Power Supply (Signalling & Operation)

Many of the older signalboxes on the network (probably the majority of Simsig boxes) actually consist of local interlockings controlled from a central panel through a multiplex system that allows multiple commands to be sent over a single pair of wires. If reliable safety-critical multiplexes didn't exist, each of those local interlockings would have been given a panel and would be a signalbox in its own right, so you could almost think of it as if it is a remote-controlled signalbox. Each of these local interlockings will have its own power supply arrangements, taken from a convenient feeding point in the local public system.

" said:

Many of the older signalboxes on the network (probably the majority of Simsig boxes) actually consist of local interlockings controlled from a central panel through a multiplex system that allows multiple commands to be sent over a single pair of wires. If reliable safety-critical multiplexes didn't exist, each of those local interlockings would have been given a panel and would be a signalbox in its own right, so you could almost think of it as if it is a remote-controlled signalbox. Each of these local interlockings will have its own power supply arrangements, taken from a convenient feeding point in the local public system.

Actually, the multiplex doesn't have to be safety-critical, just like the signalling panel doesn't have to be.

Taking King's Cross as the example I'm most familiar with, each interlocking is a separate safety-critical installation. Each has its own control panel, though this is normally locked out of use and isn't as "pretty" (for example, TCs with points flood red even when routes are set). Actions on the main panel are sent to the interlockings, whether local or remote, in the same form (e.g. "push button at S273"and the interlocking turns that into route commands. The messages, and the resulting reports on TC and signal status, come over the multiplexes, which aren't safety-critical because they can't cause a wrong-side failure.

I have another question: What is the maximum speed that the electrical system allows trains to develop on ECML?

The OHL equipment used on the ECML is 25kV AC and is the same for the whole country where OHL is installed.

" said:

I have another question: What is the maximum speed that the electrical system allows trains to develop on ECML?

The speed on a line is not limited by the electrical supply but rather the layout of the track in terms of how curvy it is.

To clarify, there is more than just "safety critical" and "not". There are a number of SIL (Safety Integrity Levels), though the railway typically uses three (I'll note right now that there are exceptions to this):
0: Not safety critical
2: Safety related
4: Safety critical
Levels 1 and 2 are similar to each other, as are 3 and 4. An interlocking is SIL4; the control system is usually SIL2. I would imagine multiplexers are also SIL2. While multiplexers should not be able to directly cause the interlocking to do something nasty, anything talking to such needs to not provoke the interlocking - for example, automatic routesetting systems have their own ideas of what routes are available to set so it'll only ask the interlocking if it thinks the request will succeed. It'll also only try a route request three times before declaring the request a failure and turning off subareas. In addition, any multiplexer (and/or control system) needs to present timely and correct information, lest the signaller use misinformation to cause an unsafe situation, which again suggests more than than "not safety critical".

" said:

" said:

I have another question: What is the maximum speed that the electrical system allows trains to develop on ECML?

The speed on a line is not limited by the electrical supply but rather the layout of the track in terms of how curvy it is.

Different from here in Rio, the track layout on some parts, allows trains to run more then 100km/h (60mph) [The trains were built to reach 120km/h (75mph)] but the Overhead Line restricts to 100km/h (60mph) due to his particularity.

The original APT design came up with a cunning way around the same problem: although the plan was foreeach train to have two power cars, the trains would have been a pair of half-sets "inside out" with the power cars together in the centre with a relatively short HV bus linking them on the supply side.

" said:

The original APT design came up with a cunning way around the same problem: although the plan was foreeach train to have two power cars, the trains would have been a pair of half-sets "inside out" with the power cars together in the centre with a relatively short HV bus linking them on the supply side.

I heard at the time that the Railway Inspectorate had put a block on an HV bus passing over/through passenger carrying accommodation.

Actions on the main panel are sent to the interlockings, whether local or remote, in the same form (e.g. "push button at S273"and the interlocking turns that into route commands. The messages, and the resulting reports on TC and signal status, come over the multiplexes, which aren't safety-critical because they can't cause a wrong-side failure.

Thanks CTCThiago for the interesting photos. By way of comparison, I've got some shots of the Network Rail electrical control room for Scotland on my site in case anyone's interested.

Oh really? The commands maybe can't cause wrong side failure, but the resulting reports certainly can! (eg. when a signalman allows a train to run through a set of points whose indication spuriously shows "normal"Without fail-safe indications, you can't have any oral authorizations or other standby measures, and no ERTMS RBC.

Quote:

Oh really? The commands maybe can't cause wrong side failure, but the resulting reports certainly can! (eg. when a signalman allows a train to run through a set of points whose indication spuriously shows "normal"Without fail-safe indications, you can't have any oral authorizations or other standby measures, and no ERTMS RBC.

The local interlocking would prevent any signals being cleared over the points that are in the wrong position. If the signal failed to clear prior to authorising a train to pass the signal the signaller would key the points to the correct position.

You are therefore looking at 3 independent failures on two separate systems which coincidentally has effected the same set of points.

Failure 1) Points failed to move Normal when commanded by the route setting.
Failure 2) Points failed to move Normal when keyed to Normal by the signaller.
Failure 3) Points spuriously indicated Normal despite being reverse on the ground.

The above is very improbable considering the Controls and Indications systems are separate.

If the above did occur, the signaller would authorise the train to pass the signal and proceed at caution to the next signal and therefore any problems would occur at low speed.

FF

Quote:

Actions on the main panel are sent to the interlockings, whether local or remote, in the same form (e.g. "push button at S273"and the interlocking turns that into route commands. The messages, and the resulting reports on TC and signal status, come over the multiplexes, which aren't safety-critical because they can't cause a wrong-side failure.

Oh really? The commands maybe can't cause wrong side failure, but the resulting reports certainly can! (eg. when a signalman allows a train to run through a set of points whose indication spuriously shows "normal"Without fail-safe indications, you can't have any oral authorizations or other standby measures, and no ERTMS RBC.

The local interlocking would prevent any signals being cleared over the points that are in the wrong position. If the signal failed to clear prior to authorising a train to pass the signal the signaller would key the points to the correct position.

You are therefore looking at 3 independent failures on two separate systems which coincidentally has effected the same set of points.

Failure 1) Points failed to move Normal when commanded by the route setting.
Failure 2) Points failed to move Normal when keyed to Normal by the signaller.
Failure 3) Points spuriously indicated Normal despite being reverse on the ground.

The above is very improbable considering the Controls and Indications systems are separate.

If the above did occur, the signaller would authorise the train to pass the signal and proceed at caution to the next signal and therefore any problems would occur at low speed.