ROC - have we created a single point of failure?

[broadgage]

I don’t think that business continuity/contingency plans for critical national infrastructure sites should be discussed on a public forum like this, except in the broadest possible terms.

I see no harm in discussing information that is already publicly available.
I would urge that any members with confidential inside knowledge should be very careful not to reveal this.

That said, if "the system" fails to cope with a single power failure, lightning strike or minor fire, then it seems that any business continuity/contingency plans secret or otherwise, are not very effective.

 

[modernrail]

I completely agree. But, where do we draw the line?

A small box with a distant, home and section every three miles? PSB at a major station? ROC for each major route? One big super ROC?

That was sort of my point in starting this thread. I would have thought most of the answer to this question would be through risk assessment and analysis of available mitigation within each option. This approach should lead you to roughly the correct answer. I am sure such an exercise has been undertaken. To suggest otherwise would hopefully be ludicrous. The question for me is how well has it been done.

I have a general sense at the moment that things on the railway are being considered, but not considered properly or well enough and this is likely to be cultural, partly due to inexperienced, incompetent or badly mandated management and partly as a result of fragmentation.

 

[Flying_Turtle]

Well... lovely discussion on ROC's and it's possible (non) redundancies, but my experience tells me that a contractor with a JCB digger can, inadvertently scupper the best laid out contingency plans to keep a modern railway running!

 

[DarloRich]

I have a general sense at the moment that things on the railway are being considered, but not considered properly or well enough and this is likely to be cultural, partly due to inexperienced, incompetent or badly mandated management and partly as a result of fragmentation.

The missing strand to the list above is availability of cash/ fitting your desire to what can actually be paid for.

BTW - why does everyone here assume that because you work fore the railway you must be incompetent or inexperienced?

Well... lovely discussion on ROC's and it's possible (non) redundancies, but my experience tells me that a contractor with a JCB digger can, inadvertently scupper the best laid out contingency plans to keep a modern railway running!

most of them don't need a JCB!

 

[AndrewE]

Ages ago I was asked by an airline person why BR didn't have its signal cables duplicated along the two sides of the track, which is what he would have expected given that lots of safety-critical aeroplane wiring was duplicated.
My answer was that a) if the cables were damaged then trains just came to a stand, rather than dropping out of the sky, and
b) BR could hardly afford to fit and maintain one set of cabling, let alone a second "nice to have" set!
I ssupect that he had no concept of the amount of cabling from a big power-signalling box, or the extreme difference between the environment that the two different installations have to endure...

 

[MarkyT]

Ages ago I was asked by an airline person why BR didn't have its signal cables duplicated along the two sides of the track, which is what he would have expected given that lots of safety-critical aeroplane wiring was duplicated.
My answer was that a) if the cables were damaged then trains just came to a stand, rather than dropping out of the sky, and
b) BR could hardly afford to fit and maintain one set of cabling, let alone a second "nice to have" set!
I ssupect that he had no concept of the amount of cabling from a big power-signalling box, or the extreme difference between the environment that the two different installations have to endure...

Since the late 1980s, modern trackside signalling systems HAVE been designed using duplication and diversity principles. SSI and later processor based interlocking technologies employ twin A and B datalinks for connection to trackside input/output modules and engineers try to keep their cable routes as diverse as possible, sometimes with routes either side of an alignment or by feeding them in to a section from opposite ends so a single break anywhere still leaves everything connected. The local power distribution to the equipment cabinets can also be arranged on similar principles. With relays, the amount of cabling to duplicate every circuit trackside would have made this impractical, with the complexity probably introducing its own reliability or safety issues, and certainly increasing maintenance costs.

In earlier schemes, certain critical links such as the remote control telemetry between a signalbox and a remote relay interlocking were duplicated nonetheless, and diversely routed as far as possible. A secondary degraded mode system would also often be provided for limited functionality from the signalbox, and a local emergency panel for full functionality, to be operated by an agent under telephone instruction from the panel.

 

[Dren Ahmeti]

If the ATC centre at Swanwick goes down, a limited service can continue from overlapping local airports and RAF stations.

Swanwick’s control can be taken up from Prestwick, where another ATC unit exists.

 

[AndrewE]

Since the late 1980s, modern trackside signalling systems HAVE been designed using duplication and diversity principles. SSI and later processor based interlocking technologies employ twin A and B datalinks for connection to trackside input/output modules and engineers try to keep their cable routes as diverse as possible, sometimes with routes either side of an alignment or by feeding them in to a section from opposite ends so a single break anywhere still leaves everything connected. The local power distribution to the equipment cabinets can also be arranged on similar principles. With relays, the amount of cabling to duplicate every circuit trackside would have made this impractical, with the complexity probably introducing its own reliability or safety issues, and certainly increasing maintenance costs.

In earlier schemes, certain critical links such as the remote control telemetry between a signalbox and a remote relay interlocking were duplicated nonetheless, and diversely routes as far as possible. A secondary degraded mode system would also often be provided for limited functionality from the signalbox, and a local emergency panel for full functionality, to be operated by an agent under telephone instruction from the panel.

I thought that this was probably the case "nowadays," but it was in pre-SSI days.

 

[edwin_m]

Back in the 70s or 80s there was a fire outside one of the big Southern boxes that destroyed hundreds of cables coming out of it. Can anyone remember the extent of the disruption, even though the interior was unaffected?

 

[Bald Rick]

Back in the 70s or 80s there was a fire outside one of the big Southern boxes that destroyed hundreds of cables coming out of it. Can anyone remember the extent of the disruption, even though the interior was unaffected?

It was Clapham IIRC. Was rather disruptive but I can’t remember details.

There was also a big fire in the main cable route coming out of New St Box in the early 90s. It was weeks before full functionality was restored.

 

[ChiefPlanner]

Back in the 70s or 80s there was a fire outside one of the big Southern boxes that destroyed hundreds of cables coming out of it. Can anyone remember the extent of the disruption, even though the interior was unaffected?

London Bridge - as described by Peter Raynor in his book - root cause was trackside litter , sparked by some unit arcing. Basically - until the main cables were replaced - they abandoned the normal train plan and minimised
crossing movements , with shed loads of hand signalling in place.

Old stalwarts of the MML can recall a fire in the relay room (caused by some clown burning cardboard boxes outside - hot embers of which went in , via some broken AC louvres) - which had devestating effects and flagmen / temporary block working for a 2 week period or so.

Nothing new in these things.

 

[ainsworth74]

I completely agree. But, where do we draw the line?

A small box with a distant, home and section every three miles? PSB at a major station? ROC for each major route? One big super ROC?

Works for Union Pacific in the United States! One signalling centre controls the entire 36,000 mile network that they operate!

Yes I'm aware that the traffic is somewhat different over there, in particular the density, but I still find it a remarkable and very interesting fact in discussions like this!

 

[Sunset route]

Works for Union Pacific in the United States! One signalling centre controls the entire 36,000 mile network that they operate!

Yes I'm aware that the traffic is somewhat different over there, in particular the density, but I still find it a remarkable and very interesting fact in discussions like this!

With a few exceptions of which one instantly springs to mind, is the “Chemical Coast” which is dispatched locally as remote dispatching from Omaha didn’t quite work out.

Yes I'm aware that the traffic is somewhat different over there, in particular the density, but I still find it a remarkable and very interesting fact in discussions like this!

 

[MarkyT]

Works for Union Pacific in the United States! One signalling centre controls the entire 36,000 mile network that they operate!
Yes I'm aware that the traffic is somewhat different over there, in particular the density, but I still find it a remarkable and very interesting fact in discussions like this!

Another large railroad in the eastern US, I forget which one, had a similar supersized facility which found itself in the path of a major tornado. They had to evacuate and completely shut down over 11,000 route miles of railway (most of which was not physically affected by the weather event at all) for a while I recall. After their famous major traffic meltdown on merging with Southern Pacific in 1998/9, Union Pacific actually devolved control at some major hubs to more local control centres shared with other railroads. They've probably centralised again now though! Dispatchers on US railroads (equivalent to signallers/controllers in UK) have been treated very poorly over there recently. Their jobs might be relocated hundreds of miles away with little notice, then the move might be cancelled, then rescheduled, and changed again, making it impossible for families to plan their housing, partners' employment and children's education. Unions have complained about employees trying to maintain multiple households without adequate recompense, and I've read of dispatchers living for long periods in cars as a result. There have been a number of control centre relocations accompanying recent resignalling associated with the ongoing nationwide 'positive train control' project, and, perhaps not that paradoxically, some of the lapses behind recent accidents associated with introducing this new safety system have been associated with that morale problem.

 

[LAX54]

Works for Union Pacific in the United States! One signalling centre controls the entire 36,000 mile network that they operate!

Yes I'm aware that the traffic is somewhat different over there, in particular the density, but I still find it a remarkable and very interesting fact in discussions like this!

and lots and lots of derailments and crashes too ! (sometimes weekly, sometimes daily ! )