CBTC+Fall-back

[soylemezv]

Hello everyone;


There are some questions about CBTC.Firstly;What is the difference between Degraded Mode and Fall-Back mode.Secondly, Which conditions Fall-back system is required for CBTC?In long-term, How does Fall-back or secondry control system affect costs? Especially in terms of availability, Is there any positive effect?

[PJW]

Hello everyone;

There are some questions about CBTC.
Firstly;What is the difference between Degraded Mode and Fall-Back mode.

Secondly, Which conditions Fall-back system is required for CBTC?
In long-term, How does Fall-back or secondry control system affect costs? Especially in terms of availability, Is there any positive effect?

I am not sure that there is a universal definition of these terms and therefore different suppliers and different customers may use the terms inconsistently.  I will give you my guess.


Degraded mode is what the client railway calls operating the railway when there is some form of failure.  There may be a range of operational solutions depending on what has failed (e.g. one train, one confined area, the whole system).



One of the options may be a different form of basic signalling- almost certainly lower capacity, perhaps with only limited functionality regarding which routs can be set / operational moves made, possibly even of lower safety integrity with perhaps some risk mitigation measure associated such as very slow speed limit.  It might be totally independent of the main CBTC signalling, but one possibility would be to have some axle counters for train detection that the main CBTC system could use in the event of a non-communicating train [NCT].  In this case it would make sense to refer to the CBTC "falling back" from its usual high capacity moving block operation, to using the long fixed block of axle counters to be able to get the train following the NCT on the move again eventually, once the NCT had been manually driven (in degraded mode) to exit that axle counter section.  Without such a fall-back mode, the CBTC would have to assume that the rear of the NCT still was at the place that it had last said it was positioned before it stopped reporting.  Even once the failed train is leaves the line to go into siding or repair depot, the central system will still consider that it still exists and is blocking the line,  until there is some manual intervention to "remove" the train from the knowledge of the central computer system (which is of course a potentially high risk procedure if a human ever gets it wrong!).


For the second part of your question, clearly having to provide an axle counter system increases the cost due to the physical equipment, design, installation and testing of the system itself, plus also more costs due to complicating the base CBTC system with which it is to interface.  Depending on the nature of the fallback, there may be some lineside signals as well and these add further cost, all for equipment that ideally will never find any use.  Given that this equipment all has to be maintained so that it is actually available if needed, then the whole life costs continue to increase over time.

However if do not provide the fallback and there ever is a failure, then there could be great costs because of major disruption following the failure of one train's onboard equipment.  More than that, there is safety risk because somehow need to get potentially crowded trains in tunnels on the move again and if many trains having to be driven in manual mode, sooner or later someone will make a mistake.  Even leaving the trains stationary for the time it takes to completely remove the NCT is not entirely safe, given masses of people trapped underground and possibly panicking.  A more extensive failure of the CBTC could result in the control centre staff having no idea where all the trains are on the network; at least with a freestanding axle counter system you could tell where trains certainly were not, even if you couldn't tell how many separate trains were within any one long block.  However if authorise one train at a time out of that section it will eventually become clear and therefore the problem has eased for following trains as from thereon only one train would be allowed into the section at any time. 


So it is really all about the "insurance premium" one can justify to avoid all that disruption and safety risk.  If the base system has enough diversity for it to be very highly unlikely that it will ever fail, then the risk may well be acceptable.  It could be a better decision to spend the money that would otherwise be spent on the fallback mode in making the base system even more diverse and super available.

So it is not a simple decision.  Need to estimate likelihood, consequences and therefore risk.  Consider the fallback as one possible mitigation; consider the alternatives.  Find the best option that addresses the safety requirement (in the UK the concept of ALARP applies) and any other costs of disruption, railway reputation etc.) and select the best option; in summary apply the Yellow Book 7 step risk assessment process.

[soylemezv]

Thanks for reply. By assuming that system achieves a sufficient level of safety, based on the CBTC concept, ıs there any quantitive method to evaluate "availability" ?Point of view each component failure and impact of failure on the train operation ,as a consequence loss of revenue, comparing inital and operational costs of fall back system...How method should be used to decide fallback requirement?

[PJW]

Thanks for reply. By assuming that system achieves a sufficient level of safety, based on the CBTC concept, ıs there any quantitive method to evaluate "availability" ?Point of view each component failure and impact of failure on the train operation ,as a consequence loss of revenue, comparing inital and operational costs of fall back system...How method should be used to decide fallback requirement?

Yes that is the approach which should be taken. 
Of course the reliability performance of each component can only be an estimate based on theory predictions and trying to compare with already commissioned systems having some similarity, but whereas this might be quite good for random ones, by their nature systematic errors giving reliability problems may not become evident until the right (or wrong!) combination of factors arise.
Certainly the overall system availability can be derived from combining the various component system reliabilities, taking into account the architecture giving diversity and being alert to any common mode failures.

Then other modelling must be used to estimate the impact, how long it will be to resume services etc. so more now in the realm of operations than engineering per se.  Probably not easy to get an estimate that all will agree on but yes in principle then one has a figure to see whether it is worth investing money re reduce the impact, either in a fallback system.to reduce the consequence of the main system failure or in adding more redundancy into the core system to improve its availability to reduce likelihood of failure.

[Jerry1237]

@soylemezv

We need to be careful mixing the words safety, availability and cost.

As PJW states, you can of course estimate availability and that should be completed during the conceptual and rerun during the design phases of the scheme. Generally, but not always, higher availability means increased cost.

High availability does not infer a system is safe or the cost is high. Often, the more complex a system is; which infers cost, decreases reliability and availability.

Safety is also not implicit in highly available systems.

However, the rail system or signalling and control systems we build tend to have a relatively high cost, are highly available and safe. Just look at the fallout from the Hatfield Colliery slip or the failure of the Dawlish infrastructure for how third parties have affected the availability of the railway system.

Going back to the original question: fallback systems depend upon the client's requirements. Working at reduced speeds to line of sight is free and relatively safe. It is possible to have a duplicate of the original system that costs the same as the original system but also bumps up costs such as maintenance.

Jerry