German Train Crash

[roythebus]

It is reported that there have been 4 train driver ob board of the two trains, of which 2 were driving (killed), the third was an instructor and in one of the driving cabs (killed too) and the fourth travelling in the passenger compartments (now sadly passed away in hospital). The presence of an instructor in a driver cab further complicates the situation because in such situation it always is unclear (*) who is responsible, whose comments must be obeyed and what to do if the signals and the instructor contradict themself. No details known yet though.

 

Edit: (*) Unclear what has happened after an accident occurred I mean.

In the UK the driver is always in charge of the train. The presence of the instructor in the cab was revealed in an earlier thread, maybe the link I posted to the on-line newspaper.

[Pacific231G]

 

In terms of systems checking other systems, there are all sorts of systems trying to do things to the railway but the most they can do is to send requests to the interlocking.  This is traditionally relay-based but now more likely to be a high-integrity processor-based system which will ignore any requests that would result (according to the design/programming of the interlocking) in an unsafe situation. 

That would probably come within what I was thinking of as "hard wired" even if it's not relay based. Mechanical frames and relays both have a logic table built into them and so presumably do processor based systems.

[russ p]

In the UK the driver is always in charge of the train. The presence of the instructor in the cab was revealed in an earlier thread, maybe the link I posted to the on-line newspaper.

Not strictly true Roy. If the instructor is competent on the route and traction and has taken charge of the train to instruct the trainee , he is then in charge. This could explain the presence of another driver in the train. It's normal practice here for the booked driver to ride in the train or in the rear cab of a freight train

[Kenton]

 

However in all truth I have nothing to add, the story seems to have slipped from the headlines. As with all accidents it takes time for the investigators to do their job and publish the results.

That is why, in all such accidents, catastrophic events, there is so much speculation when the news breaks.

 

By the time the investigation is complete (many months, even years later) and published (often in pure technical jargon and obscured detail, rarely apportioning blame due to potential legal intervention, and often in a quasi public medium) is has been superseded in most public minds by the next event or simply forgotten.

 

Speculation is actually a healthy way of us trying to mitigate the shock of an event a method of "talking" the event out of our minds.

 

Oh, the purpose of that post - just so that when someone posts the link to the results of the investigation in x months, I'll get a little reminder email that I'm following the topic.

[FelixM]

An announcement for a press conference tomorrow at 14:00 (13:00 GMT) has been issued by the investigation team. The question of the accident cause will be dealt with there.

[BR(S)]

An announcement for a press conference tomorrow at 14:00 (13:00 GMT) has been issued by the investigation team. The question of the accident cause will be dealt with there.

 

Human error being stated as the cause: http://www.bbc.co.uk/news/world-europe-35585302

[jon_1066]

I know next to nothing about such things but on a single track line like that shouldn't it be basically impossible to set the signals to allow two trains into it at once - ie shouldn't human error have been designed out of the system already?  Shouldn't it be operating with an electronic token system?

[Metr0Land]

Bear in mind that trains will break down from time to time, whatever system you have, there will have to be some kind of override to allow a rescue train/loco to enter the section. Thus there will always be some kind of way of overridng the safety controls. In a perfect world it should not be possible to operate these too easily, but you can never have a system where it's impossible to have two trains on the same piece of track 100pct of the time.

[caradoc]

I know next to nothing about such things but on a single track line like that shouldn't it be basically impossible to set the signals to allow two trains into it at once - ie shouldn't human error have been designed out of the system already?  Shouldn't it be operating with an electronic token system?

 

There have to be, and are, methods to allow trains to keep moving when faults occur. In Britain, to have two trains on a single line at the same time would require one to be signalled normally, and the Driver of the other to be told by the Signaller that there was a fault and authorised to pass a signal at danger. This train would then proceed at caution, which does not appear to have been the case in Germany. Dealing with faults while keeping trains safe is when Signallers really earn their money. 

[PaulRhB]

I very much doubt he signalled the second one but talked it in instead, but we will have to wait for details of what happened as we don't know the procedure or type of signalling on the single line. We use several different types of token, physical, electric and radio, over here plus track circuit block so it's not a simple answer until you know the system and the degraded working arrangements.

[D9020 Nimbus]

It used to be the case on German railways that many single lines were operated by telephone communication between the stationmasters at each end. Not sure if that's still the case. The token system is pretty much confined to Britain and some ex-colonies.

[martin_wynne]

There have to be, and are, methods to allow trains to keep moving when faults occur.

 

But in this case there is no mention of a fault? Simply that one train was running late.

 

The BBC link suggests that the signaller may be prosecuted and could face jail. I would think whoever designed a "safety" system which allows one man acting alone to over-ride it simply because a train is a few minutes late, should be in the dock with him.

 

Martin.

[meil]

There have to be, and are, methods to allow trains to keep moving when faults occur. In Britain, to have two trains on a single line at the same time would require one to be signalled normally, and the Driver of the other to be told by the Signaller that there was a fault and authorised to pass a signal at danger. This train would then proceed at caution, which does not appear to have been the case in Germany. Dealing with faults while keeping trains safe is when Signallers really earn their money. 

It needs a dam sight more than that to allow two trains into the same section of a single line. I can think of at least three forms to fill in first. Then there are the detonators to place to protect the stationary train and the assurance of the train driver direct to the signalman of the location of the train and the assurance that it will not be moved.

 

there is no circumstance where a train can enter a section when another moving train is in occupation (OK blocking back behind departing train - only exception)

[FelixM]

What has been written here is correct. The block system doesn't allow a second train onto a section where already one train is, especially in opposite directions. This would violate against not one but two requirements for safe working: Block section not clear and signals in opposite direction not locked in the danger position.

 

When the interlocking fails to check that all requirements for a safe train route are met then as a replacement the signaller is authorised to check that the train movement is safe. If that is the case, then according to German signalling philosophy there is no reason for the train to continue on sight (= slow) because nothing can happen. The interlocking still holds the signal at danger though. For these cases the Ersatzsignal Zs 1 was invented, Ersatzsignal literally translates into replacement signal and means that the signal won't clear due to technical reasons but that the onward movement acutally is safe.

 

In this accident we technically should speak of an abuse of the Ersatzsignal or at least have to check for an abuse. I don't know how detailed the British press went into this but the signaller made a full confession about what happened which the police decided not to publish. Today's press conference revealed that the signaller is the immediate cause of the accident but that noone sees the necessity to have legal consequences. This implies that the signaller did not deliberately evoke the collision and furthermore might have tried to avert what later has happened by an emergency call to the drivers (rumours about that have appeared but this detail has neither been confirmed nor denied at the press conference).

[FelixM]

It used to be the case on German railways that many single lines were operated by telephone communication between the stationmasters at each end. Not sure if that's still the case. The token system is pretty much confined to Britain and some ex-colonies.

 

Not applicable here but for the sake of completeness: It does exist but only on lightly used branch lines. Basically as there is no technical block system there is no interlocking of the exit signals. The telephone communications convey the same messages as the British Block Bell Codes: First Anbieten/Annehmen (offering/accepting, like "Is Line Clear for...?"), then Abmelden (departure notice, like "Train Entering Section"), then Rückmelden (arrival notice, like "Train Out of Section").

 

Anbieten/Annehmen is not used on double track lines when using the right line. Technical block systems can replace the Rückmelden. Abmelden has to be done always.

 

Zugnummernmeldeanlage is the German equivalent of Train Describers. They lift the necessity for exchanging telephone messages completely. The Zugnummernmeldeanlage is the basic for having Selbststellbetrieb which means that signalled routes which have been saved in before are automatically set. This is only supported by relay and soild state interlocking.

[caradoc]

It needs a dam sight more than that to allow two trains into the same section of a single line. I can think of at least three forms to fill in first. Then there are the detonators to place to protect the stationary train and the assurance of the train driver direct to the signalman of the location of the train and the assurance that it will not be moved.

 

there is no circumstance where a train can enter a section when another moving train is in occupation (OK blocking back behind departing train - only exception)

 

You seem to have misunderstood what I said, and are stating what happens when a train fails on a single line and requires assistance. This is not what happened in this terrible case: It was clearly not any form of normal working where correct procedures have been followed, but one where an awful mistake has been made and a human being has bypassed the security of the signalling system. There should be 'no circumstance where a train can enter a section when another moving train is in occupation', but that is exactly what did happen.

[jon_1066]

What has been written here is correct. The block system doesn't allow a second train onto a section where already one train is, especially in opposite directions. This would violate against not one but two requirements for safe working: Block section not clear and signals in opposite direction not locked in the danger position.

 

When the interlocking fails to check that all requirements for a safe train route are met then as a replacement the signaller is authorised to check that the train movement is safe. If that is the case, then according to German signalling philosophy there is no reason for the train to continue on sight (= slow) because nothing can happen. The interlocking still holds the signal at danger though. For these cases the Ersatzsignal Zs 1 was invented, Ersatzsignal literally translates into replacement signal and means that the signal won't clear due to technical reasons but that the onward movement acutally is safe.

 

In this accident we technically should speak of an abuse of the Ersatzsignal or at least have to check for an abuse. I don't know how detailed the British press went into this but the signaller made a full confession about what happened which the police decided not to publish. Today's press conference revealed that the signaller is the immediate cause of the accident but that noone sees the necessity to have legal consequences. This implies that the signaller did not deliberately evoke the collision and furthermore might have tried to avert what later has happened by an emergency call to the drivers (rumours about that have appeared but this detail has neither been confirmed nor denied at the press conference).

 

I can't really follow this.  The signaller can over-ride the interlocking?  How does the signaller check a line is safe?  

[roythebus]

As FelixM has said, there is no interlocking as we know it if I understand what he has said. Going back through some of FelixM's earlier posts he has explained the over-ride system if something Has gone wrong with the signalling. The signalling supervisor can give authority to the driver to pass the signal providing the white light is illuminated and he has the permission from the signallers at both ends of the block section. This is where the apparent failure is. 

 

Maybe FelixM can re-explain this for those who have not read his earlier threads. Try looking at post 22, 30, 31,46 and more.

[meil]

_{FelixM described the actions that can be taken when the signalling system fails and defaults to safe, ie red lights - nothing moves. So there is a system of Ersats-signals to be used in these special circumstances.}

 

_{Where in the present case did the signals fail? The implication is that the signalman overrode the signalling system. How can that happen from the actions of one man?}

[PaulRhB]

I would think whoever designed a "safety" system which allows one man acting alone to over-ride it simply because a train is a few minutes late, should be in the dock with him.

 

Martin.

No it's quite possible to circumvent procedures deliberately or as it appears in this tragic case through an error. If you don't follow the procedure for following a road a car can crash, this is the same type of thing that if you don't follow the rules for whatever reason a crash can happen and it's not the fault of who designs the system. We have to have a manual override or everything stands still until it's fixed. Life and industry doesn't have that sort of patience, hence risk assessments.

 

I can't really follow this. The signaller can over-ride the interlocking? How does the signaller check a line is safe?

Best to read the thread on Single Line Working.

Manual override is a necessity or the consequences lead to huge delays and then you get people getting off and wandering around which means it takes even longer to sort out.

Patience isn't a virtue of modern life.

[martin_wynne]

No it's quite possible to circumvent procedures deliberately or as it appears in this tragic case through an error.

Manual override is a necessity or the consequences lead to huge delays and then you get people getting off and wandering around which means it takes even longer to sort out.

 

This argument isn't about the need for a manual over-ride. That's an obvious need. The objection is that it requires only one man acting alone?

[Jeff Smith]

Nothing (to my knowledge) has been mentioned with regard to the drivers' familiarity with the timetable and route.  One train was normally held in the double track section to await the other before proceeding (this was mentioned by a regular traveller from the train that normally waited).  How was this held train allowed to move?  Signalled, waved on?  What assurance was the driver given that the line was clear?  A driver familiar with the timetable would surely require considerable assurance.....!

[phil-b259]

This argument isn't about the need for a manual over-ride. That's an obvious need. The objection is that it requires only one man acting alone?

In the UK it is quite possible for one signaller to be in charge of single line working - Oxted Pannel supervises several single line sctions and is single manned. It's not about the number of people but rather whether the 'manual override' procedures provide sufficient protection.

 

In the UK, on passenger lines, if a technical failure prevents the route being set onto the single line, pioltman working must be introduced. This in turn provides appropriate safeguards as there can only be a single Pioltman, who must travel with the train through the single line section (if several trains are going the same way the pilotman may authorise them to proceed sequentially via a ticket system - but he MUST always travel on the final train heading in one direction before joining the train / physically issuing tickets to the driver of the first train due to travel in the opposite direction).

 

Why this level of protection is not implemented in Germany is something others may be able to explain.

[PaulRhB]

This argument isn't about the need for a manual over-ride. That's an obvious need. The objection is that it requires only one man acting alone?

But they state he didn't follow procedure, so until we know what that procedure is we can't assume it usually allows him to act alone.

Modified block working usually requires two Signalmen, one at each end, and a manager to confirm before a train enters. At Salisbury that's reduced to one Signalman and a manager as we control both ends of the block. If I forget to call the manager then that would remove the check, it would also be quickly found and if it was deliberate then it would be disciplined.

I'd be very surprised if their system doesn't include a check.

[PaulRhB]

In the UK it is quite possible for one signaller to be in charge of single line working - Oxted Pannel supervises several single line sctions and is single manned. It's not about the number of people but rather whether the 'manual override' procedures provide sufficient protection.

.

assume you meant working a single line as opposed to SLW, But the check will either be the on call manager or pilotman.

 

Why this level of protection is not implemented in Germany is something others may be able to explain.

We don't know that it isn't at present as no one can state what the degraded working procedure is.