Tyne & Wear Metro Fleet Replacement: Awarded to Stadler

[Prime586]

Not entirely the case. Some different subcontractors, and only half of the 777s were built in the factory that’s building all of the 555s.

You are splitting hairs there. The bulk of the equipment (doors/step modules and their controllers, traction systems, train control hardware) is from the same suppliers. The faults seen on the 777s are common to both the Swiss and Polish batches (004 and 008, both part of the Swiss batch, have been two of the least reliable examples), and the Swiss-built 777/1s battery units used on the Kirkby line have their own extra failure modes.

Can’t tell if you’re joking or not (or you’re a secret Nexus employee) but certainly when the old trains have been crush loaded at peak time it’s very easy to end up pushing against the non-platform-side doors and door buttons.

There's also the extra hazard of potential gauge clearance issues from a passing train with the step fully extended on the wrong side.

 

[DanNCL]

You are splitting hairs there. The bulk of the equipment (doors/step modules and their controllers, traction systems, train control hardware) is from the same suppliers. The faults seen on the 777s are common to both the Swiss and Polish batches (004 and 008, both part of the Swiss batch, have been two of the least reliable examples), and the Swiss-built 777/1s battery units used on the Kirkby line have their own extra failure modes.

A lot of the suppliers are different. The traction motors are from the same supplier on both fleets (but not the same design) as are some other components. A big deal was made when the contract was placed about the 555s having a large quantity of locally made components.
Your original post was replying to a comment I made about build quality, not reliability. And as far as build quality goes, having personally sampled several units of both classes, the 555s feel a lot better built than the 777s do.

 

[danielnez1]

On a slight tangent, I was doing software requirements a few weeks ago with my MSc Software Engendering Team Project students, and (of course) I used the new Metro fleet as an example, anyway the class came up with this Non-functional software requirement as a simple example:

Requirement	Priority (H, M, L)	Supplier Comments
NFR3: (For train system) Once the platform is detected and no intervention is given by the driver, the door opening sequence will commence. This includes: Engagement of the ramp extension function Initiate door unlock sequence after ramps have successfully engaged. Initiate door open sequence for doors where the door open button has been pushed.	H	This fulfils part of FR2 and FR3

I am not going to pretend that single requirement is anywhere near good enough for such a safety critical system, but I can imagine the actual door pre-select system will have similar sets of requirements, and in turn have requirements on how the system interfaces with the physical door mechanisms and hardware, and very quickly the mere design of such systems becomes very complicated - this is before even a single line of code is written. So if mistakes and/or misassumptions creep in, potential problems could be overlooked until the system is built and implanted.

It also emphasise the need for proper and through testing of systems before deployment too.

 

[Peter Sarf]

On a slight tangent, I was doing software requirements a few weeks ago with my MSc Software Engendering Team Project students, and (of course) I used the new Metro fleet as an example, anyway the class came up with this Non-functional software requirement as a simple example:

Requirement	Priority (H, M, L)	Supplier Comments
NFR3: (For train system) Once the platform is detected and no intervention is given by the driver, the door opening sequence will commence. This includes: Engagement of the ramp extension function Initiate door unlock sequence after ramps have successfully engaged. Initiate door open sequence for doors where the door open button has been pushed.	H	This fulfils part of FR2 and FR3

I am not going to pretend that single requirement is anywhere near good enough for such a safety critical system, but I can imagine the actual door pre-select system will have similar sets of requirements, and in turn have requirements on how the system interfaces with the physical door mechanisms and hardware, and very quickly the mere design of such systems becomes very complicated - this is before even a single line of code is written. So if mistakes and/or misassumptions creep in, potential problems could be overlooked until the system is built and implanted.

It also emphasise the need for proper and through testing of systems before deployment too.

When I think about some of the rubbish I had to fix software bugs in, I dread to think what if the systems I was brought in to support had been safety critical.

 

[dmncf]

If you don’t know the system by heart, you might not know which side the platform will be on at the next station.

Thanks - makes sense now.

 

[danielnez1]

When I think about some of the rubbish I had to fix software bugs in, I dread to think what if the systems I was brought in to support had been safety critical.

The takeaway I try to get the students to think is about is document everything and anything, regardless of how trivial they think it is at the time. As will the loss of ETCS signalling data on the Cambrian Coast, it could be vial for tracking down bugs. I hope the 555s technical documentation is top notch for the issues they are having

 

[DanNCL]

If you don’t know the system by heart, you might not know which side the platform will be on at the next station.

Additionally it’s useful at St James, Airport and (occasionally) Sunderland where the platform could be on either side of the train.

 

[danielnez1]

Additionally it’s useful at St James, Airport and (occasionally) Sunderland where the platform could be on either side of the train.

I would assume that the driver selects which side to unlock the doors, plus the onboard software and hardware also detects things like how far to extend the retractable footplates etc. - I would also hope there is failsafes to mitigate against wrong side selection with sensors and whatnot, but clearly somethnig is very badly wrong with the current setup.

 

[Meerkat]

I don’t see any blame being apportioned to Stadler by Nexus on there own Statement, and BBC news article doesn’t either.

Both clearly state ‘operational issue’.

But the BBC article does have…

Praising the technology which detected the fault,

and starts with…

All new Tyne and Wear Metro trains have been pulled from service due to a potential door fault.

 

[MetroCar4058]

I would assume that the driver selects which side to unlock the doors, plus the onboard software and hardware also detects things like how far to extend the retractable footplates etc. - I would also hope there is failsafes to mitigate against wrong side selection with sensors and whatnot, but clearly somethnig is very badly wrong with the current setup.

I’m not sure adding in additional software and sensor complexity, therefore a risk of failure, is worth mitigating the very rare occurrence of a wrong side opening. It seems a disproportionate amount of time/money spent on a risk which is unlikely to surface itself.

Drivers are accountable for opening and closing the doors. They’ve done it for 40 years on our system without a computer protection system overruling them & there haven’t been any issues.

New stock, new procedures, more likely to make a mistake. Seems like this is part of teething.

 

[ModernRailways]

I’m not sure adding in additional software and sensor complexity, therefore a risk of failure, is worth mitigating the very rare occurrence of a wrong side opening. It seems a disproportionate amount of time/money spent on a risk which is unlikely to surface itself.

Drivers are accountable for opening and closing the doors. They’ve done it for 40 years on our system without a computer protection system overruling them & there haven’t been any issues.

New stock, new procedures, more likely to make a mistake. Seems like this is part of teething.

The ‘computer’ should know which side the platform is on, with the exception of termini (St James and Airport), and out of course working the doors are always opened on the same side at stations. If the doors need opened on a different side then this should be something whereby the driver needs to override the system.

 

[northeast10]

The ‘computer’ should know which side the platform is on, with the exception of termini (St James and Airport), and out of course working the doors are always opened on the same side at stations. If the doors need opened on a different side then this should be something whereby the driver needs to override the system.

It 'should' yes, however that all costs money. There’s non of that technology currently on the 555.

 

[Peter Sarf]

The ‘computer’ should know which side the platform is on, with the exception of termini (St James and Airport), and out of course working the doors are always opened on the same side at stations. If the doors need opened on a different side then this should be something whereby the driver needs to override the system.

For all we know a driver might have manually overridden a fail safe ?.
There have to be manual overrides.

But in any case how often is a particular fail safe required ?.
Is the problem happening more often now because of a change in operating procedure for drivers and/or passengers ?.
Will it settle down ?.
It is easy to think of extra equipment and procedures all the time BUT at some point cost and expediency has to be considered.
Especially if those introduce more failure possibilities.
Beware mission creep.

 

[Volvictof]

For all we know a driver might have manually overridden a fail safe ?.
There have to be manual overrides.

But in any case how often is a particular fail safe required ?.
Is the problem happening more often now because of a change in operating procedure for drivers and/or passengers ?.
Will it settle down ?.
It is easy to think of extra equipment and procedures all the time BUT at some point cost and expediency has to be considered.
Especially if those introduce more failure possibilities.
Beware mission creep.

Some one previously said that the doors on either side are linked so if you have pressed the correct side to get off and the wrong side is released, the wrong side will open. I can’t see that being true and maybe the person who posted it was getting confused, however, if it is true, then that makes the 555s less safe than the 599s as they only open when a side is released and that door on that side is opened. If this is the case then additional safeguards are a must.

Generally risk is calculated in risk assessments based on the likelihood of an event verses the danger if that event occurs.

Medium or high likelihood but low danger is acceptable.
Low likelihood but high danger such as risk of death is never acceptable.
If the risk is death, and there is any likelihood of an occurrence then it must be mitigated.

The risk of a wrong side door opening is serous injury or death.

 

[ModernRailways]

It 'should' yes, however that all costs money. There’s non of that technology currently on the 555.

It costs money but in the grand scheme of things it doesn’t cost much. It could easily be added in software, the train already knows where it is.

 

[Ze Random One]

It costs money but in the grand scheme of things it doesn’t cost much. It could easily be added in software, the train already knows where it is.

There's actually a good chance that the train doesn't "know" where it is. The standard of the passenger information screens "knowing" where the train is may be mich lower than needed for a safety critical system.

I've been on even modern trains (class 700) where the PIS was announcing the station 1 mile behind where the train actually was (so announced Farringdon on the approach to City Thameslink, and Blackfriars on the approach to London Bridge).

That kind of issue is poor from a customer service perspective, but has little consequence for the safety of the train. Now if you were to tie that into door enable logic, you end up with a system which, regularly enough, needs to be overridden by the driver, if there's been a GPS issue, some sort of train setup issue, or the train was unexpectedly diverted. That will mean that drivers will "get into the habit" of regularly overriding it, and then we're left in basically the same situation we have now.

Railways that are serious about this have beacons at the stopping point on the platform that ensure that:
a. The train is in the right stopping place for the platform length, and
b. the doors should only open on this side, right here, at this platform.
You can see this on London Underground, I believe that the >>>>S7<<<< markers on the subsurface lines show the drivers exactly where to stop so that the correct-side-door-enable beacon lines up with the receiver on the train.

Any GPS or distance travelled based system, which would be OK for PIS systems is unlikely to really meet the standard that's needed, unless it can be augmented by some sort of additional information provided to prove that the system is right.

In addition, such a system would need to differentiate between the two platforms at St James and Airport, and to be able to handle alternative operation (such as turning back at Heworth from the "wrong" platform)

 

[DanNCL]

I would have expected the possibility of this to have come up in a risk assessment prior to service entry - clearly it didn’t otherwise this incident wouldn’t have happened, either that or it was considered not to be worth worrying about but if that was the case then it doesn’t make sense for Nexus to suddenly worry about it now. I’m utterly astonished.

Ultimately the only way to 100% prevent human error is to automate the trains and get rid of the humans. That is never going to happen on Metro therefore it will have to be accepted that there will always be a small risk of such an incident happening - humans make mistakes. And whilst there may not be any record of an identical incident happening on a 599 let’s not pretend that there’s never been any door or platform-train interface related incidents on the 599s as there have been plenty over the last 45 years including multiple incidents where passengers have been injured and at least one where a passenger has fell on the adjacent track.

It is more difficult to accidentally release the doors on the wrong side on a 555 than it is on the 599s. 555s in addition to the standard door release buttons also have a side selector switch in the cab. Noting that the recent wrong side incident happened at Simonside side, there is no reason for the side selector switch not to have been set to the left hand side seeing as the doors will have been released from the same cab on the same side at a minimum of two stations before reaching Simonside.

The sliding steps on the doors will have sensors on them to detect the platform edge which determines how far the sliding step extends. A potential solution that would help in a situation like this would be to set it up so that if the sliding step reached its maximum extension without detecting the platform edge, the door would remain closed.

Door pre-selection has worked on Manchester’s M5000 trams for over a decade. It’s not an inherently unsafe system and removing it from the 555s should not be required.

It is very difficult at this stage to see how blame for this current situation lies with anyone other than Nexus.

 

[Peter Sarf]

Some one previously said that the doors on either side are linked so if you have pressed the correct side to get off and the wrong side is released, the wrong side will open. I can’t see that being true and maybe the person who posted it was getting confused, however, if it is true, then that makes the 555s less safe than the 599s as they only open when a side is released and that door on that side is opened. If this is the case then additional safeguards are a must.

Generally risk is calculated in risk assessments based on the likelihood of an event verses the danger if that event occurs.

Medium or high likelihood but low danger is acceptable.
Low likelihood but high danger such as risk of death is never acceptable.
If the risk is death, and there is any likelihood of an occurrence then it must be mitigated.

The risk of a wrong side door opening is serous injury or death.

That would be a risk. If the driver makes an error but the passenger can open either side regardless of which side a door button is pressed.
By making the passenger have to press the button specific to their door (or at least on the specific side) it requires two people to make an error for the wrong side to open.

Certainly consequences are more important than the chance of an error. Unless the chance or an error is really really high for something where the consequence may be little more than disruption, then that needs preventing if its going to happen all the time !.

It costs money but in the grand scheme of things it doesn’t cost much. It could easily be added in software, the train already knows where it is.

The system needs to be accurate enough to distinguish between two adjacent platforms. At a terminus like St James and the airport that is a routine requirement. For other stations it could be important if working wrong line in disruption.

There's actually a good chance that the train doesn't "know" where it is. The standard of the passenger information screens "knowing" where the train is may be mich lower than needed for a safety critical system.

I've been on even modern trains (class 700) where the PIS was announcing the station 1 mile behind where the train actually was (so announced Farringdon on the approach to City Thameslink, and Blackfriars on the approach to London Bridge).

That kind of issue is poor from a customer service perspective, but has little consequence for the safety of the train. Now if you were to tie that into door enable logic, you end up with a system which, regularly enough, needs to be overridden by the driver, if there's been a GPS issue, some sort of train setup issue, or the train was unexpectedly diverted. That will mean that drivers will "get into the habit" of regularly overriding it, and then we're left in basically the same situation we have now.

Railways that are serious about this have beacons at the stopping point on the platform that ensure that:
a. The train is in the right stopping place for the platform length, and
b. the doors should only open on this side, right here, at this platform.
You can see this on London Underground, I believe that the >>>>S7<<<< markers on the subsurface lines show the drivers exactly where to stop so that the correct-side-door-enable beacon lines up with the receiver on the train.

Any GPS or distance travelled based system, which would be OK for PIS systems is unlikely to really meet the standard that's needed, unless it can be augmented by some sort of additional information provided to prove that the system is right.

In addition, such a system would need to differentiate between the two platforms at St James and Airport, and to be able to handle alternative operation (such as turning back at Heworth from the "wrong" platform)

Yes. It is obvious most trains do not know reliably where they are from my experience as a traveller. Bad enough to the point someone could jump off the last train at a remote station and freeze to death before the next mornings first service. It happens so often that I have learnt to ignore the information and rely on the mark one eye ball - so nowadays I have no idea how good or bad the trains idea of location is !.

So, I agree, it needs a specific beacon for each track for safety critical things like doors.
It was so much simpler in the days of slam door stock !.
But dangerous in so many ways.

 

[CL395]

The ‘computer’ should know which side the platform is on, with the exception of termini (St James and Airport), and out of course working the doors are always opened on the same side at stations. If the doors need opened on a different side then this should be something whereby the driver needs to override the system.

The

I’m not sure adding in additional software and sensor complexity, therefore a risk of failure, is worth mitigating the very rare occurrence of a wrong side opening. It seems a disproportionate amount of time/money spent on a risk which is unlikely to surface itself.

Drivers are accountable for opening and closing the doors. They’ve done it for 40 years on our system without a computer protection system overruling them & there haven’t been any issues.

New stock, new procedures, more likely to make a mistake. Seems like this is part of teething.

This has already occurred once in the first few months of operation, it’s certainly more than possible for this to occur again as more drivers get trained up and inevitably make some errors.

If the doors do open the wrong side people who may be partially sighted will be guided to these doors by the white lights that nexus themselves have advertised as a way to find the correct door to the platform. They then open the door and step forward straight onto the path of an oncoming train.

 

[Paul_10]

I would have expected the possibility of this to have come up in a risk assessment prior to service entry - clearly it didn’t otherwise this incident wouldn’t have happened, either that or it was considered not to be worth worrying about but if that was the case then it doesn’t make sense for Nexus to suddenly worry about it now. I’m utterly astonished.

Ultimately the only way to 100% prevent human error is to automate the trains and get rid of the humans. That is never going to happen on Metro therefore it will have to be accepted that there will always be a small risk of such an incident happening - humans make mistakes. And whilst there may not be any record of an identical incident happening on a 599 let’s not pretend that there’s never been any door or platform-train interface related incidents on the 599s as there have been plenty over the last 45 years including multiple incidents where passengers have been injured and at least one where a passenger has fell on the adjacent track.

It is more difficult to accidentally release the doors on the wrong side on a 555 than it is on the 599s. 555s in addition to the standard door release buttons also have a side selector switch in the cab. Noting that the recent wrong side incident happened at Simonside side, there is no reason for the side selector switch not to have been set to the left hand side seeing as the doors will have been released from the same cab on the same side at a minimum of two stations before reaching Simonside.

The sliding steps on the doors will have sensors on them to detect the platform edge which determines how far the sliding step extends. A potential solution that would help in a situation like this would be to set it up so that if the sliding step reached its maximum extension without detecting the platform edge, the door would remain closed.

Door pre-selection has worked on Manchester’s M5000 trams for over a decade. It’s not an inherently unsafe system and removing it from the 555s should not be required.

It is very difficult at this stage to see how blame for this current situation lies with anyone other than Nexus.

Door pre selection may work in Manchester but what is the benefit to it for passengers realistically. It just seems a bit of a gimmick feature to show how clever technology can be but when it goes wrong then it looks rather embarrassing.

I still find it interesting that a driver error but a train behaving as it should be has led to 5+ days of no 555s at least. Part of me does wonder if there is more to it than meets the eye? I also would find the MD comments a bit concerning that they are not ruling out this could affect the pace of the metrocar replacement programme.

 

[typefish]

Door pre selection may work in Manchester but what is the benefit to it for passengers realistically. It just seems a bit of a gimmick feature to show how clever technology can be but when it goes wrong then it looks rather embarrassing.

I'd rather it worked similar to how the metrocars work - you can hold down the button and as soon as that particular door is unlocked by the driver, the door will open.

Saves so much time.

 

[Peter Sarf]

Door pre selection may work in Manchester but what is the benefit to it for passengers realistically. It just seems a bit of a gimmick feature to show how clever technology can be but when it goes wrong then it looks rather embarrassing.

I still find it interesting that a driver error but a train behaving as it should be has led to 5+ days of no 555s at least. Part of me does wonder if there is more to it than meets the eye? I also would find the MD comments a bit concerning that they are not ruling out this could affect the pace of the metrocar replacement programme.

You have awoken the devil in me.

Perhaps Nexus want to delay payment for what they have got and have found an excuse.

It is going to come down to what the customer agreed in the WRITTEN specification.
Or if Stadler did not deliver what the agreed specification EXPLICITLY said.
Most likely it is too vague and interpretations can be made either way but that means Nexus agreed to something inadequately defined.
That's me talking as a software developer.