The Underground Electric Train

by Piers Connor

17.  Deadmen and Tripcocks

Safety

After nearly eighteen months of reviewing the development of the Underground electric train in these articles without mentioning much about safety devices, apart from a few basics I touched on briefly in connection with the Westinghouse brake in article No.6 (in Underground News No.528,  December 2005), I suppose it is time to look at them in a little more detail.  As I am sure you are aware, the Underground has an exceptionally good record for train safety, largely because of its signalling and its built-in train protection system known as the trainstop and tripcock.  Sadly, in recent years, other issues like crime, fire protection, left luggage, terrorism and even politics, have tended to obscure the reality of the basically safe train operation which the Underground has developed and maintained on its railways for over a hundred years.  So, in this article, I start the first of several articles which take a look at the train safety systems which have contributed to this record.

The Deadman

Perhaps the best known (most infamous even) railway safety device is the “deadman” or “deadman’s handle”.  Nowadays, it tends to get called a “driver’s safety device” because it may be a pedal (on UK main lines for example) or even an “alerter”, as commonly used in the US to ensure the driver is awake.  The deadman is the device that stops the train if the driver releases the power controller handle.  Frank Sprague was the original designer.  He developed it during his time as a lift engineer for use on lift controllers and he used the name “deadman switch” in that application.  He transferred it to trains along with his multiple-unit control system.  It arrived on the Underground in 1903 on the two experimental District electric trains known as the A Stock.  These worked, you may recall from earlier in this series, on the Ealing and South Harrow line, which was electrified to test the new systems to be used on the District and LER tube lines.

The deadman was introduced so that one man could operate in the driving cab on his own.  The reasoning was that, if the man became incapacitated for any reason, he would release the handle – the “deadman”, and the train would stop.  The steam locomotive required two men to operate it – one to look after the fire and water while the other drove it and kept an eye on the road ahead.  If either got into trouble for one reason or another, the other would help out or, if he couldn’t help, he would raise the alarm. 
When multiple-unit traction was introduced, only one man was needed, since there was no fire or boiler to manage and the driving was relatively simple.  Nevertheless, two men were used on the C&SLR and Central London while locomotive operation was in force, the second man to assist with coupling at the termini and, of course, he could help when things got difficult.  He would also keep an eye on the road, check signal aspects and learn the trade of driving while he was at it.  However, with the introduction of multiple unit operation, he was really superfluous and he became an expense that the company could do without. 
With the exception of the Central London, all the Underground operating companies installed the deadman on their multiple unit trains from new.  The Central London replaced their electric locomotives in 1903 with multiple unit operation but they kept two men in the cab at first.  These were rapidly “let go” until trains were all operated with one man in the cab but without a deadman on the master controller.  Eventually, in 1908, the Board of Trade got to hear of it.  They sent the Central London management a snotty letter noting their displeasure at this unsafe operating practice.  The CLR responded admirably quickly by converting all the master controllers to the deadman type within a matter of weeks!

The most common type of deadman was a button in the controller handle (Fig. 1 above) which had to be kept depressed all the time the controller was switched into a driving mode – both forward or reverse.  This was installed on all stocks built up to 1920 but it was difficult to use as it required the driver to grip the handle so that the button was depressed by the palm of the hand.  This is a most uncomfortable method of operation and it was, not surprisingly, widely abused.  As the controller could be switched into the “OFF” position and the train allowed to coast, drivers would regularly do this to get some rest for their arm.  However, the train was effectively unprotected if the driver was taken ill at that moment.  It also led to many trains not being driven to their full capabilities when required, since they were coasting when they could be under power.  Some drivers overcame this by tightening an adjustment screw so that the button stayed down regardless of whether the driver held it or not. 
From 1920, trains began to appear with rocking controller handles which only required downward pressure to keep the deadman function operative (Fig. 2 left).  The B T-H type had a double spring which required firm pressure to get the handle down in the first instance but which, once down, could be held down with light pressure.  This was a much better system and survives to this day in various forms on trains built before the D Stock.  Surprisingly, the GEC equipped trains built through the 1920s and 1930s retained a version of the old button type.  Some of these even survived into the 1980s on various battery locomotives.
The Metropolitan-Vickers rocker deadman also appeared at the same time but it didn’t have the latching mechanism of the B T-H type and you had to keep more pressure on it.  It was easy to forget this on the more lively riding open sections with O & P Stocks and one could easily “drop the button” and accidentally cause an emergency brake application. 
The Met-Vickers deadman replaced the old Westinghouse design.  This was a handle which swung back to the off position when released.  It had a small thumb operated button in the top of the controller handle.  It is not clear to me how it applied the brakes, if at all.

Deadman Operation

The operation of the standard deadman was simple.  If it was released while the controller was in an operative position, a valve opened in the train line, (the brake pipe), let the air out and the brakes went into emergency application along the train.  The valve operation was actually a two-stage process, using a small pilot valve in the controller itself and a larger relay valve located under the cab floor, but the effect was the same.  For modern trains with no train line – they have electrically controlled emergency braking (ECEB) – the safety circuits, which run round the train in the place of the brake pipe, are opened by deadman switches instead and the brakes go on that way.  The controller also has control circuit feed contacts attached to the deadman operating system so that the feed is lost if the deadman is operated and the motors are switched off.
The deadman system is locked out of use when the key-operated, master controller reversing switch is in the off position.  The key is removable in this position and the driver will take it with him when he leaves the cab.  Although slightly altered in detail over the years, this has been the system used on almost all the Underground’s electric trains.

CTBCs

Looking at more recent times, the provision of Automatic Train Operation on the Victoria Line meant that a driver’s safety device was never going to be used on a permanent basis so, on the ‘67 stock, the controller handle didn’t have a deadman facility.  A “Vigilance Button” was provided instead and this had to be depressed if the train was being driven manually, which it rarely was apart from trips into the depot or sidings.
The ’67 stock also had a combined traction/brake controller (CTBC).  Prior to this, brakes and power controls were separate.  The CTBC handle rotated in the horizontal plane like earlier power handles but it had a lot more than the four “notches” of the standard type.  It was developed as a result of the stock having rheostatic braking, where the traction motors are used to provide a braking effort. 
The same control wiring and camshafts were used for motoring and braking so it was easier to use the same controller handle for them too.  The e.p. and Westinghouse brake systems were retained and operated with the same handle.  All stocks built since have had CTBCs but they have also all had the deadman facility built in.  The ’67 TS vigilance button was a “one off”.

Trouble

With the arrival of the D Stock, the twist grip deadman appeared.  The handle is on a vertical shaft with a handgrip at the top.  This has to be rotated through 90° (approximately) in order to release the emergency brake and it is then held in that position to retain control.  This type of deadman operation is now standard, even on the armchair controllers provided on the 199x stocks.  I went to see the first example of the D Stock version in the test lab of the Westinghouse brake factory at Chippenham.  I looked at it for a few moments and then asked the engineer who was showing us around if he had a match.  “Oh, I’d rather you didn’t smoke in here” he said.  “I don’t smoke,” said I, ”but I want to show you something.”  I took his reluctantly offered match, twisted the deadman’s handle into the operative position and moved the handle to “parallel” and placed the end of the match into a small hole which was revealed at the base of the shaft.  I let go of the handle but it remained jammed in the operative position.  The engineer peered at the handle and the match wedging it in the full power position and said to me, “How did you discover that so quickly?”  I simply replied that I was only doing what many drivers would do on their first look at the new controller – find a way to isolate it.  Naturally the production version was suitably modified.
Whilst it might seem a simple device, the deadman has caused a lot of trouble over the years.  It is the principle interface between the driver and the train control system and is therefore in use constantly.  If the design isn’t right and drivers aren’t comfortable with it, it is bound to lead to trouble.  The old button grip led to abuses, as we have seen, and the rocker type was not immune to similar problems.  Even the shape or position of the handle could cause problems.
One celebrated driver, who we can call Tom Soames, was based at Uxbridge (Metropolitan) depot in the early 1960s.  In those days, it was usual for all Met. depots to do some Circle duties in addition to their regular work on the extension and these were heartily disliked.  Most of the Circle duties were done by men stationed at Baker Street depot and, if any other depots had a crew go sick (absent) on a Circle turn, it was normally Baker Street spare men who were pressed into covering it.  Now, Tom Soames was a man with his eye on any opportunity which came his way.  He also had very big hands and the Met-Vickers controller handle on the O Stock, which worked on the Circle & Hammersmith lines with the P Stock at the time, was also large and, in the “off” position, it was very close to the pipework behind the controller.  When Tom put the controller in the off position, he tended to catch his knuckles on the pipes.  He therefore claimed that he could not drive Circles safely without hurting his hand.  After some tests were carried out and some photographs were taken, this was eventually accepted as a genuine problem and, henceforth, all Tom’s duties on the Circle had to be covered by someone else – usually the spare men based at Baker Street.
This unsatisfactory state of affairs lasted for some time, until Tom, having a gained a somewhat dubious reputation as a person who would fight for his rights and therefore might fight on behalf of others, was persuaded to stand for election as local union representative.  This he won, with a large majority against the existing incumbent, most of the votes, it was said, being generated from Baker Street depot, which cynics suggested was largely as a result of a wish to get Tom off the duty roster so he could become a full-time union official.  This would mean his job would be covered permanently by a new man at his own depot at Uxbridge and Baker Street spare men wouldn’t have to do his Circles for him any more.
As a driver at Baker Street, I knew Tom when he was the local union rep. and I had been told his story, which I regarded as just one of those urban legends which abound on the Underground.  However, years later, when I was responsible for clearing out the old records office at Acton Works, I came across the file on the tests carried out for Tom including a set of photographs showing his hand on the controller of an O Stock and the problem it caused.  I felt suitably chastened.

Tripcock

As I mentioned in article No.6, my nomination for the most significant safety device used on the Underground is the tripcock.  Used in conjunction with the track-mounted trainstop, it is the single, most important safety system the Underground has.  Long before anyone had ever heard of ATP (automatic train protection), TPWS or even AWS, the Underground had its own form of ATP in the tripcock.  It was introduced at the same time as the deadman on the Ealing & South Harrow line and has remained a standard feature of Underground train operation ever since. 
Like the deadman, the operation of the tripcock is simple.  It consists of a valve in the brake pipe with a lever underneath it.  The lever, called the “trip arm”, normally points downwards and, in this position, the valve is closed.  If the arm meets an obstruction, like the raised trainstop, it is knocked back, opening the valve in the train line and letting the air out, so causing the brakes to apply in emergency mode.  Of course, the trip arm can be (and is sometimes) hit by other things, like ballast piled too high, a p-way shovel or even the supermarket trolley which got back from the canal but ended up trespassing on the railway. 

Testing Time

In the same spirit of curiosity that led to my demonstration of jamming the deadman on the prototype D Stock controller handle, a District Railway engineer decided to test the tripcock on a trip from South Harrow to Ealing Common on the morning of 4 January 1906.  Unfortunately for him, it got a bit out of hand.  He was driving one of the two electric locomotives that the District had acquired for engineering work.  At this time, the District was at the cutting edge of technology – electric traction was new and high tech. and the automatic signalling was regarded as wonderful new safety system.  People were interested in what this new fangled American system would do to the railway business and many of the staff were also curious about the new equipment they were dealing with.  This driver was one such person.
On this particular morning, he and the pilotman riding with him decided to test this new tripcock system their railway had been provided with to see if it would work.  After all, they had been told it would prevent a collision if a train passed a signal at danger.  So, they thought they should try it out and that’s what they did.  The driver let rip and took the locomotive at full speed past a red signal on the approach to Alperton.  They were following a passenger train.  The locomotive was “tripped”, the emergency brakes applied and the locomotive stopped just as it should.  The two men were so pleased with themselves that they decided to try it again at the North Ealing home signal but, this time, the braking distance allowed for was a bit short, the line was downhill, the rails were wet and, although the locomotive was tripped, it hit the rear of the single car train passenger train standing in the platform.  The car was a double-ended motor car, No.201.  It was the first accident on the newly electrified railway.
I expect the two enterprising tripcock testers lost their jobs but one of the main results of this incident was the careful calculation of the overlap provided for each signal.  The overlap is the distance the signal is set back from the entrance to the block it is protecting.  On the Underground, it is the distance allowed for the train to stop in if it gets tripped.  Before this incident, it seems to have been a fixed distance.  After it, the calculation was made on a site-specific basis, taking into account such variables as possible approach speed and the gradient.  The approach to North Ealing being on a downhill gradient was obviously a significant factor in the collision.  The weather was also wet at the time.

Rear Tripped

A tripcock is provided for each driving cab.  This means that every train will have one at each end.  This led to problems where a train gets “back tripped”.  In these cases, the first thing the driver knows about it is when the train “comes up in a heap” because the emergency brakes have applied.  It is very disconcerting.  In the days before on-train diagnostics, the driver and his guard had to go through a process of elimination to determine the trouble.  It would usually be resolved by isolating the rear tripcock.  An isolating cock (or switch) is provided to do this and it has its handle mounted on the headstock – the TCIC.  It was originally placed there so that the isolation could be visually detected from outside the train.
Trains formed with driving cabs in the middle originally had to have the middle tripcocks isolated manually as part of the coupling process.  This prevented the middle trip arm getting hit by the trainstop rising when the front of the train passed the signal and it returned to danger.  Trains built after 1936 had the middle tripcocks automatically isolated by the automatic couplers as they coupled.  They were reset automatically too, as the train was uncoupled.  The tripcock was provided with a pneumatic reset cylinder and piston, which was activated when the couplers went into the uncoupling sequence.

The Code Trip Valve

For the ATO system proposed for the Victoria Line, there had to be a re-think of the tripcock system.  The intention was that the new stock, the 1967 Tube Stock, would still be required to work over existing lines – to get to Acton Works for overhaul for example – so it had to have a tripcock facility, but it didn’t need it for normal ATO operation.  However, it did need a means of “tripping” the train if it didn’t respond to the coded signalling transmissions.  Thus, the “code trip valve” was born.  This is an electro-pneumatic valve, mounted in the cab and connected to the train line.  It is held closed electrically as long as the signalling safety system is responding normally.  If there is any incorrect response, the current supply to the valve is lost, the valve opens and the train is “code tripped” with an emergency brake application.
For off-Victoria Line trips, a standard tripcock is fitted to each end of the train in Northumberland Park Depot and a manual changeover process is carried out at Finsbury Park where the train moves off the Victoria Line over the connecting junction to the Piccadilly Line.  This is now a rare event, as trains don’t go to Acton for overhaul any more.
I am sure you won’t be surprised when I tell you that, on the Victoria Line ATO system, there is a further complication – the rear code trip valve does not receive a current supply from the safety system.  As it is at the back of the train, it doesn’t need it so, to prevent it applying the emergency brake, it has to be isolated from the train line.  This is done through a piped connection to the traction/brake controller (CTBC), which is closed off when the controller is placed in the “shutdown” position.  The rear code trip valve is now isolated and the train will operate under the protection of the code trip valve at the front.  Code trip valves in middle cabs are isolated in the same way.
A slightly modified ‘67 Stock CTBC design was continued on the C and ’72 Stocks in the belief that they too would be converted to ATO in the near future.  Of course, this never happened, but the arrangement meant that these trains, which had conventional tripcocks, could not be back tripped.  The connection between the train line and the rear trip valve was isolated by the shut down CTBC.  This led to another peculiarity.  Sometimes, you would change ends at a terminus and open up, only to find that the rear trip (now your front trip) had been operated somewhere on the previous journey.  You had to reset it before you could restore the train line pressure and get the brakes to release.
This was the situation on the C and ’72 Stocks until around 1980 (I don’t recall the exact date) when an incident at Colindale with a ’72 Stock train caused a rethink.  The train had been driven into the reversing siding and the crew were changing ends.  Unfortunately, the driver had failed to ensure that the brake pipe pressure was fully discharged before leaving the cab, as he should have done, and the brakes didn’t go on properly.  The siding is on a slight gradient there and, as the brakes slowly leaked off, the train began to roll very gently towards the exit end.  The driver didn’t notice at first as he was walking through the train to the other end but eventually he realised what was happening and quickly pulled a passenger emergency alarm handle to stop the train.  However, the train did pass the outlet signal and stopped on the open points with a set of wheels off the rails.
This incident showed two weaknesses in the train’s equipment – one was that the driver could shut down a train without applying the brakes sufficiently and the other was that a train could roll with no tripcock working.  The first problem was not entirely solvable but the second was rapidly cured by removing the automatic tripcock isolation selection when the CTBC was placed in the “Shutdown” position.  Now, these trains became like all the other manually driven stocks and they could be back tripped. 

Tripcock Reset

Not unnaturally, if a train gets tripped and stops in the tunnel – or anywhere else for that matter – you have to be able to get it moving again.  This requires a means of resetting the tripcock.  The original tripcock was a simple cock with a handle at the end of a pipe.  When it was knocked open, it stayed open.  It was positioned at the front of the leading bogie, usually on the end of the shoebeam.  It had to be as close to the front as possible because the only way of closing it in a tube tunnel was by reaching under the cab front and pulling it forward manually from its knocked back position.  This was a most unsatisfactory method, as the driver would get covered in dirt in the very tight space and he could easily touch something highly electrical in the process. 
The problem was solved with a new design of tripcock that appeared around the start of World War I in 1914.  This was called the DR2 type (District Railway No.2) or “ejecta” type.  It was a much more sophisticated device than the original “plug” type, consisting of a cam operated valve, complete with a lever operated reset, fitted inside a specially constructed cast box, which was bolted to the shoebeam behind the front axle and which could be adjusted vertically and laterally.  This adjustment feature solved the problems with the old “plug” type tripcock, which was subject to the variations in wheel wear and which could lead to spurious operation.

The new DR2 tripcock came complete with a reset cord, which was carried forward to the headstock under the front of the cab so that the driver could reach it without having to scramble underneath the train.  The cord was attached to the lever, which was arranged so the tripcock could be reset easily whether it had been operated in either direction, i.e. the train had been back tripped or front tripped.  This arrangement survived until the mid-1960s on the surface lines, when the trip reset cord was extended to the front cab door (M door) so that a crew member did not have to climb down onto the track to reset.  This had been a difficult procedure, as you could not get out through the front door because it was too high above the track, so you had to go via a side door.  If you chose the offside door, if you weren’t careful, you were likely to be knocked down by a passing train and if you took the nearside door, you could easily take the “juice” off by getting entangled in the tunnel telephone lines.  Hobson’s choice really, but the extended trip reset cord solved the problem.
Tube crews always had to get out through the end door as there was no room at the sides when in the tunnel.  They carried on doing this until the train refurbishment programmes of the 1990s, when it was decided that staff should not have to get out of the cab to reset the tripcock.  There were fears that they might slip while getting out of the front door and stepping on to a greasy coupler to get down.  Refurbished surface stock tripcock resetting was also modernised at this time so that the A, C, ‘72 and ‘73 Stocks were all provided with remote reset devices.  A push button in the cab operated the pneumatic reset valve in the same way as automatic couplers when going through the uncoupling sequence.  Reset cords were extended into the offside cabinet in the cab on D, ‘95 and ‘96 Stocks.

SCAT

Although signals on the Underground are provided with trainstops, drivers were always allowed to pass signals at danger, but only after they had stopped at them and only under strict rules.  It was always recognised that signals could fail or a train could get stuck and require a push from behind to get it out of the way, so sometimes a train would have to pass a red signal.  Rules to cover these situations were provided from the beginning on all railways (the famous Rule 55) and they were recognised as particularly important in the tunnels of the Underground. 
On the Underground, the rules provide that, assuming that the driver has already stopped at a red (or danger) signal, and it is an automatic signal, he can, after waiting a set period during which he will try to find out what’s going on, proceed at extreme caution past the signal, get tripped and then reset and proceed again at extreme caution until two green signals had been passed.  In controlled areas specific permission has to be granted.  The process was, and largely still is, known as “carrying out the rule”.
Unfortunately, over the years, drivers occasionally took a rather relaxed view of “extreme caution” and some nasty rear-end shunts took place.  The worst of these was in the tunnel near Stratford on 8 April 1953 when 12 people were killed, but there were a number of others both before and after this time and it was not until a spate of collisions and near misses in the 1960s and ‘70s that a system known as speed control after tripping (SCAT) was introduced.  It appeared on the D Stock when that went into service in 1980, although it was then referred to as “tripcock delay”, and on the 1983 Tube Stock.  It required the driver to proceed at slow speed whilst an indicator light was illuminated.  It was retrofitted on refurbished trains (and provided on new stock) from the mid-1990s.
SCAT is simply a 3-minute electronic delay inserted into the control system that prevents a train exceeding (usually) 10 mph until 3 minutes have elapsed.  At 9 mph the driver gets an audible alarm and if he goes over 10 mph, the service brakes apply.  It basically enforces the “extreme caution” rule.  Now, if a driver isn’t paying attention after carrying out the rule, a 10 mph bash will bend a bit of metal but it is unlikely to kill anybody.  In any case, at that speed, even the doziest of drivers is likely to see a train ahead and stop before hitting it.
One might ask why it took so long to put such a system into place and why it wasn’t put on older stocks before the refurbishment programme of the early 1990s.  Well, simply, the technology wasn’t there.  The older train equipment was not easily adaptable without huge expense and there was (and still is) a reluctance to put anything new on trains which might affect their reliability.  This is especially so for something which could stop the train moving or delay the service. 
Following the King’s Cross fire, a complete review of the safety risks of all the Underground’s operations was undertaken and the possible speeds of trains after “carrying out the rule” was shown to be a high risk problem.  There had been several incidents during the 1980s which showed the rule’s vulnerability due to overspeeding – in particular, Leyton (two occasions) and Kilburn, where a driver was killed on his first day on the front alone.  It wasn’t until the early 1990s that a reliable, train-mounted, time-delay system was available and a way of fitting it to older stocks had been worked out.  Once it was, it was implemented as part of the safety improvements programme for refurbished trains, which included interior fire-hardening and the introduction of the PEA system in place of the old emergency stop valves.
To be continued ……..