal JW2

(double yellow aspect)
3
To Chalfont & Latimer

To/from Aylesbury 1

Northbound Southbound

To/from Chesham Signal JT6

Fog repeater signal (red aspect)
Chalfont & Latimer
3
2
From Amersham
To/from Marylebone
1
Signal JT80
Fog repeater signal Signal JW5
(single yellow aspect) Not to scale
Some lines and features omitted for clarity

Figure 4: Metropolitan line between Amersham and Chalfont & Latimer

Organisations involved
10 Chiltern Railways operated the train involved in the incident and employed
both the train’s driver and the driver management team. This included driver
managers, each of whom acts as a dedicated line manager for an allocated group
of drivers, but also provides real-time management of any driver when on duty.
Driver depot managers oversee the work of driver managers; one covers the
driver depots at Banbury, Birmingham Moor Street and Stourbridge, and the other
covers the driver depots at Marylebone and Aylesbury. The driver management
organisation is managed by the head of drivers and driver training.
1
Equivalent to a signal box on the national rail network.

Report 04/2021 11 July 2021

Chalfont & Latimer
 11 LUL is the owner and operator of the Metropolitan line infrastructure. It employed
The incident

the train operator (driver) of the Metropolitan line train involved and the service
operator, equivalent to a signaller on the national rail network, at Amersham signal
cabin.
12 Medigold Health undertakes medical examinations of Chiltern Railways’ train
drivers, and carries out medication checks when requested.
13 Chiltern Railways, LUL and Medigold Health freely co-operated with the
investigation.
Trains involved
14 The Chiltern Railways train was the 21:13 hrs passenger service from Aylesbury
Vale Parkway to London Marylebone, train reporting number 2C72.2 It was
formed of two class 165 two-coach diesel multiple units coupled together with unit
165015 leading and unit 165006 trailing (figure 5).
15 Class 165 trains have a maximum permitted speed of 75 mph (121 km/h) and
were built between 1990 and 1992 for British Rail. The Chiltern Railways fleet of
class 165 trains was refurbished between 2003 and 2005. Equipment fitted to this
fleet at the time of the incident included a tripcock system which, in conjunction
with lineside equipment, stops a train if it passes a signal displaying a red ‘stop’
aspect on LUL infrastructure. The fleet was also provided with other equipment
related to signalling systems (see paragraphs 35 to 40), driver’s vigilance devices
which apply the train’s brakes if the driver does not acknowledge an audible alert
by removing and reapplying pressure on a foot pedal, on-train data recorders
(OTDR) and forward-facing closed-circuit television cameras (FFCCTV).

Figure 5: Class 165 train (not the train involved in the incident; image courtesy of Chiltern Railways)

2
An alphanumeric code, known as the ‘train reporting number’, is allocated to every train operating on the national
rail network.

Report 04/2021 12 July 2021

Chalfont & Latimer
16 The LUL train was a northbound Metropolitan line passenger service from Aldgate

The incident
to Chesham, service number 403, comprising an eight car ‘S’ stock train.
Rail equipment/systems involved
17 Southbound trains travelling from Amersham to Chalfont & Latimer pass the
signalling equipment listed in table 1. If a northbound LUL train has been routed
from Chalfont & Latimer platform 1 towards Chesham the signals displayed to the
driver of an approaching southbound train would be as shown in the third column
of the table.

Signals as displayed on approach to Chalfont & Latimer station

Distance Signalling Aspect (see Notes
from stop equipment note below)
signal
2170 Tripcock test White Located beneath signal JW2 at south
metres indicator aspect end of Amersham station and connected
(approx.) (figure 7) displayed to lineside equipment at Amersham
for a short station that is used to test satisfactory
period operation of tripcock equipment fitted to
trains. It shows a white aspect which is
extinguished following a satisfactory test
of the tripcock equipment.
2170 Signal JW2 Double South end of Amersham station. A
metres yellow double yellow aspect means ‘preliminary
(approx.) caution’. The train can proceed but the
driver must be prepared to find the next
signal displaying a single yellow aspect.
1335 Fog repeater* White Fog Repeater signals display a white
metres for signal aspect if the signal ahead is displaying
JW5 either a green or yellow aspect.
1207 Signal JW5 Single A single yellow aspect means ‘caution’.
metres yellow The train can proceed but the driver
must be prepared to stop at the next
signal.
123 Fog repeater Yellow Fog Repeater signals display a yellow
metres for signal JT6 aspect if the signal ahead is displaying a
red aspect.
Stop Signal JT6 Red Approximately 842 metres from
signal Chesham branch junction (see figure 6).
A red aspect means ‘danger’. The train
must not proceed beyond the signal.
These signal aspects are as seen by the driver of a southbound train when the route is
set for a northbound train to cross the southbound main line and then take the branch to
Chesham, and assumes that there is no other train between the southbound train and the
junction.
*Fog Repeater signals provide an advanced warning to the driver of the aspect displayed
at the signal ahead. They are provided in areas susceptible to reduced visibility due to fog.

Table 1: Signalling on southbound approach to Chesham branch junction (see also figure 4)

Report 04/2021 13 July 2021

Chalfont & Latimer
The incident

Chesham
branch line

Direction of travel of
Chiltern Railways train

Figure 6: Signal JT6 (image courtesy of London

Underground Ltd)

Staff involved
18 The driver of the Chiltern Railways train qualified as a train driver in 2002. He
had driven class 165 trains since qualifying and had regularly driven over the
Metropolitan line route, except from 2015 to 2018 when he was restricted to
driving empty trains (trains with no passengers) at Wembley depot and between
Wembley depot and London Marylebone (see paragraph 103).
19 The service operator joined LUL as a trainee service operator in 2001 and worked
regularly at Rayners Lane, Rickmansworth, Harrow-on-the-Hill and Amersham
signal cabins. During his career he reported having dealt with between 10 and 12
instances of trains passing stop signals at red without authority, all involving LUL
trains. However, none had involved a driver resetting the tripcock and continuing
without permission.
External circumstances
20 The incident occurred at around 21:43 hrs on a clear, dry summer evening.
There is no evidence that external circumstances, including sunlight, affected the
incident.

Report 04/2021 14 July 2021

Chalfont & Latimer
The sequence of events

The sequence of events

Events preceding the incident
21 The driver was not rostered to work on the day before the incident. The driver
stated that he had a quiet day around the house and went to bed around
23:00 hrs, waking several times in the night, before finally waking at about
06:00 hrs on the day of the incident. He left home for work at around 14:00 hrs.
22 The driver arrived at Marylebone between 10 and 15 minutes before the
scheduled booking-on time of 15:00 hrs and booked on face-to-face with a
controller. He then drove the 15:20 hrs service from Marylebone to Oxford and a
return service which arrived at Marylebone at 18:28 hrs. After a short break, the
driver worked the 19:05 hrs service to Aylesbury, arriving on time at 20:17 hrs.
23 The driver then had a rest and refreshment break and, at about 21:15 hrs, went
to meet the train he would drive to London Marylebone. This was the 21:13 hrs
service from Aylesbury Vale Parkway which had been driven to Aylesbury by a
different driver. After departing from Aylesbury one minute late, the train ran on
green signals during a journey which the driver reported was uneventful, as far as
Amersham, where the train arrived at platform 3 still running one minute late.
24 The service operator at Amersham signal cabin was aware of this delay and a
six-minute delay to the northbound Metropolitan line train service to Chesham
which was approaching Chalfont & Latimer. The service operator decided that
overall system delay would be minimised if the northbound Chesham train was
given priority over the Chiltern Railways service. He therefore set the route for
the Chesham branch. The setting of this route caused JT6 to show a red aspect
to stop the Chiltern Railways train on the southbound line until the LUL train had
crossed safely onto the Chesham branch. The other southbound signals were
then showing the aspects set out in table 1.
Events during the incident
25 After completing station duties at Amersham, the Chiltern Railways train departed.
The driver stated that he did not notice the double yellow aspect displayed at
the south end of Amersham station on signal JW2 (shown on recordings from
the train’s FFCCTV, figure 7). He did recall controlling the train’s speed as it
approached tripcock test equipment located around 30 metres before this. The
train’s OTDR recorded the train passing the test equipment at around 9 mph
(14 km/h), below the maximum permitted tripcock testing speed of 10 mph
(16 km/h).
26 The train passed signal JW2 while travelling at around 13 mph (21 km/h) and, two
seconds later, the driver selected full power. Around a minute later, the train was
travelling at around 55 mph (88 km/h) as it passed the fog repeater associated
with signal JW5 and then signal JW5. FFCCTV recordings show that these were
visible to the driver for around 25 seconds on approach, respectively displaying
a white and single yellow aspect (figure 8). A single yellow aspect informs drivers
that the next signal is displaying a red aspect and that they must prepare to stop
the train before reaching it; the driver stated that he did not notice any of these
aspects.

Report 04/2021 15 July 2021

Chalfont & Latimer
The sequence of events

Signal JW2

Tripcock test indicator

(light extinguished)

Direction of travel

Figure 7: Signal JW2 displaying a double yellow aspect (FFCCTV image courtesy of Chiltern Railways)

Signal JW5

Signal JW5
fog repeater

Direction of travel

Figure 8: Signal JW5 displaying a single yellow aspect and associated fog repeater showing a white
aspect (FFCCTV image courtesy of Chiltern Railways)

27 Around three seconds after passing signal JW5, the driver acknowledged an
audible alert from the driver’s vigilance device, triggered because no driving
control had been operated during the previous 60 seconds. The driver shut off
power 11 seconds later and applied the brake after noticing the train’s speed had
risen to around 62 mph (100 km/h), slightly above the maximum permitted speed
of 60 mph (97 km/h).

Report 04/2021 16 July 2021

Chalfont & Latimer
28 FFCCTV images (figure 9) show that around this time the fog repeater associated

The sequence of events

with JT6 and signal JT6 itself became visible to the driver and remained visible
until the train passed them. The yellow aspect of the fog repeater and the red
aspect of signal JT6 were visible to the driver for around 20 seconds. During this
time, the driver allowed the train to coast as it descended towards Chalfont &
Latimer, except for a brake application of around one second duration to stop the
train’s speed rising above 60 mph (97 km/h) again.

Signal JT6
Chesham branch line signals
displaying same sequence
as southbound line

Signal JT6
Chesham
fog repeater
branch line

Direction of travel Direction of travel

Figure 9: Signal JT6 displaying a red aspect and associated fog repeater showing a yellow aspect; inset
image shows signal JT6 approximately one second before the train passed it (FFCCTV image courtesy
of Chiltern Railways)

29 As the train was coasting, at just under 60 mph (97 km/h), it passed the red (stop)
aspect of signal JT6 and the train’s emergency brake was automatically applied
when the raised trainstop operated the tripcock system on the train. The train
stopped around 312 metres beyond signal JT6 and around 530 metres before the
Chesham branch junction (figure 10).
30 As the Chiltern train was approaching signal JT6, the Metropolitan line service
was just departing from platform 1 at Chalfont & Latimer station, with signal JT80
at the north end of the station displaying a green (proceed) aspect. This signal
changed to a red aspect when the signalling system detected that the Chiltern
train had passed signal JT6. The Metropolitan line train had not passed signal
JT80 when its aspect changed, and its operator stopped the train immediately,
having moved a very short distance.

Report 04/2021 17 July 2021

Chalfont & Latimer
The sequence of events

Chalfont & Latimer

station

Chesham
branch line

Direction of travel

Figure 10: Stopping position of the train after tripcock activation (FFCCTV image courtesy of Chiltern
Railways)

31 The Chiltern Railways train driver stated that he thought the automatic emergency
brake application was spurious, and not associated with a signal, so he reset the
tripcock equipment about five seconds after the train stopped. The driver restarted
the train around four seconds later and accelerated for around 22 seconds,
reaching a speed of around 27 mph (43 km/h). The driver then shut off power and
allowed the train to coast for around 20 seconds before making a light (step 1)
brake application which continued as the train passed over the Chesham branch
junction about nine seconds later (figure 11). The train ran through the points at
this junction which were still set for the LUL train going to Chesham.

Chalfont & Latimer

station

Points set
for Chesham
branch line

Direction of travel
Figure 11: The train approaching the points set for the Chesham branch (FFCCTV image courtesy of
Chiltern Railways)

Report 04/2021 18 July 2021

Chalfont & Latimer
32 The Chiltern Railways driver did not notice that the train had run through

The sequence of events

and damaged these points. He released the train’s brakes but then almost
immediately applied the emergency brake when feeling a ‘kick’ as the train
passed through the first set of points in the crossover that were set towards
platform 1 at Chalfont & Latimer station (figure 12). The Chiltern Railways train
was travelling at around 25 mph (40 km/h) as it passed over the crossover points,
around 10 mph (16 km/h) more than the maximum permitted speed of 15 mph
(24 km/h) that applied over them.

Stationary train in
platform 1

Points set for

the route into
platform 1

Direction of travel
Figure 12: The train approaching the points set towards the stationary train in platform 1 (FFCCTV
image courtesy of Chiltern Railways)

33 The Chiltern Railways train came to a stop 15 seconds after its emergency brake
was applied and around 23 metres from the stationary Metropolitan line train in
platform 1 (figure 2).
Events following the incident
34 Although the Metropolitan line train was still adjacent to the platform and
passengers could leave directly, passengers from the Chiltern Railways train
had to be evacuated by walking along the track. This required staff to travel to
the train to help manage the evacuation safely, and waiting for these meant that
the evacuation took place at around 23:10 hrs (87 minutes after the SPAD had
occurred).

Report 04/2021 19 July 2021

Chalfont & Latimer
 Background information
Background information

35 Trains operating in the area are fitted with signalling and communications
equipment as described below (omitting some details not relevant to the
incident). Some of this equipment was intended for use at other locations, so the
corresponding lineside equipment was not provided in the area.
36 The tripcock safety system comprises trackside trainstops (figure 13 left image)
and train-borne tripcocks operated by a lever (figure 13 right image). The
mechanical trainstops are raised adjacent to signals showing a stop aspect and,
in this position, will be struck by a train’s tripcock lever causing the lever to rotate
and operate the tripcock causing an emergency brake application. Trackside
equipment was fitted to all signals capable of displaying a red aspect in the
incident area. Tripcocks were fitted to all Metropolitan line trains. The tripcocks
on the Chiltern Railways class 165 trains were always active, even when not
operating over LUL infrastructure.

Signal and associated

trainstop in raised position 
Leading
right-hand
wheel

Tripcock
lever

 of
Rotation
tripcock lever
causes brake
Direction of train
application

Figure 13: Trainstop (left image) and Tripcock lever fitted to class 165 train (right image) (images
courtesy of LUL and Chiltern Railways respectively)

37 The Speed Control After Tripping (SCAT) system is intended to reduce the
likelihood and consequences of a collision. After a tripcock has been reset, the
system limits the speed of the train to 10 mph (16 km/h) for a defined time. It was
fitted to Metropolitan line trains whose train operators were permitted, in some
circumstances, to pass stop signals on their own authority, but where they might
not be certain of the location of any obstruction on the line ahead. On these
trains, it limited train speed for 3 minutes. It was not fitted to Chiltern Railways’
class 165 trains, but was fitted to Chiltern Railways’ class 168 trains, although
with a restriction time of 10 seconds which has minimal practical effect as a
protection system.

Report 04/2021 20 July 2021

Chalfont & Latimer
38 The Automatic Warning System (AWS) uses equipment mounted between the

Background information
rails and on the train to provide train drivers with an indication of signal aspects
at many locations, and speed restrictions at some locations. Approaching a
green signal aspect, a bell sounds in the cab and no driver acknowledgement is
required. When approaching a cautionary or stop signal aspect (double yellow,
single yellow or red) and when approaching a speed restriction, a horn sounds
which must be acknowledged by the driver within two to three seconds, or the
system will apply the train’s emergency brakes. The driver’s acknowledgement
causes a yellow and black visual indicator (known as a sunflower) to be displayed
in the cab as a reminder of the warning. The AWS equipment cannot be reset (so
the driver cannot release the brakes) for a period of 60 seconds. The AWS system
was fitted to Chiltern Railways trains but was not fitted to LUL infrastructure or
Metropolitan line trains.
39 The Train Protection and Warning System (TPWS) uses equipment fitted between
the rails and on the train to apply the emergency brake on a train which passes a
stop signal or is likely to pass a stop signal because it is not slowing sufficiently or
is likely to exceed the maximum permitted speed at certain locations. The TPWS
equipment cannot be reset (so the driver cannot release the brakes) for a period
of 60 seconds. The system was fitted to Chiltern Railways trains but was not fitted
to LUL infrastructure or Metropolitan line trains.
40 Automatic Train Protection (ATP) uses equipment fitted between the rails and on
the train to supervise train speed and signal aspects, and will warn the driver if
the train is exceeding the maximum permitted speed, is not applying sufficient
braking to comply with a reduction of speed or is not braking sufficiently to stop
at a signal at red. If the driver does not act to increase braking sufficiently, the
ATP system will automatically intervene to take control of the train to prevent an
overspeed or a SPAD. The system was fitted to most Chiltern Railways trains but
was not fitted to LUL infrastructure or Metropolitan line trains.
41 Communications-based train control uses radio links between on-train and
trackside equipment to control train movements, instead of traditional signals
displaying coloured aspects. LUL’s Four Lines Modernisation project was ongoing
at the time of the incident and had equipped all Metropolitan line trains with a
system of this type, but the trackside equipment had not been commissioned in
the area around Chalfont & Latimer when the incident occurred. Chiltern Railways
trains were not equipped with this system and the Four Lines Modernisation
project does not include provision to fit the system to trains not belonging to LUL.
42 Separate radio communication systems, each including on-train and trackside
equipment, were provided for Chiltern Railways trains and Metropolitan line
trains. Chiltern Railways trains were fitted with the GSM-R (Global System for
Mobile Communications – Railways) system and Metropolitan line trains used
the LUL ‘Connect’ radio system. While these communication systems were not
compatible, direct GSM-R communication was available between the Chiltern
Railways train and Hammersmith Line Control, who could then relay information
to the relevant service operator. The Four Lines Modernisation project will provide
the addition of direct contact via GSM-R between a Chiltern Railways train and
the service operator (signaller) in addition to retaining GSM-R contact with the
Line Controller.

Report 04/2021 21 July 2021

Chalfont & Latimer
 Analysis
Analysis

Identification of the immediate cause

43 The driver reset the tripcock on the train following a SPAD at signal JT6 and
moved forward towards Chalfont & Latimer without obtaining permission to
continue.
44 Witness evidence, CCTV recordings and OTDR data indicate that the driver did
not stop as required at signal JT6, and then did not seek permission to restart the
train after resetting the tripcock equipment.

Identification of causal factors

45 The incident occurred due to a combination of the following causal factors:
a. The driver did not react to the signal sequence and stop the train at signal
JT6, probably because he was fatigued (paragraph 46).
b. Following the SPAD, the driver reset the tripcock equipment and then restarted
the train without obtaining permission (paragraph 76).
c. Chiltern Railways’ competence assessments did not identify that the driver
lacked knowledge about tripcock activation processes and had a relatively
high risk of being affected by fatigue, so these issues were not addressed
(paragraph 85).
Each of these factors is now considered in turn.
JT6 SPAD
46 The driver did not react to the signal sequence and stop the train at signal
JT6, probably because he was fatigued.
47 FFCCTV images show that the correct sequence of signals had been displayed
for the Chiltern Railways train from Amersham. However, the Chiltern Railways
driver stated that he had no recollection of these signal aspects and believed the
train was passing signals displaying green aspects.
48 There was no evidence that a train fault contributed to the SPAD.
Loss of attentional focus
49 Evidence that the driver had lost attentional focus on the driving task is shown by:
• the driver not noticing and reacting to the cautionary and stop signal aspects
displayed by signals JW2, JW5 and JT6, and the fog repeater signals
associated with signals JW5 and JT6
• the driver being preoccupied with non-work related issues, which he stated was
the case after the train had departed from Amersham station
• the driver not noticing the train was still accelerating under full power down the
falling gradient until the speed had slightly exceeded the maximum permitted
line speed (drivers normally begin to reduce power in time to prevent this
happening).

Report 04/2021 22 July 2021

Chalfont & Latimer
50 The driver’s response to the train’s vigilance device warning shortly after the

Analysis
train had passed signal JW5, which was displaying a single yellow aspect,
was possibly an automatic response rather than an indication that he was
concentrating on the required task.
51 A driver who has lost attentional focus on the driving task on the national railway
network may have their attention drawn to cautionary and stop signals by AWS
warnings on approach to these signals. If alerted by an AWS warning approaching
a double yellow aspect, a driver should have sufficient distance to stop at the
red signal using service braking. If alerted by an AWS warning approaching a
single yellow aspect, sufficient distance may not be available to stop at the red
signal3 even using emergency braking, but the driver will be aware they are
now approaching a red signal. Although it is very unlikely that a driver would be
able to stop at a red signal after being alerted by an associated AWS warning
on approach to it, they would be likely to notice the red signal. AWS is in use
between Aylesbury and Amersham but, as it is not fitted on LUL infrastructure,
it had ceased to offer any support to the driver on the approach to, and after the
train departed from, Amersham station.
52 The driver was involved in 15 safety-related incidents from 2002 until shortly
before the incident (table 2). Although RAIB does not have detailed evidence of
the causes of these incidents, it is possible that some of these incidents may also
have been affected by a loss of attentional focus.

Date Incident type Location

17/02/2020 Stopped out of course Gerrards Cross
20/01/2020 Failed to cancel AWS South Harrow Tunnel
July 2015 to Driver on restricted duties at Wembley depot and driving empty
September 2018 trains between this depot and Marylebone, no incidents recorded
Station overrun High Wycombe
23/02/2015 Reset ATP and proceeded London Marylebone
without authority (see
paragraph 80)
02/10/2014 Station overrun Warwick Parkway
02/05/2012 Failed to call Sudbury and Harrow Road
19/07/2011 TPWS intervention Neasden Junction
18/07/2011 TPWS intervention Neasden Junction
10/08/2007 TPWS intervention Leamington Spa
27/06/2007 TPWS intervention Signal SY142
21/05/2007 Failed to call Seer Green
24/10/2003 Wrongside door release Amersham
16/05/2003 Station overrun South Ruislip
29/04/2003 Failed to call Northolt Park
07/11/2002 Station overrun Saunderton
Table 2: The driver’s incident history
3
These examples refer to four aspect signalling using an aspect sequence of green, double yellow, single yellow
and red. Signalling can include three aspect signalling using an aspect sequence of green, single yellow and red. In
these circumstances an AWS warning received approaching the single yellow aspect will provide sufficient distance
to stop at the red signal using service braking.

Report 04/2021 23 July 2021

Chalfont & Latimer
Analysis

Fatigue
53 RAIB concluded that fatigue was the likely explanation for the driver’s loss
of attentional focus on the driving task, after also considering other possible
explanations. Phone records show that the driver was not using his mobile phone.
Witness evidence shows he was not distracted by other people either in the cab,
on or about the tracks or within the passenger saloon. Post-incident tests found
no evidence that the driver was affected by non-medical drugs4 and/or alcohol.
54 Fatigue increases the likelihood of errors and adversely affects performance. It
can result from sleep loss, periods of extended wakefulness, circadian phase5
and/or workload. ORR6 says that the causes of fatigue include:
• work-related factors, including the timing of working and resting periods,
length and number of consecutive work duties, intensity of work demands
(work- related factors are generally about providing adequate opportunity for
sleep)
• individual factors including lifestyle, age, diet, medical conditions and drug and
alcohol use, which can all affect the duration and quality of sleep
• environmental factors, including family circumstances and domestic
responsibilities, and adequacy of the sleeping environment.
55 The driver stated that for many years he had consistently suffered from poor
quality sleep, and was not waking up feeling rested (see paragraph 57). The
driver had about seven hours sleep the night before the incident, but he stated
that this sleep was broken, as it typically was, and he did not feel refreshed during
the early part of the day before leaving for work.
56 The driver stated he was starting to feel tired when he arrived at Aylesbury at
around 20:17 hrs, but did not feel too tired to drive safely at that time. At this point
he had been awake for around 13.5 hours, and when his train passed the stop
signal he had been awake for around 15 hours. ORR’s guidance for managing
fatigue risk (see paragraph 74) states that:
‘Being awake for around 17 hours has been found to produce impairment on a
range of tasks equivalent to that associated with a blood alcohol concentration
above the drink driving limit for most of Europe. Being awake for 24 hours
produces impairment worse than that associated with a blood alcohol
concentration above the legal limit for driving on the UK’s roads.’
While the driver had not yet been awake for 17 hours at the time of the incident,
the poor night’s sleep he had experienced the night before the incident probably
meant his performance was nevertheless adversely affected by fatigue.
Medical fitness
57 The driver stated that he had not slept well for many years, and believed this was
due to ageing, many years of shift work and his level of physical fitness.

4
Rail Industry Standard RIS-8070-TOM ‘Testing Railway Safety Critical Workers for Drugs and Alcohol’ issue 1,
December 2016, states that a test result for drugs is positive if it shows ‘The presence of drugs for which there is no
legitimate medical need for either their use or the quantity of their use.’ Rail Industry Standards are available from
www.rssb.co.uk.
5
Also known as our ‘body clock’ and is a natural process that occurs in all our bodies that includes telling our
bodies when to sleep and wake.
6
ORR publication ‘Managing Rail Staff Fatigue’ published 2012, available from www.orr.gov.uk.

Report 04/2021 24 July 2021

Chalfont & Latimer
58 The medical fitness requirements for train drivers are set out in The Train

Analysis
Driving Licences and Certificates Regulations 2010 and are reflected in Railway
Industry Standard RIS-3451-TOM ‘Train Drivers – Suitability and Medical Fitness
Requirements’, issue 1, December 2016. This standard requires the periodic
medical examination of train drivers by registered medical practitioners and
includes the scope of these medical examinations. The requirements of this
standard are also reflected in Chiltern Railways’ procedure OHP 00847 ‘Medical
Fitness’.
59 The driver’s last routine medical examination before the incident was in March
2019 and included a urine test to look for indicators of possible underlying health
conditions such as diabetes, kidney disease and urinary tract infections. It did not
include an assessment of possible indicators of sleeping disorders, such as sleep
apnoea (see paragraph 65). The medical examiner declared the driver ‘F1’, fit for
normal duties. The medical form recorded that the driver needed to wear varifocal
glasses to meet the standard for distance and near vision.
Sleep apnoea
60 A medical examination and assessment after the incident at Chalfont & Latimer
found that the driver was suffering from obstructive sleep apnoea, a condition in
which breathing stops and starts during sleeping. This can result in the sufferer
waking up a lot, and sometimes results in people feeling very tired and finding it
hard to concentrate during the day.
61 The Train Driving Licences and Certificates Regulations 2010 sets out the
minimum content of periodic medical examinations, and Schedule 1 to the
regulations states that these examinations must include:
• a general medical examination
• an examination of sensory functions (vision, hearing, colour perception)
• blood or urine tests to detect diabetes mellitus and other conditions as indicated
by the clinical examination
• tests for drugs where clinically indicated.
In addition, an electrocardiogram (ECG) test at rest is also required for train
drivers over 40 years of age. An ECG test helps to diagnose and monitor
conditions affecting the heart.
62 Schedule 1 of the regulations sets out the general medical requirements for train
drivers and states that drivers must not be suffering from any medical conditions
or be taking any medication, drugs or substances which are likely to cause:
(a) a sudden loss of consciousness
(b) a reduction in attention or concentration
(c) sudden incapacity
(d) a loss of balance or co-ordination
(e) significant limitation of mobility.

Report 04/2021 25 July 2021

Chalfont & Latimer
 63 Neither the Train Driving Licences and Certificates Regulations 2010 nor Railway
Analysis

Industry Standard RIS-3451-TOM ‘Train Drivers – Suitability and Medical Fitness

Requirements’ specifically mention sleeping disorders. However, RSSB7 guidance
document GO/GN3655 ‘Guidance on Medical Fitness for Railway Safety Critical
Workers’, issue 2, June 2014 does so and acknowledges that sleep apnoea is
related to increased accident rates, depending on its severity and that ‘sleep
disorders such as OSA [obstructive sleep apnoea] will have an increased
likelihood of impairment of awareness or concentration, or even falling asleep,
while performing safety critical work’.
64 In 2006, RSSB published a report of a study to investigate the prevalence of
obstructive sleep apnoea in the rail industry.8 The study found that:
• the prevalence of obstructive sleep apnoea in the rail sector based on strict
criteria was 7.3%, which is approximately twice the amount expected in the
general population
• unrecognised obstructive sleep apnoea is present in individuals working in
safety critical roles in the rail industry.
65 The Guidance on Medical Fitness for Railway Safety Critical Workers
(paragraph 58) advises that organisations should check that their health service
provider routinely considers excessive daytime sleepiness and obstructive
sleep apnoea when assessing the medical fitness of safety critical workers.
Chiltern Railways’ procedure OHP 00847 ‘Medical Fitness’ details the medical
examination standards and includes sleep apnoea as a medical condition that can
affect the fitness of drivers.

7
RSSB is a not-for-profit company owned and funded by major stakeholders in the railway industry, and which
provides support and facilitation for a wide range of cross-industry activities. The company is registered as ‘Rail
Safety and Standards Board’, but trades as ‘RSSB’.
8
Obstructive Sleep Apnoea Syndrome in Train Drivers (T299 Report); available at www.sparkrail.org.

Report 04/2021 26 July 2021

Chalfont & Latimer
66 Chiltern Railways contracts Medigold Health (as part of a broader framework

Analysis
agreement) to provide periodic medical examinations undertaken by a recognised
doctor.9 Chiltern Railways did not define specific requirements for this examination
but relied on the expertise provided by this arrangement. Although Medigold
Health was aware of the medical requirements contained in legislation and in rail
industry standards and guidance (paragraphs 56 and 61), the questionnaire it
supplied for doctors undertaking these health checks did not include a question
explicitly relating to sleep until November 2019, before the incident but after the
last pre-incident health check undertaken on the driver. Medigold Health stated
that:
‘All clinicians trained to undertake rail work are advised of the company’s rail
information pages which include the rail standards and guidance documents;
GO/GN3655 is included in this document pack. Fatigue and tiredness of a
significant and impairing level could be expected to cause headache, dizziness,
aching muscles or weakness and psychological symptoms such as lowered
mood or irritability. Those of a more non-specific nature and involving a broader
number of medical systems would contribute to the clinician’s consideration
of an, as yet, undiagnosed condition. The question set contains a selection
of disease specific and of symptom questions. Asking these questions relies
on the patient providing answers. Non-disease specific responses and other
findings such as smoking, alcohol use, obesity, sugar in the urine or moderately
raised blood pressure will be managed by the clinician by the provision of
health advice and recommending attendance at their GP practice for follow up.’
67 On 4 February 2020 the driver attended a Chiltern Railways safety briefing. The
one-day briefing used 103 presentation slides and an RSSB video to cover ten
topics, one of which was fatigue. Notes for the briefing show that the definition of
fatigue was discussed, but not medical conditions that can cause fatigue. On this
occasion, the video did not feature sleep apnoea. The driver stated that he could
not recall any briefing drawing his attention to sleep apnoea and its risk. Although
not relevant on this occasion, RAIB notes that long screen-based presentations
can result in loss of audience attention, meaning that not all the important issues
are remembered. Chiltern Railways stated that it is aware of the need to keep
people’s attention during presentations and so tries to make presentations as
interesting and interactive as possible.
68 Lifestyle guidance can make an important contribution to safety by helping staff
balance home and work life, including recognising and managing fatigue issues.
Chiltern Railways provides this using its professional driving handbook, RSSB
videos shown during some driver safety briefing days and an e-learning fatigue
module, that specifically highlighted sleeping disorders, including sleep apnoea.
However, these various sources of information may not have been effective
because:
• The professional driving handbook notes that sleep health can affect
performance but offers no guidance about sleep-related medical conditions.

9
The Train Driving Licences and Certificates Regulations 2010 include the requirement for medical examinations
to be undertaken by a recognised doctor. ORR maintains a list of such recognised doctors.

Report 04/2021 27 July 2021

Chalfont & Latimer
 • RSSB videos are shown during driver safety briefing days and some of these
Analysis

videos discuss fatigue. However, as noted at paragraph 67, it is possible that

the information in the videos may be overlooked or soon forgotten due to the
volume and detail of topics covered during the safety days.
• Chiltern Railways had not effectively implemented use of the mandated fatigue
e-learning module, with only 7% of train drivers completing it.
Diabetes
69 In December 2019, following a routine GP medical appointment, the driver was
diagnosed with type 2 diabetes and, in January 2020, started taking prescribed
medication to treat this condition.
70 Chiltern Railways’ professional driving policy, issued to train drivers, requires
them to report to their manager or control if they believe their fitness to work
could be affected. The driver stated that he did not report the diabetes diagnosis
because he believed it did not affect his fitness to drive trains. This was because
his GP had not advised him to tell his employer (the driver understood that his GP
knew he was a train driver), and from personal experience where a diabetic family
member was able to drive a car without restriction.
71 Chiltern Railways requires its drivers to report any prescribed medication they
are taking that could affect their performance, so that an assessment can be
undertaken by its healthcare provider to determine whether the medication
could affect a driver’s ability to safely drive a train. The driver was aware of
this reporting requirement, but had not formally reported taking the medication
prescribed for diabetes. He stated this was because he had not been warned
about any performance-related side effects of the medication by his GP, and had
suffered no side-effects when starting the medication.
72 However, the driver stated he told one of the Marylebone driver managers about
it during a conversation, but could not recall which manager. Chiltern Railways
checked its records and could not find a record of a medication check being
undertaken. One of the driver managers did recall a conversation with the driver
about diabetes but thought this was an informal conversation relating to an
existing condition already known to Chiltern Railways and so took no further
action. It is uncertain whether this was the conversation recalled by the driver.
After the incident at Chalfont & Latimer, Chiltern Railways provided details of the
diabetes medication to its health care provider for assessment, and the provider
advised that there was no associated restriction for train driving.
73 Type 2 diabetes symptoms include tiredness and needing to urinate more
frequently, particularly at night. It is therefore probable that the onset of diabetes
sometime after the driver’s periodic medical in March 2019 worsened the poor
quality of sleep already affecting the driver due to sleep apnoea.

Report 04/2021 28 July 2021

Chalfont & Latimer
Roster

Analysis
74 The driver’s roster did not follow all parts of ORR’s guidance for managing fatigue
risk.10 This recommends a maximum block of four early (before 07:00 hrs) starts
and that these should be followed by two days’ rest. The driver had worked five
early shifts, each beginning just before 06:00 hrs, and then had only one rest
day before the day of the incident. It is unlikely that the driver’s working pattern
was the main cause of his fatigue, given the long-term negative effects on his
sleep quality caused by sleep apnoea and diabetes. However, it is possible that
his working pattern had some effect, as the driver stated he had not properly
recovered from the series of early starts in the week leading up to the incident.
Eyesight
75 The driver’s medical examination in March 2019 identified a need for him to
wear varifocal glasses for both distance and near vision. The driver stated that
he could not recall wearing them at the time of the incident and that he did not
know he had to wear them for driving trains, believing they were only needed for
reading. Not wearing glasses is very unlikely to have contributed to the SPAD as
the driver could not recall the signal aspects at all, and even if he had misread
signal aspects from a distance, they would have been clearly visible as the train
approached and passed them.
Restarting without permission
76 Following the SPAD, the driver reset the tripcock equipment and then
restarted the train without obtaining permission.
Rules
77 LUL and Chiltern Railways expect the driver of any train stopped by a tripcock
activation on LUL infrastructure to obtain authority from LUL’s service operator
before restarting their train. Chiltern Railways’ drivers needed to do this through
LUL control due to radio limitations (paragraph 42). The Chiltern Railways driver
stated that he believed permission to restart the train was not needed because
he believed the tripcock activation to be spurious, and not caused by the train
passing a stop signal. However, he stated that he did intend to report the
unscheduled stopping of the train due to the tripcock activation when he arrived at
Chalfont & Latimer station, the train’s next stop, because it may have delayed the
LUL train which at that time he believed was waiting for his train to pass.

10
ORR publication ‘Good practice guidelines - Fatigue Factors’ published 2017, available from www.orr.gov.uk.

Report 04/2021 29 July 2021

Chalfont & Latimer
 78 The national rail network Rule Book applicable to train drivers11 does not
Analysis

specifically mention tripcocks as they are rarely found on the national rail
network.12 Therefore, rules covering tripcock operation are part of Chiltern
Railways’ instructions for drivers operating over LUL infrastructure.13 These are
produced in co-operation with LUL but do not explicitly state that immediate
contact with the signaller (LUL’s service operator) is required. Instruction 6.3.3
states:
‘In the event of a tripcock operating on LU infrastructure, you must contact the
Signaller (via the LU Controller if necessary) and work to their instructions.’
79 Although the national rail network Rule Book does not deal directly with
spurious tripcock activations, a tripcock brake application is an ‘abnormal’ brake
application, which is covered by national rail network Rule Book module TW1,
Section 1 which states:
‘If your train has been brought to a stand by a brake application which you did
not make, you must immediately check the in-cab equipment indications, such
as automatic warning system (AWS), ERTMS or train protection and warning
system (TPWS), to see if this has intervened.
If AWS, ERTMS or TPWS equipment has intervened, you must immediately
contact the signaller, unless TPWS caused the brake application when the train
was approaching buffer stops.
If AWS, ERTMS or TPWS did not cause the brake application, you must find
out if the brake was applied by the guard or by the passenger communication
apparatus.
If none of these caused the brake application, you must check if the train is
complete.
You must agree with the signaller what actions will be taken to find out whether
the train has become divided and whether any other line is affected.’
80 As also required for tripcocks, the TPWS and ATP systems require resetting
by the driver after the systems have activated the train brakes to stop a train in
circumstances such as passing a stop signal. The relevant railway rules explicitly
require the driver to obtain the signaller’s authority before restarting the train if
TPWS has applied the brakes. In the case of ATP, drivers’ training requires ATP
brake applications to be reported to the signaller before restarting the train. The
driver involved in the Chalfont & Latimer incident did not obtain the signaller’s
authority when restarting his train after a TPWS activation in June 2007, and after
an ATP activation in February 2015 (table 2). With regard to the ATP activation in
2015, the driver stated that although he could not recall the details of the event,
he believed it was likely to have been caused by an ATP ‘error’ code, which he
stated that, from his training, did not require reporting to the signaller.
81 Although fatigue can affect people’s decision making (paragraph 54), it is
uncertain whether fatigue influenced the driver’s decision to restart his train
without seeking permission at Chalfont & Latimer or following the TPWS brake
activation in June 2007.
11
GERM8000 ‘Train Driver Manual’, issue 7 was valid at the time of the incident.
12
The tripcock system is used on MerseyRail and by LUL trains running over Network Rail infrastructure between
Gunnersbury and Richmond, and between Queens Park and Harrow & Wealdstone.
13
TQW 00200d ‘LU Instructions’ issue 3, April 2020.

Report 04/2021 30 July 2021

Chalfont & Latimer
82 Instructions are given to LUL train operators in a set of documents which differ

Analysis
from those for Chiltern Railways drivers. LUL instructions are given in its Rule
Book 7 ‘Train incidents and safety equipment’, issue 7, December 2018, which
states that, following a SPAD, train operators must not move their trains until they
have received authority to do so. This authority would normally be given by the
service operator. Spurious tripcock activations are not covered by this rule and,
for these, LUL expects its staff to apply Rule Book 7, section 1.4: ‘It is the duty of
all staff to immediately report any incident to the controller’.
Spurious tripcock activations
83 The driver believed that the spurious tripcock activation was caused by the train’s
tripcock striking high ballast, an animal or some other object which would have
the same effect as striking a trainstop raised at a stop signal. The driver stated
that not seeking authority to restart the train was not an attempt to cover up the
incident, and that he would not have continued towards the junction if he had
known he had passed a signal at danger.
84 It is possible that the driver was influenced by a lack of clarity about how tripcock
activations are dealt with on the national rail network routes which Chiltern
Railways operates over. There are no signals fitted with train stops on these
routes, so any tripcock activations are spurious. Chiltern Railways’ data shows
more than 100 such events are reported annually. Witness evidence suggests
that there is also an unknown number of unreported spurious activations. Chiltern
Railways does not include in its operating instructions what should be done in
the event of a tripcock brake application on the national rail network but stated it
would expect drivers to apply the rule for abnormal brake applications as stated in
the Rule Book (paragraph 79).
Competence Assessment
85 Chiltern Railways’ competence assessments did not identify that the driver
lacked knowledge about tripcock activation processes and had a relatively
high risk of being affected by fatigue, so these issues were not addressed.
Retraining and assessment before returning to full main line driving
86 The processes used for assessing and monitoring Chiltern Railways’ drivers’
competence are described in its document ‘Train Driving Competence Standards
and Guidance’.14 This defines the criteria that must be met for a driver to be
considered competent. Assessments against these criteria are carried out
by assessors using a combination of practical assessments (in which drivers
are observed driving trains and undertaking other tasks), reviewing driving
performance using data collected by the on-train data recorder, reviewing forms
submitted by drivers (such as when reporting signalling faults or train faults) and
face-to-face questioning by assessors. Drivers are also asked to complete written
question papers, including one which relates to working over LUL infrastructure.
However, RAIB observed that the LUL written question paper produced by
Chiltern Railways did not include a question about responding to a tripcock
activation.

14
Chiltern Railways document CRCL-OPS-L2-303 ‘Train Driving Competence Standards and Guidance’ issue 1
dated August 2012.

Report 04/2021 31 July 2021

Chalfont & Latimer
 87 The driver was initially trained in 2002, 18 years before the incident, so the RAIB
Analysis

investigation has focused on how tripcock issues were assessed during and after
the driver’s return to full main line driving in 2018. This was after a three-year
period working within a depot and driving empty trains on a route which did not
involve LUL infrastructure and tripcocks.
88 Following a meeting at which managers decided it was appropriate for the driver
to return to full main line driving (see paragraph 105), the driver’s then manager
(driver manager A) proposed a training plan for the driver’s return to full main line
driving (see paragraph 106). This plan included requirements to re-learn all routes
and a full rules assessment. It also included additional training to drive class 68
locomotives in passenger service, as the driver had only been trained to drive
them within Wembley depot. RAIB has not been able to establish the actual scope
of training as Chiltern Railways stated it could only locate an unsigned, undated
electronic copy of a plan; it could not locate a final copy of the completed training
plan, demonstrating which activities had been successfully undertaken.
89 Available evidence indicates that parts of the retraining were assigned to a driving
instructor who made the records summarised below:
• A record dated 11 May 2018 noted that training was underway with the driver
taking trains under supervision between Aylesbury Vale Parkway and London
Marylebone. Comments indicated that the instructor driver observed the driver
using risk triggered commentary driving,15 and questioned the driver on LUL
rules and regulations. The instructor driver also recorded that the driver had
been briefed about these separately at Aylesbury depot.
• A record dated 29 May 2018 noted that the driver was continuing to make good
progress and was now driving faster trains to Oxford and Banbury, as well as
continuing to drive over the LUL route. The instructor driver noted that the driver
was continuing to use risk triggered commentary driving ‘to good effect’.
90 The driver instructor stated that he had briefed the driver on LUL rules and
checked his understanding by verbally questioning him. It is uncertain if this
included questions about responding to tripcock activations, and there are no
records of what took place.
91 A driver manager (driver manager C) was then tasked with assessing the driver
on completion of his training for the reasons explained at paragraph 109 onwards.
This driver manager was new to the role and was not sure what was required of
him to deem a driver competent in these circumstances (the roles of the various
driver managers are discussed at paragraph 108 onwards). At this time, he
had no experienced local management support. A lack of written and electronic
records and incomplete recollection of events mean that it is not possible to
determine exactly what the driver’s retraining and assessment consisted of and
how it was undertaken. However, the driver restarted full main line driving after
driver manager C issued a certificate of competence valid for 24 months on 14
September 2018.

15
Risk Triggered Commentary is a technique that helps focus attention so that critical information relating to risk
for a given situation and/or task is at the forefront of a driver’s mind and supports working memory, for example
saying out loud signal aspects. The use of this technique is not mandated for all drivers by Chiltern Railways, but
drivers are made aware of its usefulness.

Report 04/2021 32 July 2021

Chalfont & Latimer
92 Chiltern Railways could not find any written records relating to assessment of

Analysis
the driver in respect of LUL rules, and the driver could not recall being briefed
or questioned about these during his retraining period. It is therefore uncertain
whether the driver had been retrained and assessed on resetting the tripcock
system before restarting full main line driving duties.
Assessment after returning to full main line driving
93 The driver was assessed on 12 occasions between returning to full main line
duties and the day of the incident. These comprised eight practical assessments
and four assessments undertaken by reviewing OTDR data. The driver’s last
planned practical assessment before the incident could not be undertaken due to
restrictions on the number of people in the driving cab because of the COVID-19
pandemic, so instead, an OTDR assessment was undertaken. Although the
term ‘non-technical skills’ does not appear in any of the driver’s competence
assessments, there were some competence records referring to the driver using
risk-triggered commentary driving and highlighting station stops on the train’s
schedule paperwork.
94 During the eight practical assessments, generally positive comments were
recorded about the driver’s performance, and no issues of concern requiring
any follow-up or intervention were deemed necessary. During an assessment on
5 February 2019, carried out on a drive from London Marylebone to Aylesbury,
the assessor completed the section of the performance standards relating to ‘the
operation and testing of the tripcock and trainstop apparatus’ (paragraph 128
describes possible limitations of this assessment). The driver’s last practical
driving assessment over the Metropolitan Line in the southbound direction
(the direction in which the train was travelling when the incident occurred) was
undertaken on 20 December 2018, during which the assessor recorded the
driver’s use of risk-triggered commentary driving.
95 Apart from one assessment of 3 hours 40 minutes duration, which was an
assessment of the driver following further training to drive class 68 locomotives
in passenger service, the average practical driving assessment was 1 hour
12 minutes with the shortest being 30 minutes and the longest being 2 hours.
All the assessments were completed by mid-afternoon except for the class 68
assessment which was completed by around 18:00 hrs.
96 The four OTDR data assessments did not identify any areas of concern relevant
to the incident. The average duration of train driving considered during these
four assessments was around 61 minutes, with a range between 39 minutes and
1 hour 23 minutes. The assessment start times ranged from 09:07 hrs to 11:48
hrs. The timing and duration of both the practical and OTDR assessments meant
they were less likely to detect fatigue related issues than longer assessments
undertaken later in the day.

Report 04/2021 33 July 2021

Chalfont & Latimer
 97 The incident driver was not on a development plan, and so testing on railway
Analysis

rules was not required to be completed until two years following issue of his
certificate of competence on 14 September 2018. However, the driver was tested
on national railway rules on 6 September 2019, just under one year later. Driver
manager D was unable to recall why the driver was reassessed after one year
but thought it possible that the wrong information had been entered into the
competence management database. Driver manager D did not undertake an
assessment of the driver’s knowledge of LUL rules as he was not yet competent
on the LUL rules himself (the roles of the various driver managers are discussed
at paragraph 108 onwards).

Identification of a probable underlying factor

Chiltern Railways’ driver management
98 Chiltern Railways’ driver management processes did not effectively manage
safety related risk associated with the driver. It is probable that this is a
factor underlying the incident and possible that this was the consequence
of an insufficient number of driver managers and their high workload.
99 The driver involved in the incident was involved in 12 safety related incidents
from 2002 to 2015, and this resulted in him being given a role restricted to
driving empty passenger trains within Wembley depot and between this depot
and London Marylebone station (table 2). He returned to full main line driving
duties in 2018, and was then involved in two further incidents before the incident
at Chalfont & Latimer. The frequency of incidents before the one at Chalfont &
Latimer is greater than that of a typical driver, but did not lead Chiltern Railways to
implement the effective management action needed to prevent this incident.
100 A Chiltern Railways safety review panel16 was convened in June 2012 after the
driver had failed to stop his train at Sudbury and Harrow Road station in the
previous month, the driver’s tenth safety incident since qualifying in 2002. Chiltern
Railways was unable to locate records associated with this review except for
a record of the outcome. This shows a decision to allow the driver to continue
driving with a development plan in place to manage personal issues outside
work, that were believed to have contributed to the driver’s performance. This
plan lasted 24 months, during which the driver was not involved in any further
incidents.

16
Described in Chiltern Railways‘ procedure OQP-313 ‘Competence Development Process for Train Drivers.

Report 04/2021 34 July 2021

Chalfont & Latimer
101 The driver’s next incident was in October 2014, when his train overran a station

Analysis
stop at Warwick Parkway. Actions taken in response to this included pairing the
driver with an instructor driver for five days, a practical driving assessment by a
driver manager, monthly face-to-face meetings with his manager and advising
the driver to use risk-triggered commentary driving. The driver also took part in
psychological assessments with a specialist organisation to identify possible
social, cognitive and personal issues that may have contributed to the incidents,
and to identify strategies that the driver could use to reduce the likelihood of
similar events in the future (such as non-technical skills17 (NTS)). The specialist’s
report, dated 7 February 2015, identified several areas where techniques (for
example, marking station stops on the train’s schedule) should be considered in
future development plans for the driver.
102 Despite this intervention, the driver was involved in a further incident on 23
February 2015, when his train overran a station stop at High Wycombe. A safety
review panel, comprising senior Chiltern Railways managers and a trade union
representative, was convened to decide whether the driver could continue driving,
with supportive actions, or whether the driver should be removed from driving
duties. The panel spoke with the driver and his driver manager, and reviewed
all the driver’s previous incidents, associated post-incident development plans
and the report produced by the organisation that undertook the psychological
assessment after the previous incident.
103 The panel noted that the driver was dealing with personal issues in his life and
that the driver was identifying methods to use to help his concentration. It decided
that the driver would be restricted to driving trains at Wembley depot and empty
class 165 and 168 trains between there and Marylebone station for an initial
period of three years. The intention of the restriction was recorded as to:
‘ ...manage the concentration issues and to reduce the amount of decisions that
you will have to make whilst driving at high speeds and during longer periods of
sustained concentration.’
104 A development plan was put in place for this three-year period including a
requirement for the driver to use strategies to help his concentration (such as
risk-triggered commentary driving), reviews of OTDR downloads and periodic
interviews with his driver manager. The review panel concluded by saying that:
‘We are not closing the book on a return to mainline driving, at the end of your
new competence development plan we would not preclude your return to the
mainline, subject to agreement with yourself, Driver Manager, Depot Manager,
Operations Standards Manager and Operations Development, Training and
Simulator Manager – involvement to be determined.’

17
RSSB (footnote 7) describes non-technical skills as ‘social, cognitive and personal skills that can enhance
the way you or your staff carry out technical skills, tasks and procedures. By developing these skills, people in
safety- critical roles can learn how to deal with a range of different situations’.

Report 04/2021 35 July 2021

Chalfont & Latimer
Analysis

Decisions and training in 2018 to return the driver to full main line driving
105 Chiltern Railways’ procedure OQP-313 does not describe what should happen at
the end of a period of restricted duties, but a review is implied in the conclusion of
the 2015 safety review panel (paragraph 104). There is no evidence that a formal
review took place when the driver’s three-year restriction was nearing completion
in 2018 and very little evidence to indicate exactly what did happen. Chiltern
Railways believes a meeting involving the operations manager, the depot manager
and the driver’s manager took place, but it is unclear who, or what, initiated the
process for returning the driver to full main line driving.
106 The driver’s manager (driver manager A) identified a need for retraining before
returning to full main line driving and a training plan was created. No competence
plan was put in place for the period after the driver’s return. Chiltern Railways’
standards did not explicitly require a plan and there is no evidence that a plan
was considered by managers. It is possible that managers believed the driver’s
personal issues had been resolved, perhaps because the driver had not been
involved in any incidents in the three years he had been on restricted duties.
However, this alone would not be a reliable means of assessing improved
performance as restricted duties meant that the driver was driving much less,
both in terms of continuous driving time and in total driving time per shift, and was
able to take frequent breaks. It is possible that these circumstances reduced the
probability of him losing attentional focus which was a possible factor in earlier
incidents (paragraph 52).
107 The driver stated that he had raised concerns with his manager and trade union
official about returning to full main line driving, as he was particularly concerned
that involvement in another incident could end his career. A record of a meeting
between the driver and his driver manager dated 7 June 2018 includes a note of
the driver’s concerns, and reassurance by the driver manager that any incident
‘would be dealt with fairly’. Chiltern Railways stated that staying on restricted
duties was not an option as, in its view, the evidence indicated the driver’s
performance had improved, with no incidents during the restricted three-year
driving period, and a full-time permanent position as a restricted driver did not
exist.
108 The initial part of the driver’s retraining was undertaken by a driving instructor.
The training plan (paragraph 106) envisaged that the task of continuing the
driver’s retraining, and assessing him as competent to return to full main line
driving, would then pass to a driver manager. The handover meeting between the
instructor and a driver manager (driver manager C) took place on 7 June 2018.
Driver manager C was new to the role of driver manager, having started in it at the
beginning of 2018, and this was the first time he had undertaken such a re- training
and assessment task. He stated that he was given little guidance on what was
required.
109 In June 2018, during the period the driver was training to return to full main line
driving, his driver manager (driver manager A) retired. There are conflicting
accounts regarding responsibility for the driver’s management at this point: driver
manager B stated that driver manager C had taken over management of driver
manager A’s team as he had been shadowing driver manager A whilst seconded.
However, driver manager C stated that he believed driver manager B was
responsible for the management of the driver. In either case, driver manager C
completed the driver’s training (paragraph 91) with support from driver manager B.

Report 04/2021 36 July 2021

Chalfont & Latimer
Undertaking normal driving duties from 2018 until the incident

Analysis
110 Driver manager B had a period of sickness leave towards the end of 2018, and
subsequently transferred to another Chiltern Railways depot in early 2019.
Around this time driver manager C left Chiltern Railways and responsibility for
managing the driver transferred to driver manager D. This driver manager was
new to the role and had joined from another train operating company where he
had been a train driver.
111 Driver manager D stated that, when he was given his team of drivers, some were
highlighted to him as needing close attention. However, during the handover no
concerns were raised about the driver involved in the incident, and this driver was
not then subject to any competence development plan. The safety performance of
Chiltern Railways’ drivers is logged onto its ASSURE database system (an online
system used to manage and record the competence management process), and
driver manager D had updated the driver’s safety history following the incidents
in early 2020 (see paragraph 113). Although the driver’s full safety history was
visible to driver manager D on the ASSURE database, he felt that he would have
benefitted from more detailed information about the driver and his operational
performance during the handover, particularly information that may not be
apparent in electronic records.
112 Driver manager D also stated that as soon as he had been trained in assessing,
he had little time to complete all the rest of the required training identified in his
training plan, as the workload at the depot was significant. The driver manager
also stated that he was working up to 50 to 60 hours a week, including working
from home, in an attempt to keep on top of his workload (see paragraph 121).
113 The driver was not involved in any safety incidents between restarting full main
line driving in September 2018 and early 2020 when he was involved in two
incidents. In the first incident, on 20 January 2020, he did not cancel an AWS
warning within the allocated time of two to three seconds so the train’s emergency
brakes applied. Then, on 17 February 2020, the driver stopped his train at a
station it was not booked to stop at. The driver reported both these incidents.
114 Driver manager D stated that he was not fully aware of the background to
the driver’s previous safety history (paragraph 111) and neither incident was
particularly concerning. However, on 18 February 2020, the day after the second
incident, a Chiltern Railways safety manager sent an email to driver manager D
suggesting he have a ‘meaningful conversation’ with the driver because of his
previous safety incidents. Driver manager D spoke with the driver but nothing of
concern was raised and driver manager D decided it was not necessary to place
the driver on a development plan or to take any other action.
115 It is possible that driver manager D would have had a greater understanding of
the driver if he had been able to build a closer relationship with him. Practical
assessments, particularly the time immediately before and after driving tasks,
are an opportunity to do this but, since taking up his role, driver manager D’s
workload meant that he had only undertaken one practical driving assessment
with the driver (paragraph 119). This was a return trip from London Marylebone to
Oxford on 9 September 2019.

Report 04/2021 37 July 2021

Chalfont & Latimer
Analysis

Driver management resource

116 Chiltern Railways’ driver management function had not always been adequately
resourced at Marylebone depot since at least 2017. For part of 2018, during the
time the incident driver was being retrained, and from December 2019 to June
2020, the period when the incident driver had two safety incidents, two driver
managers were each responsible for managing around 43 drivers. This is around
50% more than the largest number for which managers were responsible at other
depots (table 3).
117 The driver managers were supported variously by one or two driver instructors
to assist in carrying out competence assessments and briefings to help manage
workload at Marylebone depot. However, this approach reduces opportunities
for driver managers to build relationships with their drivers and possibly limits
discussions of a personal nature.

Ratio of driver managers to drivers at Chiltern Railways depots

Number of driver Number of Drivers Actual average
Depot managers (nominal drivers per
Intended Actual establishment) manager
Marylebone
June - Sept 2018 3 2 86 43
Dec 2019 - Jun 2020
Marylebone
3 3 86 29
Oct 2018 - Nov 2019
Aylesbury
3 3 92 31
2018 - 2020
Stourbridge
1 1 24 24
2018 - 2020
Banbury
2 2 47 24
2018 - 2020
Birmingham
2 2 37 19
2018 - 2020
Table 3: Ratio of driver managers to drivers at Chiltern Railways depots

118 The driver manager vacancies led directly to high workload for the remaining
driver managers and this was exacerbated by the relatively high driver manager
turnover with the associated training requirements. The consequence was that
most driver management was being undertaken by driver managers new to
the organisation, or inexperienced driver managers new to the role, with heavy
workloads. Some driver managers told RAIB that often they received the ‘bare
minimum’ of training before they were expected to become fully productive. At the
time of the incident, the driver’s manager (driver manager D) had been in post
for 18 months but had not yet been through the formal process for learning and
assessment of the LUL route and the LUL rules.

Report 04/2021 38 July 2021

Chalfont & Latimer
119 The consequences of this high workload are illustrated in records for the incident

Analysis
driver. Of the 11 practical competence assessments completed after resuming
full main line duties (excluding the class 68 training assessment), 9 were overdue
between 10 and 60 days, with an average of 22 days. Of these 11 driving
assessments, only four were undertaken by driver managers; the rest were
completed by instructor drivers. Using an instructor driver does not prevent an
effective performance assessment, but it does lose an opportunity for a driver
manager to develop their relationship with their driver.
120 Witness evidence indicates that the training of driver managers was inadequate,
and a 2019 independent report commissioned by Chiltern Railways into its driver
management function18 reported that:
‘Most driver managers find it very difficult to locate online procedures and
standards or even know the scope of what exist [sic] relative to their role.’
‘There is limited support and skills development provided by operations
standards to the driver management team.’
‘Except for a few instances, the focus of driver management is to deliver a
requirement to follow a process (assessment, CDP, training or route learning,
etc.) with little emphasis on developing driver performance and measuring
progress.’
‘CDP [competence development plans] often remain unsigned by managers
which is non-compliant with existing procedures.’
121 High workload, including insufficient time to become acquainted with the
incident driver’s previous record and inexperience, are the possible reasons
for driver manager D’s actions when responding to the safety incidents in early
2020 (paragraph 114) and when being told about the incident driver’s diabetes
diagnosis (paragraph 72).
122 Witness evidence from some of the driver management team in place between
2018 and 2020 suggests high workload at Marylebone depot was partly due to
the difficulties in recruiting and retaining driver managers at that location. Chiltern
Railways’ salary for driver managers is low compared with other train operating
companies, and the hourly rate of pay is similar to that of its train drivers.
There is some evidence, refuted by others, that a perceived non-supportive
relationship with senior management possibly influenced retention of driver
managers but, as there is some evidence that support was being given, and no
direct evidence linking lack of support to the causes of the incident on 21 June
2020, this relationship is dealt with in this report as part of an observation (see
paragraph 139).
123 In May 2020 Chiltern Railways made a request to the Department for Transport to
increase the salary of its driver manager grade to help it recruit and retain driver
managers. Obtaining the Department for Transport’s consent was a requirement
of its Emergency Measures Agreement (EMA) introduced to deal with the financial
losses associated with the COVID-19 pandemic.

18
‘Chiltern Railways Review of Train Driver Management’, independent report by RPD (Rail Professional
Development), 2019.

Report 04/2021 39 July 2021

Chalfont & Latimer
 124 The request was rejected by the Department for Transport because of its policy
Analysis

of no pay increases while the EMA was in place unless enforceable by existing
agreements and Chiltern Railways was advised to look at other solutions. In
October 2020, the Department for Transport agreed that Chiltern Railways
could second someone into a managerial position to help strengthen the driver
management function. In January 2021, the Department for Transport approved
a request from Chiltern Railways to reorganise its driver management function, a
reorganisation intended to provide more resilience and incentivise staff.
Driver management processes
125 Taken together, the following indicate that Chiltern Railways’ driver management
processes did not effectively manage safety related risk associated with the
driver:
a. A possible management belief that the three-year period of restricted duties
had ‘fixed’ any issues that might have been underlying causes of the driver’s
previous incidents (paragraph 106).
b. No evidence that the specialist’s psychological report prepared in 2015
was reviewed to identify any actions that could be taken to support the
driver and reduce the likelihood of him being involved in further incidents
(paragraph 101).
c. A substantial part of the driver’s retraining was undertaken by an
inexperienced driver manager who was given little guidance on what was
expected of him in order to pass the driver as competent to return to full duties
(paragraph 108).
d. The driver’s manager changed three times between mid-2019 and January
2020 (paragraphs 109 and 110). This resulted in:
• loss of information held in personal memory; and
• a repeated need to rebuild the trusting personal relationships which can help
identify and resolve potential problems.
e. Many training records and decisions were not available, contributing to
managers having an incomplete knowledge of the driver’s safety performance
history (paragraphs 88, 90, 92 and 111).
f. An ineffective response to the two incidents in 2020 which resulted in an
informal conversation with the incident driver rather than a formal review
of events (paragraph 114). This is likely to be a consequence of ineffective
handover when driver manager D took on his team (paragraph 111) and/or
driver manager resourcing (paragraph 116).
g. Possible ineffective follow-up with the incident driver about his diabetes
condition. This is considered possible because of uncertainty around the
circumstances in which diabetes was reported (paragraph 72) and its link to
driver manager resourcing (paragraph 116).
h. Overdue, and in some cases possibly ineffective, assessments with insufficient
time to plan these appropriately (paragraph 95). This is directly linked to driver
manager workload, which itself is due to driver management resourcing.

Report 04/2021 40 July 2021

Chalfont & Latimer
Observations

Analysis
Risk management
126 Assessments undertaken by Chiltern Railways and LUL did not accurately
assess the risk of a collision arising from a Chiltern Railways driver
resetting the tripcock and then proceeding without authority. However,
the deficiencies identified in Chiltern’s management of the driver suggest
that, even had the risk been more accurately assessed, it is unlikely
that improvements to this assessment would have resulted in sufficient
mitigation to prevent the incident at Chalfont & Latimer.
Tripcock assessment
127 Driving task analyses are used to identify training, knowledge and competence
requirements for inclusion in Chiltern Railways’ driver training and competence
processes, including deciding what performance criteria are necessary and
what written and verbal questions need to be asked to prove drivers have
sufficient underpinning knowledge of rules and procedures. The task analysis
for train driving had identified a task described as ‘Respond appropriately to an
unsolicited brake application via the AWS or TPWS’ (task reference CRTD-185).
However, there was no corresponding task for responding to an unsolicited brake
application due to activation of the tripcock. There were therefore no clear and
explicit competence criteria relating to the actions to be taken following activation
of the tripcock in Chiltern Railways’ train driving standards, and no related
question in Chiltern Railways’ question paper relating to operations on LUL
infrastructure (paragraph 86).
128 There was a more general question concerning tripcock use in unit 8 of Chiltern
Railways’ train driving competence standards and guidance.19 This unit concerns
working of trains over LUL routes and requires drivers to ‘demonstrate correct
operation of the tripcock testing equipment’. Associated ‘explain’ criteria, given
in the same document, identify criteria to be discussed during practical driving
assessments or face-to-face rules assessments. These criteria include ‘What
instructions apply to the operation and testing of the tripcock and trainstop
apparatus’. Although Chiltern Railways stated this was intended to include
responding to tripcock activations, witness evidence indicates that some
assessors understood this to relate to the tripcock test, and not responding to a
tripcock activation.
129 Chiltern Railways acknowledged that the criterion may have been open to
interpretation, but noted some criteria need to be of a general nature to prevent
an excessive amount of detail being listed in the competence standards. The
uncertainty about the scope of tripcock assessments is treated as an observation
(rather than a cause of the Chalfont & Latimer incident) because there is
considerable uncertainty about the extent to which the incident driver was
given the required assessments relating to his response to tripcock activations
(paragraphs 90, 92 and 97).

19
CRCL-OPS-L2-303 ‘Train Driving Competence Standards & Guidance’, issue 1, August 2012.

Report 04/2021 41 July 2021

Chalfont & Latimer
 130 The driving task analysis concluded that tasks associated with AWS and
Analysis

TPWS activations were high risk, with ‘low’ opportunities to assess drivers in
operational service. It therefore identified that a train simulator should be used
to assess drivers where necessary. A similar outcome would have been likely if
the corresponding tripcock reset item had been the subject of a task analysis.
However, this is unlikely to have affected the Chalfont & Latimer incident as
witness evidence indicates that Chiltern Railways rarely used its simulator to
assess train driver competence.
131 Route risk assessments are intended to identify risks specific to locations. The
relevant assessment recognised the potential for trains to reach the Chesham
junction after resetting the tripcock without authority, and relied on training as
mitigation. However, shortcomings in the provision of training covered in the
underlying factor demonstrate that such a mitigation could not be relied upon
(paragraphs 127 to 130).
Risk profile and modelling
132 Chiltern Railways’ risk profile does not include the risk of a collision due to a driver
resetting the tripcock and proceeding without authority because:
• the risk profile uses data from RSSB’s safety risk model,20 a model created for
main line operators which does not include data from LUL or the small parts of
the national network fitted with tripcock equipment
• there was no separate Chiltern Railways risk profiling exercise for operation
over LUL infrastructure
• Chiltern Railways’ driving task analyses (paragraph 127) neither recognised
risk associated with resetting the tripcock without authority, nor fed into Chiltern
Railways’ safety risk profiling process
• route risk assessments did not feed into Chiltern Railways’ safety risk profiling
process and information from them was not shared with driver managers or
drivers.
133 Although not relevant to resetting tripcock equipment, the RSSB safety risk
model does not explicitly display risk data associated with the comparable
event of resetting the TPWS and continuing without authority. However, in 2018
RSSB derived from the safety risk model a numerical estimate of the level of risk
associated with resetting the TPWS and continuing without authority, when it last
estimated its contribution to SPAD risk.
London Underground Ltd
134 LUL manages safety risk associated with Chiltern Railways’ train operation within
the line-specific risk assessments associated with third-party operations on the
Metropolitan line.21 This identified the hazardous event ‘collision between Chiltern
and LUL train’ and included a cause ‘as a result of the Chiltern Railways train
passing a signal at red’. For this hazardous event, it was considered that the
risk was controlled by the fitment of tripcocks to reduce the likelihood of a train
reaching a potential collision point with another train ahead, and LUL and Chiltern
Railways’ rules which prohibit a Chiltern Railways driver passing a red signal on
their own authority (paragraphs 77 and 82).
20
https://www.rssb.co.uk/en/safety-and-health/monitoring-safety/risk-analysis-and-the-safety-risk-model.
21
Third party operations include engineering contractors and passenger train operators.

Report 04/2021 42 July 2021

Chalfont & Latimer
 Analysis
SCAT system
135 The lack of a combined LUL and Chiltern Railways risk profile is a possible
reason for an inconsistent approach to fitting of the SCAT system (paragraph 37)
which mitigates risk due to trains passing stop signals.
136 Chiltern Railways’ class 168 trains were built between 1998 and 2004 with
the SCAT system fitted. This limits the train speed to 10 mph (16 km/h) for
10 seconds, significantly less than the three minutes used on LUL trains. This
reduced timer was implemented to reduce delays due to spurious activations
when class 168 trains are operating on the national rail network. Chiltern Railways
was able to find a partly-completed form, dated 21 December 2004, requesting
a derogation from the LUL standard requiring a three minute SCAT timing. LUL
was unable to find any correspondence about this derogation and stated it was
unaware the class 168 trains were operating with a 10 second SCAT timing.
137 Chiltern Railways’ class 165 trains are not fitted with the SCAT system. Planning
for their refurbishment, undertaken between 2003 and 2005, included a hazard
and operability study (HAZOP) undertaken jointly by Chiltern Railways and LUL to
identify potential hazardous conditions and events associated with the refurbished
class 165 trains, and to identify how these could be controlled. Hazard H104 was
recorded as ‘Train passing red signal after tripcock’. The controls identified were
‘Existing Chiltern Railways safety procedures ensure a Class 165 driver will not
pass a red signal using his own initiative. Chiltern Railways Drivers will only pass
red under direct instruction from the infrastructure controller’.
138 The entry for this hazard referred to a letter written to LUL by the organisation
contracted by Chiltern Railways to manage aspects of the safety approvals
that were required as part of the refurbishment programme. The letter, dated
6 September 2002 and sent to LUL’s chief rolling stock engineer, referred to the
SCAT system and implied a decision that fitment to the class 165 trains was not
needed because Chiltern Railways and LUL had agreed that Chiltern Railways
rules did not permit its driver to pass a signal at danger without the LUL service
operator’s authority. No other records could be found relating to a response from
the chief rolling stock engineer. Before the refurbished class 165 trains could
enter service, approval from Her Majesty’s Railway Inspectorate (HMRI)22 was
required. Although the records relating to this approval could not be found, it
is inferred that approval was given by HMRI as the refurbished trains entered
service.

22
Approval to operate was a requirement of The Railways and Other Transport Systems (Approval of Works, Plant
and Equipment) Regulations 1994. Her Majesty’s Railway Inspectorate became part of the Office of Rail Regulation
in 2006, subsequently becoming the Office of Rail and Road in 2015.

Report 04/2021 43 July 2021

Chalfont & Latimer
 Driver management
Analysis

139 Some elements of Chiltern Railways’ driver management system were not
functioning effectively.
Driver management working relationships
140 While there is no direct evidence linking the working relationships within the
driver management function to the cause of the incident, some people involved
in the driver management function, both currently and those that no longer work
for Chiltern Railways, stated that a senior individual in the driver management
organisation used a management style which they believed was the cause of low
morale, people leaving Chiltern Railways and people moving from Marylebone
to depots where the workload was more manageable. Some witnesses stated
they were not supported or were made to feel responsible for things that were
organisational problems. One person said he felt a ‘bullying’ attitude existed but
the allegation of ‘bullying’ was refuted by others, and evidence was provided
showing support being given to a driver manager by modifying their working hours
to help with work/life balance.
Competence assessment
141 Although the people involved in the management and assessment of the driver
had generally received the necessary training in conducting routine competence
assessments (but not the guidance and/or experience to manage unusual
situations, paragraph 108), there is no evidence that people were observed while
they were carrying out competence assessments. This is an important activity as
it demonstrates assessors are able to apply skills they have been trained on, such
as giving constructive feedback, promoting safe behaviours and identifying areas
for further development.
142 Chiltern Railways provides guidance to assessors in documents ‘Safety Critical
Assessor’23 and ‘ASSURE Online CMS database guidance’.24 While these
provide guidance on planning and undertaking assessments, there was a lack of
guidance on the duration of assessments, start and end times of assessments
and how to plan effective assessments with regard to identifying possible signs of
driver fatigue.
143 Most train driver practical assessments were being completed by driver
instructors (paragraph 117). A recommendation to increase the number of
driver manager practical assessments was made following a Chiltern Railways
internal investigation into the circumstances of a previous SPAD at signal JT6
on 2 October 2019 (see paragraph 149). However, the number of practical
assessments undertaken by driver managers actually decreased between the
SPAD on 2 October 2019 and the incident on 21 June 2020.
144 The driving task analysis identified the need to use the train driving simulator to
practise many tasks. However, evidence from Chiltern Railways and witnesses
shows that the simulator is rarely used for this purpose, its main use being the
training of new drivers, with little use by qualified drivers. Simulators can be an
effective way to practise unfamiliar or infrequent events.

23
Chiltern Railways document CRCL-OPS-L2-301 ‘Safety Critical Assessor - Guidelines and Competence
Standards’ issue 2, dated January 2013.
24
Chiltern Railways document ‘Assure Online CMS database guidance’ version 4, dated May 2018.

Report 04/2021 44 July 2021

Chalfont & Latimer
Record management

Analysis
145 During the investigation Chiltern Railways was often unable to locate some
driver records (paragraph 92) and was unable to locate other records in a timely
and efficient manner. Witness evidence was that this was due to shortcomings
in management of paper records. Further evidence of shortcomings in records
management was provided by the report commissioned by Chiltern Railways
in 2019 (paragraph 120) that found out-of-date material relating to safety
management procedures and route learning. Reliable access to current records is
essential for managers to provide effective safety management.
Layout of instructions
146 Chiltern Railways’ instructions for drivers did not effectively highlight
important information.
147 Chiltern Railways’ instructions for operating over LUL infrastructure and its
General Instructions do not highlight critical rules (figure 14). This contrasts with
the national rail network rule book and LUL’s rule book. Highlighting in this way
conveys to the reader the importance of information essential for safety.

A rule printed inside a red box is considered to be

critical and is therefore emphasised in this way.

Figure 14: Critical rule identification in the national rail network rule book (left image) and LUL Rule
Book (right image)

Previous occurrences of a similar character

148 Records indicated that the signal JT6, intended to stop southbound trains
reaching the Chesham branch junction when this was set for northbound trains
to cross the southbound line, had been passed at red without authority on three
occasions since 2011 and before the day of the incident:
• On 8 November 2011, an LUL train passed the signal by around 15 metres. The
LUL investigation identified that low rail adhesion was a factor in the incident.
• A Chiltern Railways train passed the signal on 2 October 2019 by around
45 metres. The driver applied the emergency brake about 300 metres on
approach to the red signal. Chiltern Railways’ investigation found that factors in
the incident included the driver not reacting to the fog repeater and single yellow
aspect at signal JW5. Although the driver recalled departing Amersham on a
double yellow aspect at signal JW2, he could not recall the single yellow aspect
at signal JW5. He subsequently noticed the red aspect at signal JT6, but it was
too late to stop at it.
• On 6 April 2020, a LUL train driver anticipated that signal JT6 would change
from a red aspect as the train approached, but it did not do so before the train
passed it.

Report 04/2021 45 July 2021

Chalfont & Latimer
 149 The October 2019 SPAD investigation identified that the driver lost situational
Analysis

awareness and did not identify the single yellow aspect at signal JW5, but
the investigation did not identify the lack of an AWS warning as an influence.
The investigation also identified that the driver was not using risk-triggered
commentary driving (its use by Chiltern Railways drivers is advisory, see
paragraph 89 and associated footnote). The investigation identified the following
issues:
• The driver had not been assessed over the Metropolitan line in the last seven
years, although an OTDR assessment had been completed on 7 August 2019.
• There was no evidence that the driver had been assessed during the hours of
darkness (that is, out of office hours) in the previous seven years.
• It had been over four years since a driver manager had carried out an in-cab
practical driving assessment of the driver; all these assessments had been
undertaken by a driver instructor.
150 At 08:22 hrs on 28 March 2015, a freight train running from Acton to Westbury,
operated by DB Schenker Rail (UK), passed a signal at danger at Reading
Westbury Line Junction, to the west of Reading station. A similar incident occurred
at 06:11 hrs on 3 November 2015 when another freight train forming the same
service from Acton to Westbury, and operated by the same company, passed
a signal at danger at Ruscombe Junction, about seven miles east of Reading.
RAIB’s investigation (RAIB report 18/2016) found that both incidents occurred
because the drivers were fatigued: the cause of the fatigue was that neither
driver had obtained sufficient sleep. Following the incident on 3 November 2015,
the train driver was diagnosed with sleep apnoea. Screening for this condition
was not included in the organisation’s company standards or periodic medical
examinations.
151 At 05:31 hrs on 9 February 2006, a freight train derailed at Brentingby Junction,
near Melton Mowbray after the train had passed a red signal at the end of a
goods loop (RAIB report 01/2007). RAIB identified that a cause of the accident
was fatigue. Although there was no evidence that the driver suffered from sleep
apnoea, he was of a build and age that increased the likelihood of sleep-related
conditions. RAIB’s investigation found that the train operator’s processes did not
include routine screening for sleep disorders.
152 At 00:11 hrs on Sunday 21 July 2013, a passenger train operated by Greater
Anglia carrying 35 passengers collided at 8 mph (13 km/h) with a train stabled
in platform 6 at Norwich station (RAIB report 09/2014). RAIB concluded that the
accident occurred because, during the last 20 seconds of the train’s approach
to the station, the driver had either a lapse in concentration or a microsleep.
RAIB identified some factors which may explain the driver’s possible lapse in
concentration, including various thoughts occupying his attention at the time of
the approach and the driver being tired through a short-term lack of sleep. RAIB
also found that the driver had a previous operational history indicating that he was
prone to lapses in concentration, and that this had not been identified by Greater
Anglia’s competence management system.

Report 04/2021 46 July 2021

Chalfont & Latimer
Summary of conclusions

Summary of conclusions
Immediate cause
153 The driver reset the tripcock on the train following a SPAD at signal JT6 and
moved forward towards Chalfont & Latimer without obtaining permission to
continue (paragraph 43).

Causal factors
154 The causal factors were:
a. The driver did not react to the signal sequence and stop the train at signal
JT6, probably because he was fatigued (paragraph 46, Recommendation 1,
Learning point 1).
b. Following the SPAD, the driver reset the tripcock equipment and then restarted
the train without obtaining permission (paragraph 76, Recommendations 1
and 3).
c. Chiltern Railways’ competence assessments did not identify that the driver
lacked knowledge about tripcock activation processes and had a relatively
high risk of being affected by fatigue, so these issues were not addressed
(paragraph 85, Recommendation 1).

Underlying factor
155 Chiltern Railways’ driver management processes did not effectively manage
safety related risk associated with the driver. It is probable that this is a factor
underlying the incident and possible that this was the consequence of an
insufficient number of driver managers and their high workload (paragraph 98,
Recommendation 1).

Additional observations
156 Although not causal to the incident on 21 June 2020, RAIB observes that:
a. Assessments undertaken by Chiltern Railways and LUL did not accurately
assess the risk of a collision arising from a Chiltern Railways driver resetting
the tripcock and then proceeding without authority. However, the deficiencies
identified in Chiltern’s management of the driver suggest that, even had the
risk been more accurately assessed, it is unlikely that improvements to this
assessment would have resulted in sufficient mitigation to prevent the incident
at Chalfont & Latimer (paragraph 126, Recommendation 2).
b. Some elements of Chiltern Railways’ driver management system were not
functioning effectively (paragraph 139, Recommendation 1).
c. Chiltern Railways’ instructions for drivers did not effectively highlight important
information (paragraph 146, Recommendation 1).

Report 04/2021 47 July 2021

Chalfont & Latimer
 Previous RAIB recommendations relevant to this
Previous RAIB recommendations relevant to this investigation

investigation
157 The following recommendations, which were made by RAIB as a result of its
previous investigations, have relevance to this investigation.

Previous recommendation that had the potential to address one or more factors
identified in this report
Unauthorised entry of a train onto a single line at Greenford, 20 March 2014, RAIB
report 29/2014, Recommendation 1
158 RAIB considers that more effective implementation of recommendation 1 in
report 29/2014 could have addressed the driver’s response to the tripcock
activation, which was a factor in this incident.
159 This recommendation read as follows:
Recommendation 1
Chiltern Railways should conduct a review of its driver management processes
to confirm that the training and briefing given to drivers is comprehensive as
regards the equipment and systems that drivers use, and that assessment of
drivers covers the identification of, and response to, TPWS fault warnings as
well as drivers’ response to other unusual or emergency situations, and make
changes in accordance with the findings of the review. As part of its review,
Chiltern Railways should consider whether there is a role for more regular use
of its driving cab simulator in the assessment of its drivers’ competence, to
achieve a more systematic approach, and whether it has adequate systems
in place for periodically reviewing and revising its competence management
processes and training material.
160 Chiltern Railways’ formal response to the Office of Rail and Road dated 8
June 2015 focused on TPWS issues. It did not cover other aspects of the
recommendation which required consideration of other equipment and systems
used by drivers. This was an opportunity to review the tripcock system and its
associated rules and instructions. Such a review may have identified that these
rules and instructions were inadequate.
161 Chiltern Railways also stated in its 8 June 2015 response that, following the
Greenford incident, it had identified a driver assessor knowledge gap in TPWS
assessment. Again, by focusing on TPWS an opportunity to identify a similar
knowledge gap regarding tripcocks was missed. Chiltern Railways also stated
that its assessors had been briefed to look for patterns in a driver’s history when
undertaking assessment. For the reasons discussed at paragraph 98 onwards,
the high workload meant that planning of assessments to this depth was not
happening prior to the Chalfont & Latimer incident.

Report 04/2021 48 July 2021

Chalfont & Latimer
162 At the time of writing the letter to the Office of Rail and Road on 8 June 2015,

Previous RAIB recommendations relevant to this investigation

Chiltern Railways was in the process of submitting a business case for a second
train driving simulator but stated that ‘given the significant investment required,
this requires further development on the business case’. This business case
was later rejected by the board of directors in favour of upgrading the existing
simulator. Chiltern Railways also told the Office of Rail and Road that ‘Chiltern
can give assurance that whatever the outcome of this investment, it will be
ensuring that existing drivers are able to make greater use of the simulator
resource’. However, RAIB notes that use of the simulator by experienced train
drivers to practise responding to faults and unusual or out-of-course situations
does not routinely feature in Chiltern Railways’ management of operational
competence (paragraph 144).

Report 04/2021 49 July 2021

Chalfont & Latimer
 Actions reported as already taken or in progress relevant to
Actions reported as already taken or in progress relevant to this report

this report
163 On 2 March 2021, ORR served an Improvement Notice25 on Chiltern Railways
stating its opinion that:
‘The Driver management arrangements at the Marylebone Driver Depot are
inadequate and the Driver Management Team have insufficient competence,
information and resource to ensure effective arrangements for managing
competence of drivers within their control and you are therefore failing to
discharge your duties to ensure so far as is reasonably practicable the safety of
your employees and others.’
ORR told RAIB on 15 June 2021 that Chiltern Railways had complied with the
requirements of its Improvement Notice.
164 Chiltern Railways stated that it has taken a number of actions since the incident,
including:
• Revising its LUL Instructions with the objective of:
‘strengthening the guidance applicable to tripcocks, tripcock testers and train
stop operations and instructions applicable in the event of tripcock activations.’
Following validation and agreement with LUL, Chiltern Railways stated that the
revised instructions are currently being printed ready for publication.
• Updating its train driving competence systems to include:
• A requirement for at least one assessment to be undertaken towards the end
of a driver’s shift to ‘check on concentration and fatigue levels’.
• Providing clarity on the reporting of taking of medication.
• Checks that corrective eyewear is worn when required.
• Specific guidance and questions related to the action to be taken when
responding to tripcock activations on either LUL infrastructure or on the
national rail network.
• Fitting labels in the driving cabs of its class 165 and 168 trains instructing
drivers to immediately report any tripcock activation to the signaller and not to
reset the tripcock equipment or move the train until authorised to do so.
• Engaging with a third-party facilitator to:
‘. . . develop the working relationships within the driver function and between
the driver and HSSE [Health, Safety, Security & Environment] teams.’ Chiltern
Railways stated that ‘To date, we have had sessions involving the directors of
both departments and their direct reports, and also an initial workshop with the
driver managers and HSSE representatives.’
Chiltern Railways further stated that:
‘The 22nd June workshop has now taken place . . . with an action plan going
forward including more sessions to build on the teams’ interactions’.
25
An improvement notice is one of ORR’s formal enforcement means by which it can request a duty holder to
make a specific improvement within a set timescale. The improvement notice served on Chiltern Railways can
be found here: https://orrprdpubreg1.blob.core.windows.net/docs/IBS-020321-01%20Chiltern%20Railway%20
Company%20Ltd%20improvement%20notice.pdf.

Report 04/2021 50 July 2021

Chalfont & Latimer
 • Receiving authorisation from the Department for Transport to strengthen its

Actions reported as already taken or in progress relevant to this report

driver management function.
• Commencing assessments of driver managers and trainers undertaking
assessments on others.
165 Medigold Health stated that a question about problematic daytime sleepiness and
drowsiness was added into periodic medical examinations from November 2019
and that it is trialling a new periodical medical examination form that includes
additional questions relating to mental health, neurodevelopmental disorders and
diabetes.
166 In July 2020 LUL commissioned an internal review to examine the interfaces of
LUL’s infrastructure with the national rail network and third parties. One element
of this review was to examine existing operational and safety risks and the
appropriateness of existing risk controls. The findings and recommendations of
the review were agreed at an LUL executive leadership team meeting on 7 April
2021. Actions arising from the review included:
• setting a clear communications framework between LUL and other duty holders
regarding the different disciplines and levels at which they occur
• establishing a proportionate assurance regime between LUL and other duty
holders where LUL is reliant on the risk controls of other organisations.

Report 04/2021 51 July 2021

Chalfont & Latimer
 Actions reported that address factors which otherwise
Actions reported that address factors which otherwise would have resulted in a RAIB recommendation

would have resulted in a RAIB recommendation

167 RSSB stated that it is currently in the process of starting to rebuild the safety risk
model and that it is likely a figure similar to that obtained in 2018 (paragraph 133)
will be available from the model once work is completed in March 2022.

Report 04/2021 52 July 2021

Chalfont & Latimer
Recommendations and learning point

Recommendations and learning point

Recommendations
168 The following recommendations are made:26

1 The intent of this recommendation is to reduce the risks arising from

human performance by improving Chiltern Railways’ management of
drivers.
Chiltern Railways should review its driver management processes and
introduce improved processes based on the review findings. The review
should include consideration of:
• providing drivers with adequate training and assessment of tripcock
reset procedures on both Network Rail and London Underground
infrastructure
• identifying conditions such as sleep apnoea during periodic medical
examinations
• sharing the key findings of the route risk assessment process with
drivers and driver managers
• adopting ORR fatigue guidance when designing driver rosters
• how to promote good quality working relationships within the driver
management function
• resourcing, training and ongoing support for those managing drivers
• periodic assessment and retraining in assessment techniques for staff
undertaking competence assessments
• providing guidance on driver assessment methods, frequency, duration
and time of day, which covers:
• an appropriate range of routine and unusual activities on both
London Underground and Network Rail infrastructure; and
• the identification of situations such as loss of attention due to fatigue
and/or other causes.

26
Those identified in the recommendations have a general and ongoing obligation to comply with health and safety
legislation, and need to take these recommendations into account in ensuring the safety of their employees and
others.
Additionally, for the purposes of regulation 12(1) of the Railways (Accident Investigation and Reporting) Regulations
2005, these recommendations are addressed to the Office of Rail and Road (ORR) to enable it to carry out its
duties under regulation 12(2) to:
(a) ensure that recommendations are duly considered and where appropriate acted upon; and
(b) report back to RAIB details of any implementation measures, or the reasons why no implementation measures
are being taken.
Copies of both the regulations and the accompanying guidance notes (paragraphs 200 to 203) can be found on
RAIB’s website www.gov.uk/raib.

Report 04/2021 53 July 2021

Chalfont & Latimer
Recommendations and learning point

• how best to highlight important information in operational documents to

draw drivers’ attention to rules that are critical to safe train operation.
(paragraphs 154a, 154b, 154c, 155, 156b and 156c)

2 This recommendation is intended to improve the understanding and

management of risk at the interface between the national rail network
and London Underground operations.
Chiltern Railways and London Underground Ltd should jointly
establish an effective process for the management of safety at the
interfaces between their respective operations. This should include
further assessment of the risk associated with operation of Chiltern
Railways trains on London Underground Ltd’s infrastructure and
the implementation of any further risk controls deemed necessary
(paragraph 156a).
This recommendation may also apply to other passenger and
freight train operators working onto London Underground Ltd
infrastructure.

3 The intent of this recommendation is to reduce the likelihood of a

collision with another train due to a driver resetting tripcock equipment
and proceeding without authority.
Chiltern Railways and London Underground Ltd (LUL) should jointly
review the design of train protection equipment with the objective of
reducing the risk associated with resetting of train protection equipment
after activation due to a SPAD on LUL infrastructure. The review should
consider:
• ways of discouraging the immediate resetting of train protection
equipment following its activation (known as ‘reset and go’)
• the need for limiting the speed of train movements after train protection
equipment has been activated (similar to SCAT); and
• ways of minimising unnecessary brake activations on non-LUL lines.
The review should take into account any planned upgrades of
signalling equipment on LUL lines. Any additional measures found to
be justified should be implemented in accordance with a timebound
plan agreed between Chiltern Railways and London Underground Ltd
(paragraph 154b).
This recommendation may also apply to other passenger and
freight train operators working onto London Underground Ltd
infrastructure.

Report 04/2021 54 July 2021

Chalfont & Latimer
Learning point

Recommendations and learning point

169 RAIB has identified the following important learning point:27

1 This incident demonstrates the importance of organisations checking

that periodic medical examinations include consideration of sleep
disorders when assessing the medical fitness of safety critical workers
(paragraph 154a).

27
‘Learning points’ are intended to disseminate safety learning that is not covered by a recommendation. They are
included in a report when RAIB wishes to reinforce the importance of compliance with existing safety arrangements
(where RAIB has not identified management issues that justify a recommendation) and the consequences of failing
to do so. They also record good practice and actions already taken by industry bodies that may have a wider
application.

Report 04/2021 55 July 2021

Chalfont & Latimer
 Appendices
Appendices

Appendix A - Glossary of abbreviations and acronyms

ATP Automatic Train Protection
AWS Automatic Warning System
FFCCTV Forward facing closed-circuit television
ECG Electrocardiogram
EMA Emergency Measures Agreement
GSM-R Global System for Mobile Communications – Railways
LUL London Underground Ltd
ORR Office of Rail and Road
OTDR On-train data recorder
RAIB Rail Accident Investigation Branch
RSSB Trading name of Rail Safety and Standards Board
SCAT Speed Control After Trip
SPAD Signal Passed at Danger
TPWS Train Protection and Warning System

Report 04/2021 56 July 2021

Chalfont & Latimer
Appendix B - Investigation details

Appendices
RAIB used the following sources of evidence in this investigation:
• information provided by witnesses
• information taken from the train’s on-train data recorder (OTDR)
• closed-circuit television (CCTV) recordings taken from the Chiltern Railways train
• site photographs and measurements
• weather reports and observations at the site
• voice communication recordings
• mobile communication data
• medical records
• electronic data related to the movement of the trains involved
• documentation relating to Chiltern Railways’ competency management system
• safety management documentation relating to managing the risk of collisions
between trains on LUL infrastructure
• documents relating to class 165 refurbishment
• signalling system design records
• rail industry standards
• (national railway) Rule Book modules
• Chiltern Railways’ rules and operating instructions
• London Underground Ltd’s rules
• a review of previous RAIB investigations that had relevance to this accident.

Report 04/2021 57 July 2021

Chalfont & Latimer
 This page is intentionally left blank

Report 04/2021 58 July 2021

Chalfont & Latimer
This report is published by the Rail Accident Investigation Branch,
Department for Transport.
© Crown copyright 2021
Any enquiries about this publication should be sent to:
RAIB Email: [email protected]
The Wharf Telephone: 01332 253300
Stores Road Website: www.gov.uk/raib
Derby UK
DE21 4BA