BaltACDOnce rules have been written in Gotcha the employee is always the violater and the company is held harmless. I suspect this applies to all the the companies that operate....
Euclid The following actions should be taken by rail transport operators utilizing ECP braking systems: Conduct an assessment of the interaction between the ECP braking system and the mechanical pneumatic braking system following an unexpected (penalty) braking intervention on a train configured for ECP braking. Determine whether the ECP braking system is designed to the AAR S-4200 standard Determine whether the sixty minute release has been programmed within the ECP braking software Conduct a risk assessment on the use of ECP braking for the prevention of the event of a rollaway incident. Conduct a risk assessment on the effectiveness of the ATP system in the event of an ECP braking system failure. This advice is effective immediately Peter, Thanks for clarifying that. I don’t quite understand the basis of the above recommendations from the National Rail Safety Regulator. The statement uses terms such as “determine whether” and “conduct a risk assessment,” and “conduct an assessment of the interaction.” The terms suggest that the behavior of these operational details is not known and must be learned due to what has been revealed by the BHP runaway. Why would there be any question as to the risk, the programming, the interaction between braking types, and effectiveness of the ATP system? It would seem that the entire system did what was intended.
The following actions should be taken by rail transport operators utilizing ECP braking systems:
Conduct an assessment of the interaction between the ECP braking system and the mechanical pneumatic braking system following an unexpected (penalty) braking intervention on a train configured for ECP braking.
Determine whether the ECP braking system is designed to the AAR S-4200 standard
Determine whether the sixty minute release has been programmed within the ECP braking software
Conduct a risk assessment on the use of ECP braking for the prevention of the event of a rollaway incident.
Conduct a risk assessment on the effectiveness of the ATP system in the event of an ECP braking system failure.
This advice is effective immediately
Peter,
Thanks for clarifying that. I don’t quite understand the basis of the above recommendations from the National Rail Safety Regulator. The statement uses terms such as “determine whether” and “conduct a risk assessment,” and “conduct an assessment of the interaction.”
The terms suggest that the behavior of these operational details is not known and must be learned due to what has been revealed by the BHP runaway. Why would there be any question as to the risk, the programming, the interaction between braking types, and effectiveness of the ATP system? It would seem that the entire system did what was intended.
That bulletin is the first thing I have ever seen from the Office of the National Rail Safety Regulator. I've checked their website since and they have some interesting annual statistical summaries. They issue occasional bulletins as listed on the website.
Normally, we would expect the Australian Transportation Safety Board to investigate this incident. A preliminary summary is on their website. But apparently ATSB didn't go up to the site, but ONRSR did.
This might be explained by your comment that everything worked as designed.
ONRSR may have gone to site precisely because everything worked as designed and a serious incident resulted.ATSB didn't because there was nothing to investigate - the problem was the system working as intended.
I know nothing about the ONRSR personnel but I assume some of them have rail experience. The location of the head office was decided by determining which state needed the most Federal Money to stay solvent and they got the new organisation.
The statements about the ECP system suggest there may be ECP systems that don't comply with AAR S-4200. If so I haven't seen any. Every connector I've seen on any system is to the AAR pattern. Every labelled control box indicates S-4200 compliance. Perhaps they are just hedging their bets or perhaps they haven't actually gone out and looked.
The ATP comments are different. Each system has probably specified slightly different systems, although they are probably built from a standard set of components. As has been indicated earlier, I don't think BHP realised that their system would not stop a train under the conditions that occurred as a result of the ECP shutdown. In retrospect, the problem is clear, but it probably didn't occur to the ATP designers that some features buried in S-4200 would rise up and bite them.
Operators should check their ATP systems, if any, to see if an ECP shutdown will render it ineffective. I don't know if FMG and Roy Hill have ATP but I doubt it. Rio Tinto obviously have such a system although the Autohaul remote control should allow directed air brake application indepedent of ECP or an ATP warning anyway.
ATP is used in Queensland but on main lines, not on the heavy haul coal lines and I think ECP is only used on the coal lines (but not by all operators yet).
I have a photo taken in August 2004 from the 210km, showing a train hauled by an AC6000CW and an SD40 approaching. in the background, I can see the train continuing through the 211 km where the train in question was stopped by the open connector.
It is early afternoon and the sun is shining from a blue sky on the blue green bluffs forming the Chichester ranges.
Had the ATP worked, the runaway would have been stopped as it passed the location from which I took the photo.
The locomotive crewman's error allowed the train to run one kilometre.
The failure of the ATP system allowed to run another 91 km, accelerating to 110km/h (70mph).
Peter
BaltACD Second - Lawyers write the rules in a language known as 'Gotcha'. Once rules have been written in Gotcha the employee is always the violater and the company is held harmless.
Second - Lawyers write the rules in a language known as 'Gotcha'. Once rules have been written in Gotcha the employee is always the violater and the company is held harmless.
That pretty much applies to rules established by any employer. OTOH, the one-sidedness of the rules have on occasion been used against the employer in court.
Euclid. Why would there be any question as to the risk, the programming, the interaction between braking types, and effectiveness of the ATP system? It would seem that the entire system did what was intended.
It seems to me that BHP releasing this new directive about the hidden hazard of the brake program is admitting that they were blindsided by it just like the engineer was. I think they owe an apology.
Your quote was from the bulletin issued by the Office of the National Rail Safety Regulator, not BHP, the operator of the train.
The purpose of the bulletin was to warn the other operators using similar ECP brakes that this condition could affect them.
Trains with ECP braking complying with AAR S-4200 operate on three other iron ore systems in Western Australia and coal trains are operated by three operators on state owned track in the New South Wales Hunter Valley and by three operators in Central Queensland. There are stone aggregate trains in southern NSW that use S-4200 ECP brakes. All the trains outside Western Australia operate on track shared with frequent passenger trains.
This is an official warning to operators from a Federal Government agency.
The first thing to remember about railroad rules in the 21st Century. The Lawyers get the final say on how the rules are stated no matter what the railroader or the bean counters want the rules to state. Second - Lawyers write the rules in a language known as 'Gotcha'. Once rules have been written in Gotcha the employee is always the violater and the company is held harmless. I suspect this applies to all the the companies that operate trains on steel rails for whatever the purpose and whatever the language.
Never too old to have a happy childhood!
From BHP Safety Alert No. RSA-20ID-002 (in red text):
“ECP braking systems that comply with the American Association of Railroads standard AAR S-4200 have a software feature designed to preserve battery life on the ECP fitted wagons by releasing the electronic brakes on a train in circumstances where:
An electronic brake is applied by the ECP system
There is no communications between the ECP system on board the lead locomotive and the end of train; and
Sixty minutes has elapsed from the last communication.
Where these conditions exist the ECP braking system will release creating the risk of a rollaway incident unless the air pressure within the braking system has been released to atmosphere.”
In this wreck, the three conditions did exist, and so the system automatically released the brakes for the purpose of preserving battery life. This seems characteristic of the programing culture that tends to include features intended to snare us to prove a point. Walmart automatic checkout has a handy feature in which it dumps all of your scan data if you pause just a little too long—Gotcha! Then you must take all your items out of the bags and scan them again.
In the case of BHP, the need to make a pneumatic application in order to prevent ECP from automatically releasing in one hour is entirely counter-intuitive, relying solely on a human operator to remember the procedure step. If the operator happens to overlook this fine point—Gotcha! The automatic system proves it is smarter than the operator who is left to take the blame for a $50 million runaway.
Which is worse: A massive wreck that destroys most of an entire loaded train; or a train with dead batteries?
The Australian Office of the Rail Safety Regulator has shut the stable door some days after the horse bolted...
https://www.onrsr.com.au/__data/assets/pdf_file/0020/22475/Safety-Alert-RSA-2018-002-ECP-Braking.pdf
If anyone finds an ECP system not configured to AAR S-4200, i'd be amazed...
The week after the derailment, BHP was fined $A 500 million for tax evasion.
The derailment was not significant compared to that.
M636C Paul of Covington I'm still trying to figure out someone's logic in deciding the piority when designing the system: In order to save battery power you release the brakes on a train. (Edit:) I was writing this while Euclid was writing his entry. Doesn't the system still have the emergency application capability if the train air drops? It seems like that would be the logical way to do it when the time expires. At least in theory, you have the oprtion to tell the system to leave the brakes on by making a pneumatic brake application. This apparently tells the system that brakes are required and the ECP Emergency Application does not cancel after one hour. If you don't make such an application, the system u nderstands that brakes aren't required and turns of the ECP signal and the CCD units, releasing the brakes. "It probably seemed quite logical to the Committee at the time." But I'm not trying to say that it was a good idea. The thinking was that after a breakdown of ECP communication, the train would have to continue using air brakes and the batteries were needed to operate the air valves. BHP only have one type of locomotive, around 180 SD70ACes, all of which have ECP braking, so the likelihood of needing to use the air brakes isn't that great. But this was an AAR Committee who expected ECP to be an exception among conventional trains. So their thinking was to be able to run the train using air brakes after any ECP failure. Peter
Paul of Covington I'm still trying to figure out someone's logic in deciding the piority when designing the system: In order to save battery power you release the brakes on a train. (Edit:) I was writing this while Euclid was writing his entry. Doesn't the system still have the emergency application capability if the train air drops? It seems like that would be the logical way to do it when the time expires.
I'm still trying to figure out someone's logic in deciding the piority when designing the system: In order to save battery power you release the brakes on a train.
(Edit:) I was writing this while Euclid was writing his entry. Doesn't the system still have the emergency application capability if the train air drops? It seems like that would be the logical way to do it when the time expires.
At least in theory, you have the oprtion to tell the system to leave the brakes on by making a pneumatic brake application. This apparently tells the system that brakes are required and the ECP Emergency Application does not cancel after one hour.
If you don't make such an application, the system u nderstands that brakes aren't required and turns of the ECP signal and the CCD units, releasing the brakes.
"It probably seemed quite logical to the Committee at the time."
But I'm not trying to say that it was a good idea.
The thinking was that after a breakdown of ECP communication, the train would have to continue using air brakes and the batteries were needed to operate the air valves. BHP only have one type of locomotive, around 180 SD70ACes, all of which have ECP braking, so the likelihood of needing to use the air brakes isn't that great. But this was an AAR Committee who expected ECP to be an exception among conventional trains. So their thinking was to be able to run the train using air brakes after any ECP failure.
Seems like 'an unexpected problem'; maybe unanticipated? Humans wrote the program, and humans rested and approved the program... So here is the poor Driver, reacting in a situation that was complicated by a prograned system that was not designed to function within those parameters.(?).
It just cost $$ 50 MIllion Bucks (Aus), more or less; and see who walks the plank?
Writing standards at a conference table leaves a lot of 'field intellegence' behind.
When you are out of the elements - the elements are out of you!
It probably seemed quite logical to the Committee at the time.
The problem is that this is a very little known feature and in the case of BHP with fixed formation unit trains, separation of a connector was a very rare occurence so loco crew had no experience of what to do.
M636C Euclid Okay Peter, I do see that now in section 4.5.17. So, if this system is running its one hour timer, and a pneumatic application is not in effect, why not have the system recognize the lack of pneumatic application and not release the brakes? Why not error on the side of not causing a catastrophic runaway, just to conserve battery power? Where is the common sense? This is a death trap just waiting for somone who thinks a train that has been stopped by applied brakes will remain stopped unless someone intentionally releases the brakes. Like the unfortunate driver who is currently being blamed for the whole catastrophe.... But the guys in the AAR committee made their decisions in a conference room or at their desks, with a full understanding of how the system was configured. It probably didn't seem strange to them that an additional pneumatic brak application should be made to indicate to the system that braking would continue to be required. They weren't on the ground in the dark, 130 miles from the nearest town on the steepest grade on the system with a radio and a flashlight looking for a separated cable connector. So far we don't know where the separated connector was in the 238 cars, except that it probably wasn't in the first twent cars from the locomotive if it was still being looked for an hour after the stop. An emergency ECP application is a very serious reponse to a failed connector. How much ECP braking capability was lost? Since the air pipe was intact, the train could have continued on Westinghouse alone, perhaps at reduced speed if the system had bee able to determine what proportion of ECP braking remained active and if that permitted a controlled stop. I'm sure the AAR guys were thinking of a train separation or derailment when the arrangements were decided. If most of the train is off the track, what's the danger in releasing the brakes? Remember that much recent ECP discussion in the USA was wheher ECP would stop a train of tank cars faster in a derailment. So a rapid emergency response was top of the list. But clearly, nobody expected what happened when the train ran away. Peter
Euclid Okay Peter, I do see that now in section 4.5.17. So, if this system is running its one hour timer, and a pneumatic application is not in effect, why not have the system recognize the lack of pneumatic application and not release the brakes? Why not error on the side of not causing a catastrophic runaway, just to conserve battery power? Where is the common sense? This is a death trap just waiting for somone who thinks a train that has been stopped by applied brakes will remain stopped unless someone intentionally releases the brakes.
Okay Peter, I do see that now in section 4.5.17.
So, if this system is running its one hour timer, and a pneumatic application is not in effect, why not have the system recognize the lack of pneumatic application and not release the brakes? Why not error on the side of not causing a catastrophic runaway, just to conserve battery power? Where is the common sense?
This is a death trap just waiting for somone who thinks a train that has been stopped by applied brakes will remain stopped unless someone intentionally releases the brakes.
Like the unfortunate driver who is currently being blamed for the whole catastrophe....
But the guys in the AAR committee made their decisions in a conference room or at their desks, with a full understanding of how the system was configured.
It probably didn't seem strange to them that an additional pneumatic brak application should be made to indicate to the system that braking would continue to be required.
They weren't on the ground in the dark, 130 miles from the nearest town on the steepest grade on the system with a radio and a flashlight looking for a separated cable connector.
So far we don't know where the separated connector was in the 238 cars, except that it probably wasn't in the first twent cars from the locomotive if it was still being looked for an hour after the stop.
An emergency ECP application is a very serious reponse to a failed connector. How much ECP braking capability was lost? Since the air pipe was intact, the train could have continued on Westinghouse alone, perhaps at reduced speed if the system had bee able to determine what proportion of ECP braking remained active and if that permitted a controlled stop.
I'm sure the AAR guys were thinking of a train separation or derailment when the arrangements were decided. If most of the train is off the track, what's the danger in releasing the brakes?
Remember that much recent ECP discussion in the USA was wheher ECP would stop a train of tank cars faster in a derailment. So a rapid emergency response was top of the list.
But clearly, nobody expected what happened when the train ran away.
I would hate to be on the scene of a derailment of a ECP train, where after an hour the brakes released on a portion of the train that was still on the rail stopped on a down grade and those cars take off rolling into the main scene of derailment.
Seems as if the people that designed this standard had very little real knowledge of train operations and how to ensure safety.
_____________
"A stranger's just a friend you ain't met yet." --- Dave Gardner
ECP does not equal K.I.S.S.
In reading through the AAR instructions, I am looking for something like “System-Generated Total Brake Release.” So far, I have not found anything like that.
Look carefully at section 4.3.17 of AAR S-4200.
What happened to the BHP train is clearly indicated in that paragraph, but in about four disconnected sentences.
As you said, the cable break cut off the EOT signal which resulted in a 120% ECP brake application.
If no action was taken to make a pneumatic brake application, the power to the CCD was cut to conserve the batteries and the ECP brake application was released as part of the power down feature.
However, I must correct my earlier misapprehension. This state still allowed brakes to be operated pneumatically using the ECP valves and battery power. Only the ECP system was isolated.
Had BHP's ATP system been able to direct a pneumatic brake application rather than commanding an ECP application (as appears to be the case) the train could have been stopped at low speed at the signal location (there are no actual signal lights) at Garden South, one kilometre from the emergency stop location.
I guess nobody expected a train to be moving on the main line with ECP completely shut down. In retrospect this was a serious omission.
But the whole situation is clearly set out by 4.3.17 in S-4200.
Thanks Balt. Great description of the MCAS issue. Boeing is in for a big liability case I suspect. I wonder what defense they have as to why they didn't provide meaningful knowledge to the airlines and their pilots.
The more I am reading about the 1 hour release makes it seem like the Boeing people that hid operating features from pilots in the 737 MAX the Lion Airlines crashed had a hand in the logic stream
If operators KNOW how things actually work, they tend to make them work correctly even when s..t happens.
The general area that might apply to circumstances of this runaway are in the section named: “System Fault-Generated Brake Applications.”
In that section is 4.4.7.5 which covers low train line voltage conditions. One of those conditions is “Train line power is off.” It would seem to indicate that the disconnected power/control cable on the BHP train (referred to as “train line”) caused a system-generated full service brake application, and that stopped the train.
Apparently, that full service application was system-scheduled to undergo a system-generated full release in one hour.
However, according to the news report, BHP said that this system-generated scheduled release could have been canceled if the engineer had made an emergency application of brakes prior to the end of the one-hour time frame leading up to the occurrence of the system-generated scheduled release of the full service application (that had been made as a system-generated response to the train line being without power).
I don’t find anything in the AAR instructions that mentions this system-generated scheduled release of the previously system-generated full service application of brakes.
In any case, it is said by BHP that the engineer could have canceled the system-generated scheduled release of the brakes if he had made an emergency application of the brakes prior to the scheduled release of brakes in one hour.
So, the question I have is, why can’t the system be designed to have it make the engineer’s emergency application for the purpose of cancelling the system-generated scheduled release of the brakes? That would prevent the engineer from forgetting or being unaware of the need to make the emergency application in order to cancel the scheduled release.
Or better yet, why not get rid of the scheduled release protocol and just repair the broken train line cable in as much time as needed?
blue streak 1 This incident brings up the question. Does the US system as proposed work the same way and what instructions are there if a ECP cable separates. We believe that it has been stated that the US system retains the triple valve ?
This incident brings up the question. Does the US system as proposed work the same way and what instructions are there if a ECP cable separates. We believe that it has been stated that the US system retains the triple valve ?
These are the AAR Standards and would apply to any ECP system.
Retaining the air actuated valves makes the system more complex and may result in unintended operation of the pneumatic valves from pressure fluctuations from ECP operation...
I assume the operation and the timing would be the same whether air actuated valves or ECP valves in emulation mode were involved.
M636C http://www.spoornet.co.za/Website/tender_pdf/AAR%20Spec%20S-4200.pdf
http://www.spoornet.co.za/Website/tender_pdf/AAR%20Spec%20S-4200.pdf
ACTIVATED
They say, "After the shutdown, brakes cannot be applied."
Those were my words, not part of the standard.
I may be wrong. I invite readers here to check for themselves.
The easiest place to get the text of S-4200 is:
(South African Railways..)
Not having ANY brake release when that release was not requested by the Operator is a accident waiting to thappen - in this case the wait was one hour.
M636C Check AAR Specification S-4200: Paragraph 4.3.17, "CCD or EOT in Shutdown mode." "If the brake pipe is charged and a pneumatic application is not in force, the ECP application wil be released.... ...after 1 hour." "The intent of this logic is to allow thetrain to operate as long as possible after loss of train line power and to conserve batteries..." If the brake application is made within the first hour after the loss of power, the brakes will apply in the normal manner. After the shutdown brakes cannot be applied. Peter
Check AAR Specification S-4200:
Paragraph 4.3.17, "CCD or EOT in Shutdown mode."
"If the brake pipe is charged and a pneumatic application is not in force, the ECP application wil be released.... ...after 1 hour."
"The intent of this logic is to allow thetrain to operate as long as possible after loss of train line power and to conserve batteries..."
If the brake application is made within the first hour after the loss of power, the brakes will apply in the normal manner. After the shutdown brakes cannot be applied.
Thanks for posting that specification. I will take a look at the whole thing.
But in just reading what you wrote, what is the "shutdown" they refer to? They say, "After the shutdown, brakes cannot be applied."
But the brakes are already applied due to the fault in the control cable. That braking stopped the train and held it on the grade. I fail to see the point of having that brake application automatically release in order to avoid it becoming non-releasable if the batteries lose their charge. So you lose battery power and you therefore cannot release the ECP brakes when you later want to. Why would you want to release the brakes without the control cable operational?
Fix the control cable, and then release the brakes when you are ready.
This set of procedures seems pretty squirrely in its reasoning although maybe there is a brilliant point to it. It also seems incredibly squirrely to have all of this complicated system response and resulting disaster under investigation, and while that is all unresolved, announce that it was partly the engineer's fault. What kind of a company does that?
If the brake application is made within the first hour after the loss of power, the brakes will apply in the normal manner. After the shutdown brakes cannot be applied. This might be why the the ATP system was unable to stop the train when it ran away.
The clear intention of this clause is that if air braking is required, it should be applied as soon as possible after the loss of the ECP power.
It isn't clear to me that the release need occur on those vehicles still connected to the locomotive with an active HEU and still receiving ECP power, except that the system assumes the loss of the EOT indication to be a failure.
Elsewhere it is indicated that the batteries are expected to maintain power on the system for four hours.
It appears that it was thought that the ECP line would only separate if the train parted, clearly a more serious situation than just the ECP plugs separating. If the train parts, the air line separates and full emergency braking occurs both pneumatic and ECP. If the ECP line separates alone, only an ECP Emergency application (120%) occurs.
I assume the AAR Committee did not want an automatic pneumatic application of brakes with an ECP line break only, leaving this decision to the train operator.
I suspect the AAR Committee didn't envisage a 40 000 tonne train under way with the ECP system shut down to conserve the batteries, either.
There may be some rethinking of the AAR Recommended Practices fairly soon.
M636C As opposed to automatically forcing a full release after one hour because the battery power may fade if the release were delayed more than an hour; it seems like it would be much preferable to require the train to shift over to conventional pneumatic air brakes controlled through the brake pipe. There is no air actuated control valve to "change back to". The only brake control valves are the ECP valves and when not connected to the ECP cable, these rely on battery power to operate. They can operate as air actuated valves in what is called "emulation mode" but this relies on battery power being available. Peter
As opposed to automatically forcing a full release after one hour because the battery power may fade if the release were delayed more than an hour; it seems like it would be much preferable to require the train to shift over to conventional pneumatic air brakes controlled through the brake pipe.
There is no air actuated control valve to "change back to". The only brake control valves are the ECP valves and when not connected to the ECP cable, these rely on battery power to operate. They can operate as air actuated valves in what is called "emulation mode" but this relies on battery power being available.
Well then what did you mean when you said this?:
"Had a reduction in the main train pipe been made, since only the ECP cable had separated, not the air pipe, a conventional brake application could have been applied to all vehicles."
That is the information that I was referring when I said, "it would be much preferable to require the train to shift over to conventional pneumatic air brakes controlled through the brake pipe," as you quoted me above.
M636CAs opposed to automatically forcing a full release after one hour because the battery power may fade if the release were delayed more than an hour; it seems like it would be much preferable to require the train to shift over to conventional pneumatic air brakes controlled through the brake pipe. There is no air actuated control valve to "change back to". The only brake control valves are the ECP valves and when not connected to the ECP cable, these rely on battery power to operate. They can operate as air actuated valves in what is called "emulation mode" but this relies on battery power being available. Peter
Obviously in the design of this system, whomever designed it, FAIL SAFE was not a design criteria.
Our community is FREE to join. To participate you must either login or register for an account.