The 'Unix philosophy' works just as well where there is hardware involved - you might need a converter box to provide the interface between the hardware and software. As long as the converter is properly specified and well built, the hardware won't 'know' about any changes upstream, and new hardware comes with an update to the converter box so the software doesn't need to 'know' about any downstream changes. And testing is limited to ensuring that the new converter box behaves like the old one.
-
Our new ticketing site is now live! Using either this or the original site (both powered by TrainSplit) helps support the running of the forum with every ticket purchase! Find out more and ask any questions/give us feedback in this thread!
Signal box failure - theoretical question
- Thread starter tygar2
- Start date
- Status
Sponsor Post - registered members do not see these adverts; click here to register, or click here to log in
R
RailUK Forums
Llanigraham
On Moderation
It is fine stating that the computer side of it can be "linked" safely, but this doesn't take into account all the other elements that the panels control, from CCTV controlled crossings to telephones at User Worked Crossings.
Plus it doesn't take into account there there needs to be signallers signed competent to use the Panel at the remote station.
Plus it doesn't take into account there there needs to be signallers signed competent to use the Panel at the remote station.
I can't see any technical reason that can't be linked in as well. CCTV is increasingly using digital transmission and voice has been PCM for donkey's years. Is there a specific technical reason that these need to be wire transmission? I can see continuity proving being an issue, but surely watchdog timers could take care of that?
I'll say it again (for the fourth or fifth time): I acknowledge and understand that there are staffing and logistical reasons why it doesn't happen. I'm simply interested in the technological side of things.
Llanigraham
On Moderation
I suppose that CCTV possibly could be linked, but I think that the telephone side would cause a problem, since the calls either come through to a concentrator that has a separate button for each crossing or phone, or a display for each phone. And there can be a lot of them!!
Plus you often need local knowledge of that crossing's "foibles".
The panel knowledge issue is immutable so this is all theoretical, but if that limitation did not exist, the following infrastructure would work:
Two permanent links from each signalling installation to regionally-separate interlocking centres — one primary, one secondary. If the primary goes down, the secondary takes over.
In said datacentres, panels for every area in the 'digital railway' run in permanent configurations, on a platform of commercial off-the-shelf VDI (virtual desktop infrastructure) servers, with standard enterprise redundancy. These panels would support route displays, CCTV video feeds, and any arbitrary number of voice lines — and even a GSM-R concentrator so that all of a signaller's needs are present and integrated. This entire installation would be exhaustively tested to current standards.
Entirely separate from this, operations centres would comprise of VDI clients to connect to the proven panels (plus each's associated facilities) — but these would only need to relay the already proven-and-tested information back and forth, with encryption and error checking built-in to the link.
At that point it might be cost-effective to maintain multiple operations centres, with some not normally used and just fulfilling the role of 'hot spare'. Large organisations already retain the services of companies specialising in providing and maintaining such office space for thousands of users, which will hopefully never be needed in earnest.
Two permanent links from each signalling installation to regionally-separate interlocking centres — one primary, one secondary. If the primary goes down, the secondary takes over.
In said datacentres, panels for every area in the 'digital railway' run in permanent configurations, on a platform of commercial off-the-shelf VDI (virtual desktop infrastructure) servers, with standard enterprise redundancy. These panels would support route displays, CCTV video feeds, and any arbitrary number of voice lines — and even a GSM-R concentrator so that all of a signaller's needs are present and integrated. This entire installation would be exhaustively tested to current standards.
Entirely separate from this, operations centres would comprise of VDI clients to connect to the proven panels (plus each's associated facilities) — but these would only need to relay the already proven-and-tested information back and forth, with encryption and error checking built-in to the link.
At that point it might be cost-effective to maintain multiple operations centres, with some not normally used and just fulfilling the role of 'hot spare'. Large organisations already retain the services of companies specialising in providing and maintaining such office space for thousands of users, which will hopefully never be needed in earnest.
I'd say that it's the other way around! The 'concentrator' on the more recent schemes that I've seen is a sort of touchscreen interface rather than a conventional concentrator with physical push buttons. I don't know, technically speaking, whether that could easily be replicated elsewhere (especially given the safety-critical nature and the huge risk from 'crossed lines' or other confusion.
CCTV crossings, on the other hand, nearly always seem to have a dedicated monitor and push-button controls on a little panel for each crossing. I have seen photos of crossing controls incorporated into the main workstation views, but only on one installation. I guess that it might be a human factors thing - crossing controls shown at a variable location on the workstation views (depending on which overview/detailed views are shown on which screens) possibly combined with CCTV views shown on one of a pool of common monitors might lead to a greatly increased risk of a 'crossing clear' being given in error (Signalman looking at the wrong crossing!), especially on those workstations with a large number of busy crossings which, with everything else in ARS, make up the bulk of the workload.
Is there a specific technical reason that these need to be wire transmission? I can see continuity proving being an issue, but surely watchdog timers could take care of that?
One of the problems with digital transmission of CCTV is Frame Freeze. Digital systems will continue to display the last frame transmitted in the event of link failure. As I'm sure you will realise, this could result in the signaller seeing a "clear" crossing when it isn't. With wired systems this is much easier to detect than with radio based systems.
In terms of telecommunications systems for things like SPT's and Lineside telephony like crossing phones, it is possible to switch these between control desks - Liverpool St has this for the Liverpool St desk. But to do it on a national scale would require the networking of all the ROC Concentrator systems. Technically possible but I'm not aware of any plans to implement it. If you accept that in an emergency all train to signaller communication is via GSM-R it is technically possible but would require some reconfigeration of the GSM-R system that would take some time, it's not designed to be able to do it.
For signalling systems, the safety element is contained within the local interlocking. If control was re-routed to a different terminal - it's only a data circuit between the control terminal and the interlocking that might well pass over BT as well as NR infrastructure - the interlocking would reject any messages that were not safe to implement. Modern telecommunications systems have an automatic reroute system incorporated in them, the user will never know it the data circuit has automatically been rerouted so the end to end testing argument is invalid.
One of the problems with digital transmission of CCTV is Frame Freeze. Digital systems will continue to display the last frame transmitted in the event of link failure. As I'm sure you will realise, this could result in the signaller seeing a "clear" crossing when it isn't. With wired systems this is much easier to detect than with radio based systems.
In terms of telecommunications systems for things like SPT's and Lineside telephony like crossing phones, it is possible to switch these between control desks - Liverpool St has this for the Liverpool St desk. But to do it on a national scale would require the networking of all the ROC Concentrator systems. Technically possible but I'm not aware of any plans to implement it. If you accept that in an emergency all train to signaller communication is via GSM-R it is technically possible but would require some reconfigeration of the GSM-R system that would take some time, it's not designed to be able to do it.
For signalling systems, the safety element is contained within the local interlocking. If control was re-routed to a different terminal - it's only a data circuit between the control terminal and the interlocking that might well pass over BT as well as NR infrastructure - the interlocking would reject any messages that were not safe to implement. Modern telecommunications systems have an automatic reroute system incorporated in them, the user will never know it the data circuit has automatically been rerouted so the end to end testing argument is invalid.
I can see the problem there, but that's not hard to mitigate against. Not all video systems continue to display the last valid frame.
Well, if the public would accept a Signalman who was rusty with the area, out of date on SBI's / local instructions, ( have to dispense with the 6 month regulation) and also for CCTV crossings to be closed for the duration, and UWC being unanswered, and a worksation being fired up after not working for a year or so, with no testing, then yes it can be done! Oh and the ROC's will need to be doubled in size at least !
Arrrghhh!!!! We get that staff knowledge is a major issue. However, they invented something called 'a bus' and 'hotel rooms' a while back so it's not a show-stopper in and unto itself.
And ROCs wouldn't have to be twice the size, if it was technically feasible to replicate workstations then there could be one backup ROC, or even a 'ROC in a box' mobile solution.
What I'm interested in is the technical roadblocks. If there are solutions for all of them, then it would be time to raise logistical blocks - the logistics don't matter if it's not possible from a technological standpoint.
I like that idea!
I think this thread proves that such a system would have to be designed, deployed, and activated completely independently of the systems it replaces. There's too much "it can't be done because we haven't ever done it" thinking baked into the current design & culture.
That's not an insult, since it has provided an incredibly fail-safe, reliable, and mistake-resistant platform. However, it could be too far along the certainty/innovation spectrum, and be causing inefficiency and/or blocking positive change for example: a signaller on a bad day, facing a lot of pressure, would probably have an easier time answering calls on a single clearly-marked on-screen call display that handles all incoming lines to that panel, rather than dealing with umpteen physical handsets ringing throughout the day.
Sunset route
Established Member
- Joined
- 27 Oct 2015
- Messages
- 1,200
Sounds like your formulating, now just have to make sure all the control desks are the same and from the same manufacturer, we can't have any of this this mix anymore, Westcad, IECC(scalable), MSC, VICOS, Ansaldo STS and the various TMS workstions, all of them offering slightly different MMIs, there is going to have to be one national standard for this to work.
But whether it's technically feasible or not, we are no where near the ROCs controlling the vast majority or the country, in fact two have still to control any signalling at all. Most of the country is still in the hands of the old IECCs, SCCs, PSBs and ASCs. In the five years since the ROC plan was released, my ASC should be half closed by now but instead we are still expanding and adding new panels.
There's three ways to deal with this kind of situation (assuming you want to avoid the price rises that come with vendor lock-in), in increasing order of preference: buy *way* more than you need and stockpile the parts, design a custom interface spec and allow vendors to build to the standard (the issue with this is vendors sometimes have different ideas of what 'compliant' means where standards are concerned) or use off-the-shelf hardware and do all the 'fancy' stuff in software.
tygar2
Member
- Joined
- 28 Nov 2009
- Messages
- 39
So my trains are still stuck in the middle of nowhere
and from the discussion it seems technical hurdles prevent transfer of control to another signal box.The closest to an answer seems to be Temporary Block Working but I'm a bit unsure so maybe someone could help clarify the following;
- If a signal box is out of action/evacuated (signaller out of the loop) can temporary block working be introduced or is it only where the signals have failed but everything is fine at the signal box end and needs a signaller in control?
- Can temporary block working be introduced where multiple trains are already stuck within the proposed block section (i.e between 2 stations)?
Thanks
Llanigraham
On Moderation
It is if the staff refuse to travel what could be 100 miles, and to stay away. And would NR be willing to pay for them to be away from home?
But one panel could not do 2 jobs. Therefore there would have to be enough panels for all the jobs needed.
And I don't think you will ever get an answer to that.
Sunset route
Established Member
- Joined
- 27 Oct 2015
- Messages
- 1,200
So my trains are still stuck in the middle of nowhere
The closest to an answer seems to be Temporary Block Working but I'm a bit unsure so maybe someone could help clarify the following;
- If a signal box is out of action/evacuated (signaller out of the loop) can temporary block working be introduced or is it only where the signals have failed but everything is fine at the signal box end and needs a signaller in control?
- Can temporary block working be introduced where multiple trains are already stuck within the proposed block section (i.e between 2 stations)?
Thanks
Temporary Block Working would not be particle for a couple of reasons,
One, a signaller needs to be charge.
Two, you would never find enough staff to Man the multiple sections that would be required to run more than one train.
Three, it is incredibly comms intensive even for just breaking two lines into two sections let alone a ROCs worth of railway.
Four, all points need to be secured and left that way, so your gong to have to decide which route you're only going to run.
All trains would need to be clear of sections where you hope to start temporary block working.
tygar2
Member
- Joined
- 28 Nov 2009
- Messages
- 39
Thanks, that's very helpful.
Point 1 alone kills the whole idea. The rest just ensure that coffin is secure.
Back to the drawing board....
Sent from my SM-G935F using Tapatalk
axlecounter
Member
I've read somewhere that the 4 Swiss control centres can -theoretically- do what is being discussed here, but I can't find a useful link.
edwin_m
Veteran Member
Can't the Channel Tunnel switch control between the UK and French sides quickly if it needs to?
Sunset route
Established Member
- Joined
- 27 Oct 2015
- Messages
- 1,200
Yes, built with duplicate control centres.
Sunset route
Established Member
- Joined
- 27 Oct 2015
- Messages
- 1,200
Over the years as a signalman/ler, I've had (train describer) TD failure, (time division multiplexing) TDM indication failure, TDM control failure, TDM inducation & control failure, loss of (remote control) RC, (frequency division multiplexing) FDM failure, Smartlock failure and unable to reboot, loss of demotic power supply and back up to both relay rooms and my signalling centre, multiple lightning strikes around (computer based interlockings) CBIs and a Second stage fire alarms with complete evacuation.
In most of those cases your talking no train service or a very reduced train service. Anything that envolves talking passed multiple signals requires Temporary Block Working and on a multiple track mainline split into several sections will require plenty of staff and the means to communicate with them. The signallers workload for TBW is high and in my opinion having worked them all multiple times it's a higher workload than either Single Line Working SLW or Pilotman Working.
At the end of the day, no comms either verbal signaller to train drivers, response staff, or data for the signalling systems then no train moves.
We've used post it notes when our train describer has failed while controlling around 70miles of main line through 8 signalling panels with 12 fringe boxes to deal with and that's fun (not) but it works just about. One of the biggest problems is the cab radios won't set up unless the TD works so the primary comms link to drivers is out and they don't like using (signal post telephones) SPTs anymore, as it means leaving their nice warm cabs lol
Cheers for the reply. I was thinking more on the lines of a less technical solution. Everyone is looking for big technical solutions. Whatever happened to going back to pen/paper and old fashioned leg work.
No TD still means I can run my unit. If I got GSMR GB then game on from my end.
Whatever happened to trains before the days of radios.
I was informed, by a Signaller no less, that the GSMR is basically a laptop terminal and could be transferred easily. I assume he is wrong then ?
I used an SPT the other week because my GSMR wasn't working as intended. When I have a train fault the Sig. usually asks for my mobile number. For a GSMR fault he asked me to use the SPT. (which was equally poor) Deities help us when all SPTs are finally gone.
BTW some SPTs are quite disgusting and covered in green slime.
No TD still means I can run my unit. If I got GSMR GB then game on from my end.
Whatever happened to trains before the days of radios.
I was informed, by a Signaller no less, that the GSMR is basically a laptop terminal and could be transferred easily. I assume he is wrong then ?
I used an SPT the other week because my GSMR wasn't working as intended. When I have a train fault the Sig. usually asks for my mobile number. For a GSMR fault he asked me to use the SPT. (which was equally poor) Deities help us when all SPTs are finally gone.
BTW some SPTs are quite disgusting and covered in green slime.
tygar2
Member
- Joined
- 28 Nov 2009
- Messages
- 39
Cheers for the reply. I was thinking more on the lines of a less technical solution.
Whatever happened to going back to pen/paper and old fashioned leg work.
Whatever happened to trains before the days of radios.
I'm curious to know how the pen and paper solution works and how that could be implemented if a modern signal box went down.
Pen + Paper
But you know, colloquial language and all that. :roll: Maybe old fashioned legwork means get out a bike and hook it up to a dynamo to power the box. :roll:
tygar2
Member
- Joined
- 28 Nov 2009
- Messages
- 39
What I was actually hoping for was a run through of how the pen and paper method actually works when the panels are down and the signaller cannot "see" the trains the location of the trains under his control.
Hoping the signaller who experienced it will see and be kind enough to share.
I am more stunned by the sheer amount of automation and technical requirements to run a train. The more we put on, the more it breaks and the more constrained we are to fix it. Before all this magic and wizardry there must have been a way to run trains. I was thinking, in general terms, Handsignaller + hand held radio/mobile phone could at least clear some trains.
We can already pass the signal at danger if the points are set so I do wonder how far you could get before the system totally constrained you.
I watched a film recently with Air traffic Controllers resorting to pen and paper to coordinate airplanes. I'm aware much is fantasy but there must be an element of truth to it. I wonder if the railway could do something similar or how it was done 'historically'
I came in with CSR, passing signals and still ran under AB and local boxes.
Now its all track circuits and ROC's the second the system breaks then the whole job stops.
Theorycrafting aside, I'd love to know what is actually possible. If I was stuck at Waterloo East. Could I still get into Cross if the points were set and the Signaller called me on my mobile to authorise me ?
We can already pass the signal at danger if the points are set so I do wonder how far you could get before the system totally constrained you.
I watched a film recently with Air traffic Controllers resorting to pen and paper to coordinate airplanes. I'm aware much is fantasy but there must be an element of truth to it. I wonder if the railway could do something similar or how it was done 'historically'
I came in with CSR, passing signals and still ran under AB and local boxes.
Now its all track circuits and ROC's the second the system breaks then the whole job stops.
Theorycrafting aside, I'd love to know what is actually possible. If I was stuck at Waterloo East. Could I still get into Cross if the points were set and the Signaller called me on my mobile to authorise me ?
It depends what's failed, really.
What I was actually hoping for was a run through of how the pen and paper method actually works when the panels are down and the signaller cannot "see" the trains the location of the trains under his control.
Hoping the signaller who experienced it will see and be kind enough to share.
If it's just the TD that's gone, the biggest problem will be identifying trains on the panel. 'Pen and paper' will be used, probably post-it notes or similar, to help keep track of everything, correlating the pretty red lights on the panel to reporting numbers. Obviously that, and the process of keeping it updated, represents a large increase in workload on its own.
If all indications have been lost too, the bigger problem is that you don't know where trains are or the state of points. You can't really do much, bar working out exactly where each train is and authorising some to pass signals at danger along plain line, without staff on the ground at each junction/crossover/whatever to clip up points and/or wind them to the signalman's instructions. Clearly very little will be achieved in the short term, and even after that it won't be possible to run much because it's going to take ages to set up for each move, and the signalman's workload will now be immense.
If everyone's standing out in the car park watching the ROC burn down, even that isn't possible because there's no way of contacting the signalman who, in turn, has absolutely nothing in front of him to help keep track of things. The best that can be hoped for, if the problem's going to persist for a long time, is to get signalmen set up with some sort of temporary workstation from where they can communicate with their handsignalmen, route-setting agents etc at key junctions and use temporary block working in between. Good luck finding the staff to set that lot up!
The aforementioned ROC-in-a-Box.
- Status