IRSE INTERNATIONAL TECHNICAL COMMITTEE

Topic 49

Track Worker Safety

Version 5.1 dated May 24th, 2018

Written and edited by Wim Coenraad and Rod Muttram on behalf of the International Technical Committee of the IRSE and based on the President’s series presentation on 15th March 2018

version 5.1 dated March 24th, 2018

We gratefully acknowledge the contributions made by Mark Prescott or Network Rail and Sudhir Prabhu for providing information for this paper.

Table of Contents

Introduction

Functions and Practices

Function

Practices

Warning

Evacuate the Danger Zone

Use of Lookouts

Use of mobile technical warning systems

Use of Permanent Technical Measures

Protection

Use of Temporary Speed restrictions

Block the Track

Possession

Possession Management

Supporting Systems

Worker Warning/Alerting Systems

Lookout Operated Warning System (LOWS)

Automatic/Train Operated Warning System (ATWS)

Signals and Signal Controlled Warning Systems (SCWS)

Level Crossings

Protection Measures

Speed Restrictions

Safety Fencing

Mobile Enclosures on wheels

Implementing Possessions and Boundary Protections

Shunting Zones

Train Alerting Systems

Train Stops

Train Emulation

Clipping and locking points

Point detection circuits

Dummy Fuses and links

Ground Frame

Level Crossing inhibition

Possession Management

Contract with signaller

Hand held terminals

Emulating trains

Evolution

Strategies

Prevention is preferred

Examples of New developments

ATOS (Japan)

BDK’s Future Traffic Management System possession management functions (Denmark)

ProRail Work Zones (Netherlands )

Railroad Worker Protection System (US)

ÖBB (Austria)

Network Rail’s Trackworker Safe Access Strategy (UK)

Tactical Systems

RDD Remote Disconnection Device.

Figure 17 LEWiS Lineside Early Warning System

LEWiS (Lineside Early Warning System)

Strategic Systems

Traffic Management Protection System:

Strategic Signal Controlled Warning System (SCWS):

SBB (Switzerland)

Conclusion: where is technology taking us?

Sources

2.Introduction

The focus of this paper is heavy rail; many of the principles also apply to metros, but the prevelence of tunnel and elevated infrastructure for those systems pose particular risks and issues. The ITC may consider a suplement for Light Rail and Metros at a later date.

Working on or near the track and on-going train traffic do not mix. At least that is the predominant opinion nowadays for many railways. Increasing train frequencies and speed combined with societal risk averseness tend to enforce regimes where track workers and train traffic are separated, in time, space or separated by physical barriers. Currently, in some countries, (e.g. the Netherlands) working on or near the track is only allowed in possessions and even neighbouring tracks are not allowed to be in service. This imposes such restrictions on the possibility to perform maintenance and repair activities without disruption to traffic, that ProRail’s newly appointed CEO has publicly voiced his concerns that we are going “over the top” in our safety concerns and should be more pragmatic. It is thus topical for IRSE to make a survey of track worker protection practices and systems and examine emerging best-practices, especially in the light of the options presented by recent technological advances, such as the “Internet of Things”

In this report, the IRSE ITC presents a survey of methods, systems and practices in use to protect track workers. Whilst in the past the use of signalling systems to provide warnings of approaching trains for track workers was deemed “too expensive”, current practice seems to be that announcement and warning systems and devices need to provide at least the same level of safety as the control and command systems for trains. At least to some degree changes in technology are making such systems more practicable and affordable. Intelligent infrastructure is a primary source of risk reduction for Trackworkers but there will always be a need to go on track for some tasks such as maintaining switches and crossings.

3.Functions and Practices

3.1.Function

The function of a track worker protection system is to ensure persons working in or near a track cannot be harmed by trains. Expressed in terms of a hazard to be mitigated, it is defined as avoiding a collision with a moving vehicle resulting in casualty or injuries of staff. There are many more aspects related to the health and safety of persons working in or near the track, such as electrocution, pinching, falling and exposure to dangerous substances that are outside the scope of this article but which, of course, must be considered in planning any work.

3.2.Practices

Preventing conflict between workers and trains can be achieved through warning workers of approaching trains in their own or neighbouring tracks, by protecting workers and their workspace from trains, or by simply ensuring that train traffic is stopped when work is in progress, by taking possession of the track, line or station.

In some cases, not only do regular trains, scheduled or unscheduled, pose risks, but engineering trains and other “yellow fleet” vehicles moving inside the work area are also potential causes of a hazard. Further, a ‘whole system’ approach is necessary to avoid hazards from uncontrolled vehicles (c.f. a Tebay situation, (see https://en.wikipedia.org/wiki/Tebay_rail_accident) ) and other hazards such as electrification.

Most infrastructure managers use different types of track worker protection equipment in conjunction with pre-defined procedures. The range (as well as the combination) of the measures to be implemented / used depends on national rules and the local situation.

A recent CEN Standard (EN16704) defines a hierarchy of measures and the conditions under which they should be used. This is intended to harmonise working practice in this area across Europe. It is relatively new and local working practice does not yet necessarily align with it.

The following regimes for working on or near the track have historically been common:

Out of Service (Total Possession)

Physical barriers between work areas and open tracks

Controlled Admission (of trains and work vehicles) to track otherwise under possession

Assured warning of approaching trains by a technical system

Personal Observation (by an individual worker or a lookout)

Technical systems can be used to support trackworker protection based on Personal Observation or Assured Warning, depending on their properties and deployment. In most cases evacuating the danger zone is required when a warning is issued. Of course, this does not apply when all or part of the railway that constitutes a work-zone is out of service, usually referred to as ‘under possession’.

Controlled Admission is a term to describe a system where work trains, engineering vehicles etc. are allowed to enter or leave a possession, usually requiring some form of cooperation between the Person in Charge of the Possession, the signaller and the drivers of the vehicles concerned.

3.2.1.Warning

Evacuate the Danger Zone

Traditionally track workers kept an eye on oncoming traffic and stepped out of the track or moved to a “safe haven” when they saw a train approaching. This of course required line of sight (and attention) to be able to spot an approaching train and is incompatible with the use of some personal protection equipment such as hearing and eye protection and the use of noisy equipment. Nowadays this method of working is largely considered unacceptable. Remnants of this practice can be observed when track workers wave to the driver of a train to acknowledge they have seen him approaching.

Use of Lookouts

To assist track workers when lines of sight are inadequate, one or more lookouts can be posted whose sole task is to watch for oncoming trains and warn the gang to evacuate the track. Traditionally the lookout blows a horn to alert the gang.

A system of evacuation requires trackworkers to be able to step out of the track and reach a position/place of safety quickly and also prohibits the use of tools and machinery which cannot be removed quickly.

Use of mobile technical warning systems

Historically, at least in some countries, detonators were used to protect worksites by warning drivers if they crossed a worksite boundary, and perhaps these sometimes had the secondary benefit of alerting the workforce.

More recent Mobile Technical Warning systems typically use sirens and flashing lights to warn a track gang of an oncoming train. Activation can be manual by a lookout, or automatic through some form of train detection. Usually these mobile systems need to be installed prior to the works, requiring a degree of planning and another method of protecting the installation crew.

Use of Permanent Technical Measures

Where the installation of mobile technical warning systems is too cumbersome, or their use too frequent, warning installations can be installed permanently. Typical examples of such locations include bridges, cuttings and tunnels.

￼

Figure 1 Fixed warning system in a tunnel

3.2.2.Protection

Use of Temporary Speed restrictions

Temporary speed restrictions are used mostly to allow train traffic to continue on adjacent tracks ensuring workers will either have enough time to reach a position of safety, are protected from pressure waves etc. Usually when train speeds and frequencies increase, this practice is no longer allowed.

Block the Track

In some countries (cf the Netherlands) the view is that working on or near the track whilst train traffic is in operation is no longer acceptable and track work is only permitted when traffic in an area (of a station or yard), on a track or even a complete line is stopped. Work is only allowed with the track blocked in a “possession”.

Often such a blockage can be agreed between track workers and signallers as a kind of “contract”. The making of this ‘contract’ between people presents a risk of human factors error and is one reason why this method of working cannot just be assumed to be completely safe.

Possession

A possession is defined as a work regime where the area under possession is separated from the operational railway and controlled by a “Person In Charge Of Possession (PICOP). Train movements are normally stopped but in some cases the PICOP has the power to allow engineering trains to enter the possession and/or move within it (controlled admission).

The possession can take the form of a “contract” between the PICOP and the signaler, with or without additional technical safeguards referred to as “boundary protection”. A possession can be pre-planned as part of the time table development for the “daily plan”, or (for example in an emergency) it can be agreed verbally, usually supported by some form of pre-defined protocol and registration. This can be usefull for short ad-hoc possessions needed for immediate corrective actions.

A possession may or may not require “boundary protection measures” such as the blocking of signals protecting routes into the area under possession, ensuring turnouts are locked in a diverting lie, away from the possession area etc. The area under possession can take the form of a station area, a track on a multiple track line, or a complete line. If only one track is blocked in a multi track section other protective measures such as barriers may also be used/needed.

Possession Management

Advanced systems of possession management can allow pre-defined areas to be taken, e.g. using lineside key switches (‘lockouts’), or even allow possessions to be planned and managed using timetabling, traffic management and interlocking functions. Such management sytems allow more time to check and verify planned possessions and use pre-programmed “scripts” to set and lock boundary protection measures, and remove them. Using preprogrammed possesions and scripted actions reduces the risk of human error, but may possibly increase the integrity requirements (“SIL level”) of timetable planning and Traffic Management systems that implement them. This is an area where we need to apply some common sense; if we are replacing very low integrity human processes then the the cost of over-specifying systems to high levels of integrity may mean that possible improvements are ‘priced out’. We must avoid ‘the best being the enemy of the good’.

4.Supporting Systems

In this chapter, we give some examples of technical systems used to ensure or enhance track worker safety, ranging from traditional low-tech to state of the art communications based systems. However, no claim of complete coverage of the range of systems in existence is made.

4.1.Worker Warning/Alerting Systems

4.1.1.Lookout Operated Warning System (LOWS)

“Systems” that allow a lookout to warn the track gang under protection can range from horns and whistles to remote controlled personal warning devices such as headsets (which can be required when ear protection needs to be used) and/or pre-installed sirens and warning / flashing lights. As these systems are only effectively delivering or distributing a lookout warning they suffer from the same potential human error rate in terms of missed alerts; they may somewhat improve the rate of observation of warnings. The ‘send’ part of the system sometimes includes a form of ‘hold down’ switch such that if the device is put down, dropped or the lookout totally loses concentration an alert is sent (see the functional requirements in EN 16704-2-1).

￼

Figure 2 lookout operated Warning device transmitter (photo courtesy of Schweizer)

4.1.2.Automatic/Train Operated Warning System (ATWS)

Remote controlled personal warning devices such headsets and pre-installed sirens and warning / flashing lights can be operated by some form of train announcement such as wheel sensors or by automated or autonomous “proximity sensing” or conflict detection based upon geo-location of trains and individuals working in or near the track. In some cases elements of the signalling system, with a warning function, such as level crossings can be used to alert track workers as well, if the warning times and locations to be protected happen to coincide. Fully automatic systems cancel the warning as the train leaves the area, Semi-automatic systems can save detectors and cables by only fitting the approach side of the site/track and having the warning cancelled manually. Of course, this also has some human factors risks. (Again, see the fuctional requirements in EN 16704-2-1).

ATWS is produced by several manufacturers and is a warning system that issues an alarm, using sirens/horns and flashing lights in a work zone when a train is approaching on an adjacent track. It requires all staff and machinery to move to a position of safety. In some countries plant is also allowed on the track and must move clear, in others this practice is banned for fear of mechanical/reliability issues preventing the plant getting clear of the running line. Once the train on the adjacent track has passed, the alarm stops and work can be resumed. The system uses a “fail safe” central module that process activation and de-activation inputs and operates the warning lights and sirens/horns. The activation can be through the use of treadles, axle counter heads or similar.

￼￼

Figure 3 ATWS wheel sensor and trackside warning equipment (photos courtesy of ZÖLLNER).

4.1.3.Signals and Signal Controlled Warning Systems (SCWS)

In many cases signals and features of the signalling system can be used both to block tracks and/or to warn track workers. OBB, SBB and Infrabel all have SCWS (for example the Thales FieldTrac 6392) and both Network Rail and Deutsch Bahn have systems in development to meet the requirements of EN 16704-2-1 for their specific needs. This reflects the pressure on available possession time. On the ProRail network signals warning of approaching trains are used in locations where lines of sight are obscured, such as on bridges, in tunnels and near overpasses.

￼

Figure 4 Track inspection near bridge using a form of SCWS (photo courtesy of ProRail)

Figure 4 shows a track inspection near a bridge with a fixed warning installation (WIBR) for approaching trains from that direction

4.1.4.Level Crossings

An automatic level crossing warns road traffic of approaching of trains. On some networks it can also be used by a trackwork team (via the safety responsible), provided that the actual announcement time for when a train approaches the workplace is sufficient. As an example from ProRail guidelines, at a typical level crossing warning time of 25 sec. and a minimum required track worker warning and evacuation time of 30 sec. the level crossing announcement can only be used for a working area, which is 5 sec. beyond that level crossing and then only for that direction of traffic, where the level crossing is downstream of the workplace. In the other direction, the announcement time is insufficient, and a different solution is required. Note that this method is not allowed on other networks such as Network Rail and is not included in the hierarchy of controls in EN 16704-1; it is for question whether it will continue to be used in Europe as railways move into compliance with the standard.

4.2.Protection Measures

4.2.1.Speed Restrictions

Speed restrictions, usually for trains in tracks adjacent to workzones, can be in the form of temporary signs advising reduced maximum speeds, ATP enforced through additional balises or the inhibition of less restrictive speed codes in continuous ATP, or Movement Authorites with reduced speed profiles. In most situations a speed restriction alone would not now be considered a sufficient risk reduction measure.

4.2.2.Safety Fencing

Fences can be used to prevent workers from accidentally stepping on to a “live” track. Implementations vary between safety chains on “sticks”, or simple high visibily mesh, to robust fences and railings that will resist a worker falling against them. Several quickly deployable safety barrier systems are available. The requirements for such barriers can be found in EN 16704-2-2.

￼

Figure 5 Safety Fences protecting a worksite from access to the Profile Gauge

￼

figure 6 Simple plastic mesh Fences in Duffel Belgium

4.2.3.Mobile Enclosures on wheels

A coach-type enclosure allowing access to the track and equipment installed in allows work to be carried out without requiring a multi track possession. The mobile workspace can be driven onto a work site. It prevents the workers from leaving the protected area whilst at the same time using the signalling system to prevent conflicts with other trains (it is no different to any other train from the system’s perspective. This type of method is particulary suitable for work on on-track assests such as re-progamming balises.

￼

Figure 7 Mobile workspace

4.3.Implementing Possessions and Boundary Protections

Shunting Zones

On NS, in station areas shunting areas can be configured to provided protected work zones. If the shunting area is activated, a well-defined area of the station’s interlocking is isolated. Once the shunting area has been “given” (by the signaller” and “taken” (in this case by the PICOP) no routes can be set into and inside the shunting area. This creates a work zone with boundary protections.

Train Alerting Systems

In most cases alerting a train of ongoing work in its path is not a very effective way to safeguard track workers, but it can be used as a supplemental risk reduction measure where traffic is not stopped in or near work zones; for example for engineering trains. Signs, flashing lights, stop boards etc are used in situations where an approaching train is to be warned of approaching a workzone or an engineering train moving inside a workzone of approaching the limit of that workzone. Where a modern ATP system is fitted this may be used to enforce stopping points, low running speeds, etc. And in the US at least one manufacturer sells a system which issues warnings to drivers and workforce as a backup to more conventional methods such as lookouts.

Train Stops

Taking the alerting of a train of approaching a workzone to its logical conclusion it is possible to installtrain stops, such as balises, atp magnets and beacons and even derailers to prevent a train from making an unauthorised crossing of the workzone or posession boundary.

Train Emulation

Track worker protection systems can use use the signalling system’s inherent functions that prevent conflicting train paths or moves by allowing the workers to emulate the occupancy of a train. The simplest form is a track circuit operating device (TCOD). The TCOD when placed between the running rails connects them together electrically, emulating a train and ‘dropping’ the track circuit. TCODs can be locked in place, to prevent mistaken removal and more recent implementations can use remote control to start and stop the track shunting function. Thus the devices can be installed and left in place prior to (a series of) possessions, optimising the available work time.

￼

Figure 8 An example of a modern TCOD is Dual lnventive's ZKL 3000 RC - a remote controlled track circuit operating device.

Where track circuits are used, it removes the requirement for the use of detonators and/or marker boards, which had to be installed by track workers out on a live track. Managed by one 'registered user’; the system allows for the realtime monitoring of live projects. ProRail (the Dutch equivalent of Network Rail) made the decision to install nearly 500 ZKL 3000 RC remote control TCODs across their network's infrastructure. At Amsterdam station, a mass of switches and platform lines now have possessions controlled entirely by TCODs.

In the Netherlands, short possessions are preferable, so ProRail chose to implement TCODs in order to provide a series of flexible worksites across the country, 105 in Amsterdam alone. After a single year of use, there has been an increase in productivity of around 20 per cent, while nearly 270 working hours were gained by teams not having to implement and remove safety measures, and nearly 500 fewer track worker hours were spent in a place of danger.¹

Network Rail uses ZKL3000 TCODs in a similar fashion and will trial Remote Disconnection Devices (RDD) installed in signalling locations – see section 6.3.

Clipping and locking points

Traditional point clamps and locks can be used to lock points in a position leading away from the workzone/possession.

Point detection circuits

By removing a prewired connector from a junction box the detection circuits of a turnout can be interrupted. This inhibits clearing a signal, including using a proceed on sight aspect, across the turnout.

Dummy Fuses and links

Boundary protections can be implemented without changing the signalling circuits by removing fuses and links and replacing these with insulated dummies. These dummies have unique numbers. This requires qualified signalling staff to prepare and implement these measures.

Ground Frame

In some locations in stations and open lines manually operated turnouts with electrical locks are present. These can be used to inhibit route setting and signal clearance by unlocking the ground frame. To prevent inadvertent restoring of the ground frame, these turnouts then must be clamped and locked, because the electrical locking device itself cannot be padlocked.

Level Crossing inhibition

ProRail: The key switch that is normally used to de-activate the train announcement to the level crossing when an engineering train is present in the strike in zone, can also be used to keep the signals in the approach to the level crossing at danger.

4.4.Possession Management

Taking possession of a station, track or section of line is the most used way of separating track workers and trains physically. It requires a system to manage the posession, typically arranging for traffic on the tracks to be suspended, after which the authority for the posession is handed over to the PICOP (Person in Charge of Possession). The PICOP is in charge of allowing (engineering) trains to enter his area under posession and to move within it if the work needs that. After the works have finished and the tracks are verified to be safe for the travel of regular trains, the PICOP hands the area under posession back and train traffic can be resumed.

The management of this posession can be arranged through “verbal agreements”, written authorities or mananged by special systems in interlockings and/or traffic management systems.

It requires a means of identifying the tracks that are under possessions and the possession boundary/boundaries, both for the parties handing over authority to the PICOP and the workers in the field. It also requires means to prevent trains entering the area under possession without authority.

Contract with signaller

Defining, taking and handing back possessions through “contracts” with the signaller can be done verbally, but introduces the risk of misunderstandings and misinterpretations so requires a very strict form of communication protocol and logging. Preferably the area under possession is defined prior to the work being carried out as well as the identity of the PICOP and controller, their means of communication and any boundary protection arrangements

Hand held terminals

Hand Held Terminals, either using specific hard- and software or “mobile phone apps” linked into a central control system can be used to transfer control of taking and handing back the area under possession to the PICOP. The hand-held device can, at least to a degree, use the device’s location information to check the area under possession corresponds to its location. When this locating principle is deemed either too insecure or not precise enough tags, e.g. RFID or barcode labels (that may be added, or already be in place to identify assets), can be used to provide location information.

Emulating trains

In Communications Based Signalling Systems, such as CBTC but also in ETCS Levels 2 and above, the principle of using a TCOD to emulate a train can be extended to portable equipment emulating an on-board unit.

5.Evolution

Given the fact that many railways are approaching the limit of their networks’ capacity, are hoping for capacity increases promised by ERTMS and CBTC systems and/or are nearing a 24/7 operation, the increased use of the infrastructure is bound to increase the need for maintenance but the available time for doing it is decreasing; potentially a vicious circle results, and the issue must be addressed.

The general trend seems to be to enable track workers to establish a safe working zone themselves and delegate the authority to authorize engineering trains and such to move into, out of and within the area under possession to a person in charge of the possession (PICOP). The tendency is to plan the required possessions into the timetable as much as possible, minimising signaller/dispacher involvement in decision making and to implement technical systems that minimise the time wasted in ‘handover and handback’. An example of such practices can be seen in the use of hand held terminals as part of the ERTMS system in the Netherlands and currently under development in Denmark and for PTC in the US.

Where possession cannot be used for whatever reason many railways have or are implementing SCWS as the most acceptable alternative control.

5.1.Strategies

5.1.1.Prevention is preferred

EN 16704 includes a hierarchy of measures with full separation preferred, signal controlled warning systems as second choice, followed by automatic warning systems and only then systems requiring human vigilance.

In line with existing strategies for dealing with occupational hazards, Prevention is the guiding principle. It follows then that stopping train traffic when workers are active is the preferred option. This can be done through taking possession of a line or station, or where this is not possible by taking possession of one r more tracks and ensuring a physical barrier prevents trains from entering the area under possession.

Where prevention is impossible, the second best option is to control the hazard either by reducing the probability of the hazard occurring, or by mitigating the consequences. Such practices include the use of warning systems, speed reductions and safe havens where workers can remove themselves from the path of an approaching train.

￼Content Placeholder 1

Figure 10 EN 16704 Hierarch of measures

6.Examples of New developments

The following are some examples of Developments in progress or recently completed, the list is by no means exhaustive.

6.1.ATOS (Japan)

In Japan, in their conventional traffic control systems, route setting for shunting and track worker management/protection is excluded from interlockings because the complexity that would be needed, and these functions are carried out locally at stations (it is too complicated to control these from the control centre). This means there is little or no benefit from introducing conventional traffic control systems into Tokyo metropolitan commuting lines (due to numbers of station staff that would still need to be retained). The safety of trains and workers performing maintenance work conventionally uses a mechanism of ensuring safety by human interaction and personal attention; the culture in Japan is one of compliance to rules.

In the new ATOS system (JR East’s Autonomous Decentralized Transport Operation Control System), maintenance workers themselves request access with the support of the system, and maintenance work and train collision prevention are realized by the system, and as a result safety and efficiency has improved. The difference between conventional traffic control centres and ATOS's specific features is that its automatic route setting for trains covers all stations including large stations. The dispatchers interrupt/change the route setting for trains in the case of traffic disturbance, but they do not need to be involved in route setting for shunting nor track worker management/protection because these functions are carried out by the interlocking systems and workers themselves.

Start / end maintenance work

The adjusted maintenance work plan is input to the information terminal at the technical centre and registered in the central control system (maintenance work database), and the maintenance worker then uses a work terminal to get the general purpose electronic interlocking to perform a start request operation. In the general-purpose electronic interlocking device, safety checks such as whether the trains scheduled before the beginning of the work have actually passed and whether any train in the direction to approach the site has not yet departed is checked, and then the related equipment is locked so that trains cannot enter the workzone. A message indicating that it is safe to start work is displayed on the work terminal.

If maintenance work cannot be carried out as planned due to disorder of the train schedule or the like, the Dispatcher will decide to defer the maintenance work.

Note that the work terminal has two modes, a wireless connection and a wayside phone connection, according to the available method in the area concerned.

￼

Figure 11 ATOS hand-held terminal (photo courtesy of Nick Thorley, Network Rail)

￼

Figure 12 ATOS maintenance planning workstation (photo courtesy of Nick Thorley, Network Rail)

6.2.BDK’s Future Traffic Management System possession management functions (Denmark)

In Denmark the ETCS based signalling system that is currently under development and test will provide a more advanced means of defining and managing possessions. The following description is based on the specifications.

TMS

The Traffic Management System allows the use of Planned Possessions that are integrated in the daily Online Production Plan (OnPP). It provides interfaces to Control Room Users to set up, modify, negotiate and hand back possessions jointly with other Task Owners. The TMS supports the HHT (Hand Held Terminal) Control Room User in cooperating with the PICOP in order to start a possession properly, through a messaging infrastructure, sending and receiving notifications to/from PICOP in charge of the possession. The Control Room User must approve a possession started by a PICOP or can request a possession himself. The TMS also supports possessions not associated with a HHT issuing the necessary route controls or points movements. It also supports setting up emergency temporary speed restrictions.

Possession planning

The TMS supports defining, modifying and terminating possessions. Possessions are managed through a state diagram. Operating on their status it is also possible to simulate their effects before activating them, checking the possible divergences from the timetable (OnPP) that they could cause.

HHT

HHT is the hand-held terminal that greatly enhances the productivity of maintainers with a powerful, easy to use mobile device. The HHT is designed for the management of the possession of working areas (acquire/release possession, block areas already under possession, transfer the ownership of areas) and for the control of switch points inside the possession working areas without moving physically to a fixed lineside panel potentially installed in a distant location along the line.

The HHT can be considered as a portable TMS HMI, providing the same functions as the ones available to an operator in the TCC with only the access rights corresponding to the maintainer missions. they are connected to the central TMS server through a WEB interface and GSM-R infrastructure (in GPRS mode).

From the HHT is possible to perform any TMS functionalities with the respect of the assigned roles. Usually HHTs are provided for Maintainers, PICOPs, Shunters and other well identified figures, but they could be assigned to any person that needs a mobile work place.

￼hht

Figure 13 Hand Held Terminal

6.3.ProRail Work Zones (Netherlands )

Work zone protection is implemented by enhancing interlockings with the functionality for work zone protection. In applying this kind of protection, the entire rail infrastructure controlled by the interlocking is split up into a number of work zones of fixed dimensions. Work zones are uniquely identified and do not overlap; every infra element (such as a points or track section) belongs to exactly one work zone.

A work zone at a junction typically comprises two to five points. A single track between two junctions comprises just one work zone. Figure 4 shows an example of the work zone layout for a part of the Betuweroute.

￼

Figure 14 Example work zone layout

These work zones become interlocking entities, with the same integrity level as routes and shunting areas. During the execution of works, the work zones are taken under possession in their entirety and are, after completion of the works, taken back in service again. When a work zone is taken under possession, the interlocking provides the necessary precautions to protect the work zone from normal train traffic.

Taking and giving up a possession is done in the following way. At the start of the work the signaller takes the work zone out of service, whereupon the LWB², e.g. by operating a local keyswitch, takes the work zone into his possession. After the works have been completed the LWB gives up the possession by returning the switch to its normal position, whereupon the signaller takes the work zone back in service.

The interlocking enforces the correct sequence of these actions. A work zone cannot be taken under possession by the LWB before the signaller has taken it out of service. This way the signaller is able to keep control over the area under his responsibility. Once a work zone is under possession, the signaller cannot take it back into service before the possession has been given up by the LWB.

Work zones and conflicting routes, i.e. routes leading to or crossing the work zone, are mutually exclusive. When the signaller takes a work zone out of service, the interlocking checks that no routes conflicting with that work zone are set. When a work zone is out of service the signaller can no longer set routes conflicting with the work zone.

The flank protection points of a work zone are steered and locked in the position deviating from the work zone when that work zone is taken out of service. This prevents a train passing a signal at danger entering a work zone under possession, whilst at the same time preventing any engineering trains driving or rolling out of the work zone fouling the tracks still in service.

For high-speed lines a temporary speed restriction can be applied to tracks adjacent to the work zone, to prevent track workers and/or their equipment being caught in the turbulence of a passing train. Typically the speed is restricted to 130 or 140 km/h.

6.4.Railroad Worker Protection System (US)

Within the different PTC implementations in the US (there are essentially four different PTC solutions) some require a HHT and vehicle mounted terminal based solution for Railroad Worker Protection interfacing to a maintenance workstation which is integrated into the ‘Office’ system which is the heart of the PTC wayside. This allows the rapid and secure handover and handback of possessions/line blocks in a similar way to the Danish ETCS based system above but within the US the principle of a handover and handback between Worker and Dispatcher seems to be still preferred over a higher level of timetable planning. This probably reflects the predominantly freight nature of US railroads with less repetitive timetables.

￼

Figure 15 Example of RPWS Office architecture form the Long Island Railroad requirements

6.5.ÖBB (Austria)

Like a number of European Railroads ÖBB have reacted to the pressure on capacity and reduced availability of possession time by opting to develop a more comprehensive and widely deployed SCWS the requirements for which can be summarised as:

–automatic generation and technical display of a warning

–use of the Track Warning System (TWS) both in stations and outside stations

–generation of a warning by the use of data from the interlocking – no need to fit track devices

–definition of the warning areas based on the local need for maintenance and the local infrastructure conditions

–no dependency on signals in the warning area: only to guarantee the announcement time

–Independent of interlocking supplier

–Use of GPRS for data transmission

–SIL3

￼

Figure 16 Thales response to the ÖBB requirements - FieldTrac 6392

3.Network Rail’s Trackworker Safe Access Strategy (UK)

In addition to reducing the need to visit track through intelligent infrastructure Network Rail has endorsed a Trackworker Safe Access Strategy. This strategy targets the reduction of the national risk profile of Trackworkers being struck by a train through development & deployment of enhanced protection and warning systems. These must be of a high reliability and remove the opportunity for human error. The deployment of this risk reduction strategy is planned as a phased approach over a number of years.

Network Rail’s Safer Trackside Working programme (STW) is designing and developing new protection and warning systems. These new systems will be both tactical short-term solutions to give some early reduction of risk and longer term sustainable solutions aligned to deployment of digital railway technologies.

This strategy for sustainable risk reduction is built on the principle of highly reliable train blocking systems and Technical Activated Warning Systems with

Low human error failure Modes

Low installation failure modes

Low operator competence

Low hardware costs

Low installation costs

Low system maintenance costs

A high number of installations is planned to maximise geographic coverage and availability to track workers to gain maximum impact to the risk profile.

Tactical Systems

RDD Remote Disconnection Device.

The RDD concept was developed by staff simultaneously at Manchester and London Bridge Delivery Units. The RDD is designed to mimic the signal disconnection facility available in Solid State Interlockings (SSI), allowing the process to be used in traditional relay signalling architecture. This provides additional protection for a Line blockage beyond that provided by a Signalman’s reminder appliance. A signalling technician activates the RDD from a terminal, using Control Agent software, on the instruction of the Signaller, after he has put the primary protection in place. This is in line with the existing Rule Book process. The RDD remote control switch is cut into the existing track circuit of the existing relay signalling architecture.

This technology is being prepared for trial on Network Rail infrastructure this year.

￼

￼

Figure 17 LEWiS Lineside Early Warning System

LEWiS (Lineside Early Warning System)

LEWiS is a retro fit Signal Controlled Warning System (SCWS). LEWIS will be deployed at tactical locations on the network, typically critical junctions. LEWiS is composed of two key components:

• An SSI message interpreter known as the Interlocking Monitor;

￼

Figure 18 SSI Message Interpreter

• A portable sounder with visual beacons known as the Warning Device;

￼

Figure 19 Warning Device.

The Interlocking Monitor units are left in situ in a signalling location case or adjacent weatherproof enclosures. When the track worker team wants to use the system they connect the portable Warning Device to the Interlocking Monitor via a plug coupling.

The Interlocking monitor is programmed to ‘listen’ for specific Solid State interlocking (SSI) telegrams via a connection at the data link monitoring/test points. These trigger telegrams are selected to give sufficient warning time for a team of workers to move to a place of safety at a predetermined fixed warning area. The device will also warn if there has been a critical error with the device, to provide the users with an indication that the device cannot be relied on.

LEWiS is a primary protection system and replaces the need for traditional distant Lookouts. The warning unit is less than 5Kg, non-metal and free standing and designed to meet noise and light emissions in accordance with BS-EN-16704-2-1.

LEWiS will be trialled on Network Rail infrastructure during 2018.

Strategic Systems

In order to deliver its asset management strategy Network Rail needs access to the track to perform maintenance and enhancement activities. Digital Railway facilitates the optimisation of capacity and in some cases the reduction in train headways. Consequently, it has been necessary to provide both a highly reliable protection system and a highly reliable warning system in order to enable the maintaining of assets without compromising safety.

￼

Figure 20 Digital Railway high level architecture

Traffic Management Protection System:

A high integrity protection system that removes human error failure modes, reliance on signalmen and safety critical communications. Protection will be able to be established via a mobile application integrating with the Digital Railway Traffic Management System. This system will introduce new possession management rules and more efficient use of track access

.￼

Figure 21 TMS handheld terminal

Strategic Signal Controlled Warning System (SCWS):

SCWS is a new high integrity, highly reliable Strategic Signal Controlled Warning System that can be deployed over whole lines of Route. It provides an automated warning system for trackside workers of the approach of trains towards a site of work. The objective is to reduce the reliance on lookouts during open line working and remove human error modes associated with lookouts.

Essentially, portable warning units will triangulate their position and communicate with a main control unit connected to Control Centre signalling equipment. The control unit will interface with the interlockings via EULynx data protocol and build a model of the state of the railway. It calculates the warning criteria to allow workers at the portable field unit to reach a position of safety.

Network Rail will let a contract in 2018 to undertake feasibility studies, product development and deploy prototypes.

6.6.SBB (Switzerland)

Within Switzerland there is an ongoing discussion about the track worker related risk.  In the past one injured/dead person (traveller) was considered as equal to 10 injured/dead staff personal (like track workers are). In discussion is now a relation of 1:1, that means the RAMS requirements for Warning Systems (WS) and Automatic Warning Systems (AWS) systems may increase significantly.

A new approach is being developed within the Swiss project “SmartRail4.0”. The aim is to localize any person within the track (using GPS position information) and to inform automatically both, affected train drivers as well as the WS/AWS in place.

Such CTC-based systems are not currently defined within the Swiss rule books (Eisebahnverordnung EBV) and their implementation guidelines, (Ausführungsbestimmungen zur Eisenbahnverordnung, AB-EBV). So their functional safety requirements are also being discussed.

7.Conclusion: where is technology taking us?

The introduction of communications based signalling systems, usually referred to as “CBTC” in rapid transit and ETCS level 2 or above (or similar systems like PTC) in main line railways offers potential to use the centralised knowledge of trains’ positions and speeds for better management of possessions and in Automatic Trackworker Warning Systems.

Systems that use individual warning devices as well as systems that use collective warning devices can be activated based on Movement Authorities being issued that overlap the warning zones. The logical extension of this is to treat track workers as a “special kind of train”, one that can “drop out of the sky” e.g. when a possession is given and taken and conversely can “evaporate into thin air” one a possession is given up and taken back. The possession zone itself then can be treated as a special “movement authority””, for a “train” that is mostly stationary (although there is no fundamental reason why it should be). Special care must be taken that track workers “auto location” processes have enough resolution to prevent them locating themselves in an adjacent track or entering that track mistakenly.

A number of Current implementations use RFID tags attached to infrastructure elements readers and such to mitigate that hazard and Sudhir Prabhu suggests this solution in his MSc thesis (Prabhu, 2016) Although it would be possible to implement such logic in a “radio block centre” in the case of ETCS the required standardisation and incorporation of such functions in the ETCS specifications through the European Railway Agency might be prohibitively cumbersome. An ATWS trackside system would have to be able to emulate an ETCS on-board EVC to a sufficient degree, be registered in the RBC to be able to start a communication session etc. to be able to take and give up a possession.

The hand held terminal approach as described in the Danish example would offer a more pragmatic approach, but on the other hand potentially imports a required SIL into the TMS, which is undesirable in other ways.

There are certainly many initiatives in process, and the new EN 16704 attempts to introduce a logical structure and a more standardised approach, albeit its first issue has a few language issues. It will be interesting to see how things mature and develop over the next few years.

8.Sources

Fries, J. (2012). HOW TO INCREASE TRACK WORKER SAFETY AND PRODUCTIVITY. Aspect. IRSE.

Prabhu, S. D. (2016). A Safer System for TrackWorker Warning using ETCS Level 2. University of Birmingham.

¹ Rail Engineer Feb 2017, p70

² ProRail term for a Person in charge of safety in a worksite