Fault Tree Analysis of Route Initiation Circuit
Safety and RAMS
CHAPTER -3
I would describe the Route Initiation Circuit for the given Yard. Before proceeding with development of the Circuit, we consider that Route Initiation is possible only if SM’s Key is Inserted (SMCR Relay Pick up), Signal knob is operated (GNR Relay Pick up), Route Button is operated (UNR Relay Pick up) and No Conflicting Route is already Initiated (LR Relays Drop for conflicting Routes). We will start from the operation of SMCR Relay.Refer Figure 1 for State Transition Diagram.
Figure 1 State Transition Diagram
This Relay is energized when the SM’s Panel Key is `IN’ and turned to Normal. The Energisation of SMCR / SMR Relay provides authorized operation of all the functions on the Panel. When SM’s Key is turned to Reverse and taken out from panel by SM, it prevents un-authorized operation and locks the Panel in the last operated position. The Circuit is very simple as the SMCR Relay operation depends on only one condition – Insertion of SM’s KEY. The SMCR Circuit is given below. If needed, a Repeater Relay SMCPR can be used. One Pick-up Contact of SMCR can be used for operating a Repeater Relay SMCPR, if needed. The Vital Event is showed in a box. Boolean Equation for SMCR is:
SMCR = SM’s KEY
Refer Figure 2 for Operating Circuit for SMCR and SMCPR Relay
Figure 2 The Operating Circuit for SMCR and SMCPR Relay
The energised contacts of SMCR are used in Knob circuits, Button circuits, Point operation circuits, Route Initiation circuits, Route Cancellation circuits, Emergency circuits, Crank Handle circuits, Timer circuits etc. Repeaters of SMCR Relay (SMCPR) may be used as required.
Now, we will prepare a Fault Tree to find out how the Circuit can fail in a Safe mode (Relay does not Pick-up when SM’s KEY is Inserted).Refer Figure 3 & 4
Figure 3 Fault Tree
Unsafe failure (Relay picks up without SM’s KEY) can be due to two causes only.
Figure 4 Fault Tree showing two causes
Failure Mode Effect and Criticality Analysis for SMCR Relay is shown in Table 1
Table 1 Failure Mode Effect and Criticality Analysis for SMCR Relay
All the above failures are detected. Safe failures will not allow ALR to operate and Route cannot be initiated. Signal will not go to OFF. But, Unsafe Failures are not detected until SM tries Route Setting, without insertion of the Key or when the Panel is tested.
The Rate of Safe Failure is
λ safe = λ SMCR + λ FUSE + λ POWER + λ WIRING + λ CONTACT. FLT
As per MIL Std. 217F, for less than 1 operation / Hr. (SM’s KEY is not Inserted for every Signal clearance), λ CONTACT. FLT = 0.0594 X 10 –6 / Hr.,
So, λsafe = (0.7495 X 10 –6 + 0.4307 X 10 –6 + 6.554 X 10 –8 + 2 X 0.04 X 10 –6
+ 2 X 0.0594 X 10 –6) / Hr
= 1.3855 X 10 –6 / Hr.
The Rate of Unsafe Failure is λ unsafe = λ WIRING + λ CONTACT. FLT
In this case, Wiring fault has negligible probability except Human Interference, which is difficult to calculate. Thus, it can be limited to λ CONTACT. FLT
= (0.0594 X 10 –6 ) 2 / Hr.
= 0.003528 X 10 –12 / Hr.
Event Tree Analysis of the SMCR Relay Operation is shown in Figure 5
Figure 5 Event Tree Analysis of the SMCR Relay Operation
The Timing Diagram for operation of SMCR Relay is shown in Figure 6
Figure 6 The Timing Diagram for operation of SMCR Relay
Route Initiation
A Signal Route Selection Relay ” LR ” decides a particular Route for a Signal and all the Points required for that Route including Isolation and Overlap will be operated to the required position by the LR Relay. Every Signal will have One LR Relay for each of the Routes that the Signal can lead to, including different Overlaps. Some Signals e.g. Advance Starter, Starters etc will have only one LR as there is only one Route.
Refer Figure 7 for Flowchart representing the conditions needed for LR Relay Operation for Route Initiation:
Figure 7 Flowchart with the conditions needed for LR Relay Operation for Route Initiation
Route Initiation / Selection is done by the Operation of Individual LR Relay for the Signaled Route. LR Relay picks up only when there is an operation to Clear a Signal. From the conditions to be satisfied for Route Initiation, and considering one extra Information that Emergency Signal Cancellation (EUGGN) is not applied, we can find the Boolean Equation as:
LR = Signal GNR. Route UNR. SMCR. Conflicting LRs*. EGGNR*
If we Initiate the Signal ‘1’ for Route ‘A’ in the given Yard, the Signal Button ‘1GN’ and Route Button ‘AUN’ are to be pressed simultaneously. The Flowchart of operation of ‘1ALR’ is as follows.
Refer Figure 8 for The Flowchart of operation of ‘1ALR’
Figure 8 The Flowchart of operation of ‘1ALR’
Refer Figure 9 for Logic Diagram for operation of 1 ALR Relay
Figure 9 Logic Diagram for operation of 1 ALR Relay
Refer Figure 10 for State Transition Diagram made for 1ALR Relay along with Contact use.
Figure 10 for State Transition Diagram is made for 1ALR Relay along with Contact use.
Refer Figure 11 for the Basic A1LR Circuit with Signal Button 1GN and Route Button A1 UN pressed
Figure 11 The Basic A1LR Circuit with Signal Button 1GN and Route Button A1 UN Pressed
In the above circuit with SMCR Pick up, the Signal button 1 and the concerned Route Button A are pressed simultaneously to pick up concerned relay ALR through 1GNR and ‘A’ UNR. Once Picked up, it will remain Up through its own front contact and TSR front contact even when Buttons are released (1GNR and ‘A’ UNR front contacts are broken) and even if SM’s KEY is removed. On arrival of train, when the Train passes the Signal, with TSR drop, LR also drops. In case of cancellation, EGGNR (Emergency Signal Cancellation Relay) will pick up and cause LR to drop. EGGNR Contact is bypassed by 1GNR contact, so that only the particular Signal can be Cancelled.
For Route 1A1, the Conflicting LRs are – 1A2LR, 1BLR, 1C1LR, 1C2LR, Co1A1LR, Co1BLR, Co1C1LR, 2DLR, 4ELR, 6ELR, 8ELR, 10A1LR, 10BLR, Co10A1LR, Co10BLR, SH11A1LR, SH11BLR, SH11C1LR, SH12A1LR, SH12BLR, 13FLR and 14A1LR (22 conflicting routes!!). We could have used Drop contact of Sequential Route Release Relay, UYR2 or UYR3 in place of TSR pick up contact to drop LR after a Train crosses the Signal. But it will be a delayed drop. With TSR front contact LR will drop immediately.
Refer Figure 12 for Safe Failures of LR Relay indicated in the Fault Tree.
Figure 12 Safe Failures of LR Relay Fault Tree.
It shows that Safe failure can be caused by any of the twelve individual Causes, one Cause having variable combination depending on yard (Conflicting Routes can vary in different Yards).
Unsafe Failure can occur if 1 ALR Relay either operates when not wanted or it does not release when needed. There are three causes of Unsafe failures:
- The first case can occur if the operating path is available due to simultaneous failures of Contacts of Relays in the path. If ALR operates when not wanted, UCR and subsequently HR Relays will operate clearing the Signal for the Route.
- The second case can occur if the Stick Path does not break due to simultaneous contact failures of TSR and ALR (own) Relays. In this case also UCR and subsequently HR Relays will remain operated clearing the Signal for the Route.
- Unsafe condition can also occur if the Emergency Release of Route is not possible.
Refer Figure 13 for Unsafe Failures of LR Relay in the Fault Tree.
Figure 13 Unsafe Failures of LR Relay
Refer Table 2 for Failure Mode Effect and Criticality Analysis for ALR Relay
Table 2 Failure Mode Effect and Criticality Analysis for ALR Relay
All the above failures are detected. Safe failures will not allow ALR to operate and Route cannot be initiated. Signal will not go to OFF since UCR and subsequently HR Relays do not operate. Unsafe Failures are detected by the Panel Indication. The Rate of Safe Failure is
λ safe = λ LR + λ GNR + λ UNR + λ SMCR + λ EGGNR + λ TSR + λ CONFLR + λ FUSE
+ λ POWER + λ WIRING + λ LR (STICK CONTACT)
Using Failure Rates and considering 22 Conflicting LR Relay Contacts,
λsafe = (28 X 0.7495 X 10 –6 + 1.1802 X 10 –6 + 6.554 X 10 –8 + 2 X 0.04 X 10 –6) / Hr
= 22.3117 X 10 –6 / Hr.
The Rate of Unsafe Failure due to unwanted operation of ALR Relay seems to be much less because all Failures must occur simultaneously. In this case only one Conflicting LR is to be considered since only one Route can be initiated at a time. But, Short Cct of ALR Stick Contact along with short Cct. Failure of TSR Relay contact, leads to Unsafe condition as ALR will directly operate and Signal would come if no other Route is initiated. Luckily the Fault will be detected by Panel Indication. Unsafe failure can also occur due to Short Cct. Of EGGNR Relay contact during Emergency Release.
Westinghouse Q Series Relays have Mean Time Between Wrong Side failure of 6.89 X 10 – 9. So, the Rate of Unsafe Failure is
λunsafe = (λ ALR (OWN). λ TSR)+(λ GNR . λ UNR . λ SMCR . λ CONFLR .)+(λ EGGNR + λGNR).
As per Railtrack IRM CCA Model, λRELAY (short) = 0.4307 X 10 –6 / Hr
λunsafe = (0.1451 X 10 –9 / Hr)2 + (0.1451 X 10 –9 / Hr)3 .( 0.7495 X 10 –6 / Hr)
+ 2 X 0.1451 X 10 –9 / Hr
= 0.021 X 10 –18 / Hr + (3.0549 X 10 – 27 / Hr).( . 0.7495 X 10 –6 / Hr)
+ 0.2902 X 10 –9 / Hr
= 0.2902 X 10 –9 / Hr , as the other terms are negligible.
We observe that Unsafe operation has a low probability and satisfies Safety Integrity Level.
Refer Figure 14 for Event Tree Analysis of the LR Relay operation
Figure 14 Event Tree Analysis of the LR Relay Operation
The Timing Diagram for LR Relay operation is shown in Figure 15
Figure 15 The Timing Diagram for LR Relay operation
Refer Figure 16 for Timing Diagram for Emergency Release of the Relay
Figure 16 Timing Diagram for Emergency Release of the Relay
There is an option of connecting the Crank Handle Relay contacts in the operating Path of LR Relays, if Motor Points are used in the Yard. This increases Safety since both UCR as well as LR Relays are controlled by the Crank Handles. Route now cannot be initiated if any Crank Handle in the Route is unlocked. But the Rate of Safe Failure would increase due to additional contacts in Series.
Thus, there are several ways of designing the Circuit for LR Relay when Signal Button is used. They are:
- Using EGGNR and GNR Drop contacts in Parallel, in the Operate Path of LR Relay and using TSR and LR Pick-up Contacts in Series in the Stick Path of LR Relay. This design is described above.
- Using EGGNR and GNR Drop contacts in Parallel, in the Stick Path of LR Relay.
Figure 17 LR relay Circuit
A Relay draws less Current in Stick Path with respect to the Current drawn in Operate Path. So, inclusion of EGGNR and GNR Contacts in Stick Path is a better idea.
- UYR Drop Contact in the Operate Path of LR Relay.
Figure 18 LR Circuit
Proving UYR Relay instead of TSR is a better idea, since UYR gives a Positive proof that the Train has passed Signal. TSR, on the other hand, can Drop due to Track Bobbing or Power Supply problem
- Using UYR and LR Pick-up Contacts in Series in the Stick Path.
SMCR 1 GNR ‘A1’ UNR
Figure 19 LR Circuit
Using Conflicting Signal ASR Pick-up Contacts in Operate Path of LR Relay.
Figure 20
In some Panels, Signal Initiation is done by using Signal Switch instead of Button. In this case, the GNR Relay Contact of the Circuits described above, is replaced by the ‘R’ Band of the Signal Switch.
The Basic Circuit with Signal Switch is
Figure 21
‘R’ Band of the Signal Switch is bypassed by SMCR Drop Contact to allow Locking of the Panel by SM after the Signal is Taken OFF and to prevent any unauthorized normalization of Signal.
Bypassing SMCR Front Contact and Route Button Contact by Pick-up Contact of the concerned LR Relay is to prevent
- Dropping of LR Relay when Route Button is released (thereby breaking Button Contact ‘A1’UNR).
- Dropping of LR Relay when SM’s Key is removed after the Signal is Taken OFF.
LR can Drop when Signal Switch is made Normal, if SM’s Key is In (SMCR is Up).
To continue reading Register Now or Login