Colin Dennis CEng, FIMechE, FSaRS

Transcription

1 Colin Dennis CEng, FIMechE, FSaRS

2 Automating train protection a bit of history TPWS how it works Has it been successful? Pitfalls Design solutions Key design lessons when automating functions Conclusions

3 From start of railways to early 2000 s trains controlled only by the driver Signals Passed at Danger (SPADS) a significant cause of accidents: Purley March fatalities Bellgrove Junction March fatalities Newton July fatalities Cowden October fatalities Watford Junction August fatality Southall September fatalities Ladbroke Grove October fatalities

4 Source: RSSB

5 Another notable signal related accident was at Clapham Junction December fatalities - but not a SPAD Societal pressure to do something BR keen to implement Automatic Train Protection to monitor train speed and signal status and apply brakes if driver fails to Pilot schemes on Great Western and Chiltern Too expensive > 1bn Cheaper solutions sought

6 Simple single point speed and signal status monitoring system Applies the brakes automatically if the train is going too fast Would stop the train before the point at which a collision would occur Also used to check speed on approach to speed restrictions at curves and buffer stops

7 Design principles: Simple as possible Doesn t need to prevent SPADs but should minimise accidents Should reduce SPAD risk by 70% Installation as easy as possible for rapid deployment for maximum risk benefit 10 to 15 year life

8

9 Speed 75 mph Conflict point etres) Overspeed Sensor Train Stop Sensor Distance Source: RSSB Safe Overrun Distance

10 Scale of fitment: Signals protecting junctions 650 Buffer stops 1150 Speed restrictions 8000 Train cabs Cost for system-wide fitment: 500m for the infrastructure 50m for the trains Accelerated programme: Installation started in 2001 and finished in 2004

11 The Driver Machine Interface (DMI) Retrofit DMI out of driver s eye line in many cabs Little human factors/ergonomist input

12 Society of Automotive Engineers 5 Levels of Automation TPWS sits here

13 principles:

14 Source: RSSB

15 Single point speed monitoring big variety of trains, train brake efficiency and driving styles Lots of TPWS brake demands unwarranted? Combined accept button Indications lost and system reset - 60 seconds Driver continues the journey thinking there is no threat When not spurious following a SPAD could cause an accident Known as Reset & Continue

16 Design principles: Source: RSSB

17 TPWS operation not detectable by the signaller Nothing to tell the driver a SPAD had occurred Train brakes apply automatically for a multitude of reasons not easy to diagnose Cab can be shutdown and reset to clear all brake demands Trains with better brake efficiency would stop before the signal leading to potential for driver reliance ie letting TPWS operate

18 Driver training and refreshers Rule change driver must contact the signaller before starting off again Making use of on-board condition monitoring equipment (where fitted) to detect when TPWS has operated and a reset & Continue has occurred Successful for several Train Operators Driver management if caught resetting and continuing Redesign of the DMI with human factors input

19 Separate alarms for SPAD and Overspeed Dedicated reset via double button press Voice based alarm messages Brake state memory so cab can t be shutdown to reset

20 Expensive retrofit about 25m for all trains Not reasonably practicable for most fleets subject to Cost-Benefit Analysis Mandatory for new trains

21 Design principles: Source: RSSB

22 Good human factors design principles should be applied even to simple designs Must have human factors/ergonomist involvement the system must be operable under all conditions

23 Get it right at the design stage Source: RSSB - Taking Safe Decisions Retrofit is very expensive

24 Design out nuisance alarms Test designs in simulators Analyse the proposed design with users and independent engineers to look for traps and unintended consequences General: Try to maintain operator skill levels to avoid deskilling

25 Automating train braking through TPWS has been a great success in reducing risk Designs without adequate human factors input can result in unintended consequences from operator confusion, misunderstanding and distraction Spend the time at the design stage retrofit is very expensive Where possible provide monitoring of automatic actions Beware: Short term fixes can become long term solutions!