The Railway Passenger Safety Site

This site is dedicated to enhancing safety for passengers on Britain's railway trains. It has been inspired (if that is the right word) by the terrible accidents at Southall and Ladbroke Grove, near Paddington.

If you want to help campaign for better safety then please give your views on the Rail Safety Forum and join the Safety on Trains Action Group (STAG).


Seven people died at Southall, west London, when a Great Western High Speed Train (HST - also known as InterCity 125) ploughed into a train of empty stone hoppers which was crossing Southall Crash Photofrom the down relief line to Southall yard across the up and down main lines. The HST driver had failed to stop at a red signal protecting the crossing. The Automatic Warning System (AWS) on the HST was not working before the train started its journey. The Automatic Train Protection (ATP) was switched off - although it was operable and the driver had been trained to use it. There was a reluctance to use ATP on journeys that began where there was no ATP installed ion the track because it took longer to put in details of the train than was allowed for a station stop (typically about two minutes). The driver stated that he had been packing his bag immediately before the crash. The proceedings of the Public Inquiry into the Southall crash can be found at The public inquiry was delayed while Great Western Trains (the train operator) and the driver was prosecuted for corporate manslaughter. This case collapsed, Great Western Trains was however fined a record £1.5 for offences under safety legislation.

Ladbroke Grove, Paddington

At Ladbroke Grove, a Great Western HST collided head on with a Thames Turbo 3 car diesel local train. The front car of Ladbroke Grove Crash Photothe Turbo was destroyed and the front coach ("H") of the HST was burnt out. Around 30 people were killed and many injured. Immediate investigations following the crash showed that the signal (signal SN109) protecting the junction of the line (Line 3), on which the Turbo was routed following its departure from Paddington Platform 9, with the Up main line was red. The Thames Turbo had apparently passed the signal at red - a SPAD. The HSE investigation stated that it regarded the failure of the train to stop at the signal as a "System Failure" rather than purely driver error. A diagram of the track layout where the accident occurred can be found at The front coach of the Thames Turbo was destroyed in the impact and the middle coach over-turned. The front coach of the HST, coach "H", was destroyed by fire. There is a  Paddington FAQ page

I wrote an account of my experiences during and after the crash . My daughter also wrote a poem which was published in the Newbury Weekly News.

The Cullen Inquiry into the Ladbroke Grove crash is underway. Its website, including transcripts of evidence updated daily, is at .

The Southall and Paddington accidents have one thing in common with other recent crashes at Watford, north London and Winsford in Cheshire. One of the trains involved passed a signal displaying red - a SPAD.

Accident at Watford, 1996

A North London Railways (now called Silverlink) passenger train passed a signal at danger (SPAD) and ran through points and crashed into an empty train. One passenger was killed and 27 injured.

The HSE found that the primary cause of the accident was that the driver of the North London Railways (NLR) passenger train did not react correctly to two signals set at caution - he should have slowed down and prepared to stop. When he saw the following signal, which was red, and applied the brakes the train was travelling at about 110 kph (68 mph). The train eventually stopped 203m (222 yards) past the signal and across the junction with another line. An empty NLR coaching stock train, approaching at 80 kph (50 mph) on this line, was unable to avoid colliding with the stationary passenger train.

It was found that the distance from the signal to the junction, the overlap, was less than required by the guidelines.

Rail Safety in Great Britain

So how safe is rail travel in the United Kingdom.? It is still by far the safest form of surface transport. The Chief Inspector of Railways has observed, in a paper he presented to the Institute of Electrical Engineers, that the total number of passengers killed on the railway from the time they were introduced to the present day (a period of 170 years or so) is less than the number of people killed in traffic accidents every year.

The following passenger casualty rates by transport mode are given in the 1997 Edition of Transport Statistics Great Britain. The average rates for ‘Killed and Seriously Injured’ per billion passenger kilometres during 1986-95 were:

Bus or coach
Two wheeled motor vehicle
Pedal cycle

On the basis of the last ten years, the risk of being killed or seriously injured when travelling by car is fifteen times greater than travelling by rail. On the basis of the most recent period, this has increased to twenty times greater.

So rail in the UK is far safer than other forms of surface transport (and much, much safer, than walking alongside a road), However, it is not as safe as modern railways elsewhere in Europe and in Japan. Air travel is as safe as it is because government aviation authorities have insisted that safety measures are implemented. Rail passengers deserve equal consideration!

The Problem

There are two aspects to rail passenger safety: primary safety and secondary safety.

Primary Safety

Primary safety is concerned with the prevention of accidents. Most recent accidents have been as a result of a train being driven past a signal at danger  (SPAD). This can happen for a variety of reasons and often a train stops beyond a red signal but in the safety overlap distance before the next block begins. Most trains and lines are fitted with a system called Automatic warning System (AWS). This warns the driver if the signal he is approaching is not clear (green). Unfortunately, because of the way it works, the system can give one of only two indications - a bell ring for clear and a hoot for not clear. Often on busy lines, a train may pass a long series of yellow or double yellow signals with the driver having to cancel each warning. There is a danger that the cancelling becomes "automatic" without the driver consciously being aware of it.

The implications of a SPAD are far worse where the signal is protecting a junction or crossing (as at Southall), or a section of bi-directional track where trains can run in both directions (as at Paddington). Short sections of bi-directional working also occur at single-lead junctions and ladder crossovers.

Secondary Safety

Secondary safety is concerned with preventing injuries to passengers on trains involved in accidents and allowing them to escape from crashed trains safely.

Secondary safety concerns

Recent accidents have raised concerns regarding the following

Train driving

There are two aspects of train driving that give rise to safety concerns:

A Rail Passengers' Safety Manifesto

The "Problems" section above explains the safety issues. How can these problems be minimised to make rail travel safer.

Primary safety - stopping accidents from happening

Secondary safety - preventing injuries and escaping from a crash


Click here for the Railway Passenger Safety FAQs.

Safe Trains Action Group - STAG

This action group has been formed to campaign for improvements in safety on Britain's railways. It can be contacted at:

PO Box 4894

Tel/Fax: 0118 926 8730



Why not join?

Have your say:

Post your own views, or see what others have to say, on the Rail Safety Forum.

Alternatively, email your comments or questions.

Visits since 10th Nov 1999

Page revised 29th August 2001


This glossary is intended to help the layman understand the terminology used in reports on rail safety issues. More detailed information can be found on railway terminology on  Railway Technical Web Pages (this includes descriptions of signalling systems, ATP and TPWS).

A basic description of train protection systems, including AWS, ATP and TPWS, can be found at:

Thanks are due to Geoff Mayo for correcting the information on ARS and SSI.


Automatic Routesetting System. A computer system in a modern signalling centre that requests the SSI system to set a train routeaccording to data from the timetable. Routes can also be set manually by the signaller.

Automatic Train Protection (ATP).

ATP is a system involving both equipment on the track which transmits target speeds to trains, and in the cab which displays the speeds and checks that the train is not exceeding them. The speeds are the safe speed at the entry to a block of track.

Advantages of ATP

Disadvantages of ATP

Automatic Warning System (AWS).

AWS is provided to give an audible warning and a visual reminder of the aspect displayed by signal. If the signal being approached is clear (green) a bell sounds in the cab and the visual reminder is cleared. If the signal is not clear - red, yellow (next signal is red) or double yellow (next signal is yellow) - a hooter or buzzer sounds in the cab and the visual indicator is set to indicate that the last signal passed was not clear. Apparatus under a ramp between the tracks contains a permanent magnet and an electromagnet. If the electromagnet is not energised, it indicates that the signal being approached is not clear. The system, in common with most rail equipment, thus "fails safe". The electromagnet can only give two indications, hence the main limitation of AWS - it gives the same warning for red as for yellow or double-yellow signals.

Block Working

Most railway signalling in the UK is based on block working. The railway line in each direction is divided up into sections called blocks. Each block is protected by a signal. A train can only enter a block if that block is clear, i.e. there is not another train in the block and points are set correctly for the route of the train. The signal protecting a block is usually about 300 yards )288 metres) before the block. This is called the overlap and is provided in case a train over-shoots the signal at red (a SPAD).

Cab Secure Radio

A radio system fitted to trains operated as Driver Only Operation so that drivers can communicate with signallers. The system is designed so that the signaller can be sure that he actually is talking to the driver and not to an impostor.

Catch points

Points used to divert a run-away wagon or train into a sand drag or to intentionally derail it. Provided in the days before continuous brakes on freight trains and arranged so that a vehicle travelling in the wrong direction (probably a run-away down an incline) will be diverted off the line. Catch points have sometimes caused accidents when a train has been running "wrong line" because of engineering work or to pass a broken-down train.

Centralised Door Locking

The doors are locked by the guard or senior conductor immediately preceding departure. Doors cannot be opened until the guard or senior conductor unlocks them. In the vent of emergency, individual doors can be unlocked by breaking a pane of glass above the door and pulling a release handle.

Continuous brakes

Brakes provided on all coaches or wagons of a train and controlled in such a way that a division of the train will cause both halves to stop. In the UK continuous brakes were, until about twenty years ago, operated using a pipe containing a vacuum. Modern freight trains and locomotive-hauled passenger trains (including HSTs) have brakes operated using a pipe containing air under pressure. The vacuum or air pressure effectively hold the brakes off. If there is a loss of vacuum or pressure, the brakes come on. Modern diesel or electric multiple-unit trains have brakes controlled by electrical circuits. If the circuit is broken, the brakes come. In all these systems, if there is a fault or the train divides, the brakes will come on - the systems are fail-safe.


See Driver Only Operation

Driver Only Operation

Trains are staffed only by a driver (there is often also a conductor for selling tickets and revenue protection). The driver has the responsibilities for checking that it is safe to open or shut the train doors and for ensuring that it is safe to start the train from a station. Driver Only Operation is only permitted on trains and lines equipped with Cab Secure Radio.

Facing points

Points that can divert a train from the "main line" when it is travelling in the normal direction for the line on which it is running. Junctions use facing points. Compare with trailing points.


Railway equipment in Britain is designed so that if it fails then safety is maintained. If a signal fails then it is designed to show a red aspect. Circuits are installed to ensure that an aspect is "proved lit", if not then the previous signal will display the aspect instead. Train brakes are operated by air. The system effectively causes air pressure to hold the brakes off. If air pressure is lost then the brakes come on. It is possible that a signal will fail unsafe. This rare event is called a wrong-side failure. The Clapham disaster in 1988 was a wrong-side failure caused by redundant wiring coming into contact with signalling circuits after work on enhancing the signalling system.


Health and Safety Executive (if which Her Majesty's Inspectorate of Railways is now part)

High Speed Train (HST)

Diesel-electric trains with a designed operating speed of 125 mph. Trains are powered by two Class 43 power cars (locomotives) - one at each end. The trains are made up of seven or eight Mark 3 coaches. The two coaches adjacent to the power cars have a guard's compartment.


Signals and points are interlocked so that a clear signal cannot be set if it is protecting  points which are not correctly set. In the days of manual signal boxes this was done using notched bars in the lever frame housed in the ground floor of the box. In modern power boxes it is done using SSI - electronic logic.

Ladder crossing

Often quadruple track is a arranged as "paired by speed", effectively two set of double tracks side-by-side. When a train is to be transferred from the relief (slow), line to the main (fast) line, (or vice versa) a track has to be crossed. Conventionally this was done using a crossing. Nowadays it is often done by the crossing track joining an opposite direction track for a short distance, using a set of points, and then branching off to the required track using another set of points. The Southall crash happened on a ladder crossing.

Mark 1 Coach

The first design of coach produced by British Railways in about 1950. Regarded as not crash-worthy because they have a body built on top of a separate heavy chassis frame. In many crash situations, one coach rides up against its neighbour and its chassis frame crushes the body of the neighbour. The trains involved in the Clapham disaster of 1988 were based on the Mark 1 design. The HSE has decreed that all Mark 1 trains are withdrawn from service by 2004.

Many trains on the electrified lines around London are based on the Mark 1 design.

Mark 2 Coach

Second generation of British Railways designed coach. Regarded as a strong design. Most are now fitted with Central Door Locking.

Mark 2 coaches are used by Anglia Railways, some Virgin Cross Country services and on many other locomotive-hauled trains.

Mark 3 Coach

Mark 3 coaches are regarded as the strongest and most crash-worthy railway coach in the world. Some have been involved in serious accidents where not one passenger has been seriously injured. Following over 300 incidents of passengers falling from trains, all coaches are now fitted with centralised door locking. The doors are locked by the guard or senior conductor immediately preceding departure.

HSTs are made up of Mark 3 coaches as are the Virgin West Coast trains between London Euston, Birmingham, Wolverhampton, Stoke-on-Trent, Manchester, Liverpool, Preston and Glasgow.

Semaphore signal

The kind of signal in use in the UK before colour light signalling (there are still many in use on less used lines). The signal consists of an arm projecting from a post. Danger or caution is indicated by the arm being horizontal. A clear signal is indicated by the arm being at an angle of about 45 degrees. There are basically two kinds of semaphore signal - home and distant. The arm of a home signal has a square end and is coloured red with a white vertical stripe; if the arm is horizontal it indicates danger and a train approaching it must stop. A distant signal has a fishtail cutout in its end and is coloured yellow with a black fish-tailed shape black line. A horizontal distant signal arm ("caution"), indicates that an approaching train should be prepared to stop at the next signal. At the post end of semaphore arms there are "spectacle glasses" through which a parafin light shows to indicate the state of the signal at night.

Signal aspects.

Until the 1960s, most lines had semaphore signals. Most now have colour light signals. These can have one, two or three aspects (number of lights). Red means that the next section is not clear, or that points are not set appropriately. A single yellow means prepare to stop at the next signal. Double-yellow means that the next signal is yellow and green means that the next section of line is clear and the next signal is green, double yellow (three aspect signals) or yellow (two aspect signals).

Signal Passed at Danger (SPAD).

In 1998 over 630 signals were passed at danger. The vast majority were passed by a few meters and stopped in the overlap. Most were caused by slippery rail conditions affecting braking. Some were caused by signals changing to red a short time before the train approached it because the signal had failed. Signals, like most railway equipment, is designed to fail-safe, and will display a red aspect if they fail. A few, however, were due to drivers failing to observe the red signal and the previous warning yellow signal.

Single-lead junction.

The conventional way to arrange a double-track junction is with a set of points for each track and a crossing. A train from the branch would first cross the opposite-direction main line before joining the same-direction main line at a set of points. A single lead junction is arranged so that there is a crossing consisting of two points leading onto a single line, Another set of points joins the single line to the double-track branch. A train from the branch will first join the opposite-direction main line, then leave this at a set of points to join the same-direction main line. Although some people suspect that single-lead junctions are provided because to reduce costs, the actual reason is that they make it easier to provide high speed junctions in situations where gradients change.


Solid state interlocking. Commands by the signaller or ARSto set signals and points are interpreted  by microprocessors in a modern power signalling centre. The microprocessors send the commands to signals to display the required aspect and send commands to change points. The signals and points send signals back to the processors to confirm the action was carried out successfully. The processors also perform interlocking logic. Three microprocessors are used to perform the same operation and their results are compared. Two processors have to give the same result for the action to be carried out. One processor can shut itself down if its outputs are different from the other two, the other two can shut the faulty one down likewise. If a further processor fails, then the whole interlocking is shut down (all signals red, all points locked in their last called state).

Thames Turbo.

The marketing name for the diesel multiple unit trains used by Thames Trains. There are two classes, 165 and 166. The class 165s used by Thames Trains are mainly three-car units and have a maximum speed of 90 mph. The class 166 is similar but is double-glazed and air-conditioned. They are fitted with  AWS (as are most British main-line trains) but not with  ATP .

Track Circuits

These are used to detect when a train is in a block section. An electric current is passed down the rail. While the current is flowing, it holds down a relay. When a train enters the section, it short-circuits the current to the other rail. This releases the relay and this indicates the presence of the train to the signalling system. It also often detects broken rails because the circuit is broken. The system is fail-safe because failure of the electricity supply or relay causes a false detection of a train.

Trailing points

Points arranged in such a way that a train has to "set back" (reverse) to be diverted from the line on which they are standing. Sidings are normally accessed via trailing points, as are emergency cross-overs on double lines. They are safer than facing points in the event that a train SPADs the signal protecting them as the train will force over the point blades and continue on the line, reducing the possibility of colliding with another train or de-railing.

Train Protection and Warning System (TPWS)

A recent British development which is currently scheduled to be fitted to most lines in Britain within the next five years. Two sets of two electronic loops are set in the track before signals where a SPAD would be most likely to put a train into risk of being involved in a collision. The loops are energised when the signal is red and emit  electromagnetic fields. When an antenna on the train detects the field emitted by the first loop of a pair it starts an electronic timer. The field emitted by the second loop of the pair stops the timer. The first pair of loops encountered are spaced so that the timer on the train can calculate whether the safe speed for approaching the signal is being exceeded. If it is, the brakes are automatically applied. The second pair of loops are situated closer to the signal and are placed very close together such that the safe speed is effectively zero. TPWS will be used in conjunction with the existing AWS.

Advantages of TPWS

Disadvantages of TPWS, compared to ATP.

Trap points

Points that are inter-connected with another set of points and arranged in such a way that a train SPADding the protecting signal will be derailed or diverted into a sand trap, rather than taking the main points onto a running line where it might collide with another train. These days they are mainly used to protect passenger lines from freight trains coming from sidings or passing loops. Derailing a passenger train, or diverting it into a sand drag, may cause more danger than it prevents.