Differences between TPWS, ATP and ETCS

[12LDA28C]

Is it? I thought that was the whole point of the system.

It should be easy enough to find out how many SPaDs there have been on GWR and Chiltern (on ATP-fitted routes and traction) in the 20-plus years that ATP has been in operation. That number certainly won't be zero.

 

[TurboMan]

Is it? I thought that was the whole point of the system.

If the train speed is less than the release speed then it's possible to pass a signal at danger, but the low speed means the train will be brought to a stand within a relatively short distance.

I can think of two such SPADs on GWR in the last year.

 

[plugwash]

No train protection system can completely prevent SPADs, because applying the brakes does not absoloutely gaurantee the train will stop.

 

[D365]

No train protection system can completely prevent SPADs, because applying the brakes does not absoloutely gaurantee the train will stop.

Correct answer. ATP braking curves are not 100% infallible. (note that in this instance the term "Automatic Train Protection" also includes ETCS)

 

[Annetts key]

I don't think it's really fair to say that one system that wasn't fitted would "almost certainly" have saved lives as compared to another system that wasn't fitted.

If ATP had been fitted and been operational on the affected lines and trains at Ladbroke Grove and Southall, these trains would not have passed signals at red, and there would not have been railway disasters at these two locations. Also, how effective would TPWS have been even if it had been fitted at the time? During the hearings into both of these accidents, I read every single word of the transcripts, and this was discussed. But as it was a long time ago, I forget the details.

Lord Hidden in his investigation into the Clapham Junction Railway Accident says under recommendation 46: "The Court welcomes BR's commitment to introduce Automatic Train Protection on a large percentage of its network, but is concerned at the timetable proposed". My I remind you that said report was provided to the Secretary of State for Transport on 27th September 1989.

Meanwhile 34 years later, at the current time, Network Rail is still having difficulties getting the funding for ERTMS. Technology keeps moving on. With the railways (actually the government) still dragging its heals and kicking the can even further down the line.

At some point, there will be an accident that could have been prevented by ATP or ERTMS if fitted, but not by TPWS. Even when introduced, TPWS was described as a "stop-gap" solution. And as it happens, it was not as cheap to fit as originally thought.

Now, I don't have the time to go through and analyse every single railway accident and incident to provide a list of the outcomes if ATP / TPWS was fitted.

For those that are of the view that TPWS alone caused the number of signals passed at red/danger to fall need to do better research. TPWS was one of a number of other changes that were introduced.

But at the end of the day, at the vast majority of signals, if the driver makes a mistake (human error), beyond AWS, there is nothing to override the train controls and bring the train to a safe stop.

To all train drivers, please do not take offence, as it is not my intention to undermine you. By far, the vast majority are excellent and very professional. But having talked to drivers, listened to the voice recording of drivers conversations with the signallers or read drivers written reports after incidents, it is clear that occasionally human errors occur.

NB. The communications/reports referred to above are in relation to allegations made against the signalling system, not accidents. All such reports are fully investigated internally by the railway. Sometimes, it is an equipment malfunction. Sometimes it is human error (driver, signaller or occasionally some other member of staff). Sometimes, it's actually none of these, and it's an oversight in the system or a design problem.

 

[najaB]

If ATP had been fitted...

But it wasn't. And neither was TPWS so it doesn't answer the question I asked: how many fatal accidents would ATP have prevented that TPWS didn't?

 

[43066]

But it wasn't. And neither was TPWS so it doesn't answer the question I asked: how many fatal accidents would ATP have prevented that TPWS didn't?

Virtually none? If anyone can identify a single one, with proper reasoning and analysis, I’d be fascinated to read about it.

Hence there was no business case for ATP, or latterly ETCS, on a safety basis alone. There may be some capacity improvements unlocked by ETCS overlaid with ATO, but only in key areas, and at vast expense, hence the distinct lack of urgency towards adopting these systems network wide.

 

[DerekC]

But it wasn't. And neither was TPWS so it doesn't answer the question I asked: how many fatal accidents would ATP have prevented that TPWS didn't?

I have seen various figures for the level of protection that TPWS provides compared with ATP, but they are all over 80% - i.e. TPWS produces a reduction in equivalent fatalities of of over 80% of what ATP/ETCS would do. However the industry is having nervous twitches about the residual risk - such things as the lack of continuous supervision of speeds and the fact that TPWS can't supervise speed reduction at a diverging junction. The fact that we haven't had an accident with TPWS that ATP wouldn't have prevented doesn't mean that there won't be. And it might be a big one. Which doesn't mean that there is a business case on safety grounds for ETCS, but it does mean that politicians and the industry great and good are worried about it. They can imagine the headlines and all the promises from Clapham onwards being recited!

 

[Annetts key]

But it wasn't. And neither was TPWS so it doesn't answer the question I asked: how many fatal accidents would ATP have prevented that TPWS didn't?

Virtually none? If anyone can identify a single one, with proper reasoning and analysis, I’d be fascinated to read about it.

Hence there was no business case for ATP, or latterly ETCS, on a safety basis alone. There may be some capacity improvements unlocked by ETCS overlaid with ATO, but only in key areas, and at vast expense, hence the distinct lack of urgency towards adopting these systems network wide.

If ATP had been fitted more extensively, then TPWS would not exist on ATP fitted lines, and may not have ever been developed at all.

If drivers never made any mistakes, would there be no business case for TPWS?

There are many, many things within signal engineering where no business case exists, but despite this, the complexity of signalling interlocking systems has increased greatly. With many, many changes to catch ever more cases of human error as they have been found.

 

[43066]

If ATP had been fitted more extensively, then TPWS would not exist on ATP fitted lines, and may not have ever been developed at all.

Entirely theoretical. We could just as well speculate that the huge budget for fitting ATP network wide would have led to a reduction in maintenance budgets elsewhere, resulting in more track/points failures and resultant fatalities, a la Potters Bar.

It’s impossible to prove either way, so ultimately pointless to discuss.

If drivers never made any mistakes, would there be no business case for TPWS?

But human drivers will always make mistakes so, until the human element can be eliminated, likely not for many decades hence, how is this question relevant?

There are many, many things within signal engineering where no business case exists, but despite this, the complexity of signalling interlocking systems has increased greatly. With many, many changes to catch ever more cases of human error as they have been found.

So, what is the answer to the original question posed:

how many fatal accidents would ATP have prevented that TPWS didn't?

Which doesn't mean that there is a business case on safety grounds for ETCS, but it does mean that politicians and the industry great and good are worried about it. They can imagine the headlines and all the promises from Clapham onwards being recited!

Are politicians worried about it? I think I’m right in saying NR maintenance budgets have been frozen by the current government, so reduced in real terms, which tends to suggest otherwise.

 

[Efini92]

If the train speed is less than the release speed then it's possible to pass a signal at danger, but the low speed means the train will be brought to a stand within a relatively short distance.

I can think of two such SPADs on GWR in the last year.

So it has the same limitations as TPWS OSS. Thanks for clarification. I thought ATP was an active system that constantly monitored train speeds.

 

[Annetts key]

So it has the same limitations as TPWS OSS. Thanks for clarification. I thought ATP was an active system that constantly monitored train speeds.

ATP does continuously monitor train speeds. With the GWML ATP system, this is referred to as fully supervised.

However, if the signal the train is approaching is red, and there is no in-fill device (in-fill loop, or in-fill beacon), if/when the signal clears up to a proceed aspect, there has to be a mechanism to get the aerial of the train's ATP system over the signal beacon so that the on-board computer can be updates. As the beacon is mounted very close to the signal, but the trains aerial may be mounted further back on the leading vehicle, the 'release speed' mode allows the driver to proceed slowly forward.

 

[12LDA28C]

ATP does continuously monitor train speeds. With the GWML ATP system, this is referred to as fully supervised.

However, if the signal the train is approaching is red, and there is no in-fill device (in-fill loop, or in-fill beacon), if/when the signal clears up to a proceed aspect, there has to be a mechanism to get the aerial of the train's ATP system over the signal beacon so that the on-board computer can be updates. As the beacon is mounted very close to the signal, but the trains aerial may be mounted further back on the leading vehicle, the 'release speed' mode allows the driver to proceed slowly forward.

Not even slowly in some cases depending on the release speed at each particular signal. I've seen signals with a release speed of 40mph.

 

[Annetts key]

Not even slowly in some cases depending on the release speed at each particular signal. I've seen signals with a release speed of 40mph.

But even at 40MPH, you are not going to get very far if the signal is still red. As soon as the on-board computer gets the update as the train passes over the signal beacon, it will apply the brakes and the train should stop within the overlap. Keep in mind that the ATP knows the length of the overlap and if it is a restricted or unrestricted overlap. The overlap (normally at least 180m or 200 yards for an unrestricted overlap) is integral with colour light signalling and track circuit block signalling design.

There is a good detailed explanation here

In essence with any form of ATP system:
a) the driver is responsible for stopping at the Limit of Movement Authority which is at the signal (where provided) and the ATP supervises this.
b) However the ATP is responsible for stopping the train before it reaches the conflict (generally the end of the overlap); there indeed needs to be a margin so that the driver is free to drive their train without the chance of unwarranted interventions. Therefore the ATP does not worry about the need to stop the train prior to the signal but waits until it is certain that driver has made error before applying the emergency brakes.
c) The ATP supervises the drivers braking against the service braking curve (actually there are often 3 targetted at various stopping positions just prior to the signal- an annunciation curve to give a warning, the curve the driver should really be following to be able to stop a defensive driving distance prior to the signal and the extremely last moment curve used to intervene if driver hasn't reacted). Once the speed has been reduced the defined sufficiently low level known as the "release speed", it no longer supervises to this cuurve but permits the driver to proceed towards the signal at this (or lower) speed. The primary reason why is that the ATP never quite knows how far there is left to go due to possible odometry error. It is a bit like feeling ones way cautiously in the dark; when you think you are getting close, proceed very slowly but be ready to react very promptly!). The ATP will find out exactly where it is once the driver SPADs and although it is obviously too late to stop at the signal, provided the speed is low enough then safety is not compromised. The ATP permits the SPAD to occur at a speed up to the "release speed" because is knows that it will be able to stop the train prior to the possible conflict. The driver will be in a lot of trouble of course, but no collision will result.

Hence the calculation of the release speed certainly depends upon the overlap length but also things such as gradient, odometry and possible lurch uncertainty, latency in performing calculations, the brake build-up time, emergency brake rate, any extra contingency margin etc.

Assuming there is only transmission of information to the train in the immediate vicinity of each signal then it may be that the driver can see a green signal ahead but the ATP system doesn't yet know that it has cleared. If the train had passed the previous signal at yellow, then the information that the following signal was red would be being stored by the on-board. The ATP must continue to assume that this is still the case, until it gets an update and for that it has to wait until the train encounters the next loop / beacon. In the extreme case, there will only be data transfer just beyond each signal and thus the driver must be permitted to continue, albeit at a low speed, in order to get to the next beacon or there would be an impasse.
PJW

 

[flowcoach]

I’d like to come back to the question of why the TPWS ‘train stop’ grids are not set further back from the relevant signal.

I agree that having them further back on the line would be more effective at stopping a moving train from having a SPAD.

It would, however, be of no use for preventing a train that had stopped at that signal from continuing in error (because at that stage the grids would be behind the accelerating engine).

It is also worth noting that the line immediately after the signal (literally the “overlap”) is part of the same track circuit (the signaller’s train-detection-system) as the line immediately before the signal (the “berth”). For that reason a SPAD of short length need not be, in itself, a problem for other rail traffic as it need not impinge on the “interlocking” of the signalling system.

 

[Tester]

It is also worth noting that the line immediately after the signal (literally the “overlap”) is part of the same track circuit (the signaller’s train-detection-system) as the line immediately before the signal (the “berth”). For that reason a SPAD of short length need not be, in itself, a problem for other rail traffic as it need not impinge on the “interlocking” of the signalling system.

Bit in bold: Whilst this can occur in specific circumstances, it is by no means the norm. The vast majority of signals have separate berth and overlap track circuits (or equivalent).

 

[flowcoach]

Bit in bold: Whilst this can occur in specific circumstances, it is by no means the norm. The vast majority of signals have separate berth and overlap track circuits (or equivalent).

I stand corrected. But I take it that the underlying point is the same; having a train in the overlap will not affect signal interlocking.

 

[Tester]

I stand corrected. But I take it that the underlying point is the same; having a train in the overlap will not affect signal interlocking.

Having a train in the overlap will do all sorts of things, depending on the layout and what the control tables specify.

By way of example.....

Inhibiting approach locking release and thereby maintaning route locking

Placing other signals to danger

Locking points

Initiating level crossing closure sequence


In short - it's complicated!

 

[12LDA28C]

I’d like to come back to the question of why the TPWS ‘train stop’ grids are not set further back from the relevant signal.

I agree that having them further back on the line would be more effective at stopping a moving train from having a SPAD.

It would, however, be of no use for preventing a train that had stopped at that signal from continuing in error (because at that stage the grids would be behind the accelerating engine).

It is also worth noting that the line immediately after the signal (literally the “overlap”) is part of the same track circuit (the signaller’s train-detection-system) as the line immediately before the signal (the “berth”). For that reason a SPAD of short length need not be, in itself, a problem for other rail traffic as it need not impinge on the “interlocking” of the signalling system.

The TSS grids are designed to interact with the on-train equipment and bring the train to a stand in the event of a SPaD, not in the event of a train passing a random point at some arbitrary distance before the signal. The purpose of the OSS grids is to stop a train that is literally 'overspeeding' towards a signal at danger.

 

[Annetts key]

I’d like to come back to the question of why the TPWS ‘train stop’ grids are not set further back from the relevant signal.

I agree that having them further back on the line would be more effective at stopping a moving train from having a SPAD.

It would, however, be of no use for preventing a train that had stopped at that signal from continuing in error (because at that stage the grids would be behind the accelerating engine).

It is also worth noting that the line immediately after the signal (literally the “overlap”) is part of the same track circuit (the signaller’s train-detection-system) as the line immediately before the signal (the “berth”). For that reason a SPAD of short length need not be, in itself, a problem for other rail traffic as it need not impinge on the “interlocking” of the signalling system.

The purpose of the TPWS train stop is to activate the train braking system if the train passes a signal at red, so that the speed of the train can be reduced to either avoid an impact or crash, or to mitigate the consequences if a collision still occurs.

They cannot be "set back" or in-rear/on approach to the signal, as the driver (assuming they had a proceed aspect at the previous signal) is entitled to drive right up to the signal at red.

It's the job of the OSS (described earlier, where fitted) to active the train brakes if the train is approaching the signal at red at a speed that is higher than the set-speed for the OSS. If the train is going faster than the set-speed, then the brakes will be applied at that point (just after the OSS trigger 'loop').

TPWS is normally only fitted to signals where there is a conflict point beyond the signal. In practice, that means a controlled signal. Most controlled signals have separate berth (approach) and overlap track circuits / axle counter sections. Hence the interlocking and the signaller know if a train passes a controlled signal that is red.

Normally only automatic signals have a combined berth (approach) and overlap track circuit / axle counter section. As these are only normally used on plain line, these signals are not normally fitted with TPWS.

The situation varies with semi-automatic signals. But there are not many of these on the network.

 

[edwin_m]

(all signals fitted with TPWS require alterations to the interlocking, and a lot will also require alterations to the circuitry in the signal box/panel).

That was not the original intention (I was involved with in the mid-1990s with what became TPWS). It was intended just to take a feed off the red lamp circuit. But extra complication was added later.

TPWS does not solve the problem of trains encountering multiple signals showing caution (yellow or double yellow) aspects. As many of these signals will not have a potential point of collision beyond the signal, hence there is normally no requirement for TPWS to be fitted...
The problem with drivers encountering multiple consecutive signals showing caution, is that with them repeatedly acknowledging the warning from the AWS, this may become routine. So when the next signal is showing a red, they get the same horn, they automatically acknowledge the warning from the AWS, then if they are not paying attention, they may find that they cannot stop their train before passing the signal at danger. ATP does solve this issue.

If the signal showing red is TPWS-fitted and the train is within the permitted speed, the OSS or TSS should stop it just as it would in any other situation.

What fatal accident(s) would ATP have prevented that TPWS didn't?

Those that occurred before TPWS was fitted for a start.

Ladbroke grove and southall would’ve been prevented. Granted they both occurred before tpws was fitted.

In a nutshell ATP prevents spads, TPWS mitigates the risk of a spad by stopping the train before it reaches the point of conflict.

TPWS would also have prevented Ladbroke Grove. The train that passed the red had a long overrun distance before it was switched onto the track where it had a head-on collision, and a brake application on passing the signal would have stopped it well before. At Southall if the AWS had been operational it would almost certainly have prevented the accident by giving a warning at the double and single yellow signals that the driver missed, ATP was fitted but not used and presumably had TPWS been fitted it would have been isolated too. That accident was more about making sure systems were used than what system was fitted.

Now, I don't have the time to go through and analyse every single railway accident and incident to provide a list of the outcomes if ATP / TPWS was fitted.

That is exactly what was done in around 1994 with all accident reports back to the end of steam, assessing what would have happened under various "what-if" situations including if ATP or a TPWS-like system had been fitted. The assessment was corrected for other changes in the meantime such as increased crashworthiness of rolling stock. The conclusion was that TPWS would avoid over 70% of the casualties of ATP, and experience since has borne this out.

 

[Annetts key]

That was not the original intention (I was involved with in the mid-1990s with what became TPWS). It was intended just to take a feed off the red lamp circuit. But extra complication was added later.

Whatever the original intention, in practice the actual installation of the system as specified at the time does require the alterations as I said. And for certain signals, the alterations can be even more complex. Any alterations to the interlocking quickly increase the cost.

If the signal showing red is TPWS-fitted and the train is within the permitted speed, the OSS or TSS should stop it just as it would in any other situation.

Yes, IF the signal if fitted. But under the current design requirements, the vast majority of signals not at junctions are normally not fitted with TPWS.

TPWS does what it was designed to do, to tackle the "low hanging fruit" rather than to provide a comprehensive system like ATP.

That is exactly what was done in around 1994 with all accident reports back to the end of steam, assessing what would have happened under various "what-if" situations including if ATP or a TPWS-like system had been fitted. The assessment was corrected for other changes in the meantime such as increased crashworthiness of rolling stock. The conclusion was that TPWS would avoid over 70% of the casualties of ATP, and experience since has borne this out.

But like any assessment based on accident reports or incident reports, it can only tell you about past events that resulted in injuries.

The railway signalling systems have adapted with the signalling system (including interlocking and block systems) becoming more complex as measures that prevent one type of accident are found wanting and are found not to prevent other types of accidents. Now modern interlocking and block systems have almost completely eliminated human errors by signallers in respect of keeping trains safe (mistakes may still be made if due to a failure, the signalling system is not functioning normally or an unsignalled movement is being made).

ATP and ERTMS use good engineering principles to provide full and continuous supervision of the train in respect of both the limit of authority for the movement and the maximum permitted speed (be it the train speed, the line speed, a permanent speed restriction, junction speed restriction etc.). Hence by design, they do a very good job of very significantly reducing human error if a train driver looses attention or makes other mistakes.

What is even more annoying is that many, many individuals now carry more computing power in their pockets/bags in the form of a smartphone than that of a solid state interlocking, let alone the computing power of the 1990s technology that forms ATP.

 

[edwin_m]

Whatever the original intention, in practice the actual installation of the system as specified at the time does require the alterations as I said. And for certain signals, the alterations can be even more complex. Any alterations to the interlocking quickly increase the cost.

I'm not in a position to disagree with that.

TPWS does what it was designed to do, to tackle the "low hanging fruit" rather than to provide a comprehensive system like ATP.

Yes, that was always the intention.

But like any assessment based on accident reports or incident reports, it can only tell you about past events that resulted in injuries.

The railway signalling systems have adapted with the signalling system (including interlocking and block systems) becoming more complex as measures that prevent one type of accident are found wanting and are found not to prevent other types of accidents. Now modern interlocking and block systems have almost completely eliminated human errors by signallers in respect of keeping trains safe (mistakes may still be made if due to a failure, the signalling system is not functioning normally or an unsignalled movement is being made).

The analysis did consider avoided cost of equipment damage as well as reduction in injuries and fatalities. I mentioned making allowances for better crashworthiness, and it may also have considered improvements resulting from reduction in human errors from increased signalling automation - after 30 years I'm afraid I can't remember.

What is even more annoying is that many, many individuals now carry more computing power in their pockets/bags in the form of a smartphone than that of a solid state interlocking, let alone the computing power of the 1990s technology that forms ATP.

That's true, but what that smartphone doesn't have is suitable integrity to act as a vital signalling system. Trying to achieve that introduces a lot of complication, although interestingly AWS and TPWS were not considered to be high-integrity systems because they would only come into play if the driver made a mistake and the chances of the system failing at the same time were seen as very low.

 

[Annetts key]

That's true, but what that smartphone doesn't have is suitable integrity to act as a vital signalling system. Trying to achieve that introduces a lot of complication, although interestingly AWS and TPWS were not considered to be high-integrity systems because they would only come into play if the driver made a mistake and the chances of the system failing at the same time were seen as very low.

My point is that the technology and engineering has moved on rather a lot since the ATP systems that were considered by BR were designed. Yes, an ATP system does have to be designed to safety critical system specifications (for example, the GWML ATP encoders have two independent processors for system integrity (safety) reasons).

As an example of how microprocessor costs have fallen for embedded applications, the least expensive ARM Cortex microcontrollers can now be bought for less than £1 (excl. VAT) each. I'm not saying these would be suitable for a safety critical systems, but these are far more powerful yet significantly cheaper than the processors available when the GWML ATP was designed.

But the mainland U.K. railway has not managed to move on very quickly. Only now are Network Rail introducing ERTMS on a high speed main line as part of the East Coast Digital Programme (web site https://eastcoastdigitalprogramme.co.uk/the-programme/digital-signaling).

It's been over thirty years since the start of the BR pilot ATP schemes. Yet, it will take maybe another twenty years or more before most of the network has the level of protection that the Hidden enquiry recommended.

 

[edwin_m]

My point is that the technology and engineering has moved on rather a lot since the ATP systems that were considered by BR were designed. Yes, an ATP system does have to be designed to safety critical system specifications (for example, the GWML ATP encoders have two independent processors for system integrity (safety) reasons).

As an example of how microprocessor costs have fallen for embedded applications, the least expensive ARM Cortex microcontrollers can now be bought for less than £1 (excl. VAT) each. I'm not saying these would be suitable for a safety critical systems, but these are far more powerful yet significantly cheaper than the processors available when the GWML ATP was designed.

But the mainland U.K. railway has not managed to move on very quickly. Only now are Network Rail introducing ERTMS on a high speed main line as part of the East Coast Digital Programme (web site https://eastcoastdigitalprogramme.co.uk/the-programme/digital-signaling).

It's been over thirty years since the start of the BR pilot ATP schemes. Yet, it will take maybe another twenty years or more before most of the network has the level of protection that the Hidden enquiry recommended.

However, you don't need much processing power in a trackside module or balise, so the fact one is capable of navigating to the moon is of limited usefulness. Even for interlockings, going from a roomful of relays to an SSI cabinet the size of a fridge was a much bigger benefit than replacing several fridges by something the size of a microwave. The cost of the processor is a drop in the ocean compared with the design, data preparation and installation costs

Component obsolescence is a much bigger issue. On its own that issue probably condemns GWATP to a limited life, and the UK railway would have been in a much bigger hole if it had widely adopted something that was single source and would by now be hard to get spares for - still less extend onto other routes. Other countries that adopted similar first generation ATP systems have had similar problems and are generally upgrading to ERTMS, which is developed against open specifications for functionality and available from several suppliers so much less likely to go obsolescent.

The justification for ERTMS is now around the expected (or presumed) cost saving against new conventional signalling as existing equipment need renewal. In the near or total absence of ATP-preventable accidents in the past couple of decades, the safety benefit doesn't come near justifying premature replacement. In fact doing so prematurely might be more hazardous than leaving the existing equipment in place until life expiry, as it puts more people in harm's way on the trackside.

 

[Annetts key]

However, you don't need much processing power in a trackside module or balise, so the fact one is capable of navigating to the moon is of limited usefulness. Even for interlockings, going from a roomful of relays to an SSI cabinet the size of a fridge was a much bigger benefit than replacing several fridges by something the size of a microwave. The cost of the processor is a drop in the ocean compared with the design, data preparation and installation costs.

No you don't need a powerful microcontroller. And other less powerful microcontrollers are even cheaper. In terms of development costs, the tools available now are far better. Data preparation is not a big problem for a system like the GWML ATP system. Each infrastructure installation for a signal operates completely independently to those for the signals either side of it.

I am not saying that we should introduce an ATP system now. I'm saying that I am very disappointed that we did not introduce a better system than TPWS after seeing that ATP was practical with all the safety benefits that an ATP system offered.

Even the BR SSI interlocking cubicles are nearly 50% fresh air (well the ones I've worked on were).

Component obsolescence is a much bigger issue. On its own that issue probably condemns GWATP to a limited life, and the UK railway would have been in a much bigger hole if it had widely adopted something that was single source and would by now be hard to get spares for - still less extend onto other routes. Other countries that adopted similar first generation ATP systems have had similar problems and are generally upgrading to ERTMS, which is developed against open specifications for functionality and available from several suppliers so much less likely to go obsolescent.

Parts and system obsolescence is not new for the railway. It's happening with many other parts of the signalling system, has happened in the past and will happen in the future. For example ASTER U/SF15 track circuit equipment, CCTV systems, various TDM systems, various relay types, at one point, channel rodding for mechanical points... SSI itself is now effectively obsolescent.

Railtrack (now Network Rail) has made the mistake (IMHO) of tying itself to a single manufacturer for various systems, like for example, TPWS. I've only ever seen the infrastructure parts (SIM, ND TSS, OD TSS, ND OSS, OD OSS modules) from a single manufacturer (now Thales, but IIRC Racal Electronics before this was bought by Thales). That being only one example.

There are mitigations that can be applied to help. By having a number of different manufacturer's. If ATP had been installed nationwide, then there is a far bigger market for manufacturers to produce spares for. Items that still have a market will therefore still be manufactured. Also by having a clear migration path. The migration path for ATP clearly being to ERTMS.

The justification for ERTMS is now around the expected (or presumed) cost saving against new conventional signalling as existing equipment need renewal. In the near or total absence of ATP-preventable accidents in the past couple of decades, the safety benefit doesn't come near justifying premature replacement. In fact doing so prematurely might be more hazardous than leaving the existing equipment in place until life expiry, as it puts more people in harm's way on the trackside.

But even that justification for ERTMS is being hindered as new signalling is postponed to save money. Network Rail's own ERTMS dates have/are slipping. And you don't save money in the long term if you install conventional signalling and then go back later on to install ERTMS. If ATP had been planned for in the designs of new trains, the migration to ERTMS would have been cheaper and easier.

1970s signalling systems are now over fifty years old.

The Cambrian Line ERTMS (level 2) came into full service in 2011.

The real problem being the lack of investment due to the decisions by government. And in the meantime the employees (train crew) and passengers have less protection than they reasonably could have.

The issue of track safety of staff is another topic. Currently the vast majority of staff do not work on the track while trains are running. Any signalling work therefore would therefore be done in a T3 worksite or during a lineblock.

 

[edwin_m]

I am not saying that we should introduce an ATP system now. I'm saying that I am very disappointed that we did not introduce a better system than TPWS after seeing that ATP was practical with all the safety benefits that an ATP system offered.

And I'm saying that those safety benefits were rather small then and even smaller once TPWS came along. Another problem with ATP was the complexity of the on-train equipment which had to be interfaced to some very old existing traction. The ERTMS programme is being staged to minimise this, for example all the passenger trains on the southern ECML already have ERTMS or are made ready for it to be fitted, except IC225 which will be gone by then.

Parts and system obsolescence is not new for the railway. It's happening with many other parts of the signalling system, has happened in the past and will happen in the future. For example ASTER U/SF15 track circuit equipment, CCTV systems, various TDM systems, various relay types, at one point, channel rodding for mechanical points... SSI itself is now effectively obsolescent.

Mechanical components can be manufactured in small quantities using workshop tools, and for many electronic components there are equivalent replacements available. Anything that runs software is potentially more complicated, though the later computer-based interlockings will run data prepared for SSIs (but this is getting off topic).

Railtrack (now Network Rail) has made the mistake (IMHO) of tying itself to a single manufacturer for various systems, like for example, TPWS. I've only ever seen the infrastructure parts (SIM, ND TSS, OD TSS, ND OSS, OD OSS modules) from a single manufacturer (now Thales, but IIRC Racal Electronics before this was bought by Thales). That being only one example.

There are mitigations that can be applied to help. By having a number of different manufacturer's. If ATP had been installed nationwide, then there is a far bigger market for manufacturers to produce spares for. Items that still have a market will therefore still be manufactured. Also by having a clear migration path. The migration path for ATP clearly being to ERTMS.

The BR ATP systems were also proprietary to single suppliers, and even with similar systems in use in other countries the manufacturers have been unwilling to continue supporting them. I agree the migration path from ATP is to ERTMS, but (unlike AWS to TPWS) it involved replacing a large part of the complex on-board equipment.

 

[Annetts key]

And I'm saying that those safety benefits were rather small then and even smaller once TPWS came along.

And I'm disagreeing. At a signal with no TPWS you get 0% of the benefit. Just because (assuming this is the case) we have not had an accident which ATP could have prevented but TPWS would not have, does not mean it will not happen in the future. We should be thankful that the vast majority of train drivers in the U.K. are good professionals. But as seen on railways elsewhere and on tram systems (2016 Croydon tram derailment due to excessive speed), drivers do sometimes make mistakes.

If you were buying a brand new car, would you choose one with an ABS braking system or one without?
What about airbags? Or the various other systems that improve the safety of motor vehicles?

Another problem with ATP was the complexity of the on-train equipment which had to be interfaced to some very old existing traction. The ERTMS programme is being staged to minimise this, for example all the passenger trains on the southern ECML already have ERTMS or are made ready for it to be fitted, except IC225 which will be gone by then.

I agree the migration path from ATP is to ERTMS, but (unlike AWS to TPWS) it involved replacing a large part of the complex on-board equipment.

But ATP fitment on trains could have been phased in. How many new trains have been introduced since 1990? When did the industry start to specify that new trains should be ERTMS ready? The migration from ATP (or ATP ready) to ERTMS could have been far easier than the fitment of ERTMS is currently going to be if all the 'new' trains introduced since 1990 had been ready for ATP or fitted with it.

 

[stuving]

Railtrack (now Network Rail) has made the mistake (IMHO) of tying itself to a single manufacturer for various systems, like for example, TPWS. I've only ever seen the infrastructure parts (SIM, ND TSS, OD TSS, ND OSS, OD OSS modules) from a single manufacturer (now Thales, but IIRC Racal Electronics before this was bought by Thales). That being only one example.

For the record, the name on early TPWS kit was Redifon MEL, which was part of Thomson UK.
MEL (ex Philips) had been part of Thorn-EMI when Thomson-CSF and Racal carved up Thorn-EMI between them in 1995. Redifon was bought by Thomson UK the year before. All that had happened before TPWS came out, of course.

Then the parts that went to Racal also ended up with Thomson-CSF/Racal, which renamed itself Thales in 2000. Confusing, huh?

 

[edwin_m]

And I'm disagreeing. At a signal with no TPWS you get 0% of the benefit. Just because (assuming this is the case) we have not had an accident which ATP could have prevented but TPWS would not have, does not mean it will not happen in the future. We should be thankful that the vast majority of train drivers in the U.K. are good professionals. But as seen on railways elsewhere and on tram systems (2016 Croydon tram derailment due to excessive speed), drivers do sometimes make mistakes.

Anything can happen in the future, but both analysis of nearly 30 years of accidents in the 1990s, and actual experience in 20 years since it was rolled out, suggest that TPWS and other measures introduced (the Driver Reminder Appliance and sanders were part of the same initiative) have avoided most of the casualties that ATP would have avoided had it been introduced at the same time.

If you were buying a brand new car, would you choose one with an ABS braking system or one without? What about airbags? Or the various other systems that improve the safety of motor vehicles?

That's not a reasonable comparison, because the roads are much more dangerous than the railways, for reasons including that a proportion of road drivers are idiots. So extra safety measures are more justifiable, and ABS is mass-produced so is much cheaper than the railway equivalent - and that would be sanders, now pretty much universal on trains too. And the equivalent of airbags is more crash-friendly interiors which have also appeared on new trains since the 1990s, along with other measures such as crumple zones. Also I wouldn't expect to have to retrofit ABS to an old banger, which is what would have had to happen with slam door EMUs and similar if ATP had been widely adopted around 1990.

But ATP fitment on trains could have been phased in. How many new trains have been introduced since 1990? When did the industry start to specify that new trains should be ERTMS ready? The migration from ATP (or ATP ready) to ERTMS could have been far easier than the fitment of ERTMS is currently going to be if all the 'new' trains introduced since 1990 had been ready for ATP or fitted with it.

The design requirements to be "ERTMS ready" are laid down and standardised in one of the many European specifications, and would be different from those to be ready for some older ATP system, so the benefit of having a train prepared for the older system is probably limited if it turns out that it needs to be fitted with ERTMS instead. ERTMS also avoids some of the capacity penalties of older ATP systems and is expected to be ultimately upgradeable to Level 3 which offers a significant capacity benefit.