Applying logic to level crossings

Obstacle Detection (OD) crossings are now fully approved and in use throughout the country. In issue 125 (March 2015), Rail Engineer reported on one of the first installations at Four Lane Ends on the Wigan to Southport route. That article discussed that the next step would be to control such crossings with the use of an electronic solid state interlocking, rather than a relay-based one.

OD crossings use radar to confirm a crossing is clear from road vehicles and pedestrians before allowing the protecting signals to come off and allow trains to proceed but, as in all signalling applications, a failsafe interlocking is key to safe operation.

Programmable logic controller (PLC)-based control systems have been used in other industries for many years. One example is the Pilz PSS 4000, which has been used widely in machine safe automation, process safety, mines, bridges, water treatment systems and in European rail. It is now being developed and approved for use within Great Britain as reported in issue 118 (August 2014) and its deployment is awaited with interest.

It is, however, only one of several safety critical PLCs that are being evaluated for use on GB rail. Over the next few years, several hundred crossings will need replacing and it’s important that there is a selection of safe products to choose from and GB rail does not become dependent on one vendor.

The East Sussex Coast Re-signalling project was one of the first in the country to use another PLC-based interlocking for the level crossings on the scheme. This was the Vital Harmon Logic Controller (VHLC) supplied by GE Transportation, and the scheme was successfully commissioned by Atkins and Network Rail in 54 hours over the weekend of the 13/16 February 2015. Unlike the Pilz example, the VHLC is a proprietary rail PLC.

Interlocking developments

An (OD) crossing is protected by road traffic light signals and lifting barriers on each side of the railway. An audible warning to pedestrians is also provided. The barriers are normally kept in the raised position and, when lowered, extend across the whole width of the carriageway on each approach.

The crossing normally operates automatically and the closure sequence is initiated by approaching trains clearing track circuits. Confirmation that the crossing is clear, and that railway signals may be cleared for the passage of trains, is provided automatically following a thorough scan for any significant obstruction by obstacle detection equipment (the Radar). An interlocking is required to correctly and safely control the protecting railways signals, road traffic light signals and lifting barriers.

The first railway interlockings were mechanical. A locking bed and steel bars form a grid with levers providing the input and signals, points, signals and barriers providing the output. If the function controlled by a given lever conflicts with that controlled by another lever, mechanical interference is set up in the cross locking between the two bars, in turn preventing a conflicting lever movement from being made.

Relay interlockings were the next evolution and operated solely by electrical circuitry, with the large mechanical levers of previous systems being replaced by buttons or switches on a panel or via a video interface. Complex electrical circuitry is made up of relays and contacts in an arrangement of relay logic that confirms the state or position of each signal output. As devices are operated, their change of position opens circuits that lock out other devices that would conflict with the new position. Similarly, other circuits are closed when the devices they control become safe to operate.

Still in use today, over one hundred years after their introduction, these crossings are inherently fail safe as, if the relay coil fails in a level crossing interlocking, the circuitry is designed so that signals stay red and level crossing barriers come down.

Modern electronic interlockings have been introduced over the last 30 years. They use solid-state electronics with no moving parts and the wired networks of relays are replaced by software logic running on special- purpose microprocessor control hardware. The logic is implemented by software rather than hard-wired circuitry and provides the ability to make modifications when needed by reprogramming rather than rewiring. The vital logic is stored as firmware or in read-only memory (ROM) that cannot be easily altered to resist unsafe modification and meet safety testing requirements.

Solid State Interlocking (SSI) is the brand name of the first-generation microprocessor-based interlocking developed in the 1980s by British Rail, GEC-General Signal and Westinghouse Signals Ltd. Second generation processor-based interlockings are known by the term computer-based interlockings (CBI) – Westlock and Westrace (trademarks of Siemens) and Smartlock (trademark of Signalling Solutions Ltd) are examples of CBI interlockings.

Programmable logic controllers (PLC)

In the rest of industry, software-based electronic control systems are also used for the automation of typically industrial electromechanical processes, such as the control of machinery on factory assembly lines, amusement rides, or lift systems. These have the generic title of programmable logic controllers (PLC) and the same PLC can be used for many different applications using an appropriate software programme to control the system.

PLCs are now starting to be used for railway signalling control, including level crossings, and they are also being used on trains. Not all PLCs are designed to be fail safe, and a key requirement for an interlocking PLC is to use one with a high Safety Integrity Level (SIL). In very simple terms, a control instruction is undertaken in software which is executed by at least two diverse internal central processing units (CPUs) which cross-check each other before an instruction is executed.

The hard-wired relay logic is converted into PLC code using various programming languages. This is not as simple as it sounds as old relay circuits have evolved to compensate for relay behavioural characteristics and all the standards have evolved around relays. A system requirement specification has to be created using a formal method (in accordance with the standard for software- based signalling EN 50128) before coding the PLC and proving it is safe in accordance with safety standards for railway signalling and telecoms systems. Once this is done, the benefits are many as:

• the hardware in PLCs is tried and tested, typically for decades in many applications;
• firmware/software for safety PLCs meets IEC 61508-3 (Functional safety of electrical/electronic/ programmable electronic safety-related systems);
• programming for subsequent systems is simple and flexible through the re-use of pre-validated function blocks;
• PLCs can be mounted in a lineside cubicle instead of an equipment room, saving space;
• some vendors provide PLCs which are compliant with standards, such as EN 50121, for environmental requirements with regards to temperature and electromagnetic compatibility;
• there is no need for special air conditioning / heating / filtering;
• system architectures for control systems are available up to SIL level 4;
• there is a wide availability of PLC suppliers and programmers;
• PLCs are expandable and scalable and operate via proven, open-architecture IP and Ethernet-based communications;
• there is no expensive periodic testing and servicing of relays.

Safety standards

International standard IEC 61508 “Functional safety of electrical / electronic / programmable electronic safety-related systems (E/E/PES)” is an umbrella standard intended to be a basic functional safety standard applicable to all kinds of industry. It covers the complete safety life cycle and has its origins in the process control industry sector.

The European EN5012x family of railway standards, including EN50126, EN50128 and EN50129, have been developed by CENELEC (European Committee for Electro- technical Standardisation) and apply to both heavy rail systems and light rail and urban mass transportation including people movers. EN 50126 covers the specification and demonstration of reliability, availability, maintainability and safety (RAMS) and is the core standard.

EN 50128, which details communications, signalling and processing systems, addresses requirements capture, software design, implementation and testing while EN 50129 describes in detail what action and documentation has to be provided for the purpose of preparing a safety case.

East Sussex re-signalling

Covering an area from Eastbourne in the south to Lewes Station in the west and Bexhill Station in the east, the East Sussex Coast re-signalling project replaced 26 miles of life-expired mechanical infrastructure with a modern, state of the art signalling system. The scheme saw line speeds increased to 90mph, 10 level crossings upgraded and six existing signal boxes abolished, with control of the new signalling system being transferred to the new Three Bridges Route Operating Centre (ROC).

VHLC interlocking technology was selected for the scheme’s level crossings instead of conventional relay- based interlocking as it takes up less space, does not need an equipment room for hundreds of relays (so no heating and lighting is needed), requires fewer cables and, as there are no moving parts, delivers higher reliability. It also costs less to upgrade and maintain the level crossings.

The public often believes that an operator-controlled level crossing is safer than one which uses an obstacle detector to confirm a crossing is clear. However, an obstacle detector does not get fatigued or distracted and is therefore just as safe, if not safer.

The VHLC replaces most vital and non-vital relays at an interlocking. Its software package, Logic Station, allows signal design engineers to program vital signal logic for the VHLC using relay logic diagrams. The basic VHLC system consists of the chassis, power supply, vital logic processor, auxiliary communication processor, and a site-specific module. Various configurations for different code system emulations are provided. Being just 330.2 mm high, 483.0 mm wide, 355.6 mm deep and weighing just 15.0kg, the VHLC is located in a single small lineside cubicle rather than needing a complete equipment building.

While there may be some concern in locating electronic equipment in lineside cabinets for maintainability and environmental reasons, it must be remembered that such equipment monitors and reports any faults to a central location together with allowing remote diagnostics and interventions. The equipment is very reliable, so regular access for maintenance and adjustment is not required. Telecommunications equipment has been located in lineside cubicles for many years and, while similar concerns were raised when they were introduced, these have been unfounded. On the East Sussex Coast Re- signalling project, it has been reported that the only active element that is not remotely monitored and maintained is the light inside the lineside cubicle housing!

Not all barrier crossings are suitable for use with OD equipment to confirm the crossing is clear. If the road profile is such that the radar cannot get a clear scan of the crossing and may possibly miss an obstruction, conventional manual observation via the use of CCTV may still be required. This was the situation at Hampden Park and Havensmouth crossings on the East Sussex Coast scheme, although the VHLC interlocking was still used.

The VHLC had previously been used for Automatic Half Barrier crossings, but Atkins had to gain type approval for use with an OD crossing. The programme of validation and verification testing included the establishment of an off-rail OD crossing complete with barrier machines. This allowed a lengthy and extensive testing programme in complete safety, and to make sure the system was reliable before it ever went near service.

This approach to testing a new system extensively before it is installed on the operational railway is to be applauded, and it is an area where railways have done poorly in the past. It is appreciated that it is not always easy to create a working railway and the introduction of plug and play cabling has helped. In the car industry a new vehicle would not be launched and sold without years of behind the scenes testing, and it is this rigour of testing that the rail industry must aspire to if it is retain credibility. It is even more important now that systems are very complex.

The East Sussex Coast re-signalling project commissioning was undertaken in five 12-hour shifts. At one point, there were over 300 engineers and staff on site at the same time – dismantling the critical parts of the old signalling system and bringing the new one into use. During that time, VHLC was applied to the 10 level crossings across the East Sussex project, the highest number of level crossings that Atkins has brought into service within one commissioning. Some of this efficiency was due to using the VHLC product and the amount of off-site testing that was possible.

Since the commissioning on 16 February, the only failures have been with the conventional relays which are still required to interface with the obstacle detector equipment. There have been no failures of the VHLC electronic equipment.

Atkins is now using the lessons learned during the development and deployment of the VHLC PLC for the introduction of its larger ElectroLogIXS electronic CBI interlocking. In addition, the Signalling Innovations Group at Network Rail is evaluating a number of commercial off-the-shelf PLC products from outside the rail sector- particularly for MCB-OD crossings but for other types as well.

These developments should drive down the cost of providing level crossings in the future.