Nine Dead 150 Injured - Never Should Have Happened

[Euclid]

 

xjqcf

The question as to why the substitute signal was displayable is misplaced; the question really is should any human proceedure permit the override of a protective state from a machine, such as the signal system here? 

That is my question too.  If you have two trains heading for a conflicting route, the signals should automatically prevent them from colliding.  If the trains are far enough apart, you can take the signal away from one train and give it to the other because there will be enough space to get the train losing its signal room to stop.

But in this case, it sounds like this manual override imposed a stop signal on a train that was already past it.  So, I don’t get the functionality of this system.  What happened should not have been possible.  We like to speak of red herrings here, and I would say that the dispatcher playing a video game is the reddest of red herrings.

If the distraction of a video game is sufficient to cause this disaster, then a thousand other distractions would be capable of producing the same result.  Railroading has the functionality to physically prevent route conflict, and uses it in cases where the consequences are sufficiently dire.        

 

[schlimm]

Negligent homicide under the German criminal code carries a sentence of up to five years in prison and/or a fine.

[Firelock76]

I'm going to succumb to the urge to be nasty just this once...

You know, in the old days of the Prussian Railways this incompetant would have been left alone in a room with a Luger loaded with one cartridge with the expectation he'd do the honorable thing.

Like I said, just this once.

There's few things sadder than someone who's old enough to know better, and doesn't.

[Deggesty]

schlimm

The investigation has gone beyond that.

"Authorities in the southern German city of Rosenheim arrested a 39-year-old signals control officer on Tuesday, whom they accused of negligent homicide for playing games on his mobile phone just before a fatal train crash in February. They alleged that he attempted to make up for his inattention by sending an emergency message, which the train drivers ultimately did not hear. Investigators believe that "the accused was distracted." Prosecutors said the man admitted to playing a game on his phone, but denied that that had distracted him. Two commuter trains collided on a single-track line near Bad Aibling in Bavaria on February 9. The crash left four train drivers and seven passengers dead and more than 80 people injured. Within a week of the case, the prosecutor in charge of the case had identified human error as the cause. The dispatcher now faces a heavier penalty than he had shortly after the accident, when authorities had accused him of sending the wrong signal."

 

It is a mistake to employ infants to look after the welfare of other people. Of course, I am confident that this infant was not asked if he played games when he was supposed to be working. He obviously did not realize the gravity of  his task.

[schlimm]

The investigation has gone beyond that.

"Authorities in the southern German city of Rosenheim arrested a 39-year-old signals control officer on Tuesday, whom they accused of negligent homicide for playing games on his mobile phone just before a fatal train crash in February. They alleged that he attempted to make up for his inattention by sending an emergency message, which the train drivers ultimately did not hear. Investigators believe that "the accused was distracted." Prosecutors said the man admitted to playing a game on his phone, but denied that that had distracted him. Two commuter trains collided on a single-track line near Bad Aibling in Bavaria on February 9. The crash left four train drivers and seven passengers dead and more than 80 people injured. Within a week of the case, the prosecutor in charge of the case had identified human error as the cause. The dispatcher now faces a heavier penalty than he had shortly after the accident, when authorities had accused him of sending the wrong signal."

[xjqcf]

From what I have read on this incident it appears that the dispatcher authorized the train at Bad Aibling to pass the exit stop signal to proceed toward Kolbermoor. This he did by activating a so called substitute aspect (three white lights arranged in an upward-pointing triangle). The engineer, following standard proceedures, proceeded past the signal, pressing an override button on the operator's panel as he passed over the still activated 2000 kHz inductive magnet which is used on most lines in Germany as part of the PZB train protection system at no more than 40 kph until clear of the points after which he could proceed at track speed; within the same time frame, however, the other train had left Kolbermoor toward Bad Aibling on a green signal, setting up the collision on a blind curve.

 

The signalling system allows this display of a substitute signal if the signal cannot be cleared, but only after some specific proceedures, which I have not yet been able to determine. It has been alleged by the German prosecutor that these proceedures were not done. Why these proceedures were not followed has not been made public, and one can only speculate. I would guess the dispatcher, wanting to avoid further delay (The train was already 4 or 5 minutes late; tight standards in Germany compared to the U. S.), had lost sight of the fact that the Kolbermoor train was already on the way and just assumed it was some unexplained signal failure.

 

The question as to why the substitute signal was displayable is misplaced; the question really is should any human proceedure permit the override of a protective state from a machine, such as the signal system here? 

Such overrides are also possible here in the U. S. although they are mostly verbal, such as NORAC rule 241 or the various proceedures under GCOR 9.12. The bottom line is that no technology is 100% effective; most are designed in a way to try to design them to "fail safe," in this case meaning stop and stay. While safe this means nothing moves until there is some form of human intervention ranging from waiting until someone confirms the danger which triggered the stop signal or discovers and corrects the fault, which could be hours in length. Perhaps, as some have suggested, a "second pair of eyes" is needed such as a chief dispatcher, who must also operate an independent control to authorize the overrride, so that the dispatcher can't just independently do so; this should be doable with causing much more unreasonable delays. 

[ramrod]

It appears to me that most commentators on this thread assume or believe that the culture, rules, job standards, traditions and practices of the German railways and their regulating and standards agencies are virtually identical to those in the US and Canada. I have no doubt there are similarities among them, but I would expect there are major differences as well.It would be helpful if someone who knows both US and German systems could point out the major differences to help us understand why and how this accident occurred. 

[Euclid]

I would like to see a detailed explanation of exactly how the said mistake of the one employee occurred and caused this collision.  The general way that it has been described seems like the control system is faulty in its design by allowing a simple mistake to cause a catastrophe.

[samfp1943]

BaltACD

 

NorthWest

http://www.dw.com/en/dispatcher-arrested-game-linked-to-bad-aibling-crash/a-19182092

 

 

Bigger question is what kind of Dispatching System facilitated trains with overlaping authority.

 

A partial answer to BaltACD's question is found on the following linked site @ http://www.dw.com/en/after-bad-aibling-railway-safety-in-europe/a-19037919  "After Bad Aibling: railway safety in Europe"

FTA"...There is currently no unified system in place that has trains respond to the same signals. How exactly trains stop when a break signal doesn't work, a question that might have played a role in the Bad Aibling disaster, varies from country to country, because rail transport systems have historically developed on a national, not an EU-wide basis.

The goal is to get all railway route networks under one umbrella, so that train travel is equally safe in all EU member states - and that's what the European Train Control System (ETCS) was developed for..."

And then there was this information from the same article :

"...Open-source software makes ETCS more affordable

The ETCS is supposed to replace the many incompatible safety systems operated in the EU, especially on high-speed lines. It deals with signaling and train protection, among other issues.

The basic idea of one common train and railway system has been around for decades. The specifications put forth by the ETCS are accepted Europe-wide, but there are several national exceptions to individual guidelines. Integrating all this into one standard that all trains from Rome to Stockholm and from Lisbon to Bucharest run on is a - rather difficult - work in progress..."

Then finally they have included the folowing admission that seems to sum up the whole problem(?) in the EU... "..."OpenETCS" is supposed to lower costs and expenditure of the system's implementation. So far, there are no trains equipped with ETCS that fulfill all regulations of all European railways. The developers of the open-source software hope that their freely accessible, cost-efficient "openETCS" will be installed on all new trains that are being built now..."   [emphasis added !]

[BaltACD]

NorthWest

http://www.dw.com/en/dispatcher-arrested-game-linked-to-bad-aibling-crash/a-19182092

Bigger question is what kind of Dispatching System facilitated trains with overlaping authority.

[NorthWest]

http://www.dw.com/en/dispatcher-arrested-game-linked-to-bad-aibling-crash/a-19182092

[Euclid]

tree68

 

Euclid

Here, the operator was unlucky in lighting his lantern.

 

 

A fatal incident ca 1906 on the Adirondack Division was the direct result of one engineer covering up part of the writing on his train order with his thumb as he read it.

Thus he missed the fact that he was supposed to wait on second number whatever...

I agree - mistake or no, the players in this incident have to live with it, as do all crew members involved in incidents, and particularly those with a bad outcome.  We've talked about this before.

 

I was doing some research on historical train wrecks, and had copies made from the Railroad Gazette in the 1880-90 era.  They complied a monthly listing of train accidents in the U.S.  They go into every detail, and it is fascinating to realize how much could go wrong back in that timeframe.  There was more than one instance of brakemen riding the roof of a boxcar as it sailed through the air after being blown off the car in a high wind. 

[zugmann]

Deggesty

If good intentions "Pave the road to ----,: what do the best of intentions do?

 

Only to serve that we are still humans.

[Deggesty]

If good intentions "Pave the road to ----,: what do the best of intentions do?

[schlimm]

It is also sad that the dispatcher had the best of intentions.

[tree68]

Euclid

Here, the operator was unlucky in lighting his lantern.

A fatal incident ca 1906 on the Adirondack Division was the direct result of one engineer covering up part of the writing on his train order with his thumb as he read it.

Thus he missed the fact that he was supposed to wait on second number whatever...

I agree - mistake or no, the players in this incident have to live with it, as do all crew members involved in incidents, and particularly those with a bad outcome.  We've talked about this before.

[Wizlish]

Amen.

[groomer man]

I just have this to say. Say a prayer for the dead and their grieving families but also for the dispatcher who made this grave error. He has to live with this the rest of his life and that's a heavy burden for a human heart

[Wizlish]

BaltACD

If we want to go to history - the O&M provides many examples of all forms of failures

Dear Lord, it was worse than Mellen's New Haven to Clarence Day!  (Or so that presentation puts it.)

[BaltACD]

Euclid

Here, the operator was unlucky in lighting his lantern.

From The Railroad Gazette:

 

February 1890

17^th, 7 p.m., on Cincinnati, Hamilton & Dayton, at Winton Place, O., a southbound accommodation train which had just left the station was run into at the rear by a fast express train, the engine of the latter, the “A. G. Darwin,” demolishing one-half the rear car of the accommodation, badly damaging the others, and overturning stoves or lamps sufficiently to start fire in several places.  The rear car of the accommodation was a combination baggage and express car, and there were but few passengers in it.  Three passengers and two trainmen killed, two passengers and two trainmen injured.  The block system is in use on this portion of the road, and the collision resulted from a wrong signal given at Carthage. 

The operator was anxious to avoid delaying the express, and so concluded to give its engineer the caution signal instead of holding him until the block was clear.  It appears that a caution signal is given by showing white by the semaphore and green by a hand lantern, and that the operator displayed the fixed white signal before he had succeeded in lighting his lantern with which to give the green signal.  While he was trying to light the lantern the express train passed by.

http://cincyrails.com/files/FromTheOhioToTheMississippi.pdf

If we want to go to history - the O&M provides many examples of all forms of failures

[n012944]

schlimm

 

 

n012944

Semantics?  Not at all.  I have been critical of the dispatcher.  What is telling is that you are so excited to be able to place blame on a railroad employee, that you won't listen to people who DO THE JOB, as to why he shouldn't have been able to do what he did.    

 

 

  Did you design an ATC?   Neither did I, 

 

Strawman argument.  A pilot does not need to design an aircraft to know that being able to retract the landing gear while still on the ground is unsafe.

[Euclid]

Here, the operator was unlucky in lighting his lantern.

From The Railroad Gazette:

 

February 1890

17^th, 7 p.m., on Cincinnati, Hamilton & Dayton, at Winton Place, O., a southbound accommodation train which had just left the station was run into at the rear by a fast express train, the engine of the latter, the “A. G. Darwin,” demolishing one-half the rear car of the accommodation, badly damaging the others, and overturning stoves or lamps sufficiently to start fire in several places.  The rear car of the accommodation was a combination baggage and express car, and there were but few passengers in it.  Three passengers and two trainmen killed, two passengers and two trainmen injured.  The block system is in use on this portion of the road, and the collision resulted from a wrong signal given at Carthage. 

The operator was anxious to avoid delaying the express, and so concluded to give its engineer the caution signal instead of holding him until the block was clear.  It appears that a caution signal is given by showing white by the semaphore and green by a hand lantern, and that the operator displayed the fixed white signal before he had succeeded in lighting his lantern with which to give the green signal.  While he was trying to light the lantern the express train passed by.

[BaltACD]

Can't speak to the German way of doing things!

Dispatchers in the US - DO NOT have the ability to change the Book of Rules on verbal authority.  If trains have a Red (Stop) signal in the field, they must comply with the signal indication.  The Dispatcher may give the permission to pass the Stop indication, however, they must not exceed Restricted Speed until they observe a more permissive signal indication. 

NO TRAIN IS GIVEN PERMISSION TO PASS A STOP SIGNAL AT TRACK SPEED.

[Wizlish]

tree68

If we're lucky, some backup mechanism will catch the error. If not...

With almost all the history of train control from the first use of Morse on the Erie, and the practical design of almost every system, being to get that "lucky" factor out of the question.  Any system that relies on luck is likely to be little more effective than one that relies on prayer from typical railroaders .

[tree68]

Euclid

Did he forget about the opposing train?

Stranger things have been known to pass.  

We have no idea at this point what other activities/operations he may have been involved with.  Dispatching can be like a big chess game, and if he forgot he left a piece hanging out there, well...

Even in this country, a dispatcher may have under his/her purview several hundred miles of track.  What sometimes happens is that a "perfect storm" of circumstances coalesce, leading to some dire result.  If we're lucky, some backup mechanism will catch the error. If not...

[Euclid]

n012944

I’m pretty certain, given the speed of the collision, that the section of track outside the stations between Rosenheim and Holzkirchen was not equipped with any mechanisms for registering occupancy, and communicating that occupancy to trains in the section.  

n012944,

It sounds like you are suggesting that the signals will automatically stop a train if it passes a signal displaying “stop,” but those signals are controlled from the “office” without any input from actual track occupancy.  Therefore, it would automatically enforce a stop signal on a train, and yet leave the control of the signals wide open to human error. 

I guess that would explain the possibility of the crash, but it seems like a bizarre system.

What is unclear to me is how the operator allowed the train to escape the automatic system.  One possibility would be as I said above where the operator gave verbal permission to pass the stop signal, and shut off the automatic stop system.  The other possibility is that the operator simply changed the signal from stop to clear.  That would be possible if the whole system had no track occupancy detection as you suggest.  

I still would like to know what explains the human error of the operator.  Did he forget about the opposing train?

[Wizlish]

cx500

What is surprising to me is that BOTH trains were allegedly travelling at full speed. That would suggest that the signalman was able to completely defeat the signal logic and provide a clear signal. If given verbal permission to pass a stop signal, most (if not all) North American rules require restricted speed until reaching the next signal.

I think that it is precisely this that constitutes the reason the dispatcher is being criminally investigated.

But to invoke James Reason for a moment, there's also some cultural aspect to this thing, which I hesitate to define fully ... the cultural aspect that gave the train crew the idea that it was OK to go as fast as possible because 'someone in authority indicated to them it was OK' and an ATC system where what is not mandatory is forbidden did not forbid.  I don't want to draw any comparison with Tom Lehrer's 'they've hardly bothered us since then' but I have to wonder, strongly, how much of that 'side' of the collision involves this.

[cx500]

Several aspects puzzle me. 

First of all, there needs to be a mechanism where human decision can override the signal logic.  Yes, it creates a weakness in the system, but hardware does fail occasionally and can take hours to replace.  Completely shutting down a busy line that thousands depend on for transportation is not realistic, as the backlog cascades back into other routes.  We are not talking minutes but hours, maybe even a day.

What is surprising to me is that BOTH trains were allegedly travelling at full speed.  That would suggest that the signalman was able to completely defeat the signal logic and provide a clear signal.  If given verbal permission to pass a stop signal, most (if not all) North American rules require restricted speed until reaching the next signal.

[Wizlish]

schlimm

 

 

n012944

Semantics?  Not at all.  I have been critical of the dispatcher.  What is telling is that you are so excited to be able to place blame on a railroad employee, that you won't listen to people who DO THE JOB, as to why he shouldn't have been able to do what he did.    

Of course it is a case of semantics: broad vs narrow definitions.  Did you design an ATC?   Neither did I, but I can find, read and if necessary, translate reports of an accident.  Can you?

 

As it happens, my father did his senior thesis on automatic train control, and there is at least one reference available via the ten90 Web site for what promises to be a history of positive train control all the way up through the millenium, so there is no need to speculate about the characteristics of the train control system 'either'.  The German name of the system (which even Schanoes didn't seem to figure out) translates readily to 'intermittent train control' which is immediately recognizable in the literature as being ... well, intermittent, meaning accomplishing by electric means what a signal would do by optical means: transmitting an indication of stop, proceed, etc. to the train.  This is no different, really, from mechanical ATC systems like the type used on the NYC subway system; once the train has passed the raised trip location, the 'safety system' will not stop the train no matter what is done.  "Shutting off" a system like PZB involves nothing more complicated than keeping a given inductor from sending a signal to a receiver passing over it.

 

Probably the fullest extent that this discussion could or should go into the happy world of engineering shoulda-woulda-coulda is whether this system ACTIVATES the inductor to stop the train or, as I think I'd prefer, assumes the most RESTRICTIVE indication it can, functionally, when there is no power applied.  (At least one British intermittent system had a fixed magnet that was opposed by the applied modulation current, so with power off it still induced the right effect at the receiver.)   Now, I haven't read enough about PZB internals to say conclusively, but I strongly suspect that what was needed to suppress a nominal 'red board' was to apply the equivalent of a short to the inductor, so the train received no restrictive signal.  Note that this is a different character of control act from 'turning a switch off' to disable something: it is a conscious decision to modulate something.  (In this case, just as poor a choice as that guy in Spuyten Duyvil on the NYC west side line in the mid-'60s...)

 

I keep seeing discussion about how a proper safety system would stop the train short of a collision, enforce restricted speed, etc.  Let me repeat that an intermittent ATC is no different from an ordinary block signal in this respect.  However, it seemed pretty clear to me as a child, and it seems reasonably clear now, that any 'default' or 'uncontrolled' indication that passes a PZB 'signal' should be no different from rules for home and distant signals, or the restricted speed that applies for banner tests -- this being in two parts, the 'signal indication' actually displayed in the cab and the rules (and rules-following culture, something reputed to be common in Germany) that back it up.

 

So any action, whether key-by or due to failure of energization, would produce (1) a restrictive warning to the operators on the train, and (2) clear indication that they needed to proceed 'able to stop within 1/2 sight distance' or reasonable facsimile.

 

That shoulda-woulda-coulda handled one-half of the accident, but not necessarily the other.  Another detail of PZB I don't know is whether, when the inductor at a given location is bypassed, the 'facing' indicators change to most restrictive indication also ... of course, if the opposing train had passed the last inductor before then, they wouldn't know (and under the circumstances it is just plain wrong to blame them for any aspect of permitted speed or vigilance, other than the patently unfair one of expecting them to stop short at any time in an ATC-protected block they had no restricting indication from).