[Go Up], [Go Back], [Go On].

1.2. A Whistle-stop Tour of Railway Signalling

Railway signalling engineers face a difficult distributed control problem. Train drivers can know little of the overall topology of the network through which they pass, or of the whereabouts of other trains in the network and their requirements. Safety is therefore invested in the control system, or interlocking (the glossary clarifies the meaning of unfamiliar signalling terms emphasised thus), and drivers are required only to obey signals and speed limits. The task of the train dispatcher (signalman, or signal operator) is to adjust the setting of switches and signals to permit or inhibit traffic flow, but the interlocking has to be designed to protect the operator from inadvertently sending trains along conflicting routes.

The network can be operated with more security and efficiency if the operators have a broad overview of the railway and the distribution of trains. Since the introduction of mechanical interlockings in the late 1800's, and as the technology has gradually improved, the tendency has therefore been for control to become progressively centralised with fewer signal control centres individually responsible for larger portions of the network. In the last decade Solid State Interlocking has introduced computer controlled signalling, but the task of designing a safe interlocking remains essentially unchanged.

Solid State Interlocking is a data-driven signal control system designed for use throughout the British railway system. SSI is a replacement for electromechanical interlockings---which are based on highly reliable relay technology---and has been designed with a view to modularity, improved flexibility in serving the needs of a diversity of rail traffic, and greater economy. The hugely complex relay circuitry found in many modern signalling installations is expensive to install, difficult to modify, and requires extensive housing---but the same functionality can be achieved with a relatively small number of interconnected solid state elements as long as they are individually sufficiently reliable. SSI has been designed to be compatible with current signalling practice and principles of interlocking design, and to maintain the operator's perception of the behaviour and appearance of the control system.

At the signal control centre a control panel displays the current distribution of trains in the network, the current status of {signals}, and sometimes that of point switches (points) and other signalling equipment. The railway layout is depicted schematically on the panel by a graphic similar to Figure 1.1.

Figure 1.1: Signals (Si) on the control panel appear on the left to the direction of travel, each signal has a lamp indicator, and each main signal has a button. Switches (points, Pi) show the normal position, and there is usually a points key on the panel so one can throw the points `manually'. Lamps illuminate those track sections (Ti) over which routes are locked (white), and those in which there are trains (red).
There are seven (three aspect) main signals shown here, and three sets of points. It is British Rail's practice to associate routes only with main signals. The operator can select a route by pressing the button at the entrance signal (say, S7), then pressing the button at the exit signal---the consecutive main signal, being the entrance signal for the next route (S5). This sequence of events is interpreted as a panel route request, and is forwarded to the controlling computer for evaluation. Other panel requests arise from the points keys which are used to manually call (and hold) the points to the specified position, or from button pull events (to cancel a route by pulling the entrance signal button).

When the controlling computer receives a panel route request it evaluates the availability conditions specified for the route. These conditions are given in a database by Geographic Data which the control program evaluates in its on-going dialogue with the network. If the availability conditions are met the system responds by highlighting the track sections along the selected route on the display (otherwise the request is simply discarded). At this point the route is said to be locked: no conflicting route should be locked concurrently, and a property of the interlocking we should certainly verify is that no conflicting route can be locked concurrently.

Once a route is locked the interlocking will automatically set the route. Firstly, this involves calling the points along the route into correct alignment. Secondly, the route must be proved---this includes checking that points are correctly aligned, that the filaments in the signal lamps are drawing current, and that signals controlling conflicting routes are on (i.e., red). Finally, the entrance signal can be switched off when the route is clear of other traffic---a driver approaching the signal will see it change from red to some less restrictive aspect (green, yellow, etc.), and an indicator on the control panel will be illuminated to notify the operators.

The operation of Solid State Interlocking is organised around the concept of a polling cycle. During this period the controlling computer will exchange messages with each piece of signalling equipment to which it is attached. An outgoing command telegram will drive the track-side equipment to the desired state, and an incoming data telegram will report the current state of the device. Signalling equipment is interfaced with the SSI communications system through track-side functional modules. A points module will report whether the switch is detected normal or detected reverse depending on which, if either, of the electrical contacts in the switch is closed. A signal module will report the status of the lamp proving circuit in the signal: if no current is flowing through the lamp filaments the lamp proving input in the data telegram will warn the signal operators about the faulty signal.

Other than conveying status information about points and signals, track-side functional modules report the current positions of trains. These are inferred from track circuit inputs to the modules. Track circuits are identified with track sections which are electrically insulated from one another. If the low voltage applied across the rails can be detected, this indicates there is no train in the section; a train entering the section will short the circuit causing the voltage to drop and the track section will be recorded as occupied at the control centre. Track circuits are simple, fail-safe devices, and one of the primary safety features of the railway.

All actions performed by Solid State Interlocking---whether in response to periodic inputs from the track-side equipment, aperiodic panel requests, or in preparing outgoing command telegrams---are governed by rules given in the Geographic Data that configure each Interlocking differently. Some examples of route locking and release data are explained in Section 1.3.3 below. The Geographic Data Language (GDL) is introduced in more depth in Chapter 2. In the following section an outline is given of the architecture of the system, and the organisation of the software. These details are needed for a proper appreciation of the models developed in succeeding chapters.

[Go Up], [Go Back], [Go On].
Matthew Morley, Edinburgh. Date: 29 November, 1998