Bad Signaling at Bad Aibling

The Bad Aibling rail accident was a head on rail collision that took place on February 9th, 2016 on a single track portion of railroad near Bad Aibling Germany.  As of this writing the investigation is pointing towards human error on the part of the signalman and, more specifically, the fact that the signalman was playing a game on his mobile phone around the time the events of the accident occurred.  Now. while phone distraction has played a role in previous rail accidents, in this case I believe the true culprit is the design of the German railway signaling system itself and any claims of distraction are simply an easy answer.

This tower operator is distracted, but not unsafe

First let's deal with the issue of distraction.  Unlike operating a vehicle, operating a tower or dispatch interface does not require constant attention.  Of course it is better to have someone paying attention, but it is not unsafe and moreover, distractions are already built into the job.  Operators frequently have to use the restroom, eat meals, talk on the phone to other railroad employees or even leave the tower to deliver train orders.  In a job filled with distractions, the whole point of the signaling system is to prevent distraction from leading to accident.  It is a fundamental principal of railway signaling for things to fail safe.

German Zs1 Signal

The mechanism that allowed two trains to end up in a cornfield meet is the Zs1 signal, shown above.  Known as an "Ersatzsignal" or Substitute signal it is placed below a "main signal" and lit upon command of the signaler when the main signal cannot be displayed normally.  Many in English speaking rail circles have described it as a Restricting or call-on signal, but that analogy is not entirely accurate. In practice it is more like a manual block clear of the type that can still be encountered on the LIRR.  Trains pass the Zs1 and proceed through all turnouts at no more than 25mph and before they can increase to normal speed .  Some sources state the 25mph limit applies to the next main signal, but a majority say normal speed and that would agree with the behavior of the second train involved with the accident.

Zs1 Displayed for a train movement

 The Zs1 signal is displayed when, for any reason, the main signal governing movement into a section of track, cannot be displayed.  This can be due to a bulb out condition, an axle counter miscount or any other problem with the signaling system.  As far as I can tell, the Zs1 guarantees route locking only.  In most rail systems around the world, when the signal system fails trains must proceed on sight prepared to stop short of an obstruction or other problem.  This is because even in the case where the cause of the failure is known, that doesn't mean a second problem might exist.  Because the situation of compound failures can lead to accidents, in most of the world a substitute signaling system must replace the automatic one to relieve trains of this burden of traveling at Restricted speed .  As one might expect, performing this task can be quite involved, requiring multiple signalers and communicating the fact to many trains and qualified employees. However in Germany all it takes is a button press to light up the Zs1.

Bad Aibling Stellwerke

In North America there is no signal that can be displayed into a CTC block where traffic is set in the opposite direction in the same way a Zs1 is used in Germany.  You can't even give a Restricting against the flow of traffic, necessitating a permission past stop procedure and even then the train will continue to be limited to Restricted speed.  The permission past stop procedure involves speaking to the locomotive engineer, usually over an open radio channel.  Yes. dispatchers in North America can screw this up, but the procedure takes time, requires two persons and requires the operator or dispatcher to pay attention.  In Germany the signaler presses a button and the train operator heads on his way.  When used for routine problems like bulb out or axle miscounts the process can become rote and the procedure can be shortened or skipped entirely.

The Zs7 Caution signal is the best analog to North American Restricting

Unfortunately I don't as of yet know what the Zs1 procedure involves, but I from what I have read it consists of ensuring that the block is actually free of obstructions.  A newer signal, Zs7 Caution, is used in places where the signaler is unable to positively determine block occupancy and does in fact require the train receiving it to proceed at Restricted speed, but the problem of actually setting a route against traffic remains.

313 absolute signal where the Zs1 was displayed before the collision. Annotated version.

While misuse of the Zs1 was the ultimate cause of the accident, there were a number of other systemic factors that contributed to it.  First, closed channel radios are employed  in theory to prevent "confusion" over who is speaking to whom, but the end result is that train operators are kept in the dark.  Furthermore, in the case of the Bad Aibling accident closed channel radios actually prevented the signalman from being able to stop the trains involved with a radio call because he forgot the correct emergency broadcast code to use.  You know, as opposed to pushing transmit to talk.


Second, the use of axle counters as a cheap alternative to track circuits, only serves to further ingrain the manual block thinking.  Detecting track occupancy without track integrity only perpetuates the inability of distant signals to stop trains.  Moreover, while axle counters are prone to failure (or miscount), just like track circuits, the signaler is able to reset the problem on his own with a button, instead of needing a maintainer to fix it.  While some can see that as a feature, it removes a valuable form of two person control.  Again, fixing signal problems via the interlocking panel becomes habitual and eventually an accident happens.

Panel blocking was a basic way the PRR made operators think twice before bypassing signal protections.

Most signaling systems have their single point of failure.  In North America there isn't anything preventing an operator or dispatcher from giving a bad Form D and running a train into another on a stretch of single direction ABS track.  However for the last 50 years we have been on a quest to eliminate ABS and replace it with something where such a mistake cannot be made because the technology prevents it.  Germany however, despite all its fancy train protection systems, flank protection and signal overlaps, is still burdened with 19th century thinking when it comes to block systems.  As a society Germans are really good at following procedures so therefore these sorts of accidents are rare, but allowing something like the Zs1 still tempts fate and every so often you get burned.

Note: This is my 261st post.  Yay for important milestones!