Intercités crash outside Paris, multiple fatalities

[petergb]

Another view of the fishplate and problematic section of track, and also a diagram showing its location, are available from https://twitter.com/SNCF_infopresse/media/grid. Some pictures of damaged wheels etc. there also.

(after selecting a picture, a hi-res version can be accessed from the pic.twitter.com link in the text caption)

Although the diagram shows a simple diamond, I think in reality it's probably actually a double slip (agreeing with edwin_m above) - difficult to make sense of the rail layout otherwise.

The other view https://twitter.com/SNCF_infopresse/status/356426148940505088/photo/1 might perhaps show the nuts and bolts in the positions in which they were found?

 

[khib70]

Several reports suggest that the driver showed "exceptional reflexes" in protecting the line and preventing further casualties.

Anyone familiar with SNCF know what exactly the driver would have done in that situation. In my very limited knowledge, protecting the line after such an event is quite a complicated and lengthy process. Does the driver of an SNCF loco have access to a button which closes everything down? Genuinely curious.

 

[CC 72100]

In my very limited knowledge, protecting the line after such an event is quite a complicated and lengthy process. Does the driver of an SNCF loco have access to a button which closes everything down? Genuinely curious.

I believe so, one which turns all signals to red. I remember watching a documentary about the Gare De Lyon crash in 1988, in which the driver, upon pressing this button, turned all signals to red, erased all set signalling paths, and meant that cab radios could not be heard for the high pitched siren that it sent out.

http://www.youtube.com/watch?v=1-Y0w0TWujI

Go to 09:30, it shows the hitting of the radio alarm. The erasing of pre-set signal paths was a 'side effect' which I think is only discussed in the analysis bit of the program.

 

[MarkyT]

I believe so, one which turns all signals to red. I remember watching a documentary about the Gare De Lyon crash in 1988, in which the driver, upon pressing this button, turned all signals to red, erased all set signalling paths, and meant that cab radios could not be heard for the high pitched siren that it sent out . . .

. . . The erasing of pre-set signal paths was a 'side effect' which I think is only discussed in the analysis bit of the program.

I believe Gare de Lyon station was signalled using a solid state interlocking system similar to contemporary installations in the UK. As was common at the time the control centre was equipped with an operator emergency 'All signals at red' button that functioned by simply cutting off power to the signalling interlocking processors. Whilst this effectively placed signals to red, as the local object controllers loose communications and fail safe, the unfortunate side effect is an immediate and complete loss of all the trackside status indications, affecting other dependent systems such as train describers and train radios, and results in the inability to channel any further commands through the system to move points to divert a runaway for example. I think the French controller in the Gare de Lyon event was following standing instructions to operate the 'emergency stop' when receiving a particular level of alarm on the train radio system, but he couldn't determine which of the approaching trains was out of control. The action of cutting off power to the control computers clearly did not help, resulting in an effective blackout of status information and meant points couldn't be moved even if the controller knew which ones to change. More modern installations in the UK (and older ones retrofitted) now feature 'signals at red' controls for particular junctions and stations that function without tripping out the signalling computers. I assume French Railways have learned similar lessons from the incident.

 

[BestWestern]

I believe so, one which turns all signals to red. I remember watching a documentary about the Gare De Lyon crash in 1988, in which the driver, upon pressing this button, turned all signals to red, erased all set signalling paths, and meant that cab radios could not be heard for the high pitched siren that it sent out.

http://www.youtube.com/watch?v=1-Y0w0TWujI

Go to 09:30, it shows the hitting of the radio alarm. The erasing of pre-set signal paths was a 'side effect' which I think is only discussed in the analysis bit of the program.

That sounds vaguely similar to the 'Emergency' function on GSMR radio units, which when pressed will reset all signals in the immediate area ('cell') and the adjacent areas (one 'cell' either side I believe) to danger, as well as putting through an immediate call to the Signaller, cutting all other calls in the process. Rather says a lot about the state of our railway that the French had a similar system as long ago as the late 80's!

 

[jon0844]

I'd hope there's a lot of differences between that system and a newer digital one.

 

[BestWestern]

I'd hope there's a lot of differences between that system and a newer digital one.

Well, however the details look the end result is broadly similar I would think. GSMR may be new in terms of its introduction to the railway, but it is not the latest tech as I understand it, and it is certainly long overdue. I would wager that whatever SNCF are using at present is at least as good, and very probably better.

 

[jon0844]

GSM is pretty old, but still forms the basis for newer digital systems.

Is there anything newer than GSR-R? I mean, we obviously have 3G and 4G phone systems now, but 3G wouldn't be worth the need to upgrade equipment - and 4G is ultimately designed for voice over IP (even if the current 4G networks aren't offering voice at all, dropping users back to 3G or 2G for voice telephony).

I wouldn't have thought SNCF could be using anything better, but I am no expert on how such systems are used on private networks.

The emergency services might be using TETRA, a system I saw tested in the mid 1990s (I travelled with Motorola to the Atlanta Olympics, where they were used and were very effective after the terrorist incident in the village) but I don't know how that might work over a longer range, or if GSM-R is effectively the same setup for allowing calls to one and calls to many.

 

[BestWestern]

GSM is pretty old, but still forms the basis for newer digital systems.

Is there anything newer than GSR-R? I mean, we obviously have 3G and 4G phone systems now, but 3G wouldn't be worth the need to upgrade equipment - and 4G is ultimately designed for voice over IP (even if the current 4G networks aren't offering voice at all, dropping users back to 3G or 2G for voice telephony).

I wouldn't have thought SNCF could be using anything better, but I am no expert on how such systems are used on private networks.

The emergency services might be using TETRA, a system I saw tested in the mid 1990s (I travelled with Motorola to the Atlanta Olympics, where they were used and were very effective after the terrorist incident in the village) but I don't know how that might work over a longer range, or if GSM-R is effectively the same setup for allowing calls to one and calls to many.

Who knows, the stuff gets rather complicated when you start delving too deeply into it all! GSM-R should, in theory, be a reliable system with blanket coverage, and I suppose you could argue quite reasonably that that's all you need. It should have been in place a long time ago however, and it's telling that at the same time as it is finally coming on stream, NR are already testing the next generation of signalling on the Cambrian. I'm no expert, but where I do think a trick was missed is in not using the network for other auxiliary on board kit, for example wi-fi and perhaps the next generation of 'live' chip and pin devices, which I presume could make use of the coverage if desired? Or is that complete rubbish; as I say, I am not an expert on such matters!

 

[jon0844]

I do think we need future trains to be 'connected' and be able to send and receive all sorts of information in real time, as well as providing Wi-Fi and information to passengers, a live connection for ticket sales/authorisation for staff etc..

But I also expect that from a safety point of view, many people would argue that anything to do with safety/signalling would remain disconnected from other things that are not safety critical. So we might be a way off that happening.

 

[edwin_m]

GSM-R is basically a 2G system with some extra features for railway use including (if I recall) priority emergency broadcasts and an emergency stop which is transmitted to all nearby trains. I'm never heard of it actually putting the signals to danger.

The hope is that the rail industry will be able to upgrade to later generations of technology without all the complication that the present system has had. The upwards compatibility of 3G and 4G equipment with 2G may help in this, but there is still a need to get all the railway-specific features onto a new technology platform.

 

[jon0844]

I don't see any need to go for 3G or 4G, as any data requirements are probably quite low - and you have EDGE which is technically a 3G standard. I don't know if GSM-R can use this.

4G would be great for offering high-speed Internet access to passengers, but I can't see why it would be necessary for safety critical operations.

 

[edwin_m]

People are saying that GSM-R in its current form doen't have enough bandwidth to run ERTMS level 3.

 

[CC 72100]

I believe Gare de Lyon station was signalled using a solid state interlocking system similar to contemporary installations in the UK. As was common at the time the control centre was equipped with an operator emergency 'All signals at red' button that functioned by simply cutting off power to the signalling interlocking processors. Whilst this effectively placed signals to red, as the local object controllers loose communications and fail safe, the unfortunate side effect is an immediate and complete loss of all the trackside status indications, affecting other dependent systems such as train describers and train radios, and results in the inability to channel any further commands through the system to move points to divert a runaway for example. I think the French controller in the Gare de Lyon event was following standing instructions to operate the 'emergency stop' when receiving a particular level of alarm on the train radio system, but he couldn't determine which of the approaching trains was out of control. The action of cutting off power to the control computers clearly did not help, resulting in an effective blackout of status information and meant points couldn't be moved even if the controller knew which ones to change. More modern installations in the UK (and older ones retrofitted) now feature 'signals at red' controls for particular junctions and stations that function without tripping out the signalling computers. I assume French Railways have learned similar lessons from the incident.

Thanks for your post and the subsequent posts below that have added more info/corrected some of mine on this one. I like to think I was on the right tracks to begin with (pun intended) but that helps to clear up my vague post.

 

[jon0844]

People are saying that GSM-R in its current form doen't have enough bandwidth to run ERTMS level 3.

Doing a search came up with this;

http://www.thalesgroup.com/Markets/...Content/Environment_LTE/Moving_ahead_with_4G/

The capacity challenge
The communications standard currently used by the rail industry – GSM-R – is one of the building blocks of ETCS, the European Train Control System. In ETCS Level 2 systems, GSM-R provides the channel by which vital movement authority data is transmitted to trains.

But GSM-R has limitations. It can only be used for operational purposes, so passengers get no direct benefits. And because it’s a narrowband solution, base station overload – particularly at large stations and marshalling yards – can cause operational difficulties.

 

[33056]

I believe Gare de Lyon station was signalled using a solid state interlocking system similar to contemporary installations in the UK. As was common at the time the control centre was equipped with an operator emergency 'All signals at red' button that functioned by simply cutting off power to the signalling interlocking processors. Whilst this effectively placed signals to red, as the local object controllers loose communications and fail safe, the unfortunate side effect is an immediate and complete loss of all the trackside status indications, affecting other dependent systems such as train describers and train radios, and results in the inability to channel any further commands through the system to move points to divert a runaway for example.

Can't speak for more modern SSI installations but the "all signals on" button should not be used to replace signals in an emergency. By pressing the all signals on button the following will occur:
Cuts off power supply to the interlocking area
Returns all signals within the interlocking area to danger
All track indications will show occupied
Train descriptions will step forwards
Point indications will be lost

This is on a 20 year old system.

 

[MarkyT]

Can't speak for more modern SSI installations but the "all signals on" button should not be used to replace signals in an emergency. . . . .

I don't know if this is provided at all on the operating floor in the latest installations, but I assume the original idea WAS a means for signallers to be able to stop all trains in a large scale emergency. I can't think of any good reason why such a facility should remain available to a signaller now*. I think it's a completely obsolete concept, superseded by the much superior signal group replacement controls (that do not cut off power and are a newer invention, definitely not provided in the early SSI schemes).

* except maybe to foil criminals/terrorists attempting a hostile takeover (think St Trinians!) - they'd not be able to restart the interlockings and assume control.

 

[edwin_m]

The panel or IECC that controls the SSI has a lower integrity than the SSI itself, because all it does is sent requests for the interlocking to do things, which it ignores if unsafe. There was a concern that the signalling centre system might "lock up" making it impossible for the operator to do anything, so the hardwired all-signals-on was provided through separate circuits so as to be independent of any other equipment. In fact by cutting power to the interlocking it also addresses the even remoter risk of the interlocking itself locking up. Most items of machinery where loss of control could result in danger have an independent emergency stop similar to this - including trains!

In the event of an incident on the line it's incredibly unlikely that the control system would also have failed, so the signaller could replace signals manually. However hitting a big red button is probably quicker and more reassuring than going round the screen cancelling individual routes.

 

[33056]

The signal box instructions in the place I referred to specifically say that the "all signals on" button should not be used in an emergency unless the normal procedure (ie replacing signals to danger by using the panel buttons) does not work.

The box instructions for a similar installation (NX panel with SSI) which is around 9 years younger also say more-or-less the same thing. Personally speaking, I would instinctively replace the signals to danger using the buttons on a panel if an incident occurred but would guess that a vitual "big red button" on a screen based system might be easier (never worked one of those nor want to!)

 

[MarkyT]

The panel or IECC that controls the SSI has a lower integrity than the SSI itself . . . There was a concern that the signalling centre system might "lock up" making it impossible for the operator to do anything, so the hardwired all-signals-on was provided through separate circuits so as to be independent of any other equipment.

Yes that was another theory I considered, however when a processor controlled panel or vdu control screen system controls a relay interlocking (the latter becoming increasingly common), there is also usually a separately wired override control to put all signals at red, but that doesn't completely power down the interlocking in the same way. I guess in the early days power down seemed an easy way of acheiving a similar result with SSI, but a better way would be to trigger the emergency stop via a separately wired input to a trackside functional module (local object controller) and deal with the logic in the high integrity SSI programme and data.

 

[edwin_m]

Yes that was another theory I considered, however when a processor controlled panel or vdu control screen system controls a relay interlocking (the latter becoming increasingly common), there is also usually a separately wired override control to put all signals at red, but that doesn't completely power down the interlocking in the same way. I guess in the early days power down seemed an easy way of acheiving a similar result with SSI, but a better way would be to trigger the emergency stop via a separately wired input to a trackside functional module (local object controller) and deal with the logic in the high integrity SSI programme and data.

Yes, this would be a perfectly sensible way of doing things. The fact it is done by cutting the power instead probably reflects institutional suspicion about the possibility of processor interlockings going haywire.

 

[BestWestern]

[deleted]