2006 "Q6" but actually Q3 Commissioning strategies

[dorothy.pipet]

An attempt for comments - took about 45 minutes and I feel part c is particularly weak.

[PJW]

An attempt for comments - took about 45 minutes and I feel part c is particularly weak.

As you indicated, this probably isn't a question for which your experience is the most relevant and therefore may not be a good choice in the exam, but certainly a good idea when preparing for the exam to have an attempt which are not natural choices.


Part a)

Good content, but wonder if there was enough on Safety Risk given this is a module 1 question.

Therefore I’d have focused more on things like the number of wires hanging in the relay room as those for multiple stages would co-exist and on any one occasion only a minority are to be changed over.  There is every likelihood that some will be affecting a termination position that would also be affected by others.   Therefore even if it is being implemented in precisely the order that the designer had envisaged, there is still a possibility of an installer and tester making a mistake- remove a wire shown on a green set of drawings for one stage, find the wire hanging that appears to be that on the red set of drawings for that stage yet actually be for another changeover for a completely different alteration whose drawings for that specific night are not relevant. 


Can be mitigated to a certain extent by applying coloured dots to define the specific stage on the luggage labels applied to each wire to be added or removed, but still mistakes can be made.  Just the pure quantity of hanging wires to search through, all get tangled up because of those luggage labels, hard to access, hard to read in poor light, working against time, fighting also the body clock and so unrealistic to expect that mistakes won’t be made. In reality there is very little effective independence achieved during “tester controlled changeovers”.  Of course the subsequent “functional circuit testing” should reveal before the Principles test and some additional assurance achieved by wire count, but realistically how robust are these? 

   
In practice there won’t be enough time to do a functional circuit test prior to the Principles test and it would be scarcely practicable anyway as it tends to need a fair number of interlocking inputs easily controlled from a test panel and there isn’t the time to put that on and then verify all functions back to their correct valid inputs within the shift, let alone do any of the intended work.  So the only option is to have some enabling stages that implement some form of quick changeover arrangement from the interlocking connected to the real railway or to simulation.  This has to be left in place for weeks / months and there are risks associated not only with its design and installation and then removal, but also for its period of existence- how can we be sure that the interlocking only ever gets valid inputs whenever it is in operational use during the days- is it left in a safe state at the end of each and every shift? Will the maintainers get confused by both it and all the hanging wires should they be called to fault find during the intervening day?  There is first the matter of leaving them records of the definitive status of the interlocking, but the bigger problem is ensuring that anyone who may need to understand that information both knows where to look and secondly is actually capable of assimilating the information presented.


The Principles tester is also going to be very time limited and will be very focused on each specific group of changeovers and need to scope their testing on what they believed to be the extent of the changeover, what is shown on the Control Tables to have changed functionality and whatever the issue was that it was the intention to address. If some incorrect changeover has happened, they only have a hope of stumbling upon it by the functions they are testing not operating correctly, but if an error in the changeover did not prevent this but created either a right side failure or wrong side failure elsewhere then it is only by pure luck that they might chance upon it.  There are no guarantees even in a big extended closure but the chances of an error being made are less and the chances of finding any before putting back into operational service are higher, simply because all of the testing is performed after all of the changeover and therefore a far high percentage of the interlocking’s functionality will have been exercised to some extent, either as a formal test or just incidentally whilst undertaking other formal tests.


Don’t put too much faith in wire counts either, particularly in the “night by night” approach.  The nature of such is that there will be a work package of many separate items and it will be a matter of “playing by ear” on the shift to refine precisely how many of the items can be accommodated.  Even if the design produces wire count for the anticipated workload, then even in shift 1 there is a fair chance that it won’t 100% match what was actually done- either some item will not have taken place or an extra one squeezed in.  Any under or over achievement on that shift has a knock-on effect on the documentation for the next and the chances of getting all the documentation re-worked over night for that is virtually zero.  Wire count doesn’t tell you much anyway- the best it can say is if there are the wrong number of wires on any terminal that is counted.  This is clearly dependent on all the records being right initially (fat chance!) and there being enough time to count everything that “might” have been affected inadvertently as well as all those that “should have been”, the count itself being accurate, any discrepancy being fully investigated rather than just the analysis being “corrected” to show what was counted.  After all that, it doesn’t help identify if the wrong one of many hanging wires was terminated by mistake- if the net count is right then no error is detected.
 
You may detect a certain lack of confidence in ability to undertake night-by-night changeovers adequately safely.  Standards were different 30 years ago, but by and large I do believe that BR managed to work safely enough.  There were errors made but overall there was a culture and length of experience within all those involved from design, installation,  test and the signalmen that actually it was a method of working that was made to work and was capable of being done in an adequately safe way.  Nowadays I generally wouldn’t countenance it within an NR environment.  There are too many distractions, too many parties involved who haven’t got a clue about what is really important and what is a a compliance nicety, too much escalation politically and commercially when someone is found to have broken an egg when making an omelette.  The generation of people with the relevant experience, attitudes and behaviours has almost completely disappeared; in a risk adverse and contractual environment it just can’t be done anymore.

London Underground does seem to be able to work in this way to a limited extent; there is more of the “railway culture” and most of the work undertaken in such a manner is designed (or at least closely design supervised) in-house and the testers undertaking such work tend to be LU employees etc.  The sites and functionality are relatively simple and the technology is such that typically the basic locking is achieved mechanically, with the electrical relay circuits for aspect level, route release controls etc. so much simpler and self-contained.  Processes and procedures re also somewhat different; the red/green approach is not utilised but all shown on one sheet, with different stages shown in a range of different colours to show how they inter-relate (which is exactly contrary to the NR process when showing multiple stages on the same set of diagrams is explicitly prohibited). From a mainline perspective they seek to achieve quite trivial amounts and prescribe much more testing “around” the change than would be undertaken on NR so from that viewpoint it looks extremely top heavy effort to implement the simplest alterations.  However since they can rarely get extended possessions and so much does have to get achieved in short “engineering hours”, this is what they have to do and have maintained a culture which supports it but would appear to be ridiculously inefficient from an NR perspective.  However the organisation is very determined to work in a safe manner and this is the consequence.
 
Wonder what the situation is in other parts of the world…….?
 
Part b)
Some of your answer drifted outside the scope of the question which defined wiring changes within the relay room and mention of dis boxes, equipment cases and Reed track circuits whilst not necessarily being wrong, rather gave the impression that you weren’t keeping to core topic.
I doubt that would ever get a possession arranged that was long enough to undertake in an ideal way; it would only be if the interlocking remedial work could get done under the cover of a massive P’Way deep dig and like-for-like renewal project or similar.  A large amount to be undertaken in a longer possession can also be time pressured and putting multiple teams on the work presents its own difficulty and doesn’t speed up much.  The concept of a job with no shortage of time is one that I have yet to encounter.
 
Whereas perhaps there is some advantage in that regard from doing all the changes in one possession, I think that the primary difference is what you cut into. 
 
If doing the task piecemeal then must ensure that each separate work item is as free-standing as possible and affects the bare minimum.  There is no meaningful pre-testing that can be done.
 
If doing the task as a whole, then trying to design in such a way that large elements of circuits can be pre-tested as an entity is preferable, indeed to the extent that rather than attempting to re-use that chunks which would be unaltered are reproduced so that entire circuits can be pre-tested before the day and then the old relay coil spades simply exchanged for the new one.
  
I certainly agree that looking at all the intermediate configurations is essential for a multi-staged approach.  Not sure that compliance to standards is strictly relevant; the existing interlocking almost certainly pre-dates and even after the more worrying safety deficiencies are addressed is still likely not to be fully compliant and definitely won’t be part way through the staged implementation by definition!
 
 
Part c)
Yes agree that this was the weakest part of your answer.

Correlation and Condition Survey are important, but be aware that these are non-trivial for an existing major relay room and just undertaking these can create risk.
Replacing an entire relay rack is often a good idea, but of course it does need a lot of connections made to it on site.  If the interlocking (such as the WR E10k) had originally been destined that separate racks were pre-fabricated off site and connect via cables terminating in screw terminals then this really helps the rack to be exchanged; more generally though a rack was only partially wired and the  wiring to/from other places in the relay room just run as individual wires when on site, so this makes much less easy and complete.

Actually I am convinced that if a significant level of change is contemplated then gutting the relay room and putting in new racks to hold SSI modules and interface relays to join onto the existing relay line circuits to the external signalling is the way to achieve.  It will of course need a central interlocking and the data for that produced and tested as well as an amended interface to the control system all of which will bring their own challenges and risks, but all the difficult stuff can be done off site or in rehearsals.  Clearly the changeover to interfaced SSI will require a major commissioning possession as would have to change the entire area in one go; couldn't have part of the functions on an RRI and the rest on an SSI!. 

The problem is that such a proposal may not fall within the examiners' view of what their question demanded, but I think if you as the candidate made it clear that literal pre-wiring was considered un- tenable and that the way to accomplish it was therefore implement in data that could be fully pre-tested off site and  the pre-wiring of interface relays then I think could convince that really was answering the question asked.  Note that this paper dates from a decade ago and that I am looking at it with a 2016 viewpoint.

Part d)

I thought this was good coverage with plenty for he available 6 marks.  The question’s wording does seem to hint to me that those on site are “on their own” without the luxury of design cover.  In that context perhaps the answer is to revert the circuit back to how it used to be before the botched “safety improvement”.  Presumably the interlocking had functioned for years in that state and so another few days like that isn’t going to hurt, and that would give the design office on days a chance to design a modification.

Overall I don’t think this was an easy question for anyone; I think it was a it historic hen it was asked and even more so now.  I didn’t think your answer was too bad; in summary the criticism would be:

1. Too design heavy, light on install /test /maintainer considerations

2. Didn’t seem to focus on interlocking circuit alterations being done to address safety concerns, but seemed to drift to reflect more generic alterations