I meant to publish this on Sunday as announced and mis-clicked, so…it’s up now. Enjoy!
Background
Münchendorf is a town of 3188 people (as of 2023) in eastern Austria, located in the Mödling District 15km/9mi south of Vienna and 51km/32mi west of the Slovakian border at Bratislava, Slovakia’s capital (both measurements in linear distance).
The town is served by the Pottendorf Line, a double-tracked electrified main line connecting Vienna (the Austrian capital) with Vienna-Neustadt (confusingly, a separate city) on 51km/32mi of track. The line fully opened in 1875 after over 15 years of planning, and had to be slightly rerouted when a long elevated section was destroyed in World War 2. It’s used nowadays by both passenger and freight services at speeds of up to 160kph/99mph.
The Train Involved
Z 7657 was a regional passenger service from Deutschkreuz to Vienna main station performed by the Raaberbahn (also called GYSEV), a Hungarian-Austrian rail service provider owned by the governments of Hungary and Austria as well as the ÖBB (Austrian National Railway). The service was provided by a a double-traction of Class 474X “Ventus” trains with a Class 4746 leading and a Class 4744 following. “Ventus” is the name given to Desiro MainLine electric multiple units made by Siemens, which were introduced in 2016. The trains consist of three permanently coupled cars measuring 75.15m/247ft in length at an empty weight of 145 metric tons. They have a power output of 2600kW/3487hp allowing a top speed of 160kph/99mph. The 4744-version can carry 259 passengers in a single-class configuration, while the 4746 carries 244 people. The two versions are identical apart from the 4746 offering two more doors per side. The train carried a total of just 70 passengers along with a driver at the time of the accident.
The Accident
The Ventus-train for service Z 7657 departs Deutschkreuz station at 5:13pm on the 9th of May 2022. The train pulls into Ebenfurth station, where the driver changes cabs to depart in the opposite direction, at 6pm, departing the station with a two-minute delay. The train eventually passes the approach-signal “Y” for Münchendorf station at 6:18pm at 100kph/62mph, getting a “caution”-indication. He slows the train to 57kph/35.5mph as intended. The station’s train control and surveillance system picks the train up as it passes signal Y, entering a 1250m/0.77mi surveilled section. The train then switches from the western to the eastern track at the points number 56, from where it would usually pass through the station on track 301, pass exit-signal H1 and remain on the eastern track, with the speed limit increasing to 160kph/99mph beyond signal H1. The train would move through block-sections f51, f41 and f31 in that order as it passes through Münchendorf station. A block section is a set section of a rail line’s track which only one train may occupy at any point. Modern signaling systems use different means to determine the position of a train and thus the occupancy-status of the block sections, turning signals behind a train red so that trains stay in individual block sections with enough stopping-distance between them in case the train in front comes to a halt for any reason. Trains, especially faster ones, have considerable stopping-distances, often putting the train in front “beyond the horizon” if a safe distance is to be maintained.
The driver of the Ventus-train accelerates after switching tracks and enters the station at 6:19:07pm, travelling at 80kph/50mph in order to stay below the 85kph/53mph speed limit as they approach the signal H1. Breaching the speed limit would trigger an automatic emergency stop, something a train driver obviously wants to avoid. The speed limit increases to 145kph/90mph just ahead of signal H1, which the train passes at 106kph/66mph. The driver would later state that they saw H1 display “all clear” (a single green light). They are thus understandably surprised by the points number 2 being set to “turn” instead of “straight ahead”. The train’s data-logger records an emergency stop being triggered at 6:19:59pm, but the train hasn’t even begun to slow down by the time it reaches the points a second later. The speed limit for the set of points when set to “turn” is just 60kph/37mph, so the Ventus doesn’t have a chance to stay on the rails when it enters the points at 148kph/92mph.
The deflection to the left is so violent that the leading two cars of the train fly right off the tracks, separating from the rest of the train and rolling over as they enter the adjacent field. The third car’s leading wheel set is pushed back to the right by the car in front tearing off, it and the rear three-car unit derails except for the rear car’s rear wheel set, but remains mostly upright and aligned with the rail line. One passenger is killed in the derailment, the driver and 2 passengers are severely injured and another 22 passengers suffer minor injuries.
Aftermath
A survivor on the train alerts the emergency services at 6:21pm, telling them that a train derailed at Münchendorf station and that the overhead catenary is hanging down. The first ambulance reaches the wreckage by 6:34pm, 8 minutes after a police car locates the wreckage, but its crew can’t access most of the train as they don’t know if the overhead catenary has been powered down yet. A rescue helicopter reaches the site at the same time as the ambulance, 4 more helicopters follow within the hour. The helicopter’s crew tends to the driver, who was pinned in their cab, while the ambulance first comes across the deceased passenger who had apparently been ejected from the second car as it spun around 180° during the derailment. More and more responders arrived within the following minutes, eventually totaling over 100 people. But it would’t be until 6:57pm that the catenary’s were confirmed to be powered down, allowing responders to access the entire train. Several survivors had exited the train on their own in the meantime, requiring responders to try and “shepherd” them back as they walked off in various directions. A so-called intervention team also reached the site at around 7:30pm, meant to provide support to the responders when they’re faced with large-scale disasters. The site is declared clear of both victims and survivors by 7:50pm, shifting focus from rescue and recovery to an investigation into the cause.
The immediate cause of the accident is determined rather quickly, the train derailed after it attempted to navigate a set of points at almost 2.5 times the engineered speed limit for those points. The driver, once they could be interrogated, states that they had a regular, uneventful journey and that they were utterly blindsided by the points being set to “turn” as they approached them at over 140kph/87mph, expecting to continue straight ahead. They recalled seeing the station’s exit-signal (H1) display “all clear”, meaning they were free to accelerate to the section’s regular top speed of 160kph/99mph.
Signal H1 is a regular Austrian main signal, consisting of a rectangular black board on a mast holding several different-colored lights. “All clear” would be a single green light being illuminated in the upper right corner of the signal.
On a regular day H1 would have shown “all clear” and the train would’ve been safe to accelerate out of the station, continuing on its track for a considerable distance. But the investigators find out that the day of the accident wasn’t a regular day even before the accident occurred once they start talking to the signal box crew and look into signal box records.
An error had popped up on the screens at the local signal box as the Ventus approached the station, with block section f51 (the one just past the station) being marked as “occupied”. The section had last been used by another train (Z 55072) at 6:01pm, but the occupancy-status had not reset after it passed. The dispatcher thus couldn’t set the regular path for the incoming Ventus. The occupancy of the block-sections at Münchendorf station was determined by an axle-counter system, which counted the number of axles both entering and leaving each block section. A section would only clear if the number was equal. Rule 53 of the operational guidelines said that a “red status” caused by the axle counter’s data not lining up could only be reset once the last train using the affected section was contacted and confirmed to be complete. This process took some time, with the dispatcher in charge thus (correctly) reconfiguring the Ventus’ path to switch from the eastern to the western track at points number 2, avoiding the “red” block section f51.
Setting points number 2 to “turn” automatically adjusted the signal H1 to “all clear — 60kph”, indicating the new speed limit necessitated by navigating the points when set to turning rather than going straight ahead. H1 had been displaying “stop” (red light) until the path was set to the western track, at which point the new status is displayed on the signal by a green light in both the upper and lower right corners instead of just one in the upper right corner (“all clear”).
The driver of the Ventus leaves the surveilled section by 6:19:20pm and, misreading the signal as “all clear”, starts accelerating towards the usual speed limit of 145kph/90mph instead of decelerating to get below 60kph/37mph. He passes H1 15 seconds later as he accelerates past 106kph/66mph, the accident is now just about unavoidable.
An emergency stop is triggered at 6:19:59, 4 seconds before “Points 1 error” pops up on the signal box screen, signaling the derailment of the train which tore apart the set of points. The signal box crew only gets an indication of something terrible having occurred when a different train’s driver radios in at 6:21:08pm, asking why the overhead catenary lost power.
The dispatcher contacted Z 55072 at 6:19:55pm, inquiring about the train’s status as dictated by the guidelines. They receive feedback (that the train is complete/fine) by 6:24:55pm and reset the axle-counter. F51 clears, but it’s four minutes since the Ventus derailed and happens just as the federal police informs them of a derailment.
But why could the train even accelerate to more than twice the speed limit in the area? Train control systems are meant to be a backup safety measure, ensuring that operational safety cannot be compromised by human error. The investigation finds that the train control and surveillance system within Münchendorf station is much more precise than that used “out on the line”. The system within the station can very precisely track train positions and speed, while that on the adjacent “open line” can only surveil the train’s position via the axle counter and the sectional top speed. And the sectional top speed when the train derailed was 160kph/99mph. The points had a 60kph/37mph speed limit when set to turn, but this was a temporary limitation and not the regular speed limit for all trains passing through that section of track. And the train control system was incapable of ensuring trains didn’t breach the temporary limitations, only the general speed limit on the section. The station’s surveillance had ended just before H1, and thus no emergency stop was triggered when the train passed H1 at already excessive speed for the temporary limit.
The third “puzzle piece” to the accident came from the signal box crew, who took over 10 minutes to notice that f51 was still showing as “occupied” after the last train had left it. Noticing this discrepancy several minutes earlier would’ve meant they would have been able to reset the section’s status in time for the Ventus to proceed through it as usual rather than requiring diversion into the western track. The investigation did note, though, that dispatchers are trusted with an ever increasing workload, and that a small section displaying red instead of green on their screens is easy to miss, especially as it doesn’t come with any additional acoustic or visual warnings.
The official report thus declares the main cause of the accident as human error, with the driver mistaking the restricted all clear (two green lights) for a regular all clear (single green light). They had been driving for the Raaberbahn since 2003 and worked the line where the accident occurred since March 2017, with no earlier errors on their record. The only note on their file had been an incident where they confirmed a dispatcher’s instruction, not noticing that it was faulty. An incident which remained without consequences. The report argues that extensive experience of trips on the Pottendorf Line with very few irregularities created a strong routine, which led to the driver expecting the signal to show “all clear” because it pretty much always did. This strong expectation increased the risk of misreading a signal’s displayed instruction as a very similar instruction.
This hadn’t actually been the first time a train had erroneously accelerated out of Münchendorf station. A train driver had departed from a stop at the station on the 4th of June 2021 and accelerated to 105kph/65mph by the time they reached the points number 2 which were also set to “turn”. In that case, the train just barely managed to make it through the points, despite going faster than the points’ speed limit. The driver of that train later also said they had seen H1 show “all clear” when it had actually been showing the “all clear — 60kph” instruction.
The driver of the derailed train was eventually put on trial in 2023 and received a sentence of six months on probation for “negligent endangerment of the public”. They successfully appealed and got the judgement rejected in August 2023. However, they were still fired from their job in May 2023.
_______________________________________________________________
I have chosen to stay off Medium’s monetization offers to keep these stories as accessible as possible, but you can support me with a small tip via “Buy me a coffee” if you feel like it.
_______________________________________________________________
A kind reader is posting the installments on reddit for me, I cannot interact with you there but I will read the feedback and corrections. You can find the post right here.
