Hacker News Reader

Comment by cs702 | Hacker News Reader

Wow, a simple bit-arithmetic bug somewhere in there has over time become a design constraint for all trains used in an entire country. That's insane!

View on HN

More of an operational constraint. You can design the various carriages and locomotives any way you want as long as you don't compose them in that way.

They're putting an awful lot of faith in that counter though if they allow 255 and 257 that means that they expect to never miscount an axle.

A single wagon probably has an even number of axles, so 255 and 257 is probably impossible. But yes, those axle counters are extremely reliable, a miscount produces quite a bit of work because then a human has to confirm that the train left the track protected by the counters.

> A single wagon probably has an even number of axles

Do bogies with uneven number of axles even exist?

Some locomotives have (or had) an odd number of Axles: https://en.wikipedia.org/wiki/Co-Bo

And answers my question in the positive, bogies can be anywhere from 1 to 5 axles (at least for locomotives)

> A single wagon probably has an even number of axles, so 255 and 257 is probably impossible.

Voilà.

That doesn't seem like a safe assumption: http://d2ydh70d4b5xgv.cloudfront.net/images/a/e/fleischmann-...

(Not Swiss, just the first train car I could find with 3 axels)

This German car is like 100 years old and was scraped years before they managed to implement axle counters.

That car may be 100 years old, but the last German three-axle cars were build in 1959 (https://de.wikipedia.org/wiki/Umbau-Wagen_(DB)#Dreiachsige_U...), and some of them were still in use in 2014 (https://de.wikipedia.org/wiki/Datei:Umbauwagen_der_DB_Bahnba...)

None of them are in regular use anymore and also you can't build a long enough train to exceed the limit.

> you can't build a long enough train to exceed the limit.

You can definitely build long enough trains to blow past the limit several times, coal and ore trains are routinely 100+ cars long (with each car having at least 4 axles), the record is a BHP Billiton Iron Ore train of 682 cars and 8 locomotives.

I remember being stuck on a crossing with an ore train like that passing. It was going quite slow and it took forever to pass. 100's of cars.

It was about a German car. Not BHP.

In Switzerland the freight trains are not this long, perhaps at most 40 cars. They need three engines [0] to climb the gradient of 28‰ of the Gotthard mountain line (now being replaced by the Gotthard base tunnel).

[0]: http://bazonline.ch/schweiz/standard/Zwei-Haende-bremsen-den... (German)

That is probably the best point -- Swiss trains have to be short, so this 2^8 constraint isn't really an issue.

Yes and no. The limit until 2010 was 670m in nearly all parts of western europe. Block signals, crossroads, stations… need to be made sufficient long enough.

With ETCS [1] there are no "fixed" physical block segements anymore. They are simulated in software and allow a much higher densitiy of trains and also longer trains. While SBB is highly motivated to roll out and migrate their legacy signalling systems, it's still a long way. The new Gotthard Base Tunnel is already built ETCS-only.

https://en.wikipedia.org/wiki/European_Train_Control_System

Talgo trains have just one axle per wagon... See https://en.wikipedia.org/wiki/Talgo

257 would be impossible regardless

1,2,3,...,254,255,0,1,2,3...

1 byte.

Although it is mentioned in the comments to the linked article that it is probably an electro-mechanical counter, so I am imagining a four wheel encoder with each wheel having 4 positions (although could be 8 wheels with 2 positions per wheel), electrically readable, and reset-able.

Trains can be composed of all kinds of cars.

yeah, but my point was that a mechanical counter of this nature would overflow counting 0-255 then wrapping around. So it would never get to 257. And the wheels I was referring would be in the counting mechanisim, I didn't say anything to suggest type of cars / axles etc.

No, that it won't get to 257 is the whole point here. So 257 axles with a single axle missed would end up as 256, resetting the counter -> no train present.

Ditto for 255 with a single 'bounce'.

I don't think that the article was about miscounts, otherwise it would equally be a problem for a 258 axle train that missed 2 axles. Since the article is describing a problem that occurs for multiples of 256 it is almost certainly a counter overflow issue, so a 256 axle train resets to zero and a 257 axle train would appear to the counter as 1, which is still sufficient to mark the block of track as occupied.

The standard locomotive arrangement in the US is 2 bogies of 3 axles each; 4-6-0 and 0-6-0 wheel arrangements (5 and 3 axles, resp.) on steam locomotives were also common. While the modern locomotives do have an even number of axles, it's not a multiple of 4 (like standard wagons usually are), so it's not possible to have 256 axles exactly if you have an odd number of locomotives (e.g., 2 forward/1 reverse arrangement).

Don't forget multiple units. Those usually have axles in multiple of 4

Axle counters are "positive only" systems e.g. if the numbers don't match or the counter resets, it will report an error and the next train needs a special safety order to enter the track section. So if you manage to combine a 256 axle train, it will just slow down everything on its way and cause chaos, but no accidents.

In the old times there was a manned caboose car at the end which job was to ensure the completeness of the train (and that switches are cleared).

Here's an example of such an SBB car decommissioned some centuries ago http://www.bahnbilder.de/bilder/gueterwagen-266906.jpg

Video (1986) https://www.youtube.com/watch?v=ev4szZ4iNTY

Ya, I remember those. My friends and I would always wave to the cabooseman (I doubt that's the right word, but I really like it) as it went by, and he would usually wave back at us.

In Britain, he'd be called a guard or brake-man, and rode in the brake van.

The US probably has a different term.

Ironic since "van" means the front, as in vanguard.

I realize you weren't being serious, but this van is an abbreviation of caravan, which ultimately has its origins in Persian: In 16th cent. carouan, < Persian kārwān, in same sense. Found in medieval Latin carvana (Hoveden), caravanna, caravenna (Matt. Paris), and French carvane, from Crusading times, but apparently not in English before 16th cent. The form caravan was perhaps caravane from French.[1]

[1] http://www.oed.com/view/Entry/27717#eid10166797

In the U.S. that would the train's rear conductor or a brakeman, basically the conductor's assistants. In the days before vacuum brakes the rear conductor would have the job of reading lantern messages from the front conductor (in the locomotive) and then dispatching brakeman to walking along the train car roofs and individually setting the brakes on each car.

That sounds like a pretty dangerous job.

The railroad industry has a very sordid history of killing its employees. All the way from track construction to actual operation.

Even in this 1955 fire training video you can see they care more about the locomotive than the safety of the crew: https://www.youtube.com/watch?v=hkUQ3rTfU4s

tldw: crew were expected to enter the confined area of the engine room in the middle of a fire and turn at least two valves (that have complex interactions with each other) filling the same confined area with CO2.

That makes good sense.

Still, given that the warning was issued quite explicitly it would seem that the designers of the operations guide definitely thought it was possible to have a train that long. Otherwise, why bother with the warning?

Because you have to cover all possibilities, even if they are highly unlikely. It's sad most people mistake this for weakness of a system.

> It's sad most people mistake this for weakness of a system.

I don't think that conclusion is warranted.

Well, maybe. I've seen a lot of "Hyperloop" fans who don't know basics about transportation systems (planning, technology, financing). So maybe I'm overly aggressive here. Sorry.

I've re-written a bunch of fuel quantity calculation software for a small airline, the degree of planning and verification that went into that totally blew my mind, it completely changed my way of thinking about writing any piece of software and even now I have to catch myself not to 'overthink' the solution to some problem.

As soon as there are lives on the line the amount of thinking about undefined situations skyrockets. Even so, given that the system fails 'positive' (as in: it can't register 'no train' when there is a train, it can only register 'train' when there is none) I'm quite impressed with the foresight to even think about that exact possibility occurring.

Another field where you see this kind of planning is in medical electronics and software systems.

The medical electronics you have seen must have very little resemblance to the equipment I use. Buggy, terrible UI and poor design.

Hm. Interesting. I've had - unfortunately - a lot of close up time with a bunch of high tech around one of my children and without exception that stuff was very well designed and did not hick-up even once over a whole pile of weeks. (Neonatal ICU.)

I've also bought some medical electronics surplus for parts in the past and it was absolutely bullet-proof. Top quality.

Try the radiology department. Brand new hardware and software from Siemens, GE or Philips. Particularly GE and particularly MRI interfaces. Broken code, and just plain terrible design choices like typing "1" for on and "0" for off. Type in "3" and it crashes, except when its occasionally allowed on non bools. Ultrasound interfaces are so unbelievable horrid that they should win any competition fairly easily. On on current model machine - touch screen, track ball, hardware sliders, physical buttons, software buttons and a track pad. connecting that to the network was unpleasant.

Edit: Im just taking an infusion pump to be serviced. This model is well liked. However when you want to deliver a drug bolus at a very specific time point during an MR scan the pump may deliver it, or it may give and error as its timed out. There is no way to tell prior to pressing "bolus". Not ideal.

> Another field where you see this kind of planning is in medical electronics and software systems.

Maybe sometimes...

https://www.youtube.com/watch?v=2o8MDCIlOEk

That should be reason enough for a claim.

> decommissioned some centuries ago

Decades, perhaps? (A decade is ten years; a century is one hundred.)

A train having less than 256 axles in Switzerland doesn't exactly sound limiting, ridiculously long trains are coal and ore lines (e.g. BHP Billiton) or huge general freight in large countries (Canada, US). Switzerland is a fairly small country with steep gradients, a 256 axles limit would give a limit of ~60 cars.

They don't say that this is an upper limit. The number should not _equal_ 256 (or 512, etc), but it can be larger or smaller than that.

> They don't say that this is an upper limit.

It's not, but considering the context going above would mean going through the limit which would be dangerous, during exit the counter would mark a railroad section as unoccupied before underflowing back to occupied. It might also have interesting failure modes during entry.

It sounds like that would momentarily register the track as free between the 256th and the 257th axle, a nice little race condition.

And you could decouple 2⁸n axles worth of rail cars, and depart the segment leaving it looking empty.

I sense a cyberpunk / train heist movie plot here...

It's not that it has to have less than 256 axles, it has to not have exactly 256 axles (or presumably multiples of 256)

Considering the context is track vacancy detection, I'd think even going through the counter would be dangerous (as it could temporarily mark a rail section as unoccupied during its occupation before underflowing, a good old race condition) and would thus be operationally avoided as a recipe for disasters.

It wouldn't be difficult to require that a count of 0 be maintained for several seconds before registering as vacant.

This is exactly the sort of repair that gets implemented - fixing the wrong thing!

Presumably the original limitation is hardware that is actually counting axles, while timing check can be done programmaticaly.

It is much safer to lock the segment on overflow or underflow (and require manual rearming), a timer can be defeated and dumb luck means it will eventually be.

Also Germany has a limit of 252, IIRC, and I expect the majority of long freight trains passing through Switzerland to be international services. There are plenty of old axle counters in operation around Europe because ultimately it's a limitation more in theory than in practice.

Along with the steep gradients, you have to remember there's far more passenger services on the lines, so pathing constraints force freight services to be shorter (you can't have them accelerating that much slower than passenger services, or they start taking up a disproportionate amount of capacity on the line).

>Also Germany has a limit of 252

Was that itself a response to the exactly-256 problem, "plus a margin of safety"?

Yes. Plenty of European countries have similar limits, around 250. There's plenty of old 8-bit microcontroller based axle counter systems still in use which are unlikely to get replaced until they are life expired simply because the 256 limit incredibly rarely affects anything; for reference, the most axles per train in the UK I'm aware of is 192 axles.

Switzerland runs small freight trains by US standards. Freight cars are usually 2-axle.

Here's Union Pacific's longest container train. 295 freight cars, 9 locomotives. Four axles per car. So that's over 1180 axles. A more typical US train is 100 cars and a few locomotives; over 400 axles isn't uncommon. 256 would be an inadequate axle limit in the US.

(There are longer trains in Australia, but they're usually coal or mineral hauls on dedicated track in flat country. This was a run from Los Angeles to Texas on mainline track.)

[1] https://www.youtube.com/watch?v=jdIzRFOaTCY

Oh, certainly, I'm not trying to claim these are the longest in any worldwide sense, but it's a common sort of maximum length around Europe.

FWIW, a lot of freight wagons around Europe are on bogies (with two axles per bogie) where they would be two-axle wagons in the US; I presume a lot of this is down to comparatively higher speeds of freight in Europe as a result of pathing around passenger services. Plenty of freight around Europe runs at up to 160km/h (~100mph), and that sort of speed is fast for a passenger service in the US. Obviously, this doubles the number of axles per wagon (though decreasing axle weight and hence track loading), further shortening the length of a 256 axle train.

> A train having less than 256 axles in Switzerland doesn't exactly sound limiting

It would appear the maximum length of a train in Switzerland is 1500 meters which would push it well above 256 axles.

I'm only aware of one single movement of a 1500m test train, consisting of 76 container wagons and three SBB Re 620 locomotives, which would make 322 axles if I'm not mistaken, for the curious.

At the same time, that was a run through the Gotthard Base Tunnel, and running onto similarly modernised infrastructure, and hence less likely to have 40 year old axle counters in use.

This kind of thing makes me less apprehensive about programming jobs going away.

The quality of the software the world depends on is so low. We can do so much better and hopefully better will be demanded of us as the field matures.

Why would you jump to the conclusion that this is a software implementation. I believe, based on the comments in the linked article that it is probably a electro-mechanical counter.

The problem may not be software, the solution almost certainly will be.

This was likely a known limitation when it was implemented and the costs to overcome it weren't considered worth it.

Reply on news.ycombinator.com