london underground signalling - tubeprune course sig v2.pdf · london underground signalling 1 -...
TRANSCRIPT
1
London Underground Signalling 1 - Systems Before ATO
“A Crash Course in London Underground Signalling”
by Piers Connor
Part 1, Draft 2
Date: 15th July 2010
2
1 - Brakes and Blocks Introduction Railway control and signalling systems and the associated communications systems (CoCoSig as it’s called now), play a vital part in the safe operation of railways. Nowhere is this more important than on intensely trafficked suburban and urban railways like the London Underground, where vital safety systems of train control allow the railway to move over 3 million passengers a day efficiently and safely. This booklet examines the background, development, engineering and operation of signalling on the London Underground and shows how it developed from a pioneer safety system at the start of the 20th Century to pioneering full automatic train operation in the 1960s and from there into the modern train control systems of the 21st Century that are now being installed.
It may be that some readers have no previous long term or detailed experience in railway signalling so here we cover some basics which will be well known to others. In addition, it should be understood that there are subtleties in the basic approaches to the LU system that differ from main line practice, so references to main line signalling are included for comparison where relevant.
Brakes Any proper understanding of signalling has to begin with an understanding of the limitations of train braking. Signalling was introduced as a means of preventing train collisions. It was realised very early on in the development of
railway operation that trains were not easy to stop quickly. There were two reasons for this. Firstly, train brakes were not continuous, that is, not all vehicles were braked and those that were only had manually operated brakes. Braking was a haphazard business at best, relying on whistle signals from the driver to call for brakes and then on the brakesmen to actually provide them. It didn’t always work very well, especially as trains got heavier and speeds rose. Things were eventually resolved in the late 19th century by the adoption of continuous brakes, which were more technically efficient, which were remotely controlled by the driver and which could be used in emergency by other members of staff.
The second problem for train braking was the adhesion factor between wheel and rail. This was much less easy to resolve.
Adhesion As any train driver will tell you, driving a train is easy. The difficult bit is stopping it. It’s normally easy to get a train going but it’s much more difficult to stop it, particularly to stop it in the right place. To do this consistently, whilst avoiding damage to the train, giving a reasonably comfortable ride to the passengers and keeping time, requires skill and concentration. The reason for this is simple – the adhesion available for a train with a steel wheel on a steel rail is such that the braking distance is considerably more than you get in a car with rubber tyres on the average road. The adhesion between a tyre and the road surface can be measured at over 80%. The main line railways calculate their braking distances on the basis of 8% adhesion, an order
of magnitude less. So, if you are driving your car at 70mph and you need to stop, you think about it (say 20m) and then brake (75m), total 90m. Now transfer yourself to the cab of a train at 70
Fig. 1: Schematic illustrating the calculation of the braking distance required by a main line train travelling at 125 mph (200km/h or 55m/s). The formula is v2/2b where v is the initial speed of the train and b is the average deceleration rate. The brake rate is set at a comfortable 0.7m/s2. A sighting distance, calculated from the usual time allowed of 10 seconds, must be added to the total. Note that the signal can be referred to as the limit of movement authority or LMA. Diagram after F Schmid.
3
mph. Think about it (20m), apply the brake and wait for it to feed up to the required pressure on the whole train (60m), then wait for the train to stop (950m approx.), a total 1030m, or more than a kilometre. An emergency brake application at this speed might get the train to a stand in 700m, if it’s not raining. This means that a train’s braking distance is more than ten times greater than that of a car and (trust me) it seems like a million times greater when you are at the front of a train with the emergency brake fully applied and you know there is nothing you can do to avoid hitting something in front of you.
All railways – with the exception of those few using rubber tyres, which have rather different problems – suffer from this problem of adhesion. Although we could reasonably expect to get at least 20% adhesion in the dry tunnels of the London Underground, in the open, where there is always the likelihood of moisture, grease, ice and even leaves, the current adhesion limit assumed is 6.5% for the design of automatic systems. What all this tells us is that, since trains can’t stop instantly or even very quickly, you need a lot of advance warning of when you are closing in on a train ahead. Satisfactory ways of doing this took a long time to develop.
Blocks Early systems used to pass trains from station to station, the line between two stations effectively becoming a section1 or, as it is described on main line railways, a “block”. A train was only allowed to leave the station at the entrance of the block when it was confirmed that the train ahead was
1 On a standard two-track railway, it is two sections, one for each direction.
clear of it. A visual signal was placed at the entrance to the block to show the driver whether it was OK to proceed. Soon, a rule evolved, which is still valid today -‐ “only one train is allowed in any one section at any one time”. Obviously there are carefully managed waivers for coupling, rescue and the like but that’s the basic rule.
Gradually, this arrangement was developed so that the signalman controlled the area around his station and the admission of trains into the sections approaching his station (Fig. 2). The whole operation was manual and relied on the vigilance of the staff to make it work safely. The signalman (nowadays called a “signaller”, in case he’s a she, or on LU, “Service Controller”) had to watch out until he saw the train depart his area of control before he would pass the “train out of section” message to the signalman in rear and subsequently “accept” another train when offered it.
Fig. 2: Diagram of the traditional layout of block signaling showing the area of control managed by a signal box. The Starting signal at each station protected the entrance to the block section. This signal could not be cleared until permission was granted by the signal box at the next station. The Home signal protected the station approach. The Distant signal provided advance warning of the home signal. The area between the home and starting signals was “station limits and was under the local control of the signal box.
On and Off
Amongst railway people, signals are said to be “on” or “off”. “On” means the signal is showing a stop indication while “off” means it is showing a proceed indication. These descriptions refer back to the very early days of railways when a signal often consisted of a board on a post. If you wanted to tell the driver to wait, you placed the board on the post, facing the driver, so the signal was “on” the post. When it was OK for the driver to go, you took the board “off”.
Even today, some main line drivers still refer to signals as “boards”. In some places, like the Midlands, they are called “pegs”. On the Underground, they are referred to as “sticks”. I have no idea why.
4
2 - Detection and Protection Train Detection
During many years of development, the signalman was gradually provided with electrical and mechanical interlocks and “instruments” of various types, which were designed to help prevent him from making some basic errors and to remind him of the status of the blocks he controlled. Train detection was visual, signalmen using what aircraft pilots refer to as “the Mark 1 eyeball” to confirm the passing of trains. This worked OK as long as everyone was paying attention and things didn’t get too busy but a number of accidents over the years showed that it wasn’t foolproof. Signalmen could and did, occasionally let trains run into occupied sections with sometimes fatal results. It was from these incidents that the idea of some sort of automatic train detection was thought desirable and, by the late 19th century, it had arrived in the form of the track circuit, the principle of which is shown in Fig. 3 above.
The Track Circuit A track circuit is just a low voltage circuit fed into a section of track. A train is detected when it
occupies the track and shorts out the circuit. The system could be used to prevent errors by signalmen operating signal levers or it can be used to operate the signal itself. Originally it was battery operated, using direct current but it later evolved into a more sophisticated system using an AC supply.
If you pass a low voltage (5-‐10v AC) electric circuit through the running rails you can use the circuit to operate a relay to indicate current is flowing. If current is flowing the relay can be used to switch on a light -‐ in our case a green signal lamp lit by 100v AC. If the current stops flowing, the relay contacts drop to switch the feed to the red light. The circuit is normally arranged so that the feed is at the far end and the relay at the entry end of the circuit. This gives continuity to the detection ahead of the train while it passes through the section.
Since the wheels and axles of train are steel, they short circuit the track as soon as they enter the section and you can use the loss of the circuit to show the section is occupied. The track circuit “goes down” as they say, the relay drops open and the signal shows a red light to the driver of
Fig. 3: Schematic of simple track circuit showing the arrangement for automatically operating the signal protecting the section. The diagram shows the section occupied by a train and the signal at danger. If there was no train in the section, the circuits would operate as shown by the dotted lines and the signal would show a green aspect. In reality, many sections have an insulated block joint in one rail only but the principle is the same. After Japan Railway and Transport Review.
Fig. 4: Diagram showing the basic arrangement of block sections on a London Underground plain track. Each signal stands at the entrance to the block it protects. The signals operate automatically and are usually identified by the letter A followed by a number. Signals are numbered, where possible, with even numbers in one direction and odd numbers in the other.
5
the next train to approach. When the train leaves the section, the circuit “picks up” and the relay is energised and switches the signal to green. If you divide the line up into sections and isolate each section electrically from its neighbours by means of “insulated block joints”, the whole line can be protected with this system of “automatic signalling” (Fig. 4 above).
A word of caution here: A track circuit doesn’t actually detect the presence of a train, it detects the absence of a train. As long as the circuit is complete, you can be pretty sure there isn’t a train there. If the circuit isn’t complete, there might be a train there.
The track circuit was adopted by the Underground in 1903 and, eventually, by many other railways and it is still the principal form of train detection today. Modern versions have become available, for example where adjacent circuits use different, electronically generated frequencies and avoid the need for insulated joints – jointless track circuits or JTCs. Then there are axle counters, which don’t require track circuits but which adopt different rules. More on these later.
The Trainstop An additional feature of the Underground’s signalling system, installed at the same time as automatic signals, is the trainstop. Each signal where a train might be required to stop, is provided with a mechanical device adjacent to the right hand running rail. The device consists of an arm, which operates in conjunction with the signal, being raised to stop a train which attempts to pass if the signal shows a stop aspect. The train is provided with a “tripcock”, matching the location of the trainstop, which is connected to the braking system. If the tripcock is operated by the trainstop, it causes an “irretrievable” emergency brake application, i.e. the tripcock cannot be reset until the train has stopped.
The trainstop is raised by a spring and lowered by a compressed air cylinder arrangement, using air supplied from a trackside pipe – the air main -‐ see box on next page. This design ensures that the loss of air supply will cause the trainstop arm to be raised.
The use of automatic signals with trainstops for over 100 years has made the Underground one of the safest railways in the world. Nevertheless,
the use of a complex mechanical device, coupled to the automatic signalling system, does not come without a price. The air supply, trainstops, interfaces and associated train equipment all require regular checking and maintenance and this presents a considerable manpower burden. Modern systems of train control can eliminate the system.
Overlaps Now that each section is protected by a stop signal and a trainstop, you might be forgiven for thinking that trains were now safe from being run into from behind. Unfortunately, this is not so. As we’ve seen above, a train needs lots of room to brake and, if it passes a signal showing a stop command and gets tripped, there will be quite a distance before it comes to a stand. If the train in
Fig. 6: Close-up of the trainstop/tripcock interface used on London Underground. The trainstop arm is shown raised behind its equipment box. The tripcock lever mounted on the train is shown in white. The trainstop arm is raised by spring operation and lowered by compressed air supplied from the trackside.
Fig. 5: View of London Underground automatic, 2-aspect signal, with associated trainstop mounted on the right hand side of the right hand running rail. When the signal shows a stop aspect, the trainstop arm is raised and when a proceed aspect is shown the trainstop arm is lowered. The air supply to the trainstop is carried by a pipe running alongside the track and is passed to the trainstop as required through an electrically operated valve.
6
the section protected by that signal is just inside the section, a short distance beyond the signal, the tripped train will hit it before it stops (Fig. 7 below).
To remove this possibility, you have to give the tripped train room to stop before it enters the section. This means it must be tripped before it reaches the section; in fact, it must be tripped a full braking distance before it reaches the section. So, to provide this distance, you have to move the signal and its trainstop a safe braking distance back from the entrance to the section. The distance the signal has to be moved back is called the overlap (Fig. 8 below).
On London Underground, overlaps are calculated on a site by site basis. Over the years, a complex
formula has evolved which takes into account the gradient, the maximum possible train speed, the braking capacity, several margins for error and even the position of the tripcock relative to the front of the train. In broad terms it works out as the emergency braking distance plus about 30%.
In many locations, the calculated overlap is longer than a train’s length, so it would be possible for the train to pass the signal entirely before entering the section that the signal is protecting. Until the train enters the section and the track circuit “goes down”, the signal shows a green aspect behind the train – not good practice. To eliminate this possibility, the overlap has its own track circuit (the “replacement track”) so that the signal will return to danger as soon as the leading wheelset of the train passes it. This feature means that most Underground signal sections have two track circuits and this is
reflected in the LU track circuit numbering system for automatically signalled areas so that, in our example of Section 123 (Fig. 7), the track circuits would be numbered 123a and 123b, the latter being the overlap of Signal A125. Both track circuits still form the section 123 and both must be clear for Signal A123 to show a green aspect.
Fig. 7: Schematic demonstration of how a tripped train (Train 2) could enter an occupied section and collide with a train ahead (Train 1). This is prevented by what is called an “overlap”, Fig. 8 below.
Fig. 8: Schematic showing how each signal is positioned a safe braking distance back from the entrance to the section it protects to allow room for a tripped train to stop. This distance is called the overlap. Note that the overlap normally has its own track circuit to ensure that the signal returns to danger as soon as the front of the train passes it. Each block section is here shown in colour with the LU track circuit numbering convention.
Air Main
The problem with air operation of trainstops and points is that you need a compressed air supply, which will be available all over the system, so an “air main” has to provided along each side of each route. London Underground has the world’s largest interconnected compressed air system. Compressors in the traction substations supply the air main at 60 psi (about 4 bar). Naturally, the air supply system is expensive to maintain, sensitive to extreme weather conditions and prone to failure. Around the system, there are 48 compressors working just to keep the pressure up against leaks in the pipework.
LU wants to get rid of the air main but it will only be able to do so when all trainstops and air operated point machines have gone. On the Central Line, which now has ATO and electro-hydraulic points, much of the air main has been removed but it is still required in some places for the old “P” type fare gates – the ones that open quickly with a loud “clunk”.
7
Repeaters As trains need a lot of distance to stop, drivers need to know well in advance about the condition of the signals ahead of them. In many cases they can’t see the signal early enough to be able to stop at it if it is showing a danger aspect. This problem was recognised very early on in the development of railways, so drivers were provided with “Distant” signals. The Distant repeated the indication of the stop signal and gave the driver a good chance of stopping if he needed to.
The Underground adopted the same idea, but modified to suit its close headways and tunnel conditions. On main line railways using semaphore signals, distants are normally used in specific circumstances regardless of sighting but, on the Underground, repeaters are only provided where sighting of the stop signal is compromised in some way. Since the standard Underground stop signal is a two-‐aspect, red or green signal, repeaters for automatic signals are two-‐aspect signals showing green or yellow aspects, depending on the aspect of the stop signal. Repeaters for automatic signals are lettered, on a yellow plate, “R” plus the number of the associated stop signal.
Although a repeater is designed to repeat the aspects of its associated stop signal, there is a period when it doesn’t. If a signal and its repeater are both showing green2 and a train approaches, it will pass the repeater first. As it carries on, it is likely to be fully past the repeater before it reaches the stop signal. This means the repeater is showing green behind the train. To
2 A repeater will show green when the signal it repeats shows green and its trainstop is lowered.
prevent this, like the overlap, the repeater has its own “replacement” track circuit so that, as the train passes it, it changes from green to yellow. As a result, in the short time the train is between the repeater and the signal it repeats, the signal will show green while its repeater shows yellow, as shown in Fig. 9. So, you could say that a repeater repeats the aspects of its associated stop signal but, er, not all the time.
“Well”, you might ask, “Why go to this trouble to prevent a green light showing behind a train? After all, there is a red signal protecting the section it occupies (A123 in Fig. 9), so there won’t be any way the driver of a following train can see the green of the repeater.” Well, actually, there is. It’s called the “Stop and Proceed Rule”.
Fig. 9: Schematic of section of line showing how a repeater R125 shows a yellow aspect while its associated stop signal shows green using an additional track circuit. This ensures that a train will not have a green signal showing immediately behind it. Section 123 (shown in orange) now has three track circuits.
The First Automatic Signals
Automation of signalling, using track circuits, came to the Underground early. An automatic signal, using a track circuit operated by the passage of trains instead of by a signalman using a lever connected to it by a long wire, was tried by the District Railway on the Hounslow branch in 1901. It was imported from the US (as was much of the original Underground technology) and it was successful enough for a complete system of them to be tried on the Ealing & South Harrow Railway (now Rayners Lane branch as far as South Harrow) when it was electrified in 1903. This too was successful and the Underground adopted it for its new tube lines and for the electrification of the District Railway. The Metropolitan also adopted automatic signalling eventually but it was never fully integrated with the other lines until it was taken over by London Transport in 1933.
8
3 – Rules and Enforcement Stop & Proceed It was discovered very early on that automatic signals don’t always behave themselves. Now and then, they would fail to clear after the train had left the section they were protecting. The “signal failure”, bane of the commuter, had arrived. Actually, a signal staying at red when the train isn’t in the section is not actually a failure. It is the system degrading to the next level of safety. Something hasn’t done what it was it is supposed to do so the signal isn’t about to let trains go past it to enter a section which might be occupied. It stays at red. It’s inconvenient but safe.
In the early days of Underground electric train operation, there was no radio and few phones. Trains in tunnels were effectively isolated from the rest of the world. To allow some sort of contact to be made in the event of a signal remaining at danger, the stop and proceed rule was introduced. This rule told the driver to wait one minute (nowadays two) and then proceed past the signal slowly, basically driving on sight. The phrase “extreme caution” was developed. Of course, the train would be tripped. The driver had to reset the tripcock and then move off very slowly into what might be an occupied section.
This process achieved two objectives. It allowed a train stuck at a red signal to move forward to the next station at least and let everyone know at “Euston, we have a problem”. Also, it provided a means for a stalled train to be approached and perhaps, be assisted by the next train – the classic “push out”. Both have been used, the former the most regularly. Today, with train radio, the process is a bit easier. At least the driver can call up the control room and ask if they know what’s going on.
For our situation, where a train is in the section ahead and its full length has passed a repeater, a following train “applying the rule” should not be shown a green aspect. This is why repeaters have their own track circuits.
SCAT Unfortunately, over the years, drivers occasionally took a rather relaxed view of “extreme caution” and some nasty rear-‐end shunts took place. The worst of these was in the tunnel near Stratford (Central Line) on 8th April 1953, when 12 people were killed but there were a number of others both before and after this time and it was not until a spate of collisions and near misses in the 1960s and ‘70s that a system known as “speed control after tripping” (SCAT) was introduced. The objective was to enforce slow speed on a train after it had been tripped at a signal. It appeared on the 1973 Tube Stock when that went into service in 1975, although it was then referred to as “tripcock delay”. It required the driver to proceed at slow speed whilst an indicator light was illuminated. It was retrofitted on refurbished trains (and provided on new stock) from the mid-‐1990s.
SCAT is simply a 3-‐minute electronic delay inserted into the control system that prevents a train exceeding (usually) 10 mph (17km/h) until 3 minutes have elapsed. At 9 mph the driver gets
Risk Review
After the Kings Cross fire of 1987, a full review of the safety risks of all the Underground’s operations was undertaken and the possible speeds of trains after “carrying out the rule” was shown to be a high risk item. Previously, it had been recommended by Her Majesty’s Railway Inspectorate (HMRI) that the rule should be withdrawn. There had been several incidents during the 1980s which showed the rule’s vulnerability due to overspeeding – in particular, Leyton (two occasions) and Kilburn, where a driver was killed on his first day on the front alone. The rule was not withdrawn – it was simply impossible to leave a train sitting in on a line with no one knowing what was going on. However, the introduction of centralised signalling control and train radio did make it easier to communicate information.
Following the Leyton and Kilburn incidents, HMRI had recommended, in a report of 1991, that a speed limit be enforced after carrying out the rule but it wasn’t until the early 1990s that a reliable, train-mounted, time-delay system was available and a way of fitting it to older stocks had been worked out. Once it was, it was implemented as part of the safety improvements programme for refurbished trains, which included interior fire-hardening and the introduction of the PEA system in place of the old emergency stop valves.
9
an audible alarm and if he goes over 10 mph, the service brakes apply. It basically enforces the “extreme caution” rule. Now, if a driver isn’t paying attention after carrying out the rule, a 10 mph bash will bend a bit of metal but it is unlikely to kill anybody. In any case, at that speed, even the doziest of drivers is likely to see a train ahead and be able stop before hitting it.
One might ask why it took so long to put such a system into place and why it wasn’t put on older stocks before the refurbishment programme of the early 1990s. Well, quite simply, the money wasn’t there. The older train equipment was not easily adaptable without huge expense and there was (and still is) a reluctance to put anything new on trains which might affect their reliability.
The introduction of SCAT has produced some problems of its own. Now, whenever a train passes a signal at danger, there is the 3-‐minute crawl afterwards, which doesn’t help service reliability. It also highlights accidental tripping, known as the SPAD (Signal Passed At Danger), when a driver misjudges a signal stop or suddenly sees a green signal turn to red in front of him. Largely as a result of some hostile media comment, SPADs are now regarded as a safety issue which needs monitoring by safety regulators, so they get reported through an official network.
London Underground also regards SPADs as a nuisance. Trains forced into SCAT after getting tripped delay the service and a number of initiatives have been tried to reduce the number of SPADs. Crews involved in such incidents always get management attention of one sort or another.
Dual Aspect & Trainstop Proving A feature of London Underground signalling is double protection. Nothing is ever allowed to be exposed to a single fault which could render it unsafe. Trainstop operation is a good example. A trainstop is the ultimate protection for the train. When a signal shows a stop aspect, the trainstop is raised to trip into action the emergency brakes of a train which passes the signal. The trainstop is lowered only when the signal shows a proceed aspect.
Now, the trainstop is raised by a spring and held down by compressed air pressure. This means that, if the air pressure is lost, even if the signal is
clear, the trainstop will automatically rise. The signal control circuit detects this and causes the red aspect to appear, even though the section ahead is clear and the green aspect is lit. The driver will then see both red and green together -‐ the “dual aspect” – which he will treat as a stop signal. He then applies the “stop & proceed” rule.
The other possibility for a trainstop malfunction is that it doesn’t go up when the signal is red. It has happened – suppose an empty drinks can gets wedged between the trainstop and its control box – so a protection circuit called “trainstop proving” is used. This circuit prevents the signal in rear of our signal from clearing if our signal is red but the trainstop hasn’t gone up. This is known as “trainstop proving”. This kind of protection is used frequently in signalling circuitry and is nowadays called “diversity” – never have a single point of failure, always check everything twice.
Four Aspects?
Because you can only have one train in one section at one time, if you want to let more trains through the system, you have to reduce the length of the sections. This will mean that successive signals will be closer together. Sometimes, this can mean that the signal for the section you are approaching has the repeater for the next stop signal on the same post. Semaphore signals are also seen like this – the distant for the next signal is mounted below the previous stop signal.
Fig. 10: LU signal post carrying a stop signal above the repeater for the next signal. Note the two identification plates, one white, one yellow.
10
On the Underground, particularly in open sections, the repeater and previous stop signal were often made up from a combined signal unit with four aspects. If all the signals were clear, the combined signal would show two greens – green for the stop signal (always at the top) and green for the repeater of the next signal. The signal head is as shown in Fig. 10, above.
This design should not be confused with the 4-‐aspect signals used on the main line. The main line 4-‐aspect signal indicates the state of the road over four sections. The sequence of operation is red, single yellow, double yellow and green. Also, the main line 4-‐aspect signals have only one identification plate. The Underground version, actually being two signals, has two number plates, one in white for the stop signal above another in yellow for the repeater.
Certain signals on the Metropolitan Line north of Harrow-‐on–the-‐Hill are genuine 4-‐aspect signals, installed to provide sufficient warning to main line trains operating with longer braking distances than usual on the Underground. These areas do not have repeater signals, since they could be confused with a multi-‐aspect yellow. If a repeater is necessary because of sighting problems, a banner signal is used. Rickmansworth southbound comes to mind as one place which has a banner signal.
Nowadays, the 4-‐aspect look-‐alike stop signal and repeater combination as a single signal head are not being installed for new installations. New combined stop and repeater signals consist of two separate 2-‐aspect signal heads, even if they are on the same post.
In Rear and In Advance When discussing operations on a railway, particularly when you are dealing with an emergency, you have to be sure you know where everyone and everything is. Over the years, vocabulary has developed to indicate locations of trains, signals, structures and people in relation to other objects along the line. Sometimes, to
the outsider, these expressions can be confusing. Two such are “in rear of” and “in advance of”. The following diagram, Fig. 11 below, shows what these two expressions mean.
Train 1 is standing at signal A123. This is how the driver would report his position when contacting the signaller. This is simple and could hardly be misunderstood. However, Train 2, stopped between signals A123 and A125, has passed signal A123 but it has not reached A125. Although A125 is ahead of the driver as he sees it, he is said to be “in rear of” the signal. And, although it has gone past signal A123, the train is said to be “in advance of” signal A123.
If you aren’t paying attention, this could get confusing. It is made even more confusing by the appearance in LU Signal Engineering standards of a statement which says that the stopping point for a train “shall normally be 5 metres IN FRONT OF a signal” (my capitals). If this was true, i.e. in advance of the signal, the train would have been tripped! Of course, the signal engineer is looking at the signal the other way round. The back of the signal is where he changes the bulbs and feeds the wires in. The front is where he cleans the lens.
This has the hint of farce about it but there have been recent instances where errors have been made because of the misinterpretation of these expressions. With the huge number of new people coming into the railway sphere these days, it is essential that these descriptions are standardised, communicated during training and verified as clearly understood when used on the ground.
Fig. 11: Diagram showing how the positions of trains are described on the London Underground.
11
4 – In Control Semis So far, we’ve only looked at automatic signalling on the Underground. We’ve seen how each track is divided into sections with a signal protecting the entrance to each section and how, when a train runs through, a track circuit detects its presence and replaces the signal to danger behind it. As the train clears the section, the signal clears to green when the track circuit picks up. When talking about this, it is said that the normal aspect of automatic signals is green. They only go to red if the circuit “goes down”, as it would when occupied by a train or because the circuit is lost for some reason.
Automatic signalling is fine until you get to a junction. At junctions, you need someone to make the decisions about selecting the route required, which signal should be cleared for it and which held at danger to protect it, so here a signaller must be appointed to do this and the signalling is therefore – to some extent anyway – controlled by him.
All the basic systems used for automatic signals we’ve seen above are retained with controlled
signals but a controlled signal needs an action by the signaller to get it to clear. Because of this, the normal aspect of all controlled signals is red or stop3. Since train detection in controlled areas is still automatic, using track circuits, controlled
3 Shunt signals are also controlled but most of them on LU don’t show a red light. They show a horizontal red band to indicate stop and this rotates to a 45 degree angle to indicate proceed (See Fig. 14).
signals are called “semi-‐automatic” signals or “semis”, for short.
Semi-‐automatic signals are identified by the usual white enamel plate on the signal post, with the code letters of the controlling interlocking room or signal cabin plus the number of the lever (or button) controlling it. There are some variations which we will see in due course as they arise. Code letters have changed over the years, largely as a result of more and more individual cabins being closed and replaced by line control centres. For example, the Arnos Grove signal cabin area used to be “J” but was changed to “PJ” when central control was introduced on the Piccadilly Line.
Points At a junction, the kit that allows a single track to divide into two is usually called “a set of points” in the UK, or just “points” for short. In the US they call them “switches”, which is ambiguous because, although they work like switches, the rails which move are called switch rails and they “switch” trains from one track to another.
Modern ones also contain switches in the electrical sense. In an attempt to overcome the ambiguity, they are now often called “turnouts”. We will stick to points.
Points comprise a number of moving parts, some of which carry the weight of the train as it passes over them. As a result, they require careful maintenance and a stable trackbed upon which
Fig. 12: A drawing showing the basic parts of a set of points as used on conventional railways. The outside “stock” rails are fixed. The stretchers hold the moving switch rails to gauge. The points are shown in the normal position with the route set straight. A stretcher will be linked in some way to the point machine, which drives the switch rails from one position to the other. Locking and drive systems are not shown.
12
to rest to ensure they guide the wheels of the train safely through4.
Most points have two positions, known as “normal” and “reverse”. The normal position is usually where the points allow the train to proceed along the straight or main route, while reverse is for the diverging route.
Points need several safeguards to ensure they operate properly and safely and these safeguards have to be monitored and linked to the signals protecting them. First, the switch rails – the rails which move to change the route – must be kept to gauge. This is done with a “stretcher” – a bar which joins the two switch rails. Often more than one is used, Fig 12 above.
Next, it is necessary to ensure that, once a route has been set up and the signals protecting it have been cleared (placed in the “off” position), no other route can be set up that will conflict with it and create the risk of a collision. This is achieved by interlocking. Interlocking was gradually introduced in the 1870s until it became compulsory under the 1889 Regulation of
4 Very often, when you hear of a points failure, it is the result of poor track maintenance causing failure of the point locks or the detection system.
Railways Act. In its common form, interlocking was achieved by mounting the signal and point levers in a frame, beneath which extensions to the levers were interlaced through a series of interlocking bars. The bars were arranged so that, once a points lever and its associated signal lever had been reversed, all other levers which could be used to set up a conflicting route were locked so that the signaller couldn’t reverse them. On LU, the locking is achieved by the use of small steel “dogs” attached to the locking bars which engage with “crosslocks” to provide the interlocking.
With points, there was always the fear that the switches could move as a train approached a diverging junction (facing points). To prevent this
another lock was introduced. This was operated by a second lever provided in the signal box for each set of facing points. This lever operated what is called a “facing point lock”, mounted on the points themselves. To change the points, the locking lever had to be reversed first to release the facing point lock, then the points lever could be reversed, after which the locking lever was restored to normal. Then the protecting signal lever could be reversed to show a clear signal to the driver. The whole set of levers were
Fig. 13: Drawing of LU 4-foot, air operated point machine in a flat bottom rail layout. The drive rod is linked to the air cylinder through an escapement. The lock housing contains the lock which ensures the two switch rails are in the correct position. The detector slide extends to the PL & D (Point Lock and Detection) Box where the electrical detection is made by two detector rods being in the correct position. The whole assembly is fixed in position by the Ground Lock (always called the WL). The mechanism cannot move until the WL is released. This is unique to LU and is to ensure the points remain locked if the air supply is lost. Adapted from a Westinghouse drawing.
13
interlocked so that the signaller couldn’t free the points unless the locking was released and he couldn’t do this until the signal lever was restored to normal.
Even with this protection, it would still possible for a signaller to restore all the signal levers to normal and then move the points while a train was passing over them. To prevent this, the locking bar appeared. This was a long bar mounted adjacent to one of the running rails, which was depressed by the flanges of the train wheels as it passed. This acted on the facing point lock to hold it in place against an attempt to release the lock by the signaller.
Once the track circuit arrived, points could be electrically protected during the passage of a train. The locking bar was now redundant. The occupation of the track circuit caused an electrically operated lock, known as the “back lock” to hold the signal lever against an attempt to move it back it to the normal position, thereby maintaining protection of the route.
As you might imagine, there were many variations on locking devices but they all provided the essential protection for route security. All of them were adopted by the Underground in one form or another and eventually they were incorporated into standard designs for point machines.
Point Machines A point machine is the mechanism used to move the switch rails in a set of points. Originally they were operated directly by the signalman through rods or wires connected to the lever in his cabin but both electrical and pneumatic drives appeared in the last years of the 19th century. The District and LER tube lines wholeheartedly adopted the pneumatic drive system, imported from America. Eventually the Underground’s design evolved into a very neat and reasonably compact design which appears in Fig. 13 above and is known as the “4-‐foot” machine
The design is known as a 4-‐foot machine since it is designed to fit between the running rails. There isn’t enough room to put the air cylinder outside the running rails. A 6-‐foot version, where this is done, is used in some locations where more space is available.
London Underground has used compressed-‐air operated point machines for almost 100 years5. They have stayed with them for two reasons – (1) they need a trackside air supply (see Air Main in the box above) to work the trainstops so they might as well use it for point operation – and (2) air operated point operation is fast. It takes 5-‐6 seconds for an electric point machine of the type used on the main line to change from one position to another, (lock to lock, as it’s called) whereas it takes only 2 seconds for the LU air operated points to change. Suppliers have struggled to get electric operation times down but Westinghouse have said their new electro-‐hydraulic machine will throw the points in “less than 3 seconds”.
One of the best places to see air operated points working is at the west end of Platforms 2 and 3 at Edgware Road (Met.). You can see and hear them changing from one position to another and you can see the signals and trainstops operating too.
The Underground rationalised point drives and layouts in the post-‐war period to eliminate electric machines (mostly ex-‐Metropolitan Railway) and some earlier LER variants. The standard arrangement became the four-‐foot layout, described above. There were three sizes of air cylinder to drive the escapement, the longer the turnout, the bigger the drive. The layout was available with and without a ground-‐lock (Fig. 13), which was always added to turnouts used for passenger moves even though the escapement itself incorporates a facing point lock.
One other “point” to bear in mind is that points are often provided in pairs to create a crossover. The two ends will normally operate in unison from a single lever but each will have its own drive and locking system on the ground. Points in a crossover will have the same lever number but the ends are lettered A and B. The A end will be the one nearer the interlocking. 5 They also used compressed air to operate signal arms until the last of them was converted to colour lights in 1952.
4-, 6- or 10-foot?
On the railway, we always refer to the bit between the running rails as “the 4-foot”, since it is to 4ft. 8½ins. gauge. The bit between the two tracks of a normal 2-track line is called “the 6-foot” and the bit between two double track lines is called “the 10-foot”, for obvious reasons. Fortunately, no one has forced us to metricate it yet.
14
Chairlocks When the Victoria Line signalling was being designed, the signal engineer of the day was keen to develop a standard layout which offered true detection of the switches. The 4ft layout, in common with many designs, does not detect switch position, it detects the rods connected to them, so if these are out of adjustment or come adrift, the switches themselves can be in a different place from that indicated. the Underground wanted to overcome this and eventually found a design developed by SNCF – the Chairlock (Fig. 12). They adapted this to their own requirements (the design had to be re-‐worked for Bull Head (BH) rail, of course).
The chairlock layout is typically French -‐ elegant, achieving both true switch detection and locking and effective -‐ it has a very positive drive but its
design doesn’t overcome three short-‐comings. First, being elegant, it’s very difficult to set up mechanically on the ground. Once it is set-‐up however, it stays put because there are no rods to expand or contract or get walked on by P-‐way men etc. The second problem arises because the WL was shoe-‐horned in as a special LU requirement and, as a result, its tolerance is very tight. The WL has to operate very quickly and there is a tendency for them to bind on chairlocks, which will result in a points failure6.
6 You can’t see the WL (ground lock) on a chairlock machine because it’s hidden away inside the chairlock
The third problem is that chairlocks are very intolerant of a train running through them. The closed switch chairlock unit will be smashed by a run-‐through and since the open switch unit will try to stop the switch moving, the stretchers usually get broken too. Fortunately, run-‐throughs are rare.
Following the introduction of chair locks, someone had the bright idea of using a simpler product available off-‐the shelf, the British Rail clamp-‐lock. But, once the Underground’s signal engineer got hold of it, it was no longer “off the shelf” because the BR drive is electro-‐hydraulic and the Underground straight away converted it to pneumatic drive. But at least it was available for BH rail. It is said that when you set them up with new switch, stock & closure rails you have to be particularly careful to get the detection right, so they were little better than the chairlock.
Nowadays, clamp-‐lock spares are hard to find and LU is phasing them out.
The Underground stuck with Bull Head rails for years after main line railways started replacing them with Flat Bottom (FB) rails, largely because of fears about clearances in tube tunnels. LU encountered several problems when they started to use FB point & crossing layouts. The first was that the volume used on LU is so small that the manufacturers were really not interested in developing a special pneumatic layout. In
unit itself and, when de-energised, physically locks that unit.
Fig. 12: Sketch of Chairlock point machine as adapted for Underground air operation. Note how the locking and detection is at the very end of the switch rail tips, making careful setting up and adjustment essential and requiring well maintained P-way to prevent detection failure. Sketch adapted from LU drawing.
15
addition, chairlocks could not be readily adapted. For a while, LU used a variant of the HW1000 (as used on the Central Line) but has now standardised on an FB version of the 4ft layout (see Fig 11 above).
Other off-‐the shelf machines are being looked at for line upgrades, where another problem emerges. To meet new Journey Time Capability7
requirements, a lot of turnouts have to be made longer for higher speeds and this means longer, heavier switch rails, which need more energy to move them. Sometimes two point motors have to be used. The limit of performance of pneumatic drives has now been reached and it is likely that all new drives will be electro-‐hydraulic. The arguments over speed of drive are less strong since, as we’ve seen, modern electro-‐hydraulic drives are quite fast. Also, new LU signalling designs use “sectional route release” in common with mainline practice. Curiously, the new turnouts at the Piccadilly Junction for T5 are very long 4-‐foot drives and it will be interesting to see how these actually perform in long term service.
Out of Gauge Points A certain places, “out of gauge” points are provided. These are usually at the exit of a reversing siding like Colindale or Wood Green. The points are arranged in a “Y” format (Fig. 13) and the two switch rails operate independently. When the points are in the normal position, both switch rails lie away from the stock rails so they are effectively “out of gauge”. To let a train use the left hand route, the right hand switch rail will close against the stock rail and vice versa for the right hand route. The safety feature of this
design is that, if a train attempts to leave the siding against the signal with the points not set, it will be tripped (of course) and it will derail before reaching the main line.
7 Part of the former PPP contractual framework.
Fig. 13: Schematic of out of gauge points. In the normal position, both the switch rails are open. Only one will close to set up a route. This arrangement provides protection for the main line against a train starting from the siding against the exit signal.
Fig. 14: Typical, externally lit, LU disc type shunt signal mounted in a tube tunnel wall with identification plate. More modern installations use an internally it LED box showing the equivalent indications. There are some locations which use BR type position light shunt signals. Photo: R Griffin.
16
5 – Terminals and Timing Terminals The design and use of signalling in controlled areas has developed slowly on the Underground over the last 100 years. To look at this development, we will take a simple 2-‐track terminus (Fig. 15 below), similar to, say, Elephant & Castle (Bakerloo) and see how it has evolved. The example is simplified but we can use it to demonstrate the progressive development of safety principles8.
In our layout, trains in the platforms are protected by the home signal (E5) being set back a full speed overlap from the platform berths. Thus, a train standing in either platform is protected from an overrunning train tripped at E5. However the design has one major flaw. If a train overruns E5 at full speed while a train is leaving Platform 1 over No. 3 crossover, there is a risk of a collision because it is within the overlap of signal E5. There is no “flank protection”.
8 There is the usual health warning here for signal engineers in that you will see I have omitted some details and simplified the principles.
There is evidence to suggest that this was the original setup at least until the mid-‐1920s.
Eventually, it was realised that full protection for a departing train would require the signal to be moved back a distance equivalent to at least the crossover length. But this had a price. Moving the signal back increases the distance to the platforms. This would then increase the time required for a train held to await a free platform to start up from signal E5 and proceed into the
station. The solution was to ensure that flank protection was provided for a full speed approach by stopping the train at the new signal position and then letting it draw up closer to the site of the original home signal. The train could then run into the platform as soon as it was free. Fig. 16 shows how this was done.
Our terminus now has two home signals, E5 and E6. The “outer home”, E6, is positioned so that a
Fig. 15: Schematic of simple 2-track terminus equipped with a scissors crossover, a home signal (E5) and starting signals (E1 and E2) for each platform. The home signal (E5) is set back a full speed overlap from the platform berth so that if a southbound train is tripped it will stop before it could hit a train standing in either platform. The crossover is worked by two levers: Lever 3 works the points covering the exit from Platform1 while lever 4 works the points for SB moves into Platform 2.
Fig. 16: Schematic of terminus with flank protection introduced. If both platforms are occupied, signals E5 and E6 will be at danger. A SB train approaching will be tripped at E6 if it does not stop and the safe braking distance of the overlap of E6 provides “flank” protection for the crossover. To allow a train to approach E5, a timing track in rear of E6 will hold E6 at red until the train has occupied the circuit for a set time. It will then clear to allow the train to draw up to E5. Note also the Delta track on the exit of the terminus which provides “bobbing” protection as described in the text.
17
train approaching at full speed and failing to stop will be tripped and come to a stand before it reaches the crossover. So the train can come closer to the station ready for it to run into a platform as soon as it is free, a timing track on the approach to E6 is used to ensure that the train occupies this section long enough to check it is not going to overrun E6 at full speed. Once this is proved, by a 15 second timing relay, E6 will clear to let the train draw up to the “inner home” E5. It should be noted that, in our illustration, if a train did overrun E5 while E2 was cleared for a departing train, the occupation of the overlap track would cause E2 to return to danger.
Next, we consider a train departing from Platform 1. The lever for No.3 points is reversed, the lever for E2 is then reversed and the signal clears. The train in Platform 1 can now leave. We hope it will leave quickly because we have a train standing at E5 and we want to get it into the terminus. However, we do have to wait until the departing train has passed through the crossover. While the train is occupying the crossover, its track circuit prevents the lever for E2 being restored to the normal position. This is called “backlocking”. We need to do this to prevent the points being moved under the train. If we could get No. 2 lever back to the normal position, it would release the interlocking on points lever No. 3 and we could restore the points to normal before the train was clear of them.
So the track circuit for the points is important. However, crossovers are problematic in that they can sometimes fail to detect the train passing over them (vibration, bad packing under the sleepers etc.). This gives rise to what is called a “bobbing” track, where there is an intermittent loss of detection. It’s not common these days but it can happen and signal engineers are very cautious people. They insist on diversity, so they provide an additional detection system. They use what is referred to as a “delta” track circuit.
A delta circuit is a 10kHz feed into a running rail over a short distance -‐ a few metres -‐ which detects the front of a train as it arrives. The circuit does not require insulated joints in the rail as the length of detection is small and uses a high frequency circuit.
When the front wheelset of the train is detected by the delta circuit, the backlock on the signal is energised and the lever can be restored to normal. Now the points can be changed and the
next SB train routed into the terminus. For routes which involve many sets of points, deltas are useful for allowing the release of each set of points as it is cleared by the train so that another route can be set up immediately. This is often called “sectional release”.
Bi-Directional Tracks. A terminus has trains running in both directions, into and out of the platforms. A train is designed to operate in both directions so it has a cab at each end, with a tripcock at each end on the right hand side of the leading bogie as you look out of the cab end. From this we can see that a train entering either platform of our terminus (Fig.15) will have to pass over the trainstops of the starting signals E1 and E2. As the train runs in, the starting signal will be at danger. The driver won’t see it because it is pointing the other way, ready for when he has changed ends and is waiting to depart. Since the signal is at danger, the trainstop will be up. The rear tripcock of the train, which will become the front tripcock when the driver changes ends, is on the same side of the track as this trainstop and if it stayed up as the train ran in, the train would be tripped on the rear tripcock – back-‐tripped as it is called. To prevent this, the trainstop automatically lowers as the train approaches and then rises again as soon as the train is clear of it. This is known as “trainstop release”. In order to operate effectively, trainstops of signals on bi-‐directional tracks are very close to the track circuit boundaries.
Approach Locking At a diverging junction, where the driver has a choice of routes, mistakes can be and are made. The commonest is where the signaller sets up the wrong route, clears the signal for the train and the driver accepts it and goes the wrong way9. A favourite place for this is Hanger Lane Junction where the District goes left towards Ealing Broadway and the Piccadilly goes right towards North Ealing. Many a train has ended up in the wrong place over the years.
9 More often than not, the mistake is not the signaller’s fault. It is usually due to a “wrong description” being sent along the line because of a cancellation, late running or out-of-turn-working.
18
It would not stretch our imagination too much to suppose that a signaller, suddenly noticing that the wrong route is set up, would replace the signal to danger by putting the lever back towards the normal position so that he can restore the points to the position he wants and therefore send the train on the right route. However, if the driver has got too close to the signal to be able to stop before reaching the points, there is a risk the points could be moved under the train. This possibility is prevented by “Approach Locking”.
Approach locking simply means that the signal lever is locked when the driver reaches the sighting point of the signal. The track circuit detects the train as it reaches this point and retains the backlock on the lever to prevent it being restored to its normal position. However, the signaller can move the lever a short distance off the reverse position to get it to go back to danger. If he can stop the train, he will.
Once activated, the approach lock will be held until a time has elapsed – usually two minutes – sufficient for the signaller to be sure that the train is stationary before making any changes to the route. The signaller, if working in a signal cabin, has to “take a release” manually by a hand-‐operated screw device or a dedicated lever operating a time delay relay. In other installations, the time release is automatic. The driver, having seen the signal “go back in his face” as they say, will have got in touch by now anyway.
The approach track to a junction signal is also often used to clear the signal when the train has reached a certain point in rear of the signal. Although the route is set, the signal will not clear until the train has occupied the approach track circuit. This has the effect of causing the driver to pay attention to the signal showing red so that, when it changes to green, he will check to see that the route is the correct one for his train. Well, this is the theory anyway. WM21/22 at Hanger Lane Junction is like this but it hasn’t prevented generations of drivers from accepting the wrong signal, with Piccadilly trains going round to Ealing Broadway and Districts to North Ealing. The same setup on an approach track also has the effect of causing the driver to reduce speed where a diverging route requires a speed limit.
Timing Circuits Certain routes require train speeds to be reduced to “preserve the integrity of the train/track interface” – in other words, to prevent the train flying off the tracks. Traditionally, drivers are shown a speed limit sign which, traditionally, they usually adhere to, more or less, but which they can ignore. To enforce speed limits, the signal engineer introduced certain devices which persuade the driver to reduce speed, or at least to pay attention. The approach controlled signal at Hanger Lane Junction mentioned above is one way of forcing a driver to reduce his speed as he approaches a junction. The approach to Watford South Junction used to be like this but drivers knew the setup many ignored it. They knew that when the train reached a certain block joint, the signal would clear. In five years of approaching it, it almost always cleared. On the few occasions it didn’t I got the brakes on and stopped at the signal – just. But then, I knew I could since I had already adjusted the train speed to match the possibility.
This approach didn’t work for everyone. The in-‐town part of the Central Line used to have several stations where there were three home signals on the approach. The outer home was approach controlled. If there was a train in the platform, all three would show red. When the driver saw them, he would slow down and, when he occupied the approach track circuit, the outer home would clear, even if the train ahead was still in the platform. There was no time delay. The idea was that, since the driver had slowed his train, he could approach the next signal at the lower speed and still have a safe braking distance if he got tripped.
One driver, approaching Holborn WB on 9th July 1980, where such an installation was in place, knew the setup and assumed that the train ahead would leave as he approached. It had always done so before so why not this time. He approached at full speed. As he entered the approach track, the first signal cleared. He expected the next one to clear as the train in front left the platform. But it didn’t and he got tripped at close to full speed. The overlap on this second signal was not designed for a full speed trip and the train ran through to the rear of the one in the platform and collided with it at about 12mph. It turned out that the train in the
19
platform was delayed while the crew were attending to a sticky door.
Luckily, no one was killed but a valuable lesson was learned. If you devise a system which relies on the integrity of a wide variety of users, eventually one of them will find a way to abuse it. As a result, approach control of this type on Central Line outer home signals was quickly removed. Other similar sites along the line already had timers on the approach track, which retained the red aspect for 4½ seconds to ensure that the train would be tripped if it didn’t reduce speed.
Terminal Protection Another accident, some 5 years earlier on 28th February 1975 at Moorgate, also arose as a direct result of driver error and also led to changes in the signalling system. The changes became known as terminal protection. This accident was a lot more serious than the one at Holborn and led to the deaths of 42 passengers and the driver. The circumstances were simple; the train ran through the station at 35mph and hit the end of the tunnel. The driver never made any attempt to stop and the guard didn’t have time to react to stop the train.
Soon afterwards, the Underground began experiments with various forms of terminal
protection. The eventual result was that all dead end platforms and reversing sidings were fitted with timing sections which forced a train to slow down during its approach to the buffer stops. Typically, the home signal has a timing section to make the driver reduce the train speed to 20mph and there are two “blind trainstops” in the platform or siding. A blind trainstop is one without a signal.
At the entrance to the platform, the first blind trainstop remains raised until the timing section detects the train speed is 18mph or less and, 30 metres in rear of the stopping mark, there is a second trainstop which requires 12mph or less before it will lower. There is also a fixed trainstop at the stopping point. Drivers usually end up watching the trainstops rather than the train speedo, since the latter is regarded as less reliable.
One serious outcome of the terminal and siding protection scheme has been a reduction in line capacity. Terminals are often the limiting factor for the capacity of a whole line. Nowhere is this more obvious than Aldgate where, because of terminal protection, 8-‐car A Stock trains have to creep across the junction into either of the two bay platforms, effectively blocking the route for Hammersmith trains. On other lines, some reversing sidings are now virtually disused as a
result – Wood Green being a good example. The delay cause by the combination of detraining a terminating train and then waiting for it to creep into the siding just became unacceptable. Without Wood Green reversers, more trains had to be sent to Cockfosters to reverse but, of course, they have to negotiate the terminal protection there. Nowadays, as soon as there is a small delay to the Piccadilly Line service, congestion at Cockfosters can become a serious problem. This, combined with other factors like
Fig. 17: Schematic of a layout where a conflicting route is protected by a draw-up signal. The overlap of the starter (E12) extends over the junction so that the junction is not fully flank protected if a train gets tripped at E12. The draw-up signal E120 is positioned in rear of E12 so that its overlap provides full protection. A train approaching the platform will brake before it reaches the platform so that it enters the timing track at reduced speed. A 4½s timer will clear E120 to yellow, lowering the trainstop to allow the train to draw up to E12.
20
defensive driving10 and one person operation, have led to a reduction in Piccadilly Line capacity of 20%.
Draw-Up Signals There are certain places on the Underground where two tracks converge or cross just beyond a station platform. The best known is perhaps Baker Street, where the double-‐track junction occurs just east of the station platforms. The overlaps of the starting signals of Platforms 5 and 3 actually extend over the junction, meaning that, if a train got tripped at speed at either signal, it would not stop before it reached the junction and could collide with another train which was passing on the conflicting route. To overcome this problem, “Draw-‐Up Signals” were introduced. Originally, they were called “Permissive Signals” but the name fell into disrepute during the late 1960s because the term “permissive society” became common and the Underground, it seems, was anxious not to be associated with perceptions regarding the lowering of public morals.
A draw-‐up signal (Fig. 17 below) is a 3-‐aspect signal positioned in rear of the starting signal so that the driver will see it as he approaches the platform. The three aspects are red, yellow and green. If the starting signal is “off”, the draw-‐up signal will also be green. If the starting signal is red, the draw-‐up signal will also be red. As he approaches the signal, the driver will reduce his speed and a timing track will detect the train and will allow the signal to clear to a yellow aspect, lowering its trainstop before the train reaches it if the speed is low enough. The draw-‐up signal is identified by the letter and number of the signal operating with it, plus a zero or two as necessary to bring it up to three digits.
Round the Bend? I have already mentioned the “stop and proceed” rule, where a driver, confronted by a red signal
10 Defensive driving is where drivers are taught to drive cautiously, creeping into station and crawling up to signals. It could be regarded it as a waste of the infrastructure, a restriction on line capacity and a down-grading of the skill of the driver, who is relatively well paid and is therefore an expensive resource which should be optimised. Better training is the answer. Eventually, of course, ATO will take the driver out of the equation.
which fails to clear after a set time will, if he can, seek permission to pass it and then proceed under extreme caution into the section ahead. With automatic signals, the driver can proceed without permission if he can’t get it. As I’ve mentioned before, some drivers have taken a rather relaxed view of “extreme caution” and have gone too fast to allow them to stop in time when they see a train ahead of them. In some cases this resulted in deaths. Many cases involved trains negotiating curves in tunnels or in places where sight lines were poor. To help reduce these problems, additional stop signals were inserted in certain locations. Originally they were called “Stratford Signals”, after the Stratford accident on 8th April 1953 where a driver carried out the rule at a rather brisk speed and caused a collision which resulted in the deaths of 12 people. Later they became known as “Round-‐the-‐Bend signals”.
Round-‐the-‐Bend (RTB) signals are only installed in tube tunnel sections where the curve radius is less than 300m and only in automatically signalled areas. They do not affect the normal headway and a driver would not usually see them at danger. Of course, if a driver has passed the previous signal under the rule, he would have to repeat the process when stopping at the RTB signal.
More recently, in some places where signal sighting is poor, countdown markers have been provided on the approach side (in rear of) the stop signal. I suspect these have been introduced as a cheaper alternative to RTB signals.
Modern Interlocking Earlier, we looked at interlocking for junctions, both in the lever frame and on the ground where the points are. These systems were entirely mechanical but, over many years, interlocking for railway signalling eventually progressed from mechanical systems to relay systems and more recently to microprocessors and computers. Although the main line railways had started using relay interlocking as early as 1929, London Underground stuck with mechanical interlocking for signal frames until the 1990s. Relays had been used for remote operation of sites like Wood Green but the safety was still enshrined in the mechanical lever frame. It wasn’t until the resignalling of the Central Line in the early 1990s
21
that the Underground saw the first full relay interlocking. It was introduced at West Ruislip in 1991 and several more sites were converted as the resignalling moved eastwards. Later installations had Computer Based Interlockings (CBI) instead of relays and some of the relay installations were later converted to CBIs as well.
As you would imagine, relay interlocking uses sets of relays in place of mechanical frames to prevent the setting up of conflicting routes. The main line railways’ progress in this direction was driven by the growing need for huge mechanical frames at complex areas like London Bridge, where a 311 lever frame weighing 23 tons was required. Relays considerably reduced the weight and space required at such places. The Underground generally had smaller installations and, for a long time, it was the policy to keep sites small so as to reduce the impact of failures. With the Underground’s smaller mechanical frames, the need for relays was seen as less urgent.
Of course, relays bring their own problems, not the least being the need to have all vital (safety) circuits duplicated in such a way that a single wrong side failure could not set up an unsafe condition. For larger installations, thousands of relays were needed and the circuitry was complex. Design checking and circuit testing were very time consuming. Perhaps it was because the Central Line resignalling of the early 1990s was carried out by contractors (Westinghouse) and they held a large proportion of the risks for getting the safety systems right that London Underground were prepared to let them adopt relay interlocking.
The first conversion, at West Ruislip, was not a happy story. It was decided to re-‐signal the area and replace the track at the same time. Also, the signalling had to be set up for the new ATO system but trainstops and visual signals had to be retained for the old 1962 Tube Stock which was still using the line. This was the first contractor led signalling installation on the Underground and there was a lot of friction between the Underground signals people, who were used to doing their own thing, and Westinghouse who, not having done it before on LU, were actually learning installation as they went along.
The result was painful. The original plan was to close West Ruislip for a month and terminate the service at Ruislip Gardens. Those of us who
remembered the 4-‐day Easter weekend resignalling changeover by British Rail at the huge terminus at Liverpool Street were horrified and complained that we would be the laughing stock of the industry if we closed the little two-‐platform terminus at West Ruislip for a month just for resignalling. Eventually the project team settled for 9 days over the August Bank Holiday weekend and up to the following weekend. With friction between the teams, some wrong-‐side failures during testing, changes to engineering management and safety requirements resulting from the Hidden Report11 and the newness of the contractual arrangements, there were constant delays and stoppages of work. The resulting chaos meant that West Ruislip did not open again until 9th December 1991.
In the late 20th century, railways woke up to the fact that computers, or parts of them like micro-‐processors, could be used in signalling. As with relays, there was a cautious approach at first, although as early as 1974, LU tried one at Rickmansworth for the remote control of Watford, retaining the mechanical interlocking frame for safety. By the mid 1980s, electronics for safety systems were being considered in the form of vital processing of interlocking (VPI) on the main line railways and LU followed in 1987 when they had such a system installed at Northolt as a trial, working in parallel with the existing mechanical frame.
Of course development was slow. People were rightly nervous about using computers for safety systems. It was considered essential that some sort of real-‐time checking was in place in case the processor integrity failed, the programme corrupted itself or the original programme code contained unforeseen bugs. This led to the employment of multiple computer systems using two-‐out-‐of-‐two or two-‐out-‐of-‐three voting systems before a route could be cleared. Another checking technique is to use two or more processors with different individual logic programmes within the computer to maintain the diversity requirements of the vital systems. On main line railways, processor logic was developed for SSI (Solid State Interlocking), first tried at Leamington Spa in 1985 and this evolved into CBI 11 “Hidden Report” - Investigation into the Clapham Junction Accident of 12 December 1988 by Anthony Hidden QC, in which a number of recommendations regarding resignalling projects were made and adopted by both BR and London Underground.
22
(Computer Based Interlocking) as later used on the Underground. In all of these systems, relays are still used for the interfaces with the trackside equipment.
Remote Securing If, when a route is set up, any of the associated point detection or locking systems fail, the signal(s) protecting those points will also “fail”. In reality, they are not failing, they are providing the protection for which they were designed and are therefore functioning correctly. However, this is no consolation for the passengers stuck on a stationary train because of a “points failure” or for the control room staff trying to keep the trains moving.
Sometimes, the points will set and lock but the signal still fails to clear. One way of allowing trains to move under these conditions is to secure the points and then authorise the train to proceed slowly past the red signal – the “stop and proceed” rule described briefly earlier. Until about 15 years ago, points had to be secured manually. Someone from the nearest station – usually the supervisor – had to walk to the points carrying a “clip and scotch”. He would fit the clip to hold the closed switch rail to the stock rail and insert the scotch to keep the other switch rail open. The driver would then be authorised to proceed cautiously through the route.
Of course, we are assuming that the points are in the correct position and do not require the services of a signal technician to come down and “blow them over” to the correct position. All this takes time – often 20 minutes to half an hour – until a way of securing points remotely was introduced12.
Remote securing is operated by the signaller in the control room. He has a special button which
12 The original purpose of remote securing was to allow a train through a route to rescue a stalled train blocking that route. It was soon realised that it could be used to overcome signal problems too.
effectively adds a lock to the points to hold them in place and to prevent any changes. If the points are detected correctly and the lock works, a “Route Secure” sign will be displayed at the signal. The driver can now accept an instruction to proceed slowly into the route.
Route Proving You will recall that earlier I mentioned that it is common for a pair of points to be used to provide a crossover and for these points to work together as a set (Fig. 18). Since all the vital protection in such an arrangement is interlocked, it follows that once the points are reversed for a crossing move and the signals for the chosen route provide a proceed indication, the whole crossover is safe for a train to pass over it. The same will apply for the route when the crossover is in the normal position and the two directions are being used as normal. In recent years, this feature has been used as a way of overcoming certain types of signal failure. It is known as “route proving”.
Another, similar system, using a “route card” is also used. At each location where a suitable route can be proved, a “route card” is provided. This shows a special procedure which must be carried out to prove a route and allow a train to move over a set of points against a red signal and without the points being scotched and clipped.
Fig. 18: Schematic of route proving using a trailing crossover. In this example, signal E5 has failed to clear, detaining Train 7. In order to prove the points are locked, Signal E1 will be used to bring Train 1 to a stand and the driver will be told to wait even when the signal clears to green. Train 7 is then authorised to pass signal E5 at danger and proceed “under rule”. During this manoeuvre, the driver of Train 1 monitors E1 to ensure the green aspect is maintained. The purpose of the operation is to remove the need to manually secure the points on the crossover.