Controller of site safety

A Controller of Site Safety or COSS is a person qualified by the British civil engineering company Network Rail to ensure safe practice for work occurring on or near railway tracks and infrastructure. Their primary role is to set up a 'safe system of work' (SSOW) to protect staff working on or near tracks from trains.

The British Rail Rule Book assigned responsibility for appointment of lookouts for warning railway staff of approaching trains to the 'man-in-charge' through the 1980s.^[2][3][4] In February 1985, four railway workers that were part of a six man crew clearing snow from points were struck and killed by a passing train.^[5] The group had no defined leader and no appointed lookouts despite poor visibility due to falling snow. In 1989, the role was renamed "Person In Charge of Work" (PICOW), but otherwise remained similar to the previous role.^[6]

In 1990, eleven railway staff were killed by trains while on or about the tracks, combined with further fatalities in 1991, British Rail revised the rules surrounding staff on or about the tracks, implmenting significant changes in response to deficiencies in the rule book at the time.^[7]

From April 1992, a PICOW was required to be appointed anytime workers were on or near the line, in response to these incidents, tasked with ensuring workers are kept safe from trains by appointing lookouts, arranging closure of tracks and other methods.^[8] Additionally, the PICOW role now required a formal certification to preform, with a formal training course to teach key concepts, such as setting up safe system of work and usage of railway documents to plan work.^[8] The course was a 2 day course, implemented on the job experience requirements before someone could become eligible to train as a PICOW.^[9][10]

On 7 August 1999, this job role was officially renamed to Controller of Site Safety (COSS).^[11][12]

The COSS has responsibility for the safety of themselves and the group under their direction and could be subject to prosecution should someone be killed or injured by their negligence.

The rules around performing the role of a COSS are stated in the Rule Book, a set of documents issued to track staff detailing their duties. Since 2010, this has been Rule Book Handbook 7, General duties of a controller of site safety (COSS).^[13]

To become a COSS, someone should have served a suitable period of time on the railways and undertake a five-day course. This is then followed by a period of mentoring by an experienced COSS and then independent regular assessments to ensure that the subject is competent to undertake their role safely and effectively.

A COSS is required to distinguish themselves on site by wearing a blue armlet/badge on the left arm or upper body on which the word "COSS" is printed in white text. They are prohibited from wearing this armlet/badge when not acting as a COSS.^[13]

Depending on the work, a COSS may be provided with a preplanned safe system of work. However in situations where work was not planned, such as unexpected signal or track faults, the COSS will need to decide on and impliment a safe system of work themselves.^[14] Further, a COSS may need to adapt a previously planned safe system of work if conditions change, such as weather, time of day or the location of the work.^[15][14]

Prior to approaching the railway line to start work, the COSS must be confident that the safe system of work will be adequate to protect the entire group from approaching trains. This includes factoring in variable conditions such as time of day, weather conditions, track and landscape geography and the nature of the work itself.^[15] They are also required to document that they've considered these factors and the decisions made regarding the safe system of work and if there were changes from previously planned arrangements.^[15]

The COSS also has the power to arrange for a railway track to be 'blocked' or closed to train traffic to enable work to be preformed.^[16][14] The COSS has to coordinate this with the signaller, place detonators and possession limit board.^[a][16]

Prior to starting work near or on the tracks, the COSS must give the group they are in charge of a safety briefing that explains the following:^[13][14]

Prior to accessing the tracks, the COSS must also verify that all members of the group have valid Sentinel competency card.^[b] All members of the group are also required to sign the safe-work briefing form to confirm they understood the information in the briefing.^[13] The COSS is required to have direct supervision of the group, and must remain with them while on or near the tracks.^[13]

The preferred safe systems of working where the staff are protected from line open to train movements, either by blocking some or all lines to traffic or controlling the distance the group is from the track (called Safeguarded/Fenced/Separated areas in order of consideration). This method was formerly called a Green Zone. This is the safest way of working due to the higher risks with trains moving at speed, although many incidents still happen within blocks.

Open Line working (formerly known as Red Zone) means the lines are open to train movements; this is seen as more risky than Safeguarded/Fenced/Separated areas, and is avoided in the rail industry where practicable.

A Safe System of Work (SSOW) is the method that railway employees use to protect themselves from being struck by moving trains while working on or near train tracks.

Prior to 2010, these systems were referred to and grouped as 'green zone' and 'red zone'.^[15] Green zone referred to systems where the work site was protected from trains by closing the track^[h] and red zone referred to systems where the tracks were still open to trains and workers would be required to move to a position of safety when trains approached.^[15] In an effort to reduce confusion and simplify the rule book, the terms were phased out in 2010.^[17] The hierarchy was also removed at this time, as it was largely rendered moot by instructions that required that the SSOW selected be most suitable to the task, circumstances and location of work.^[17]

Network Rail has aimed to eliminate the usage of human lookouts, with a significant push occurring after an incident at Margam, where two track workers were struck and killed by a train.^[19] At Margam, the six person crew had split into two groups, and the appointed lookout had remained with the other group.^[20] A 2021 fatality near Surbiton station prompted Network Rail to accelerate these efforts.^[21] In the June 2022 Network Rail Board meeting, it was acknowledged that lookout usage was already low as practical, with the majority of routes not using human lookouts. Total elimination was not realistic.^[22][23]

In 2025, the Rail Safety and Standards Board introduced updates to the Rule Book to further restrict the usage of lookouts. From December 2025, lookouts are only allowed when no other safe system of work is suitable, can not be used at night, during poor visibility or in/near tunnels.^[24] Further train speeds must be under 25 mph (40 km/h), and there are no junctions that would allow the train to unexpectedly change tracks.^[24] The usage of intermediate and distant lookouts^[i] was also banned.^[24][13]

• Sentinel