WHITE PAPER

Do you really need a fallback system* with

Communications-Based Train Control (CBTC)?
*secondary train detection and separate interlocking
Introduction
Urban rail operators face huge operational and financial pressures. On the one hand, they
need to take advantage of advanced technology to grow revenues and boost performance
on new and existing lines. On the other, they need to justify every penny they invest as they
confront growing budgetary constraints.

Modern signalling – Communications-Based Train Control (CBTC) – holds the key to balancing
these competing demands. CBTC delivers benefits that cannot be realised using traditional block
signalling. Among these are extra capacity, enhanced reliability and better safety. CBTC also
reduces operating costs – an increasingly urgent need.

But what about the capital cost of implementing CBTC?

A major pain point for many operators is the extra cost of providing a so-called “fallback” signalling
system in parallel with CBTC. A fallback system comprises either a secondary train detection
system, or a secondary train detection system plus separate interlocking.

Fallback systems come with an enormous price tag,

dramatically increasing the overall signalling cost. They
make projects much more complex to design and
implement. They also impose a significant maintenance
burden.

Yet there is no need for a fallback system in most cases.

The purpose of this white paper is to set out the case for implementing “pure” CBTC, without any
fallback. In the following pages, we explain what is meant by the term “fallback system” and why
some operators believe they need one. We show how a correctly implemented CBTC system
can be operated successfully without the need for fallback. Finally, we examine some of the
drawbacks that surround fallback systems – including the additional costs and risks that such
systems can bring.

Do you really need a fallback system with CBTC? - Page - 1

What is a fallback system?
When installing a CBTC system, either for a new (Greenfield) line or for an existing
(brownfield) one, operators may request that a “fallback” system is provided. A fallback
system is a shadow or backup signalling system.

The idea of a fallback system is to take over some or all of the signalling functions if there is a problem
with the CBTC system, or if it is necessary to handle an unequipped (non-CBTC) train. The fallback
system exists in parallel with and in addition to the CBTC system. Although the fallback system is
inactive most of the time, it has an active interface with the CBTC system.

There are two possible approaches to fallback when it is applied to a CBTC system:

Secondary train detection only?

The aim here is to be able to “see” the position of a train (or trains) if the CBTC’s on board
equipment or train-to-wayside communication fails and the train becomes non-
communicating. To achieve this, the track is equipped with a train detection system using axle
counters or track circuits. These are capable of providing an indication of the position of any train
(whether equipped or unequipped) within geographical blocks determined by the position of the axle
counters or track circuits. Data from this system can be used (i) as an input to the CBTC Zone
Controller and (ii) to provide a visual indication of the position of trains on the ATS system or via a
separate panel. No fallback interlocking is provided. Capacity under this configuration is severely
restricted. Figure 1 illustrates one possible configuration with axle counters at stations and junctions
on a notional 2 km stretch of metro. This configuration may be provided with or without wayside
signals.

Do you really need a fallback system with CBTC? - Page - 2

Secondary train detection plus separate interlocking

The aim of this is to provide a fallback signalling system in case there is a failure of the CBTC
Zone Controller. In this configuration, the CBTC system is overlaid on top of a separate fixed
block interlocking. Train route requests are sent from the ATS to the interlocking, and CBTC override
commands are sent from the Zone Controller to the interlocking in order to improve system
performance. In the event of a CBTC system failure, the fixed block signalling remains in place. Trains
can then continue to operate under traditional block signalling, although the line will have much
diminished capacity in most cases. This model comprises a secondary train detection system (as
above, using axle counters or track circuits), lineside signals and separate interlockings. Figure 2
illustrates a configuration with typical headways under block signalling. For comparison, Figure 3
shows the same section of track under CBTC operation with safe separation (and much shorter
headways) made possible by moving block.

In Greenfield projects, the fallback system is provided as all-new infrastructure. In brownfield projects
(i.e. those where a line is being resignalled), the existing train detection system and interlocking is
sometimes retained to act as a fallback system.

Figure 1. Fallback with secondary train detection at stations and junctions only

Figure 2. Fallback with secondary train detection and signals

Figure 3. Normal CBTC operation with no fallback

Do you really need a fallback system with CBTC? - Page - 3

Why do operators want fallback systems?
The rail industry has a long history of safety innovations. One example is the track circuit,
developed more than 150 years ago and still used today. Rail operators, particularly those of
mature networks, are understandably reluctant to relinquish technology that has proven itself over
such a long period of time.

While the preference for established ways of doing things is understandable, CBTC is itself an
established technology with a track record that stretches back 35 years. Today, more than 200 metro
lines worldwide use CBTC as their primary signalling and train control system. There is no technical
requirement for fallback in CBTC systems.

Despite this, some operators still request the provision of a fallback system. When a fallback system
is requested, it is generally for one or more of the following reasons:

Maintain revenue operations if CBTC fails

A fallback system is sometimes installed as a backup in case CBTC fails. The aim is to minimise
or eliminate disruption to normal revenue services. This is achieved by switching over to the secondary
system. The argument in favour of this approach is based on two assumptions. The first is that the
CBTC system might fail (and might do so often enough to justify investment in a secondary system).
The second assumption is that if CBTC did fail, the fallback system would be capable of providing a
reliable and reasonable standard of service.

Accommodate unequipped trains

A fallback system is sometimes provided to accommodate non-communicating trains, i.e.

trains that are not visible to the CBTC system via the usual mechanism of train-to-wayside
radio communications. Typically, these are unequipped engineering (work or maintenance) trains
that operate during non-revenue hours. The argument in favour of fallback in this scenario is based
on the assumption that the operator would choose not to equip all the trains expected to use the line.
The second assumption is that unequipped trains would be completely invisible as far as the CBTC
system is concerned.

Detect broken rails

Secondary train detection using track circuits is sometimes seen as desirable because it can
be used to detect broken rails. The argument in favour of this approach is based on the assumption
that track circuits provide a reliable means of detecting rail breaks.

On the face of it, the arguments in support of fallback seem strong. However, in the next section, we
show that there is a stronger case for not deploying a fallback system.

Do you really need a fallback system with CBTC? - Page - 4

Managing operations without fallback
How can revenue operations be maintained if CBTC fails?

A key question for operators is how to maintain services if CBTC enters degraded mode – i.e.
if there is some loss of functionality. One of the biggest concerns is how to deal with a train that
becomes non-communicating. How can this be managed if there is no fallback system?

Features inherent in the CBTC Automatic Train Supervision (ATS) system and effective recovery
procedures hold the key.

In the event that a train becomes non-communicating, its last position is recorded and displayed via
the ATS system. Meanwhile, the train is allowed to proceed to the limit of its movement authority
before stopping safely. If the movement authority extends to a station, the train can be held there until
the issue is resolved.

Safety is maintained at all times. A protective envelope is automatically created around the non-
communicating train; trains to the rear have their movement limited by a safe stopping distance from
the last confirmed position of the non-communicating train. Health monitoring solutions within the
CBTC system detect communication failures and notify the control centre to initiate maintenance and
repair activities.

If the fault cannot immediately be resolved, passengers are detrained. The ATS operator then uses
the Manual Route Authorisation function within ATS to reserve a safe route. This allows the non-
communicating train to be driven manually off the active guideway or to the depot (Figure 4).

This scenario should be so rare in a properly designed, redundant CBTC system that there is little
justification for the additional expense and operational impact due to secondary detection and
interlocking equipment.

Figure 4. Non-communicating train: protective envelope and Manual Route Authorization

\
How can unequipped trains be accommodated?

Unequipped trains are typically engineering (work or maintenance) trains that operate during
non-revenue hours, as noted above. These trains can be safely managed using the Manual Route
Authorisation functionality within ATS, without the need for secondary detection. As with non-
communicating trains (described above), Manual Route Authorisation creates a protected corridor for
an unequipped train.

This mode of operation is acceptable for train movements in non-revenue hours. However, because
Manual Route Authorisation can have the effect of tying up lengthy sections of track, it is generally not
suitable for use during normal traffic hours. With many metros switching to 24/7 operations, operators
are increasingly looking to equip their engineering fleets for CBTC operation. It should be noted that
the cost of converting engineering vehicles is likely to be less than that of providing secondary
detection.

Do you really need a fallback system with CBTC? - Page - 5

How can a broken rail be detected?

A broken rail can be detected by a track circuit, but only under certain circumstances. While
broken rail detection is seldom seen as the sole justification for retaining or deploying track circuits, it
is sometimes used to support the wider argument for secondary train detection.

Given the risks associated with broken rails, and the limitations track circuits have in detecting them
reliably, a systematic approach to rail condition monitoring based on ultrasonic inspection should
always be considered as the first preference. This approach has the advantage of detecting flaws
before the rail breaks.

Do you really need a fallback system with CBTC? - Page - 6

What are the arguments against fallback?
As the previous section shows, appropriate operating procedures combined with ATS
functionality makes it possible to manage a CBTC line in degraded mode without the need for
secondary train detection or external interlocking.

However, there is an additional dimension to the fallback story: not only does implementing
secondary train detection and interlocking incur extra costs, it can also undermine rather than
improve reliability.

a) System cost

The biggest drawback with fallback systems is the cost of the extra hardware required. This includes
the purchase and installation of axle counters or track circuits, interlocking hardware and lineside
signals. Setting up a fully-specified fallback signalling system is enormously expensive; the provision
of secondary train detection alone adds approximately 5% to the cost of the total signalling solution in
a greenfield project.

The need to integrate the secondary system with CBTC adds a further layer of cost and complexity.

Beyond that, there are the ongoing operational and maintenance costs of equipment that would
otherwise not be required. Secondary detection, for example, will typically increase maintenance costs
by around 5%. Since the profile of this type of equipment can differ significantly from modern CBTC
hardware platforms, extra care should be taken to analyze the life cycle implications and costs of
additional equipment. Factors include obsolescence timelines, typical failure modes, maintenance
costs, workforce expertise and power consumption.

b) System performance

CBTC systems benefit from the proven approach of implementing moving block technology from end-
to-end to ensure safety and reduce headway. Using an external interlocking undermines that approach
because it creates delays in the process of advancing a train’s movement authority, even when the
interlocking has been optimized to accept override commands from the CBTC system.

c) Additional complexity

When non-communicating trains are managed by an external interlocking, the equipment (signalling,
detection and switching) must operate independently of the CBTC system. When CBTC-controlled
trains operate in the same area, those fixed block interlocking functions must be overridden to align
with the CBTC system operation. Since both systems should be implemented in “hot standby”
redundant configurations, there are multiple communication channels and relationships that must be
maintained. Similar complexities exist for supervisory and system functions, such as health monitoring
and remote configuration/update. As well as introducing additional risk, it can limit or complicate future
system and functionality upgrades.

Do you really need a fallback system with CBTC? - Page - 7

The provision of an external interlocking also has implications for cybersecurity. Complexity opens up
new vulnerabilities: the proliferation of interfaces and hardware means that the combined signalling
system has a large attack surface and this can be difficult or impossible to cyber-secure in a
satisfactory manner.

d) System availability

The inclusion of a secondary detection system can have a significant impact on overall system
availability. If the secondary system (track circuits or axle counters) has a higher failure rate than the
primarily digital CBTC equipment, it will drive down the overall system availability. It is worth noting
that track circuits are a single point of failure; by contrast the “detection” component of CBTC (digital
radio) is fully redundant. In addition to increased maintenance and repair costs, secondary detection
can lead to an increase in service interruptions and delays.

In situations where secondary detection systems are installed but used infrequently, there is the
additional requirement to ensure that such equipment is monitored and maintained at regular intervals
to ensure proper functionality when it is finally called into service. Similarly, procedures are required
to ensure that relevant personnel are up-to-date on system functionality and processes when required.
Training and refresher courses are therefore vital for ATS operators, train operators and maintenance
staff.

e) Project implementation

The additional complexity of integrating fallback, mentioned above, typically results in longer
timeframes and higher costs, both during project design and installation. It also prolongs the process
of gaining safety case approval. On top of this, it undermines a key early-stage benefit of CBTC: this
is that CBTC, in its pure form, is designed to be implemented with minimal disruption to revenue
operations. In a pure CBTC brownfield implementation, none of the existing signalling and detection
equipment is retained. The only interface between old and new is with the point machines. Onboard
equipment can be installed on trains which are run in “shadow mode”, monitoring and validating the
CBTC system prior to switchover. Once ready, the switchover to CBTC can be implemented in a
shorter time frame and in a manner that suits the operator.

Do you really need a fallback system with CBTC? - Page - 8

Conclusion
Secondary train detection and traditional interlocking can seem to be an appealing approach
to managing non-communicating trains in a CBTC environment. However, the risks and costs
are significant. Any proposal to use a fallback system should therefore be carefully evaluated.

For lines that will exclusively run CBTC-enabled trains, there is limited value to be found in
implementing secondary detection systems, compared to the additional cost and complexity. There
also remains the risk that the secondary system will mask operational deficiencies that should be
addressed by a properly implemented CBTC system.

For lines where the regular use of non-CBTC trains is anticipated, a careful analysis of the major
drawbacks described in Section 5 can help facilitate a trade-off analysis that considers equipping all
trains for CBTC operation, rather than limiting the performance of the line overall with a complex and
costly hybrid signalling system.

Do
Doyou
youreally
reallyneed
needaafallback
fallbacksystem
systemwith
withCBTC?
CBTC?--Page
Page--99
About Thales

Communications-Based Train Control (CBTC) was pioneered by Thales and first

implemented in 1985. Today, our SelTrac™ CBTC solution is used on more than 100 metro lines
worldwide making it the world’s most widely-adopted CBTC solution for urban rail.

Thales has more experience in delivering fallback-free CBTC than any other supplier. Our projects
include the very first implementations of pure CBTC, without secondary detection and without
traditional interlocking. More than three decades on, we have implemented more than 15 lines
which operate without fallback.

Do you really need a fallback system with CBTC? - Page - 10

Do you really need a fallback system with CBTC – Page 9
 105 Moatfield Dr.
Toronto, ON
Canada
416-742-3900
[email protected]
`> Thalesgroup.com <

Copyright © 2020 THALES All rights reserved.