4 ms·

Emergency stop signal should be easy to send when it is needed. Most trains have a emergency brake lever inside which is also very easy to abuse, but is there

Emergency stop signal should be easy to send when it is needed. Most trains have a emergency brake lever inside which is also very easy to abuse, but is there for safety. It is better to enforce harsh penalties for abuse.

mschuster91 3y ago
In Germany, in addition there is yet another emergency signal - if you need a train to stop (say, because someone fell into the tracks) and you can see the train (so no time to call 112), wave your hand in a circular motion [1]. [1] http://www.tf-ausbildung.de/SignalbuchOnline/sh3.htm http://www.tf-ausbildung.de/SignalbuchOnline/sh3.htm
- throw_a_grenade 3y ago
  Same in Poland, though here you can also use white lantern, if you don't have red one.
mytailorisrich 3y ago
Harsh penalties are ineffective and irrelevant in terrorism and warfare situations, or even only against lunatics. Here I don't think that this signal system is designed to be used by the public. I'm guessing that there are transmitters installed and operated by the railways and perhaps police/emergency services but no-one else. I am sure that the system will now be upgraded to include cryptographic authentication or something to that effect.
- jacquesm 3y ago
  And that will sooner or later result in loss of life. Certificate not updated? Oops...
  - mytailorisrich 3y ago
    In this case I am pretty sure that a single organisation controls the whole system, transmitters and receivers. So I see no reason why they would update one side but not the other. There has to be a minimum level of competence and enforced procedures to run any important systems...
    - jacquesm 3y ago
      That's not how safety systems work. Ever walked around in a factory? Those big red mushroom buttons everywhere actually work. Absolutely nothing is going to stop you from hitting one of them. It's not unlike the social contract: the assumption is that you too are kept safe by others. Abusing such systems is the lowest of the low, and will get you in serious trouble. As would be sabotaging fire fighting equipment, arson, bomb threats, throwing stuff onto the highway and so on. The fact that you can't see any reason means that you are probably not in charge of safety anywhere. The battle is so asymmetrical that you can't win unless people stick to the assumption that their lives are valuable too. If that is no longer the case you are technically at war. This is why suicide bombers have an easy time of it: they have broken out of that social contract and are willing to give up their own lives to take the lives of others. You simply can not effectively defend against this unless you are willing to throw out the social contract and become a police state yourself (or suffer eventual loss of life). The minimum level of competence to run an important system (to put a train in motion, for instance) is definitely there. But to stop an important system should need no competence, it should just require presence and action. Any other requirements are not going to be secure (because too many people need to have access to such systems, including all of the public) but will cause the critical part to fail just when it is needed.
      - mytailorisrich 3y ago
        Obviously in a factory people who are let in are vetted and authenticated to start with. Here we're discussing a radio transmission (from what I understand) in the wild that can come from absolutely anyone and anywhere and stop a whole train. There is no reason for this not to be secured. I didn't claim that there should be a special competence to remotely stop a train, and indeed we may want something as simple as a big red button. But not anyone should be able to push that button and there should obviously be competence to run the system behind the scene as per my previous comment.
msm_ 3y ago
Sadly, given the current situation, we'll probably have to migrate from the current (easy to use and available) system to something more secure (and fragile). Some people will die, but if that happens again there's not much choice.
- jacquesm 3y ago
  No, I don't think we should. What we should do is hunt these perps down and take them out of circulation for a long long time. Because it isn't possible to make a system both easy to access and secure at the same time and if the price is that people will get killed who have nothing to do with any of this then we will end up losing our critical infrastructure just as sure as if you bombed it.
  - msm_ 3y ago
    It's very hard to find a source of a radio signal sent from a middle of nowhere (having only a few trains to trinagulate). Of course we should do this, but if someone starts abusing this to raise chaos in the country, we may have no other choice. And we have an enemy country very interested in causing problems nearby. >Because it isn't possible to make a system both easy to access and secure at the same time Not right now, but since 2009 we're implementing GSM-R, and we still don't have it. It's not a bad solution, but nobody really cared until the recent abuse happened.
    - jacquesm 3y ago
      Legacy... hard to overcome that in a few years when it took many, many decades to deploy the original gear. This stuff is quite expensive, deployed everywhere and needs to continue to be backwards compatible while the new solution is rolled out, which is difficult to achieve.
andrewaylett 3y ago
In the UK, the "emergency stop" feature might actually be an "emergency talk to the driver" feature. Source: I was sitting opposite a family whose small child activated the emergency stop. The train didn't stop.
- tialaramex 3y ago
  On a modern train, if you activate the button and the driver doesn't react at all, it will eventually stop the train, but the driver gets a few moments to decide what to do, and in a lot of cases their decision is going to be explicitly "Don't stop" because of the disproportionate number of inadvertent or malicious activations. On the tube, where (aside from a handful of long distance expresses e.g. to/from Amersham) your train is going to stop at a station anyway in the next couple of minutes they have notices explaining to people that the best way to get e.g. medical assistance is going to be to get off the train at a station, where they can help you, not stay on it and push the emergency button hoping somehow assistance magically teleports to a moving train.
pjerem 3y ago
See my other comment. On modern trains, the emergency lever doesn’t stop the train anymore but let you speak to the conductor. The train will only stop if you don’t speak for several seconds or in case of a real emergency. And tbh, I just can’t see which sort of emergency can happen inside the train that would require an immediate full stop. Even if something life threatening is happening inside, the best option is to call and meet the emergency services in the next station.
- jacquesm 3y ago
  > And tbh, I just can’t see which sort of emergency can happen inside the train that would require an immediate full stop. Trains are multiple vehicles that are somewhat loosely connected. A train segment could be detached from the rest of the train. https://abcnews.go.com/US/amtrak-cars-separate-boston-bound-acela-train/story?id=52881264 https://abcnews.go.com/US/amtrak-cars-separate-boston-bound-... And other mechanical issues with the train besides (for instance: the train being on fire). The fact that you can't think of something doesn't mean that you have done an exhaustive search.
  - alphager 3y ago
    In case of a detachment, the train will automatically perform an emergency brake (without the possibility of manual intervention by the conductor). Trains are fail-safe. They only run because the brakes are held open by a pressured air system running along the whole train. In case of a detachment, the hose connecting the wagons would break, releasing the air pressure and thus slamming the brakes down.
    - jacquesm 3y ago
      Fair enough, that's a thing I actually knew so I should have not used that example. But a runaway would have much the same effect.
- pm215 3y ago
  Examples where a passenger-initiated emergency stop would help: The Eschede crash in Germany: https://en.m.wikipedia.org/wiki/Eschede_train_disaster https://en.m.wikipedia.org/wiki/Eschede_train_disaster -- part of the wheel came through the floor into the passenger compartment. The passenger couldn't find an emergency stop, and by the time they'd found a conductor and got their attention (which took minutes) the train crashed. Trap-and-drag accidents where somebody on the platform gets clothes trapped in the train door and is pulled along with the train as it starts to pull off. If you don't emergency-stop the train within seconds that person is likely to suffer serious injuries or die. Likely the conductor/guard isn't near that door and only passengers will have seen the problem.

mschuster91 3y ago

In Germany, in addition there is yet another emergency signal - if you need a train to stop (say, because someone fell into the tracks) and you can see the train (so no time to call 112), wave your hand in a circular motion [1]. [1] http://www.tf-ausbildung.de/SignalbuchOnline/sh3.htm http://www.tf-ausbildung.de/SignalbuchOnline/sh3.htm

throw_a_grenade 3y ago
Same in Poland, though here you can also use white lantern, if you don't have red one.

mytailorisrich 3y ago

Harsh penalties are ineffective and irrelevant in terrorism and warfare situations, or even only against lunatics. Here I don't think that this signal system is designed to be used by the public. I'm guessing that there are transmitters installed and operated by the railways and perhaps police/emergency services but no-one else. I am sure that the system will now be upgraded to include cryptographic authentication or something to that effect.

jacquesm 3y ago
And that will sooner or later result in loss of life. Certificate not updated? Oops...
- mytailorisrich 3y ago
  In this case I am pretty sure that a single organisation controls the whole system, transmitters and receivers. So I see no reason why they would update one side but not the other. There has to be a minimum level of competence and enforced procedures to run any important systems...
  - jacquesm 3y ago
    That's not how safety systems work. Ever walked around in a factory? Those big red mushroom buttons everywhere actually work. Absolutely nothing is going to stop you from hitting one of them. It's not unlike the social contract: the assumption is that you too are kept safe by others. Abusing such systems is the lowest of the low, and will get you in serious trouble. As would be sabotaging fire fighting equipment, arson, bomb threats, throwing stuff onto the highway and so on. The fact that you can't see any reason means that you are probably not in charge of safety anywhere. The battle is so asymmetrical that you can't win unless people stick to the assumption that their lives are valuable too. If that is no longer the case you are technically at war. This is why suicide bombers have an easy time of it: they have broken out of that social contract and are willing to give up their own lives to take the lives of others. You simply can not effectively defend against this unless you are willing to throw out the social contract and become a police state yourself (or suffer eventual loss of life). The minimum level of competence to run an important system (to put a train in motion, for instance) is definitely there. But to stop an important system should need no competence, it should just require presence and action. Any other requirements are not going to be secure (because too many people need to have access to such systems, including all of the public) but will cause the critical part to fail just when it is needed.
    - mytailorisrich 3y ago
      Obviously in a factory people who are let in are vetted and authenticated to start with. Here we're discussing a radio transmission (from what I understand) in the wild that can come from absolutely anyone and anywhere and stop a whole train. There is no reason for this not to be secured. I didn't claim that there should be a special competence to remotely stop a train, and indeed we may want something as simple as a big red button. But not anyone should be able to push that button and there should obviously be competence to run the system behind the scene as per my previous comment.

msm_ 3y ago

Sadly, given the current situation, we'll probably have to migrate from the current (easy to use and available) system to something more secure (and fragile). Some people will die, but if that happens again there's not much choice.

jacquesm 3y ago
No, I don't think we should. What we should do is hunt these perps down and take them out of circulation for a long long time. Because it isn't possible to make a system both easy to access and secure at the same time and if the price is that people will get killed who have nothing to do with any of this then we will end up losing our critical infrastructure just as sure as if you bombed it.
- msm_ 3y ago
  It's very hard to find a source of a radio signal sent from a middle of nowhere (having only a few trains to trinagulate). Of course we should do this, but if someone starts abusing this to raise chaos in the country, we may have no other choice. And we have an enemy country very interested in causing problems nearby. >Because it isn't possible to make a system both easy to access and secure at the same time Not right now, but since 2009 we're implementing GSM-R, and we still don't have it. It's not a bad solution, but nobody really cared until the recent abuse happened.
  - jacquesm 3y ago
    Legacy... hard to overcome that in a few years when it took many, many decades to deploy the original gear. This stuff is quite expensive, deployed everywhere and needs to continue to be backwards compatible while the new solution is rolled out, which is difficult to achieve.

andrewaylett 3y ago

In the UK, the "emergency stop" feature might actually be an "emergency talk to the driver" feature. Source: I was sitting opposite a family whose small child activated the emergency stop. The train didn't stop.

tialaramex 3y ago
On a modern train, if you activate the button and the driver doesn't react at all, it will eventually stop the train, but the driver gets a few moments to decide what to do, and in a lot of cases their decision is going to be explicitly "Don't stop" because of the disproportionate number of inadvertent or malicious activations. On the tube, where (aside from a handful of long distance expresses e.g. to/from Amersham) your train is going to stop at a station anyway in the next couple of minutes they have notices explaining to people that the best way to get e.g. medical assistance is going to be to get off the train at a station, where they can help you, not stay on it and push the emergency button hoping somehow assistance magically teleports to a moving train.

pjerem 3y ago

See my other comment. On modern trains, the emergency lever doesn’t stop the train anymore but let you speak to the conductor. The train will only stop if you don’t speak for several seconds or in case of a real emergency. And tbh, I just can’t see which sort of emergency can happen inside the train that would require an immediate full stop. Even if something life threatening is happening inside, the best option is to call and meet the emergency services in the next station.

jacquesm 3y ago
> And tbh, I just can’t see which sort of emergency can happen inside the train that would require an immediate full stop. Trains are multiple vehicles that are somewhat loosely connected. A train segment could be detached from the rest of the train. https://abcnews.go.com/US/amtrak-cars-separate-boston-bound-acela-train/story?id=52881264 https://abcnews.go.com/US/amtrak-cars-separate-boston-bound-... And other mechanical issues with the train besides (for instance: the train being on fire). The fact that you can't think of something doesn't mean that you have done an exhaustive search.
- alphager 3y ago
  In case of a detachment, the train will automatically perform an emergency brake (without the possibility of manual intervention by the conductor). Trains are fail-safe. They only run because the brakes are held open by a pressured air system running along the whole train. In case of a detachment, the hose connecting the wagons would break, releasing the air pressure and thus slamming the brakes down.
  - jacquesm 3y ago
    Fair enough, that's a thing I actually knew so I should have not used that example. But a runaway would have much the same effect.
pm215 3y ago
Examples where a passenger-initiated emergency stop would help: The Eschede crash in Germany: https://en.m.wikipedia.org/wiki/Eschede_train_disaster https://en.m.wikipedia.org/wiki/Eschede_train_disaster -- part of the wheel came through the floor into the passenger compartment. The passenger couldn't find an emergency stop, and by the time they'd found a conductor and got their attention (which took minutes) the train crashed. Trap-and-drag accidents where somebody on the platform gets clothes trapped in the train door and is pulled along with the train as it starts to pull off. If you don't emergency-stop the train within seconds that person is likely to suffer serious injuries or die. Likely the conductor/guard isn't near that door and only passengers will have seen the problem.