Fail-safe PLC secures rail, barge traffic

Rails over a drawbridge are a critical control point for: freight trains that can take more than a mile to stop, barges partial to having enough bridge clearance for passage, and engineers that like to ensure all bridge interlocks are in place before a train rolls through. The most recent safety initiative at Paducah & Louisville (P&L) Railway involved auditing and improving the technol...

By Staff August 1, 2004

This article contains an online extra.

Rails over a drawbridge are a critical control point for: freight trains that can take more than a mile to stop, barges partial to having enough bridge clearance for passage, and engineers that like to ensure all bridge interlocks are in place before a train rolls through.

The most recent safety initiative at Paducah & Louisville (P&L) Railway involved auditing and improving the technology for one of its signaling systems. Much like a typical road, train movements are governed by green, yellow, and red signals, through an integrated series of signal blocks. Each block consists of 10 or more miles of track, and train crews watch signaling systems located at the entrance and intermittently within the block to know what’s ahead. Advance warning helps with rail safety; loaded cars weigh more than 100 tons each, so there’s a lot at stake, even though P&L hasn’t had any signaling system problems to date.

‘Some of the control technology used in signaling systems is up to 60 years old,’ says Dwayne Edwards, general supervisor of signals and structures at P&L. ‘There comes a point in time when you need to replace this technology even though it is properly functioning.’

While looking to replace these older systems, P&L was especially interested in incorporating technology certified fail-safe and that met International Electrotechnical Commission (IEC) 61508 standard for functional safety of electrical, electronic, programmable electronic safety systems. ‘The safety guidelines and product testing procedures are much more advanced than in the past, and the resulting quality assurance is priceless in an industry like ours,’ Edwards explains. ‘We calculated that by replacing some relays and other mechanical components, we could reduce maintenance of a signaling system by as much as 50%.’ The calculation proved correct when P&L updated the signaling system on its 1931 Rockport drawbridge, a 520-ft span over Kentucky’s Green River. The P&L train dispatcher, 120 miles away, in Paducah, KY, remotely controls the bridge’s position and monitors status for 8-10 trains and watercraft daily.

The old system included 48 relays; conventional dc track circuits; an aerial cable running from pole lines along the bridge; 110 V dc power switch machine; and a linkage system consisting of steel rods, joints, plates and bars.

P&L worked closely with system integrator Interrail Signal Inc. of Jacksonville, FL. The new system includes: a Rockwell Automation (Allen-Bradley GuardPLC1200) controller; 16 relays; 4 non-ferrous (NF) proximity sensors; and coded electronic track circuits. GuardPLC1200 is a certified, fail-safe programmable controller designed to monitor the bridge sequence and all of the interlocks, span locks, and lift rails to ensure accurate drawbridge operation. On the bridge’s signaling system, GuardPLC monitors the following 14 relay interlocks and four proximity sensors. By replacing the switch machine, linking system, and 30 relays with the PLC-based system, P&L eliminated four days of maintenance monthly.

GuardPLC uses redundant CPUs in a single PLC controller body. Each logic circuit within the controllermany mechanical components that are costly to replace.

‘Our new hardware cost 10% of what we would have paid to replace the switching machine, linking system, and other devices previously used on the bridge. But saving hardware cost was not one of our primary goals going into this,’ says Edwards. ‘Above all, we now have a more reliable, streamlined operation.’

Online Extra

SIL requirements, PLC programming at P&L Railway

Ignoring the popular adage “if it ain’t broke– don’t fix it,” railway companies are looking to replace aging controls with more reliable, intelligent technology. Why? “Because unlike traditional manufacturing processes, railroad accidents cause more than just downtime and loss of product,” explains Dwayne Edwards, general supervisor of signals and structures at Paducah & Louisville (P&L) Railway. “Derailments, combined with the hazardous contents and the sheer weight of freight cars, can quickly lead to casualties, evacuations and a very unforgiving public.”

Working on the railroad Railway companies taking the proactive approach to control technology literally have one eye on the tracks, and one eye on the transportation market. With more than 40% of U.S. freight moved by rail, the railroad industry’s market share currently surpasses all other single modes of transportation. The railroad’s lead on trucks, planes, and barges is attributed to providing customers with high-quality service at the lowest possible price. But while the more than 550 U.S. freight railways have primarily relied on elbow grease to maintain this position, P&L Railway is among companies augmenting hard work with new technology.

With 281 miles of main line used to transport more than 15 million tons of coal, chemicals and supplies annually, P&L is recognized as a premier regional railroad in the United States. Its tracks in western Kentucky are strategically located to provide customers access to the inland waterway system and five of the eight national or “Class I” railroads. P&L also is proud of an exceptional safety record, having received accolades from the E.H. Harriman Memorial Institute and other industry groups for its safety performance. That may be more significant given general lack of capital for ongoing improvements in the rail industry. In terms of profitability, the rail industry is said to average a 7% rate of return on net investment.

“Our approach rests on the fact that to have a safe operation, we need safety-oriented employees that use their heads….” Edwards says. “We empower our employees to always take the safe course of action, look for and recommend ways to ensure personal safety for themselves, fellow employees, and operational safety.” Momentum leaves no time for error; a loaded train traveling just at 35 mphrequires more than a mile to stop. And most trains travel faster than 35 miles an hour. Even a single short-circuit can lead to a barge colliding with a half-raised drawbridge or a train moving forward before all bridge interlocks are in place. Such nightmare scenarios led P&L to update its system.

Signals for safety Intersections and other high-traffic sections of a railroad are required by law to have signaling systems. Green, yellow and red signals on P&L’s Rockport drawbridge can alert trains to the presence of other trains or boats, broken rails and improperly functioning switches. Here’s an application example. A barge traveling down the Green River contacts the train dispatcher via radio and requests permission to pass. If there are no trains within the block (Beaver Dam, KY, to Central City, KY), the train dispatcher triggers a raise request, which the signal system recognizes and the train control signals display a red “stop” signal. After a preset time the bridge will begin to lift and when fully raised, a green “proceed” signal will be displayed for river traffic. The barge continues its course down the river and radios a message to the dispatcher after clearing the bridge. The train dispatcher will then request the bridge down, and the river traffic signal will display a red “stop” signal. When the bridge assumes the down position, a series of system checks begin. If all checks are verified complete and in the proper sequence, the train control signal will display a green “proceed” signal. Any interruption or out-of-order event results in an immediate red “stop” signal for all incoming traffic and a “trouble call” to a maintenance engineer.

A majority of time during these site visits is spent conducting tests mandated by the Federal Railroad Administration, conducting additional safety checks unique to P&L, and lubricating more than 60 mechanical pivot points on the bridge. When P&L looked closely at the drawbridge solution, there were numerous problems the company needed to address. First, the relays– being mechanical devices – required a significant amount of attention and, with moving parts, were prone to wear and tear. The pole lines used to carry the current for signal control dated back to the telegraph, indicating that structural integrity of the poles was questionable. Also, the signal provided by conventional dc track circuits didn’t carry well, which could easily result in a short circuit. Also, hardware used had no documented safety rating, possibly leaving P&L vulnerable in the event of an accident.

The PLC and related equipment is housed in an 8 x 10 ft concrete enclosure, to monitor the Rockport bridge’s interlocks, span locks, and rail lifts. Interlocks, such as those monitoring the span-lock or lift-rail surface position, were crucial to ensuring zero failure. The lift-rail surface position, for instance, ensured that the running surface of a rail was within a 3/8-inch margin, indicating that the bridge was in the accurate position after being lowered. On the bridge’s signaling system, an Allen-Bradley GuardPLC [from Rockwell Automation] monitors the following interlocks and proximity sensors:

East span lock (proximity sensor);

West span lock (proximity sensor);

East lift rail (proximity sensor);

West lift rail (proximity sensor);

Span-lock repeater relay;

Lift-rail repeater relay;

Bridge down check relay;

Lower bridge relay;

Raise bridge relay;

Raise bridge repeater relay;

Bridge raise-lower request relay;

Bridge up relay;

Bridge down relay;

One block indication repeater relay;

Sixteen block indication repeater relay;

North bridge track relay;

South bridge track relay; and

System down relay.

Programming sequence In addition to maintaining a continuous safe state of operation, the GuardPLC1200 provides a scalable safety-control system that is easily programmed with RSLogix Guard programming and configuration software. Glen Tyson, an Allen-Bradley distributor working for Englewood Electrical Supply, helped create the control sequence for P&L. As a PLC specialist, he was able to quickly create the program, taking advantage of the built-in and user-defined function blocks within RSLogix Guard software package.

PLC programming sequence for raising the bridge

Inputs 8 and 12 low; Outputs 1 and 2 high

Inputs 7 and 10 low; Outputs 1 and 2 high

Inputs 1, 2, 5 and 9 low; Output 1 low and 2 high

Inputs 3, 4 and 6 low; Outputs 1 and 2 low

Tyson also designed an input simulator to test the accuracy of the GuardPLC sequence before it was installed. “This was critical because any downtime after the GuardPLC went online would cause extensive delays for trains and boats,” said Jim Kelley, president, Interrail Signal. “The simulation gave us the assurance we needed that the controller would perform as expected.”

Safety caboose: In addition to the safety PLC, the railroad replaced the conventional dc track circuits and aerial cable with coded electronic track circuits that send pulses in different code rates along the rail. Each code rate represents a unique signal “color” or message to the receiving unit. The coded electronic track provides state-of-the-art signaling capabilities, reducing the risk of having relays short-circuit. And non-ferrous proximity sensors, which are capable of differentiating between steel tracks and their stainless-steel targets, are used to indicate the position of the bridge’s span locks and lift rails. This ensures that locks and rails are in their proper position.

Safety integrity level (SIL) The single most important feature of the PLC is its fail-safe components. Since the highest safety integrity level (SIL) that can be claimed for the entire signaling system is limited by the fault tolerance of its subsystems, certification of every component is critical. IEC 61508 provides four safety integrity levels. Highest level (SIL 4) is applied to equipment traditionally used on aircraft and in nuclear power plants.

GuardPLC1200 is certified at SIL 3, which is the safety apex for the railroad industry. IEC 61508 dictates that SILs are determined by two operating modes: average probability of the equipment to fail its assigned function on demand (“Low demand…” table), and probability of dangerous failure per hour of operation in high-demand or continuous mode of operation (“High demand” table).

Safety Integrity Level (SIL)
Low Demand Mode of Operation(Average probability of failure to perform its design function on demand)

4
≥10–5to &10–4

3
≥10–4to &10–3

2
≥10–3to &10–2

1
≥10–2to &10–1

Safety Integrity Level (SIL)
High Demand or Continuous Mode of Operation(Probability of dangerous failure per hour)

4
≥10–9to &10–8

3
≥10–8to &10–7

2
≥10–7to &10–6

1
≥10–6to &10–5

For more information For more from P&L Railway or Rockwell Automation, click into the links below.

Paducah & Louisville (P&L) Railway (including a rail fan area with photos) Allen-Bradley GuardPLC system from Rockwell Automation

Also check out the Control Engineering Buyer’s Guide online at and search “safety PLC” at / .