May 2016
The misuse of an associated pass on sight (POSA) signal aspect to enable passing of failed main signals without oral communication between signaller and train driver.
Misuse of signal aspects provided for the purpose of keeping traffic moving when a signalling system failure has occurred can lead to very serious consequences, as was illustrated early in 2016 by a fatal accident in Germany. The accident was determined to be the direct result of misuse of such an aspect by the Bad Aibling signaller and the issue is of significance and merits early consideration when developing similar systems and when writing or reviewing the rules surrounding their use.
The accident.
On the 9thof February 2016 at around 06:47, a 174 tonne ET325 six-car and a 111 tonne ET355 three-car Stadler Flirt3 electric multiple unit (EMU), very modern EMU sets built to crash norm DIN/EN 15227 and operated by the French owned Bayrische Oberland Bahn (BOB, trading as Meridian), collided head-on with an impact speed of around 150 km/h (90 mph) near Bad Aibling in Germany. Investigations found that the signaller had been at fault due to diverting his attention to playing an internet game on his mobile telephone at least until very shortly before impact. Soon the expression “schlamperei” (sloppiness) appeared in several German media comments. indicating irritation with bad job-related discipline on the railways that once again went undetected until an accident occurred. This issue concerned use of the Zs-1 Ersatzsignal (Pass on Sight Aspect), presumably to assist the 4 minute late-running Southbound service with timekeeping by sending it into a single-line section that in fact was already occupied by another service. Not only was it found in the Bad Aibling Zs-1 recorder that this had been done two months as well as six days before this accident, but there have been three well-documented previous fatal accidents in which errors with the Zs-1 signal aspect played a role: Berlin Wannsee on 09-05-1993 (signaller at fault), Brühl near Cologne on 06-02-2000 (non-compliant use of the Zs-1 aspect, overspeed derailment, driver blamed) and Schrozberg in Bavaria on 11-06-2003 (signaller at fault). No other European network that uses Pass on Sight Aspects (to keep trains rolling with a modicum of expedience in case of signal failures), i.e. France (“oeilleton” signal), Austria and former Austrian / Hungarian railway operations, Switzerland and Britain, lists such a repeated series of fatal accidents. In Britain such incidents go back to the erroneous use of the interlock release key (e.g. Battersea Park in 1937 and South Croydon in 1947) and predates current signalling systems.
This article in no way tries to pre-empt the official inquiry in to the recent accident or to make recommendations regarding that accident, but attempts to expose the wider issues arising from misuse of such special signalling arrangements and the potential for consequential errors.
The railway line.
The accident occurred near the Bad Aibling Kurpark platform halt in a curve with a 100 km/h (60 mph) speed restriction (from 120 km/h – 75 mph permitted maximum speed) along the river, where dense lineside vegetation hinders forward view, along the Mangfalltalstrecke. This is a 37 km (23.10 mile) long single-track electrified railway along the river Mangfall between Holzkirchen and Rosenheim in Bavaria. The line has five double-track crossing stations that are located approximately 5 kilometres (3 miles) apart and from Heufeld via Bad Aibling to Kolbermoor is controlled by the signaller at Bad Aibling station from a 1970’s SpDrS60 push-button electric relay NX panel. The line is no quiet backwater; in times of disruption on the electrified double-track (Innsbrück – Kufstein, Austria) – Rosenheim – Munich main line this is the primary diversionary route. Furthermore, booked as well as diverted freight services regularly use this line.
The trains involved.
As booked the two services involved were to cross at Kolbermoor station. The westbound service M79506 from Rosenheim to Holzkirchen entered the Kolbermoor station loop on time and was booked to wait 5 minutes for the opposite service to arrive, but it left on time on a proceed aspect. The eastbound service M79505, from Munich via Holzkirchen to Rosenheim and due to come into Kolbermoor from Bad Aibling, ran 4 minutes late. The signaller stated that he noticed that the signalling from Bad Aibling to Kolbermoor did not accept his input for M79505. He expected what he called a “Phantomstörung”, a spurious fault, and then used the ZS-1 facility to override the PZB90 train protection to get the train going to adhere to the booked meet at Kolbermoor. Somehow he expected the on time westbound service M79506 to wait for the booked crossingdespite having given it the road to Bad Aibling which therefore disabled his choice to set the road for M79505. The Zs-1 “Ersatzsignal” as defined in the German railway signalling handbook, is a small triangle of steady white lights under the main signal, meant to allow a train to pass a failed main signal without the need for oral contact between signaller and driver. M79506, having already passed its signal, now caused that driver to be unaware of any issue with the route ahead. The delayed driver on M99505 at Bad Aibling adhered to regulations on departing on a ZS-1 aspect by passing the PZB ATP magnet at the signal at 40 km/h (25 mph) till clear of the single-line turnout and from there he accelerated, still according to the rules, to 100 km/h (60 mph). The signaller, realising his first mistake, then made a second mistake by sending out an emergency stop message on the GSM-R train radio, but in his stressed confusion used a wrong call destination field on his GSM-R computer screen and sent the emergency message to station staff along the line. Shortly thereafter the mistake was noticed and a second successful attempt was made , by now too late. There initially were 11 fatalities, whilst 85 people were injured of whom 24 severely, but two months later one of the injured passed away in hospital.
The signal aspect.
The Zs-1 Ersatzsignal is a small white triangle of steady white lights under a main aspect. The rules require that s after checking that the line ahead is clear the aspect may only be used when the associated main signal cannot show a proceed aspect because there is:
1) A defective signal semaphore or light bulb,
2) A defective turnout detection, but only after the turnout has been secured in the proper position,
3) A defect in the signalling block system, e.g. a cable fault, and it has been established that the line is clear,
4) A proven clear track circuit that persistently keeps showing occupied,
5) No normal possibility to set up a signal-protected route for a necessary special move that is protected according to the relevant rules.
The use of Zs-1 is logged on an automatic counter and the signalling book has to be filled with the logged number and an explanation as to why the Zs-1 signal was used. When the signal is illuminated it will show its aspect for 90 seconds and then automatically extinguish. On receipt of the Zs-1 the driver must reset his PZB’90 train protection by pushing and holding a button until a 4 lights up and then drive past the signal, to avoid being stopped by the PZB’90 magnet there. The train must travel at 40 km/h (25 mph), prepared to stop before any obstruction, until a next relevant signal is reached, from where the driver adheres to the appropriate aspects shown. However, in case of a starting signal (Ausfahrsignal) exhibiting a Zs-1 aspect, the driver must adhere to the 40 km/h rule until the train has passed the last turnout of the yard or station (Ende Weichenbereich) and is then permitted to accelerate to 100 km/h in section. In the case of the February 2000 accident at Brühl the driver, lacking route knowledge, erroneously thought that he had passed the last turnouts and (against the rules) then accelerated to 120 km/h (75 mph) after passing a Temporary Speed Restriction board with a 12 that was in fact not meant for him. In the case of Bad Aibling the driver passed the last turnout on entering the single line section and then accelerated to 100 km/h (60 mph) as permitted by the rules.
During the week following the accident reports various media reports suggested that Zs-1 signals were being used for rather different purposes to those intended, as was in fact clear from other accidents as well. Whilst rail officials denied it, a signalman’s union official stated in the media that the aspect was occasionally used after “serious deliberation” as a kind of “get out of jail” card. That is what it is there for, according to this statement.
Issues with use of this signal and with emergency communication.
From the accidents mentioned an emerging picture of use, communication problems and the reaction of drivers after receiving the aspect, point at the following safety issues.
- The apparent ease of deciding to use the aspect.The decision to use the aspect was taken by a signaller on his own, without further recourse to either another person or equipment checking the justification and validity of the decision in terms of train safety. There is, incidentally, reason to take hints at fairly regular misuse of the aspect in the media at face value.
- The apparent ease with which it is possible to overlook section occupation.Like any other electro-magnetic relay signalling installation the Siemens SpDrS60 panel shows the set route with a string of yellow lights in the graphical representation of the track layout. If a track circuit gets occupied the string of yellow lights change to a single red occupied section light. If a particular track section as shown on the diagram is long, as in a single track section between stations, it may be possible to overlook that the section is showing track occupied.
- The permitted speed of travel under what is in fact degraded signalling integrity.There is reason to query the safety aspect of allowing a service departing on a Zs-1 aspect to travel at 100 km/hr (60 mph) when the Zs-1 aspect is a case of degraded signalling. Even if the rules prescribe several types of signaller checks that the track ahead of the signal is clear, there is evidence from at least three accidents that indicate uncertainty whether those checks will be properly completed. Certainly when one person controls a longer section of line.
- The issue of checking the use of the aspect from signalling records.Checking of the signalling book, the signalling fault book and the Zs-1 signal occurrence counter figures by supervisors does not appear tohave been either frequent or thorough. That in turn might be interpreted as either a lack of show of authority from the side of supervisors or, worse, a tacit agreement with this type of misuse.
- The wrong radio screen destination field used to distribute the emergency message.It is surprising to find that the emergency stop message to the train drivers, which always is a matter of stress and therefore should be very obvious, appears to have been a matter of clicking the “right” button amidst a number of message destination fields. This is where the local GSM-R radio MMI design failed, certainly when it was stated that the collision could have been avoided had the first message been received in the cabs.
- Technical aspects.One could also question the technical merit of providing a Zs-1 signal for where it is the final protection of a single line section, or at least use without some supplemental conditions to eliminate the risk of an oncoming train.