Development of a Smart Level Crossing System For Traffic ... · Development of a Smart Level...

43JR EAST Technical Review-No.33

Special edition paper

Safety at level crossings is an important matter for railway operators. Current level crossings emit warnings and block traffic if abnormalities occur. From a failsafe perspective, this is correct control; however, it can lead to excessive warning and traffic blocking for pedestrian and automobile level crossing users in some cases. Particularly, so-called “level crossings kept unopened” where level crossings remain closed for long periods of time block road traffic for a long time and have a major social impact. In light of that, we conducted a study on both level crossings in normal state and failure state in this development with an aim of shortening warning time. For crossings in normal state, we developed a microelectronic level crossing controller with constant warning time control function where the constant warning time control logic is changed from conventional relay connection control to software control to facilitate introduction of level crossing constant warning time control. That enabled cost reduction and simplification of design, production, and testing of the level crossing system. As the architecture of the constant warning time control logic was covered in a past edition of JR East Technical Review,1) we will give an overview of the factory tests and field monitoring tests in this report. For level crossings in failure state, we worked on measures to prevent a level crossing from constantly emitting warnings and blocking traffic2) even in failures. Specifically, we developed a networked level crossing system whereby microelectronic level crossing controllers that conventionally control individual level crossings independently3) are connected over a network and control of level crossings is maintained by utilizing information of adjacent level crossings even when one fails. In this paper, we report on design and production of a prototype and in-factory tests of that prototype.

Introduction1 Development of a Microelectronic Level Crossing Controller with Constant Warning Time Control Function2

2.1 Overview of Constant Warning Time ControlFig. 1 shows the system configuration of a level crossing control system with a constant warning time control function. By varying the warning start point for trains passing through and those stopping, it adjusts level crossing warning time to be more appropriate.

2.2 Switch to Software for Constant Warning Time Control Logic

In development of the controller, we aimed to reduce relay connection work by switching the constant warning time control logic from relays to software. We further carried out in-factory and field monitoring tests with an aim of putting the system into practical use.

2.3 In-Factory TestsIn the development, we carried out function tests of the software from June to October 2012 after producing the software and in-factory comprehensive tests of the combined system hardware and software from March to June 2014 after producing the hardware. Before the tests, we studied a method of testing efficiently in the limited time available. This section covers that study.

Development of a Smart Level Crossing System For Traffic Convenience

•Keywords: Level crossing kept unopened, Microelectronic level crossing controller for between stations, Constant warning time control, Switch to software control, Network

Safety at level crossings is an important matter for railway operators. Our safety concept sometimes leads to long warning time at a level crossing. Long warning time causes inconvenience to those who want to cross the level crossing. In this development, in order to shorten level crossing warning time, we have studied two states of level crossings: normal state and failure state. For the normal state of level crossings, we have developed a microelectronic level crossing controller with built-in constant warning time control logic. For the failure state, we have developed a mechanism to avoid long warning times when a level crossing detects a failure. Specifically, we connect level crossings in a network and control them using information of other level crossings instead of the information of the failed level crossing. We made and tested a prototype level crossing network system and obtained favorable results.

*Advanced Railway System Development Center, Research and Development Center of JR East Group **Omiya Signaling and Communications Technology Management Center (previously at Advanced Railway System Development Center) ***Tohoku Construction Office (previously at Advanced Railway System Development Center) ****Shinkansen Transport Department (previously at Advanced Railway System Development Center)

Yamato Fukuta*Yoichi Kansaku**** Akimasa Okada*Takanori Ambe* Naoki Miyaguchi**Manabu Teramoto***

(Level crossing Y)ATS-P (wayside)

Start point for warning (for trains passing through)

Start point for warning (for trains stopping)

Train stoppingWarning start

Train passing throughWarning start

Stop point for warning

Point A Point E Point B

Station platform

Level crossing equipment cabinet (level crossing control logic device)

Automatically braking if train accidentally passes station without stopping

Fig. 1 System Configuration of Level Crossing Constant Warning Time Control System

44 JR EAST Technical Review-No.33


2) Reduction of number of proceduresIf common transition from a status is seen, check of failures after that common transition can be omitted. Since the pattern after the failure of a level crossing was common in this development, we reduced the number of subsequent procedures (Fig. 4).

Following the aforementioned procedure, we were able to produce an efficient test check list.

2.3.2 In-Factory Test ResultsIn-factory tests(1) Function testsAfter the development of basic functions of constant warning time control, we carried out function tests at the manufacturer’s factory from June to September 2012 and obtained favorable results.(2) Function tests using test check listAfter the manufacturer’s function tests, we carried out function tests from September 28 to October 4, 2012 using the test check list made produced as mentioned in 2.3.1 and obtained favorable results.(3) Comprehensive testsAfter developing the hardware of the system and the user interface software at the finished system level, we carried out manufacturer’s comprehensive in-factory tests from March to June 2014. We obtained favorable results in tests such as hardware tests equivalent to those conventionally performed, tests for confirmation of impact on conventional functions, and simultaneous input tests.(4) Comprehensive tests using test check listAfter the manufacturer’s comprehensive in-factory tests, we carried out all the remaining parts of the comprehensive tests on July 7, 2014 using the test check list produced as mentioned in 2.3.1 and obtained favorable results.

2.4 Field Monitoring Tests2.4.1 Overview of Field Monitoring TestsBased on the favorable in-factory test result, we carried out field monitoring tests at the Hikawa level crossing between Omiya and Toro Stations on the Tohoku line. An overview of the tests is as follows.(1) Confirming stable operation in a given period in the site

environmentWith the field monitoring test period set as eight months from July 2014 to February 2015, we confirmed normal operation in a long operation period from summer to winter.(2) Confirming normal operation with input patterns by actual

trainsWe compared operation of the developed system, which is operated

2.3.1 Method of Developing Test ItemsThis is the procedure for developing test items proposed this time.(1) Procedure for developing test items1) Proposal of test itemsWe introduced the RAMS (IEC 62278) lifecycle concept shown in Fig. 2 into to identify items to be tested. In order to clarify events that can occur in the field after practical introduction, we identified such events at each stage of the RAMS lifecycle from the perspective of a railway operator.

2) Clarification of patterns that can lead to danger using Fault Tree Analysis (FTA)

Assuming dangerous events to be at the top of the events in FTA, we clarified possible patterns in top-down analysis.3) Clarification of failures and handling errors using Failure

Mode and Effect Analysis (FMEA)By investigating possible modes of failures and handling errors using FMEA, we clarified possible patterns in bottom-up analysis.4) Feedback to test item proposalBy feeding back the patterns clarified in 2) and 3) to the test item proposal developed in 1), we brushed up the proposal both in top-down and bottom-up approaches.5) Determination of test itemsBy omitting from the test item proposal items in the same time chart and out of the scope of that system taking into account the feedback in 4), we determined test items.(2) Procedure for streamlining test itemsTest check lists needed to be created for each test item, but we streamlined test check lists by focusing on the following two points to conduct tests in a realistic time frame.1) Reduction of number of test itemsSince the software controls inbound and outbound lines independently, we reduced the number of test items after comparing them with each other. We also reduced items related to status indication after comparing all indications (Fig. 3).

2 System Definition and Application Conditions

5 Apportionment of System Requirements

6 Design and Implementation (RAMS Plan)

10 System Acceptance

9 System Validation

1 Concept

3 Risk Analysis

4 System Requirements

7 Manufacture

8 Installation

11 Operation and Maintenance

Lifecycle of microelectroniclevel crossing after installation

12 Performance Monitoring

13 Modification and Retrofit

14 De-commissioning and Disposal

Pattern 1

Pattern 2

Pattern N

Statusdisplaypanel

Inbound

Pattern 1

Pattern 2

Pattern N

Statusdisplaypanel

Outbound

Comparison test with status display panel

No need of subsequent confirmation

Inbound/outbound linesComparison test

No need of subsequent confirmation

Pattern 1 Pattern 3 Pattern 4 Pattern 5Pattern 2 Pattern N

Check test after transition to failure

No need forsubsequent confirmation Pattern after

transition tofailure 1

Pattern aftertransition to

failure 2

Failure 2

Pattern aftertransition to

failure 3

Failure 3Failure 1

Fig. 3 Example of Reduction of Number of Items

Fig. 4 Concept Image of Reduction of Number of Procedures

Fig. 2 The RAMS Lifecycle



based on by information extracted from the level crossing that controlled the Hikawa level crossing, and operation of the actual level crossing (Fig. 5). That allowed us to check operation using many actual trains that we could not perform in-factory tests.

2.4.2 Field Monitoring Test ResultsTable 1 shows the results of field monitoring tests. In the test period, the developed system continued to operate stably in the following environment and no operation problems occurred.(1) Field monitoring test period:

237 days in total from July 7, 2014 to February 28, 2015 (2) Highest temperature in the equipment cabinet:

44.7 ºC (August 6, 2014) Lowest temperature in the equipment cabinet: -6.85 ºC (February 10, 2015)

(3) Lightning surge: None(4) Number of trains:

Approx. 38,500 (stopping trains: approx. 23,700, passing trains: approx. 14,800)

Currently the Hikawa level crossing has been provided with a warning delay time element, so some difference was seen in whether or not warning start is delayed subject to the location of the next train. Compared with the warning time of the current system, that of the developed system was sometimes longer. However, both operated according to the functional specifications where there would be no problems in terms of safety, and no safety problem occurred.

Since the results of both in-factory tests and field monitoring tests were favorable, we put the developed system into practical use in fiscal 2015.

Development of a Level Crossing Network System3

3.1 IntroductionCurrent level crossing protection devices (“level crossings”) change to constantly emitting a warning once a failure is detected, based on the fail-safe concept. However, a level crossing with long constant warning and traffic blocking is a level crossing kept unopened from the perspective of level crossing passers, and this has become a major social issue.

In order to overcome that, we aimed to reduce warning of a failed level crossing by connecting over a network level crossings conventionally controlled independently and using data of adjacent level crossings even if the level crossing in question fails.

3.2 Purpose of Development3.2.1 Issues with Current Level CrossingsFig. 6 shows the current level crossing system configuration. Here we look at between-station level crossings (level crossings B, C, D in the figure). As the control of individual level crossings is independent, control of each level crossing is done in the assigned area while securing safety. Thus, once a level crossing detects a failure, it constantly emits a warning and blocking traffic based on the fail-safe concept.

In such a level crossing failure, maintenance personnel go to the site and restore the level crossing after investigating the cause, so warning and traffic blocking continues for a long time. Particularly when such a failure occurs at a location such as a level crossing on a main street with much traffic, that results in major social impact.

3.2.2 ObjectivesTaking the aforementioned issues into account, we fundamentally reviewed the current system configuration in the development. JR East uses many microelectronically controlled level crossings (“microelectronic level crossings”) to ensure safety at level crossings and properly control warning. We thus aimed to build a system where a microelectronic level crossing can maintain safe operation by using information of adjacent microelectronic level crossings that are connected to each other over a network even when a failure is detected (“level crossing network system”).

Fig. 7 shows an image of the system configuration of a level crossing network system.

Test item Criteria Result

1. Warning timeAgrees with operation of Hikawa level crossing (Operates as specified in function specifications)

Good

2. Input/output timing Good

3. Defect detection Good

4. Environmental performance

Continues stable operation in on-site environment Good

Toro Station

Gentaro level crossing

(32 k 187 m)

Hikawa level crossing

(32 k 351 m)

Nakajima level crossing

(33 k 163 m)

to Tokyo

To remote control location

to Aomori

Hikawa level crossing equipment cabinet

Field monitoring testequipment cabinet= *Only Tohoku Line inbound line extracted

Hikawa level crossingequipment cabinet

Current level crossing logic(constant warning time)

Field monitoring test equipment cabinet

Microelectronic level crossing logic

(constant warning time)

Obtain relay condition

(Level crossing B)

1) Detect failure

2) Constant warning

(Level crossing C)

(Level crossing D)

Level crossing equipment cabinet



Start point for warning






Fig. 5 Overview of Field Monitoring Tests

Fig. 6 Current Level Crossing System Configuration

Table 1 Field Monitoring Test Result



3.3 Basic Development of a Level Crossing Network System3.3.1 Overview of DevelopmentWe first developed a system where a microelectronic level crossing can maintain safe control using information of adjacent level crossings even when it detects a failure, instead of constantly emitting a warning and blocking traffic (“fallback”).

Fig. 8 shows control areas with fallback.

The basic idea of fallback is as follows: when microelectronic level crossing C detects a failure, the system does not use the information of that level crossing because the information of a failed level crossing is not reliable. Instead, the system uses reliable information of microelectronic level crossings B and D. Thus, the control area of the system in fallback is the area from level crossing B to level crossing D.

3.3.2 Development of Control LogicIn order to achieve the basic control logic plan, we developed actual control logic. The following is the technical items we studied. Here we focus on level crossing C.(1) Method of managing train locationConventional level crossings check train locations using the train counter—the number of trains within the control area of microelectronic level crossing C —to control warning and traffic blocking. However, when the microelectronic level crossing detects a failure such as with the controller, the train counter managed by microelectronic level crossing C becomes unreliable. We therefore defined another train count that manages train locations within the area from level crossing B to level crossing D (“approaching train counter”) separately from the train counter that manages train locations within the control area of the level crossing C. The number of trains in the approaching train counter increases or decreases according to changes in the train counter of microelectronic level crossings B and D. And, when level crossing C detects that it has failed, the system changes into

a fallback mode using the approaching train counter. In this way, train location control using the approaching train counter the same was with conventional train location management can ensure safety. Fig. 9 shows the concept image.

(2) Use of logic of adjacent microelectronic level crossingsWe decided to control level crossings using information of adjacent microelectronic level crossings but it is not desirable to develop new logic simply to assure reliability of information. We thus made full use of logic of adjacent microelectronic level crossings that are fail-safe devices. Specifically, the level crossing network system relies on adjacent microelectronic level crossings to detect failures and changes to fallback mode only when adjacent microelectronic level crossings have not failed. In this way, level crossing C does not need to judge whether or not level crossings B and D have failed.(3) Securing safety In order to perform safe level crossing control, we have to develop an appropriate control method according to the state of level crossings. We thus studied what control would be needed according to the level crossing state that microelectronic level crossings detect to achieve safe control, and we found that the approaches from the following two perspectives would be needed for microelectronic level crossings.1) Obtaining data via the networkNormal/abnormal obtaining of data of adjacent microelectronic level crossings via the network2) Status of the level crossingNormal/abnormal status of level crossing CConcerning the status of the microelectronic level crossing, the system needs four control modes of the combination of the above statuses. The four control modes are defined as follows.(a) Network mode (1: Obtaining data via the network: normal,

2: Level crossing concerned: normal)In order to safely switch to fallback mode when a failure is detected, the system constantly obtains information of the adjacent level crossings and operates the fallback logic in the background to assure safety, even while the system is operating normally. We defined this status as the network mode.

(Level crossing B)

1) Detect failure

(Level crossing C)

(Level crossing D)

Crossing information Crossing information

Dispatcher Maintenance center










3) Prevent constant warning

Communications network

Communications network

2) Obtain information of other level crossings by network

Level crossing B

Level crossing C

Level crossing D

Normalcontrol area

Control area in fallback

Area of counting for"approaching train counter"

of level crossing C

Area of counting for "train count" of level crossing C

Level crossing B

Level crossing C

Level crossing D

Normalcontrol areaControl areain fallback

Controller of microelectroniclevel crossing B

Controller of microelectronic level crossing C

2) Train counter of level crossing B

Controller of microelectroniclevel crossing D

3) Train counter of level crossing D

1) Train counter of level crossing C

Use for normal warning

4) Approaching train counter of level crossing C

Use for fallback warning

Fig. 7 Image of Level Crossing Network System Configuration

Fig. 9 Concept Image of Fallback

Fig. 8 Control Area in Fallback



(b) Fallback mode (1: Obtaining data via the network: normal, 2: Level crossing concerned: abnormal)

This is the status after the microelectronic level crossing concerned detects a failure and the system switches to fallback mode. In fallback mode, the system assures safe level crossing control by performing train location management the same as with conventional control using the approaching train counter as explained in (1). We defined this status as the fallback mode.(c) Local mode (1: Obtaining data via the network: abnormal,

2: Level crossing concerned: normal)When operating normally, the system cannot be switched to fallback mode if it cannot obtain information of the adjacent level crossings or if such information is not reliable. In addition to the conventional functions, we assured safety level equivalent to that of conventional control by designing logic that prevents wrong mode transition. We defined this status as the local mode.(d) Failure mode (1: Obtaining data via the network: abnormal,

2: Level crossing concerned: abnormal)If a failure is detected in status of (c), the system constantly emits warning and blocks traffic to secure safety. We defined this status as the failure mode.

As seen above, we defined four control modes to secure safety and studied individual transition conditions. Fig. 10 shows the mode transition chart.

3.3.3 Function Check TestWe actually produced three prototype level crossings of the microelectronic level crossing network system and tested the aforementioned function.

Fig. 11 shows the system configuration in the function check tests, and Fig. 12 is a photo of testing in progress. In that system configuration, three prototype microelectronic level crossings were placed in a row and connected to each other by Ethernet via a hub. The PCs connected to the hub were provided with a remote monitoring function developed to confirm failures of the microelectronic level crossings remotely and a monitoring terminal developed to monitor the internal condition of the microelectronic level crossing system. Moreover, in order to simulate the operation of the on-site controller and check the output power of the microelectronic level crossings on a LED display, a switch panel was produced as well.

We carried out tests such as input/output tests, network tests, approaching train counter tests, control functions tests in the modes introduced above, and we were able to confirm that the system operated without problem as stipulated in the function specifications.

3.3.4 Estimation of Effect of FallbackTo demonstrate the effect of fallback, we estimated the effect assuming a case where the system operates in fallback mode in a section with many between-station level crossings in the Tokyo suburban area in the time slot from 7:00 to 7:59 on a weekday. Table 2 shows the results of that estimation. When a conventional level crossing detects a failure, it constantly emits

(a) Networkmode

(b) Fallbackmode

(c) Localmode

(d) Failuremode

Detection of a failure

Detection of a failure

Operation to complete on-site recovery

Operation of start up switch

Operation of change to network

Operation of change to network



Abnormal relay operation

• Abnormality of adjacent level crossing• Abnormal relay operation

• Abnormality of adjacent level crossing• Operation of start up switch

Completion of system setup

Microelectronic level crossing controller

(networked)

HUBTrain detection simulator

(switch panel)

Remote control terminal

Monitor terminal

Microelectroniclevel crossing B

(networked)

Microelectroniclevel crossing C

(networked)

Microelectroniclevel crossing D

(networked)

Monitor level crossing system in network

Display operation history etc. of individual level

crossings

Simulate train movementMicroelectronic levelcrossing controller(Ethernet interface)

Monitorterminal

Remote control terminal

PC

HUB

Switch panelSwitch panel Switch panel

Fig. 11 System Configuration of Function Check Tests

Fig. 12 Function Check Test

Fig. 10 Mode Transition Chart



Reference:1) Manabu Teramoto, Naoki Miyaguchi, Kazuhiko Kumasaka, Reiji

Ishima, Yamato Fukuta, “Teijikan Seigyo Ronri o Naizo shita Denshi Fumikiri Seigyo Sochi no Kiso Kaihatsu [in Japanese]”, JR EAST Technical Review, No. 43 (2013): 33 - 38

2) Japan Railway Electrical Engineering Association, Tetsudo Gijutsusha no tameno Shingo Gairon; Fumikiri Hoan Sochi [in Japanese] (1995)

3) Tsunenobu Kikuchi, Kazutoshi Tamura, Kyosuke Isono, Naohiro Kasuya, Takanori Yasumoto, “Shingata Denshi Fumikiri Seigyo Sochi [in Japanese]”, Railway & Electrical Engineering, Vol. 10, No. 11 (November 1999): 37 - 41

warning and blocks traffic, so the rate of warning time in one hour is 100%. In contrast, with the level crossing network system operating in fallback mode, that rate is 18.7%, showing that it achieves warning time shorter than that of conventional level crossings.

3.3.5 Issues for Putting the System into Practical UseWe found some issues to be overcome for putting the system into practical use. Those include:(1) Functional issues· Consideration of complicated placement of controllers· Consideration of a method of switching to fallback mode if two

or more between-station level crossings fail· Investigation of system specifications for single track lines· Arrangement of failure specifications related to communications

errors(2) Operational issues· Extension of the area where line occupation must be confirmed

when a failed level crossing recovers in fallback mode(3) Infrastructural issues· Putting in place network infrastructure for building a level

crossing network(4) Safety issues· Consideration of diverse safety issues required for putting the

system into practical use

Conclusion4

In this development, we studied both level crossings in normal state and those in failure state in order to shorten warning time.

For level crossings in normal state, we changed the constant warning time control logic to software logic and developed a microelectronic level crossing controller with a constant warning time control function to be incorporated to microelectronic level crossing controllers. The developed system successfully passed in-factory and field monitoring tests and was put into production in fiscal 2015. As cost reduction as well as simplification of design, installation, and testing were accomplished, we expect it will be further introduced to actual level crossings.

For level crossings in failure state in, to prevent level crossings from constantly emitting warnings even in failures, we developed a level crossing network system where a level crossing control can be maintained by using even in failures information of adjacent microelectronic level crossings that are connected to each other

over a network. In the course of the development, we found that four control modes are needed to maintain safe control and studied transition between those modes. We further produced a prototype level crossing network system and carried out function check tests by connecting the system by Ethernet and simulating the operation of on-site controllers with a switch panel. In the function check tests, we tested train counter, control functions, and the like and obtained favorable results. While some issues there still remain in putting the system into practical use, introducing the level crossing network system will in the future probably reduce unnecessary long warning and traffic blocking due to level crossing failures and improve convenience for pedestrians and road traffic users.

We believe a social contribution can be made by shortening road traffic blocking time of level crossings using results of this development.

Normal Failure detected on outbound line

Conventionallevel crossing

8.4(14%)

60(100%)*

Level crossingnetwork system

(developed)

8.4(14%)

11.2(18.7%)

*Maintain warning when level crossing detects a failure

Table 2 Warning Time per Hour (Min.)

Development of a Smart Level Crossing System For Traffic ... · Development of a Smart Level...

Documents

Transcript of Development of a Smart Level Crossing System For Traffic ... · Development of a Smart Level...