microETS

The MicroETS system

As reported elsewhere on this website, the new Micro ETS system has been installed on the Pont Croesor-Beddgelert Section of the railway and a three month trial in the summer of 2012. This article by Roland Doyle of Highrail Systems Ltd explains the principles of the system.

Collision Avoidance Systems

ETS token machine - David Tidy

The need for a Collision Avoidance System on a bi-directional single line railway is obvious. At one time safety was achieved by putting a policeman on duty on each single line section of a railway. The train was not allowed to enter the single line section until the policeman was aboard the locomotive. After a while, the policeman’s truncheon became the symbol for the movement authority. Called the ‘token’, it was placed on the hands of the driver, as the sole authority for a train to occupy the section to which it applied.

In 1888 the L&NWR invented an electrically worked instrument, the Electric Train Staff (ETS). There was an ETS machine at either end of a single line section, linked with copper cables. Each ETS machine has a magazine to hold many tokens. When a token is removed from, or inserted into an ETS machine, a change-over switch changes over. This switch has two possible states, 'A' or 'B' known as the 'ETS polarity'. The system is arranged so that when the line is clear (no token out), both machines will have the same polarity. They will ether both be 'A' or both be 'B', it doesn't matter which, so long as they are the same. On the L&NWR system, the ETS machines at either end of a section would be in signal boxes staffed by signalmen.

When the signalman in the local signal box wished to extract a token from his ETS machine, he would arrange for the signalman in the remote signalbox to hold down a key, which applied that ETS machine polarity to the transmission line. This remote polarity was received at the local end, and if it was the same as the local machine's polarity, the local machine would then unlock allowing a token to be released. The instant that token was released, the polarity of the local ETS machine would invert causing it to lock, since its polarity was now different from the remote machine. This ensured that only one token could be removed from the system. When the Remote operator on Ffestiniog Railway - Roland Doyle

Remote operator on Ffestiniog Railway - Roland Doyle

token was inserted to the ETS machine at the far end, the polarities would then be the same again so that a token could be removed again. The reason why the machines have several tokens is that subsequent trains may travel in the same direction.

An advantage of ETS over Staff & Ticket working is the flexibility to change the specific loop that trains pass without the need to move the token by road. This is useful if one train is late and the other is on time. The passing place can be changed so that the delay of one train is not wholly passed on to the other.

Having been installed on the FfR in 1912, this system was later adapted by the use of a remote-operator. On the FfR system, a small handle is wound on a generator which applies an electrical signal to the transmission line. Equipment at the remote end detects this signal and will apply the remote ETS polarity to the line without the need for anyone there to hold a key down. Thus the system can be operated by a single member of the loco crew.

The MicroETS System

MicroETS remote operator - David Tidy

The MicroETS system obtains the polarity of the remote ETS machine by using secure double encrypted messages over the internet (or any other medium which can support Internet Protocol). The Remote Operator on the new system is currently a push-button switch. The remainder of the equipment is kept locked away out of sight with a view to maintaining the heritage feel of the system, similar to the original ETS system.

Under the ETS bench at each token station, there is a MicroETS Outstation for each ETS machine. The outstation contains 4 microcontrollers, 3 'Channel Cards' for communications to the outstation at the opposite end of the section and one event recorder to log the processes associated with obtaining a token. The Event Recorder even knows when the remote operator button was pressed.

The MicroETS Management Server is a program currently running on a server in Gloucestershire in a company that just rents out secure servers which are attached to the high speed internet backbone in the UK. Each time a token is removed or inserted into an ETS machine, the event data is collected by the server in Gloucestershire. Another programme, MicroETS Client, is used to read the data in the server and use it to display a mimic diagram of the line, showing where a token is in or out - see diagrams below.

If the token is out then the direction of movement authority is shown by an arrow.
If you hover the cursor over the arrow, the time of token extraction will be displayed in a tooltip.

The system has been developed by Highrail Systems Ltd, the principal players being Ben Abbott (MicroETS Management Software), Roland Doyle (MicroETS Outstation hardware & Software) and David Seelhoff (DC-Uninterruptable Power Supply). Jim Comerford has been approved by FfR Co to install the equipment. Jim has made very neat installations at Pont Croesor & Beddgelert.

Safety and Security

MicroETS Card - Roland Doyle

The Safety Critical Core parts are the Channel Cards. These are purpose made for the MicroETS system. Since they are not PC based, they will not just connect to any device sending a connection request. The connection process is specific to the MicroETS protocol since Channel Card 1 at Beddgelert will only ever need to connect to Channel 1 at Pont Croesor, and so on. It's true that some clever would-be hacker could 'spoof' a channel card (make his PC have similar credentials to a channel card) But he will not know the password needed to complete the connection process. In fact no one knows what that password is since it changes every time.

Once connected, the channel cards communicate with each other using encrypted communications. Even if a would-be hacker could decrypt the messages, he's then faced with the task of placing the correct key in his response message (the computer engineering term for this key is a 'token' but in this case that just confuses matters!). The key changes each time a message is sent. Without the correct key, the message will be ignored. But there are 3 channels of inter-outstation communications, all with different unrelated dynamic keys.

If the mains electricity supply fails at a token station, MicroETS has battery backup which will keep the system running for at least 27 hours. However, the controller will know when the mains fails since he is shown a power fail icon next to the token station on his mimic diagram.

As part of the safety verification process, the system is being trialled for 3 months. Shadow working is used whereby during the trial period, the Guards operate the MicroETS system, keeping the ETS token out of the sight of the loco crew, who operate the current 'live' staff & ticket system. The trial system is installed between Beddgelert & Pont Croesor. Many thanks to Steve Broomfield and Lyndon Cooper who together with Roland Doyle have been showing the Guards how to operate the system.

Future developments

The FR Company, has asked us to look at the provision of operating starting signals which would be set automatically by the removal of the relevant MicroETS token, and cleared either by train departure or reinserting the token into the machine it was obtained from. This requirement has been allowed for by providing a signalling relay for the starting signal.

Planned future development includes intermediate token machines (like the one at Boston Lodge) and Long & Short Section Working (like the Minffordd – Tanybwlch section which can be split into Minffordd – Rhiw Goch and Rhiw Goch - Tanybwlch).

Update - October 2013

The trial system (Pont Croesor – Beddgelert) is currently being soak tested using Jim Comerford’s automatic testers which replicate the Remote Operator Button push every 6 minutes or so. Later this year, we will run two more trials with the equipment being operated by Jim’s automatic testers. One trial will have an even number of tokens between the two ETS machines – meaning ‘line clear”. This is the reliability trial since the system should decide to release a token each time. The system logs will show what was decided. The second trial is the safety trial where there will be an odd number of tokens between the two ETS machines meaning “line blocked”. In this case, the system should decide not to release a token on every test cycle.

Should the Ff &WHR decide to adopt the system, then it will be somewhere in the queue for funding behind Harbour Station redevelopment.

The assistance of Roland Doyle in providing this article is gratefully acknowledged

Back to Home page

Created 4th July 2012, updated 7th October 2013 by David Tidy