IRSE News 150 Nov 09.pdf

A CASE STUDY IN SAFETY
Complexity and Safety: A Case Study
George Nikandros
Chairman aSCSa, BE (Electrical), MIE Aust, CPEng, FIRSE, MACS, RPEQ
(This paper was originally presented to a meeting of the
Australian Safety Critical Society earlier this year, whose
members were not from a railway background – it is a good case
study for Signal Engineers as well – Ed.)
INTRODUCTION
Despite correct requirements, competent people, and robust
procedures, unsafe faults occasionally arise. This paper reports
on the outcomes of an investigation into a series of related
events involving a railway level crossing. Whilst the direct cause
of the failure was defective application control data, it was a
defect that would be difficult to foresee and if foreseen, to test
for. The last failure event occurred after the correction was
supposedly made. A further correction was made as a matter of
urgency.
To understand the underlying complexity and safety issues,
some background knowledge in relation to active level crossing
controls i.e. flashing lights and boom gates and railway signalling
is required. The paper therefore includes a description of the
operation of the railway level crossing controls and the railway
signalling associated with the case study.
The official incident report is not in the public domain and
therefore this paper has been prepared so as to not identify the
location of the series of incidents, the identity of the
organisations or the people involved.
THE UNSAFE EVENTS
There were three events, with the same unsafe outcome, in that a
driver of a train was presented with a PROCEED aspect in the
same trackside signal when the actively controlled crossing was
open to road traffic i.e. the flashing lights were not flashing and
the boom gates were in the raised position. Had the driver not
observed the state of the active level crossing controls and
proceeded on to the crossing, a collision with a road vehicle or
pedestrian would have been very likely; the crossing is a busy
crossing with some 4300 vehicles per day and 500 pedestrians
per day.
The first occurrence of this outcome occurred some
seventeen days after the initial commissioning of a new signalling
system and was not given the appropriate classification for
investigation and action when logged. The second occurrence
occurred two days later, a Saturday. This time the correct
classification was made and actions were immediately initiated
i.e. designer engineers were called in to identify and fix the
problem. The third event occurred five days after the second
occurrence and after the design flaw was supposedly removed.
THE RAILWAY CONTROL SYSTEM
Level Crossing Controls
The key aim of active level crossing controls is to provide the
road crossing user sufficient warning that a train is approaching
and where boom gates are provided, to close the crossing to
road traffic before the train enters the crossing. Once the train
has passed, the crossing needs to be reopened with minimal
delay. If a second train approaches the crossing when already
closed, the crossing is held closed. Figure 1 shows the typical
train trigger points for controlled rail crossings for a
unidirectional line.
Figure 1: Typical train trigger points – one direction only
Once opened the crossing needs to remain open for a
sufficient time so as to ensure that the appropriate warning is
again given to the road users.
Particularly for busy roads, a level crossing should not be
closed unnecessarily i.e. if a train stops short of the crossing at a
signal displaying a STOP aspect for a time, then the crossing
should be opened for road traffic. The signal should not then
display a PROCEED aspect, until the appropriate warning is
again given to the road crossing users.
However level crossings are rarely located to make life
simple. Having multiple tracks and locating a level crossing in
the vicinity of a station stop significantly adds complexity. More
than one train may approach the crossing simultaneously from
both directions and trains may stop for long periods of time at
the station platforms.
Another complexity which usually occurs in urban areas is the
use of road traffic control signals. There needs to be
coordination (an interlock) between the road traffic control
signals and the level crossing control signals; it would be unsafe
to have a “GREEN” aspect in a road traffic signal for road
vehicles to travel through the level crossing with the level
crossing controls in the closing or closed states. The approach of
a train needs to be detected earlier to enable the road traffic
control system to cycle in sufficient time so that the signals
16
IRSE NEWS | ISSUE 150 | NOVEMBER 2009