Acela derailment

[NE933]

It is disturbing that a movable frog in disagreement with the turnouts of a high speed switch can be made that way without any warning indication. A person not paying attention, or worse: someone intent on sinister purpose, has just exposed a fault that should never have been. Amtrak, move your a-- before we have 200+ people bleeding on the tracks! And it causes increased scrutinty from those who want to slash rail funding!!!!!!

 

[George Harris]

It is disturbing that a movable frog in disagreement with the turnouts of a high speed switch can be made that way without any warning indication. A person not paying attention, or worse: someone intent on sinister purpose, has just exposed a dault tha should never have been. Amtrak, move your a-- before we have 200+ people bleeding on the tracks! And it causes increased scrutinty from thos who want to slash rail funding!!!!!!

Let's try this one more time: JIS and I have both attempted to explain the situation: There was warning indication. The signal in approach showed stop. There are rules in place, well known standard rules of long standing that deal with movement of trains in this situation. permission ot pass a stop signal is given when necessary, as was the situation in this case, under a restricted speed rule. JIS gave the number of the rule. You will have to look at his post as these rules numbers are not in my brain. The rule is called restricted speed or sometimes yard speed, and generally in effect says, proceed able to stop within half the distance you can see, looking out for switch improperly lined, broken rail, other train movements, etc., etc., not exceeding 15 mph (or in some railroad's rules is or has been 20 mph).

There was a double rule violation here as best as can be determined for now. I am sure that there will be an investigation going into details, but due to the minor nature of this event, the details may never become public. They were, first, the switch was cranked over to be positioned for the train movement and blocked, but the frog, which is a movable point frog was not cranked over. Second, the engineer failed to notice in time to stop that the frog point had not been cranked over. I will add a third: There are movable frog designs that include a guard rail similar to that used with fixed frogs. The need for these is debatable so that there are also designs of these frogs that do not use these guard rails, and to the best of my knowledge this is the type that Amtrak uses. Whether these guard rails would have held tne train in place while the wheels going over the frog bounced up, ran along the top, and then drop back down and contining along the rail properly beyond the frog, maybe so and maybe not. This would be a suject for arguement.

The switch frog cannot be made to be in disagreement and a clear signal still be given. They can be made to be in agremment and a clear signal not be given. That is the nature of "interlocking" which essentially says that the track must be in all aspects be as it should and all circuits completed as they should before a signal permitting movement can be given. If any part is not as it should be, no permissive signal can possibly be given. This process is reliable and has been proven to be so for over 100 years. Railroad operating people bet their lives on it multiple times a day.

Although it has been claimed elsewhere that this derailment could possibly have led to a collision, that is simply not so.

I am a loss to know how we could make it any clearer.

 

[Trogdor]

This is turning into a railcon thread.

 

[jis]

Actually there was one piece of protection still in place. Even if the engineer tried he could not have exceeded the restricting speed limit. So even if he totally ignored everything he could not have derailed the train too much worse than he did.

When the train computer receives the Rule 421 release it is set automatically to enforce restricting speed until the 421 restriction is lifted, which would typically be at the next block signal.

So all these silly ideas about 200 people bleeding and a collision have no basis in facts.

 

[sechs]

I don't feel like people are responding to what I'm saying.

I understand that the engineer (or should I say, motorman) did not verify the switch as per the prevailing rules. I was asking about a system that would have warned about the switch situation, irregardless.

There isn't.

My point is, maybe there should be.

 

[sechs]

I don't feel like people are responding to what I'm saying.

I understand that the engineer (or should I say, motorman) did not verify the switch as per the prevailing rules. I was asking about a system that would have warned about the switch situation, irregardless.

There isn't.

Hence the signals dropping to the fail-safe "stop" indication.

Which apparently failed to be safe....

 

[sechs]

I don't feel like people are responding to what I'm saying.

I understand that the engineer (or should I say, motorman) did not verify the switch as per the prevailing rules. I was asking about a system that would have warned about the switch situation, irregardless.

There isn't.

Hence the signals dropping to the fail-safe "stop" indication.

Exactly! I wonder which part of "no protection in Rule 421" was not understood by sechs. But words are cheap, so repeating a critical point is worth it I suppose.

Oh, I understood it. The rule is just irrelevant to what I was talking.

 

[Trogdor]

Yep, definitely turning into a railcon thread.

 

[George Harris]

Exactly! I wonder which part of "no protection in Rule 421" was not understood by sechs. But words are cheap, so repeating a critical point is worth it I suppose.

Oh, I understood it. The rule is just irrelevant to what I was talking.

But, it is not irrelevant to real world railroad operations. That is what we are trying to discuss and explain. Note jis's statements:

Actually there was one piece of protection still in place. Even if the engineer tried he could not have exceeded the restricting speed limit. So even if he totally ignored everything he could not have derailed the train too much worse than he did.
When the train computer receives the Rule 421 release it is set automatically to enforce restricting speed until the 421 restriction is lifted, which would typically be at the next block signal.

So all these silly ideas about 200 people bleeding and a collision have no basis in facts.

Reality is that you cannot prevent everything all the time, so you have a way to minimize damage when all else goes wrong. That is why the FRA requires derails for tracks leading into high speed mains, and why it is common on most railroads to use derails even where not required by the FRA.

 

[jis]

Yep, definitely turning into a railcon thread.

I think someone is just trying to boost his posting count

On a more serious note, something that is most likely in place is for the CETC to be able to see the actual state of the switch even when automation is disabled, which it clearly is when the switch is being hand cranked. It would stand to reason that such state indicator would be available for both the switch point and the frog in case of movable frogs.

It is also possible that the electronics that failed causing the switch to be stuck also took out the sensor relay if there is one. These days when a circuit board fails a whole bunch of things go at the same time. I am afraid it is unlikely that we will ever come to know such minutia that will of course be considered in the inquiry.

The bottom line is no matter how well anything is designed, there will continue to be failure modes that take out all protections, and there has to be a way to work around such as safely as possible unless you want the railroad to come to a screeching halt awaiting replacement parts and repair each time something minor fails. A well designed safety regime allows for operations under failed conditions while ensuring minimization of damage should everything completely go wrong. But there is no way to completely ensure that nothing will ever be damaged.

The design of safety systems is premised on risk mitigation, wherein you design to reduce the risk of expensive accidents, but can't ever eliminate them. Safety systems cost money to put in place and operate. And no matter how much people hate it, at the end of the day it is always a matter of cold calculation balancing the cost of the system vs. the money at risk that it is mitigating.

Witness the bellyaching that is going on about installing PTC, which arguably hard to cost justify purely on risk mitigation basis, on many lines on which they were originally mandated, but since have been taken off the mandated list.

 

[Green Maned Lion]

My point is, maybe there should be.

No. This happens on the NEC, what? Once a year? Since the implementation of the PTC following the Chase disaster, afaik only the wreck in Secaucus lost any lives, and this due to the faulty design of the Comet IV cabs.situations like this in particular happen rarely. This is like asking to put the fifth braking system on an elevator because systems 1-4 failed causing the elevator to glide down and impact the basement at over a tenth of a mile an hour.

 

[sechs]

I think someone is just trying to boost his posting count

As if George really needed more posts....

On a more serious note, something that is most likely in place is for the CETC to be able to see the actual state of the switch even when automation is disabled, which it clearly is when the switch is being hand cranked. It would stand to reason that such state indicator would be available for both the switch point and the frog in case of movable frogs.

And, that was my reasoning. Such a system could be independent of other safety systems.

The bottom line is no matter how well anything is designed, there will continue to be failure modes that take out all protections, and there has to be a way to work around such as safely as possible unless you want the railroad to come to a screeching halt awaiting replacement parts and repair each time something minor fails. A well designed safety regime allows for operations under failed conditions while ensuring minimization of damage should everything completely go wrong. But there is no way to completely ensure that nothing will ever be damaged.

I agree. While I don't know how moveable frogs work, and, thus, why the switch and the frog aren't mechanically interlocked; it seems like there could be another layer of safety here. While unlikely, it's theoretically possible for this kind of situation to occur under otherwise normal operating condition; at track speed, as mentioned, this would probably be quite disastrous.

 

[sechs]

This is like asking to put the fifth braking system on an elevator because systems 1-4 failed causing the elevator to glide down and impact the basement at over a tenth of a mile an hour.

I don't know of any elevator with more than two breaking systems, but I'm sure they exist.
Elevators, however, don't operate in a known degraded state. You just take the stairs.

 

[Ryan]

I don't feel like people are responding to what I'm saying.

I understand that the engineer (or should I say, motorman) did not verify the switch as per the prevailing rules. I was asking about a system that would have warned about the switch situation, irregardless.

There isn't.

My point is, maybe there should be.

I would argue that there is, and it caused the signal to be red. Toss out rule 241 and your goals will be met. Not sure that you would like the results, though.

 

[NE933]

So all these silly ideas about 200 people bleeding and a collision have no basis in facts.

And we're all more grateful for that; let's keep it in the realm of fears and never let it become fact.

 

[Trogdor]

So all these silly ideas about 200 people bleeding and a collision have no basis in facts.

And we're all more grateful for that; let's keep it in the realm of fears and never let it become fact.

A better idea would be to throw out such a ridiculous idea completely, because while it will very likely never become fact, letting it become a fear can be just as dangerous, if not moreso.

The person who drives across the country because he/she is afraid to fly is far more likely to get killed on the road than in the air. If we now have some folks afraid to take the train because of ignorance of how the railroad works, fearing that their Acela train might take a misaligned switch at 150 mph and derail head-on into an oncoming Regional, then that irrational fear could just as likely push them onto the dangerous highways where they very well could be involved in a high-speed, head-on collision.

For those questioning whether the safety systems were adequate in this case: there's a reason why the lead locomotive (not the whole train, just the lead unit) derailed at 5 mph and not 50 mph or 150 mph.

 

[George Harris]

I agree. While I don't know how moveable frogs work, and, thus, why the switch and the frog aren't mechanically interlocked; it seems like there could be another layer of safety here. While unlikely, it's theoretically possible for this kind of situation to occur under otherwise normal operating condition; at track speed, as mentioned, this would probably be quite disastrous.

In very long turnouts there are multiple switch machines driving the switch points. Since the frog switch machine will be at least a couple hundred feet from the nearest switch point machine in a high speed turnout, to mechanically interlock it with the machines on the switch points is imrpactical, and if done all the extra rods, cranks, etc. would result in decreased reliability. In addition, safety would demand locking and detection on the frog, which would still required electrical and independent mechanical devices at the frog. These multiple switch machines are interlocked in the control system.

Short turnouts that have second drive points on the switch do have a mechanical connection between the two drive points so that they can be driven by one switch machine. This is the norm on No. 20 turnouts (normal speed for these is 40 mph to 45 mph) Usually the second drive point is neither detected nor locked, as the switch is safe whether or not it functions, but the second drive rod is only 19 feet 8 inches beyond the first drive rod. Likewise, spring frogs can be and are used on these things. A spring frog is one with the flangeway for the diverging movement held closed by a spring so that the wheels for trains on the through track do not go over a gap. When a train is using the diverging track the wing rail is pushed over by the wheels to open the flangeway for their passage. After the train goes through, the spring pushes the wing rail back to close the gap. Usually these devices are equipped with a shock absorber so that the wing rail does not snap back after every wheel passage.

(by the way,I am not trying to boost my post count. I have no idea what it is, nor do I care.)

 

[VentureForth]

(by the way,I am not trying to boost my post count. I have no idea what it is, nor do I care.)

Lest you get frustrated, I for one greatly appreciate the engineering aspect of this conversation.

 

[NE933]

So all these silly ideas about 200 people bleeding and a collision have no basis in facts.

And we're all more grateful for that; let's keep it in the realm of fears and never let it become fact.

A better idea would be to throw out such a ridiculous idea completely, because while it will very likely never become fact, letting it become a fear can be just as dangerous, if not moreso.

Welllll, not if it causes greater sense in rail signal employees to keep up their guard. I don't anyone getting more scared over nothing, and empty fear mongering is dangerous, just as you said. So, let's master whatever beneficial fears have been released from this, and any other incident that comes to mind (i.e. Chase, MD, Chatsworth, CA, Mobile AL, etc.) and harness its powers to make sure the horse never gets out of the barn.

Without sounding like a pompous moron (i'm sure i've succeeded in doing that already), what I'm trying to advocate(?) is that we don't just open up another bag of potato chips and crunch on as if nothing happened.

 

[AlanB]

Without sounding like a pompous moron (i'm sure i've succeeded in doing that already), what I'm trying to advocate(?) is that we don't just open up another bag of potato chips and crunch on as if nothing happened.

No one is doing that. I'm sure that the two people who made mistakes in this case will be disciplined at a minimum.

But again, when it comes to a 150 MPH accident that can't happen. The failure here that caused the derailment wasn't technically in the automatic system. The Automatic system worked as intended. The automatic system would never have allowed a train to go over that switch with the frog set diverging and the switch point set for normal. While we may never hear exactly what failed at that switch, the automatic system saw that something was wrong and it went to its fail safe mode. Meaning that it dropped all the signals in that area to red or danger as its called out on the railroad.

Now had the engineer disobeyed that red signal, the automatic controls on the train would have brought it to a stop. Therefore no 150 MPH derailment. Again, the system worked as intended.

The failures came at the human level. Amtrak sent a MOW person to fix things and he/she failed to follow proper protocol, prior to informing the dispatcher that the switch was correctly and safely positioned such that a train could cross it. The engineer failed to follow proper protocol in that while they operated the train at the proper speed, he/she failed to ensure that everything associated with that switch was set properly. And at the speed the train was traveling at, had the engineer been paying attention they should have seen that misaligned frog in time to stop the train prior to crossing the frog & derailing.

But there is no way that the automatic systems could have prevented the human failures. The automatics knew that something was wrong, whatever that was originally, and they shut down the corridor. Humans came along and took steps to temporarily bypass the automatics and they failed to follow the correct procedures to ensure the safe operation of the train.

 

[oldtimer]

Without sounding like a pompous moron (i'm sure i've succeeded in doing that already), what I'm trying to advocate(?) is that we don't just open up another bag of potato chips and crunch on as if nothing happened.

No one is doing that. I'm sure that the two people who made mistakes in this case will be disciplined at a minimum.

But again, when it comes to a 150 MPH accident that can't happen. The failure here that caused the derailment wasn't technically in the automatic system. The Automatic system worked as intended. The automatic system would never have allowed a train to go over that switch with the frog set diverging and the switch point set for normal. While we may never hear exactly what failed at that switch, the automatic system saw that something was wrong and it went to its fail safe mode. Meaning that it dropped all the signals in that area to red or danger as its called out on the railroad.

Now had the engineer disobeyed that red signal, the automatic controls on the train would have brought it to a stop. Therefore no 150 MPH derailment. Again, the system worked as intended.

The failures came at the human level. Amtrak sent a MOW person to fix things and he/she failed to follow proper protocol, prior to informing the dispatcher that the switch was correctly and safely positioned such that a train could cross it. The engineer failed to follow proper protocol in that while they operated the train at the proper speed, he/she failed to ensure that everything associated with that switch was set properly. And at the speed the train was traveling at, had the engineer been paying attention they should have seen that misaligned frog in time to stop the train prior to crossing the frog & derailing.

But there is no way that the automatic systems could have prevented the human failures. The automatics knew that something was wrong, whatever that was originally, and they shut down the corridor. Humans came along and took steps to temporarily bypass the automatics and they failed to follow the correct procedures to ensure the safe operation of the train.

Very well stated!

AMEN

 

[sechs]

I don't feel like people are responding to what I'm saying.

I understand that the engineer (or should I say, motorman) did not verify the switch as per the prevailing rules. I was asking about a system that would have warned about the switch situation, irregardless.

There isn't.

My point is, maybe there should be.

I would argue that there is, and it caused the signal to be red. Toss out rule 241 and your goals will be met. Not sure that you would like the results, though.

If you think that manual inspection is somehow an automated system, then you think you're right. I suppose that you want us to go back to hanging out train orders with hoops, too.

 

[sechs]

I agree. While I don't know how moveable frogs work, and, thus, why the switch and the frog aren't mechanically interlocked; it seems like there could be another layer of safety here. While unlikely, it's theoretically possible for this kind of situation to occur under otherwise normal operating condition; at track speed, as mentioned, this would probably be quite disastrous.

In very long turnouts there are multiple switch machines driving the switch points. Since the frog switch machine will be at least a couple hundred feet from the nearest switch point machine in a high speed turnout, to mechanically interlock it with the machines on the switch points is imrpactical, and if done all the extra rods, cranks, etc. would result in decreased reliability. In addition, safety would demand locking and detection on the frog, which would still required electrical and independent mechanical devices at the frog. These multiple switch machines are interlocked in the control system.

Short turnouts that have second drive points on the switch do have a mechanical connection between the two drive points so that they can be driven by one switch machine. This is the norm on No. 20 turnouts (normal speed for these is 40 mph to 45 mph) Usually the second drive point is neither detected nor locked, as the switch is safe whether or not it functions, but the second drive rod is only 19 feet 8 inches beyond the first drive rod. Likewise, spring frogs can be and are used on these things. A spring frog is one with the flangeway for the diverging movement held closed by a spring so that the wheels for trains on the through track do not go over a gap. When a train is using the diverging track the wing rail is pushed over by the wheels to open the flangeway for their passage. After the train goes through, the spring pushes the wing rail back to close the gap. Usually these devices are equipped with a shock absorber so that the wing rail does not snap back after every wheel passage.

(by the way,I am not trying to boost my post count. I have no idea what it is, nor do I care.)

I was joking about the post count thing, but I do thank you for the thoughtful response.
As I was saying, if it's possible for an electronic system to know whether the switch and frog are in the same alignment, an informational warning that they were not should have avoided a situation like this. It's a layer of redundancy that simply seems to be absent from the current system.

 

[Green Maned Lion]

This s getting nuts. Several people here, NE, who know rail operations, and a guy who is rail construction engineer, are telling you that this system is as safe as practical. The system worked perfectly. Something went wrong with the trackage on the fastest stretch of rail in this hemisphere. The fastest trainset we operate ran over this stretch and did everything wrong imaginable. And nobody got hurt. What the heck more do you want?

 

[Ryan]

I don't feel like people are responding to what I'm saying.

I understand that the engineer (or should I say, motorman) did not verify the switch as per the prevailing rules. I was asking about a system that would have warned about the switch situation, irregardless.

There isn't.

My point is, maybe there should be.

I would argue that there is, and it caused the signal to be red. Toss out rule 241 and your goals will be met. Not sure that you would like the results, though.

If you think that manual inspection is somehow an automated system, then you think you're right. I suppose that you want us to go back to hanging out train orders with hoops, too.

Nope.

If you toss out rule 241, when the automatic system detects danger, the lights turn red and the train stops until the system can be fixed. Safer, since it doesn't depend on manual inspection, but the delays will really stack up.