Demystifying the safe braking model

Rolling stock engineers know that they design brakes to be suitable for the railways on which their trains operate. Signalling engineers know that they design their systems to deliver safe separation between trains. Whilst both disciplines work together with Newton’s laws of motion, there are differences in approach depending on the nature of operation.

Main line railways have to accommodate a variety of train types which inevitably have different speed and braking characteristics, whereas metros are generally designed around a single type of train. Conventional signalling systems seek to ensure that a train will be safe even if it passes a signal at danger. The UK main line railway generally uses three or four aspect colour light signals which, combined with the protection of Automatic Warning System and Train Protection and Warning System (over-speed sensors and train stop sensors) and a standard 200-yard overlap beyond the red signal. In contrast, London Underground conventional systems simply use two aspect signals with a calculated overlap beyond a red aspect.

In the early 1970s, the engineers who had worked on London Underground’s pioneering Victoria line automatic system started developing the concept of ‘braking within the overlap’ for use on other lines as they were (eventually) upgraded. This was the notion that more capacity could be provided if the train could use service braking in the overlap distance. Clearly, this could only happen if the Automatic Train Protection (ATP) system could be assured that the appropriate braking rate was being achieved. This concept eventually became central to moving block signalling systems and was, effectively, the precursor of the safe braking model which was the subject of a lecture given to the Institution of Railway Signal Engineers by Matthew Shelley in June 2023.

Communication based train control

The aim of moving block signalling systems – usually known as Communication Based Train Control (CBTC) – is to reduce train spacing in order to increase capacity. Anyone used to calculations for conventional signalling will be relieved to know that brake rates, acceleration rates, gradients, and loads are still important, and calculations are still based on Newton’s laws of motion: s = ut + ½ at2 & v = u + at where: a = acceleration (m/s2)
s = distance(m)
t = time(s)
u = initial velocity (m/s)
v = final velocity (m/s)

The approach is, however, somewhat different as it requires many more calculations of braking distance.

A CBTC system will continuously analyse how far along the guideway (i.e. the track) a train can proceed, known as the Movement Authority (MA). Where a train, say, train (b), is following another, say, train (a), the system will continuously recalculate the MA. Based on the progress of train (a), train (b)’s MA might increase or stay the same, but where train (b) is approaching a feature such as speed limit or a station stop, the distance to go will reduce as the train moves towards the feature. The system will expect the train to stop at the end of the MA, and as it approaches that point, the system will require the train to brake. If it fails to do so and intersects the ATP intervention profile shown in the diagram below, it will demand an emergency brake. The safe braking model describes the worst-case stopping distance in these circumstances.

IEEE Standard 1474.1 (IEEE Standard for Communications-Based Train Control (CBTC) Performance and Functional Requirements) defines the term ‘safe braking model as: “an analytical representation of a train’s performance while decelerating to a complete stop, allowing for a combination of worst-case influencing factors and failure scenarios. A CBTC equipped train will stop in a distance equal to or less than that guaranteed by the safe braking model.” Put more simply, how fast a train can go under any probable failure conditions before the ATP intervenes and applies the emergency brake and how far will the train travel before it stops.

As was described earlier, speed, acceleration rates and stopping distances are relatively easy to calculate but it is harder to determine ‘under any probable failure conditions’. The diagram from the IEEE standard shows three phases for stopping the train and an allowance for the uncertainties in the knowledge of the location of the obstruction.

These phases are:

• A runaway phase where the train accelerates (or continues to do so) until the ATP intervenes to cut acceleration and initiate emergency braking.
• A brake build up phase where the train continues to accelerate (or starts to decelerate (depending on the gradient – known as runaway) whilst brake pressure builds.
• An emergency brake phase where the train decelerates to a stop at the emergency brake rate.
• Additional factors
• The maximum speed might be achieved at the first or second phase depending on the gradient.

Sources of error due to tolerances in detecting absolute reference point/norming point and processing the data captured.

Additional factors

The maximum speed might be achieved at the first or second phase depending on the gradient.
So far this is quite similar to the methods that would be used for conventional high-capacity metro overlap calculations. But there are additional factors to consider some of which relate to the nature of CBTC systems, including:

• Positional error: in CBTC systems, the central system ‘knows’ where trains are located from information they transmit. How do the trains know where they are? Generally, this information comes from absolute reference points on the track, e.g. RFID tags in the track or ‘null’ points in wired antennae where the two wires cross frequently. However, the location is not as deterministic as it might be in the example of a train passing a raised trainstop. There might be a margin depending on the sensitivity of the antenna, train speed, or the processor’s cycle times. Beyond the absolute reference points, the train usually maintains knowledge of its position via axle mounted tachometers which might be affected by incorrect wheel diameter calibration or wheel spin/slide. Finally, by the time the position has been reported the train has usually moved. So, these reports are subject to a margin that is included in the calculations. Even the tachometers are subject to small inaccuracies based on the number of pulses recorded per wheel revolution – the more the better (tachometer resolution).
• Speed errors: As can be seen in the IEEE 1474.1 figure, the CBTC system will know three speeds: the commanded train speed (from ATO or the driver) which is less than the ATP intervention speed which, in turn, is lower than the maximum attainable speed following runaway acceleration. All possible sources of speed error must be analysed and these generally relate to inaccurate calibration of wheel diameter (set during maintenance or calibrated on the railway), tachometer resolution, and averaging and rounding errors where the ATP system averages speed over several processing cycles. There’s also the risk of wheel spin or slide. The last issue is generally eliminated if the system can tolerate having one or two axles un-motored and un-braked.

Runaway phase

With all these errors accounted for and the worst-case forward location determined, the start of the runaway phase can be determined and the worst cases considered. The train might be accelerating at its maximum rate as a result of failures of the ATO, the train’s traction circuitry, or the human driver. A complicating factor is that the train’s acceleration rate usually depends on speed and gradient and sometimes varies with passenger load. All this is taken account of in the calculations, but sometimes conservative values are used throughout a metro. When the ATP intervenes, the tractive demand might be immediately removed but it might take a short time for tractive effort to be removed, especially if there is wheelspin at the time the overspeed is detected.

A brake build-up phase is included because there is almost always a delay between emergency brake being demanded and the full braking effort being applied. This is a combination of the time it takes for air pressure to build and to avoid a sudden jerk that might knock standing passengers off their feet.

The runaway phase including brake build-up calculations takes into account:

• Speed at start of intervention*.
• Worst case forward position (based on the uncertainty evaluated earlier).
• How long it takes the ATP to react to the speed threshold being breached.
• How long it takes for the ATP to demand the emergency brake.
• Time to reduce tractive effort to zero.
• Worst case gradient*.
• Gravity*.
• Rolling stock traction and braking curves.
• Trains mass and passenger load (tare is normally worst case)*.
• How long it takes to build up emergency brake effort are considered.

*Only these values needed for the brake build-up section.

Once the speed and position at the end of the brake build-up phase have been calculated the next step is the emergency braking phase. This calculation uses the following data:

• Speed and location at the end of the brake build up phase.
• The Guaranteed Emergency Brake Rate (GEBR).
• Worst case gradient throughout this phase.
• Gravity.
• Train mass/load – usually considered to be crush load.

The challenge is the value of GEBR. This is usually agreed between the signalling and rolling stock suppliers and the operator. It is the minimum emergency brake rate that can be relied upon with a credible single point failure (typically failure of brakes on one bogie of the shortest permissible train formation) and at a defined level of adhesion. The term ‘Guaranteed’ is a bit of a misnomer because of the GEBR’s dependence on a minimum coefficient of adhesion, typically in the region of 0.1 to 0.14. In underground railways, achieving this is usually no problem, but in open areas, much lower adhesion levels can and do occur requiring the operator to have measures in place to manage the impact of the lower adhesion values. Usually, operators reduce the service brake from a typical 0.8 m/s2 to, perhaps 0.4 m/s2 to reduce the risk of the emergency brake being demanded.

Positional uncertainty (again)

When determining the stopping distance/movement authority of our train, train (b), the position of the train in front, train (a), needs to be considered. In this case, in order to maintain safe spacing, the furthest back position of train (a) needs to be the value used to determine safe spacing. Indeed, on some railways it cannot be discounted that train (a) might set off in the wrong direction and this risk must be accommodated in the calculations.

Summing the parts

When all the distances calculated in the various phases are summed, the overall stopping distance will be determined. But this is not the end of the story. The calculations need to be repeated for various approach speeds. It might appear that the lower the speed, the shorter the stopping distance. This is true only if braking is initiated at the same point. The diagram below shows graphically the result of a sample set of calculations for a sample. Each one starts as the train intersects the ATP intervention profile; the lower the speed, the further along the train intersects the profile. From there the runaway, brake build up and emergency braking curves are calculated. Until this is done the furthest stopping distance cannot be established.

It is often the case that braking from higher speed produces the shortest stopping distance and this is illustrated with three sample curves highlighted: high speed – green, medium speed – black, and low speed – red. The black line shows the furthest forward stopping distance for the set of calculations for this ATP Intervention Profile. At first sight this is counter-intuitive, but it is the result of lower speed trains intersecting the ATP Intervention Profile much later than they would if travelling faster. The cause of this is the relationship between Service Brake Rate (SBR) and GEBR and is seen where there is a low SBR but high GEBR.

Frequency of calculations

On a conventional signalling system, these calculations would be carried out for every stop signal. CBTC systems generally have no signals and safe spacing is determined by the system. This means that the calculations are carried out for agreed increments along the railway, generally in the range 2 metres to 10 metres. Using the shortest interval on a 10km long railway, some 5,000 calculation points must be used in each direction and each point might require a calculation for speeds between at, say, 5km/h increments from 5km/h up to the maximum permitted at that point.

Other factors

The calculations also take account of factors such as speed limits set by the track engineers and so-called unallowed zones such as crossovers where it is undesirable for trains to stop. Speed limits, for example 50km/h in platforms, can be a constraint as a train accelerating out of the station might hit the speed limit before the rear of the train has left the platform. This results in the train easing off acceleration and possible braking before re-accelerating once the rear of the train is clear. This is a system integration opportunity to explore whether the speed limit could be eased for the last, say, 10 metres of the platform to enable smooth acceleration. This and other optimisations benefit performance but need to be agreed between rolling stock, signalling, track, and possibly power engineers as well as the operators.

Conclusion

This is but a brief outline of the process and factors involved in working out safe braking distances for a CBTC system. Indeed, some supplier’s own procedures for carrying out these calculations can sometimes run to over 100 pages.

On a frivolous note, when thinking about managing adhesion risks with CBTC railways in the open, your writer started thinking about the certainty that rack and pinion railways would provide. But as they introduce other issues, not least limited speed, this notion was quickly dismissed.

With thanks to Matthew Shelley for his assistance and illustrations, and to the IRSE for permission to publish.

Image credit: