German Train Crash

[St. Simon]

 

 

Even as a trainee signalling designer, to me that goes against all principles of signalling and interlocking

 

Simon

[PaulRhB]

Ah but it would most probably have prevented it. Apart from bringing a fresh pair of eyes to the situation the Pilotman has to make themselves aware of the token position. In doing that they would have quickly identified the on coming train.

The Pilotman IS the token. When sending trains in, as Ian pointed out, he can send several and only rides the train when the next will be from the other end. The out of section is provided by either the box at the far end telling the pilotman or within a single area the Signalman telling the pilotman it has cleared the section beyond using the track circuits.

Modified block is under scrutiny following this crash and it does have a drawback but the alternative may be trains being stuck for hours on long sections of single line if multiple sections fail at once. The West of England panel for example has 6 sections with 3-4 trains in at once. You therefore would need at least two pilotmen to clear them out if the whole panel fails, which it has twice. Consider the MOM is at one end and another has to be sourced off area and you can be looking at over two hours before you can move a train. The public and media won't accept that or the cost of doubling the line to full TCB so where do you go?

We discussed the latest news at work today and all had the same opinion of why he reacted without following process. As I've said before you can have as many safety protocols as you like but a human can still decide, sometimes with the help of others to override them. Chernobyl is the extreme example.

In Felix's post there is a slight misnomer about UK interlocking. If you cancel a route before the train passes a signal on modern panels the route times out for 2-3 minutes so you cannot move points under a moving train and the occupied tracks lock any points that are under the train.

If the route locks in due to a failure the route locks the points and the only way to move them is taking them on local control at the point motor or the S&T disconnecting it. Those all take a lot of time so the train won't be moving.

If this does ban MBW working over here then there's going to be done hellish delays when there's a serious lightning hit or other failure on a box controlling single line sections.

I can assure you that when done to the process you're attention is very much on the detail and if for whatever reason you rush and ignore the process you will face serious consequences even if there's no other train in there.

[meil]

The Pilotman IS the token. When sending trains in, as Ian pointed out, he can send several and only rides the train when the next will be from the other end. The out of section is provided by either the box at the far end telling the pilotman or within a single area the Signalman telling the pilotman it has cleared the section beyond using the track circuits.

Modified block is under scrutiny following this crash and it does have a drawback but the alternative may be trains being stuck for hours on long sections of single line if multiple sections fail at once. The West of England panel for example has 6 sections with 3-4 trains in at once. You therefore would need at least two pilotmen to clear them out if the whole panel fails, which it has twice. Consider the MOM is at one end and another has to be sourced off area and you can be looking at over two hours before you can move a train. The public and media won't accept that or the cost of doubling the line to full TCB so where do you go?

We discussed the latest news at work today and all had the same opinion of why he reacted without following process. As I've said before you can have as many safety protocols as you like but a human can still decide, sometimes with the help of others to override them. Chernobyl is the extreme example.

In Felix's post there is a slight misnomer about UK interlocking. If you cancel a route before the train passes a signal on modern panels the route times out for 2-3 minutes so you cannot move points under a moving train and the occupied tracks lock any points that are under the train.

If the route locks in due to a failure the route locks the points and the only way to move them is taking them on local control at the point motor or the S&T disconnecting it. Those all take a lot of time so the train won't be moving.

If this does ban MBW working over here then there's going to be done hellish delays when there's a serious lightning hit or other failure on a box controlling single line sections.

I can assure you that when done to the process you're attention is very much on the detail and if for whatever reason you rush and ignore the process you will face serious consequences even if there's no other train in there.

Yes indeed he is the Token but if any tokens are out he either has to take control of it or, if at the other end, instruct the signalman to lock it away securely. It is at that last point , when the signal man says - but it's on the train - that it should have dawned what the problem was!

[PaulRhB]

While I agree the Pilotman should be another well informed check on the process it's not what happened in this case which is why we've compared it to MBW as the closest system.

MBW is a much slower process than pilotman to move trains as it takes time to do properly and trains run at 50mph max. It does however have a big advantage in starting to move trains remotely while the pilotman heads to the area. In many sections MBW is limited to just one train before pilot working must be implemented or a short 1-2 HR period max. The limited period is purely because it needs so many checks and making it a routine by carrying on for hours would be more likely to introduce shortcuts by human nature.

If the pilotman is close we wait and set that up in preference but if it's going to take a long time we will get things moving and step up to pilotworking as soon as possible.

Yesterday's reveal that the operator was playing a game causing a distraction would have lead to him not being fully aware of where things were and the error is in why he didn't take the time to ascertain it after realising trains were delayed but authorised a movement before completing the checks. Now I can guess why as can anyone whose sat down and got engrossed in a book or game to suddenly smell burning toast or the sound of water overflowing. You rush to sort it out, but do you always then think about the where you're going to put the burning toast or how to mop up the water on the way? The training is about reacting with the right response not necessarily the problem itself first.

The question of what was the last train into section and where is it now? In MBW I always tell the driver where the previous train is as part of the first requirement of telling the driver why MBW is necessary. It sets up a nice steady process that then goes on to confirm that the route is set before giving the details listed on the form.

I was training someone on their first job as pilotman last week and said always just read the form exactly to the driver, it's a nice logical progression that reads well so never edit it. If there's nothing to put there, eg arrangements for level crossings, you just read it and then say "there are none". Same with MBW, you set the route, check it, and then as you read the form you point to the things on the panel and check a third time. It's a bit like the system the Japanese use pointing and saying the signals it focuses you on it.

Sadly the news about playing a game suggests our suspicion of panic leading to rushing overcoming ok it's gone wrong now stand back and figure the best way to sort it out.

A game, a newspaper, cooking dinner or an urgent toilet break can all present you with a sudden realisation that trains have stopped as a routes not set.

[jjb1970]

Something to keep in mind is that there is a world of difference between a mistake and purposefully setting out to defeat interlocks and protection devices. If you really want to, a suitably knowledgeable person can probably figure out how to get around most safety systems (although on modern systems you need to be very technically capable in several disciplines) however that is not a mistake or error but malicious intent. What safety systems will do is prevent individuals making human errors which escalate into tragedies most of the time, although it should also be recognised that no system is infallible. If there are multiple failures and a sequence of events which makes all the holes in the proverbial swiss cheese line up then that is one thing (and it certainly does not mean you don't learn from it and look at designing the holes out), a system which allows an individual to make a catastrophic error which results in multiple fatalities because that individuals judgement is in effect the safety barrier is something else entirely.

The computer game angle really raises all sorts of questions as it indicates seriously flawed behaviours if it is true. And at the moment it is only a story in the media.

[meil]

Giving this some further thought as described the German system has a fundamental design flaw. It is unable to deal with a cancelled train situation safely. The advance treadle locks the system until depressed. If it is not depressed the system remains locked and the only way forward is to over ride the safety of the system which includes not having to have the train accepted at the other end of the section. Surely the safe way would be to provide a train cancelled function that would return the system to normal but vitally require the train acceptance procedure to be repeated? It is this flaw that has enabled the signalman to override the system for a purpose it was not intended for.

[John M]

Under the French system, should the signaller be unable to clear the signal (perhaps due to a track circuit not clearing), the driver is stopped and issued with a FREP. This is a numbered form, with a copy in the cab, and one in the 'box. The signaller fills out the form, at the same time reading it out to the driver, who enters the details on his/her form. The driver then reads these details back, and both parties agree time and date. Should there be a possible obstruction or anomaly with the track, the driver will also be given a verbal 'Marche a vue' (proceed at a such a speed that the train can stop short of any obstruction) or a formal 'Marche Prudente', where the driver is given a maximum speed by the signaller. These procedures, being lengthy, mean that people have time to think about their actions

The French system of the driver and signaller completing a written authority to pass a signal at danger appears similar in principal to track warrant control (TWC) used in unsignalled or dark territory used on railways with American operating systems. One of the safe guards of TWC is that warrants are issued over an open radio system so that the driver of an opposing train can intervene if he realises the dispatcher or controller is about to issue a warrant for the same track section.

 

I understand that a pilotman is required too establish that a section is clear in order to establish pilot working. I am not sure how this is achieved with power signalling, with mechanical signalling I understand that the pilot man was required to obtain authority from the signal man at both ends of the section and in certain circumstances physically walk the section to ensure the line was clear of obstructions.

 

Is the apparent fundament difference in signalling practice between the UK, Germany related to cultural differences between societies around the concept of risk, human error and personal responsibility and differing justice systems

 

When we look at accident causation in Robins model countries we tend to focus more on the system and the organisation as opposed to the actions of an individual worker while the reports of the Spanish TGV accident and German crash indicate that investigators in mainland Europe focus on the individual.

[PaulRhB]

I understand that a pilotman is required too establish that a section is clear in order to establish pilot working. I am not sure how this is achieved with power signalling, with mechanical signalling I understand that the pilot man was required to obtain authority from the signal man at both ends of the section and in certain circumstances physically walk the section to ensure the line was clear

The pilotman agrees with the Signalman at each end what the last train was and confirms its clear. In a modern power box that controls both ends you still will agree that and confirm details of when it left the section. There are often at least two Signalmen on duty in the larger panels who will have cross checked each other too.

The pilotman wouldn't walk the section these days as they are miles long and if anyone's unsure whether a train is in there or not you don't run. We have various systems we can replay or check times the train describer feed to watch trains in and out so you can take five minutes to replay it and confirm what the last train was and when or if it left the section.

The trust system also would provide a list of all trains and their in and out times. It's all about not rushing it and using the tools at your disposal. It may take five minutes but then you are sure.

[Jeff Smith]

Getting back to basics and acknowledging that I know very little about signalling:-

1. was there information available to the signalman that the single line section was occupied and what direction the train was going?

2. if so, did the signalling interlocking system prevent normal despatch of the waiting train into an occupied section?

3. if so, he must have made a conscious decision to override it by whatever means the system allows?

His decision process seems to be faulty despite the built-in safety elements.  This seems to be a human factors situation that maybe prevails in routine relatively repetitive tasks and it could be argued is aggravated by too much automation diluting the thinking process.....the same has been said about modern commercial aircraft operation where a sudden unforeseen event can result in disaster.

[phil-b259]

Getting back to basics and acknowledging that I know very little about signalling:-

1. was there information available to the signalman that the single line section was occupied and what direction the train was going?

2. if so, did the signalling interlocking system prevent normal despatch of the waiting train into an occupied section?

3. if so, he must have made a conscious decision to override it by whatever means the system allows?

His decision process seems to be faulty despite the built-in safety elements.  This seems to be a human factors situation that maybe prevails in routine relatively repetitive tasks and it could be argued is aggravated by too much automation diluting the thinking process.....the same has been said about modern commercial aircraft operation where a sudden unforeseen event can result in disaster.

 

(1) Not sure - but the 'system' certainly saw that a train was in section and responded correctly.

(2) Yes the signalling system worked as designed and prevented the dispatch of a train into an already occupied section.

(3) Yes the signalman DID override the system - through what I, and many others regard as a dangerous 'back door' built into all German railway signalling which simply does not exist in the UK.

 

In summary, the signalman was distracted (playing a game on his mobile) and wasn't paying proper attention to his duties. Thus when he set the route and the signal didn't clear (because there was already a train in section) he assumed it was because of a trivial fault so he operated a override - which basically gave a visual indication to the driver sat at the signal protecting entry to the (occupied) single line section that the driver should ignore the red aspect and proceed at linespeed.

 

Note it has been suggested that the points giving access to the single line were of a type which allows them to be trailed through and as such the signalman didn't have to operate any points nor did the driver of the train consider it unusual they were set against him.

[The Stationmaster]

Getting back to basics and acknowledging that I know very little about signalling:-

1. was there information available to the signalman that the single line section was occupied and what direction the train was going?

2. if so, did the signalling interlocking system prevent normal despatch of the waiting train into an occupied section?

3. if so, he must have made a conscious decision to override it by whatever means the system allows?

His decision process seems to be faulty despite the built-in safety elements.  This seems to be a human factors situation that maybe prevails in routine relatively repetitive tasks and it could be argued is aggravated by too much automation diluting the thinking process.....the same has been said about modern commercial aircraft operation where a sudden unforeseen event can result in disaster.

 

1. Yes (unless there was an indication fault on his controls or there was a train detection fault in the section - neither has been mentioned).

2. Yes, that appears to be why the Ersatz Signal was used.

3. It is clear, on his own admission, that he did make such a decision.

 

The event should not, in everyday reality, be something which is unforeseen - the inability to clear a running signal should immediately ring an alarm bell in any Signalman's head causing him to ask why he can't clear it.  He should then - from his experience and training alone - go through every one of the potential reasons which prevent that signal from clearing taking particular care on a single line section of course.

[Jeff Smith]

phil-b259 and The Stationmaster - thank you for responding, much as I suspected and not very encouraging for German rail safety - in engineering terms 'a single point failure'.

 

The proliferation of smart mobile phones is all too evident in society and I see working people (ie those on duty) consumed by checking them all the time and being distracted from what they are supposed to be doing..... case in point, airport security (TSA) who are supposed to be guarding doors etc from passenger re-entry (admittedly a fairly boring task) head-down checking their phones....

[jjb1970]

If the signalman really was distracted by a mobile phone game whilst operating the system in a way which over rode the safety interlock then I find it hard to have much sympathy for the signalman. I can understand that people make mistakes and if a safety system is designed to allow safety protection to be over ridden so easily then to me that is more of an indictment of the system design as it is of an individual. I can also understand that people get distracted by smartphones. But to be playing with a smart phone whilst over riding interlocks on a safety critical system beggars belief.

Either way, if a system is this vulnerable to maloperation then it is just not fit for purpose in todays world.

[Coryton]

Either way, if a system is this vulnerable to maloperation then it is just not fit for purpose in todays world.

 

Perhaps. But the safety record of railways in Germany is pretty good - so if there really is such a strong reliance on a single person carrying out procedures correctly, it appears to work (surprisingly?) well. Though not well enough in this case.

[PaulRhB]

Yes generally it is very safe. A system that eliminates every possible human failing would be so lengthy and cumbersome that it would make moving trains very very slow.

Distraction by whatever happens but it's about not panicking to try and avoid anyone noticing and following the process that they are trained to do. If you ignore or shortcut the training then it's likely to go badly wrong, whether it's trains, planes, buses or boats. There are many systems in all those industries that rely on one person to do the checks and ask for a second check. It came out early on in the media he should have contacted a manager but did it without authorisation so it suggests he shortcut the check there which is identical to that used for MBW here.

[jjb1970]

Nobody is under any illusions that risk can be eliminated. The only way you can eliminate the risk of train crashes is to not run trains. What you can do is minimise risk and establish risk control measures designed to prevent crashes, with secondary risk control measures designed to mitigate the effects of a crash. Most legal jurisdictions recognise that the costs of risk control should not be grossly disproportionate to the risk reduction and safety benefits and require something equivalent to what in the UK system is called ALARP (as low as reasonably practicable. However, it is also true that risks which are reasonably foreseeable should be eliminated or reduced to a tolerable level. There is no way that this incident could not be considered reasonably foreseeable. Therefore it should have been mitigated. Procedural controls should be the final line of defence (in technical risk management a procedure is equivalent to PPE in occupational health and safety, it is the last line of defence) and I'd consider that it is for the network operator to demonstrate why they considered a system so vulnerable to maloperation to be acceptable. In this case the argument is not an argument over crunching the numbers in a quantified analysis, I believe the death toll is 12 with many more injured, and injuries in this context is a bit more than a cut finger or bruise. There is no reason why engineering controls or more robust procedural controls could not be implemented with little or no impact to operability of the system, to argue that the system could not be improved to reduce the clear risk of collision and that this improvement could be done in a way which is conducive to efficient operation is a sign of institutional inertia.

[david.hill64]

Nobody is under any illusions that risk can be eliminated. The only way you can eliminate the risk of train crashes is to not run trains. What you can do is minimise risk and establish risk control measures designed to prevent crashes, with secondary risk control measures designed to mitigate the effects of a crash. Most legal jurisdictions recognise that the costs of risk control should not be grossly disproportionate to the risk reduction and safety benefits and require something equivalent to what in the UK system is called ALARP (as low as reasonably practicable. However, it is also true that risks which are reasonably foreseeable should be eliminated or reduced to a tolerable level. There is no way that this incident could not be considered reasonably foreseeable. Therefore it should have been mitigated. Procedural controls should be the final line of defence (in technical risk management a procedure is equivalent to PPE in occupational health and safety, it is the last line of defence) and I'd consider that it is for the network operator to demonstrate why they considered a system so vulnerable to maloperation to be acceptable. In this case the argument is not an argument over crunching the numbers in a quantified analysis, I believe the death toll is 12 with many more injured, and injuries in this context is a bit more than a cut finger or bruise. There is no reason why engineering controls or more robust procedural controls could not be implemented with little or no impact to operability of the system, to argue that the system could not be improved to reduce the clear risk of collision and that this improvement could be done in a way which is conducive to efficient operation is a sign of institutional inertia.

Unless it is changed since I was actively involved, Germany doesn't use ALARP, but uses the principle of Minimum Endogenous Mortality. Basically you risk assess a situation and if the risk is higher than the prescribed level, you have to fix it, whatever the cost. If the risk is perceived as being less than the prescribed level, you need do nothing (even if the risk is not ALARP). All will out in due course, but I assume that eminent German engineers assessed that the use of the Ersatz signal met the risk level and was therefore OK.

 

My experience of working with German railway engineers is that they look for compliance with standards alone. If it meets the applicable standards then it must be OK without doing a risk assessment as well.

 

I have worked in several overseas projects where the prospect of working with UK safety professionals resulted in a sharp intake of corporate breath as UK was deemed to be too 'nit-picky'. I am sure that the railway professionals who add valuable comments here would be put in this category by many. I state this as a personal observation, not to make any claim that UK is better (or that the commentators here are over teh top).

[phil-b259]

I still struggle to  see how any organisation / country can seriously consider itself to have a good safety culture when it deliberately designs into its signalling system a signal that specifically tells drivers "We can't set this signal to a proceed aspect - but that doesn't mater, you carry on as normal"

 

However you look at it, the Ersatz signal quite simply has no place on a properly risk assessed railway system.

 

If a signal cannot be cleared the system is protecting trains from harm (by not letting them move). no ifs, no buts and no amount of Germanic reasoning can change that fact.

 

If it is necessary to overide the system, it needs to be done cautiously and preferably with as many break points in system as possible. For example had the signaller actually spoken to the driver directly to authorise him by (as is necessary in the UK and 'NF' prefixed signals in France) the driver may have asked the signaller about the train he usually waits for, or detected the signaller wasn't concentrating or........

[The Stationmaster]

I still struggle to  see how any organisation / country can seriously consider itself to have a good safety culture when it deliberately designs into its signalling system a signal that specifically tells drivers "We can't set this signal to a proceed aspect - but that doesn't mater, you carry on as normal"

 

However you look at it, the Ersatz signal quite simply has no place on a properly risk assessed railway system.

 

If a signal cannot be cleared the system is protecting trains from harm (by not letting them move). no ifs, no buts and no amount of Germanic reasoning can change that fact.

 

If it is necessary to overide the system, it needs to be done cautiously and preferably with as many break points in system as possible. For example had the signaller actually spoken to the driver directly to authorise him by (as is necessary in the UK and 'NF' prefixed signals in France) the driver may have asked the signaller about the train he usually waits for, or detected the signaller wasn't concentrating or........

 

I don't necessarily think there is anything wrong with the basic principle (after all we now use something similar in Britain but only in certain situations) but what strikes me as very wrong is the apparent 'disregard' of wider factors controlling its use.  

 

In other words it is very much the situation David has explained in his post above - in Britain we would nowadays carefully risk assess the circumstances in which such a signal would be used (in the past those of experience would have effectively done the same but in a less formal way).  Thus we would hardly even think of using it on a signal controlling the entrance to a single line whereas the German system of assessment works in a different way.

[PaulRhB]

And all MBW locations are being reassessed directly as a result of this to see if it changes the ranking. Our railway often gets criticised but I think it's showing that we look at the wider picture including globally when it's relevant.

I had a discussion about it with a friend who's a manager on a different part of the system and although familiar with it doesn't actually use it. It makes for a very interesting discussion and both of us held a slightly different view but based on the same factor. It's one of those things that once trained in the culture and because it isn't that rare you feel is a big responsibility but that's what makes it stand out and drives the method.

My main interest in their investigation is in how this was trained as it seems to have gone quickly to the shortcut rather than try all possibilities first.

[jjb1970]

The German liking for standards noted by David Hill and for procedures noted by others earlier is well observed.

At the risk of sounding like a cynical old fart I tend to put standards in the same category as Bismarck's famous comment that enthusiasts of sausages and the law should never look at how either is made. I've been a member of several ISO technical committees and working groups over the years (and am still on two working groups) as well as working with the EC and IMO and although in most respects it is a miracles the systems work as well as they do I tend to see most of these documents as being a prescriptive element that forms a part of a broader risk analysis process and not in themselves evidence of a safe system or design. Especially when so few ever read the standards and so read much more into them than they should and when many manufacturers and operators apply a rather tendentious interpretation of them. We've seen a good example with automotive emissions in recent months. The VW saga has nothing to do with emissions standards (although they've been very successful in spinning things to make the standards front and centre rather than their illegal use of defeat devices) but what it has done is highlight something that everybody connected with emissions certification has always known - that emissions standards and certification have no relevance to real emissions.

Germany also places much more importance on procedures than the UK and countries with a similar ethos to the UK. The idea that once a procedure is signed off then responsibility sits with those who have to implement it would be seen as inadequate at best in many countries as there are all sorts of wider variables related to corporate cultures, resources, training and competence etc to consider. That is not to absolve individuals of their own responsibility, but rather to recognise that stopping at declaring "we had a procedure, he/she didn't follow it therefore its their fault" is at best complacent, at worst a complete distortion of reality. That was the aspect of German safety culture in electricity generation that struck me as being really backwards. To me it is just not acceptable (and hasn't been for many years) to accept the obvious that human beings are fallible and make mistakes even where they have the best of intentions and then also make safety systems so reliant on something which is recognised as being so prone to error.

[phil-b259]

(after all we now use something similar in Britain but only in certain situations)

 

No we don't - if you mean POSA signals they still require a driver to proceed at caution when they are operated (where as, if I understand it correctly the Ersatz signal gives permission to proceed at linespeed) - plus POSAs cannot be cleared unless the route is proved to be set and all points locked. they are also not installed at the entry to single lines either as far as I know - for very good reasons. A POSA signal merely guarantees that a valid route exists (i.e. two trains in conflicting routes cannot be given a POSA at the same time) and all points are set - it specifically  says nothing about whether there is a train already in the section ahead and as with shunt / call on signals the driver MUST proceed on the basis that they can stop within the distance they can see with their own eyes.

 

While the Ersatz signal may have been developed with the best of intentions - that intention (to not delay services to much under fault conditions) means that the consequences if it is cleared in error are far worse than the methods we use in the UK, where in most cases passing a signal at danger can only be done at caution and only after a full verbal discussion between the driver and signaller. As such the overall risk of passengers being killed or injured is surely lower under the UK / French system.

[phil-b259]

My main interest in their investigation is in how this was trained as it seems to have gone quickly to the shortcut rather than try all possibilities first.

 

And whats more that shortcut ("oh the signalling has failed but its nothing serious" attitude "so I will override it") is officially provided for in the form of the Ersatz signal. The nearest equivalent scenario I can come up with in a UK environment is a signalman in a mechanical box unable to clear a signal so he simply sticks a green flag by the signal concerned and wanders off with the driver accelerating away to linespeed upon seeing it.

[Coryton]

entry to single lines either as far as I know - for very good reasons. A POSA signal merely guarantees that a valid route exists (i.e. two trains in conflicting routes cannot be given a POSA at the same time) and all points are set - it specifically  says nothing about whether there is a train already in the section ahead and as with shunt / call

 

And the fact that conflicting POSAs can't be given presumably makes them in one sense safer than the signaller talking a driver past a red signal, as - in principle - drivers on conflicting routes could inadvertently both be given permission to proceed.

[The Stationmaster]

No we don't - if you mean POSA signals they still require a driver to proceed at caution when they are operated (where as, if I understand it correctly the Ersatz signal gives permission to proceed at linespeed) - plus POSAs cannot be cleared unless the route is proved to be set and all points locked. they are also not installed at the entry to single lines either as far as I know - for very good reasons. A POSA signal merely guarantees that a valid route exists (i.e. two trains in conflicting routes cannot be given a POSA at the same time) and all points are set - it specifically  says nothing about whether there is a train already in the section ahead and as with shunt / call on signals the driver MUST proceed on the basis that they can stop within the distance they can see with their own eyes.

 

While the Ersatz signal may have been developed with the best of intentions - that intention (to not delay services to much under fault conditions) means that the consequences if it is cleared in error are far worse than the methods we use in the UK, where in most cases passing a signal at danger can only be done at caution and only after a full verbal discussion between the driver and signaller. As such the overall risk of passengers being killed or injured is surely lower under the UK / French system.

 

As I said 'something similar' - i.e. similar but not 'the same'

 

And they were of course introduced for exactly the same reason as the Ersatz Signal in that they have a proved route but they differ, obviously, in not giving a full proceed indication.

 

Now the interesting thing about their origin is that the whole idea was to get round the potential risks in talking a train past a signal at danger where there is room for messages to be confused or misunderstood - hence the idea (which was subject to considerable debate) of using a fixed subsidiary signal which gives a very restrictive aspect and would only be used in carefully assessed circumstances.  They are similar to an Ersatz Signal in that, for example, they give permission for a train to pass a failed signal but they are not the same in that they don't give permission to run as a clear main aspect would.