On minimizing derailment risks and consequences for passenger trains at higher speeds

543 On minimizing derailment risks and consequences for passenger trains at higher speeds D Brabie and E Andersson Department of Aeronautical and Vehicle Engineering, Royal Institute of Technology (KTH), Stockholm, Sweden The manuscript was received on 12 January 2009 and was accepted after revision for publication on 13 May 2009. DOI: 10.1243/09544097 Abstract: The first part of this article deals with the possibility of preventing wheel climbing derailments after an axle journal failure by implementing mechanical restrictions between the wheelsets and the bogie. A multi-body system (MBS) computer model is developed to account for such an axle failure condition, which is successfully validated by comparing the pre-derailment sequence of events with two authentic cases. An extensive parameter analysis on the maximum vertical and longitudinal play between the wheelset and the bogie, required to prevent a highspeed power or trailer car to derail, is performed for various combinations of running conditions in curves. Once an actual derailment has occurred on conventional passenger trains at 200 km/h, extensive MBS simulations are performed on the feasibility of utilizing alternative substitute guidance mechanisms, such as low-reaching parts of bogie frame, axle box, or brake disc, as means of minimizing the lateral deviation. Results are presented in terms of geometrical parameters that lead to a successful engagement with the rail for a total of 12 different derailment scenarios. These are caused by an axle journal failure, an impact with a small object on the track, or a high rail failure. Minimizing the lateral deviation is also investigated by means of restraining the maximum coupler yaw angle and altering the bogie yaw stiffness. Time-domain simulations are also performed in terms of lateral track forces and derailment ratio when negotiating a tight horizontal S-curve. Further, the articulated train concept is investigated in terms of the post-derailment vehicle behaviour after derailments on tangent and curved track at a speed of 200 km/h. In this respect, a trainset consisting of one power car and four articulated passenger trailer cars is modelled in the MBS software. Results in terms of lateral deviation and maximum carbody roll angle are presented as a function of different inter-carbody damper characteristics and running gear features. The feasibility of these damper characteristics is also tested in terms of lateral track forces and derailment ratio when negotiating a tight horizontal S-curve. Keywords: railway, safety, derailment, guidance, lateral deviation, bogie, vehicle model, multibody system simulation 1 INTRODUCTION Despite being one of the safest modes of transportation, railway accidents and incidents still occur, sometimes with derailments as an attendant phenomenon. A multitude of factors may bring high-speed passenger rail vehicles into a derailed condition such as Corresponding author: Department of Aeronautical and Vehicle, Royal Institute of Technology (KTH), Teknikringen 8, Stockholm 100 44, Sweden. email: danb@kth.se mechanical failures in the wheelset track interface (wheel, axle, rail failure, etc.), impact with objects on the track, earthquakes, etc. Depending on various aggravating factors (track geometry, switches and crossings, etc.), the derailed wheelsets may start to deviate laterally. In such situations, the risk of catastrophic outcomes can be diminished by minimizing the consequences. Robust safety systems for trains, in short RSST, is the name of a project that started at the Division of Rail Vehicles of the Royal Institute of Technology (KTH) with the aim of studying various means of minimizing serious consequences resulting from mechanical

544 D Brabie and E Andersson failures at high speeds on rail vehicles or the track. This study is performed in close cooperation with Swedish railway authorities as well as rail operators, rail vehicle suppliers, and consultants. A previous technical report [1], supported as well as an initial study [2] within the RSST project, indicated that mechanical restrictions limiting a wheelset s movements relative to its bogie frame might be beneficial in cases of axle failure on the outside of the wheel, at the journal bearing. This insight emanated from empirical observations involving the Swedish high-speed tilting train X 2000, which limited the consequences to a minimum after a couple of axle failure incidents. Out of four such incidents, only one case led to a derailment with fairly modest consequences. Furthermore, empirical evidence from Sweden and abroad [2] suggested, among others, the possibility of utilizing alternative substitute guidance mechanisms as a means for reducing the potentially very dangerous lateral deviation of the running gear from the track centre line. In addition, the articulated design concept has been suggested to have positive effects on the outcome of a derailment, mainly based on a number of observations on the French TGV. The first part of the current article evaluates the possibility of reducing derailment risks after axle journal failures. This is presented in section 2 together with the validation of the proposed MBS model representing axle journal failures. Means of minimizing consequences once a derailment has occurred because of three different reasons is assessed in section 3. In this section also a description of the post-derailment computation methodology is presented briefly. General conclusions and some outlooks for future work are presented in section 4. 2 MINIMIZING DERAILMENT RISK DUE TO AXLE JOURNAL FAILURE Although not the most frequent cause of derailment in general, axle failures at the journal bearing posses an imminent danger to vehicle safety, as the affected wheel becomes unloaded. To the best of the authors knowledge, pre-derailment multi-body system (MBS) simulations and analysis of rail vehicles after an axle failure were first reported in reference [3]. The MBS vehicle model, especially the part dealing with the axle failure interface, has since then been refined. It is therefore imperative for such a new model to undergo a validation process. 2.1 Axle failure computer model validation 2.1.1 The validation cases and general simulation considerations Two Swedish incidents, the Tierp [4] and Gnesta [5] cases, have been chosen for the purpose of validating the proposed axle failure computer model. The axle failed at the same location in the bogie in both cases, the tube side of the wheelset opposite to the gear on an X 2000 power car. In the current context, valuable factual information can be found in Table 1. The vehicle and the track is modelled in the general purpose MBS analysis tool GENSYS [6]. The GENSYS code is used in Sweden and abroad for simulating dynamic track vehicle interaction. Simulation results have on numerous occasions been validated by comparisons with measured quantities as well as with results obtained with other software; see for example references [7] and [8]. The vehicle model consists of seven rigid bodies: one carbody and two bogies with six degrees of freedom (DoF) each, and four wheelsets with five DoF each (the pitch DoF is constrained). The primary suspension, i.e. the suspension between wheelsets and bogie frame, is modelled by linear springs in parallel with linear and non-linear dampers acting in the longitudinal, lateral, and vertical directions. The secondary suspension, i.e. the suspension between bogie frame and carbody, consists of non-linear springs acting in the longitudinal, lateral, and vertical directions in parallel with non-linear viscous dampers. Each bogie includes a roll bar element to produce a linear roll stiffness between carbody and bogie frames as well as non-linear viscous dampers acting primarily in the longitudinal direction on each side of the bogie to provide a yaw damping between carbody and bogie frame. The model also includes bumpstops that restrict carbody to bogie frame lateral and vertical motions. The wheel rail contact element is described by a linearized stiffness in parallel with a linear viscous Table 1 Factual information for the two AJF validation cases Case Speed (km/h) Failure location Consequences Track info Weather info Tierp 200 Wheelset 2, left-hand (high) wheel on rear-end power car Gnesta 180 Wheelset 3, right-hand side on front-end power car Wheelset 1 derails in a circular curve over the low rail Contact with fist sleeper at 11 m from start of circular section No derailment R = 1805 m D = 110 mm S-shaped curves, R = 998 m, D = 140 mm Daylight, dry conditions, light cloudiness, T = 16 C Daylight, light rain, hazy, T = 12 13 C

On minimizing derailment risks and consequences for passenger trains at higher speeds 545 damper, which only produces compressive forces. Accordingly, wheel rail separation is possible as wheels are allowed to lift. A three DoF track model is implemented, based on a so-called moving track piece, which follows under each wheelset and incorporates two rigid bodies: two rails joined together by a track piece and a fixed ground. The two rails and the track piece are connected with the ground by linear springs in parallel with linear dampers, with values corresponding to a standard track. For validation purposes, the implemented track curvature and geometrical irregularities describe the actual conditions at the incident sites of Tierp and Gnesta. They were obtained by Banverket s measurement vehicle STRIX at 80 and 73 days, respectively, prior to the incidents date. All simulations use nominal UIC/ORE S1002 wheel profiles running on UIC 60 rails according to Swedish standards, i.e. inclined at 1:30 with a 1435 mm nominal gauge. For regular dynamic simulations under normal operating conditions, the model described above is considered sufficient. However, for the purpose of simulating an axle journal failure (AJF) in combination with an eventual pre-derailment sequence of events, additional semi-flexible restrictions are required, see Table 2. The restrictions are implemented as piecewise linear stiffnesses, with no effect unless certain pre-defined displacement limits are reached. Exceeding these limits, whose values could be obtained by measurements, a high stiffness value is set corresponding to an approximate structural stiffness of an eventual metallic contact. Special attention is paid to the first two mechanical restrictions in Table 2. For an X 2000 powered bogie, they represent the maximum play movement of the axle relative to the tube drive system. Because of their location in the bogie, it was difficult to measure these limits exactly; however, plausible ranges for the vertical ( z t ) and longitudinal ( x t ) plays on the tube side (opposite to the gear) are approximately 40 60 and 40 50 mm, respectively. On the gear side of the wheelset, the value of these limits is known [1] and set in both directions to x g = z g = 50 mm. In the computer model, these restrictions are Fig. 1 Wheelset semi-flexible mechanical restrictions (max. play) relative to the bogie frame located at a distance of ±0.52 m on both sides of the wheelset centre-line (Fig. 1). The actual AJF is simulated by removing the longitudinal and vertical primary suspension elements at the involved axle side at a specified location along the track. The lateral stiffness is maintained as long as the wheelset is pushed towards the decoupled axle journal. Additionally, linear longitudinal and vertical viscous dampers are activated at the interface of the failed axle in order to approximately describe the contact between the broken side of the axle journal with the wheelset. The damping coefficient is set to 10 kns/m for both longitudinal and vertical directions. Once the axle journal has failed, the surface of the rotating axle may come into contact with stationary parts of the tube drive system, hereby producing a force that opposes the rotation of the wheelset. In the computer model, this is approximately accounted for by applying a set of longitudinal and vertical forces to both wheelset and bogie frame. The magnitude of these forces are calculated by recording the force values emerging from the longitudinal and vertical semi-flexible restrictions between the axle and tube, respectively, and scaling them by an arbitrarily chosen friction coefficient, μ a-t. Not all parameters are known. Because of these uncertainties simulations are performed with three conditional parameters having varying values. The three defined conditional parameters are: (a) location of axle failure along the track; (b) wheel rail friction; (c) axle tube friction. Table 2 Implemented semi-flexible restrictions in the MBS vehicle model No. Connecting bodies Limiting relative movements Direction Total No. in one vehicle model 1 Wheelset and bogie Axle and tube drive Vertical 8 2 Wheelset and bogie Axle and tube drive Longitudinal 8 3 Wheelset and bogie Axle box and bogie frame Vertical 8 4 Wheelset and bogie Axle box and bogie frame Longitudinal 8 5 Wheelset and bogie Wheel running surface and brake shoe Longitudinal 8 6 Bogie and carbody Bogie frame and carbody underframe; prevents Vertical 8 abnormal bogie roll and pitch angles 7 Bogie and carbody Yaw damper attachment points on bogie frame and carbody: prevent abnormal bogie yaw angles Longitudinal 4

546 D Brabie and E Andersson Simulation results therefore have a spread depending on the actual values of conditional parameter combinations. Conditional parameter values are set as below. The input track geometry for the Tierp validation simulation set is shown in Fig. 2(a). The first damaged sleeper was located 11 m from the start of the circular curve section. Accordingly, three possible axle failure locations are included in the simulation set: 25 m before the start of the transition curve (T fp1 ), alternatively 5 m (T fp2 ) and 55 m (T fp3 ) from the start of the transition curve. Based on the meteorological information at the time of the incident, three wheel rail friction coefficients are tested, μ = 0.3, 0.4, and 0.5. Currently, an empirical value for the coefficient of friction as the rotating failed axle comes into contact with stationary parts of the tube drive system cannot be assessed. An attempt to minimize this uncertainty is by testing two values, μ a-t = 0.1 and 0.3. For the Gnesta case, the input track geometry is shown in Fig. 2(b). Since no actual derailment occurred, the exact location of the AJF along the track is even more difficult to determine. However, the incident report indicates that full braking was automatically applied by the ATP system (in Sweden called ATC) at approximately 137 m from the start of the second circular curve section. It can therefore be assumed that at least from that location and further on, the journal side detached completely from the rest of the axle. Four different possible axle failure locations have been included in the simulation set: 30 m before the start of the first transition curve (G fp1 ), 100 m from the start of the first transition curve (G fp2 ), 400 m from the start of the first circular curve section (G fp3 ), and at the end of the second transition curve (G fp4 ). The meteorological information for the Gnesta case indicated wet conditions. Accordingly, lower wheel rail coefficients of friction are tested, μ = 0.15, 0.25, and 0.35. For the axle to tube interface, the same coefficients of friction are tested as in the Tierp case, namely μ a-t = 0.1 and 0.3. 2.1.2 Validation results The vehicle and axle failure model is validated as below by comparing the tendency of derailment resulting from combinations of all the conditional parameters described above with the authentic sequence of events. Two additional, partially unknown, parameters are included in the validation simulation sets for both Tierp and Gnesta: the semi-flexible mechanical restrictions (elements 1 and 2 in Table 2 and Fig. 1) in the range for the vertical play of 10 100 mm and longitudinal play of 40 60 mm, both in steps of 10 mm. The validation simulation set for the Tierp case is summarized in Figs 3(a) and (b) for the two tested values μ a-t = 0.1 and 0.3, respectively, representing the uncertain friction coefficient between the axle and stationary parts of the tube. This so-called derailment maps indicate the lowest (from all simulations with different conditional parameters) vertical play for different longitudinal play at which the leading and trailing wheelset derail as a result of an axle failure on the trailing wheelset above the high (outer) rail. The figures also indicate as a shaded rectangle the plausible range of vertical and longitudinal plays found in an actual X 2000 power car bogie. The computer simulations clearly show that for certain conditional parameters in combination with certain vertical and longitudinal plays, the leading wheelset of the vehicle derails towards the low (inner) rail in the curve. Furthermore, these simulations successfully predict that the leading wheelset leaves the rails within a few metres from the entrance in the circular curved section (not shown here), in accordance with observations from the first damaged sleepers from the authentic case. The explanation for such behaviour is not obvious. As a result of the failure, the vertical force on the trailing (high) wheel is diminished, thus the creep forces on this wheel are lost, hereby allowing the trailing wheelset to be laterally displaced towards the high rail of the curve. The high wheel flange of the trailing wheelset is occasionally running above the high rail. The vertical force of Fig. 2 Curvature and cant data for (a) Tierp and (b) Gnesta validation simulation sets

On minimizing derailment risks and consequences for passenger trains at higher speeds 547 Fig. 3 Summary of results for the Tierp validation set; the lowest vertical play ( z t ) for different longitudinal play ( x t ), which leads to a derailment of the leading and trailing wheelset for (a) axle tube friction μ a-t = 0.1 and (b) μ a-t = 0.3. Shaded areas show possible play in authentic incident the low wheel on the leading wheelset is now also greatly diminished, because it is diagonally located with respect to the axle failure. The new occasional large wheelset yaw angle steers the leading wheelset towards the low rail, ultimately leading to a flange climbing derailment of the low wheel. At the same time, certain combinations of conditional parameters and mechanical restrictions may also lead to a derailment of the trailing wheelset, unlike the sequence of events of the authentic case. This especially applies to the cases where a higher friction coefficient μ a-t was tested (Fig. 3(b)), where the trailing wheelset derailment line passes through the region of plausible vertical and longitudinal mechanical restrictions. The summary of results for the Gnesta validation simulation set is presented in Figs 4(a) and (b) for the two tested friction coefficient values μ a-t = 0.1 and 0.3, respectively. The results are presented in a similar manner as for the Tierp case described above; however, as no derailment occurs in the authentic case, no distinction is made as to which wheelset is derailing. Moreover, each derailment line corresponds to the lowest vertical play for different longitudinal plays for each of the tested wheel rail friction coefficients. The simulation results agree with the outcome of the authentic case, where no derailment occurred as a result of an axle failure on the leading wheelset in the X 2000 power car trailing bogie. However, a derailment may occur in the plausible mechanical restriction range for certain conditional parameter combinations including relatively high axle tube and wheel rail friction coefficients, see Fig. 4(b) for μ a-t = 0.3 and μ = 0.35. Nevertheless, as meteorological information valid at the incident site indicates wet running conditions, it is reasonable to presume that, in general, lower friction coefficients should better correspond with the authentic case. Comparing the results of the two validation cases with each other for the same axle tube friction coefficient μ a-t, it appears quite clear that the chain of events at Tierp was less favourable than in the Gnesta Fig. 4 Summary of results for the Gnesta validation set; the lowest vertical play ( z t ) for different longitudinal play ( x t ), which leads to a derailment of the leading or trailing wheelset for (a) axle tube friction μ a-t = 0.1 and (b) μ a-t = 0.3. Shaded areas show possible play in authentic incident

548 D Brabie and E Andersson incident. Despite a considerably lower lateral track plane acceleration, only one curved track section, and a, presumably, less dangerous axle failure location, the bogie was more prone to derail at Tierp. One difference, however, between the two cases is the position of the braking shoe relative to the failed axle. At Tierp, the rotating axle in contact with the stationary tube part pulls the failed side of the wheelset away from the brake shoe. At Gnesta, the opposite takes place: the failed part of the axle is pulled towards the brake shoe, which then acts as a tighter longitudinal mechanical restriction. This, in combination with a lower wheel rail friction coefficient most probably hindered a derailment at Gnesta. In comparison with the previous work [3], the current axle failure model has lowered the vertical play required for a derailment not to occur, implying a better agreement with the chain of events in the authentic cases. 2.2 Axle-bogie frame mechanical restrictions 2.2.1 Vehicle and track modelling Two coupled X 2000 vehicles are considered: one power car followed by one tilting trailer car. A similar vehicle model, as used for the validation cases in section 2.1.1, is implemented in the MBS software GENSYS. For the power car, however, the semiflexible restriction representing the brake shoe contact with the wheel s running surface (Table 2, element 5) is removed, for a better assessment of the vertical and longitudinal mechanical restrictions between the axle and the bogie frame (Table 2, elements 1 and 2). Moreover, no further differentiation is made between the tube and gear side of the wheelset, in terms of maximal relative play of the mechanical restrictions ( z t = z g = z) and ( x t = x g = x). An equivalent set of semi-flexible restrictions as for the power car (Table 2, without element 5) is also implemented in the trailer car, based on measurements. It is presumed that axle failure in a curve would correspond to a worst case scenario. Two authentic track sections with geometrical irregularities are tested, corresponding to the validation cases of Tierp and Gnesta, see Figs 2(a) and (b), respectively. The vehicle speed is held constant at 200 and 180 km/h along the two tested track sections, implying a lateral track plane acceleration of 1.0 and 1.6 m/s 2, respectively. Only one axle failure location along the track is chosen, T fp1 and G fp1, 25 and 30 m before the start of the transition curve, respectively. Moreover, for the Gnesta track, the simulation is terminated at the end of the second transition curve. 2.2.2 Axle failure location In order to obtain a better general understanding of derailments caused by axle failures on the outside of the wheel, specifically means of minimizing the consequences in curves by implementing mechanical restrictions, a parameter analysis is performed for alternative axle failure locations. It is assumed that a failure may occur on each of the four axle journals of the leading bogie of the power and trailer cars. The following friction coefficients in wheel rail and axle tube surfaces are considered: μ = 0.2, 0.35, 0.5 and μ a-t = 0.1, 0.3, respectively. The tested range for the vertical mechanical restriction (vertical play ) lies between 10 and 100 mm in steps of 10 mm and for the longitudinal mechanical restrictions (longitudinal play ) five values were chosen: 10, 20, 40, 60, and 80 mm. The simulation results are summarized in derailment maps for the power car (Figs 5(a) and (b)) and trailer car (Figs 6(a) and (b)), for the two tested μ a-t values. Each line corresponds to the location of the axle failure, denoted relative to the closest wheel s position in the bogie and in the curve, and indicates the lowest vertical play z for different longitudinal play x at which a derailment occurs. Each derailment line is Fig. 5 Derailment map for an X 2000 power car at different axle failure locations; the lowest vertical play ( z t ) for different longitudinal play ( x t ), which leads to a derailment for (a) axle tube friction μ a-t = 0.1 and (b) μ a-t = 0.3

On minimizing derailment risks and consequences for passenger trains at higher speeds 549 Fig. 6 Derailment map for an X 2000 trailer car at different axle failure locations; the lowest vertical play ( z t ) for different longitudinal play ( x t ), which leads to a derailment for (a) axle tube friction μ a-t = 0.1 and (b) μ a-t = 0.3 a result of 300 MBS computer simulations, including variation of conditional parameters. As expected, a higher wheel rail friction coefficient (not shown specifically in the diagrams) increases the tendency of derailment, as all lines in the results diagrams belong to the simulated cases of high friction. Moreover, the bogie seems to be most sensible to derailment at an axle failure affecting the leading wheelset; this case also requires tighter mechanical restrictions to avoid derailment. Failure on the high (outer) side requires slightly less tight mechanical restrictions. A feasible explanation is found by analysing the time domain simulations: the bogie frame drops towards the failure corner on the outside in the curve, hereby preventing the corresponding wheel to climb over the high rail. Moreover, the trailer car bogie allows larger vertical mechanical restriction as an average before derailment, in comparison with the powered bogie. This is due to the fact that the bearings on the trailer bogie are closer to the wheel, thus a smaller bending moment is produced by the journal vertical load on the axle side opposite to the failed one, which in turn will cause a reduced wheel lift effect on the failed side. As previously remarked in the two validation simulation sets, a larger axle tube friction coefficient implies a greater tendency of derailment. For a power car bogie with a fixed longitudinal play x = 20 mm, a vertical play z below 50 mm would be considered sufficient to stop a derailment to occur if a relatively low axle tube friction coefficient is considered. Under similar conditions, a trailer car bogie would require a vertical play value just below 80 mm. On the other hand, the required vertical play values drop considerably once a relatively high μ a-t is considered, to 20 and 40 mm for the power and trailer car, respectively. Additionally, a smaller vertical play is also required as the longitudinal play increases. Removing the brake shoe in the power car model in combination with a higher wheel rail friction coefficient requires rather tight mechanical restrictions in order to avoid derailments. This can be clearly seen by comparing the results of the current section (Figs 5(a) and (b)) with the Gnesta validation results (Figs 4(a) and (b)). At Gnesta, the wheel closest to the failed axle journal can be labelled both Leading low and Leading high, as the vehicle negotiated an S-shaped curved track section. 3 MINIMIZING CONSEQUENCES AFTER DERAILMENTS If a derailment, after all, does occur it is most desirable that the lateral deviation of the wheels is very limited, allowing the whole vehicle to stay aligned close to the track centre-line, thus reducing risks of colliding with trains on adjacent tracks or with other obstacles as well as reducing the risks of vehicle turn over. After a derailment has occurred at least some of the wheels will run and bounce on top of the sleepers. Such a cause of events is not usually embraced by ordinary vehicle track models and computer codes; thus a specialized post-derailment module must be developed and included in the simulation software. This is described in section 3.1. In section 3.2 the defined derailment scenarios and other assumptions are presented. In subsequent sections 3.3 3.5 the simulated effects of different means to limit lateral deviation after derailments are described, both for conventional four-axle bogie vehicles and partly also for an articulated train configuration. 3.1 Post-derailment wheelset track interaction The current work utilizes a validated post-derailment MBS module [9] that applies pre-calculated force resultants on the wheel as a function of the initial

550 D Brabie and E Andersson impact state condition defined by the following five parameters: 1. the vertical distance from the wheel s lowest point, i.e. on the flange, to the upper sleeper surface (h z ); 2 4. the wheel s longitudinal, lateral, and vertical velocities (v x, v y, and v z ); 5. the wheelset s yaw angle relative to the sleeper (ψ). The force resultants are calculated using the MBS software GENSYS (see section 2.1.1) through linear interpolation based on a pre-defined look-up table. The table is previously constructed through numerous finite-element (FE) wheel-concrete sleeper impact simulations utilizing the commercially available FE software LS-DYNA [10] and it contains the longitudinal, lateral, and vertical force variations on the wheel as a function of time. The data in the current predefined table are valid for an unworn UIC/ORE S1002 wheel impacting an A9P type monoblock concrete sleeper, frequently used for Swedish railway lines. The sleeper top surfaces are positioned 10 mm under the rails, implying a total vertical distance from the top of the rail (ToR) UIC60 to the sleeper of 182 mm. The vertical variation of the upper sleeper surface as a function of the lateral position is also captured in the MBS module. In order to approach situations close to a worst case in terms of the derailed wheelset s rebounding tendency, a relatively high compressive strength of f c = 80 MPa is set, corresponding to an aged concrete sleeper. Likewise, the parameters describing the vertical track stiffness are equivalent to a stiff ballasted track defined by the following values, valid for half a sleeper: stiffness k ztg = 200 MN/m and damping c ztg = 300 kns/m. Any possible wheel to ballast contact is not taken into account. For cases in which the derailed wheels do not exceed the sleepers lateral boundary, the assumed simplification is considered reasonable. Likewise, the simplification is considered as being acceptable in terms of the ballast s possibility to support the wheel vertically. However, if a wheel goes outside the sleeper end special attention should be paid to the possibility of relatively high longitudinal and lateral force resultants on the wheel for cases where the wheel sinks considerably under the sleepers upper surface. Where applicable, the implications of such simplifications will be commented in the forthcoming results sections. Furthermore, the wheel may not return back onto the sleepers once the flange leaves the sleeper surface laterally. In the initial derailment phase, wheels may also come into contact with the rail fastening system. A recent upgrade of the post-derailment module [11] enables such circumstances to be taken into account for a Pandrol fastening system type. Briefly, the post-derailment module has been calibrated and successfully validated in three stages. 1. FE model versus Authentic derailment 1: FE impact simulations were performed and compared with the indentation marks in three consecutive sleepers [9]. 2. FE model versus MBS model: a wheel s trajectory over 24 consecutive sleepers was compared between FE and MBS model [9]. 3. MBS model versus Authentic derailment 2: MBS simulations of a derailing vehicle were performed and compared with on-site measurements over 10 consecutively damaged sleepers [11], see also Fig. 7. The MBS post-derailment module is valid under the following premises: (a) derailment on ballasted track with equally spaced undamaged concrete sleepers of constant properties; (b) constant post-derailment train speed (no applied braking); (c) wheel to ballast contact is not considered; Fig. 7 Simulated wheel trajectory versus measured sleeper damage used for the third validation stage of the post-derailment module: (a) wheal tread vertical position relative to sleeper upper surface and (b) flange lateral position relative to rail foot

On minimizing derailment risks and consequences for passenger trains at higher speeds 551 (d) impact with rail fastening system of Pandrol type; currently valid only for situations where the fastening system orientation and the train s direction of travel coincide in such a manner that the front arch of the clip is pushed out of the centre leg upon impact; (e) wheel-fastener impact model can only predict the vertical force, and accordingly longitudinal and lateral forces arising during contact are not taken into consideration; (f) additional impact with other infrastructure parts such as switches and crossings, signalling devices, etc. are currently not considered; (g) various mechanical restrictions between bodies in contact are assumed to have sufficient strength to withstand impact forces at contact, without fracture or permanent deformation of significant importance for the cause of events. 3.2 Derailment scenarios and vehicle formation Three different causes of derailment in combination with various track geometry parameters comprise a set of six derailment scenarios, see further Table 3. The MBS model of an AJF has been validated in section 2.1. The failure of the journal, located on the outside of a trailing wheelset, affects the leading bogie of an intermediate passenger car. As a result, the leading wheelset starts to deviate laterally due to flange climbing on the high rail of a circular curve section. Another derailment scenario is a hypothetical wheel flange on rail (WFOR) condition as initiated on the leading wheelset of a leading driving trailer car by an initial lateral displacement of 80 mm in combination with a yaw angle of 1.58. The leading bogie and carbody midpoints are also displaced laterally 40 and 20 mm, with yaw angles of 1.58 and 0.13, respectively. No defects, neither to the leading vehicle nor to the track, are considered. This derailment scenario might correspond to a sequence of events subsequent to the train encountering relatively small objects on the track. Furthermore, two cases are considered by varying the track geometry. In one case, the track ahead of the point of derailment consists of a transition curve (150 m long) in the opposite direction as the derailed wheelset, i.e. the leading wheelset is set to derail towards the left side of the track, while the transition curve is modelled towards the right. In the second case, the track is tangent and the rail fasteners are not considered, as this situation is believed to correspond better to sequence of events approaching a worstcase scenario. A high rail failure (HRF) in a curve is automatically a treacherous situation as the wheelsets lose all lateral guidance. Such a failure is modelled by removing subsequently the lateral and vertical wheel rail contact elements once the train passes the start of a circular curve section. The rail vehicle formations employed in derailment simulations consist of three conventionally coupled and one articulated vehicle configuration according to Table 4. In the conventional design (C1 C3 in Table 4), each vehicle consists of one carbody, two bogie frames, and four wheelsets. In the articulated design (A1 in Table 4), adjacent carbody ends share the same bogie. The axle loads for the power, trailer, and intermediate passenger cars in configuration C1 C3 are 180, 148, and 131 kn, respectively. The axle load of the Table 4 Abbreviation C1 C2 C3 A1 Train configurations employed in the MBS derailment simulations for vehicle derailment-worthiness studies Train configuration Power car + intermediate passenger car Driving trailer+intermediate passenger car Three intermediate passenger cars Power car+semiarticulated passenger car+2 articulated passenger cars+1 semi-articulated passenger car; see further Fig. 20 First derailing wheelset Wheelset 1 in intermediate passenger car Wheelset 1 in driving trailer Wheelset 1 in second intermediate passenger car Wheelset 1 of the second median bogie (fifth bogie in the trainset); see further Fig. 20 Table 3 Overview of implemented derailment simulation scenarios No. Abbreviation Derailment cause Speed (km/h) Curve radius (m) Cant (mm) Cant deficiency (mm) Lateral track-plane acceleration (m/s 2 ) 1 AJF-16 AJF on circular curve 200 1200 150 245 1.6 2 AJF-10 2580 30 153 1.0 3 WFOR-10 Impact with objects on track or 2120 70 153 1.0 others 4 WFOR-00 0 0 0.0 5 HRF-16 HRF on circular curve 1200 150 245 1.6 6 HRF-10 2580 30 153 1.0

552 D Brabie and E Andersson median bogie in the articulated section of the train (configuration A1) is 169 kn. The vehicles are modelled in the MBS software following the general description found in section 2.1.1. 3.3 Substitute guidance mechanisms 3.3.1 General considerations The concept of utilizing substitute guidance mechanisms is not new. For instance, on the Swedish network it is common practice to install two additional rails in-between the running rails, on track sections where a lateral deviation following an accident would have disastrous effects. Such enhanced passive safety components can currently be found on viaducts, bridges, at certain distances prior to tunnel openings, as well as in tunnels. The concept is that, in a derailed condition, the lateral deviation of the wheelset would be prevented by means of these additional rails. The guidance mechanisms studied in this article are connected to the vehicle. They could be divided into two groups, depending on to which vehicle part they are attached: (a) on the sprung mass, as low-reaching bogie frame parts, see Fig. 8(a); (b) on the unsprung mass, as low-reaching brake discs or axle journal boxes, see Fig. 9(a). For both groups, their intended purpose is to guide laterally and stabilize a derailed running gear by simply engaging with the appropriate running rail. This principle is shown in Fig. 8(b) for a bogie frame and Fig. 9(b) for a brake disc and an axle journal box. Fig. 10 Additional simulation set, subcase I IV; four different longitudinal start locations of the wheelset that will derail first relative to the track sleepers All these substitute guidance mechanisms have been found to prevent lateral deviation of the running gear in authentic cases of derailment at different railway systems around the world; see reference [2]. In order to initiate as well as to maintain a successful lateral guidance, geometrical and strength requirements need to be fulfilled. In addition, mechanisms should be able to cope with track discontinuities, i.e. traversing switches and crossings, in a derailed condition so that a further aggravating situation is avoided. The latter issues are not, however, dealt with in this article. Fig. 8 Guidance mechanism attached to the sprung mass: (a) geometrical feasibility parameters under study and (b) the intended sequence of events in derailed condition Fig. 9 Guidance mechanism attached to the unsprung mass: (a) geometrical feasibility parameters under study and (b) the intended sequence of events in derailed condition

On minimizing derailment risks and consequences for passenger trains at higher speeds 553 In this article, the study has been mainly focused on the geometrical feasibility requirements. In this respect, the mechanism should be positioned sufficiently low relative to ToRs as to overcome the vertical dynamic movements induced by the derailed running gear bouncing on the sleepers, in combination with a sufficient lateral gap to accommodate the width of the rail. Moreover, the positioning of the guidance mechanisms should not interfere with applicable gauging standards for low-reaching parts. In Sweden, features placed on the wheelset (except the wheels themselves) may not be lower than 80 mm above ToR, including a possible minimum wheel wear of 30 mm. For features placed on the bogie frame, one also needs to consider the maximum vertical deflection of the primary suspension, usually in the order of 30 mm, implying a limit of 110 mm in nominal position. The interoperable European gauging standard, as in UIC leaflet 505 or the provisional EN 15 273, dictates a more conservative vertical limit, raising the above-mentioned values with 30 mm implying a minimum vertical distance to ToR of 110 and 140 mm for features on the wheelset and bogie frame, respectively. For the considered lateral gap values between 80 and 290 mm, the Swedish and the interoperable European gauging standards should not impose any limitations. Out of all five parameters that make up the initial impact state condition described in section 3.1, four of them are inherent in the derailment scenarios. The fifth, non-deterministic parameter that has a direct effect on the derailed wheelset s dynamical behaviour is the vertical distance from the lowest point of the wheel to the upper sleeper surface, h z. At the instant of initial contact with sleepers, h z is varied by shifting the initial longitudinal location of the sleeper in relation to the wheelset that derails first, see Fig. 10. This shifting is performed for all derailment cases described in section 3.2 and Table 3. For instance, in subcase I, the track s sleepers are laid in the model in such a manner that the first derailing wheelset is located with its centre exactly above a sleeper at the start of the simulation. Accordingly, subcases II, III, and IV imply a subsequent longitudinal shifting of the sleepers by 0.1625 m, i.e. a quarter of the assumed constant sleeper spacing of 0.65 m. 3.3.2 Guidance mechanisms computer modelling The guidance mechanisms are modelled in the MBS software GENSYS by a specially designed contact element, derailm_1 (Fig. 11). It consists of vertical and horizontal boundaries that can define two distinct rigid planar features that may come into contact if any of the boundaries approach each other. In such circumstances, a linear stiffness and damper in parallel will obstruct the bodies motion towards each other, according to the following parameters: k GM-y = k GM-z = 80 MN/m (lateral and vertical stiffness for guidance mechanism to rail contact, respectively) and c GM-y = c GM-z = 100 kns/m (lateral and vertical damping for guidance mechanisms to rail contact, respectively). The feature corresponding to the guidance mechanism is rigidly connected to Body 1, which in the current work represents either wheelsets or bogie frames. The rails are distinguished by the features connected to Body 2, which stands for the track piece introduced in section 2.2. Fig. 11 Principal appearance of the derailm_1 contact element in GENSYS used for modelling the interaction between substitute guidance mechanisms and rails

554 D Brabie and E Andersson Furthermore, the UIC60 rail profile is modelled as a rectangle of width b r = 72 mm and height h r = 158 mm. The maximum height of an unworn rail is 172 mm to the ToR. However, the considered rail width and height correspond to a location where the almost vertical surfaces of the rail head turn into radii of 13 mm, at 14 mm below the ToR. For reasons of possible vertical wear and additional safety margins, the curved surface of the rail is therefore omitted. Longitudinal, lateral, and vertical frictional forces are applied to the bodies based on the magnitude of the impact forces arising at the contact between guidance mechanisms and rail, scaled by a friction coefficient μ b1-b2 = 0.4. In the longitudinal direction, the brake discs and axle journal boxes are located at the centre of the wheelsets, while the guiding parts of the bogie frame are located 0.7 m fore and aft of the centre-line (Fig. 12). 3.3.3 Geometrical feasibility results Computer simulations are performed for curved track as well as tangent track, at speeds of 100 and 200 km/h. In this article only results at 200 km/h are presented. The intension is to show principles rather than presenting all possible cases. All combinations of the geometrical parameters in steps of 5 mm are investigated. For each derailment scenario, four simulations are performed (subcase I IV in Fig. 10). The highest vertical distance (h, H,orH ajb ) according to Fig. 8(a) is registered at different lateral gap values (b, B, orb ajb ), which leads to a successful engagement with the rail. The results are presented as the averaged vertical distance, computed among the four simulations, as a function of the tested lateral gap values. Whether the studied guidance mechanisms have managed to successfully retain the running gear s Fig. 12 The studied guidance mechanisms and their longitudinal location in the derailing bogie lateral deviation, this is evaluated once the first derailed wheelset has rolled on the track for a distance of about 150 m. Furthermore, only a successful engagement with the rail of guidance mechanisms adjacent to the leading wheelset, in the derailing bogie (Fig. 12), is considered. In some situations, the computer simulation results indicate a laterally stabilized running gear by the guidance mechanism adjacent to the trailing wheelset. Depending on other running gear design parameters, e.g. mechanical stops in the yaw dampers that limit large carbody to bogie yaw angles, such sequence of events may also be beneficial. As mentioned earlier, such successful engagements are not accounted for here. The geometrical feasibility results for a low-reaching bogie frame, or its attached parts, are presented in Fig. 13. Each line in the six diagrams represents different derailment scenarios and corresponds to the averaged highest vertical distance H at different lateral gap B for which a successful engagement with the rail is obtained. Consequently, a low-reaching bogie frame with geometrical parameter combinations located on or on the right hand of the line would stop and stabilize the lateral deviation of the bogie, on the average. Some specific geometrical combinations located on the right-hand side of the lines might also lead to a non-guiding condition. In this context it is worth recalling that the MBS simulations are preformed for certain worst-case conditions, such as an excessive rail wear and new wheels, among others. It can therefore be assumed that a successful guidance condition is obtained for most of the cases of geometrical combinations found in the proximity of the lines. The diagrams also indicate the approximate lowest possible vertical distance according to Swedish (110 mm) and the stricter interoperable European (140 mm) gauging standards. The latter considerably limits the amount of feasible geometrical parameter combinations, although successful guiding should still be possible in most real cases. Another important limiting factor is associated with cases of relatively small lateral gaps B, which require small vertical distances H, violating the permissible gauging standards. Partially, this is caused by the Pandrol fastening system that obstructs the wheelset in the vertical direction and consequently the low-reaching bogie frame from sinking sufficiently below the ToR. Furthermore, smaller lateral gaps B, in combination with large initial postderailment vertical bouncing, increases the risk of the guidance mechanism to slide over the rail. In general, derailment scenarios corresponding to higher lateral track plane acceleration (cant deficiency) and consequently higher post-derailment wheelset lateral velocity would require a smaller vertical distance H for a successful engagement with the rail. Once again, the explanation can be found in the correlation between the rate at which the rail is approached by the guidance mechanisms and its

On minimizing derailment risks and consequences for passenger trains at higher speeds 555 Fig. 13 Low-reaching bogie frame geometrical feasibility results for derailments at 200 km/h; scenario WFOR-00 is on the tangent track, all others are on the curved track; see Tables 3 and 4 vertical displacement as the wheelset initially bounces on sleepers along the track, the amplitude of which is irrespective of the lateral track plane acceleration (cant deficiency). In addition, a high cant deficiency implies a higher roll angle on the bogie, which lifts the parts of the bogie frame running towards the inside of the curve. For derailments caused by HRF with lateral gaps of at least 200 240 mm, it is in most real cases, e.g. moderate lateral acceleration, possible to prevent lateral deviations even for interoperable European gauging cases. However, for cases according to the interoperable European gauging standard, a low-reaching bogie frame is unable to limit the lateral deviation for events corresponding to high cant deficiency. In addition, the low-reaching bogie frame cannot provide the expected lateral guidance for smaller lateral gaps. This is due to large vertical motion of the guidance mechanism arising from the wheelsets bounce on sleepers in combination with larger bogie pitch and bounce motion because of the nature of the derailment. The geometrical feasibility results for a low-reaching brake disc (Fig. 14) and low-reaching axle journal box (Fig. 15) are presented in a similar manner as in the previous subsection. In the brake disc case, the HRF derailment case has not been closely investigated, since the brake disc is located on the inside of the failed rail and is therefore not able to limit the lateral deviation. Clearly, derailments on tangent track (WFOR-00) lead to the least dangerous situations among the derailment scenarios considered. The tested guidance mechanisms can stabilize the derailed bogie even at smaller lateral gaps in combination with rather large vertical distances. However, the brake disc requires a smaller vertical distance h for a larger lateral gap b, on tangent track than on the transition curve that leads to lateral track plane acceleration a y = 1.0 m/s 2 (compare WFOR-10 with WFOR-00 in Fig. 14). The explanation is related to the dynamics of the whole running gear at the instant of the brake disc to rail lateral contact. In the derailment scenario on the curved track (WFOR-10), the trailing wheelset derails before the brake disc reaches the rail. This is not true for the tangent track case (WFOR-00), where the derailing trailing wheelset induces additional vertical movement on the leading wheelset brake disc just at the instant of lateral contact with the rail. Unlike the bogie frame, the low-reaching axle journal box can cope better with an HRF derailment scenario, even for vertical distances H ajb well above

556 D Brabie and E Andersson Fig. 14 Low-reaching brake disc geometrical feasibility results for derailments at 200 km/h; scenario WFOR-00 is on tangent track, all others are on the curved track; see Tables 3 and 4 Fig. 15 Low-reaching axle journal box geometrical feasibility results for derailments at 200 km/h; scenario WFOR-00 is on the tangent track, all others are on the curved track; see Tables 3 and 4 the stricter limit of interoperable European gauging standard, see Fig. 15. derailment in relationship with the maximum coupler yaw angle and bogie yaw stiffness. 3.4 Vehicle coupler and additional bogie design features The current section attempts to quantify the effects on the vehicle lateral deviation tendency after a 3.4.1 Restrained coupler and vehicle modelling Three coupled intermediate passenger cars (see Table 4) are modelled in the MBS software GENSYS, following the general description found in section 2.1.1.