5 ms·

tl;dr : Restarting train schedule mid-day is too hard and unsafe. So we're sending them back to depot instead.

by gridspy 5y ago

amelius 5y ago
Why "unsafe"? Isn't safety supposed to be handled at a different abstraction level (in hardware)?
- coder543 5y ago
  Defense in depth? With this safety feature inoperable, the margin of safety is reduced. Other systems that might normally provide safety critical redundancy could be providing the sole measure of safety, with no other redundancy available in case one of those fails. “Unsafe” is always defined based on context.
  - throwaway0a5e 5y ago
    What's the point of having redundancy if you can't use it to avoid an impact to service? Edit: and to be clear, we're not talking about holding down a resetable circuit breaker to avoid being late, we're talking about the rail network of an entire nation being inoperable for a day.
    - coder543 5y ago
      The point is to still have it when you didn’t know you needed it. That’s the purpose of all redundant safety systems. The redundancy isn’t there to keep the service operating; it’s to keep people from dying. You can never know if the primary safety system is functioning perfectly, so you need other systems to be there to step in when the primary fails unexpectedly. If you detect the primary system has failed, isn’t it reasonable that you should stop operation as quickly and safely as possible, and be thankful nothing bad happened while you lacked redundancy? Any SPoF could be fatal for hundreds of people.
      - throwaway0a5e 5y ago
        I'm not going to write the wall of text that's required to properly describe the situation but that's just not how these systems work. Industrial automation has all sorts of feedback loops so they people operating it know if they can trust it. The people using it are pretty much always trained in how to run the various systems manually so that an errant sensor doesn't turn into a clogged up rail line or waste whatever is in your process equipment that happens to be mid-cycle. This isn't some consumer appliance where you have to stupid proof every inch of it. These systems are bespoke and their architecture is mostly a matter of business decisions and not at all a matter of the internet peanut gallery trying to figure out how safe they can make it.
        coder543 5y ago
        If you want to claim public transit operators are happy to take on liability for potential deaths by continuing to operate when they know about reduced (or no) safety margin, that’s an interesting idea. Calling me a ”clipboard warrior” isn’t furthering your argument, though. This comment provides an excellent example along the lines I was talking about: https://news.ycombinator.com/item?id=30902016 https://news.ycombinator.com/item?id=30902016
        throwaway0a5e 5y ago
    - throwawayboise 5y ago
      A passenger aircraft can still fly with a failed engine, but it must land at the nearest suitable airport. Because at that point, another failure could not be accomodated. This sort of redundancy is about preventing disaster, not about avoiding service disruptions or keeping to a schedule.
- spullara 5y ago
  I think that trains can travel in both directions on the same track and the schedule keeps them from hitting each other head-on.
  - blibble 5y ago
    scheduling hasn't been used for preventing conflicting movements since the 1830s https://en.wikipedia.org/wiki/Railway_signalling#History_of_block_signalling https://en.wikipedia.org/wiki/Railway_signalling#History_of_...
    - makeitdouble 5y ago
      Isn’t way too late if the conflict is detected at signal level ? The worst will have been avoided, but at least one of the train will have to back down to the nearest junction, and depending on how packed it is they might have to back down a few more train as well. I’d assume in reality it would deadlock from there.
      - denkmoon 5y ago
        That's why they have fancy software to route incoming trains around delayed ones.
        makeitdouble 5y ago
        I suppose it relies on some slack in the system and everything else moving as expected. Which could also be the reason why they don't want to restart a schedule at mid-day with every active train in a non standard state.
      - lmm 5y ago
        The worst case is the trains stop running for a while, which it sounds like is what they pre-emptively did?
        makeitdouble 5y ago
- makeitdouble 5y ago
  Might not be your point, but I wouldn’t be surprised if having people stuck in wagons in the middle of a section for half an hour because of conflicting schedules would be seen as safety risks for the travellers.
- jrockway 5y ago
  It sounds like it was a crew scheduling issue. So if you implement some manual replacement for the automated system, it's possible that train crews will "time out" before they reach the destination, stranding passengers in the middle of nowhere. Or, will make a tired crew operate the trains, and tired people aren't very good at safety sensitive tasks. There was an incident a few years ago where a LIRR track crew member stepped in front of a train going 78mph and died. https://www.ntsb.gov/investigations/AccidentReports/Reports/RAR2001.pdf https://www.ntsb.gov/investigations/AccidentReports/Reports/... The employee that died had been on duty for 38 of the 50 hours leading up to the fatality. One of the NTSB's recommendations is to implement software that avoids worker fatigue: "The FRA encourages the use of certified biomathematical models, such as the Fatigue Audit InterDyne Model and the Fatigue Avoidance Scheduling Tool (FAST) by railroads to help them develop work schedules for safety-sensitive employees that align with healthy work-rest scheduling practices; however, these safety measures do not apply to roadway workers. 14 The work schedules developed through biomathematical models avoid many pitfalls causing worker fatigue that arise from excessively long work hours, highly variable work shift times that disrupt human circadian rhythms, and infringement on sleep opportunity times." TL;DR: it's not about the trains crashing into each other. It's about sleepy people making bad decisions that gets them or their colleagues killed.
  - usr1106 5y ago
    > It sounds like it was a crew scheduling issue. I'm not from the NL, but I have travelled there by train. My feeling is that they have very dense traffic, but in a relatively small country most trains don't travel more than 2 hours. That means each driver and each conductor needs to make 4 different trips a day. And because they need breaks they proably switch trains during a working day. If all this planning has been computerized for many years it just means that nobody knows what to do next if the computer screen remains blank. Probably they don't get a printout in the morning like it was some decades ago. No idea how adaptively the system would react during the day dependening on delays and disruptions. Just guessing, maybe some insider knows more.
    - rgj 5y ago
      20 years ago, the NS - the Dutch National Railroad company - tried to remove complication from the railroad schedule and got a lot of criticism from their employees because it would mean they would travel less far from their home stations. Train drivers said “so we will only be driving around our church”. It led to a lot of protests and eventually a lot of the plans were revoked. See https://nl.m.wikipedia.org/wiki/Rondje_om_de_kerk https://nl.m.wikipedia.org/wiki/Rondje_om_de_kerk (in Dutch, use Google Translate to translate to a language of your choice).
- 323 5y ago
  Maybe it might cause a traffic jam - blocked forwards, blocked backwards.

tl;dr : Restarting train schedule mid-day is too hard and unsafe. So we're sending them back to depot instead.

amelius 5y ago

Why "unsafe"? Isn't safety supposed to be handled at a different abstraction level (in hardware)?

coder543 5y ago
Defense in depth? With this safety feature inoperable, the margin of safety is reduced. Other systems that might normally provide safety critical redundancy could be providing the sole measure of safety, with no other redundancy available in case one of those fails. “Unsafe” is always defined based on context.
- throwaway0a5e 5y ago
  What's the point of having redundancy if you can't use it to avoid an impact to service? Edit: and to be clear, we're not talking about holding down a resetable circuit breaker to avoid being late, we're talking about the rail network of an entire nation being inoperable for a day.
  - coder543 5y ago
    The point is to still have it when you didn’t know you needed it. That’s the purpose of all redundant safety systems. The redundancy isn’t there to keep the service operating; it’s to keep people from dying. You can never know if the primary safety system is functioning perfectly, so you need other systems to be there to step in when the primary fails unexpectedly. If you detect the primary system has failed, isn’t it reasonable that you should stop operation as quickly and safely as possible, and be thankful nothing bad happened while you lacked redundancy? Any SPoF could be fatal for hundreds of people.
    - throwaway0a5e 5y ago
      I'm not going to write the wall of text that's required to properly describe the situation but that's just not how these systems work. Industrial automation has all sorts of feedback loops so they people operating it know if they can trust it. The people using it are pretty much always trained in how to run the various systems manually so that an errant sensor doesn't turn into a clogged up rail line or waste whatever is in your process equipment that happens to be mid-cycle. This isn't some consumer appliance where you have to stupid proof every inch of it. These systems are bespoke and their architecture is mostly a matter of business decisions and not at all a matter of the internet peanut gallery trying to figure out how safe they can make it.
      - coder543 5y ago
        If you want to claim public transit operators are happy to take on liability for potential deaths by continuing to operate when they know about reduced (or no) safety margin, that’s an interesting idea. Calling me a ”clipboard warrior” isn’t furthering your argument, though. This comment provides an excellent example along the lines I was talking about: https://news.ycombinator.com/item?id=30902016 https://news.ycombinator.com/item?id=30902016
        throwaway0a5e 5y ago
  - throwawayboise 5y ago
    A passenger aircraft can still fly with a failed engine, but it must land at the nearest suitable airport. Because at that point, another failure could not be accomodated. This sort of redundancy is about preventing disaster, not about avoiding service disruptions or keeping to a schedule.
spullara 5y ago
I think that trains can travel in both directions on the same track and the schedule keeps them from hitting each other head-on.
- blibble 5y ago
  scheduling hasn't been used for preventing conflicting movements since the 1830s https://en.wikipedia.org/wiki/Railway_signalling#History_of_block_signalling https://en.wikipedia.org/wiki/Railway_signalling#History_of_...
  - makeitdouble 5y ago
    Isn’t way too late if the conflict is detected at signal level ? The worst will have been avoided, but at least one of the train will have to back down to the nearest junction, and depending on how packed it is they might have to back down a few more train as well. I’d assume in reality it would deadlock from there.
    - denkmoon 5y ago
      That's why they have fancy software to route incoming trains around delayed ones.
      - makeitdouble 5y ago
        I suppose it relies on some slack in the system and everything else moving as expected. Which could also be the reason why they don't want to restart a schedule at mid-day with every active train in a non standard state.
    - lmm 5y ago
      The worst case is the trains stop running for a while, which it sounds like is what they pre-emptively did?
      - makeitdouble 5y ago
makeitdouble 5y ago
Might not be your point, but I wouldn’t be surprised if having people stuck in wagons in the middle of a section for half an hour because of conflicting schedules would be seen as safety risks for the travellers.
jrockway 5y ago
It sounds like it was a crew scheduling issue. So if you implement some manual replacement for the automated system, it's possible that train crews will "time out" before they reach the destination, stranding passengers in the middle of nowhere. Or, will make a tired crew operate the trains, and tired people aren't very good at safety sensitive tasks. There was an incident a few years ago where a LIRR track crew member stepped in front of a train going 78mph and died. https://www.ntsb.gov/investigations/AccidentReports/Reports/RAR2001.pdf https://www.ntsb.gov/investigations/AccidentReports/Reports/... The employee that died had been on duty for 38 of the 50 hours leading up to the fatality. One of the NTSB's recommendations is to implement software that avoids worker fatigue: "The FRA encourages the use of certified biomathematical models, such as the Fatigue Audit InterDyne Model and the Fatigue Avoidance Scheduling Tool (FAST) by railroads to help them develop work schedules for safety-sensitive employees that align with healthy work-rest scheduling practices; however, these safety measures do not apply to roadway workers. 14 The work schedules developed through biomathematical models avoid many pitfalls causing worker fatigue that arise from excessively long work hours, highly variable work shift times that disrupt human circadian rhythms, and infringement on sleep opportunity times." TL;DR: it's not about the trains crashing into each other. It's about sleepy people making bad decisions that gets them or their colleagues killed.
- usr1106 5y ago
  > It sounds like it was a crew scheduling issue. I'm not from the NL, but I have travelled there by train. My feeling is that they have very dense traffic, but in a relatively small country most trains don't travel more than 2 hours. That means each driver and each conductor needs to make 4 different trips a day. And because they need breaks they proably switch trains during a working day. If all this planning has been computerized for many years it just means that nobody knows what to do next if the computer screen remains blank. Probably they don't get a printout in the morning like it was some decades ago. No idea how adaptively the system would react during the day dependening on delays and disruptions. Just guessing, maybe some insider knows more.
  - rgj 5y ago
    20 years ago, the NS - the Dutch National Railroad company - tried to remove complication from the railroad schedule and got a lot of criticism from their employees because it would mean they would travel less far from their home stations. Train drivers said “so we will only be driving around our church”. It led to a lot of protests and eventually a lot of the plans were revoked. See https://nl.m.wikipedia.org/wiki/Rondje_om_de_kerk https://nl.m.wikipedia.org/wiki/Rondje_om_de_kerk (in Dutch, use Google Translate to translate to a language of your choice).
323 5y ago
Maybe it might cause a traffic jam - blocked forwards, blocked backwards.