Why haven't Railtrack or the Health and Safety
Executive acted on a report of a damaged railway bridge?
This report can't answer the question; but it does point out how serious the consequences of neglect could be, and it does provide evidence of this neglect. There is an urgent need to audit Railtrack's procedures and to investigate why the Railway Inspectorate are so ineffectual.
At the time of writing, over ten months after the alarm was originally raised, over two months after the HSE were alerted to the inaction of people they're supposed to be monitoring, nobody knows if bridge 176 is safe. Dozens of deaths could result.
What you see here is version 1 written on 27th October 1998. There have been subsequent developments.
|To save time loading images they are initally shown using a very economical but crude form. It is possible to get better images by clicking on the adjacent buttons. NOTE: You will probably need to have your browser set to 'automatically load images' for these upgraded images to appear when requested.|
|3||Bridge construction and current state|
|4||Will anyone investigate?|
|A||Engineering matters explained|
|B||Rivenhall derailment 1997|
|1.1||In January 1998 the end wall of brick underbridge number 176 on the East Anglian main railway line at Witham, Essex was seen to have a crack in it. This was indicative of a shear failure caused by the pressure of the embankment above pressing outwards. During the next six months, when fortunately the crack does not appear to have worsened, Railtrack seem to have ignored the situation despite being informed about it. In August the HSE were asked to investigate this apparent indifference. Two months later they do not appear to have done so.|
|1.2||This report concludes that Railtrack are negligently endangering lives, and that the 'guarantee of safety' that should be provided by the RI/HSE is not working either.|
|1.3||The recommendation is that now the existence of organisational failures has been established, that an independent enquiry should analyse the causes of these weaknesses and recommend solutions.|
|2.1||Cracked bridge and official indifference|
|This report is the result of the author's personal observation of structural weakness in bridge and the subsequent attempts to ensure that incipient failure did not become actual failure. Railtrack, the organisation that should have acted when alerted appears to have done nothing about this for 9 months. The Railway Inspectorate (RI) of the Health and Safety Executive (HSE) treated this with such urgency that after two months and three letters there is still no signs of the bridge being supervised.|
|Witham lies roughly midway between London and Ipswich on the East Anglian main line. Bridge 176 carries the railway over a foot/cycle path and culvert. At this point the railway is on a considerable embankment with houses at the foot from the bridge towards the town and station.|
|2.3||...Too close for comfort|
|The site of the Rivenhall derailment of 1997 is 3 Km further down the line. Appendix B contains a summary of the causes and pictures of the results as a reminder of the seriousness of the consequences of poor standards of track maintenance.|
|2.4||Scope of investigation|
|The author, 'a member of the public' trained as an engineer, maintains an interest in many aspects of engineering but does not practice as an engineer. Lack of such data as plans, operating procedures and organisational charts does not invalidate the conclusions. Therefore this report concentrates on showing where problems exist rather than analysing them in detail. (That should be the subject for another investigation.)|
Bridge construction and current state
(Vagueness in this description is due to lack of access to official records.)
|3.1||Description of bridge|
This is a simple brick underbridge which penetrates the embankment at right angles. The construction might be called a tunnel as it is covered with earth. The portals consist of arched (in plan) wing walls on either side of a parapet which is flat in plan. The parapet acts as a retaining wall for the part of the embankment sitting above the arch.
Repairs to both parapets were carried out around 1994. This can be seen clearly where the bricks change colour. Similar work was done, but to a greater depth on the south portal at the same time.
|3.2||Description of crack|
Notice the lateral crack where the brick courses of the arch meet the end wall. Some spalling (faces of bricks being smashed outwards) is visible.
Some spalling shows signs of being patched while some appears recent. If we assume that this situation was not present when the upper work was being done then the crack can only have developed over a period of four years.
This is a 'shear' crack where the end wall is being pushed bodily outwards. Without measurement it is not possible to say:
This was first noticed in the Christmas period 1997.
The amount of shear, "a finger's width", does not appear to have
changed in the 10 months since the initial observation.
There appear to be rare fresh brick spalls and bits of mortar working out and
|3.3.4||A much less severe crack is apparent in the same place on the south portal.|
|3.4||Summary of failure|
(The full arguments appear in the discussion section.)
The key question we have to ask is : "Does this crack pose a threat of structural failure?" The answer is yes because:
In this particular case we have a retaining wall which is bulging. The degree of bulge has obviously increased in four years. Nobody knows if this was in one or more spurts or by minute degrees. The cause is unknown and the remaining strength of the wall remains a completely unknown factor. One thing we can be sure about is that since the wall is not arched across this face it will get weaker rather than stronger as the bulging increases. It is inevitable that this wall will collapse. The 64,000 dollar question is: How much time have we got to fix it?.
If the above was some insignificant piece of Railtrack infrastructure slowly rotting away where when it falls down it wouldn't hurt anyone then nobody would care. In this case where there could be a high speed derailment with railway vehicles ending up on the properties at the bottom of the embankment then you would think somebody ought to take up the matter urgently. As we will see in the next section - it appears not.
|4||Will anyone investigate?|
|Railtrack were informed on the 9th January 1998. The only action that appeared to occur as a result was a standardised acknowledgement.|
|The HSE/RI was informed on August 7th 1998 that nothing appeared to have happened and would they investigate. Over two months later, after chase letters on 10th September and 15th October there are still no signs of any action by Railtrack. HSE/RI claim to be dealing with the situation.|
|Is it not reckless for me to have let things take their own course for so long? Well in one way yes but as it appears we have two weak organisations who are indifferent then it becomes a question of balancing the risk of catastrophic failure against obtaining sufficient evidence of structural weakness in the organisations. I'm making a point of checking for any signs of movement weekly on the assumption the failure won't be instantaneous.|
|Correspondence details are given in appendix C.|
|5.1||Why the bridge will fail sooner or later|
The parapet wall above the arch serves to hold back part of the embankment.
In normal service the strength of this wall should be sufficient to prevent the
outward pressure of the earth fill pushing it outwards. For an unknown reason
(simply age perhaps) the base of the wall has sheared from the crown of the
arch. This wall is now weaker than when it was properly attached to the
Why then doesn't the wall burst? (If it is weaker now surely the pressure of the earth behind it is still there...acting on a weakened wall it would fail surely?) Because the pressure behind the wall is not constant because the material used to fill the embankment is not fluid. Just like the spring in a jack-in-a-box only pushes so far before it 'runs out of force', so the earth behind loses some of its pressure as it expands. If the embankment was waterlogged it might move in a more fluid way and there would be a catastrophe. The Aberfan disaster is the most notorious instance of this.
So that's all right then? The earth has shifted a little and the pressure relieved - Panic over. Unfortunately not. The embankment does what any pile of earth does over time and tries to flatten itself. Engineers call this process creep. Bit by bit the pressure behind the wall will rise. How quickly depends mostly on unknowns. Heavy rain or a vibratory track maintenance machine could accelerate the process as could a number of other factors.
Two things are for certain:
|5.2||What's driving the failure|
The graphs below illustrate various possible ways in which the embankment
and wall might be behaving.
Graph 1 shows the initial failure at (2) caused by a weakening of the wall (shown in blue). Graph 2 shows the situation where the pressure behind the wall increased to beyond the retaining strength of the wall at (6).
At (2) and (6) the strength of the wall is decreased as a result of cracking and luckily for reasons explained above the embankment pressure is simultaneously relieved. In both graphs we now see the pressure building up again caused by creep. This might be a smooth or jerky process. Sooner or later this will once again exceed the strength of the wall. In graph 1 this happens at (3) then the cycle is repeated at (4),and (5). Each cycle is shorter as the difference between ever decreasing wall strength and the relaxed pressure takes a shorter period to be 'eaten up' by creep. This would be seen on the ground as the crack getting worse in spurts. Graph 2 shows continuous deformation between (7) and (8). This would be seen from the ground as a steady worsening of the situation.
At some stage the progressive weakening of the wall and the inexorable creep of the embankment results in failure shown at (5) and (8).
There are other possible ways of drawing this graph. Perhaps the bridge was grossly overloaded for a short while and we don't expect pressure this high ever again. Perhaps the initial failure was gradual (7 - 8 style) and at some time the wall has become stronger. Yes, this is a possibility and will be discussed below.
|5.3||The need for measurement|
The only way we can tell what is going on now, and so hopefully do something
before it gets to failure stage, is to MEASURE the way the crack develops and
from this we can make an educated guess of the margin of safety. (We know it
will fail sooner or later, the question is do we have to stop all trains this very
afternoon or will another timescale allow us to take remedial action at a more
convenient time.) What everyone hopes is that the time between (7) and (8) (or
3-4-5) is sufficient for our inspections to spot that things are getting rapidly
worse. This is part of the art of engineering design and the reason for having
regular inspections - The frequency of the inspections depending on the
anticipated grace period.
There are two ways in which we can use the measurement of the crack shear:-
|5.3.1||Firstly by using an experienced engineering eye at the current severity and geometry, together with any other available clues that might give indications of the cause or behaviour so far a judgement can be reached as to the immediate danger. (Sometimes it is possible to calculate the weakness and model the situation. In this case however, the degree of uncertainty would be too great, when we already know we have reached a zero safety factor point.)|
|5.3.2||Secondly we can observe the behaviour of the defect over time. Once again engineering judgement is required to interpret these measurements. There is a fairly common situation where the defect grows at a slow steady rate then at some point starts getting faster and faster. Sometimes experience tells you that you'll have about a month between the first signs of acceleration and failure, so a weekly inspection might be acceptable. (If that month is a minute then run like the clappers!)|
Part of engineering design is to make something that either fails
gracefully or with plenty of warning signs. Higher risks requires
more attention to this principle. A boat prone to capsize is more
dangerous than one that leaks because you'll notice the water in
the bilges, have an opportunity to pump or patch and if all else
fails have time to launch the liferaft.
The retaining wall could fail after giving due notice or it could fail tonight without any notice whatsoever. At present nobody can say which. Hopefully nobody will ever find out because if they do then the price could be many lives. Therefore it boils down to engineering judgement. There are three components to this which are necessarily in the order given:
|5.4.1||I have discussed the need for measurement above. So far Railtrack cannot have any more data than the reader of this report and probably have much less.|
|5.4.2||The interpretation of the data depends mainly on comparison with similar situations. As mentioned above, only rudimentary calculations are possible. An engineer will try to understand the mechanisms that are driving and inhibiting the failure. I've discussed these above.|
|5.4.3||How does one balance unknowns and assumptions which can't be expressed mathematically with the potential consequences? The consequences of failure might be severe but hypothetical while the consequences of halting operations until the problem is fixed is immediate, financially painful and highly embarassing. There are pressures to keep going and hope. This is why there is a Railway Inspectorate who, in theory, draw the line.|
|5.5||Why hasn't the wall fallen down yet?|
Against this background of technical, ethical and practical engineering
principles I want to discuss the possibility that the wall is stronger now than
originally. I have my doubts as to whether this is a valid model for the actual
situation but I deal with it to show
In plan view the wall is bulging in the middle. ie the flat part above the arch. Where it joins the curved wings we have an arch construction which is going to be strong and very unlikely to shift; so this is what we'd expect. From ground level there are no signs of vertical tension cracks. Where does the wall get its strength from? Why does the crack appeared to have stabilised?
|5.5.1||Firstly its weight acting in conjunction with the sheared mortar course keeps it in place. This is obviously weaker than the mortar course when it was intact.|
Secondly by connection at the sides with stable brickwork of the wing
walls. These can't have got any stronger but what has probably
happened is that these are now taking more of the pressure. So long as
these don't fail, and we might assume that there is plenty of extra
strength in these joints to spare so we won't see a collapse because the
middle of the wall would have to pull away from the sides. This
argument might work at the sides but|
a) the middle of the wall is not well supported
b) these joints could now be IN TENSION. (The emphasis is here because bricks are about as good in tension as string is in compression. ie if you do get some strength from brickwork in tension then you take it as a bonus to add to your margin of safety.)
|5.5.3||Thirdly, and this is the unlikely but frightening possibility: Suppose you opened a packet of square biscuits, stood them in a stack, then tried to slide one out of the middle of the stack while pushing down on the top one. The middle one doesn't slide out due to the friction between biscuits. Eventually the stack hinges at the bottom, top and middle and the whole stack collapses on the table. Now if you were to press down harder on the top it would be much more difficult to make the stack hinge but when it did (very suddenly) the biscuits would be flying all over the place. This is treacherous behaviour in compression of a long thin stack which is what the retaining wall is (but on its side). The more fierce the end forces holding the stack in place the harder it is to spot warning signs and the more severe the failure if it does happen.|
From this analysis the reader should be able to see that:
|5.6||What might be the consequences?|
|Anything from a brick falling onto the cycle/foot path (followed by immediate closure of the line until emergency repairs are carried out) to high speed derailment with vehicles tumbling down the embankment onto houses underneath. Translate the Rivenhall derailment to this location to get an idea of the possibilities stemming from a simple track defect.|
|5.7||Neglect by Railtrack|
Given the importance of discovering what's going on at bridge 176, absence of
instrumentation is grossly negligent. Railtrack have had two opportunities to
|5.8||Indifference of HSE/RI|
If, two months after being alerted to a problem of this nature, the Railway
Inspectorate have not discovered what's going on then this is appalling
indifference. Incipient bridge failure is not a matter to be filed
It appears from the correspondence with the HSE (Appendix C) that their concern is with when they can answer my enquiry rather than checking to see that the bridge is sound. It would appear that 'Civil service' attitudes could cost lives.
FACT: This isn't the first time that the HSE have filed issues raised by me under "No action" while saying that the matter will be dealt with.
|At present this matter is not being publicised so the residents of Armond Rd. and Chelmer Rd. can get to sleep at night with out worrying about the collapse of a bridge because nobody will do anything about it. It is rather pointless when all that can be done is being done. - Except it isn't!|
|5.9.1||However when the status of the bridge is determined with certainty then it will be appropriate for everyone who is in a similar situation to be informed that the two organisations that should be looking after them aren't.|
|6.1||Bridge 176 needs a survey|
The current state of the bridge is:
|6.1.2||The consequences of failure are at the least going to be highly disruptive to the East Anglian main line. If a derailment occurred the result could be many people killed. The seriousness of the consequences of failure being so great mean that more than hunches are required to confirm it is safe.|
|6.1.3||Until bridge 176 is properly surveyed and kept under routine surveillance the bridge must be considered suspect.|
|6.1.4||The neglect of this matter so far means that some independent auditor will be required to check the survey findings and to ensure that any future work or procedures are carried out. The public can't have trust in either Railtrack or HSE/RI particularly when both organisations will be keen to cover up any errors. No scrutiny equals no confidence.|
|6.2||Organisations need investigating|
I'm one of those funny people who thinks that an incipient structural failure is a
matter requiring urgent investigation. In a single word ACTION.
I also have this odd idea that Railtrack should have a culture of safety including people who appreciate the relative significance of matters rather than a PR and rule-issuing administration.
Strange to say, I also find the HSE/RI inability to act inexcusable. More than that, I can not understand how this situation could possibly happen. There must be something very seriously wrong with this organisation.
|7.1||Railtrack need to survey bridge 176 urgently.|
|7.2||The survey and Railtrack's plan of action need to be available to the public.|
|7.3||HSE/RI to investigate why Railtrack have taken no action to date|
|7.4||An independent enquiry is carried out into the way HSE/RI operate.|
|7.5||The results of recommendation 7.3 are independently audited.|
|A||Engineering matters explained|
|You do not need to be an engineer to appreciate the substance of this report.
However as there might be some debate about the true significance of a shear
crack in brickwork the reader may have more confidence discussing these
matters if they're aware of the basic vocabulary and some of the principles
involved. (Besides, if you understand these few matters you have grasped the
essence of structural engineering.)
Some words are used by engineers in a more specialised sense than in common English. The most important distinction is between STRESS and STRAIN.
|STRESS||How much pressure is applied to a component. (Stress - I have tried to refer to engineering stress in the text as 'pressure' for an easier read and to avoid confusion with strain.)|
|STRAIN||How much a component is deformed. Often, but not always, strain is measured as a how much longer or shorter a component gets, typically as a percentage. In engineering, stress and strain are never interchangeable.|
|PRESSURE||Defined as force per area just like, for instance, tyre pressures. I have used a slightly less strict definition for the purposes of clarifying the explanation.|
|Stress can be applied to a component in different ways:
SHEAR is sliding. When books on a shelf fall over together, one book shears against the next leaving steps where the top of one meets the next.
|CRACKS||Cracks, being what make things break have been studied in detail. In many
cases their behaviour can be understood and progress predicted with
confidence. Cracks have a very important characteristic: The longer the crack
the easier it grows...getting longer...getting easier and so on, faster and faster
until it cuts right across the material and the object breaks. For example hold a
sheet of newspaper by the top corners and pull apart. It is very difficult to start
a tear down the middle, but once started it becomes easier and easier. This
means that if you spot a crack when it's small you may have time to do
something about it. It also means that cracks below a certain size in certain
situations will never get worse. Cracks can look quite unsightly but still be
A TENSION CRACK is where the material is being pulled apart. A tension crack only has strength if being compressed. The only thing keeping the two sides of the crack together otherwise is the material left joined at the ends which now has to take the load that was previously being taken by the cracked area.
A SHEAR CRACK is where the material has been sheared. See figure 1 in section 3.2. A shear crack might have a little residual strength but no sane engineer would rely on it.
|CREEP||Creep is where a material gradually deforms. Lead for example is quite creepy. It's not just soft but will 'flow' over time even under its own weight. Creep is normally a slow and predictable process and is often insignificant particularly with construction materials. Where creep in construction can be a problem is with soil, as the leaning tower of Pisa illustrates. Water can turn sound ground into a slurry with hardly any strength at all.|
A FACTOR OF SAFETY is an insurance against things not quite turning out as
you calculated. It is very rare for the stresses and strengths to be known with
precision. The safety factor allows for these margins of error. This can be a
matter of making something three times as strong as 'should be necessary in
an ideal world'. From the day the structure is built the forces of nature start
work. Rust, roots, rainwater are natural forces. Neglect, modification and
loading beyond the original specification can also cause deterioration. The
more confidence you have that you're nowhere near the limits of strength the
less attention you have to pay to ensuring you keep within them. And vice
versa: Old ladies take extra care not to fall over because their bones become
brittle with age.
However to calculate a factor of safety you need to understand what's going on in engineering terms. This is called a MODEL. (Possibly a scale model, but mostly drawings and mathematics.) In some cases eyeing up the situation will do - "How many screws should I use to put this shelf up" in others, particularly where lives are at risk you either make sure you know exactly what's going on or insist on bumping up the safety factor to cover your ignorance.
SAFE DESIGN is the art of making something safe in the first place and also making sure that potential problems can be spotted before they become major ones, and/or trying to minimise the effects if it should fail. There are trade-offs between these and other factors. For example the price paid for lightweight and critical aeroplane components is expensive in-service inspection. If you can't inspect then you need a soft-fail facility in the same way as motorcycles have a reserve tank instead of fuel gauges. Notice that this is SAFE USE, which is specified initially at the design stage in the operating instructions (If the engineer is any good - for "use" read "mis-use").
|B||1997 Rivenhall derailment|
An Ipswich bound containerised freight became derailed at Rivenhall on 23rd
September 1997. A number of wagons left the track at high speed. A great
deal of infrastructure was damaged and services were severely disrupted. The
cause appears to have been poorly maintained track.
Version 1 : The above is based on press reports. Version 2 will include a summary of the official report and results of a court case arising due to be heard at Harlow Magistrates on the 3rd of November.
|9th Jan '98||PF telephone to Railtrack|
|7th Aug||PF letter to HSE|
On the 9th January 1998 I telephoned Railtrack and reported that bridge 176, at
Witham on the East Anglian main line (a couple of miles from last year's Rivenhall
derailment) was showing signs of structural distress. The retaining wall above the
north portal was cracked and it was not a cosmetic matter. This last point was
emphasised. Both portals have had the top part of their retaining walls repaired
(estimate) 4 years ago. The crack is below this new work. (The problem appears on
the south portal retaining wall to a much less noticeable extent.)
In the seven months since then there has been no signs of telltales, datum points, or any other instrumentation so you may want to investigate what steps Railtrack have taken to look at this matter.
Should there be a structural failure and derailment on the same scale as Rivenhall then a dozen houses at the bottom of the embankment would be squashed.
Naturally, I am not expecting an immediate reply, but I would like answers to the following specific questions:
|19th Aug||HSE (Mark J Hashim) to PF|
[Thank you formality]|
Your letter is receiving attention and a reply will be sent to you in due course.
|10th Sept||PF to HSE (Mr M Vowells)|
Mr Vowells appears on letterhead of 19th Aug
as Divisional Administration Manager|
Railtrack bridge 176, Witham
"... in due course."
|14th Sept||HSE (Mark J Hashim) to PF|
"Thank you for your letter of 10 September 1998. Your letter has recently been
passed to the inspector concerned who is dealing with your enquiry.
Please accept my apologies for the delay in sending a full reply which is due to our continuing enquiries."
|15th Oct||PF to chief executive of HSE|
Over two months and no hint of progress
Railtrack bridge 176, Witham|
7th August I write the attached.
19th August you say : "... in due course."
10th September I ask how are you getting on?
14th September you reply with a 'we're doing something' letter but no details.
It is now over two months since drawing your attention to what might be 1) a serious structural defect 2) a possible lack of safety systems at Railtrack. If you lived at the bottom of the embankment I think you'd want some better reassurances than you've been able to provide so far.
This is the second time this year I have had to complain. In the first case your Chelmsford office knew that by the time they got round to having to do anything the responsibility would no longer be theirs so wasting my time and showing complete disregard for the safety of the public. That was a disgrace. Now in this instance I'm assuming that nothing has been done either. Passing papers around is pathetic. Perhaps you'll be good enough to tell me:
1) what progress your staff have made so far in this matter.
2) when you think you'll be able to answer the questions posed.
A copy of this letter has been sent to my MP.
|19th Oct||HSE(Secretary to the Director General) to PF|
|Acknowledged receipt of my letter of 15th. "A reply will be sent to you shortly"|
|19th Oct||HSE(Mark J Hashim) to PF|
Further to my letter of 14 September 1998, I am writing to inform you that the
inspector concerned is currently dealing with your enquiry and is making enquiries
with Railtrack to establish what steps they have taken to ensure that this bridge is in
a safe condition.
Once again, please accept my apologies for the delay in responding and a full reply will be sent to you as soon as it is possible.
|Postscript : 25th October. Still no signs of any Railtrack action.|