Monday, October 19, 2026
Safety Message: Electronically Controlled Pneumatic Braking
ONRSR is highlighting the risk of uncontrolled movements due to Electronically Controlled Pneumatic (ECP) braking crosstalk and unsafe securing of trains.
ECP braking is a system that uses electronic brake control signals originated at the lead locomotive head end unit (HEU) and communicated by a trainline cable to car control devices (CCDs) on all wagons and to the end-of-train (EOT) device. It provides an almost instantaneous response to braking commands, including graduated brake releases and applications.
While ECP braking provides improved train handling and braking performance, it must be regarded as a supplementary system to conventional pneumatic brakes. As such, pneumatic brakes must always be applied by the train driver as the failsafe fallback when ECP braking is shut down, or when the trainline cable continuity is lost.
ONRSR is highlighting:
- the risk of uncontrolled movements of freight trains equipped with ECP braking that could arise due to a combination of crosstalk leading to ECP braking shutdown and inadequate securing of the train.
- controls that rolling stock operators should implement to mitigate this risk.
ECP devices on a train (HEUs, CCDs and EOTs) communicate with each other via a local area network. Each device is connected using the trainline cable as a single common medium for both communications and power. In general, communication between trains is unlikely, however certain hardware fault conditions, such as trainline ground faults, can result in messages being exchanged between trains. This inadvertent communication is defined as crosstalk. Crosstalk can result in loss of trainline power and communications between ECP braking devices on the train.
Crosstalk likelihood is reduced by minimising hardware fault conditions. Further, the effects of crosstalk are mitigated by software that enables ECP braking devices to establish a logical connection with the HEU on their train and filter out messages originating from other trains. To obtain the benefits of this crosstalk mitigation software, it must be installed on all locomotives, wagons and EOTs.
If both trainline power and communications are lost, such as might occur with crosstalk, the CCDs enter a timed shutdown process to conserve battery power. If emergency pneumatic brakes are applied, the CCDs shut down after 2 minutes. If emergency pneumatic brakes are not applied, the CCDs shut down after 60 minutes.
CCDs can be implemented as either “overlay” or “standalone” configuration. Overlay has ECP braking and full pneumatic brake functionality, while standalone has ECP braking and emergency pneumatic brakes only. Standalone ECP braking is typically implemented on unit freight trains, which are trains whose constituent wagons and locomotives stay together as a unit during normal operation. In both configurations, the CCDs are designed to switch over to pneumatic control if they shut down. However, because only emergency pneumatic brakes are available in standalone configuration, if any pneumatic brake other than the emergency pneumatic brakes are applied when CCDs shut down after 60 minutes, the brakes will release and the train can undergo uncontrolled movement.
ONRSR would like to stress to rolling stock operators that freight trains equipped with standalone ECP braking must be secured by applying emergency pneumatic brakes by moving the automatic brake handle into the emergency position when ECP braking is ended, experiences unwanted shutdown or trainline cable continuity is lost.
On ECP braking designed to Association of American Railroads (AAR) standard S-4200, an ECP braking emergency application does not apply emergency pneumatic brakes. Australian custom rollaway protection software introduced a feature where an ECP braking emergency automatically applies emergency pneumatic brakes. But this feature does not work under all conditions, for example it will not work if the HEU changes to “Trail” due to crosstalk. Further, the assortment of two different systems in use in Australia might cause a rail safety risk when crews change from one to the other, potentially incorrectly expecting an ECP braking emergency to equate to a pneumatic emergency. So, regardless of whether rollaway protection software is implemented, emergency pneumatic brakes must be applied by moving the automatic brake handle into the emergency position.
Key documents and actions Rolling stock operators should:
- Ensure that change management and risk management around ECP braking have fully identified and controlled all hazards, including those associated with engineering design, construction, operation and maintenance of ECP hardware and software.
- Review programs, processes and procedures to minimise hardware fault conditions such as trainline ground faults on trains fitted with ECP braking.
- Conduct fleet-wide assessments to identify and rectify rolling stock and EOT devices that do not have crosstalk mitigation software installed. Equipment without the software should be by-passed or not used until rectified.
- RTOs should collaborate with each other and engage ECP braking manufacturers to:
- Reduce the likelihood of crosstalk, and to mitigate its effects by ensuring that crosstalk mitigation software is installed on all locomotives, wagons and EOT devices operated on their networks
- Improve engineering controls of uncontrolled movements due to CCD shutdown without effective switch over to pneumatic brake backup
- Bring to crews’ conscious awareness that:
- Pneumatic brakes must always be applied as the failsafe fallback should ECP braking shut down.
- On standalone configurations of ECP braking, such as is common on unit trains, emergency pneumatic brakes must be applied to activate the failsafe fallback by moving the automatic brake handle into the emergency position.
- Emergency pneumatic brakes must be applied by moving the automatic brake handle into the emergency position regardless of whether the ECP braking system has rollaway protection software or not.
- Update and refresh training and procedures to support crew and maintenance staff competency in safe ECP braking train operation, including management of faults, degraded modes and shutdowns, and securing of trains.
- Place adequate emphasis on, and assurance of, critical ECP braking-related procedural controls commensurate with their importance. Ensure that crews who are required to implement these procedural controls clearly understand why the specified actions are required. Critical procedures communicate safety-critical tasks that must be fully actioned by crews responding to atypical or unexpected situations. Crews must therefore ensure they take sufficient time to methodically perform and verify the effectiveness of each required action.