Operations control centres at Deutsche Bahn AG

In 1995, Deutsche Bahn decided to amalgamate and extensively automate its train scheduling and interlocking control operations by creating seven dedicated competence centres.

The objective of the restructuring was to meet the need for comprehensive modernisation of the interlocking systems especially those used in the east of Germany, whilst at the same time realising major increases in quality and substantial levels of staff rationalisation. This marked the birth of Deutsche Bahn’s operations control centres (OCCs).

In 1994, Deutsche Bahn AG was created through the merger of the former West German Bundesbahn and the East German Reichsbahn. From the point of view of train dispatching, it was only natural that the fifteen regions created by the merger should be transformed into the seven DB operations control centres. To capitalise on the very positive experience gained in the first half of the 1990s with computer-aided train monitoring, the operations control centres were designed to have responsibility for larger areas with a reduction in the total number of organisational interfaces requiring process coordination and synchronisation.

By the mid-1990s, developments in electronic interlocking systems had advanced to a stage that made it feasible to use modern network and communications technology to spatially separate the control of the interlocking system from the other components: the core architecture, the safety functions and the control of the trackside elements. Another key facet of the improvements in electronic interlocking technology at that time was the creation of systems able to control extremely large regions of track, with single interlockings able to control train movements over 50 to 150 km of track. This development was also a major precondition for the success of the planned rationalisation programme.

The design concept of the operations control centres

The crucial idea behind the creation of the operations control centres was to combine and integrate the dispatching and the interlocking systems – two areas that had up until then developed independently of one another.

This concept presented the railway with huge operational, technical and organisational challenges:

• How should operations in such a large area be managed from a single-source?
• What is the right way to exploit the effects generated at the superordinate scheduling level?
• To what extent should train operations be automated if dispatching and control systems are integrated?
• Which is the right engineering approach to adopt? Should one integrate specialist dispatching/control functions into the interlocking technology, or is it better to restrict the interlocking technology to its core functionality?
• How should one deal with the large distances of up to several hundred kilometres from the operator’s location to the control element?
• What measures need to be taken to provide fail-safe mechanisms in the event of system, malfunctions in the operations control centres or the communications equipment?

The answer to these questions lies in the creation of so-called control areas. A control area consists of up to ten interlockings (so-called subcentres) that are combined in such a way that the scheduling of lines and nodes in the area can be controlled by a single train scheduler. The control area therefore represents an operational unit that covers both scheduling and signalling operations. The staff in a control area work together as a team to perform all train scheduling and control tasks. As originally conceived, the staff responsible for passenger information and passenger warnings are also regarded as part of the control area team.

A control area team will typically comprise a train dispatcher, who for reasons to be given below is known as a train controller, between five and seven signallers, an assistant and an information manager. In order to optimise the quality of the interaction between the various elements within a control area, the subcentres within the control area form an operationally and spatially contiguous unit covering approximately 70 to 150 km of track. The main factors governing the creation of these units are the operational requirements governing the strength of applying the decisions of the train controller for approach control, and capacity management at large railway junctions.

One of the major improvements afforded by this approach is that it allows the signallers and the train controller to react flexibly to any deviations or disturbances in railway operations within a control area by concentrating on heavy traffic or decreasing traffic during off-peak periods.

In normal operations, the tasks typically carried out by signallers are automated to a large degree through the use of timetable-based automatic route setting systems (ARS) specially developed for the operations control centre. These ARS are based on decades of experience in automatic route calling and former automatic route setting systems. But because the interlockings are now integrated into the OCC’s planning environment, the ARS also benefits from the continuous updating of the operating timetable.

By using timetable data generated by train-path management and incorporating any operational track requirements and necessary timetable modifications (such as diversions), this approach makes it possible to create a closed operational chain that extends right through to the actuation of the ARS route in the local electronic interlocking.

The train controller is responsible for implementing scheduling measures based on the timetable incorporated in the dispatching system. As a result, the train controller does not just determine the sequence of trains – which was the original task of the train scheduler – he also makes computer-aided decisions on track use when deviations from the standard timetable occur. The signallers can therefore concentrate on dealing with any faults, unusual circumstances that may arise and shunting movements.

Under normal operations, train movements are directed from a train controller interface incorporated in a dispatching system located within the operations control centres. This approach to train control is supported by the technical configuration of the OCC, which houses only a minimum of interlocking-related components. However, the interlocking is still equipped with a fail-safe operations and warning display system in the OCC. The functions that are more business related, such as the timetable, track and node scheduling activities, the calculation of the master control plan for the ARS, the generation and analysis of the operational process data, and the interfaces to the train operating companies are all integrated in the non-fail-safe dispatching technology. This means, given the speed of commercial and business developments, that these functions do not need to be subjected to the lengthy and costly processes of modification and maintenance that would be necessary if they formed part of a fail-safe system.

Furthermore, the dispatching technology within the operations control centre represents the higher-level pooling of functions and information at a level above that of the control areas. This means that in terms of the dispatching technology, the master control plan is not only managed at the control area level, but can be modified at a higher level by train scheduling measures. The dispatching technology can be thought of as the ‘adhesive’ that bonds the control areas within an operations control centre. It therefore has a significant influence on quality, capacity for automation and rationalisation.

In addition to the command/control technology, it is also important to ensure that all other essential technical services such as telecommunications, train radio, telecommunication equipment for monitoring systems etc. conform to the basic principles, particularly those governing increased flexibility of areas of responsibility.

Status report on the implementation of the fail-safe systems

So far we have sketched out the concept underlying DB’s operations control centres. In what follows, we present a critical but constructive appraisal of the implementation phase.

It is important to emphasise at the outset that given the sheer number of functions, components and organisational rules that had to be developed, it was not possible to eliminate all the traps and stumbling blocks that will arise when complex systems of this type are created.

One of the main challenges lies in the design of the fail-safe mechanisms that must engage if there is partial or total failure of the technology in the operations control centre or, most especially, if the telecommunications links between the operations control centres and the local subcentres are disrupted. While overcoming long distances is the primary prerequisite to achieving rationalisation benefits, it also proves to be the Achilles’ heel of any attempt to establish centralised railway control structures.

However, one of the key design principles of the operations control centres proves to be the most effective means of countering this difficulty: the local interlocking is configured as a wholly autonomous fully functioning subcentre with only the operational control of the interlocking being transferred to the control areas of the operations control centres. Each subcentre is equipped with an operating console that is used by maintenance staff. As this console is a fully functional workstation to control the interlocking itself, every subcentre can be manned locally if the need arises.

If ARS by master control plan is active when a communications failure to the operations control centre occurs, ARS by master control plan will continue to be active for a further thirty minutes. During this time, the authorised maintenance technician must take up position at his operating console in the subcentre. If the disruption is a normal interruption of operations, the maintenance technician will act as a points attendant following instructions from a signaller who, in this case, would remain in the operations control centre. Only in those cases in which the disruption appears likely to last longer will a signaller be sent to the subcentre.

In the early stages of creating the control areas that form part of each traffic management centre, the interlockings suffered from malfunctions that were mainly caused by functional problems associated with the newly developed electronic interlocking technology.

Up until now, approximately 90 subcentres and a total of 175 signaller workstations have been set up in the seven operations control centres and this process of expansion has been closely accompanied by improvements in the availability of the new interlocking technology.

As a result of the quality management process in place, the development of the system in terms of the subcentres and how they interface with the operations control centres and with one another in the various control areas can now be regarded as functionally stable and to a large extent technically mature. This is especially true of the timetable-based ARS functions located in the subcentres and the control areas. The focus of the next phase will be to proceed with developments such as creating standardised interfaces for controlling components from different manufacturers.

It was also recognised early on that interruptions to the telecommunications links between the interlocking and the OCC were a serious problem that resulted in operational failure across a wide area – something that had not been known with conventional interlocking technologies. For this reason, current efforts are concentrating on increasing the availability of the telecommunications transmission channels. These communications-related problems, which continue to be relevant today, have their source in the original design concept for the operations control centres. In order to achieve the high levels of availability required, the connections are built in a manner so they may assume to be statistically independent of one another. However, any minor random violation or any unrecognised systematic violation of this assumption means that a broken telecommunications link can lead to the failure of an interlocking affecting a wide area. It is therefore understandable that efforts are currently aimed at creating the necessary organisational, technical and contractual conditions to reduce the likelihood of telecommunications faults arising.

Status report on the implementation of the dispatching systems

So far the scheduling systems in the seven operations control systems have undergone so-called basic level implementation, which means that the systems cover the adoption of the timetable from train-path management, the handling of the operations timetable, provision of functions for track, node and network scheduling, and the statistical analysis of all scheduling-related services. At the moment, however, the automatic transfer of the master control plan to the control areas is still not possible. As a result, the master control plan has to be generated directly for the signallers’ systems of the control areas and modified manually if important deviations arise.

The scheduling system functionality required to redress this deficiency is currently undergoing rollout, and is expected to be in use in the fourth quarter of 2006. Once commissioned, the new functions will offer precise scheduling, conflict identification, continuity and timetable consistency across all systems, as well as providing improved analysis of operational data and extended external interfaces.

The transmission of the operationally responsible master control plan from the train scheduling level to all interlockings that are either already operational or are to be put into operation will take considerable time, as operational responsibility means that the commissioning process for each individual interlocking must be carried out very carefully.

Further operational requirements

In the preceding sections, we discussed the faults that can arise when the communications path between the operations control centres and the subcentres are interrupted. This type of fault could be said to be inherent in the concept of the operations control centres. However, the fact that the interlocking systems combine to cover very large areas of track means that, irrespective of the integration of the interlocking systems in the network operating centres, specialist measures must be in place to deal with any operational failures that may arise. One particular area that needs further work is the response to faults caused by track vacancy detection systems.

Route proving in stations and track-clear verification on open lines are concepts that are part of Deutsche Bahn’s operations management procedures, though all other railways will have similar concepts. If these checks cannot be conducted automatically because the track vacancy detection equipment has failed or malfunctioned, then in any system with large interlocking domains alternative procedures will be required that should, wherever possible, be implementable without requiring the use of local personnel.

The goal is therefore to develop processes that can provide an alternative means of identifying train integrity (end-of-train detection) or to use operating processes that in the event of failure can dispense with the need for a train integrity check. Current thinking in this area is aimed not at extending permissive working, but rather at finding substitute procedures that will ensure that the principle of track-clear verification is implemented without any reduction in safety.

Outlook

The spatial integration of DB’s train scheduling and control operations in seven operations control centres and the advances made in command/control technologies laid the cornerstone for a comprehensive operations control modernisation programme. The objective now is to see the OCC concept realised in full by implementing the major remaining technical functions and facilitating the transmission of the master control plan from the scheduling level to the interlocking systems in 2006.

The focus of current activity is the development of processes that will simplify the handling of faults and failures, whether or not these are individual faults affecting specific elements of the outdoor equipment or complex malfunctions within the interlocking systems or in the OCCs themselves.

Another important target is to ensure that the operations control centres actually manage those network regions and nodes that bear the major traffic loads. From an economic perspective, the creation of large control areas is particularly beneficial if the core activities, ranging from large-area scheduling to capacity scheduling in network nodes, can be carried out by a single provider.