Colin Dennis CEng, FIMechE, FSaRS
Automating train protection a bit of history TPWS how it works Has it been successful? Pitfalls Design solutions Key design lessons when automating functions Conclusions
From start of railways to early 2000 s trains controlled only by the driver Signals Passed at Danger (SPADS) a significant cause of accidents: Purley March 1989 5 fatalities Bellgrove Junction March 1989 2 fatalities Newton July 1991 4 fatalities Cowden October 1994 5 fatalities Watford Junction August 1996 1 fatality Southall September 1997 7 fatalities Ladbroke Grove October 1999 31 fatalities
Source: RSSB
Another notable signal related accident was at Clapham Junction December 1988 35 fatalities - but not a SPAD Societal pressure to do something BR keen to implement Automatic Train Protection to monitor train speed and signal status and apply brakes if driver fails to Pilot schemes on Great Western and Chiltern Too expensive > 1bn Cheaper solutions sought
Simple single point speed and signal status monitoring system Applies the brakes automatically if the train is going too fast Would stop the train before the point at which a collision would occur Also used to check speed on approach to speed restrictions at curves and buffer stops
Design principles: Simple as possible Doesn t need to prevent SPADs but should minimise accidents Should reduce SPAD risk by 70% Installation as easy as possible for rapid deployment for maximum risk benefit 10 to 15 year life
Speed 75 mph Conflict point 0-350 -300-250 -200-150 -100-50 0 50 100 150 200 250 300 etres) Overspeed Sensor Train Stop Sensor Distance Source: RSSB Safe Overrun Distance
Scale of fitment: 13000 Signals protecting junctions 650 Buffer stops 1150 Speed restrictions 8000 Train cabs Cost for system-wide fitment: 500m for the infrastructure 50m for the trains Accelerated programme: Installation started in 2001 and finished in 2004
The Driver Machine Interface (DMI) Retrofit DMI out of driver s eye line in many cabs Little human factors/ergonomist input
Society of Automotive Engineers 5 Levels of Automation TPWS sits here
principles:
Source: RSSB
Single point speed monitoring big variety of trains, train brake efficiency and driving styles Lots of TPWS brake demands unwarranted? Combined accept button Indications lost and system reset - 60 seconds Driver continues the journey thinking there is no threat When not spurious following a SPAD could cause an accident Known as Reset & Continue
Design principles: Source: RSSB
TPWS operation not detectable by the signaller Nothing to tell the driver a SPAD had occurred Train brakes apply automatically for a multitude of reasons not easy to diagnose Cab can be shutdown and reset to clear all brake demands Trains with better brake efficiency would stop before the signal leading to potential for driver reliance ie letting TPWS operate
Driver training and refreshers Rule change driver must contact the signaller before starting off again Making use of on-board condition monitoring equipment (where fitted) to detect when TPWS has operated and a reset & Continue has occurred Successful for several Train Operators Driver management if caught resetting and continuing Redesign of the DMI with human factors input
Separate alarms for SPAD and Overspeed Dedicated reset via double button press Voice based alarm messages Brake state memory so cab can t be shutdown to reset
Expensive retrofit about 25m for all trains Not reasonably practicable for most fleets subject to Cost-Benefit Analysis Mandatory for new trains
Design principles: Source: RSSB
Good human factors design principles should be applied even to simple designs Must have human factors/ergonomist involvement the system must be operable under all conditions
Get it right at the design stage Source: RSSB - Taking Safe Decisions Retrofit is very expensive
Design out nuisance alarms Test designs in simulators Analyse the proposed design with users and independent engineers to look for traps and unintended consequences General: Try to maintain operator skill levels to avoid deskilling
Automating train braking through TPWS has been a great success in reducing risk Designs without adequate human factors input can result in unintended consequences from operator confusion, misunderstanding and distraction Spend the time at the design stage retrofit is very expensive Where possible provide monitoring of automatic actions Beware: Short term fixes can become long term solutions!