The complex Thameslink capacity upgrade programme includes the very visible civil engineering works in the London Bridge area and the introduction of Class 700 trains through the central London ‘core’ using European Train Control System (ETCS) Level 2. In-cab signalling is required to allow trains to be driven automatically between Kentish Town, Blackfriars, and London Bridge or Elephant & Castle, under driver supervision, in order to enable up to 24 trains to operate per hour from 2018.
Testament to the integrated and collaborative approach taken by Govia Thameslink Railway (GTR), Siemens and Network Rail, another milestone was achieved last summer with a successful trial of a Class 700 train through the core using ETCS. This project is the showcase for Network Rail’s upcoming digital railway revolution.
86 trains an hour!
A fundamental pre-requisite of ERTMS Level 2 is a fixed-block system with signal interlocking. The core was resignalled with four-aspect signalling as part of the Thameslink Programme Key Output 1, described in issue 109 (November 2013). The relay-based Westpac and Solid State interlockings (SSI), associated with the outmoded 1970s London Bridge Area Signalling Centre, are being progressively replaced with Siemens Trackguard Westlock computer-based interlockings controlled from Siemens Controlguide Westcad workstations at Three Bridges Rail Operating Centre (ROC).
The terminal platforms at London Bridge and south central lines were completed during the Christmas 2014 blockade and described in issue 125 (March 2015). Since then, further work has taken place with the ROC now controlling all lines from Charing Cross and Cannon Street through London Bridge, with the London Bridge panel presently remaining in control of the south eastern lines to the east of the station. As the various stages of infrastructure upgrades are completed, the signaller interface and interlockings are updated by means of data changes. The tracks and signalling across the new Borough viaduct for segregated Charing Cross services was commissioned in January 2016, whilst the new Bermondsey dive-under came in to service this January (issue 148, February 2017).
With the south central phase of London Bridge resignalling, the then-new Westlock interlocking communicates with SSI Track Function Modules (TFMs) conventionally using two base-band data links and three with Long Distance Terminals (LDTs). The five data links are separately interfaced with Westlock via a Trackside Interface (TIF), which acts as a protocol converter between the Westlock network communications and SSI data links.
The latest phase, however, deploys the innovative new Siemens zone controller system. The controllers provide an input/output module (IOM) interface between the Westlock interlocking and the trackside infrastructure.
Commenting on the development, Mark Ferrer, Siemens’ operations director digital railway, said: “Although, at first glance, it may seem a little unusual to introduce a completely new system on such a high profile, much-scrutinised project, the performance requirements of the London Bridge area were such that traditional technology would have been too slow in operation. Network Rail’s specification for the programme demanded that the performance of the interface had to support a peak flow of 86 trains per hour (tph) through London Bridge.”
The zone controller developed by the team is an internet protocol (IP) network-based solution, rather than one that operates over a baseband datalink as TFMs would. As fast as a relay solution, the new controller also has a significantly smaller footprint than an equivalent TFM and provides greatly improved diagnostic capability, making any future maintenance requirements simpler, faster and more efficient. This system also overcomes the limitation of a single SSI data link that can communicate with a maximum 64 trackside modules.
To meet the specification of 24tph through the Thameslink core section, it is necessary to deploy Automatic Train Operation (ATO). This will provide a peak theoretical capacity of 30tph, thereby creating a reliable 24tph service with acceptable recovery margins.
An ATO system needs to know when and where the signalling system requires the train to stop (end of movement authority) and therefore needs a suitable signalling interface. Given that the adjoining Midland main line and East Coast main line routes will eventually be provided with the ETCS as part of Network Rail’s national rollout of the European Rail Traffic Management System (ERTMS), ETCS was the obvious choice.
However, the existing lineside signals will be retained for the foreseeable future, facilitating the running of non-ETCS trains through the core while also providing a back-up for ETCS-fitted trains should the ETCS fail. To take advantage of the increased capacity available under ETCS, additional intermediate track circuit block sections have been created, permitting trains running under ETCS to close up to the next block marker (see diagram).
Lessons from the Cambrian EDS
The ERTMS Early Deployment Scheme (EDS), introduced in 2011 on the Cambrian lines in Wales, was the pilot project for Level 2 deployment to other parts of the UK network. The experience gained and lessons learned have provided a valuable input to the development and delivery of the Thameslink ERTMS installation.
Significant issues identified with regard to testing the EDS system including insufficient focus on simulating, testing and integrating the system off the operational railway, limited access to the infrastructure to test the system, and integrating the sub-systems. The impact of these issues led to on site modification and re-testing with limited access to infrastructure, thereby delaying delivery and adding significantly to costs. Accordingly, lessons from the EDS led Network Rail to develop a four-stage strategy to manage the Thameslink project risks.
Verification and validation
Firstly, verification of the proposed system specification was undertaken using a computer simulation with a proven model of the ETCS core functions.
The next phase saw the creation of Network Rail’s Systems Integration Laboratory at the Southwark HQ of the project team. This has a complete end- to-end system with at least one sample of each component, using real equipment in an off-line test environment. These are complemented by simulators, to model the rail environment and drive the relevant system inputs.
The comprehensive test set up includes real on-board ETCS and ATO equipment, including associated peripherals such as balise reader, odometry, AWS and TPWS. The trackside equipment features real interlockings running the actual data to be used on the Thameslink route, a Radio Block Centre (RBC) and a dummy balise driven by a telegramme simulator.
These two subsystems are linked together using GSM-R base stations and repeaters linked back to Network Rail’s off-line GSM-R reference facility. The laboratory has the capability to operate one real train and up to 59 simulated trains, to reflect that the real RBC is designed to deal with 60 ETCS connected trains in the core.
The programme also made use of Network Rail’s ETCS National Integration Facility (ENIF) at Hitchin, where an 8km section of the Hertford Loop was available as a test track during off- peak periods. ENIF was configured with three virtual stations, Farringdon, City Thameslink and Blackfriars with block markers and signals.
Although the Class 313 test train was not equipped with ATO, it was possible to observe the shore-based messages that were sent. The philosophy was to test the infrastructure against the Class 313, which was the main baseline. Further compatibility testing was undertaken with a Class 700. The testing process allows the system, and operational rules to be tweaked as necessary.
The ENIF tests concluded in July of last year. Prior to the delivery of the Class 700s to England, Siemens tested the on board ETCS equipment on the Wildenrath test track in Germany.
The final stage of testing has been undertaken at night on the Thameslink core between Blackfriars and St Pancras using both the Class 313 and a Class 700. Functional and operational tests will continue through 2017.
ETCS/ATO is planned to be brought into service in the core at the beginning of January 2018 between Kentish Town and Elephant & Castle, with a temporary transition in/out of ETCS on the chord from Blackfriars to London Bridge.
The Christmas 2017 blockade sees a final major resignalling phase of London Bridge and it was decided not to cram in commissioning of ETCS/ATO through London Bridge at the same time as the extensive interlocking data changes. This final section of ETCS/ATO is therefore programmed to go live some time in 2018 to give breathing space, ensuring stability of the interlocking data, and time to test the ETCS/ATO for this section.
Automatic Train Operation
ATO is primarily an on-board system specified by Siemens as part of its Class 700 train development. Network Rail is providing the infrastructure to support ATO. A shore-based system called Automatic Train Regulation (ATR) holds the geographic route map of the core and the base timetable and, for each train, automatically updates both dwell time and run time to next station. ATR optimises these parameters to keep the service to time, whilst the signaller may make manual adjustments if necessary.
Communication is via public mobile or Wi-Fi, interfaced at the shore using COM@RL. The system has the capability to pass updated journey information to the driver on the move at any time. Additionally, ATR may pass a revised braking rate to the ATO in the event of low adhesion.
ATO calculates a braking curve but also sees the protection curve that ETCS is calculating so that ATO will ensure the driving always remains within the supervision curve, even if it thinks it can achieve better braking than ETCS.
If the ETCS fails in service, the ATO will drop out. No communication with the RBC for 30 seconds will result in the train being stopped.
In the event that ATO is not available for any reason, the train may be driven manually in Level 2. If ETCS is not available, the fall back is operation with AWS/TPWS. The AWS sunflower is depicted in the planning area of the Driver-Machine Interface (DMI).
When operating in ETCS Level 2, the AWS and TPWS systems are suppressed. The Class 700 is also designed to operate with AWS/ TPWS as a standalone system if ETCS fails.
Operation of ATO
Every time a train does a start of mission, the driver will key in the train description, for example 1E36, and the ATO will talk to the shore-based server to obtain updated timetable information including dwell and run times for the route.
When a train enters the ETCS area, it first makes contact with the RBC. This contacts the ATR system which then knows that it has an ETCS-connected train with ATO ready. ATR can then send updated information to the train.
Once the train transitions into Level 2, ATO is offered to the driver (ATO light starts flashing). If the driver chooses to run in ATO the traction/brake controller is put into neutral and the ATO button pressed. From that moment it’s hands-off. On arrival at a station, as soon as the train is detected at the correct stopping position, the doors open automatically.
A significant difference with ATO driving the train is that it will still be doing 25-30 mph half way down the platform, a change to what passengers have been used to but already standard practice on London Underground routes with ATO such as the Jubilee and Northern lines.
Incidentally, London Underground has experienced some corrugation of the rails where trains are all accelerating at the same point and that’s being looked at by the project.
ATO will minimise variability of driving through the core. As dwell time will be critical, ATO counts down to the point the driver needs to start the door closing sequence. So, for a 45 second dwell, the driver has a nominal 22 seconds to do the check and close the doors whence the ATO button will start flashing again. Pressing the button will re-engage ATO, provided the driver is satisfied it is safe to depart and movement authority is indicated on the DMI.
The train reports to the ATR when it stops and departs a station. If it departs late, the ATO will try and make up time by cutting out coasting, adopting a more aggressive approach to the next station within the safety curves, reducing the next station dwell time. Dwell times will be set according to the differing needs of the individual stations.
The critical part for Thameslink is the occupation of the flat junction at Blackfriars, where the service splits between the routes via London Bridge or Elephant & Castle. Leaving Blackfriars in ATO, the driver can take back control of the train once clear of that junction.
The ATO border is one signal section before the ETCS boundary finishes on the approach to Elephant & Castle. If the driver does nothing, the train will come to rest at the signal prior to the transition point of ETCS boundary so the train can never leave the ETCS area in ATO.
On the London Bridge route the changeover takes place on the east side of the station.
Coping with varying adhesion
Operational rules are being developed to deal with low adhesion events. An example is on a Monday morning after an engineering possession when the rails may be rusty. It may be appropriate for the first train to be driven manually and do a couple of controlled stops before running ATO. ATO has seven brake settings, and various tests of poor adhesion have been carried out under simulated adhesion conditions to determine settings for stopping accuracy.
The core is divided into sections. This allows, say, a lower rate of braking at the start of ATO to the first station, then re-adjusting on a station-to-station basis.
Class 700s have the advantage of tread brakes, which have a self-cleaning effect.
Maintenance and faulting
S&T technicians are used to having fault diagnostics facilities for computer-based interlockings and SSI data links. However, with ETCS/ATO, the fail-safe signalling system effectively extends beyond the signal box and track equipment through the airwaves via the GSM-R into the train, interfacing with the on- board ETCS European Vital Computer (EVC) and DMI in the driving cab.
In the event of an incident, the technician at Three Bridges ROC will have access to the interlocking data and the RBC data and GSM-R message data to see if movement authority aligns with the interlocking data, plus other information such as balises passed over. ATR messages are fed through the RBC and logged. On the train, events are logged by the accident resistant ‘black box’ called a Juridical Recording Unit.
A tricky issue for the maintainer is to ensure that, when balises are replaced (perhaps after relaying or re-sleepering the track), they are put back in the correct position. There are approximately 450 balises in the core, used primarily for ETCS odometry re-calibration but also in stations to finely control ATO stopping position. For a stopping point balise, an installation tolerance of 1.5 metres is required but the maintenance tolerance will be much tighter. Siting forms are used to record positions of balises with datum plates used as the infrastructure reference points.
Maintenance Delivery Unit staff have been receiving training in testing and fault finding from Siemens technical specialists using the kit within the Integration Laboratory.
Written by David Bickell
Thanks to Jon Hayes and Paul Booth of Network Rail for their help with the preparation of this article.