> It is loosely based on the real-life CSX 8888 incident, telling the story of a runaway freight train and the two men who attempt to stop it. It was the last film Tony Scott directed before his death.
If you find this sort of analysis interesting, the UK's Rail Accident Investigation Branch publishes reports into all serious incidents on the UK railway system – with the main focus on identifying ways to prevent similar accidents in the future. I've always thought these were a pretty good example of root-cause analysis of failures that much of the software industry could learn from.
Basically the train lost the ability to brake and effectively rolled backwards and forwards over a 4.7 mile section of track, with gradients on either end, until it came to a stop in the lowest section of the line see page 11).
"The air hoses between the locomotive and the cars were not connected, as is normal during this kind of switching operation. The air brakes on the cars were therefore inoperative."
This part confuses me. I was under the impression that modern train air brakes are fail-safe, i.e. pressure will release the brakes, no pressure will result in them being applied, so that the cars couldn't be moved in the first place without the air hoses between locomotive and cars being connected. Can someone with a better understanding of rail operation help me out here?
From my understanding, most modern vacuum brakes involve two pressure loops with two cylinders on each brake. When connected and operating, one cylinder is responsible for brake force and the other acts as counter to it - in case of disconnect, the countering cylinder evacuates fast and results in braking.
However, if the system is not "primed" (for example after longer stay disconnected which gets both cylinders empty) the brakes are inoperational except for manual mechanical brake one is supposed to apply for any longer stay.
The air brake system is fail safe against accidental disconnection. You can intentionally get around it if needed. Obviously they did something like that here, expecting it to be a safe setup for low speed shunting in a yard...
Also, fail-safe only works so far. A parked car needs to have handbrakes set or wheels chocked, since the air can eventually bleed out of the reservoir and release the brakes. The Lac-Mégantic disaster [0] involved insufficient handbrakes set on a train parked on a grade.
All US rail freight cars have a "bleed rod" that releases all the air in the brake system so you can move cars for switching.
Most large railroad yards nowadays are "hump yards" where a locomotive pushes cars over a small hill and they roll down the though a series of switches with a computer monitoring their progress and activating rail mounted brakes that squeeze the sides of the wheels so they roll into other cars at a controlled speed to make up trains.
Smaller yards, like in this story of the runaway, are "flat switched" where a locomotive and man power manually do all this work to put a train together. Back before railroads started reducing train crews the engineer wouldn't need to get out to align switches; they had a "switchman" who would get out and align the switches as needed.
And if you ever see "DO NOT HUMP" on the side of a car, this is what it refers to.
Crews also "kick" cars in flat yards which looks a bit more like humping in that brakeless cars roll down tracks on their own: https://youtu.be/zEWE3df6Q2s?t=248
The diagrams are very complicated - you'd think it would just be a spring-applied brake with air disengaging it, but it seems to be a much more complex system.
There is one, but it was rendered ineffective by the engineer's application of the independent brakes on the locomotive. This is another one of those classic cascades of errors, with each mistake paving the way for the next.
It just floors me that he didn't come to a complete stop before disembarking the locomotive.
Like a RFID tag or something on the engineer, that would let the train shut down if not found. Of course the engineer might accidentally leave that in the cabin.
The biggest problem with failsafes of that nature is that they get disabled, either because the users find them annoying day-to-day or because something in the system failed in the field and getting the equipment back in service was prioritized over maintaining all safety checks.
Most dump trucks have alarms that will go off if the bed is raised while moving and some modern ones can even limit speed while the bed is raised (there are plenty of legitimate uses for driving slowly with the bed up), yet it seems like we don't go a month without someone slamming one in to a bridge.
The reason he got off was the train was about to blow through an improperly configured switch. He jumped off at the last minute to flip the switch mere seconds before the train made it there.
As people have mentioned with modern systems there is rarely one single point of failure. It usually requires the failure of multiple systems in close succession.
In this case the rails were slick with rain, the switch was erroneously in the wrong configuration, the engineer misconfigured his locomotive in haste, the engineer dismounted a moving the locomotive against policy, the engineer failed to board the locomotive due to the wet handholds being slick as well as the train picking up too much speed, and only then did they have the full on runaway train.
Changing any one of the above variables and there is no incident.
Now the question is: why did he think it was acceptable to disembark? The report says this was an experienced engineer with a clean record. If it had worked, he probably expected he would get away with it. That’s the real problem.
His expectation that he would be successful may have rested on several misapprehensions: He thought he had engaged dynamic braking and thought it would be effective at that speed. On account of the first issue, he did not realize that increasing the engine output would cause the train to accelerate (as opposed to merely energize the field windings, as it would with dynamic braking properly selected.) In addition, "the engineer seemed to believe, in error, that an automatic brake application would improve braking power on single locomotive with the independent brake fully applied" (from the conclusions of the report.)
Plus he was acting in haste, and therefore not thinking it through.
He has the choice of sticking to policy but having an accident, or ignoring the policy to avert the accident, only to cause a different accident later due to some additional factors.
A dead man’s switch should be fail-close, and enable operation when functioning, not disable operation upon disfunction. The latter is vulnerable to double failures, the former is not.
"The Alerter system is connected directly to the air brake system which functions to provide an automatic full service penalty application of the air brake system, and a power knock out (PC) caused by failure to acknowledge the time out feature usually about 40 seconds. When the Alerter time out has expired, the engineer must acknowledge by tripping the acknowledging switch which will reset the time out feature. The Alerter system is nullified when locomotive brake cylinder pressure of 20 psi is developed in the Independent Application and Release pipe. This also prevents the P2A Application Valve from triggering a service brake application and PC action."
A dead man’s switch should be fail-close, and enable operation when functioning, not disable operation upon disfunction. The latter is vulnerable to double failures, the former is not.
There was a recent incident in Germany in 2019 [1]. A runaway train loaded with timber travelled some 94 km through Germany. Operators were able to clear all tracks on the way so miraculously no injuries whatsoever.
I wouldn't say "miraculously" (Because it makes it sound like it isn't normal for no injuries). Safety regs are strict exactly to prevent injuries/deaths. Still deserves a lot of respect though.
Being dragged 80ft because you're voluntarily doing something against the rules (don't attempt to board a moving train is like 1950s level workplace safety stuff, everyone has it on the books) isn't considered an event worth mentioning in the kind of workplace where people get turned into pancakes if they're not careful.
It was 2001, OSHA was much more amenable to internal handling of these kinds of things back then.
33 comments
[ 3.7 ms ] story [ 75.4 ms ] threadhttps://en.wikipedia.org/wiki/Unstoppable_(2010_film)
https://www.gov.uk/government/organisations/rail-accident-in...
https://assets.publishing.service.gov.uk/government/uploads/...
Basically the train lost the ability to brake and effectively rolled backwards and forwards over a 4.7 mile section of track, with gradients on either end, until it came to a stop in the lowest section of the line see page 11).
This part confuses me. I was under the impression that modern train air brakes are fail-safe, i.e. pressure will release the brakes, no pressure will result in them being applied, so that the cars couldn't be moved in the first place without the air hoses between locomotive and cars being connected. Can someone with a better understanding of rail operation help me out here?
However, if the system is not "primed" (for example after longer stay disconnected which gets both cylinders empty) the brakes are inoperational except for manual mechanical brake one is supposed to apply for any longer stay.
[0] https://en.wikipedia.org/wiki/Lac-M%C3%A9gantic_rail_disaste...
Most large railroad yards nowadays are "hump yards" where a locomotive pushes cars over a small hill and they roll down the though a series of switches with a computer monitoring their progress and activating rail mounted brakes that squeeze the sides of the wheels so they roll into other cars at a controlled speed to make up trains.
Smaller yards, like in this story of the runaway, are "flat switched" where a locomotive and man power manually do all this work to put a train together. Back before railroads started reducing train crews the engineer wouldn't need to get out to align switches; they had a "switchman" who would get out and align the switches as needed.
Crews also "kick" cars in flat yards which looks a bit more like humping in that brakeless cars roll down tracks on their own: https://youtu.be/zEWE3df6Q2s?t=248
https://en.wikipedia.org/wiki/Railway_air_brake describes a "fail-safe" system which has been "nearly universally adopted" which might give you some details.
The diagrams are very complicated - you'd think it would just be a spring-applied brake with air disengaging it, but it seems to be a much more complex system.
It just floors me that he didn't come to a complete stop before disembarking the locomotive.
Most dump trucks have alarms that will go off if the bed is raised while moving and some modern ones can even limit speed while the bed is raised (there are plenty of legitimate uses for driving slowly with the bed up), yet it seems like we don't go a month without someone slamming one in to a bridge.
As people have mentioned with modern systems there is rarely one single point of failure. It usually requires the failure of multiple systems in close succession.
In this case the rails were slick with rain, the switch was erroneously in the wrong configuration, the engineer misconfigured his locomotive in haste, the engineer dismounted a moving the locomotive against policy, the engineer failed to board the locomotive due to the wet handholds being slick as well as the train picking up too much speed, and only then did they have the full on runaway train.
Changing any one of the above variables and there is no incident.
Plus he was acting in haste, and therefore not thinking it through.
Another train caught up with this runaway train, coupled to it, attached the air brake hoses, and applied the brakes.
This slowed the train to a crawl. Then an engineer was able to jump aboard and cut the power.
The only damage was the burned out brakes on the locomotive.
"The Alerter system is connected directly to the air brake system which functions to provide an automatic full service penalty application of the air brake system, and a power knock out (PC) caused by failure to acknowledge the time out feature usually about 40 seconds. When the Alerter time out has expired, the engineer must acknowledge by tripping the acknowledging switch which will reset the time out feature. The Alerter system is nullified when locomotive brake cylinder pressure of 20 psi is developed in the Independent Application and Release pipe. This also prevents the P2A Application Valve from triggering a service brake application and PC action."
[1] (German) https://www.merkur.de/bayern/zug-in-bayern-ausser-kontrolle-...
It was 2001, OSHA was much more amenable to internal handling of these kinds of things back then.