1. Introduction :
U. S. Automation worked with POMA-OTIS Transportation systems as a team to install and commission Automated People Movers (APMs) at the following locations:
Huntsville Hospital in Huntsville, AL
Detroit Airport - Midfield Terminal in Detroit, MI
Minneapolis/St. Paul airport in Minneapolis, ME.
U. S. Automation provided the software programming for Automatic Train Operation (ATO) and Automatic Train Protection (ATP) systems. U. S. Automation's engineering group coordinated with the local trades and contracts for the installation and start up of the APMs. U. S. Automation's engineers built a GE Fanuc SCADA system to control, monitor, record and provide critical alarm for the Automatic People Movers. The entire operation of the train was automated including the start/stop of the train, train speeds and operation of the station doors.
The trains at Huntsville and Minneapolis airport had steel wheels and ran on steel tracks to accommodate for adverse weather conditions (snow & ice) while the train at the Detroit airport had a HOV-air system (traveled on air pads). Each train had a set of doors that opened when they were aligned with the station doors, which were commanded by the Automatic Train Operation (ATO) system. The train doors and station doors worked as a combined set of doors and opened and closed at the same time.
The guideway on which the train operated had various access points. Each guideway access point was monitored and an alarm generated when an unscheduled guideway access was detected. This alarm would kill power to the guideway and stop the train. A brief description of the Automatic Train Operation (ATO) system and Automatic Train Protection (ATP) system is given in the following sections.
Controls engineers from U. S. Automation worked closely with POMA-OTIS engineers to program and test the safety features necessary for safe operation of the APMs. The SCADA System screens were designed to the client's and national safety standards.
2. Automatic Train Protection System (ATP) :
A comprehensive Design / Test approach was adopted that met the client's strict schedule and quality requirements.
A triple modular redundant control system (TMR) was implemented to ensure the safe operation of the train. Automatic Train Protection (ATP) system software was developed that contained the safety critical features for the operation of the train. The ATP software fully complied with the guidelines of IEEE 730.
Each signal had 3 independent control signals wired back to the controller. Thus each I/O was checked three times and a change in state was accepted only after two of the three I/O states agreed.
Switches were installed at every access point along the tracks to ensure that the train would stop if anyone were on the tracks while the train was in operation.
The ATP software kept track of the train position, direction and speed. The automatic anti-collision feature of the system prevented the trains from coming into close proximity of each other.
The ATP software was also responsible for prevention of terminal station over travel. If the train was approaching an end station and did not slow down at a predetermined rate while approaching the station, the ATP software would set the emergency brakes on the train and cut power to the guide-way to prevent the train from going past the terminal station and running into the station buffer.
The ATP software monitored a safe tone coming from each vehicle. The vehicle sent the vehicle-safe signal when all conditions on the train were safe. These conditions were: no unscheduled door opening, no manual emergency stop, and no bumper switch activation. In addition a non-vital signal, phase loss or suspension loss was also included. In automatic mode two safe to operate signals were sent. Both signals had to be true to indicate the vehicle is safe to operate. This critical control signal was latched until reset. A filtering timer was used to prevent short signal interrupts from causing an emergency stop. The time was adjustable from 0 to 5 sec. In case of a loss of safe tone from the vehicle the ATP system would set the bakes and E-stop the train.
The ATP software had an emergency condition collector module that collected the emergency stop conditions from a variety of modules. This offered ease in trouble shooting as it offered a single place to quickly review the cause of an emergency stop.
Any system integrity failures (self-test, and cross-check faults) would cause an alarm message to be printed in the central control room.
3. Automatic Train Operation System (ATO):
The Automatic Train Operations (ATO) had the following operating modes
Local Scheduled Mode: The train would continuously shuttle between the terminal stations stopping at every station in between the two terminal stations.
Express Scheduled Mode: The train would shuttle between the two terminal stations without stopping at intermediate stations.
Demand Mode: The trains ran only when a passenger pushed one of the call buttons located at the station platforms or the passenger was sensed automatically. The Automatic Train Operation (ATO) is briefly described in this section.
Automatic Train Operation (ATO) was programmed such that the train would travel at a preset speed between any two stations.
The distance between any two stations was divided into various zones and depending on the zone, the speed of the train would vary.
When the train was approaching a station, it would ramp down at a preset rate; come to a complete stop at the station and then the train doors as well as the station doors would open. A brief description about the operation of the doors is provided in later sections.
There were on-board announcements as well as passenger advisory announcements on the station when the train was approaching the station; it is on the station and just before departing the station. Details about passenger announcements are given in later sections.
After the train stops at a station and the train and station doors are open, it waits for a specified period of time for passenger loading and unloading. Then the train and station doors close. Once the ATO system has detected that all doors are closed and locked, the train departs the station.
While leaving a station the train ramps up at a predetermined rate taking into consideration a "jerk factor". This is to make sure that the on-board passengers do not feel any jerks or excessive acceleration during the ramp up zone.
Automatic Train Operation (ATO) was programmed to respond to emergencies. In conjunction with the ATP, if an emergency were detected while the train was in normal operation, the train would go to the next station, drop-off all onboard passengers, then go the station where the emergency occurred skipping stops at any intermediate stations. This feature was useful especially in case of medical emergencies.
The ATO had a "Demand Mode". This mode was used during off-peak hours for periods of low or irregular passenger demand. At times when there was no passenger demand, the operative on-call train was parked at either the Terminal Station or the Regional Station with both the train & platform doors closed.
In this mode, the trains ran only when a passenger pushed one of the call buttons located at the station platforms or the passenger was sensed automatically. When in Demand mode, the call-button backlight would not be illuminated, when no passenger call was present at a station. The same pushbutton indicator light would illuminate when pressed by a passenger to confirm that the demand call had been recognized by the ATC system. Whenever no passenger demand calls were being actively serviced, the train in operation would be parked at either the Terminal or the Regional Stations, with both the station & vehicle doors closed.
When a pedestrian pushed a call-button at any station, the doors would open for the set dwell time and then the train would depart in accordance with the normal Mode schedule. Once a demand call was initiated, the train would complete a full round-trip shuttle cycle, stopping at each of the stations.
If a passenger service button was depressed after the train doors began to close, or while the train was en-route between stations, the demand request would be processed again (as described above) after the active train reached its final destination.
It was also possible to put a train "Out of Service" for maintenance purposes.
4. Central Control Operator Interface :
The entire train movement will be monitored from a central control room. The SCADA system showing the status and movement of the train is located in the central control room. A central operator console was provided in the control room to take actions in case of ATO or ATP operating failures.
The central control operator was alerted when the following events occurred:
Failure of the train to depart station
Door open failure
Door close failure
Passenger interference too long (3-reopens or 10 sec hold open)
These functions are all implemented in the ATO system (Automatic Train Operations), using PLC logic.
The central control operator will have access the following controls
Hold doors open
Hold doors closed
Adjust door dwell time from 10 to 60 seconds in 1 sec increments.
All door control functions requested by the operator will be monitored by the Automatic Train Protection (ATP) system.
The train and station door will open only after the confirmation that the train is stopped and aligned at the station and the brake set. The Hold doors open command will open the doors as long as all doors have not achieved fully closed and locked status. After that point the train begins its dispatch from the station.
In manual mode, if the signaling system is functional, then the on-board operator will consent to train movement via a switch on the train. If not, then the central operator will use only verbal instruction from the on-board operator via a radio link. Only after the central operator has received a consent from the on-board operator via a switch or verbally will the central operator initiate train movement.
5. Door Operation:
Operation of the doors will be the same regardless of the system-operating mode. Each train door will align with a station door and the pair will act as a set. They will open and close at the same time. Both the vehicle and station door will have obstruction detection equipment. When either door detects an obstruction, both will react. Both the vehicle and station door will detect an obstruction based on the input from an encoder that detects door motion. In addition, the station door will interface to a light curtain covering the space between the vehicle and station doors.
Just prior to the door closing, a message will be displayed on the vehicle and an announcement will be made on the vehicle warning passengers that the doors are about to close. If a passenger should interfere with the door closing, that one door set will re-open. After a short delay (adjustable from the control room console from one to five seconds in one-second increments), another attempt will be made to close the doors. If another interference occurs, the doors will be re-opened again. This process will continue indefinitely. It the doors do not achieve a close and locked status 10 seconds after the initial attempt to close, then an announcement will be made to "Please stand clear of the doors". Only after the interference is clear will the door close. If the doors are re-opened three times or if the doors are held open for more than 10 seconds, then an alarm will be displayed in the central control room.
A Door Open pushbutton will be located adjacent to each train door. If pressed prior to all the train doors achieving a closed and locked status, that door set will re-open.
If the system detects a door open signal without being commanded to do so, an unscheduled door open alarm will be generated. An unscheduled door opening will result in an emergency stop of the train and the removal of power. If an unscheduled station door opening should occur, it will be necessary for the designated service representative to go to the station and reset the faulty door
. If an unscheduled train door opening should occur, it will also be necessary for the designated service representative to go to the train and reset the faulty door.
To facilitate diagnosing door problems, each train door will have both an interior and exterior indicating light to display door closed and locked status. Each station door will have an indicating light on the station side of the doors.
6. Passenger Announcements:
Passenger announcement will normally be made both visually via displays and audibly via a public address system.
As an example, the following announcements will be made on the train:
1) "The doors are about to close, please stand clear" - 5 sec. prior to closing.
2) "The trains departure is being delayed please stand clear of the doors" - 10 seconds after initial attempt to close.
3) "The train is departing the station" - after all doors are closed and locked.
4) "The train is approaching station A" - trigger by train position 5) "This is station A, please exit" - as door begin to open.
6) "Please standby - the train will restart shortly" - after an Emergency stop.
As an example, the following announcements will be made at the stations:
1) Out of service - visual only.
2) "The train is approaching the station, please stand clear of the doors" - as the train approaches the station.
3) "The doors are about to close, please stand clear" - 5 sec. prior to closing.
In addition to the automated announcements the control room operators will be able to make announcements over the PA system on any one station or all stations simultaneously. These will generally be used in case of emergencies or under special conditions.
7. Train Features
There will be certain operating controls that an operator will be able to perform on-board the train in case of emergencies.
The following controls will be available for the use of the operator:
Train/station door open selector.
A head set with integrated microphone for hands free communication with the operator of the train.
Normal interior lighting controls
Emergency interior lighting controls.
These controls will be independent of the normal on-board ATO or ATP system. They will be hardwired and not dependent upon any computer systems. The train headlights will automatically switch on in the direction of travel.
Special aids for the on-board operator
To facilitate aligning the train at the station, a visual marker will be placed on the guideway that can be easily seen from the operating station.
8. Recovery of Stalled Trains:
The train may stop on the guideway between two stations due to a fault generated by the system. In such cases the train need to be moved under operator control to the nearest station and repositioned. The different scenarios for recovering a stalled train are discussed in this section.
If the fault is something other than an unscheduled door opening or a guideway access fault then the central operator may immediately attempt a system reset. If the initiating fault condition has cleared then the train will restart and continue the trip to the next station.
If the train does not restart, then the help of an assistant is required. One of the fault conditions indicated at the central console will be a Train Safety Fault. In this case it will be necessary to send an assistant to the train. For all other conditions, it will not be. When the assistant arrives at the train, he/she can verify whether the train is transmitting the Train Safe to Operate signals. If the train is transmitting these signals, then the source of the problem is known to be in the transmission medium. In this case, the assistant may communicate with the central control operator, who may then operate the train in Safety Bypass mode. If the train is not transmitting the Safe to operate signals, then the assistant must inspect the train to insure that it may safely be moved. After this inspection, he may instruct the central operator to move the train in Safety Bypass mode. In both cases, the train should be moved to the closest station to disembark the passengers and the train taken out of service until the problem is corrected.
If the train does not restart and the fault is not a Train Safety Fault, then there is no reason to send an assistant to the train. The action to be taken will then depend upon the nature of the fault.