A new fail-safe principle for railway signaling Yinghua Min Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China

Outline Introduction Old fail-safe principle Difficulty in implementing the old fail-safe principle A new fail-safe principle Conclusions

signaling When trains run on railway tracks they follow rules of operations in which safety plays a very important role. The most important rule in respect of safety is ensuring that two trains do not occupy the same position on the track at the same time. To make this rule work operation of trains uses signaling to control movement of trains on tracks and divides tracks into several sections which are protected by the signals.

Importance Transportation efficiency vs safety In case both cannot be achieved simultaneously we prefer to lost efficiency, but guarantee safety. The need to ensure safety is always the topmost consideration and under no circumstances the signaling arrangement can compromise with this primary requirement. Fail-safe principle is critical for railway signaling systems. Railway accidents teach us the importance of signaling safety.

Old fail-safe principle A number of decades ago when relays were widely used in railway signaling systems. The fail-safe principle said that railway signaling had to guarantee the safety when any element in the system was faulty, including signals degraded running.

Relay interlocking In some form of partial route relay Interlocking systems electrical switches are provided which allows electrical feeds to signals of appropriate colors and to points as desired. Through use of suitable relay logic the safety of the system for train running is ensured. In such systems electrical detection of point is used and track circuits are used for proving safety of train running. When relays are unoperated, no unsafe condition of train running occurs.

Reliability of relays L C Ideal unreliable (p>>q=1-p) L C 1 L C 1 unreliable L C P{C=0}=p P{C=1}=q 1 P{C=0}=q P{C=1}=p (p>>q=1-p)

Safety relays It is impossible for C to stuck-at 1. For instance, Gravity type relays Gravity always exists in any case Single signal lamp machanism Gravity type to guarantee red light in case L C P{C=0}=1 P{C=1}=0 1 P{C=0}=q P{C=1}=p

Metal to metal contact relay It is possible to use metal to metal contact relays for realizing the logic circuits but such circuits have to be designed with care to ensure that even under failure condition train operations are safe. This is achieved by designing the circuits in a manner that for every clearance of a signal the relays that pick up to cause the signal to clear is also checked with respect to its back contact.

Track circuits That a track section is occupied or empty is indicated by a track relay, which is a safety relay. Train occupancy or in whatever case, the relay will go down with 100% probability. Any disconnection Power off Bulb broken wire (no display equals to red light)

The system commands a red signal if the track circuit is faulty, no matter a train is running in its forward interval or not. The old fail-safe principle is then implemented.

Automatic block system(ABS) ABS operation allows trains operating in the same direction to follow each other in a safe manner without risk of rear end collision. The automatic operation comes from an ability to detect if blocks are occupied or otherwise obstructed and then convey that information to approaching trains. The term "Automatic" means the operation of the system without any outside intervention. it rejects external control to establish a flow of traffic, which is inconsistent with the idea of CTC.

ABS Movement of train between two stations is controlled by a pair of equipment called “Block Instrument” in railways. Automatic Block signal(ABS) is the vital interlocking hardware located at the remote location.

Centralized Traffic Control CTC is very much centralized . It controls not only traffic scheduling, but also control all signal facilities, and command train operations, and managements. Highly centralized systems have the advantages of high efficiency But with disadvantages of degrading reliability and safety.

Interface Controls Interface controls should be arranged to fail safe principles and an absence of circuit continuity is indicating train approach.

Warning Light Controls Warning lights shall be designed to operate in a fail-safe mode so that an absence of indication is considered as a warning. Separate warning lights shall be used for separate tracks unless specifically approved otherwise. The warning given by the system shall be initiated by the detected approach of any rail traffic movements routed towards the protected area, and shall be maintained until such time as all those movements are detected as being clear of the protected area. Operation of the warning lights shall be automatic and not require any action by the signaler. Fail safe means of train detection shall be used. Failure of train detection equipment shall ensure that the system is maintained in a "warning" state.

Fail-safe principle All signaling must be designed in accordance with accepted railway fail safe principles for both mechanical and electrical equipment, e.g., the failure of any component is not to present an unsafe condition. be reliable but fail-safe such that any predictable type of failure of an item of signaling equipment will lead to a more rather than less restrictive operating condition.

Microprocessor interlocking Microprocessor interlocking system with microprocessors or full fledged computers carries out the logical operation under software control. The Drives to external functions as signal lights, point machine etc. are typically given through suitable serial ports and decoder/controller drivers at site. Design on the system is made keeping in view the safety requirements.

Fail-safe with software The requirement of safety is a logical analysis of the state of the points, track circuits and signals. To generate commands to operate points, signals as required, the logic of signal operation can be implemented by relay logic or even mechanical logic, so it should be a pretty simple job for the modern computers. But, if some fault occurs during the process with a long path, the actuator may not act as desired. In the case Solid State Interlocking safety is attained mainly through redundancies.

Redundancy Redundancy alone cannot ensure reliability or safety of a system in operation. Correct management of redundancy is essential in making a redundant system fault tolerant and fail-safe.

Difficulty in implementing the old fail-safe principle Nowadays with the advance of electronics control systems, the principle is no longer practical. Since the electronic system is too complicated that there is no way to exhaustively consider all possible element faults. No contact elements No unified model Too many are used. Faulty behavior is various. The old fail-safe principle needs updated.

A new fail-safe principle Given a system and a state transition diagram Define critical states Life-threatening Threating major property losses Depends on system functions Define safe states Depends on systems A system is fail-safe if any critical state will transit to a safe state when any single fault occurs, which will be detected in time.

State transition diagram Critical state Safe state The shortest path to reach the safe state

The shortest path The shortest signal path for fail-safe is to guarantee the highest reliability in critical situations when critical faults occur in the system. Ignoring any faults in other nodes No matter how many paths are able to be activated. The shortest path is the only one activated.

Shortest path control Field sensor Track circuits Etc. Actuator Signal lamp Automatic stopping dispatcher monitor Data base analysis channel command Field sensor actuator

What faults can be safe? Any fault in the electronic system Hardware faults Software faults A dispatcher’s operation fault Care should be taken for Severe weather Lightning stroke protecting direct lightning flash to the sensor and actuator Track circuit Short circuit sensitivity degradation due to moisture

conclusions The fail-safe principle is to identify a critical fault and mask its effect until recovery is taken. A system is fail-safe if any critical state will transit to a safe state when any single critical fault occurs, which will be detected in time. The fail-safe requirement is that the probability of keeping train operation safe larger than (1-10-10), MTBF is typically 100 years. The shortest signal path principle for fail-safe is to guarantee the safety with highest reliability in critical situations when fault occurs in the system.

Thank you for your attention! Comments & questions?