Nine Dead 150 Injured - Never Should Have Happened

[Leo_Ames]

BaltACD

 

 

schlimm

It's telling that you chose to omit the final responses made between wizlish and I, that we were quibbling about semantics of a narrow vs broader meaning of 'system.'  I was simply providing a service by translating articles.  And passing on the conclusions of the investigation.  The dispatcher switched from the PLZ-90 to an alternate signaling device, according to reports.  FYI: Fail-safe means that a device will not endanger lives or property when it fails.  The PLZ-90 did not malfunction of fail.  It was bypassed by the dispatcher legitimately  to allow what he thought would be a safe meet.

BTW, all systems (in the broad sense) can fail.  Automated systems are clearly safer than when humans interfere.

 

 

A signal system that can be 'switched off' without a exhustive series of checks and balances, that affect all trains in the territory of operation is a FAILED system.

 

Exactly

A system that allowed operator error of this kind to enter the equation isn't a system that did its job properly. It's supposed to prevent human error by a dispatcher or train crew, not allow it to happen.  

[n012944]

schlimm

I used the phrase because that is what the articles said and because that was determined to be the primary cause of the crash.  You avoid using the term because you have a vested interest.

 

Avoid using the term?  You might want to reread my posts, as I have used "the term" in everyone of my posts.  The issue is that there was two cases of human error.  The dispatcher for doing what he did, and the system designer for designing the system to allow the dispatcher to do what he did.

 

 

[schlimm]

n012944

Avoid using the term?  You might want to reread my posts, as I have used "the term" in everyone of my posts.  The issue is that there was two cases of human error.  The dispatcher for doing what he did, and the system designer for designing the system to allow the dispatcher to do what he did.

Semantics.  But it is telling that for a system as flawed in design as some suggest, this is the first and only time that a human manipulated the PLZ-90 in a manner that caused any problem.

[n012944]

schlimm

 

 

n012944

Avoid using the term?  You might want to reread my posts, as I have used "the term" in everyone of my posts.  The issue is that there was two cases of human error.  The dispatcher for doing what he did, and the system designer for designing the system to allow the dispatcher to do what he did.

 

 

Semantics.  But it is telling that for a system as flawed in design as some suggest, this is the first and only time that a human manipulated the PLZ-90 in a manner that caused any problem.

 

Semantics?  Not at all.  I have been critical of the dispatcher.  What is telling is that you are so excited to be able to place blame on a railroad employee, that you won't listen to people who DO THE JOB, as to why he shouldn't have been able to do what he did.  

 

 

[schlimm]

n012944

Semantics?  Not at all.  I have been critical of the dispatcher.  What is telling is that you are so excited to be able to place blame on a railroad employee, that you won't listen to people who DO THE JOB, as to why he shouldn't have been able to do what he did.    

Of course it is a case of semantics: broad vs narrow definitions.  Did you design an ATC?   Neither did I, but I can find, read and if necessary, translate reports of an accident.  Can you?

[Euclid]

Here is a link stating that the cause was human error:

http://www.bbc.com/news/world-europe-35585302

 

If I understand this, a train was approaching a stop signal, and the operator did not want to delay that train by having it stop for that signal.  So apparently, he gave the engineer permission to pass that stop signal without stopping or slowing.

However, the automatic system would have caused braking to stop a train if it passed a stop signal.  Therefore, in order to prevent the automatic system from stopping the train that had been given permission to pass the stop signal; the operator turned off the automatic system. 

I agree that it seems very odd that the automatic system could be directly overridden in that manner.  However, the top question in my mind is this:

If the operator gave permission to pass the stop signal, he must have believed that there was no train conflict ahead of that stop signal.  So then what did the operator believe was the explanation for the stop signal?

The only thing that I can think of is that the operator forgot about the conflicting train and assumed that the signal was displaying a stop indication due to a malfunction.  However, that would be incredibly odd to both forget about the conflicting train and then fail to be reminded about the conflicting train by the existence of the stop signal. 

How many months will pass before we get the answer to this simple question?

[n012944]

http://www.railwayage.com/index.php/blogs/david-schanoes/why-occupancy-=-vitality.html?channel=00

 

"Occupancy = vitality. And you want to know the great, great advance U.S. railroads made in signal control systems? It begins way back in the 1870s, with the design, testing and installation of the closed track circuit.

You know what that did? That separated the “office” from the “field” in the determination of track occupancy. Now the register of the condition of the track, occupied/unoccupied, no longer existed simply in the block operator’s memory, or on the train dispatcher’s train sheet, but in the field itself, and that register, that information, could be communicated, by signals, to trains following and/or opposing that train’s movement. Pure genius, almost.

I’m pretty certain, given the speed of the collision, that the section of track outside the stations between Rosenheim and Holzkirchen was not equipped with any mechanisms for registering occupancy, and communicating that occupancy to trains in the section. So once the signal was displayed and the westbound was allowed into the block, the only thing that might have prevented a collision was line of sight distance.

Now, it’s possible that something else is the cause; that something somewhere malfunctioned to produce a “false clear”—the signal engineer’s nightmare, equivalent to the train dispatcher writing a lap order—and that the human operator in charge of the signals did not improperly authorize movement into the section of track.

That’s possible. But that doesn’t change the fact that such systems as PZB do not remedy the underlying, and fatal, weakness of any train control system that is not based—first, last and always, on the separation of the field from the office in determining occupancy."

[Wizlish]

schlimm

 

 

n012944

Semantics?  Not at all.  I have been critical of the dispatcher.  What is telling is that you are so excited to be able to place blame on a railroad employee, that you won't listen to people who DO THE JOB, as to why he shouldn't have been able to do what he did.    

Of course it is a case of semantics: broad vs narrow definitions.  Did you design an ATC?   Neither did I, but I can find, read and if necessary, translate reports of an accident.  Can you?

 

As it happens, my father did his senior thesis on automatic train control, and there is at least one reference available via the ten90 Web site for what promises to be a history of positive train control all the way up through the millenium, so there is no need to speculate about the characteristics of the train control system 'either'.  The German name of the system (which even Schanoes didn't seem to figure out) translates readily to 'intermittent train control' which is immediately recognizable in the literature as being ... well, intermittent, meaning accomplishing by electric means what a signal would do by optical means: transmitting an indication of stop, proceed, etc. to the train.  This is no different, really, from mechanical ATC systems like the type used on the NYC subway system; once the train has passed the raised trip location, the 'safety system' will not stop the train no matter what is done.  "Shutting off" a system like PZB involves nothing more complicated than keeping a given inductor from sending a signal to a receiver passing over it.

 

Probably the fullest extent that this discussion could or should go into the happy world of engineering shoulda-woulda-coulda is whether this system ACTIVATES the inductor to stop the train or, as I think I'd prefer, assumes the most RESTRICTIVE indication it can, functionally, when there is no power applied.  (At least one British intermittent system had a fixed magnet that was opposed by the applied modulation current, so with power off it still induced the right effect at the receiver.)   Now, I haven't read enough about PZB internals to say conclusively, but I strongly suspect that what was needed to suppress a nominal 'red board' was to apply the equivalent of a short to the inductor, so the train received no restrictive signal.  Note that this is a different character of control act from 'turning a switch off' to disable something: it is a conscious decision to modulate something.  (In this case, just as poor a choice as that guy in Spuyten Duyvil on the NYC west side line in the mid-'60s...)

 

I keep seeing discussion about how a proper safety system would stop the train short of a collision, enforce restricted speed, etc.  Let me repeat that an intermittent ATC is no different from an ordinary block signal in this respect.  However, it seemed pretty clear to me as a child, and it seems reasonably clear now, that any 'default' or 'uncontrolled' indication that passes a PZB 'signal' should be no different from rules for home and distant signals, or the restricted speed that applies for banner tests -- this being in two parts, the 'signal indication' actually displayed in the cab and the rules (and rules-following culture, something reputed to be common in Germany) that back it up.

 

So any action, whether key-by or due to failure of energization, would produce (1) a restrictive warning to the operators on the train, and (2) clear indication that they needed to proceed 'able to stop within 1/2 sight distance' or reasonable facsimile.

 

That shoulda-woulda-coulda handled one-half of the accident, but not necessarily the other.  Another detail of PZB I don't know is whether, when the inductor at a given location is bypassed, the 'facing' indicators change to most restrictive indication also ... of course, if the opposing train had passed the last inductor before then, they wouldn't know (and under the circumstances it is just plain wrong to blame them for any aspect of permitted speed or vigilance, other than the patently unfair one of expecting them to stop short at any time in an ATC-protected block they had no restricting indication from).

[cx500]

Several aspects puzzle me. 

First of all, there needs to be a mechanism where human decision can override the signal logic.  Yes, it creates a weakness in the system, but hardware does fail occasionally and can take hours to replace.  Completely shutting down a busy line that thousands depend on for transportation is not realistic, as the backlog cascades back into other routes.  We are not talking minutes but hours, maybe even a day.

What is surprising to me is that BOTH trains were allegedly travelling at full speed.  That would suggest that the signalman was able to completely defeat the signal logic and provide a clear signal.  If given verbal permission to pass a stop signal, most (if not all) North American rules require restricted speed until reaching the next signal.

[Wizlish]

cx500

What is surprising to me is that BOTH trains were allegedly travelling at full speed. That would suggest that the signalman was able to completely defeat the signal logic and provide a clear signal. If given verbal permission to pass a stop signal, most (if not all) North American rules require restricted speed until reaching the next signal.

I think that it is precisely this that constitutes the reason the dispatcher is being criminally investigated.

But to invoke James Reason for a moment, there's also some cultural aspect to this thing, which I hesitate to define fully ... the cultural aspect that gave the train crew the idea that it was OK to go as fast as possible because 'someone in authority indicated to them it was OK' and an ATC system where what is not mandatory is forbidden did not forbid.  I don't want to draw any comparison with Tom Lehrer's 'they've hardly bothered us since then' but I have to wonder, strongly, how much of that 'side' of the collision involves this.

[Euclid]

n012944

I’m pretty certain, given the speed of the collision, that the section of track outside the stations between Rosenheim and Holzkirchen was not equipped with any mechanisms for registering occupancy, and communicating that occupancy to trains in the section.  

n012944,

It sounds like you are suggesting that the signals will automatically stop a train if it passes a signal displaying “stop,” but those signals are controlled from the “office” without any input from actual track occupancy.  Therefore, it would automatically enforce a stop signal on a train, and yet leave the control of the signals wide open to human error. 

I guess that would explain the possibility of the crash, but it seems like a bizarre system.

What is unclear to me is how the operator allowed the train to escape the automatic system.  One possibility would be as I said above where the operator gave verbal permission to pass the stop signal, and shut off the automatic stop system.  The other possibility is that the operator simply changed the signal from stop to clear.  That would be possible if the whole system had no track occupancy detection as you suggest.  

I still would like to know what explains the human error of the operator.  Did he forget about the opposing train?

[tree68]

Euclid

Did he forget about the opposing train?

Stranger things have been known to pass.  

We have no idea at this point what other activities/operations he may have been involved with.  Dispatching can be like a big chess game, and if he forgot he left a piece hanging out there, well...

Even in this country, a dispatcher may have under his/her purview several hundred miles of track.  What sometimes happens is that a "perfect storm" of circumstances coalesce, leading to some dire result.  If we're lucky, some backup mechanism will catch the error. If not...

[Wizlish]

tree68

If we're lucky, some backup mechanism will catch the error. If not...

With almost all the history of train control from the first use of Morse on the Erie, and the practical design of almost every system, being to get that "lucky" factor out of the question.  Any system that relies on luck is likely to be little more effective than one that relies on prayer from typical railroaders .

[BaltACD]

Can't speak to the German way of doing things!

Dispatchers in the US - DO NOT have the ability to change the Book of Rules on verbal authority.  If trains have a Red (Stop) signal in the field, they must comply with the signal indication.  The Dispatcher may give the permission to pass the Stop indication, however, they must not exceed Restricted Speed until they observe a more permissive signal indication. 

NO TRAIN IS GIVEN PERMISSION TO PASS A STOP SIGNAL AT TRACK SPEED.

[Euclid]

Here, the operator was unlucky in lighting his lantern.

From The Railroad Gazette:

 

February 1890

17^th, 7 p.m., on Cincinnati, Hamilton & Dayton, at Winton Place, O., a southbound accommodation train which had just left the station was run into at the rear by a fast express train, the engine of the latter, the “A. G. Darwin,” demolishing one-half the rear car of the accommodation, badly damaging the others, and overturning stoves or lamps sufficiently to start fire in several places.  The rear car of the accommodation was a combination baggage and express car, and there were but few passengers in it.  Three passengers and two trainmen killed, two passengers and two trainmen injured.  The block system is in use on this portion of the road, and the collision resulted from a wrong signal given at Carthage. 

The operator was anxious to avoid delaying the express, and so concluded to give its engineer the caution signal instead of holding him until the block was clear.  It appears that a caution signal is given by showing white by the semaphore and green by a hand lantern, and that the operator displayed the fixed white signal before he had succeeded in lighting his lantern with which to give the green signal.  While he was trying to light the lantern the express train passed by.

[n012944]

schlimm

 

 

n012944

Semantics?  Not at all.  I have been critical of the dispatcher.  What is telling is that you are so excited to be able to place blame on a railroad employee, that you won't listen to people who DO THE JOB, as to why he shouldn't have been able to do what he did.    

 

 

  Did you design an ATC?   Neither did I, 

 

Strawman argument.  A pilot does not need to design an aircraft to know that being able to retract the landing gear while still on the ground is unsafe.

[BaltACD]

Euclid

Here, the operator was unlucky in lighting his lantern.

From The Railroad Gazette:

 

February 1890

17^th, 7 p.m., on Cincinnati, Hamilton & Dayton, at Winton Place, O., a southbound accommodation train which had just left the station was run into at the rear by a fast express train, the engine of the latter, the “A. G. Darwin,” demolishing one-half the rear car of the accommodation, badly damaging the others, and overturning stoves or lamps sufficiently to start fire in several places.  The rear car of the accommodation was a combination baggage and express car, and there were but few passengers in it.  Three passengers and two trainmen killed, two passengers and two trainmen injured.  The block system is in use on this portion of the road, and the collision resulted from a wrong signal given at Carthage. 

The operator was anxious to avoid delaying the express, and so concluded to give its engineer the caution signal instead of holding him until the block was clear.  It appears that a caution signal is given by showing white by the semaphore and green by a hand lantern, and that the operator displayed the fixed white signal before he had succeeded in lighting his lantern with which to give the green signal.  While he was trying to light the lantern the express train passed by.

http://cincyrails.com/files/FromTheOhioToTheMississippi.pdf

If we want to go to history - the O&M provides many examples of all forms of failures

[Wizlish]

BaltACD

If we want to go to history - the O&M provides many examples of all forms of failures

Dear Lord, it was worse than Mellen's New Haven to Clarence Day!  (Or so that presentation puts it.)

[groomer man]

I just have this to say. Say a prayer for the dead and their grieving families but also for the dispatcher who made this grave error. He has to live with this the rest of his life and that's a heavy burden for a human heart

[Wizlish]

Amen.

[tree68]

Euclid

Here, the operator was unlucky in lighting his lantern.

A fatal incident ca 1906 on the Adirondack Division was the direct result of one engineer covering up part of the writing on his train order with his thumb as he read it.

Thus he missed the fact that he was supposed to wait on second number whatever...

I agree - mistake or no, the players in this incident have to live with it, as do all crew members involved in incidents, and particularly those with a bad outcome.  We've talked about this before.

[schlimm]

It is also sad that the dispatcher had the best of intentions.

[Deggesty]

If good intentions "Pave the road to ----,: what do the best of intentions do?

[zugmann]

Deggesty

If good intentions "Pave the road to ----,: what do the best of intentions do?

 

Only to serve that we are still humans.

[Euclid]

tree68

 

Euclid

Here, the operator was unlucky in lighting his lantern.

 

 

A fatal incident ca 1906 on the Adirondack Division was the direct result of one engineer covering up part of the writing on his train order with his thumb as he read it.

Thus he missed the fact that he was supposed to wait on second number whatever...

I agree - mistake or no, the players in this incident have to live with it, as do all crew members involved in incidents, and particularly those with a bad outcome.  We've talked about this before.

 

I was doing some research on historical train wrecks, and had copies made from the Railroad Gazette in the 1880-90 era.  They complied a monthly listing of train accidents in the U.S.  They go into every detail, and it is fascinating to realize how much could go wrong back in that timeframe.  There was more than one instance of brakemen riding the roof of a boxcar as it sailed through the air after being blown off the car in a high wind. 

[NorthWest]

http://www.dw.com/en/dispatcher-arrested-game-linked-to-bad-aibling-crash/a-19182092

[BaltACD]

NorthWest

http://www.dw.com/en/dispatcher-arrested-game-linked-to-bad-aibling-crash/a-19182092

Bigger question is what kind of Dispatching System facilitated trains with overlaping authority.

[samfp1943]

BaltACD

 

NorthWest

http://www.dw.com/en/dispatcher-arrested-game-linked-to-bad-aibling-crash/a-19182092

 

 

Bigger question is what kind of Dispatching System facilitated trains with overlaping authority.

 

A partial answer to BaltACD's question is found on the following linked site @ http://www.dw.com/en/after-bad-aibling-railway-safety-in-europe/a-19037919  "After Bad Aibling: railway safety in Europe"

FTA"...There is currently no unified system in place that has trains respond to the same signals. How exactly trains stop when a break signal doesn't work, a question that might have played a role in the Bad Aibling disaster, varies from country to country, because rail transport systems have historically developed on a national, not an EU-wide basis.

The goal is to get all railway route networks under one umbrella, so that train travel is equally safe in all EU member states - and that's what the European Train Control System (ETCS) was developed for..."

And then there was this information from the same article :

"...Open-source software makes ETCS more affordable

The ETCS is supposed to replace the many incompatible safety systems operated in the EU, especially on high-speed lines. It deals with signaling and train protection, among other issues.

The basic idea of one common train and railway system has been around for decades. The specifications put forth by the ETCS are accepted Europe-wide, but there are several national exceptions to individual guidelines. Integrating all this into one standard that all trains from Rome to Stockholm and from Lisbon to Bucharest run on is a - rather difficult - work in progress..."

Then finally they have included the folowing admission that seems to sum up the whole problem(?) in the EU... "..."OpenETCS" is supposed to lower costs and expenditure of the system's implementation. So far, there are no trains equipped with ETCS that fulfill all regulations of all European railways. The developers of the open-source software hope that their freely accessible, cost-efficient "openETCS" will be installed on all new trains that are being built now..."   [emphasis added !]

[Euclid]

I would like to see a detailed explanation of exactly how the said mistake of the one employee occurred and caused this collision.  The general way that it has been described seems like the control system is faulty in its design by allowing a simple mistake to cause a catastrophe.

[ramrod]

It appears to me that most commentators on this thread assume or believe that the culture, rules, job standards, traditions and practices of the German railways and their regulating and standards agencies are virtually identical to those in the US and Canada. I have no doubt there are similarities among them, but I would expect there are major differences as well.It would be helpful if someone who knows both US and German systems could point out the major differences to help us understand why and how this accident occurred.