The case for modern centralisation of railway operations?

[sem34090]

I have recently been considering signalling, as it stands today, and trying to assess my long-held belief that centralised operations control and signalling using modern, computer-based, systems is not a particularly sound progression to be making, with several disadvantages over more traditional methods of signalling that have spent the past 50-60 years being phased out, although more recent developments have been more serious in my view as other parts of the railway workforce have been rationalised. I am interested to learn of why I may be wrong; to understand why these developments may not actually be as unsound as I believe them to be. I should add that I am not a professional railway worker, am merely a heritage railway volunteer and as such I do not claim to speak with any authority; I just believe in holding an opinion that hasn't only be influenced by one side of a discussion. I should also add that I'm aged 18, so have grown up in a world driven by software and electronics, so it's hardly as if my complaint is that all things in the modern world are technological evils. Anyway, here is a summary of how I feel about this;

• I feel that centralisation removes very helpful on-the-ground assistance in the event of anything untoward happening. In more rural areas, aespecially, this has potential to delay response times to serious incidents. In said rural areas track circuits or gaps between axle counters may be greatly increased due to a lower service density and thus it may take a considerable time for an incident (in which a train is no longer moving) to be recognised by the signalling centre, which could be in excess of 100 miles away were NR's ROC plans ever to see complete fruition. As far as I'm aware train radios are supposed to issue emergency calls after a certain duration, if one assumes that the driver may be killed or incapacitated but in more rural areas this may be a problem in its own right.
• I personally struggle to understand how software and remote electronic interlocking can be more robust, reliable and potentially safer than traditional mechanical and electro-mechanical equivalents. In my own experience of resignalling of mechanical areas (from a passenger's perspective) service reliability has a tendency to decrease following resignalling.
• Local supervision of train movements by someone who can actually do something to prevent or respond to incidents seems to me to be increasingly absent from the modern railway. It appears that an increasing number of stations are being staffed (where they are staffed) by agency workers who sometimes appear to lack training with regards the handling of trains and are simply acting as customer service assistants. Added to a lack of a local signaller, it seems that there is increasingly little to be done by staff on the ground to control train movements and no reliable way of bringing trains to a stand where necessary (unless the aforementioned agency staff have been told the recognised stop signals). This may become an increasing problem with further implementation of DOO/OPO across lines which feature lightly staffed or unstaffed stations.
• Maintenance of signalling equipment has been greatly complicated, leading to increased delays during breakdowns. In the past such tasks were generally much simpler and S&T technicians were more readily available to undertake the work. Signallers themselves are, in centralised signalling centres, often unable to resolve these problems on their own as they are detached from any actual signalling equipment. It may also be harder for potential faults to be noticed before they grow into live faulys.
• Level Crossing management and observation conducted via cameras is naturally more likely to result in problems than observation by a member of staff on the site. A camera monitoring a level crossing, or indeed monitoring the departure of a train under modern DOO operation, has potential to be affected by accumulated dirt or by adverse weather conditions in a way that a human operative might not be affected.
• Until the present time (the past few months during which everything has been very abnormal on the railways) there has, as I see it, been little need to try and reduce staffing levels in a bid to reduce running costs. As rail travel had been on an upward curve, profits had been reasonable for many operators and potentially also for Network Rail (although I only looked into the money passing through TOCs when I first looked into this several years ago).
• In some cases it is still required that a train be evacuated or passengers moved within a train. Under DOO/OPO this is surely unlikely to be conducted safely. In the event of a collision the only member of staff on many DOO/OPO trains would be the driver, who would likely be incapacitated or killed. It is also possible that the guard may be killed, which is perhaps why the more traditional practice of guards riding at the rear end or in the middle of trains may be advantageous also. With the retention of safety-qualified guards on trains, there is a member of staff who is able to handle the safe evacuation of a train in the event of the driver being unable to. Likewise if the guard is killed, the driver would likely be at the opposite end of the train and thus would be able to handle the evacuation safely.
• Automatic signalling systems are not infallible and can result in trains being incorrectly routed, potentially even onto single lines (the latter problem being relatively rare under electric train staff and key token systems)
• Electronic, computer-based, signalling systems may in the future leave the railway vulnerable to cyber attack and the consequences that might result could be devastating. It may be possible to attack a single ROC and at the very least take a huge swathe of the network out of operation in a way that simply could not be managed under localised mechanical control without a vast number of operatives to dismantle rodding runs and wires.
• Upper quadrant semaphore signalling appears to be rather more fail-safe than electronic circuitry; It requires the actuating wire to be under tension in order that a proceed aspect may be displayed otherwise the signal will remain in the danger position. I imagine that it is possible for electronic systems to inadvertently display a proceed aspect due to a technical fault or incorrect maintenance - I seem to recall that this was part of the cause of the Clapham Junction disaster.

So, I ask again; Why should I disregard my concerns? What is wrong with the above reasoning? I'd like to try and understand why centralised control is seen as a good progression for the future. I'm open to being convinced that everything I just wrote is wrong!

Alternatively, if you agree I'd be interested to hear if anyone else feels the same way as I do.

 

[The Planner]

Is this basically an essay suggesting we go back to block posts, manned crossings and mechanical signalling? Why would we want to undo what has been happening for the last 60 years? How could it possibly provide the same capacity as we have now?

 

[Philip Phlopp]

OK - that's a detailed list, and signalling isn't my thing (OLE is) but since I'm here and not in a pub, here goes.

1. GSM-R coverage is checked by Network Rail on a regular basis - there are Radio Survey Coaches which tend to be sent out in the consist of the Plain Line Pattern Recognition (PLPR) test trains. The GSM-R deployment was extensively checked at the time and given the issues that previously existed with CSR and NRN deployments, there was a lot of thought put into getting things as safe and reliable as could be.
2. Electronic interlocking has demonstrably shown itself to be safe and reliable, we're looking at five decades of service now. It also typically provides a number of additional safety measures over and above pure interlocking, which do not exist or are limited with mechanical signalling. Moreton is the prime example here of a level crossing with a protecting signal - the signal cannot be cleared until the barriers are lowered, the barriers cannot be raised until the signal is returned to danger, but there is nothing to stop a train being signalled towards the crossing, the signal being reset to danger and the barriers raised prior to the train reaching the crossing. Electronic interlocking can require detection of the train beyond the crossing, or can include a time delay.
3. I can certainly agree that DOO/DCO is an issue on some stations with poorly trained platform assistants, but I don't see how a local signaller can assist here, not all signal boxes sit neatly at a station, the signaller isn't always in a position to observe trains when at a platform. I'm very much in favour of a driver and a guard (with safety critical training, PTS etc) but signalling system type and presence or absence of a bobby locally isn't going to do anything to improve safety and such distractions may increase risk (Moreton again applies).
4. Fault diagnosis is always an issue, but we want fail safe, not fail dangerous. Invergowrie amongst a hundred or more fatal accidents applies. We want the job stopped, we don't want drivers charging about at line speed thinking they've got a proceed aspect when they should be stopping at a danger aspect. There are many issues which impact on mechanical signalling which can result in the wrong aspect displaying. The newest signalling equipment has very good reliability levels, self-diagnostics and remote management functionality, meaning many faults can be located and some rectified from the ROCs. Mechnical signalling always needs boots on the ground and that is always a safety risk if there's red zone working, which there's a reasonably high chance there will be.
5. I agree about level crossings, to an extent, but as per Moreton, it's not demonstrably safer. I also think you're vastly underestimating the risk of distractions. Signallers don't just have a crossing to check, and the crossing isn't always clearly visible from the side of their box.
6. There has been more than a half century of signalling rationalisation, with power signal boxes and now ROCs (or not, if anybody can ever decide). London Bridge rationalised dozens of boxes, it itself has now been rationalised into Three Bridges. There's also a lot of boxes locked out at various times of the day, so your mechanical signalling is better argument collapses in a heap on that front.
7. Don't disagree with the driver and guard argument. It should be noted that with GSM-R, signallers can make announcements to passengers directly in the event of an incident and given the large area that ROCs control however, they can safely close routes and move one or two services to the site of a suspected incident at low speed to allow other drivers to investigate. ROCs are typically having TOC staff co-located and can better co-ordinate the management of an incident. I would argue an ROC will be better placed to handle an emergency than a one person signalbox.
8. Cyber attack is a valid concern, but using a signalling system to cause an accident would be very difficult thanks to the way in which signalling interlocking is programmed into signalling equipment. It's not a hastily thrown together bit of code running on an off the shelf Windows 10 PC. The most likely scenario is bringing the system to a halt, either intentionally, or as a fail-safe shutdown. It's something NR are assuming might well happen though.
9. Wire tension is an issue - couple of branches from a storm and you've still got tension at the box, but your signal is displaying the wrong aspect - and lets face it, wire expansion on weeks like this past week, are a major headache. Clapham was a wiring failure resulting in a wrong-side failure, rules were tightened considerably to ensure there are now more tests for this sort of issue and the Hidden Report caused huge changes in fatigue monitoring in the industry.
10. There's plenty more to go wrong in single manned box - workload can be incredibly tiring and stressful, as per Moreton, and you've got the risks of something happening to the signaller, which results in a train or section of track being left in an unsafe state. If your driver is at risk of an incident, so is the bobby in his box, whether it's a heart attack or their signal box going up in flames.

Capacity is of course the biggest issue. There's simply no way you can handle the volume of trains at key locations with manual boxes and semaphores now.

 

[Bald Rick]

Just to pick up on the Level Crossing issue. As someone who used to manage signalboxes, I can confirm that those operated locally had significantly more safety incidents than those operated remotely. Notably many of these incidents involved injuries to the crossing keepers themselves, either through working the equipment, or more rarely from passing vehicles, which is something that is near impossible with remote operation (especially fully automatic crossings!)

Another point about cost savings. The railway has been under extreme pressure for decades to reduce costs on all fronts (although I accept it may not seem like that from the outside). A typical ‘small’ signalbox will cost around £300-£400k to run per year; centralising control of, say 10 ‘boxes can easily save £3m pa in operating costs alone (that doesn’t include maintenance). Some of the big power signalling schemes in the 70s and 80s resulted in the closure of over 50 boxes.

Finally, it is often forgotten that they heyday of purely mechanical signalling was around a century ago, and lasted for a few decades at most. I forget the dates but electric signals were introduced well over a century ago, and power working and ‘centralised control’ not long after that. This was partly because it was not possible to have mechanical control of some of the more complex layouts being introduced at that time, nor was it feasible to operate the level of service required under absolute block conditions.

 

[edwin_m]

Use of computer-based systems allows many functions to be carried along a small number of wires, and for those wires to be duplicated along different routes. So they ought to be more resilient against damage, the one usually cited being someone putting a digger through the cable route.

Centralised signaling centres also have quite a few people on site, including technicians who can respond immediately, and the site can be made secure and provide the sort of ameneties people expect. Signallers can cover for each other during meal breaks, sickness absence etc. Traditional signal boxes need "relief signalmen" or more recently Mobile Operations Managers, trained to cover for many places but might not actually working them that often. There was a derailment at Knaresborough a few years ago from that cause. Also in modern times it's not ideal to have people working alone in places that are often remote and with poor security and welfare facilities. If a signaler fell sick or some terrorist decided to take over a remote box, the authorities might not even know about it for some time and getting assistance to site would take even longer.

It's also worth noting that loss of one of many block posts along a line of route can disrupt the service nearly as effectively as loss of a larger signaling centre controlling all of it, but is likely to happen more often.

Some of this could be addressed by providing modern small signal boxes across the network, but it would cost a great deal more and incidentally not look anything like the traditional railway.

I've no doubt there are issues with the move to larger control centres. One of them may be that the fire protection isn't done properly so evacuations are more common than they should be (maybe put the toaster in a hut in the car park?!). Another risk perhaps not fully addressed is the loss of local knowledge on the part of the operating staff who may never even have visited the routes they are controlling. But I don't think these are reasons to abandon the principle.

 

[RT4038]

Just to pick up on the Level Crossing issue. As someone who used to manage signalboxes, I can confirm that those operated locally had significantly more safety incidents than those operated remotely. Notably many of these incidents involved injuries to the crossing keepers themselves, either through working the equipment, or more rarely from passing vehicles, which is something that is near impossible with remote operation (especially fully automatic crossings!)

Another point about cost savings. The railway has been under extreme pressure for decades to reduce costs on all fronts (although I accept it may not seem like that from the outside). A typical ‘small’ signalbox will cost around £300-£400k to run per year; centralising control of, say 10 ‘boxes can easily save £3m pa in operating costs alone (that doesn’t include maintenance). Some of the big power signalling schemes in the 70s and 80s resulted in the closure of over 50 boxes.

Finally, it is often forgotten that they heyday of purely mechanical signalling was around a century ago, and lasted for a few decades at most. I forget the dates but electric signals were introduced well over a century ago, and power working and ‘centralised control’ not long after that. This was partly because it was not possible to have mechanical control of some of the more complex layouts being introduced at that time, nor was it feasible to operate the level of service required under absolute block conditions.

It is no co-incidence that the lines and areas with large numbers of level crossings (e.g. East Anglia, East Lincolnshire) had a more than proportionate amount of line closures, as manning costs were rising so fast.

The suggestion to return to labour intensive manual signalling is about as likely as re-instating conductors on buses!

 

[HSTEd]

• feel that centralisation removes very helpful on-the-ground assistance in the event of anything untoward happening. In more rural areas, aespecially, this has potential to delay response times to serious incidents. In said rural areas track circuits or gaps between axle counters may be greatly increased due to a lower service density and thus it may take a considerable time for an incident (in which a train is no longer moving) to be recognised by the signalling centre, which could be in excess of 100 miles away were NR's ROC plans ever to see complete fruition. As far as I'm aware train radios are supposed to issue emergency calls after a certain duration, if one assumes that the driver may be killed or incapacitated but in more rural areas this may be a problem in its own right.

Unless the train crash happens within direct view of a signal box, which would require enormously large numbers of signal boxes and huge amounts of staff, the time to recognise that a train has stopped moving seems likely to be similar if the operator is sitting in Yarm, Doncaster or even Timbuktu.
They will have the same indications on their panel and the same equipment available to communicate with trains.

• Maintenance of signalling equipment has been greatly complicated, leading to increased delays during breakdowns. In the past such tasks were generally much simpler and S&T technicians were more readily available to undertake the work. Signallers themselves are, in centralised signalling centres, often unable to resolve these problems on their own as they are detached from any actual signalling equipment. It may also be harder for potential faults to be noticed before they grow into live faulys.

In extremis, with the AW609 looking like it might actually reach production now, we can potentially have a ready team of signalling specialists somewhere in the Midlands and have them over most of the Network in under an hour of the call.
And we can have ready signalling experts standing ready to assist in a major fault, in a way that is simply uneconomic if people can only move at the speed of surface transport. (This is an extreme suggestion and I am sure lots of people would have a problem with it, but the fact is that nothing costs money like having lots of staff sitting around waiting for a fault to happen)

• Until the present time (the past few months during which everything has been very abnormal on the railways) there has, as I see it, been little need to try and reduce staffing levels in a bid to reduce running costs. As rail travel had been on an upward curve, profits had been reasonable for many operators and potentially also for Network Rail (although I only looked into the money passing through TOCs when I first looked into this several years ago).

Network rail, and the industry as a whole, consumes many many billions of public money every year.
It may try to dress this up as "upgrade" spending, but upgrades are often scheduled to make renewals unnecessary - so its an accounting trick.

Electronic, computer-based, signalling systems may in the future leave the railway vulnerable to cyber attack and the consequences that might result could be devastating. It may be possible to attack a single ROC and at the very least take a huge swathe of the network out of operation in a way that simply could not be managed under localised mechanical control without a vast number of operatives to dismantle rodding runs and wires.

People often claim that ROCs have this vulnerability, but the fact is that a railway network will fall over if 1% of the signals are out of action, if they are the wrong signals.
Lets say you have a fault that takes out signalling at Clapham Junction.

 

[DB]

People often claim that ROCs have this vulnerability, but the fact is that a railway network will fall over if 1% of the signals are out of action, if they are the wrong signals.
Lets say you have a fault that takes out signalling at Clapham Junction.

Yes, to an extent - but the ROCs when at their full extent will control so much over such a wide area that it will have a far greater impact if one is suddenly out of action than a failure of any of the smaller boxes of the past could have. I do think this is a valid criticism of them - obviously there needs to be centralisation to a degree, but there is certainly a case to argue that they are taking that approach too far.

In most mission-critical IT systems (and that is effectively what signalling is), there will be two completely separate sets of equipment many miles apart. But of course signalling differs from many IT systems in that it also requires skilled operators at each location.

 

[Tio Terry]

"Electronic, computer-based, signalling systems may in the future leave the railway vulnerable to cyber attack and the consequences that might result could be devastating. It may be possible to attack a single ROC and at the very least take a huge swathe of the network out of operation in a way that simply could not be managed under localised mechanical control without a vast number of operatives to dismantle rodding runs and wires."

I don't think you understand how data links between control centres - be that ASC's, IECC's or ROC's - and remote interlocking are configured or what their diversity arrangements are. I'm not going to go into detail on an open forum such as this. Let's just say it's not an Internet related connection.

 

[edwin_m]

"Electronic, computer-based, signalling systems may in the future leave the railway vulnerable to cyber attack and the consequences that might result could be devastating. It may be possible to attack a single ROC and at the very least take a huge swathe of the network out of operation in a way that simply could not be managed under localised mechanical control without a vast number of operatives to dismantle rodding runs and wires."

I don't think you understand how data links between control centres - be that ASC's, IECC's or ROC's - and remote interlocking are configured or what their diversity arrangements are. I'm not going to go into detail on an open forum such as this. Let's just say it's not an Internet related connection.

A couple of people lifting trough lids and applying a bolt-cutter to the cables therein could sever the links between mechanical boxes just as effectively.

 

[Tio Terry]

A couple of people lifting trough lids and applying a bolt-cutter to the cables therein could sever the links between mechanical boxes just as effectively.

Links between older mechanical boxes are seldom diversely routed, so in that situation the problem could be much worse.

 

[edwin_m]

Links between older mechanical boxes are seldom diversely routed, so in that situation the problem could be much worse.

Indeed. With older boxes being so close together the only feasible diverse route would be on the other side of the formation, and someone intent on causing trouble could just tackle that one too.

 

[HSTEd]

Indeed. With older boxes being so close together the only feasible diverse route would be on the other side of the formation, and someone intent on causing trouble could just tackle that one too.

Well you could also use E-band (~60Ghz) point to point links, but the point remains well made.

 

[sem34090]

Interesting points raised; I am beginning to appreciate some of the advantages of modernisation and centralisation, though less so in the latter instance.

I'm not sure if we already have, but it would be interesting to see comments from signallers on this.

 

[LNW-GW Joint]

Despite the technical and financial benefits of centralisation with modern equipment, NR progress has slowed markedly recently.
Resources are now going mainly into a second/third modernisation of already non-mechanical routes.
Euston, for instance, has been resignalled three times since WW2.
The recent and current WCML, ECML, GEML and GWML resignalling replaces life-expired 1960/70s technology, not mechanical equipment.
I get the impression NR is barely keeping up with the obsolescence of earlier electrical/electronic systems.

Meanwhile the remaining mechanical routes soldier on in their time-warp seemingly for another generation.
This covers routes like the Marches and North Wales (slated to go into Cardiff ROC), and also the Montrose-Aberdeen route currently in the news.
The "Stockport 5" continue their AB role in defiance of two failed modernisation programmes.

It seems the sheer technical task of resignalling takes significant NR resources, including capital spend, so they are focussed on the critical routes.
These are currently the ECML and TP upgrades rather than the elimination of mostly rural mechanical signalboxes on secondary routes.
The West Midlands scheme has, over a decade or so, modernised all the routes radiating from Birmingham, but that seems an isolated success.
ETCS is, of course, the next challenge, as it promises to reduce costs significantly while offering higher functionality, and with less lineside equipment.
But it will still take nearly a decade even to reach Stoke Tunnel.

 

[Bald Rick]

Euston, for instance, has been resignalled three times since WW2.

Albeit only once in the last 54 years.

 

[edwin_m]

Despite the technical and financial benefits of centralisation with modern equipment, NR progress has slowed markedly recently.
Resources are now going mainly into a second/third modernisation of already non-mechanical routes.
Euston, for instance, has been resignalled three times since WW2.
The recent and current WCML, ECML, GEML and GWML resignalling replaces life-expired 1960/70s technology, not mechanical equipment.
I get the impression NR is barely keeping up with the obsolescence of earlier electrical/electronic systems.

Meanwhile the remaining mechanical routes soldier on in their time-warp seemingly for another generation.
This covers routes like the Marches and North Wales (slated to go into Cardiff ROC), and also the Montrose-Aberdeen route currently in the news.
The "Stockport 5" continue their AB role in defiance of two failed modernisation programmes.

It seems the sheer technical task of resignalling takes significant NR resources, including capital spend, so they are focussed on the critical routes.
These are currently the ECML and TP upgrades rather than the elimination of mostly rural mechanical signalboxes on secondary routes.
The West Midlands scheme has, over a decade or so, modernised all the routes radiating from Birmingham, but that seems an isolated success.
ETCS is, of course, the next challenge, as it promises to reduce costs significantly while offering higher functionality, and with less lineside equipment.
But it will still take nearly a decade even to reach Stoke Tunnel.

Indeed.

Of the three main generations of signaling, the first (mechanical) one can be made to continue indefinitely as long as the skills to maintain and modify it are still available and replacement parts can be hand-crafted where no longer available from suppliers. The areas still using it are mostly, relatively speaking, operational backwaters so problems will have far lower consequences than on the busier lines (one reason we don't get to hear about them so much). There would be an operational cost saving from replacing it, but with capital cost for new signaling relatively high it's difficult to justify especially when resources are scarce. The cost of one lever's worth of re-signaling would probably pay for running an AB box for a year, so for a box with 10-20 levers the return on investment gets too low to be worthwhile. However that's not a reason to build new small boxes today, because doing so would incur both the high capital cost of re-signaling and the extra operating cost for more staff.

The third generation (computer-based) has some issues of obsolescence but has modularized the technology so it's possible to replace only the problem parts rather than having to re-signal the whole lot. Also the necessary functions are implemented by configuration data, which can be changed fairly easily for things like new track layouts.

It's the relay-based schemes, installed between the 1930s (but few if any of that vintage remain) and the 1980s that are most concerning. The relays themselves have some lifetime issues and trackside equipment can be upgraded piecemeal but the major concern is the wiring within the interlockings and perhaps also the panels. In some the insulation has degraded and doing any work on them could cause it to crumble with the risk of wrong-side failures from unintended electrical connections. Even if this isn't a problem, the logic of the interlocking is hard-wired so any layout or functionality change means re-wiring, which can be hugely disruptive and carries its own safety risks (see the Waterloo collision mentioned above). Immunisation for electrification is also a huge task for these systems, unless it was built in from new. So while it's usually possible to re-control existing signaling to a new control centre, sooner or later one or other of these issues will trigger the need for wholesale re-signaling. When that happens the layout will probably be updated to current needs, which is very necessary but adds extra cost.

So it's not surprising that NR's limited funds and resources are mainly directed towards either life-extending or replacing power signalling that's older than about 1990. The rate of replacement is currently too slow to prevent the average age of the equipment from increasing. The hope is that ERTMS will deliver some cost savings and allow other areas still relying on this technology, such as the northern WCML and the South Western, to be dealt with more efficiently. There was a spate of "modular signaling" schemes a few years ago that eliminated some absolute block (Ely-Norwich, Crewe-Shrewsbury and others) but although I haven't seen any figures I get the impression these didn't deliver the predicted cost savings, and I don't believe there are any more in the pipeline.