11-29-2020, 09:45 PM
(11-29-2020, 07:10 PM)trainspotter139 Wrote: 1. I think you are mixing up ATP with ATC. ATP is just a signaling system that compares train speed with permitted speed and signals the train control computer for brake activation if the train speed is above the permitted speed. ATC takes control over acceleration and braking and works in conjunction with ATP to operate the train safely.
I think you’re right. It’s been a while since I read the article; most likely it referred to ATC.
Quote:2. That's not an engineering fail at all. All modern passenger trains have a door interlock braking system. When the doors are open, the brakes are activated. When the doors close properly the brakes are then deactivated. If the doors do not close properly, the door interlock brake stays active. ATC is a completely separate hardware module that simply sends commands to and receives data inputs from the train control computer. ATC doesn't get a signal as to why the brakes are active. All ATC gets from the train control computer is basically: "Brakes: Active, Position: Service-50%, Locked: True". ATC would operate in the same fashion if the operator hit the emergency stop switch on the control panel. All ATC would know from that is: "Brakes: Active, Position: Emergency, Locked: True". ATC can only control the train if the controls aren't locked out by another module with higher control priority, like the emergency stop switch or door interlock brake.
It is an engineering fail for a door problem to absolutely prevent operation of the train.
To be clear, there are multiple possible scenarios. Say the door is stuck and won’t close; either at all or completely. Depending on the exact situation, either the vehicle should be evacuated and then driven to the OMSF, or kept in service until the end of the line (or wherever) with a temporary barrier across the door (and the door excluded from normal open/close operation). In either scenario, there needs to be a procedure to inform ATC that the door is locked out and to ignore what it is saying.
Another possible scenario is the door closes fine, but the device which detects the state of the door has failed and always reports that it is open. In this scenario especially it is obviously totally absurd for the vehicle not to be able to operate.
Even with the current malengineered situation, the train can be operated; it just needs written track authority. So presumably there is a way of disengaging the brakes even while the door is still reporting that it is open (I don’t think typical train motive power is capable of moving the train against a fully-applied brake, even if the control system would allow an attempt). Again, a door problem is not a legitimate reason to require going back to 1800s technology. In fact, I can’t think of much that would; besides the obvious failure of part of the ATC itself, something like total brake failure maybe; except that then the vehicle would have to be towed or pushed, and in that case it would be nice if ATC could still be able to operate the helper vehicle.
This is not the first time I have heard of clearly wrong design related to doors. My understanding is that some subway trains, I think including the TTC’s Toronto Rockets, have the following procedure when an obstruction prevents a door from closing: all doors re-open and repeat the closing sequence. If they fail 3 times, the train is out of service. This is totally absurd. What should happen is that only the obstructed door should re-open. This means instead of requiring 24 doors to successfully close simultaneously, maybe 23 close on the first try and the remaining one re-opens and then closes. So right away this would eliminate most of the problems. Next, the basic idea of 3 failures requiring taking the train out of service is OK; if there is an equipment failure, at some point it needs to be dealt with. But if the reason is identified as “some idiot kept sticking their foot in the door”, then there is no equipment failure (not even a suspicion of a failure) and no point in taking the train out of service. What, they’ll take it back to the yard, and do … what? It’s fine; there was just somebody blocking it.
I think safety engineers need to step back more often and consider whether the behaviour they are creating is reasonable. I’m not asking for them to design unsafe systems, but the above examples just don’t pass the smell test.