The tragic accident on the Croydon tram network in November 2016, in which seven people were killed and many more injured, has raised many questions about tram safety. As reported in issue 171 (Jan/Feb 2019), several recommendations were made in the subsequent report by the Rail Accident Investigation Branch (RAIB), a number of which have already been implemented. Key to all of these is how to implement an overspeed protection system such that the chances of a similar accident occurring are so low that the risk can be discounted.
Transport for London (TfL) has now let a contract to Deutsche Bahn’s UK subsidiary ESG Rail for providing such a system on London’s trams, with the component parts being supplied by Sella Controls, a Stockport-based company specialising in low-cost ground to train communication technology.
Rail Engineer went to meet Iain Wilkinson from Sella Controls to learn how the system will function and what will be involved to achieve full implementation.
Background to the challenge
In terms of operation, trams may be regarded as more like buses, in that the journey progresses by the ‘drive on sight’ principle whereby the driver is responsible for the safe movement of the tram according to what can visually be seen ahead. Signals in the form of horizontal, vertical or junction picture white bars are only provided at road intersections or where tram lines diverge.
The vigilance of the driver is therefore critical to safe operation and, on street-running sections, this is virtually identical to that of a bus driver with the exception of steering. Tram networks allow for steep gradients and sharp curves, so the vehicles are designed to cope with these.
However, the resurgence of tram networks in the UK has made considerable use of existing main line rail routes, either by reopening disused formations or taking over existing rail lines. On such sections, tram speeds can be much greater (up to 70km/h) as it is a dedicated right of way with no interference from road vehicles or pedestrians.
In the Croydon area, a rail line existed between Selsdon and Elmers End. It was a Cinderella route in that it went from virtually nowhere to nowhere and, although electrified on the 3rd rail system, it carried few passengers and was closed in the early 1980s. The formation remained virtually intact, including a number of short tunnels.
In the planning of the Croydon Tramlink system in the 1990s, this redundant route was seen as potentially useful to link some outlying suburbs with central Croydon. To achieve this, the erstwhile line was linked at its half way point by two sharp curves into a street running section, with a new tram stop at Sandilands and onwards into the town centre past the busy East Croydon station.
The speed around these curves is 20km/h but, on the day of the accident, the driver allegedly lost awareness of his location and failed to slow down from the 70km/h of the former rail route section, resulting in the tram overturning. The route just before the curve is in tunnel and there was no natural daylight at the time. Hindsight would indicate that, in a dark locality, it would be all too easy to be confused as to the precise position of the tram.
Since the accident, much improved signage and a new driver vigilance system called ‘Guardian’ has been provided. Both of these contribute enormously to preventing any similar recurrence, but they stop short of actually taking over control should the driver fail to slow down for any speed restriction.
Designing a speed control system
The RAIB report did not specify the detail of a speed control system, just that technology should be used to intervene if a tram approaches a speed restriction too fast. It was left to industry to come up with a solution that is cost effective and with an appropriate level of safety integrity.
On main line railways, this would usually be a SIL4 system (Safety Integrity Level 4) with full failsafe status and active monitoring of the system integrity and functionality. Such an application to a tram network would be overkill and the considerable expense would be difficult to justify in view of the low risks involved.
A SIL2 solution has therefore been specified as one of the functional requirements to provide basic overspeed protection. The safety system will be invisible to the driver under normal circumstances, with the system only kicking in if the tram is detected as going too fast at a particular location. The risk of the safety system failing at the same time as an over speed is occurring is regarded as so small as to be discounted.
Should a system failure be detected, the system can be bypassed by the driver with the correct authorisation, thus allowing the journey to continue until such point as the tram can be taken out of service for investigation of the failure.
To make sure it wasn’t ‘reinventing the wheel’, TfL engineers researched what other light rail systems around the world were using to overcome this problem. Metro Tenerife has a system, but it isn’t SIL 2, and a few other networks also employ some measure of overspeed protection, but not to the standard that TfL required. So, the only thing was to develop a new system, using proven technology if possible.
Tracklink III
Sella Controls has developed, over the years, a track-to-train communication link originally developed for selective door opening (SDO). This consists of a sealed track or lineside-mounted beacon that is powered from the radio signal of the train interrogator unit. The beacon is coded with data for the specific location and the information exchange between beacon and interrogator can be used for a number of applications.
For SDO, 18 fleets of UK trains are now equipped with the system. The radio link is in the 865.7 to 867.9 MHz unlicensed band and power levels of around 200mW give a range of around one metre. Rail Engineer articles on the SDO system appeared in issues 58 (August 2009) and 102 (April 2013).
Although, when used in SDO mode, trains are normally stopped at a station, tests showed that Tracklink III could get an acceptable number of ‘reads’ at speeds of over 70mph.
Could the system be adapted for the London requirement? Discussions between ESG and Sella Controls led to the emergence of a practical solution.
System design and application
The Sella Controls system has three basic component parts – firstly, the track beacons mounted transversely between the running rails, secondly, the underfloor beacon readers mounted on the underside of each tram and, thirdly, an on board controller (right) unit that monitors all the beacon ‘reads’ and which is linked to a 4G public cellular radio connection or Wi-Fi for reporting back to a workstation in the control room.
The onboard controller is being supplied by EKE Electronics of Finland, with whom Sella Controls has a partnership. The company is an independent supplier of TCMS (Train Control and Management Systems) and its Trainnet product is being used for this project.
A fourth unit is a cab display that indicates that the system is operating normally, whether a trip has occurred, a reset switch and a ‘break glass’ bypass facility. A driver activating a cab for a journey automatically connects the display of that cab to the onboard controller while a connection from the controller unit to the brake circuit enables the brake to be applied should a trip occur.
On the approach to any significant curve, a series of beacons (up to four) will be positioned some distance in advance of the curve. Each beacon will be programmed with the maximum permitted speed at a specific point ahead which represents the start of a slowing down zone, thus a four-beacon arrangement would signify four zones.
The train odometry then measures the distance to the start of the first zone, this zone being typically 150 metres in length. The speed at that point is likely to be the line speed, which is already set at a maximum of 70km/h. If that speed is exceeded, the system trips in and a full service-brake application is made.
The second beacon would similarly give a speed and distance for the start of the second zone, the zone distance being shorter (typically 30 metres) with, say, a maximum speed of 60km/h, as the tram should be slowing down for the curve.
Similarly, the third beacon would give a speed for the start of the third zone at, for example, 40km/h and the fourth beacon indicates the speed near to the start of the curve – typically 20km/h.
Under normal driving conditions, the speed at the beginning of each zone should be well under the maximum speed permitted but, if the tram exceeds this, then a trip occurs and a service-brake application is made, bringing the tram to a stop.
The exact distance from the beacon to the zone start is not critical but will be around 60 metres. The zones are ‘virtual’ and are not marked in any way. Each beacon will be programmed with the distance to zone commencement, zone length and maximum tram speed within that zone. The four-beacon arrangement is such that the combination of all four can be positioned before the commencement of the first zone, so the tram odometry equipment is vitally important in monitoring the slowing down process as it has to measure the distance to the start of the different zones simultaneously.
If the curve is not so tight and thus the speed is higher, it is likely that fewer beacons will be required, but there will always be a minimum of two.
Should a trip occur and the tram stops, the EKE controller will immediately and automatically notify the London Tram control room of an over speed activation, following which the driver must speak with the control room to arrange a re-set. An instruction to activate the reset switch will then be given whence the tram brake can be released and the tram proceed on its journey. The onboard controller unit, with its data recording facility, will log every pass over a beacon and whether or not the tram is near the speed limit at that point.
Fitting the fleet
There are two types of tram in the fleet of 36 in London, supplied by Bombardier and Stadler, and both are already fitted with speed sensors and odometers. ESG and Sella Controls are undertaking the design of the system jointly, with ESG delivering the integration design of Sella’s system to the vehicles and for retro fitting the trams with the reader and controller equipment, including interfacing these to the brake and odometry circuits.
Sella has said that a ‘first in class’ fitment will be ready for testing in August 2019 and, following a reliability validation period, it is planned to fit the system to one tram every four days, with completion by the end of the year.
Once the system is commissioned, every tram will go through a test routine as it leaves the depot each morning, to prove that the onboard equipment is working.
Future potential
Clearly the seriousness of the accident meant that doing nothing was not an option for TfL, and many eyes from elsewhere will be watching as to the performance and effectiveness of the system once it is in service.
A SIL 2 system was called for in the specification, but alternative options are likely to be considered by other tram operators, both in the UK and abroad. A SIL 0 system, based upon SatNav positioning and an associated speed alarm but without direct intervention to the tram brakes, might be an option. It will all depend on the risks perceived.
Much will depend on the cost of fitting any future system. The costs for the Croydon system are not being disclosed, but the bulk of this will be in retrofitting the trams. The track beacons are relatively cheap and fitting on board equipment to a new tram is always much easier and cheaper than retrofitting.
It will be interesting to watch how over speed protection measures are progressed into the future.
