Do the railways have over-speed detection (not just on approach to signals at danger)

[MarkyT]

Paddington certainly had some separately-detected crossovers, but only some, and only where the crossovers concerned were clear of overlaps. More were added at the recent resignalling. The data for separate-end detection is quite simple.

As long as both ends are in the same interlocking I assume!

 

[Belperpete]

I'm a dinosaur and would rather have a proper relay interlocking any day.

As well as dealing with some of the data, I was also part-responsible for design of the new relay interlocking that was provided as part of the Newcastle resignalling, at Heaton depot. I pushed hard for it too to be an SSI, but unfortunately SSI cubicles were in very short supply (we had already used many more than expected on the North Mainline) so it had to be redone as relay. Afterwards, I think everyone realised that it had been a mistake to do it in relays. It took a LOT of resources.

One of the advantages of SSI is that it can be tested off-line - what is often not so appreciated is that it can be tested off-line in multiple locations, so you can put several principle testing teams to work on it in parallel. Whereas with a relay interlocking, you have only got the one interlocking, so if you have more than one principle testing team working at the same time, they inevitably end up tripping over one another. I seem to recall that, as well as the testers working at Reading, we had several testing teams at York working on Paddington. If Paddington had been relay, the principles testing would have taken significantly longer.

Whether the design time would have been less is debatable. OK, they wouldn't have had the problems that the SSI data preparers did. However, the SSI data preparation was carried out by multiple data preparers working in parallel, one per interlocking, whereas with one big relay interlocking the fundamental interlocking controls at least would all have had to be done by one person.

 

[Belperpete]

As long as both ends are in the same interlocking I assume!

Both ends of a crossover HAVE to be in the same interlocking. That is why there were castellated boundaries: every time a horizontal boundary passes through a crossover, it has to go either up or down a line so that both ends of the crossover are in the same interlocking.

 

[MarkyT]

These systems were intended mainly for high speed lines with long blocks and overlaps. For example the lowest supervised speed on TVM430 is 80km/h and the block (and therefore effectively the overlap) is typically 1500m. TPWS can supervise down to very low speeds as necessary and work with typical UK overlaps of 180m, less in some places. If applied to the classic UK railway the result would be a capacity penalty, as indeed happened with the ATP systems on GWML and Chiltern. TPWS avoids this problem by deliberately not trying to mitigate 100% of ATP-preventable casualties, actually forecast to be about 80% and as my link above mentions there hasn't been an ATP-preventable accident since Ladbroke Grove.

TVM430 hands over to KVB at lower speeds, which is why KVB is provided at St. Pancras and in the depot near Stratford. It was also retrofitted to NR infrastructure through Ashford International station recently as the new Velaros don't have AWS/TPWS capability. Trains must start off in KVB mode before transitioning to TVM when joining a high speed line. KVB (Contrôle de vitesse par balises) is a limited supervision digital balise-based protection system widely installed on conventional railways in France.

 

[MarkyT]

Both ends of a crossover HAVE to be in the same interlocking. That is why there were castellated boundaries: every time a horizontal boundary passes through a crossover, it has to go either up or down a line so that both ends of the crossover are in the same interlocking.

So it follows that the separate ends of what might otherwise be thought of as a crossover would have to be different point numbers if in adjacent interlockings. That must be preferred anyway to avoid castellation if a particular horizontal boundary is unavoidable.

 

[carriageline]

Both ends of a crossover HAVE to be in the same interlocking. That is why there were castellated boundaries: every time a horizontal boundary passes through a crossover, it has to go either up or down a line so that both ends of the crossover are in the same interlocking.

All this talk about interlockings is interesting. London Bridge area is split up horizontally. Mainly governed by 1 workstation controlling 3/4 lines out of 11. Although this is WESTlock, as opposed to traditional SSI.

You have crossovers over interlocking boundaries (although they are individually numbered ends, and individually controlled), and requests/slots to set routes over and back onto the adjacent lines. Swinging overlaps can also swing onto the adjacent workstations/interlockings!

I guess it was done this way as each workstation would control one set of lines, and routing onto adjacent workstations should have been a rare task!

Fascinating chat though guys, keep it up!

 

[HSTEd]

Doesn't SSI having a long response time cause safety issues?
ie. if a train SPADs and ends up astride another route, won't that delay signals going back to red?

 

[Bald Rick]

All this talk about interlockings is interesting. London Bridge area is split up horizontally. Mainly governed by 1 workstation controlling 3/4 lines out of 11. Although this is WESTlock, as opposed to traditional SSI.

You have crossovers over interlocking boundaries (although they are individually numbered ends, and individually controlled), and requests/slots to set routes over and back onto the adjacent lines. Swinging overlaps can also swing onto the adjacent workstations/interlockings!

I guess it was done this way as each workstation would control one set of lines, and routing onto adjacent workstations should have been a rare task!

Fascinating chat though guys, keep it up!

Correct about London Bridge. Same principle at Euston too (resignalled 2000). It means if an interlocking goes down, it only affects one set of lines, rather than all of them. Of course, interlock8ng failures are pretty rare - or they were until last week.

 

[Belperpete]

Correct about London Bridge. Same principle at Euston too (resignalled 2000). It means if an interlocking goes down, it only affects one set of lines, rather than all of them.

Provided that there are no crossovers/connections between the lines, as mentioned above.

 

[Belperpete]

So it follows that the separate ends of what might otherwise be thought of as a crossover would have to be different point numbers if in adjacent interlockings. That must be preferred anyway to avoid castellation if a particular horizontal boundary is unavoidable.

Apologies, what I said about both ends of the crossover having to be in the same interlocking was rubbish. The two point motors can indeed be connected to separate interlockings. However, there can only be one "master" interlocking controlling the crossover - the other interlocking merely acts as a "message repeater" passing on the control commands out to "its" point machine and its detection information back to the master interlocking. So if the master interlocking fails, the repeater (or "slave") interlocking doesn't know which way its set of points are supposed to be. Or if the repeater interlocking fails, the master interlocking doesn't know which way the other end of the points are lying, or the state of the foul track-circuit over that end. So if either interlocking fails, the other one can't clear signals over its point end.

On early SSI schemes (such as Paddington), at a horizontal boundary, the two point ends of a crossover were usually split between the two interlockings in the mistaken belief that this would improve reliability, when in fact it actually made it less reliable. On later schemes, we learnt to connect them both to the same interlocking. If that interlocking is running, trains can then keep running in that interlocking even if the other interlocking has failed.

Separately numbering the two-ends of the crossover to avoid a castellated boundary is not as useful as you may think. If one interlocking fails, you will still see the detection of the points in the interlocking that is still working. But if they are lying reverse, you won't be able to move them normal as you won't be getting the necessary locking conditions from the other, failed interlocking. And even if they are lying normal, you won't be able to set any routes over them normal, as such routes will require the other end set normal by the other, failed interlocking.

 

[Belperpete]

Doesn't SSI having a long response time cause safety issues?
ie. if a train SPADs and ends up astride another route, won't that delay signals going back to red?

When trackside SPAD indicators were in-vogue, they had to be controlled by circuits because SSI response times were considered too slow.

SSI response times are equivalent to many of the 1970s or 80s TDM-controlled relay interlockings (in fact, SSI used the same TDM systems).

 

[Bald Rick]

Provided that there are no crossovers/connections between the lines, as mentioned above.

You can still run trans though; at worst you’ll be passing a signal or two at danger, at best you can ‘strap out’ the crossover in the data.

 

[edwin_m]

Doesn't SSI having a long response time cause safety issues?
ie. if a train SPADs and ends up astride another route, won't that delay signals going back to red?

When trackside SPAD indicators were in-vogue, they had to be controlled by circuits because SSI response times were considered too slow.

SSI response times are equivalent to many of the 1970s or 80s TDM-controlled relay interlockings (in fact, SSI used the same TDM systems).

SSI cycles sequentially through its trackside inputs and outputs and all its internal logic, and the time for a full cycle should never exceed 1 second. Relays can be quicker in some circumstances. The most obvious example is route (or junction) indicator proving, where the indicator must be proved lit before the main aspect is cleared. Normally these would be connected to the same trackside module, so the SSI would get the proving indication coming in but the aspect wouldn't be updated until the next cycle, and anyone looking at the signal would see a delay between the two events.

This might in theory lead to a delay in a signal being replaced to danger if one of the aspect control conditions ceases to be met, but the chances of that making a significant difference to the outcome are tiny, especially considering that SPAD-related accidents are now very rare. As mentioned the response times are similar to those of a relay interlocking where a control goes through a TDM, for example if a signaler becomes aware of an emergency and replaces a signal to danger.

 

[Belperpete]

You can still run trans though; at worst you’ll be passing a signal or two at danger, at best you can ‘strap out’ the crossover in the data.

If the interlocking is going to be failed long enough that a controlled data change is necessary to 'strap out' the crossover, then something is seriously wrong! SSI data changes are not something that can readily be done on site.

 

[Belperpete]

You can still run trans though; at worst you’ll be passing a signal or two at danger, at best you can ‘strap out’ the crossover in the data.

The worst case is if an interlocking fails while there is a route set from it over the crossover reverse, then there will be no way of cancelling that route in the working interlocking until the failed interlocking comes back on-line.

 

[DarloRich]

and a man does all this by pulling a lever in a little box?

Signalling is a dark art. Just tell me when you will start and finish the job and I will go for a brew and leave you to it. Oh and write the cheque!

 

[HSTEd]

I wonder to what extent SSI and it's derivatives cross fertilise with the newly developing field of commodity safety-grade PLCs.

Seems likely the railway could take advantage of some major economies of scale there

 

[MarkyT]

There are events that could happen more slowly in a SSI versus a relay installation. While manual replacement from the panel would incur transmission delay in both for a remote TDM controlled relay room, reversion to red for something like forward lamp or TPWS grid failure could be near instantaneous in a local relay circuit for example once the proving relays have dropped. That could entail a cycle delay in SSI by contrast. I agree it's not really critical as long as the delay is no longer than one cycle.

 

[edwin_m]

I wonder to what extent SSI and it's derivatives cross fertilise with the newly developing field of commodity safety-grade PLCs.

Seems likely the railway could take advantage of some major economies of scale there

The original SSI was developed by British Rail in the 1980s and was among the first applications of processors to safety-vital applications. The hardware was entirely bespoke apart from using standard processors and other components (many of which are now obsolete). The original Integrated Electronic Control Centre, which didn't need the same degree of safety integrity as it only worked through interlockings, was based on COTS processor boards with only the video driver and a few minor bits and pieces being bespoke.

I believe the more recent computer based interlockings are based on more modern industry standard SIL4 equipment, but in some cases running software that allows re-use of the SSI geographic data and even communication with existing SSI trackside modules. This is one of several ways by which signaling can now be upgraded piecemeal, rather than the traditional approach of re-signaling and re-modelling a whole area and then leaving everything unchanged as far as possible until it is life-expired.