23 Fatalities in the 2006 German Maglev Train Collision
On September 22, 2006, the Transrapid 08, a high-speed magnetic levitation (maglev) train carrying 31 people, collided with a wheeled maintenance vehicle on the track at the Transrapid Experimental Facility (TVE) near Lathen, Germany. In the accident, 23 people were killed and 11 were injured.
Video of the Scene After the Crash (3:08)
The Transrapid train departed the station and, after approximately 60 seconds, collided with the maintenance vehicle at 179 km/h. The front of the train traveled underneath the maintenance vehicle, which then penetrated and destroyed the first section of the train.
Transrapid Experimental Facility (TVE) in Lathen, Germany
Facts
- This was an isolated 20-mile test loop with one Maglev train and no commuters.
- A maintenance vehicle inspected the track daily to ensure there was no damage to or debris on the track to mitigate any risk to the train.
- The maintenance vehicle completed the inspection and was waiting to exit track.
- Passengers were loaded on the train for a demonstration run.
- No dispatchers, engineers or operations personnel confirmed the maintenance vehicle had exited the track.
- There was no automated mechanism to prevent the train from starting its run before the maintenance vehicle exited the track.
What Caused The Maglev Train Collision?
When defining a problem, specific information is needed. Cause Mapping® root cause analysis uses a Problem Outline to capture a structured summary of what happened, when and where it happened, and the overall impact to the organization's goals. The Problem Outline describes the specific consequences of the incident and provides the starting point for cause-and-effect analysis.
The 2006 Transrapid train collision resulted in 23 fatalities and 11 injuries—a catastrophic impact to the Safety goal. The TVE had carried hundreds of thousands of visitors in more than two decades of operations. Over time, inaccuracies in operational processes went unnoticed or were accepted as normal.
Maglev Train Collision Problem Outline
*click to expand
With even a basic understanding of an incident, a linear Cause Map diagram with four or five causes can be built in about 60 seconds. The 5-Why below shows how individual event elements connected: the train collided with a maintenance vehicle, resulting in multiple fatalities and injuries, after the train was cleared by dispatch to proceed down the track.
Because the 5-Why Cause Map is a diagram, the analysis can easily be expanded. A written description of an incident can explain what happened, but sentences don’t show the relationships between the different parts as clearly as a diagram.
Maglev Train Collision 5-Why Cause Map
As the Cause Map diagram expands, it reveals that the incident has different causal paths—all of which were necessary to produce this exact outcome. The collision occurred because the train was traveling at speed AND the maintenance vehicle was in its path.
The maintenance vehicle had completed its daily inspection drive and was sitting on the track while waiting to enter the depot. Because it was still on the track, the train should not have been allowed to enter.
Maglev Train Collision 6-Why Cause Map
The maintenance vehicle’s presence on the track was not unusual. It completed this inspection routine regularly before moving off the track and into the depot. What was different this time was that the train was scheduled to depart about 30 minutes earlier than usual. It was released while the maintenance vehicle was still on the track.
The manufacturer of the train had provided an electronic blocking system that could be activated to prevent the train from being released onto an occupied section of track. However, this safeguard wasn't being used.
Maglev Train Collision 21-Why Cause Map
*click to expand
What Was the “Electronic Blocking System” and Why Didn’t It Work?
Rather than an emergency brake on the train, the electronic blocking system was an electrical lock (interlock) that could be applied to a section of the track. The German term used in the investigation is Fahrwegsperre—roughly, a “route block” or track-path lock.
The Emsland test track was divided into 33 sections. Activating the route block could place a section into a protected state by removing the electrical power necessary for a Transrapid train to travel through it. The route block did not have a mechanism to detect the presence of vehicles on the track. Control-room personnel had to establish protection for the appropriate section.
The Transrapid manufacturer had requirements concerning the use of the route block, and personnel later testified that they regarded its use as mandatory. However, the facility's operating procedures did not make that requirement sufficiently clear. The procedure left the specific method of establishing protection to separate procedural and work instructions prepared by the operations manager.
The parliamentary testimony indicated that an operations manager had told personnel that the protection should be put in place when the maintenance vehicle was on the track. But there was disagreement over what “should” meant. An operations manager said that when he told employees that they "should" put it in, he expected them to understand that as "must."
What Makes Verification Effective?
At Lathen, the operating process included a second-person check—referred to in German as 4-Augen-Prinzip, or four-eyes approach. One person in the control room was responsible for train movements, while a second person was supposed to independently verify that the track was clear before train movement was authorized.
The problem was that the track was assumed to be clear without sufficient verification. The second person didn't have the operational information needed to confirm that the track was clear, and the GPS system tracking the maintenance vehicle wasn’t being actively monitored.
An assumption can create a reason to verify, or it can stand in for verification. In this case, the assumption that the track was clear became a substitute for evidence that the track was actually clear.
There was another information gap. The maintenance vehicle used a different radio system and could not hear the communication authorizing the train to proceed. The workers remained on the track waiting for the route to be set so they could enter the depot. They did not hear the control room authorize the train to move toward them.
This wasn’t a simple case of “someone forgot.” There were multiple opportunities to verify the condition of the track, but the information needed to make those checks effective was not consistently available or connected.
How Can We Prevent Similar Rail Collisions?
Because multiple causes were required to produce this incident, there are multiple places where the outcome could have been changed. Solutions on any one path would have changed the outcome independently of the others.
Focusing on a single "root cause" not only obscures this point, it also unnecessarily restricts the solution set. Changing two or three causes creates two or three layers of protection. If one solution fails, another can still interrupt a different causal path and reduce the risk of the same outcome. That is the basic principle behind using layers of protection to manage risk.
Maglev Train Collision 21-Why Cause Map with Solutions
*view the possible solutions below or click image to expand
|
Safety Solution |
Cause |
|
Mandatory procedural instruction for morning shunting operation |
Method of marking Section 120 as occupied not defined |
|
GPS monitor repositioned at dispatcher's primary workstation |
Dispatcher did not have access to GPS data |
|
Redesigned independent verification process with defined monitoring duties for second operator |
Track occupancy not independently verified |
|
Automated track lock when wheeled vehicle is on route |
Electronic interlock for track ineffective |
|
Integrated technical safety system covering all vehicle types |
Train dispatched onto track occupied by maintenance vehicle |
What Should We Learn From This Incident?
The safety systems at the facility were not absent. There was an electronic blocking system. There was an independent verification process. There were operating regulations. What was missing was a reliable connection between what the safety system required and what actually happened in daily practice.
The investigation revealed that safety-relevant deviations from procedure had occurred over the years prior to the 2006 incident. This is why both proactive and reactive problem solving are important. After an incident, each proposed corrective action should be tied to a specific cause identified in the analysis. The same approach can be used before an incident to ask where existing protections might fail.
