Proceedings 2002/2003 - IRSE

INTERNATIONAL CONVENTION 89
the system and development documentation, Signal
Engineering submitted the ‘Cerberus’ system for
third-party validation. This was undertaken by the
Victorian firm of R2A Risk & Reliability Associates Pty
Ltd. The result of the validation exercise was the
conclusion that the system offered a significant
improvement in the level of safety currently provided
by RAC’s level crossing protection equipment.
Today, ‘Cerberus’ monitors are installed throughout
New South Wales. Following resolution of issues
with location and operation of the Control Centre
workstations, a final implementation phase is now
under way to bring all monitors reporting on-line to
Control Centres at Orange, Broadmeadow, Junee
and at the Network Management Centre in Sydney.
INDEPENDENT SAFETY VALIDATION
From the initial feasibility report, it was considered
inevitable that the would eventually be required to
provide data acceptable as legal evidence, in
inquiries following a level crossing accident or
fatality. For that reason the software design and
testing has needed to be augmented by a more
stringent process of specification, documentation
and independent validation, to produce a record that
can be presented unchallenged as legal evidence.
R2A Risk & Reliability Associates Pty Ltd were
selected to undertake the Independent Safety
Review of the 'Cerberus' level crossing monitoring
system. This review covered:
• Assessment of the existing RIC level crossing
testing procedures and supervision process.
• Assessment of the ‘Cerberus’ Level Crossing
Monitor System to determine the level of likelihood
(from rare to almost certain) that a
‘Cerberus’ Level Crossing Monitor would indicate
that a level crossing is operating correctly
after the passage of a train when either the level
crossing equipment and/or the monitor unit
were functioning incorrectly.
• Assessment of the ‘Cerberus’ Level Crossing
Monitor System to determine the level of likelihood
(from rare to almost certain) that the officer
responsible for the Control Centre is not
informed of a problem with a monitored level
crossing, within 25 hours of the problem having
occurred.
• Assessment of the of ‘Cerberus’ Level Crossing
Monitor System in regard to:
i) compliance with the Level Crossing Monitor
Requirements Specification and the Level
Crossing Monitor Control Centre
Requirements Specification.
ii) the adequacy of the Preliminary Hazard
Analysis documents.
iii)the adequacy of the system (including
procedures) in its mitigation of the hazards
identified in the PHA.
• Comparison of the two methods of level crossing
testing and supervision to determine their
relative performance in providing safe and
reliable operation of level crossings.
The work involved input from all of the designers
and from field engineers who were installing and
using the ‘Cerberus’ level crossing monitoring
system.
The final report recommended a number of minor
enhancements, all of which have been implemented.
The independent review concluded that replacing
the present procedures for daily visiting and testing
of level crossings with remote level crossing
monitors tested by and reporting through monitor
control centres to responsible maintainers would
result in improved safety of the level crossing
protection.
INNOVATIONS
The ‘Cerberus’ Level Crossing Monitor System
was developed to fulfil a need for a product which
was not available in the marketplace. For that very
reason, the developing team had to find innovative
solutions for a number of design ‘problems’, adapting
technologies from other engineering disciplines
where available, or developing the solution from first
principles.
LAMP CURRENT MEASUREMENT
The first and most important step in developing
the ‘Cerberus’ system was the development of an
accurate and reliable method of monitoring the
integrity of the crossing signal lamps. The requirement
that the monitor had to be easy to retrofit to
existing level crossings eliminated the option of
installing individual sensors in the signal lamp units.
The chosen solution was to measure the lamp
currents at source, in the control hut, and from that
calculate the number of lamps operating at any time.
The task of developing the prototype lamp current
sensor and supporting software was undertaken by
one of our cadet engineers as his final year
University project.
Subsequent refinements to the design overcame
the problem of high peak currents drawn by cold
lamp filaments, and developed a ‘learning mode’
used in setting up the monitor at a crossing. This
mode is used to teach the monitor the numbers of
lamps operating and the corresponding current
levels at that particular crossing.
Current sensors are also used to monitor the
battery test current during the remote test of the
crossing.
As a by-product of the ‘Cerberus’ programme, the
lamp current sensor is produced as a universal
AC/DC current sensor. This can be used for safe
isolated measurement of analogue current levels in
circuits, DC or at AC frequencies up to 3kHz.
SPECIALISED INTERFACE DEVICES
As the ‘Cerberus’ system was being developed,
and to support its introduction this and other
monitoring and logging systems, Rail Services
Australia has developed its armoury of interface
devices, able to safely and continuously monitor any
aspect of the operation of the signalling system.
Items completed and available for general use,
and their applications, include: