Serious Accident in Bavaria

[45669]

It has just been announced on the BBC that a criminal investigation has been opened.

 

[ComUtoR]

Ah yes.

The problem on a single line, of course, is that the *other* train is proceeding *not* on sight.

That approach only works safely on a unidirectional line, where the worst case is a stationary train, not one proceeding towards you at 100km/h.

I would have no issue passing one on a single line. The purpose of the PoSA is to speed up the process of passing it at danger. It replaces the stopping and calling of the Signaller. It is not replacing the procedures that both the Driver and Signaller still must adhere to. The PoSA's that I have been through are on bi-directional lines.

When all is working correctly the other train on a single line would not be proceeding on sight and certainly not at 100km/h

What has happened here is that there is clearly numerous failings and it will be a catalogue of errors. Echoing other comments. Something very serious has gone wrong here. This is an incident that should have never happened. I think that the "how" it happened is only part of the issue. "why" it happened is going to be very significant.

 

[Trainfan344]

This unfortunately has shades of the smiler incident at Alton Towers, a situation arose which should never be possible!

 

[Bletchleyite]

That was certainly my thought. It might be inconvenient to sit at a signal at red because it's broken, with your connection receding into the distance. But making it easier to get authority to pass one at danger is not a safe solution. It needs to be an inconvenient one to ensure all relevant checks and balances are carried out on a single line.

It's fine if everyone is driving on sight, but if the other train isn't....

 

[MarkyT]

I'm interested in the two intermediate block signals in the middle of the single line section. These are clearly for trains to be able to follow each other closely in the same direction usually, but it's possible that under certain conditions interlocking might allow trains to approach these two signals from opposing directions, say for instance two engineering vehicles entering the single line from both ends for different tasks. They'd still be fully protected from one another by the intermediate signals being at red and there being an appropriate protection distance between them. Imagine if this facility had been used incorrectly to allow two passenger trains into the section. If this happened, normally it would be inconvenient but safe nevertheless as neither movement could proceed beyond the appropriate intermediate signal at red. One of the trains would have to back out to let the other pass. Now factor in a SPAD at the intermediate signal for one of those trains. It might even have been a ding-ding-away from signal 313 if that train had stopped at the Kurpark station. Now the question returns to the Indusi. That should have intervened with an immediate trainstop on passing 313s magnet but could it have been left in a disabled state after an authorised pass at danger from the previous signal when first entering the single line (with an ersatz signal say?). I would have expected an override to function for one pass only then revert to normal operation for subsequent magnets.

 

[Bletchleyite]

It's these Ersatzsignale I really don't like the idea of on anything other than a unidirectional line. It strikes me that anything that makes it easier to instruct a driver to pass a signal onto a single line at danger is a massive, massive risk.

Much as, as a passenger, I would find it rather inconvenient if I had to wait say two hours for someone to turn up in a van and act as pilotman, I'd rather that than be signalled onto a single line with no absolute certainty that there was no other train there.

Drive on sight is fine if (a) everyone is driving on sight, or (b) there can't be anything going towards you. If one of those things is not provably true, and proven by more than one person, I'd rather wait.

 

[EAD]

I'm interested in the two intermediate block signals in the middle of the single line section. These are clearly for trains to be able to follow each other closely in the same direction usually, but it's possible that under certain conditions interlocking might allow trains to approach these two signals from opposing directions, say for instance two engineering vehicles entering the single line from both ends for different tasks. They'd still be fully protected from one another by the intermediate signals being at red and there being an appropriate protection distance between them. Imagine if this facility had been used incorrectly to allow two passenger trains into the section. If this happened, normally it would be inconvenient but safe nevertheless as neither movement could proceed beyond the appropriate intermediate signal at red. One of the trains would have to back out to let the other pass. Now factor in a SPAD at the intermediate signal for one of those trains. It might even have been a ding-ding-away from signal 313 if that train had stopped at the Kurpark station. Now the question returns to the Indusi. That should have intervened with an immediate trainstop on passing 313s magnet but could it have been left in a disabled state after an authorised pass at danger from the previous signal when first entering the single line (with an ersatz signal say?). I would have expected an override to function for one pass only then revert to normal operation for subsequent magnets.

Yes there has been some debate about this on the German Dreshscheibe forum. The split in the block is at the Rosenheimer Strasse level crossing next to Kurpark and so these signals in both directions are linked to protect the level crossing as well I understand. There is also a distant signal for them: all would have an INDUSI magnet and fail safe is always on i.e. unpowered. The blocksignal if red would always trigger a brake application as you say.

In the other forum it has been mentioned that on the entry exit style panel you can only set a route from one station to the other and so it is not baring very odd circumstances possible to set a route just to the block signal. If another train entered the block, the block signal would return to red and so there is speculation that given its location the driver of the train that had passed it after departing Kurpark did so when it was green and route set so he could proceed as he did over the level crossing. If it was red then the INDUSI would always trigger (failsafe) and you need a Befehl (authorisation) (though a Zusatzsignal or direct from the signalman) to press the plunger in the cab as you pass the magnet and proceed. The use of this "Befehlstaster" is directly recorded on the on train data ("black box") so we will know soon enough.

 

[45669]

It's these Ersatzsignale I really don't like the idea of on anything other than a unidirectional line. It strikes me that anything that makes it easier to instruct a driver to pass a signal onto a single line at danger is a massive, massive risk.

Much as, as a passenger, I would find it rather inconvenient if I had to wait say two hours for someone to turn up in a van and act as pilotman, I'd rather that than be signalled onto a single line with no absolute certainty that there was no other train there.

Drive on sight is fine if (a) everyone is driving on sight, or (b) there can't be anything going towards you. If one of those things is not provably true, and proven by more than one person, I'd rather wait.

Although I agree with you 100%, I can imagine that all those passengers with Twitter accounts would be twittering away on their Handys like there's no tomorrow if they had wait two minutes, let alone two hours!

Despite all the advantages of modern day electronic wizardry, I can't help feeling that there's something to be said for the old fashioned single line staff or token.

 

[ComUtoR]

But making it easier to get authority to pass one at danger is not a safe solution.

I feel I need to be clearer on this as your missing the point. The safety is not compromised at any point. The PoSA is a replacement for the conversation that takes place and speeds up the movement of trains through the section as you don't stop and caution. The PoSA is set by the Signaller so whether they talk to you specifically or they signal you past the red makes little to no difference. All their actions and mine are the same.

No doubt a Signaller can confirm what checks take place for when track circuits do show as occupied before you are verbally authorised past or signalled past using a PoSA.

We also have to remember that if the track circuit is showing as occupied then signals in both directions should be at red. I would hope that the PoSA cannot be given in both directions or that a PoSA cannot be given for occupied sections but a Signaller would have to share their knowledge as I can only give a Drivers perspective.

We are also not just talking about one signal either. There could be PoSA's on consecutive signals so potentially replacing temp block working too as you keep going through the PoSA's

I feel it is important to stress that the introduction of PoSA's still keeps the railway safe and are not compromising safety. Up until recently you could pass a signal on your own authority and that was (and still is) considered safe. The PoSA is authority from the Signaller.

It's fine if everyone is driving on sight, but if the other train isn't....

Again for clarity. To get the situation where one train is travelling normally and the other isn't means something has gone seriously wrong. Especially on a bi-directional line If a train is occupying the section then your signal should be showing red. The oncoming train should have a red as your occupying their section. If you both had a PoSA then you would still be going at caution and expected to stop short of any obstruction.

I'd also like to clear up the "driving on sight" The "on sight" is because I proceed on sight of the signal it is a visual authority to proceed and not "driving by sight" In the UK we are restricted to "Caution" and only as far as the next aspect. Our expectation is to stop.

From what I'm reading the German system is that your speed is then restricted to 40mph.

As someone who goes past PoSA's on an almost daily basis I feel it is important to reassure people that we are still safe when we go through them to state they are unsafe is hearsay and unfounded. It is not something any passenger should believe. I hope that a Signaller can also give that same reassurance from their perspective and professional knowledge.

Keeping on topic to this terrible incident. I'm with MarkyT he has highlighted the main points that are causing a concern. Without knowing anything about the German interlocking systems it is impossible for me to state anything as factual but from a Drivers perspective the only time I'm going linespeed through a single line is when all signals are showing as clear.

At the moment there are more questions than answers.

 

[Bletchleyite]

So to clarify a bit as I don't think anyone answered above.

Absent these new signals, what is the current procedure to authorise a UK driver to pass a signal onto a single line section at danger? Assume track circuited so no token or train staff.

 

[Bertiethebobby]

So to clarify a bit as I don't think anyone answered above.

Absent these new signals, what is the current procedure to authorise a UK driver to pass a signal onto a single line section at danger? Assume track circuited so no token or train staff.

I would think that if track circuited throughout that there is minimal danger in authorising a train past the controlling signal. If it's not, as I suspect was the case here then it's a whole different ball game.
I'm not up to speed with current UK practice though.

 

[edwin_m]

I feel I need to be clearer on this as your missing the point. The safety is not compromised at any point. The PoSA is a replacement for the conversation that takes place and speeds up the movement of trains through the section as you don't stop and caution. The PoSA is set by the Signaller so whether they talk to you specifically or they signal you past the red makes little to no difference. All their actions and mine are the same.

Neil does have a valid point here.

As people have mentioned further up the thread, if a procedure that bypasses the normal safeguards takes a bit of time to apply, it's less likely that the people concerned will immediately adopt that procedure. And if they do jump to the conclusion that the equipment is at fault when it's actually a train somewhere that they have temporarily forgotten, then it's more likely they will realise their error before they do something irrevocable. The Sykes release key is a classic British historical example of this kind of problem.

The use of a PoSA aspect potentially carries the same risk. In principle there exists the temptation to get the train moving quickly by hitting the button that activates the PoSA, whereas a conversation with the driver takes longer and also introduces a second person who might question the first one.

One mitigation of the risk at a PoSA signal is the "line of sight" requirement, that a driver obeying a PoSA must drive slowly enough to stop short of any obstruction that comes into view ahead. However this might not be sufficient if the "obstruction" is another train moving in the opposite direction, even if both drivers brake immediately. So on a bi-directional line PoSA carries a greater likelihood of collision, albeit at fairly low speed.

I'm not familiar with the technical details of PoSA or the operational rules surrounding its use but I have no doubt these issues were considered when developing them and appropriate mitigations applied. But it does illustrate a principle that may be relevant to the circumstances of this accident.
--- old post above --- --- new post below ---

Since Abermule in 1921, as far as I know, there has only been one single track head on collision in the UK caused by human error.

Based on a quick trawl of Railways Arcive there are at least two:
- Fishguard 1951 (http://www.railwaysarchive.co.uk/docsummary.php?docID=941)
- Cowden 1994 (http://www.railwaysarchive.co.uk/eventsummary.php?eventID=151)

 

[Taunton]

If I'm not mistaken this is by no means the first head-on collision on German single lines that has happened over the years, and notwithstanding the extensive precautions against passing signals at red, somehow trains manage to be signalled into the section from both ends at the same time, which is a different matter. Previous such incidents (someone will have details) seem to have been down to mismanagement of procedures at the minor stations, where the "signalman" seems to have actually been the stationmaster (maybe some translation issue) with the controls in the station building.

It does seem that with one train to time, and the other only 4 minutes late approaching their passing point, any override procedures must have been done extremely quickly to get an opposing train into a section before the oncoming one had cleared.

 

[ComUtoR]

Neil does have a valid point here.

I'm not saying his point isn't valid. Just that he is overstating the risk.

As people have mentioned further up the thread, if a procedure that bypasses the normal safeguards takes a bit of time to apply, it's less likely that the people concerned will immediately adopt that procedure.

It is not bypassing the normal safeguards. It is a visual authority rather than a verbal one. As far as I am aware all the normal safeguards still apply. From a Driver perspective nothing has changed other than the way in which authority has been given. As I say, its visual instead of verbal. If you would be authorised past verbally then if you got a PoSA instead changes nothing. You are still going past the signal. What difference does it make in how the Authority is given ? The decision about it being safe or not has already been made.

I have sat on a signal where the section in front showed occupied I was not allowed to pass the signal. Authority to pass is not given lightly.

And if they do jump to the conclusion that the equipment is at fault when it's actually a train somewhere that they have temporarily forgotten, then it's more likely they will realise their error before they do something irrevocable.

I have a lot of faith and respect for our Signallers. Jumping to conclusions is not something they do. It is also hard to do something irrevocable as the interlocking should prevent that.

The use of a PoSA aspect potentially carries the same risk. In principle there exists the temptation to get the train moving quickly by hitting the button that activates the PoSA, whereas a conversation with the driver takes longer and also introduces a second person who might question the first one.

I'm not a Signaller so its impossible for me to state categorically the procedures and relative interlocking in place before the PoSA is able to be set. I very much doubt it is "hitting a button"

The conversation with the Driver is surprisingly quick and takes less than a minute. There are a large number of SPAD's that have occurred because of miscommunication with the Signaller. The PoSA mitigates against that risk s potentially could be considered to be safer.

The second person mitigation is itself an inherent risk due to the nature of the Signaller/Driver relationship. You would be shocked if you listened to the radio tapes after a SPAD. With the PoSA there is no question of miscommunication.

One mitigation of the risk at a PoSA signal is the "line of sight" requirement, that a driver obeying a PoSA must drive slowly enough to stop short of any obstruction that comes into view ahead.

Indeed. There are also other mitigation factors too which are no doubt on the Signallers side.

However this might not be sufficient if the "obstruction" is another train moving in the opposite direction, even if both drivers brake immediately. So on a bi-directional line PoSA carries a greater likelihood of collision, albeit at fairly low speed.

A very low speed. The likelihood of both trains entering an occupied section and both trains getting a PoSA should be incredibly small. I know of two near collisions on our patch. Neither were on a single line. If the PoSA is showing then as a Driver I have the full confidence that it is safe to proceed at caution. I will admit my first time through one I was hesitant but now its second nature.

I'm not familiar with the technical details of PoSA or the operational rules surrounding its use

From the Drivers side, I am. The Signaller side I couldn't say for certain so I hope someone does. FYI I'm probably going less than 10mph past the PoSA

*edit*
I done some checking. The line must be checked to be clear before any authority is given (verbal or PoSA) Other caveats also applied, such as if the signal state in a single direction etc. Same with the single line. Authority can only be given under specific circumstances and again, the line must be checked first before any authority is given. Safety checks are done before authority is given.
*edit*

But it does illustrate a principle that may be relevant to the circumstances of this accident.

The German method does allow for 40 kph but from what I read the Zs1 would only show once the line was checked and considered safe to pass.

I have looked on the cab ride video posted above and its unclear if that section had a Zs1 for the train to be going 100kph on impact suggests that the Driver(s) had clear signals. If they had a Zs1 then they should have been going no more than 40 kph. (unless they passed Bad Aibling signal with a green ?) Which shouldn't happen IF that was interlocked

If that was the case and the signaller had authorised either unit past using a Zs1 then then line wasn't checked and the Driver wasn't in compliance with the restrictive speed.

As I say, it's a catalogue of errors for that to happen.

@EAD. You have done a superb job of educating us, apologies if I'm wrong, happy to be corrected.

 

[edwin_m]

I'm not saying his point isn't valid. Just that he is overstating the risk.

You said he was missing the point. Not quite the same thing.

It is not bypassing the normal safeguards.

The "normal safeguards" are the signalling system working as intended. The PoSA is used if some failure prevents these from operating, and in effect bypasses them. So quite rightly the risks should be looked at very closely.

I agree with the rest of your post about the integrity of the signallers and the risks that arise in any situation where a train has to pass a signal stuck at red. I was merely pointing out that the PoSA has risks of its own that need to be (and I'm sure have been) assessed and mitigated.

 

[341o2]

Have there been any advances regarding recovery of the "black box" from the eastbound train. Much seems speculation. the black box has been recovered from the westbound train and shows no indication of mechanical malfunction or driver error, the westbound train was on time, but it was the eastbound train which was running late.

Maybe we will have more information once this box has been recovered and anaylised

No update on BBC tv news this morning - not even a mention

 

[LAX54]

So to clarify a bit as I don't think anyone answered above.

Absent these new signals, what is the current procedure to authorise a UK driver to pass a signal onto a single line section at danger? Assume track circuited so no token or train staff.

Some boxes may have modified working allowed in the SBI's to allow one train to run right direction in the event of a failure, but as for us, if you take the Felixstowe Single line as an example, and a busy line indeed, if there is a failure which means we cannot clear the signal onto the single line, then the jobs stops until we have introduced Pilotworking with a Pilotman, in addition if we cannot ascertain that the train is complete (as we cant see the tail lamp) the PM will have to travel with every train, until we get a couple of 'tail lamp' men at the right locations.
OK so this causes some delay, but it is 'almost' failsafe. (it would take at least two people making an error for any train to be in Danger)

 

[Bletchleyite]

This is how I thought it was, and is much more reassuring than that a signaller could, without being forced to involve someone else, press a button to clear a signal onto a single line where another train could be proceeding at linespeed with no knowledge of the issue.

 

[45669]

The PoSA is a replacement for the conversation that takes place and speeds up the movement of trains through the section as you don't stop and caution. The PoSA is set by the Signaller so whether they talk to you specifically or they signal you past the red makes little to no difference. All their actions and mine are the same.

I feel it is important to stress that the introduction of PoSA's still keeps the railway safe and are not compromising safety. Up until recently you could pass a signal on your own authority and that was (and still is) considered safe. The PoSA is authority from the Signaller.

As someone who goes past PoSA's on an almost daily basis I feel it is important to reassure people that we are still safe when we go through them to state they are unsafe is hearsay and unfounded. It is not something any passenger should believe. I hope that a Signaller can also give that same reassurance from their perspective and professional knowledge.

One thing that I haven't grasped about the PoSA procedure is how the signalman communicates the authority to pass the stop signal to the driver.

I should add that my experience of signalling is limited to being a signalman on a heritage railway many years ago, and I could give the drivers authority to pass a danger signal by holding a green flag (or green handlamp at night) out of the signal box window.

And in the old days the fireman would carry out Rule 55 if the train was held for three minutes (or immediately if it was raining, snowing or foggy). This was supposed to ensure that the signalman didn't forget that the train was there and that the appropriate lever collars were in place.

So, what happens nowadays in these circumstances?

 

[LAX54]

This is how I thought it was, and is much more reassuring than that a signaller could, without being forced to involve someone else, press a button to clear a signal onto a single line where another train could be proceeding at linespeed with no knowledge of the issue.

The main thing that will 'fail' the single line is a track failure, this will in itself hold the signals to red, thus the Signaller will have to authorise any movement past that signal (if modified working) so the Driver will know he has passed a Red. or, if Pilotworking in place, the driver will have either a 'ticket' to authorise him to proceed, or the PM with him.

I would have said in the UK, (based on our location) it would take 2 people to make a mistake on a grand scale to have two heading towards each other on the SL.

 

[Scott M]

Is it possible that this could be a technical fault or is it almost 100% likely it is human error?

 

[Taunton]

Since Abermule in 1921, as far as I know, there has only been one single track head on collision in the UK caused by human error.

The number of head-on collisions in this list of German railway accidents, even in recent times, is quite surprising.

https://en.wikipedia.org/wiki/List_of_German_rail_accidents

 

[edwin_m]

One thing that I haven't grasped about the PoSA procedure is how the signalman communicates the authority to pass the stop signal to the driver.

That is the purpose of the POSA aspect, which is two diagonal white lights like a subsidiary signal but flashes.

 

[neilb62]

Its just been suggested on the FB Drivers group by a European Driver that this is already being put down to a signalmans error during signal failure. Tragic.

 

[MarkyT]

A PoSA signal might omit track circuit clear proving, next lamp alight and TPWS equipment functional checks. To clear though it must check opposing locking just like a main aspect (ie ensure that no train previously signalled along an opposing route is still in the conflicting section. The opposing locking might notionally time out after the first movement has been in section for long enough to assume it must have come to a stand, then perhaps you could use a PoSA type aspect to authorise permissive entry (to couple and assist from the front perhaps) In UK I think the NR rule book doesn't allow using PoSA for assisting so it can only be used to overcome certain infrastructure problems. A driver might encounter, at worst, the rear of the preceding train in the same direction. I can't imagine that a German ersatzsignal would omit even those most basic interlocking rules.

 

[matchmaker]

Based on a quick trawl of Railways Arcive there are at least two:
- Fishguard 1951 (http://www.railwaysarchive.co.uk/docsummary.php?docID=941)
- Cowden 1994 (http://www.railwaysarchive.co.uk/eventsummary.php?eventID=151)

Thanks. I wasn't aware of the first one. Still goes to show how effective Victorian single line signalling was, Tyers first tablet instrument having being introduced in 1878!

 

[Bletchleyite]

ISTR that DB don't use things like train staffs, tokens etc. This might explain a lower level of single-line safety.

 

[talltim]

I feel I need to be clearer on this as your missing the point. The safety is not compromised at any point. The PoSA is a replacement for the conversation that takes place and speeds up the movement of trains through the section as you don't stop and caution. The PoSA is set by the Signaller so whether they talk to you specifically or they signal you past the red makes little to no difference. All their actions and mine are the same.

Not sure that I agree that a signaller talking past Vs a PoSA are the same.
In talking past, there is a two way conversation. The signaller might say, 'Fault on the signal, can't get it to clear, but I'm authorising you to pass it' and the driver might say 'What about the train I normally pass here? Where will I pass it? Cue lightbulb moment.
With a PoSA, the driver just sees it and proceeds, assuming that the signaller has their reasons for lighting it.

 

[45669]

That is the purpose of the POSA aspect, which is two diagonal white lights like a subsidiary signal but flashes.

Thanks for the explanation. I don't recall ever seeing one, but having had a quick google I read that they were only introduced in December so that would explain why.

I shall have to look out for one next time I'm out and about on the rails.

 

[MarkyT]

Thanks. I wasn't aware of the first one. Still goes to show how effective Victorian single line signalling was, Tyers first tablet instrument having being introduced in 1878!

There was a fair amount of tokenless block introduced by BR during the 1960s and 70's, on the singled LSWR route to Exeter for example. Without a token or continuous track circuits there is a special tokenless block instrument with a train arrived complete acknowledgement button. In addition, to clear the block a train has to operate a sequence of track circuits and a treadle in the correct order. Trains all have to be continuously braked for such a system as it's assumed if they split both parts will always come to a stand and thus the front part couldn't exit and falsely clear the section leaving an obstruction. A CCTV system can be used for tail light observation if the single line exit is not directly visible from the box. A single ended version of this type of technology can be used for stub branches where it is known as One Train Working (without train staff).