And then of course in safety critical systems it gets even more entertaining - if a device is constantly self-checking for potentially dangerous failures then this can make it more likely to fail, albeit into a safe state. At which point you may have to implement a manual back system until the main system can be restored - which because of the potential for human error can be even more dangerous! We could call this the railway signalling paradox...it's a problem we come across time and again.


Still, it keeps us in a job


Cheers,


Andy

edited to remove typos 


Alasdair,

Whilst you're undoubtedly right that the highest priority is to maintain safety, and that, as failure is not completely avoidable, safe failure has to be engineered, that is only part of the story. 


Firstly, as Andy rightly points out, there's the paradox of monitoring for failure increasing the likelihood of failure with the follow-on consequences he describes.


I know that, as a fellow railway engineer, working with Safety Critical Systems, Andy will agree completely that things also have to be operable and reliable. Ultimately, every system has a customer of some kind, and the customer experience has to be a very close second to safety, To pursue your analogy of the fuse to protect against short circuit, it wouldn't be acceptable if the fuse blew too frequently, either because it was too low in value or because the connected device had a vulnerability that kept creating over-current conditions. The fuse needs to be the ultimate protection to ensure safety, but the connected device has to be so designed as to reduce, to an acceptable level, the likelihood of causing the fuse to blow.


Moving that out to the railway scenario, most of us who use trains have experienced that gut wrenching moment when we are advised either that our desired train has been cancelled, or worse still that the train we're sat on is going to be stuck where we are for several hours, due to a signalling failure, or failure of the overhead power. Of course, we need to be glad that the system failed in a safe manner rather than allowing the train to move in an unsafe fashion, or present a person or persons to be exposed to the risk of electrocution, but we still have a right to expect that such incidents, and their consequences, are kept to a minimum. 


As a railway telecommunications engineer, very little of what I am directly responsible for is defined as Safety Critical, as the critical safety layers are in the systems themselves, either the signalling system or the traction system. Exceptions are Public Address Systems used for evacuation purposes and train to signaller radio, though the latter only becomes a potential safety hazard if either the signalling system has failed, or has correctly stopped a movement that could have been unsafe. Also, if the comms links provided to carry SCADA operation for remote control of traction systems completely fail, this can delay the isolation of traction systems to prevent or curtail electrocution. For all of these, we have to achieve an acceptable level of reliability and availability, usually, through dual redundancy and diverse routing.


However, other comms links for signalling have the potential for bringing the signalling system down completely. Yes, it will fail safely, but it will bring trains to a grinding halt. I can assure you that it would be completely unacceptable to Network Rail let the train operators if failures occurred because the comms links were not sufficiently reliable and available..


Hence, it is definitely still a failure if functionality has been lost, albeit not as critical a failure as if safety is lost, and if functionality is lost too frequently, or there is an inherent vulnerability rendering a system liable to high risk of loss of functionality, then that is almost, but not quite, as unacceptable as the likelihood of unsafe failure. The task of the engineer is, as both you and Andy have said,  to be aware of and acknowledge the likelihood of failure, whether it gives rise to loss of safety or functionality, but also to reduce the risk of both types of failure to a minimum,  recognising those instances where there is a trade-off in risk to safety against risk to function, in which case, safety has to be the priority. 


Distinctions are made between safety critical systems and safety related systems, and also between absolute duties and "as low as reasonably practicable" duties for risk reduction/management, and the latter distinction is definitely related to the consequences to people, whether death, injury or merely inconvenience. Whilst the last is not covered by HASAW 1974 or subsidiary legislation, it is business critical and thus still of huge importance. Let's not forget that one of the delayed passengers could be somebody on their way to save life/lives, but let's not get embroiled in consequential loss!

Alasdair,

Yes, I agree completely, and I had a feeling that's what you were trying to say, but thought it worth making the point explicitly, as others might mistake your intent.

Well said Andy! 


I find it a little strange that you and I have only met at an IET event, that we've never come across each other within our mutual Rail Engineering activities. Is your York session to Northern Programmes? I was working within that organisation in both York and Manchester until the end of March this year. In fact I've been pulled back, temporarily, for two days a week alongside my Euston work, but it's in Manchester, not York.


As you say, I hope the three of us meet soon to chew the fat on our shared passions!

Roy Pemberton:

I would tell you about my current main assignment, which is all about what we do at Euston Station with Customer Information Systems to improve safety, pedestrian flow, and customer experience. 

I can inform you, as a past infrequent user of Euston St. some of the concerns I've had that are listed below:

• Too many people walking aimlessly about or standing in one spor, thus blocking my flow of travel.

• The reason for above is that all services are located in a disorderly manner.

• There were two ticket offices in different locations: main line in one place, and Oyster at the end of one(or maybe both) tunnels (or passage ways).

• As there are two passage ways leading to the trains, I couldn't tell which platforms were in which passage ways, and went down the wrong one, only to miss my train, when I finally got to the right platform.  What about using coloured signs on both the train arrival time-tables, as well as to the tunnel entrances, as used on the London Underground. So let's say platforms 1-10 are down the tunnel indicated by a red sign; and 11-16 down the blue tunnel.

• There was no indication of where the toilets are, if there are any. It would be useful to have a sign that says where the toilets are, or that there are no toilets in the station; so at least passengers don't waist their time looking for one.

• Lastly, from time-to-time passengers are met with scammers: people coming up with sad stories in order to extract monies from them. I was stopped by one foreign speaking, so called businessman, on two separate occations; pretending he had lost his wallet and was penniless. I reminded him that this was the second time he'd approached me claiming he'd lost his wallet. He quickly walked away. The station has responsibility for ensuring security of passengers inside its building. There should therefore be a sign warning passengers not to give money to beggars, and should report it to security or staff on standby.

Of course it would be great to have all the information (including a visual tour of the station) at hand - before making a journey to the station - using a smartphone app.


What about being able to purchase your ticket through the app and then scan the phone at the platform entrance, or even whilst travelling on the train, like they do on the buses? Then passengers can avoid the queues, and get on the train first.


Hope that helps!

Indeed Mehmood,

As a frequent user of the station, as well as a specialist in my field, I agreed wholeheartedly, and I am aware and have suffered from every single one of the issues you've outlined, and every one of them has gone into the requirements for the work I'm doing. It's why i describe it as the worst terminal station in the country.


I've led option development and selection for the forthcoming changes, and providing the bean counters (in particular HS2 limited and the DfT, who are the reason I'm looking at this in the first place) agree to fund it, all of those issues will be addressed over time. In fact I'm feeling really quite pleased with the options we are pushing for implementation. Bear in mind that this really is a particularly specialist area for me,, having presented at British and International conferences on the topic of how we can/should use technology to better address pedestrian flow, human factors, safety and customer experience. The biggest reason they could refuse funding is that they're not all (if any) issues caused by the HS2 changes, but issues that have historically existed for some time (50 years plus!)


However, the reasoned argument is that these problems are already bad enough, and the changes for HS2 can only make them worse.  At present, I'm getting warm noises that suggest we will get the funding, and all of the train operators love what we are proposing, but I await confirmation with bated breath. 


It won't all happen at once - the first stage is handling changes to platform use in May 2019 due to the closure of two platforms for HS2. So initially, you may see minimal differences that use existing devices/technology to deal with those changes as best we can, but real, noticeable changes that start to address the issues you highlight should follow progressively, including some trial changes to test concepts over the following two years. These will be accompanied by significant changes to the concourse layout. 


If we gain the anticipated support, I'm quite excited by it as the station is my pet hate for everything that's wrong in how to plan and operate a station, and the conveyance of information to users is a major component of why that's so. I love to feel that my work makes a positive contribution to improving people's lives! Also, although my specific responsibility is for information handling/technology, as one of the engineering team, I get to feed my input to the interdisciplinary review of proposals for overall architectural and layout measures, and it's very rewarding that I am listened to. 


I also have one other "specialist" input. As I'm registered disabled, they look to me to provide input on what works best for people with disabilities!

Hi Roy,


It was a training course on Common Safety Method (for Risk Evaluation and Assessment) - we deliver them to NR all over the place, I'll be delivering one in Basingstoke next week (possibly my last ever as I'm changing employer at the end of next week). Now there's a real education challenge: keeping engineers awake while you're training them on both safety engineering and legal compliance at the same time  Discussing lots of real railway "incidents" always works well!


Had a nice surprise, I got up to York early yesterday so had time to have a quick visit to the railway museum, and found that the first thing I ever designed for the rail industry is in there - that was very satisfying! Not that anybody would ever know, it's buried inside the particular Eurostar power car they have there. As we get older we realise that so much of what we do as engineers (particularly electronics engineers) is ephemeral, that it's pleasing when something actually gets preserved.


Cheers,


Andy

The article is American. I'm concerned that foreign authors do not always understand the peculiarities of the economy and the job market in other countries.


I'm of the opinion that education should not be homogenous worldwide but instead tailored to the job market and economy of that particular country. Engineering courses in British universities are driven by overseas students to the point where universities are more interested in providing for them whilst treating home students almost like excess baggage. This factor could be very prohibitive when it comes to curriculum reform. Vocational courses and apprenticeships are the fertile ground for innovation rather than engineering degrees.