It had never happened before. In seven years of service, no one had ever been killed on an ICE train. The super-fast, state-of-the-art Inter City Express (ICE) trains of Deutsche Bahn (German Railways) had covered hundreds of thousands of kilometers over a network of lines that connected important cities in Germany and Austria. Many thousands of passengers had safely reached their destinations.
The Inter-City Express (ICE) was developed in the early 1980s in an effort to upgrade existing trains and to provide high-speed rail service, as Japan had already done in 1964. The ICE was able to run at conventional speeds (below 200kph or 124mph) on existing tracks and up to 280kph (174mph) on the new high-speed tracks. During the 1990s, the ICE expanded throughout Germany and into neighboring Switzerland, Austria, Belgium, and the Netherlands.
By the late 1990s, the ICE, operated by Deutsche Bahn Fernverkehr, provided daily luxury rail service on over 100 trains. Amenities included a dining car, telephone services, in-seat video and audio entertainment, and a smoking area. These deluxe accommodations and a perfect safety record helped boost German rail travel by 30 percent during the decade. But the euphoria would soon come to an end.
On the morning of June 3, 1998, ICE train 884, the “Wilhelm Conrad Rontgen” (WCR), which consisted of a single locomotive pulling 12 cars, including passenger coaches, a service car, a restaurant car, and the rear locomotive, made a quick stop in Hanover at 10:30 AM before continuing north towards Hamburg—its final destination. On board the ICE from Munich to Hamburg were 287 people traveling at 200 kilometers per hour (125 mph).
Traveling northward, the WCR was four miles outside of Eschede, in Lower Saxony, Germany, when, at just before 11:00 AM, a wheel rim on the first passenger coach peeled away from the wheel body, puncturing the floor and becoming embedded. A passenger reported to the train crew that the piece of metal had come up through the floor, but the train manager let precious time elapse by insisting on investigating the damage himself before stopping the train.
The train continued to travel approximately two miles until it passed over the first of two track switches. The embedded wheel rim slammed against the guard rail of the switch, pulling it away from the railway ties. The switch’s steering rail penetrated the floor of the first coach, lifting the axle carriage off the rails. One of the derailed wheels struck the lever of the second switch, which changed the switch’s setting.
The rear axles of the third coach were switched onto a parallel track, twisting the coach perpendicular to the rails and sending the car careening into the pylons of a 30-metric-ton roadway overpass just beyond the second switch, toppling it onto eight rear wagons in a deathly jumble that unfolded in only four seconds.
Coach four, derailed by the violent deviation of car three, traveled underneath the bridge, impacting an embankment and killing three railway employees who were working nearby.
Coach five passed under the weakened bridge as it collapsed, crushing the car completely. The remaining coaches, including the service car, restaurant car, three first-class cars, and the rear locomotive, jackknifed into the collapsed bridge in a zigzag pattern.
Passengers had heard abnormal noises but had not triggered an emergency stop. The front unit, powered via overhead electrics, came to a stop two kilometers (1.24 miles) beyond Eschede, alone.
By 11:07 AM, only 37 minutes after the WCR left Hanover Station, the police declared a “major emergency” and dispatched rescue teams. Over 1,000 rescue workers descended on the accident site. Despite their efforts, 101 people lost their lives, and 88 more were seriously injured in the mishap. The derailment at Eschede was Germany’s worst train accident since World War II and left Deutsche Bahn facing deep scrutiny over design and safety.
During the rescue effort, emergency workers found it difficult to remove victims from the wreckage because of pressure-resistant windows and the railcar’s rigid, aluminum frames. As a result, Deutsche Bahn subsequently replaced these windows with a new design that included predetermined breaking points to allow for easier access to trapped passengers.
What had caused this high-speed train—the technological marvel of rail travel—to derail in such a horrific fashion?
The Investigation and Causal Factors in the Disaster
Survivors in a self-help network that included relatives of those killed, accused state-owned Deutsche Bahn of ignoring material fatigue during previous wheel checks and failing to compensate them adequately.
The Fraunhofer Institute in Germany was tasked with the accident investigation and traced its cause back to an improper application of a streetcar wheel design. First-generation ICE trains were made with single-cast or “mono-block” wheels. Engineers realized, however, that this design could result in metal fatigue and out-of-round conditions, which caused vibrations at cruising speeds. The mono-block wheel design was modified to include a rubber damping ring 20mm thick between the metal wheel rim and the wheel body.
Researchers later learned that, although it reduced vibrations, this new design weakened the wheel, making it much more dangerous than the original. Normal operational wear further weakened the modified (thinner) wheel rims on the WCR, causing one to separate from the wheel body and become embedded in the floor of the first passenger coach.
A contributing cause was indeed the flawed emergency operating procedures. Had the train been stopped immediately when the wheel disintegrated, the accident might have been avoided, and countless lives would have been saved. Unfortunately, Deutsche Bahn’s policy required that the train manager personally investigate any reports of trouble before halting the train. Passengers who witnessed the wheel failure could also have pulled the emergency brake to stop the train, but no one did. This failure to act proved to be fatal.
The Fraunhofer Institute identified underlying issues, including design verification flaws, that contributed to the derailment, namely poor design and insufficient testing:
- Unsuitability of the wheel design. The rubber cushioned wheels, which had been used successfully on streetcars, were not suitable for the heavier load of ICE trains operating at much higher speeds.
- The use of heritage as the basis for design verification. The ICE wheel-tire design was a heritage or legacy design from a streetcar application. NASA engineers often rely on heritage hardware and software. The lesson is clear to ensure that heritage designs are appropriate for current applications and especially operating environments.
- Inadequate testing. At the time, the rubber damping wheel design was adapted for high-speed rail use, Germany did not have the facilities necessary to perform complete operational (stress, fatigue, crack propagation) testing on the application of the rubber damping design, so many of the wheel-design decisions were based on analysis and theory rather than test data. The limited testing that was done did not account for the dynamic, repetitive forces that result from extended wear, extreme loads, and high-speed operation.
- Operational maintenance decisions. Operating margins and the determination of acceptable wear and tear for operational systems were in place with respect to the ICE wheels, but they were set far too low to prevent wheel failure. As early as 1992, the Fraunhofer Institute expressed concern that metal fatigue could lead to wheel rim failure. Experts warned that wheels should not be operated after being worn below 88cm (34.6in) in diameter (“as new” condition was 92cm or 36.2in), but Deutsche Bahn set the minimum limit at 85.4cm (33.6in). In the months leading up to the accident, the Hanover Transit Authority noticed that metal wheel rims were being worn down at a much faster rate than anticipated and decided to replace many of the wheels ahead of schedule. Unfortunately, the WCR’s wheels had not yet been replaced. The failed wheel measured 86.2cm (33.9in) in diameter.
- Rim fatigue.
- Stress caused by wheel rims being flattened into an ellipse with each revolution (500,000/day)
- Unseen cracks inside of wheel rim lead to failure
- Thinning rim exaggerates dynamic forces causing micro-fine cracks to grow larger
- Flat spots and ridges dramatically increase dynamic forces and accelerate wear
- Bridge Design/Switch Location. The placement of the switch (an inherent hazard for high-speed trains) in close proximity to overpass bridge supports contributed to the severity of the disaster. The failed overpass was supported by two thin piers instead of by spans anchored to solid abutments on either side. The bridge was rebuilt using a cantilevered design that would have been much less likely to collapse during such an accident.
- Lack of safety design features to detect and react to anomalous operational conditions. The change in vibration associated with a failed wheel rim could have been detected by safety monitoring sensors, which could have triggered a shutdown, broken command sequence, and/or alerted the engineer.
- Lack of emergency response policies, procedures, and communications. ICE workers were not trained in emergency response policies, procedures, and communications.
The After-Effects of the Disaster
After the accident, all ICE operations were suspended until a full-scale investigation could be completed. The wheel-tire design was completely discontinued throughout Germany and was replaced by the original mono-block wheel design. Meanwhile, Germany’s entire transit network was checked for similar arrangements of switches near possible obstacles.
In August 2002, three German railroad engineers—Joachim Thilo von Madeyski, Volker Fischer, and Franz Murawa, two former railroad employees who were in charge of wheel safety at the national railway and the manager of a firm that manufactures train wheels—rejected the charges of negligent homicide against them in statements read out by defense lawyers. Had they been convicted, they would have faced prison sentences of up to five years each. But, in 2003, the court abandoned the case against all three engineers, with each fined only €10,000 ($11,670).
1431 Graham Drive, Suite 265
support@noonpi.com
It’s never just one action but usually a series of decisions that result in these type of events.
Suppose the train had been stopped immediately with no loss of life. The wheel problem might have been fixed, but would the fatal chain reaction have been predicted and addressed? A cascade of events like this is hard to predict, and often disregarded in the design process due to cost constraints or time. Low probability is not the same as zero probability.
The engineer should have suspected. TGV in France and the bullet trains of Japan were already in service and have not seen such catastrophic wheel failure.
We civil engineers learn as we move society forward in public works and it is often through failure. I wonder of my grandfather ancestors who were canal builders then railroad men as civil engineers and constructors in Pennsylvania, New York, Maryland, and Virginia during from 1800 – 1900 of the challenges they faced and the failures they prevented or had occur. They constructed lines, built systems, and bridge and locks. I know today why we are conservative and design in public works and much of that was based on the catastrophic failures of the past. I often find in my chief engineer role I have to explain the effects of vibration, cyclic loading, creep, thermal expansion and contraction. I am just thankful most of my systems are generally static and not dynamic like the ICE train. Studying forensic reports are a consistent and constant activity I engage in from reviewing hurricane and earthquake damage to structures to less dramatic failures related to thermal expansion and contraction. Failure is why are building codes continue to evolve and all constructors and engineers need object lessons like your monthly report to consider our actions in our daily roles supporting the public.
There are multiple detailed writeups about this collapse. It is used as an example of a “Cascade of Events” resulting in a far greater calamity than would result if the initial cause was the only factor involved.
This discussion was obviously written by someone unfamiliar with railroad track terminology, either European or American, but that is not the fault of the author of this writeup. No writeup I have found has seemed to have gotten these details right. Some writings state that the flangeless wheel dropped outside the track and thus was deflected toward the diverging side of the turnout, that being toward the bridge. This makes sense. The statement commonly seen, “One of the derailed wheels struck the lever of the second switch, which changed the switch’s setting.” does not make sense, as since these were relatively high speed turnouts and power operated, there should be no such lever. It is probable that the following derailed wheels would push the second switch over, but this would be in a trailing move and would have no real effect on the severity of the derailment.
The third car did not achieve a position perpendicular to the track. At most it got to some 30 degrees off parallel in hitting the bridge and then bounced back to near parallel. The fourth became uncoupled both front and back as it passed under the bridge, and it was the one ending up 90 degrees to the track and off to the side of the track. The fifth car was completely crushed by the falling bridge.
It was not a single electric locomotive plus coaches. There was an electric locomotive on both ends. The apparent locomotive in the picture is the pushing end power car. Note that it is jam up against the bridge. That is not just from continued momentum after the derailment started, but also because in part it continued pushing under power even after the derailment began until the catenary was shorted out by the bridge collapse,
A major contributor to the high death toll was the difference between US and German crashworthiness standards for the coaches. Instead of maintaining body integrity, at least one, probably more of the coach sides “unzipped” from the roof and floor along weld lines, thus allowing bodies to be thrown out of or crushed by the collapsing car body. In typical German fashion, everything was instrumented to detect failure, however in this case that did not extend to anything that could detect wheel failure. Thus, the wheel rim failure was undetectable other than by direct observation. That a component of the wheel tread came up through the floor could just as well not have happened and was not in itself a contributor to the derailment. That the car was able to stay on the rails for several km with one wheel having no flange is an attribute of the basic tolerance of defects the general design concepts and practices of railroad track and equipment that have developed over the years. The application of a wheel design that had never been used in anything other low speed low axle load service to high speed service without exhaustive testing and analysis, I find incomprehensible. Fatigue will have its way and did in this case. At the least there should have been some form of lab testing of a full size wheel to the point of reaching tread wear limits.
The relatively light duty design of the overpass support was the contributor to the bridge collapse. The piers were single columns from bottom to top. In normal US practice, this is not permissible. The usual is to have a “crash wall” type connection between columns between, and in a case such as this, probably extending beyond the outside columns to prevent direct impact on a column by a derailed vehicle. The lack of cap between the columns at the top, as noted, further aggravated the situation by permitting instantaneous collapse of the span it supported.
While strength of body shell is mentioned as a factor in difficulty of evacuation of passengers, such strength as there was undoubtably saved lives. The window issue is another story. US standard requires the sealant strip around the windows be readily removable. The provision of “predetermined break points” seems to be a somewhat irrational solution. Do you really want to shower the injured with broken glass chunks as part of the evacuation process?
That the wheel type was deemed necessary in the first place was primarily due to the high level of stiffness in the usual German non-ballasted track system. More cushioning available in the track would mean less cushioning required on the vehicle side in order to achieve the desirable ride quality. Subsequent to this derailment, all these wheels were removed and replaced with solid wheels.
By the way, the German railways run right-handed on multiple track lines. The French railways run left-handed so that results in some interesting moves for through trains at the border crossings.