Signal box failure - theoretical question

[tygar2]

Hello all

I need to pick your brains with this theortical scenerio. If any real life references exist, rule book modules or RSSB documents exit that would be amazing.

Imagine an IECC or ROC type signalbox - i.e whole route is controlled from one location - suffers a catastrophic system failure (power failure, computer crash, panel caught fire etc).
This fault shuts down the whole signalling system down meaning the signalbox is offline and unable to control it's signals, which have reverted back to danger, and multiple trains area stuck on the route.

Add to it that the fault so so severe that trains have been at a stand for an extended period of time (over 6hrs for example) and basically no chance of a quick repair.


My understanding is that normally trains would be stuck until the fault is rectified and I also know signalboxes have backups and failsafes. However I was wondering if there is a contingency method of last resort? Perhaps a manual method to get trains off the line? Is there anyway those stuck trains can be moved to a station/suitable location for evacuation with the signalbox out of action?

You can assume communication via mobile phone is still possible.

Hope that all makes sense and I await you thoughts.

thanks

 

[Tio Terry]

It's possible that the use of GSM-R could be used to instruct the movement of trains in such extreme situations. But the back-up systems for ROC's are so good I really can't see it happening. Remember, public GSM does not necessarily cover all railway sites.

 

[mr_moo]

On plain line you can allow trains to move forwards under caution so they could bunch up towards reasonable places to de-train passengers, such as LCs.

Signals on plain line sections are plated as 'passable' or 'non-passable' for this very purpose. If a signal is 'passable', a driver who is held for a long period and is unable to contact the controlling signal box is allowed to pass the signal under their own authority and proceed at (usually extreme!) caution, being prepared to stop short of any obstruction.

A non-passable signal, so one at an LC, or on the approach to junctions etc will be the place the bunch-ups happen, as the train simply has to wait regardless as there is a danger there so it would be unsafe to allow the train to proceed by itself.

In reality, these rules are almost never actually used as backups and comms systems are now so good that they are pretty much pointless. Even if such a failure did happen, the drivers would get individual instructions via GSM-R to proceed to various places for de-training or passengers and parking up out the way.

Note that if the signalling failure were as you describe, the signaller would not be able to see what any of the points were doing either, so trains would not be able to pass over any points unless they were manually clipped. This would be done for a small number of key areas but most would not be - it takes people and time!

Also, in theory, as part of the strategy for migration to ROCs, the ROCs have the ability to take over from each other too, so if one were to go down, another could take control. Naturally, this would still have huge delays as there would not be enough staff, but it would allow some level of service to be provided, depending on where the failure was.

 

[MichaelAMW]

Signals on plain line sections are plated as 'passable' or 'non-passable' for this very purpose. If a signal is 'passable', a driver who is held for a long period and is unable to contact the controlling signal box is allowed to pass the signal under their own authority and proceed at (usually extreme!) caution, being prepared to stop short of any obstruction.

In practice there are very few of these, however, and probably none in the situation you are considering.

 

[carriageline]

Passable/non passable signals don't exist anymore, in the sense that new schemes won't have them.

To the OP. Response staff would go out and manually man crossings and points. And using things like pen, paper and magnets trains could very slowly be moved on. Although it's not something I would want to be involved in!


Sent from my iPhone using Tapatalk

 

[mr_moo]

Agreed - they are becoming less and less important now so the focus on passable/non-passable is diminishing, together with their numbers, but also the number of reasons why a signal would be non-passable has increased over time too.

 

[Llanigraham]

Also, in theory, as part of the strategy for migration to ROCs, the ROCs have the ability to take over from each other too, so if one were to go down, another could take control. Naturally, this would still have huge delays as there would not be enough staff, but it would allow some level of service to be provided, depending on where the failure was.

Theory only. It cannot be done in practice.

 

[Bald Rick]

Theory only. It cannot be done in practice.

Not even in theory. Plans to have ROCs backing each other up were dropped at least 7 years ago.

OP - this (very) occasionally happens, and has done since signalboxes started to turn to electricity. In simple terms voice communications are used to identify train locations and move them to a place where passengers can be safely disembarked.

In the event of a complete power failure of a wide area with no prospect of quick restoration, detraining would typically start within an hour for trains at stations, and within two hours for trains not at a station.

 

[ComUtoR]

I've never heard of a passable/non passable plate. Does anyone have a picture of one please ?

I understand that on ERTMS you have N and P boards.

If the box was closed (and I could prove it) and the points were set for my movement.....

 

[LAX54]

On plain line you can allow trains to move forwards under caution so they could bunch up towards reasonable places to de-train passengers, such as LCs.

Signals on plain line sections are plated as 'passable' or 'non-passable' for this very purpose. If a signal is 'passable', a driver who is held for a long period and is unable to contact the controlling signal box is allowed to pass the signal under their own authority and proceed at (usually extreme!) caution, being prepared to stop short of any obstruction.

A non-passable signal, so one at an LC, or on the approach to junctions etc will be the place the bunch-ups happen, as the train simply has to wait regardless as there is a danger there so it would be unsafe to allow the train to proceed by itself.

In reality, these rules are almost never actually used as backups and comms systems are now so good that they are pretty much pointless. Even if such a failure did happen, the drivers would get individual instructions via GSM-R to proceed to various places for de-training or passengers and parking up out the way.

Note that if the signalling failure were as you describe, the signaller would not be able to see what any of the points were doing either, so trains would not be able to pass over any points unless they were manually clipped. This would be done for a small number of key areas but most would not be - it takes people and time!

Also, in theory, as part of the strategy for migration to ROCs, the ROCs have the ability to take over from each other too, so if one were to go down, another could take control. Naturally, this would still have huge delays as there would not be enough staff, but it would allow some level of service to be provided, depending on where the failure was.

We still have Autos, but trains are not allowed to pass those anymore without authorisation from Signaller, and has been said a ROC controlling another area, was not thought through correctly, and would never be allowed at happen.

 

[edwin_m]

I've never heard of a passable/non passable plate. Does anyone have a picture of one please ?

I understand that on ERTMS you have N and P boards.

If the box was closed (and I could prove it) and the points were set for my movement.....

Commonly known as an auto plate - white rectangle with horizontal black line. Generally it denotes that the signal works automatically but the strict purpose in the rules is to indicate to drivers that they can pass it if they are unable to contact the signaller by any means.

 

[ComUtoR]

Commonly known as an auto plate - white rectangle with horizontal black line. Generally it denotes that the signal works automatically but the strict purpose in the rules is to indicate to drivers that they can pass it if they are unable to contact the signaller by any means.

When I could pass an auto I could also pass a semi, controlled, and an intermediate block home. All were passable.

 

[bengley]

We still have Autos, but trains are not allowed to pass those anymore without authorisation from Signaller, and has been said a ROC controlling another area, was not thought through correctly, and would never be allowed at happen.

The rule book still implies that we can pass these if the box is closed. Surely if the box is on fire and the staff are all outside at the assembly point, it's closed!?

 

[222001]

Very nearly happened at the EMCC. They had a power failure and the backup power supply also failed. They had around 30 minutes of battery power left, and started to bring trains to a stop in stations. Power was restored just before they lost power completely.

 

[GB]

The rule book still implies that we can pass these if the box is closed. Surely if the box is on fire and the staff are all outside at the assembly point, it's closed!?

I don't think there has been any sort of official definition of what "closed" actually is.

 

[lincolnshire]

Seems to be problems now with signalling supply after a power cut at Doncaster PSB . ( 24/03/17 @ 10-00). What happened to the standby generators then? failure to start?

Did some body want to see what happens in real life then?

 

[Railsigns]

I understand that on ERTMS you have N and P boards.

TVM430 has N and P boards. ERTMS has neither (all block markers are treated as non-passable).

 

[pompeyfan]

I had one one evening where we were bought to a hold in a station with a red on the front, after about 10 minutes I managed to get hold of our control team who said the PSB had been completely evacuated due to smoke alarm and we'd be there for a while. 90 minutes later without any warning the signal pulled off and we were on our way, I'm just grateful we had a platform even if it wasn't one of my depots calls.

 

[Llanigraham]

Very nearly happened at the EMCC. They had a power failure and the backup power supply also failed. They had around 30 minutes of battery power left, and started to bring trains to a stop in stations. Power was restored just before they lost power completely.

Same thing has happened at SWCC (Cardiff) and I seem to remember Machynlleth losing all power and closing the Cambrian down completely.

 

[Llanigraham]

TVM430 has N and P boards. ERTMS has neither (all block markers are treated as non-passable).

My understanding is that there is no Movement Order input the train can't move.
Unfortunately my Machy contact is on holiday.

 

[tcm1106]

Hello all



I need to pick your brains with this theortical scenerio. If any real life references exist, rule book modules or RSSB documents exit that would be amazing.



Imagine an IECC or ROC type signalbox - i.e whole route is controlled from one location - suffers a catastrophic system failure (power failure, computer crash, panel caught fire etc).

This fault shuts down the whole signalling system down meaning the signalbox is offline and unable to control it's signals, which have reverted back to danger, and multiple trains area stuck on the route.



Add to it that the fault so so severe that trains have been at a stand for an extended period of time (over 6hrs for example) and basically no chance of a quick repair.





My understanding is that normally trains would be stuck until the fault is rectified and I also know signalboxes have backups and failsafes. However I was wondering if there is a contingency method of last resort? Perhaps a manual method to get trains off the line? Is there anyway those stuck trains can be moved to a station/suitable location for evacuation with the signalbox out of action?



You can assume communication via mobile phone is still possible.



Hope that all makes sense and I await you thoughts.



thanks

Temporary Block Working.

 

[tygar2]

We still have Autos, but trains are not allowed to pass those anymore without authorisation from Signaller, and has been said a ROC controlling another area, was not thought through correctly, and would never be allowed at happen.

That's my understanding too. Driver's used to be able to pass automatic signals at danger under own authority under certain circumstances but, as far as I know, no signal can be passed at danger without authority anymore. Module S5 seems to confirm this.

 

[455driver]

On plain line you can allow trains to move forwards under caution so they could bunch up towards reasonable places to de-train passengers, such as LCs.

Signals on plain line sections are plated as 'passable' or 'non-passable' for this very purpose. If a signal is 'passable', a driver who is held for a long period and is unable to contact the controlling signal box is allowed to pass the signal under their own authority and proceed at (usually extreme!) caution, being prepared to stop short of any obstruction.

A non-passable signal, so one at an LC, or on the approach to junctions etc will be the place the bunch-ups happen, as the train simply has to wait regardless as there is a danger there so it would be unsafe to allow the train to proceed by itself.

In reality, these rules are almost never actually used as backups and comms systems are now so good that they are pretty much pointless. Even if such a failure did happen, the drivers would get individual instructions via GSM-R to proceed to various places for de-training or passengers and parking up out the way.

Note that if the signalling failure were as you describe, the signaller would not be able to see what any of the points were doing either, so trains would not be able to pass over any points unless they were manually clipped. This would be done for a small number of key areas but most would not be - it takes people and time!

Also, in theory, as part of the strategy for migration to ROCs, the ROCs have the ability to take over from each other too, so if one were to go down, another could take control. Naturally, this would still have huge delays as there would not be enough staff, but it would allow some level of service to be provided, depending on where the failure was.

Eh?
What are you on about 'passable or non passabe'?

Easy answer is that you sit there until help arrives.

Signed A train driver fully conversant with the rule book!

 

[tygar2]

Temporary Block Working.

Hmmm...good one. Food for thought.

Would it would be feasible though if there is a high number of stranded trains along affected route since temporary block working still requires one train in the block at any one time. Would this not mean a new TBW section (and associated paperwork plus handsignallers) are required between each train?

Reminds me of Emergency Special Working....

 

[tygar2]

Eh?
What are you on about 'passable or non passabe'?

Easy answer is that you sit there until help arrives.

Signed A train driver fully conversant with the rule book!

Yup, I believe you're a driver..."sod them...not my problem"

I'm sure after 6hrs sitting in the middle of nowhere, with pass comms going off, you'll be more open to other solutions.

What I'm trying to figure out is what this help would be able to do with a signalbox out of action.

 

[MichaelAMW]

That's my understanding too. Driver's used to be able to pass automatic signals at danger under own authority under certain circumstances but, as far as I know, no signal can be passed at danger without authority anymore. Module S5 seems to confirm this.

No it doesn't. Intermediate block signals, and signals controlled from a signal box that has been confirmed to be closed may be passed under the driver's own authority. In practice, I am guessing, with almost universal train radio coverage and mobile phones everywhere, it's unlikely you'd ever be completely stranded without communication, even if you have to walk a bit to make contact.

 

[tsr]

Drivers at TOC [X] in my area are, as I understand it, completely forbidden from passing any signal at danger under their own authority. In practice, if a signal box was closed but not immediately visible in the vicinity of the train (very likely!), the only indication from a train cab would often simply be that they weren't picking up the phone and no trains were moving, which could equally be an indication that they were extremely busy with any number of other types of incident, and therefore too much of an assumption to make.

Recently I was on a train where the signal ahead was dropped from green to red, the signaller simultaneously made an emergency broadcast to stop all trains on that line of route, and then the GSM-R radio link to the signal box failed. At no point did any of the staff onboard wonder automatically if the signal box was therefore to be considered closed. It's rare for modern boxes to be put out of action without any explicit advice to specifically say so, and if they are, you'd likely be stood for some time trying to work out the safest method of onward movement.

Should there be no foreseeable chance of getting assistance or advice from the relevant controlling signaller, the correct method of intervention may well be a controlled evacuation. At my place this is described as a method of working to be used when detraining to the trackside is the safest and most direct way for passengers to complete their journey - in other words, if it isn't an emergency evacuation (train deemed immediately uninhabitable) you only escort them from the train when walking down the ballast will be the quickest and most secure way to get people on the move, which is not terribly common.

Performing a controlled evacuation can, theoretically, be done by the train crew alone, though you would usually request support from as many competent people as can be deployed. The crew do have to consider how to minimise hazards from moving trains and other issues around the trackside, such as the third rail / overhead lines. Electrical supplies would be dealt with by an Electrical Control [Room] Operator (EC[R]O) who should be reachable separately from the signaller, and may even be able to confirm the signaller's absence, so that's not the worst issue at play here. Rather, especially in an area with axle counters rather than track circuits (which can be clipped and thus occupied), the main issue may well be getting confirmation that no traffic will pass on an adjacent line. Detonator protection might be the only option, once you are sure that there is no way to contact the signaller and that this is the maximum protection possible in the unlikely event that train services do suddenly resume.

All this is assuming that trains are stranded away from platforms, they are no longer bearable environments, that the signal box evacuation takes place for (realistically) more than 1-2 hours, and that services couldn't be halted in platforms first. Some of the busier areas of the country do have the problem that bunched-up trains may be more numerous than platforms available on each given line, but on the other hand, those areas are probably more likely to have seen investment which allows state-of-the art systems permitting signallers to shut down the service for a longer period of time before evacuating their box.

The last time (and possibly the only time) a full real-life evacuation of ROC signallers started to take place, which was a few months ago at Three Bridges and mentioned on these forums at the time, the incident was brief, occurred during the close of service and there were relatively few services out and about. Most managed to get to serviceable platforms and none were stranded in especially isolated areas. Information provision was also quite good from the TOCs concerned. Had this occurred in peak time, it would have been far worse, and the most major risk would probably have been from people attempting uncontrolled evacuations, which might only have been able to have been mitigated by the ECRO and train crew.

 

[tygar2]

No it doesn't. Intermediate block signals, and signals controlled from a signal box that has been confirmed to be closed may be passed under the driver's own authority. In practice, I am guessing, with almost universal train radio coverage and mobile phones everywhere, it's unlikely you'd ever be completely stranded without communication, even if you have to walk a bit to make contact.

My mistake. I should have clarified that I meant that in the context of IECC and ROC type signal boxes which are never closed and can be located very far away.

Actually, would a power failure or fire classify as a signal box as being closed?

 

[tygar2]

I don't think there has been any sort of official definition of what "closed" actually is.

That's the get out of jail card right there!

 

[455driver]

Yup, I believe you're a driver..."sod them...not my problem"

I'm sure after 6hrs sitting in the middle of nowhere, with pass comms going off, you'll be more open to other solutions.

What I'm trying to figure out is what this help would be able to do with a signalbox out of action.

When was the last time a load of trains got stuck for 6 hours?
Its hardly 'real world' is it!

After six hours I would be leaving the train!