Background
Gengenbach is a town of 10950 people (as of December 2020) in the extreme southwest of Germany, located in the federal state of Baden-Württemberg 8.5km/5mi southeast of Offenburg and 19km/12mi east of the French border at Meißenheim (both measurements in linear distance).
Gengenbach lies on the Black Forest Railway (“Badische Schwarzwaldbahn”), a double-tracked electrified main line connecting Offenburg in the north with Singen (Hohentwiel) in the south. In addition, the DB (German national railway) refers to the entire route to Constance as the “Schwarzwaldbahn”. Opening in sections between 1866 and 1873 (and expanded to double-tracked status by 1921) the line navigates the mountainous black forest on 149km/92mi, going through 39 tunnels and several 180°-turns to limit the incline of the tracks, making a cogwheel-system unnecessary. Today the line is mostly used for regional passenger services, with some Intercity-trains and freight trains using the line as well, with a top speed of 140kph/87mph.
The train involved
The DB series 711.1 is a diesel-powered maintenance-train introduced in 2002, mostly for the installation and maintenance of overhead catenaries. Each unit measures 24.64m/87ft in length at a weight of 78.5 metric tons. The body of the train contains a workshop, a storage room, a break-room and a small bathroom as well as a workstation to watch the CCTV-feed from the roof-mounted camera. The camera-system watches a pantograph used to both ground the train and test the catenary, which shares the roof with two movable work-platforms (one moves up and down while the other has a telescoping arm to move in all directions). Each series 711.1 is powered by two MAN four-stroke diesel engines with a combined power output of 1176kW/1577hp from 22l of displacement each, along with a smaller 6.9l MAN diesel-engine producing 130kW/174hp to power the hydraulic systems and allow the train to “crawl” when the outside platforms are in use (referred to as the “work engine”). When ferrying between work-sites the series 711.1 can reach 160kph/99mph. Like all maintenance-vehicles the series 711.1 is easily identified by their bright yellow paint job, in contrast to the usual DB-red. One person is required to drive the series 711.1, while the equipment is set up to accommodate 10 workers in addition to the driver. The unit involved in the accident, 711 112, had a more capable braking-system than its 21 siblings, as it was mostly used in the mountainous black forest.
The accident
On the 9th of July 2020 DB 711 112 was sitting at Villingen, being meant to drive northbound to Freiburg via Offenbach with a driver and driver’s assistant on board. The purpose of the trip was so the assistant could gain experience with the route and train in the process of becoming a licensed driver. Departing 103 minutes ahead of schedule the first part of the trip passed without incident, climbing up to the rail line’s highest point at Sommerau before starting the descend towards Hausach on the line’s steepest section.
The data-logger later showed that the train alternated between 57 and 75kph (35mph and 46.5mph) between Sommerau and Hausach, briefly breaching the 70kph/43mph speed limit in several places. Braking a train below the speed limit, letting it roll up to the speed limit and then braking again is a common practice to avoid overheating the brakes, and is commonly referred to as “sawtooth braking” due to the zig-zagged line this creates on the data-logger.
At 11:02 the train passed though Hausach station(kilometer 33.17) without stopping and, in accordance with the speed limit, accelerated to 125kph/76.5mph. 2 minutes and 26 seconds later the train automatically triggered an emergency stop, stopping after 410m/1345ft at kilometer 30.5 (the kilometers go in reverse as the train travels north). Just before the train came to a stop the driver registered a complete failure of his instruments in cab 2 (the one in use at the time). Looking out the side-window the driver noticed large amounts of smoke billowing from his train after it stopped. He activated the electric spring-brake to create a redundancy for the automatically applied main brakes and disembarked the train to examine the origin of the smoke. He found an active fire beneath the floor of the train, spreading from the center all the way to cab 1 (which was at the rear of the train at that time). The driver of an oncoming regional train also spotted the smoke and stopped his train a safe distance from the burning maintenance train.
The driver now radioed the local dispatch and informed them of his finding, asking for the fire department to be sent to his location. However, before he could finish the conversation the unmanned, burning train started moving again, slowly rolling north. The driver ran up to and climbed back into cab 2, activating all available brake-systems, none of which showed any effect. Meanwhile his assistant sprinted ahead and placed large rocks on the rails, intending them to act like wheel chocks, similarly unsuccessful. Seeing his hopeless situation the driver jumped off the gradually accelerating train and notified dispatch of the runaway train. The dispatcher on duty set a safe path through the upcoming Haslach station, but left the signals red. However, the train protection system (PZB) failed to apply the brakes as the train rolled past the red main signal.
Continuing on its journey downhill the train approached Steinach, were railway employees placed brake shoes in an attempt to stop the train. This was unsuccessful as the train had enough velocity and weight to rip the shoes off the rails and proceed on its way. At the same time the German Federal police was dispatched to secure several level crossings should they fail to activate, while the local fire-departments extinguished several brushfires left in the train’s path, enabled by dry vegetation due to sustained high temperatures (over 30°C/86°F). The dispatcher at Biberach station (kilometer 17.90) tried once more to stop the runaway train with brake shoes, being unsuccessful.
Running out of options and dealing with the scenario of an uncontrolled burning train approaching a larger inhabited area in the form of Offenburg (population: 60388 in 2020) the decision was made to try and derail the train at Gengenbach, as this was the least-bad outcome. The order was given to the local dispatcher at 11:44am, instructing him to direct the train into a siding. The track would merge back into the main line north of the station with a protective switch, meaning if there was no path set for a train to rejoin the main line the points would automatically derail a train attempting such a maneuver, protecting the main line.
DB 711 112 reached Gengenbach station from the south at 11:52. It switched into the siding as intended and passed the station at slow speed before running into the catch-points and derailing at the end of the siding, coming to a stop upright halfway off the tracks, having gotten stuck in the gravel ballast.
Aftermath
The fire department had already been sent to the intended point of derailment, enabling them to start fighting the fire as soon as the train came to a stop in front of them. The fire was extinguished by 12:09pm, handing the site to investigators. The DB had managed to keep any other trains out of harms way, all level crossings had worked as intended, and even the driver who had had to bail from the moving train wasn’t injured. The question was now why it had randomly caught fire, and why the brake-system had then proceeded to fail. There had been a previous fire of another series 711.1, however that fire had occurred on level ground and the train hadn’t run away.
The series 711.1 has a pneumatic disc-brake system, two independent dynamic brakes (using the engines as generators), an additional pneumatic brake acting by pressing brake-pads onto the wheels, an electronic-pneumatic brake, a magnetic rail-brake and a spring-brake as a parking-brake. All of these systems were controlled by a computer located in cab 1, in the same compartment as the control-unit for the PZB, which is in charge of, among other things, automatically stopping the train if it runs a red signal. The pneumatic systems for the brakes are located in the “brake equipment cupboard” (“Bremsgeräteschrank”) in the workshop-area adjacent to cab 1.
The dynamic brake is the preferred method of slowing the train as it causes no physical wear, using the natural resistance of the engines to slow the wheels. If the dynamic brake is insufficient the control system will automatically activate the electric-pneumatic brake and the standard pneumatic brake depending on the situation. The magnetic rail-brake usually only works above 43kph/27mph, in emergencies on steep gradients it can be set to a specialized mode that keeps it activated until the train is stationary. Lastly, the series 711.1 is fitted with an electronically activated pneumatic spring-brake to secure the train when stationary. Pushing the brake’s button on the control desk opens a magnetic valve to apply the brakes. As all systems that could be activated from more than 1 place the wires for the spring brake ran in a shared central canal along the floor of the train car. The spring brake could also be applied manually by operating the valve in the brake equipment cupboard should the electric activation fail.
Once the fire was extinguished and the interior of the train had been ventilated and cooled enough for investigators to enter it was found that the workshop-area had been completely destroyed in the fire, with the break-room and cab 1 suffering extensive damage mostly from indirect heat as well as smoke and firefighting-foam/water. Examining the second cab (which had been in use until the train ran away unmanned) it was found that all available braking-systems had been activated, along with the button for sanding (the process of blowing sand in front of the wheels to increase grip). Inside cab 1 the investigators recovered the damaged data-logger, which proved intact enough to provide full recordings once removed from the site, downloading the data at the site had been impossible due to the damage.
Examining the outside of the train investigators found that the indicators for the pneumatic brakes showed green for both bogies, meaning released brakes, while the indicator for the spring brake showed an error-marker. During recovery of the train it was lifted up by crane, here it was discovered that the spring brakes had applied, the pneumatic ones were released. This stood in contrast to the setting of the controls in cab 2. After releasing the spring brakes manually via an emergency release the train could be re-tracked and towed to a maintenance-facility. There, an external expert for fire-damage was added to the investigative team.
Closer examination of the train at the maintenance-facility showed that nearly all the fuses in the control-panel behind cab 1 had been tripped, this had cut power to the PZB-system, the brake control system and cab 2. The investigators figured that this caused the failure of the instruments ahead of the train first coming to a stop, as the fire had by that point already eaten through enough cables to short out the PZB-system (causing the emergency stop) and the power-supply for cab 2 (which cut the instruments off). These findings also explained why the data-logger cut off at 11:04am, previously inexplicably registering the train being set to cab-forward mode (as if it was on the back of a longer train with a control car leading) and deactivation of cab 2, both things usually not appearing while the train is in motion.
Upon examination of the brake equipment cupboard investigators found damaged shutoff-valves bearing signs of excessive pressure having been inflicted on the valves in a short time. Continuing the examination beneath the train it was found that the brake-line feeding the cylinder on the left side of the leading bogie had ruptured. In contrast to a torn off brake-line found on the leading axle (axle 4) this damage could not be blamed on the derailment.
The ruptured line belonged to a part of the brake-system that required pressurization to apply the brakes, the opposite of how most train-brakes work. On the series 711.1 only the spring-brake activates if pressure is reduced, the other pneumatic brakes require pressure to apply. While investigators were unsure how the line had ruptured they figured out that, eventually, the leak drained the pressurized reservoirs aboard the train, releasing the train’s brakes activated by the emergency stop. Normally at this point the spring-brake would have easily held the train in place, but since the wires between the brake-control system and cab 2 had burned the driver’s input didn’t actually activate the brake, it only came on when the derailment tore one of its lines off a mounting-point. Normally an indicator-light would tell the driver if the brake was activated, however, this had already been disabled before the train came to a stop when power to the cab was cut.
The fire-expert who joined the investigation proceeded to narrow down the origin of the fire, zeroing in on the cooling-fans for the second engine and its hydraulics. The third of the four fans showed signs of an oil-leak around the seam between its motor case and a backing plate. The fan-assembly was removed from the train, refilled and pressurized, showing a clear leakage at 90bar/1305psi, which was then traced to a faulty (uneven) gasket between the case and backing plate. This flaw allowed the gasket to slightly shift under pressure, causing oil to seep out of the resulting gaps.
The train had driven on a downhill route for approximately 30 minutes, using sawtooth-braking to maintain a somewhat consistent speed. This was achieved via dynamic braking, using the engines as generators and having the hydraulic oil absorb the heat to be directed to the radiators. The sawtooth-method meant that the brakes were released and re-applied at a somewhat consistent frequency, which also reduced and raised oil pressure and -temperature at a consistent frequency. The external investigator determined that this had, in simplified terms, continuously pumped oil out of the faulty gasket’s leak whenever the train was slowed down.
Due to the high operating-pressure of the hydraulic system the oil sprayed out in a fine fog rather than a “calm” leakage in drops and was spread out by the fans, causing it to ignite as it came into contact with the turbocharger and exhaust-manifold of engine 2. Airflow in the train’s powertrain then moved the burning fog towards engine 1, penetrating the cable-canal underneath the train’s floor in the process where the fire was provided with further food, growing enough to set the interior of the workshop-area ablaze. The main materials burning, oil and plastic, caused a lot of smoke to be produced by a relatively small fire. The fire eventually ate through the cable connecting cab 2 to the main control units, which the train registered as the cab being turned off, triggering an automatic stop.
The fire-expert’s investigation concluded that the faulty gasket had started the fire which then spread due to airflow from the fans plus from the train being in motion, being fed by various materials around it until enough damage to the electronics was caused to emergency-stop the train autonomously. An examination of the ruptured brake-line (pictured above) brought no obvious cause of that damage other than a localized brief fire caused by a few burning droplets of oil landing on the line by chance. Relaying this information back to the main investigators it was declared that the faulty gasket was most certainly the cause of the fire, while the series 711.1’s unusual brake-system had caused the runaway once the fire ruptured the hydraulic line on the bogie below cab 1.
The report criticizes that all 8 cylinders of the pneumatic brake-system are part of 1 circuit (to compare, even modern road cars have 2 brake-circuits), so a single leak can disable the entire pneumatic system as soon as the train’s reservoir runs empty. The spring-brake system was also criticized in two places. Firstly, the indicator-light on the control desk is based on the button, not the actual brake. As such, pressing the button could activate the light while an electrical fault keeps the brakes from actually applying. Secondly, the system was deemed to lack sufficient backup operability, as it can only be activated electronically from the cabs or by hand in one location right behind cab 1. In case of 711 112 the smoke rendered the manual control inaccessible for the driver, leaving him with the button that may or may not still be connected to anything. On any other train the ruptured brake-line would have permanently applied the brakes, keeping the train from running away unintentionally. In the case of the series 711.1 the ruptured pneumatic line released the main brakes, while the undamaged pneumatic system of the spring brake kept the spring-brake from applying, not “knowing” that the button had been pressed as it wasn’t connected anymore.
Furthermore, the report criticized that there were no smoke- or fire-detectors installed on the series 711, which would have allowed the driver to notice the fire sooner. In the end no one was held legally responsible for the accident, as it could not be determined who had signed off on the faulty gasket. DB 711 112 is currently in storage, likely being stripped for parts before being scrapped. The total material damage is listed at 2.51 million Euros/2.65 million USD. This was the second fire on a DB 711.1 in a short time, both of which were traced to the same cause.
The report closes with an urgent recommendation to install fire detection systems aboard the series 711.1, replace all cooling fan motors to avoid the chance of another similar incident, change the operation of the spring-brake and modify the pneumatic system into two independent circuits. The first three recommendations are currently (May 2022) in the process of being followed, while a redesigned pneumatic system is in the approval-process.
Video
A news-video showing witness’ videos of the burning train rolling towards Gengenbach:
_______________________________________________________________
