Field of the invention

The present invention relates to devices, systems and methods for improving safety within a train depot. In particular, the present invention relates to a depot safety system that protects workers from movement of trains within the depot.

Background to the invention

Train maintenance depots are important facilities for the safe and efficient operation of rail transport. They typically have several rail roads in which trains can be berthed for repairs or maintenance operations such as effluent tank draining, or refuelling. Different roads can be used simultaneously, and the movement of trains into and out from each road must be carefully managed to minimise the risk of worker injury. It is similarly important to manage the whereabouts of every worker.

Responsibility for safety on a particular road normally falls to a designated road operator. Before moving a train into an unoccupied road, the road operator must ensure that the road is clear of workers. The road operator typically activates visual and audio alerts to notify those near to the road that it should be kept clear for incoming and outgoing trains and provides sufficient time to allow workers that may be on the road to move clear. The road operator can then issue a signal to a train driver that the road is prepared for the train to move into it. Once the train has stopped and is berthed in place on the road, the road operator permits workers to move into the road to conduct their operations. When these operations have been concluded, the road operator must again ensure that the road is clear for the train to move out of the road.

Various methods and components are used by the road operator and workers to ensure safety. Notably, worker access to various locations in and around the road is controlled using worker keys which interact with a road control module. Typically, removal of the keys from a road control module locks out certain functions, such as the ability to move a train, until all workers have returned their keys, and so are clear of the road. In alternatives, access control cards may be used instead of keys.

This presents various problems to the safe and efficient operation of the train maintenance depot. Keys may be forgotten or lost by workers, delaying road operations, and introducing the cost of replacements. Additionally, workers may share keys, introducing ambiguity as to whether all workers are clear of a road. It is against this background that the present invention has been conceived.

Summary of the invention

According to a first aspect of the present invention there is provided a safety system for a train depot. The safety system comprises at least one of an operator unit, a worker management module, and a list handler. The operator unit may comprise a biometric reader and/or a user interface (Ul). Preferably, the operator unit is associated with a respective predetermined rail road of the train depot. Preferably, the operator unit is configured for communication with at least one movement control device for controlling movement of trains along the associated rail road.

The worker management module may comprise an authorised worker database. The list handler may be configured to maintain a list of workers registered to work on the rail road.

Preferably, the system comprises a safe setting in which workers can safely occupy the rail road. In the safe setting, the operator unit may transmit instructions to the at least one movement control device to place it into a protecting configuration in which it protects against train movement along the railroad.

Preferably, the system comprises an unsafe setting in which workers must stay clear of the rail road. In the unsafe setting, the operator unit may transmit instructions to the at least one movement control device to place it into an unprotecting configuration in which it permits train movement along the railroad.

The operator unit may be configured to receive a log in command, via the Ul, for a logging-in worker to be registered to work on the rail road associated with the operator unit. In response, the operator unit may enable the biometric reader to obtain biometric data from the logging-in worker. The operator unit may be configured to transmit a log in request to the worker management module. The log in request may include the obtained biometric data. The operator unit may be configured to issue a log in confirmation to the worker via the Ul. The log in confirmation may be issued on receipt of an affirmative log in response from the worker management module indicating that the worker is authorised and registered to work on the rail road.

The worker management module may be configured to receive the log-in request from the operator unit. The worker management module may be configured to perform a biometric recognition routine using the biometric data included with the log-in request. The biometric recognition routine may determine whether the logging-in worker is identified in the authorised worker database as being authorised to work on the rail road associated with the operator unit. If so, the worker management module may be configured to send an affirmative log in response to the operator unit and/or communicate with the list handler to update the list of workers to register the logging-in worker as working on the rail road.

Preferably, the system is prevented from switching away from the safe setting unless all workers in the list of workers are deregistered from working on the rail road.

Preferably, the operator unit is configured to receive a log out command, via the Ul, for a logging-out worker to be deregistered from working on the rail road associated with the operator unit.

Preferably, and in response to the log out command, the operator unit is configured to enable the biometric reader to obtain biometric data from the logging-out worker. Preferably, the operator unit is configured to transmit a log out request to the worker management module, the log out request including the biometric data of the logging-out worker. Preferably, the operator unit is configured to issue a log out confirmation to the worker via the Ul on receipt of an affirmative log out response from the worker management module indicating that the worker is deregistered from working on the rail road associated with the operator unit.

Preferably, the worker management module is configured to receive the log-out request from the operator unit, and using the biometric data included with the log-out request, perform a biometric recognition routine that determines whether the logging-out worker was previously registered to work on the rail road associated with the operator unit. If so: the worker management module may be configured to send an affirmative log out response to the operator unit, and communicate with the list handler to update the list of workers to deregister the logging-out worker from working on the rail road.

The operator unit may be configured to: communicate with the list handler to determine whether all workers in the list of workers are deregistered from working on the rail road associated with the operator unit, and if so enable switching of the at least one movement control device into a unprotecting configuration.

Preferably, the biometric reader of the operator unit comprises a camera. Accordingly, the operator unit may be configured to receive the log in or log out command, and in response enable the camera to capture an image of the logging-in or logging-out worker. The biometric data may comprise facial data derived from the captured image of the logging-in or logging-out worker. The biometric recognition routine may comprise a facial recognition routine. An encryption function may be applied to the image of the logging-in or logging-out worker to generate the derived facial data. The encryption function may be a one-way function, preventing the ability to obtain the image of the logging-in or logging-out worker from the derived facial data. The facial recognition routine may comprise comparing the facial data of a logging-in or logging-out worker with facial data stored within the authorised worker database.

Preferably, the operator unit is configured to conduct a manager log in, the manager log in enabling worker management functions on the operator unit. Worker management functions may include a worker addition function in which the operator unit is configured to receive a worker addition command, via the III, for a new worker to be added as an authorised worker for the rail road. In response, the biometric reader may be enabled to obtain biometric data from the new worker. A new worker addition request may be transmitted to the worker management module, the new worker addition request including the obtained biometric data of the new worker. A worker addition confirmation may be issued via the Ul on receipt of an affirmative worker addition response from the worker management module indicating that the new worker has been added to the authorised worker database.

The system may comprise a remote management unit. The remote management unit may be configured to interface with at least one of the operator unit, the worker management module, and the list handler to: add or remove workers from the authorised worker database; and/or register or deregister workers from the list of workers working on a predetermined rail road.

The least one movement control device for controlling movement of trains along the associated rail road may comprises signals, for signalling to a train operator.

The system may comprise a warning setting in which at least one warning device is activated to notify workers that the system will be switching from a safe setting to an unsafe setting, so that any worker occupying the rail road must clear the rail road.

The at least one movement control device for controlling movement of trains along the associated rail road may comprise an electromechanical derailer. The derailer may be configured to receive instructions from the operator unit to enter into a protecting configuration, and in response shift into a position on the rail road that would derail a passing train. The derailer may be configured to receive instructions from the operator unit to enter into an unprotecting configuration, and in response shift into a position that allows a train to traverse the rail road. Preferably, the derailer comprises a position sensor to monitor its position relative to the rail road, the derailer being configured to report its position to the operator unit, thereby providing feedback about whether the derailer is in the protecting or the unprotecting configuration.

Preferably, the derailer comprises a train presence sensor for detecting the presence of a train passing the derailer when in the unprotecting configuration, the derailer delaying switching to the protecting configuration until the train has been detected by the train presence sensor to have finished passing the derailer.

The system may comprise a depot, or component parts thereof. For example, the system may comprise one or more: rail roads, train presence sensors, train movement sensors, rail switches, walkways, signals and the like.

According to a second aspect of the present invention, there is provided a method of improving the safety of a train depot. Preferably, the method comprises receiving a log in command for a logging-in worker to be registered to work on a rail road. In response, a biometric reader may be enabled to obtain biometric data from the logging-in worker. The method may comprise performing a biometric recognition routine that determines whether the logging-in worker is authorised to work on the rail road, and if so updating a list of workers to register the logging-in worker as working on the rail road. The method may comprise preventing switching away from a safe setting unless all workers in the list of workers are deregistered from working on the rail road, the safe setting placing at least one movement control device into a protecting configuration in which it protects against train movement along the railroad.

Preferably, the method is a computer-implemented method.

It will be understood that features recited herein to be preferable are not necessarily essential to one or more aspects of the present invention. Additionally, features and advantages of different aspects of the present invention may be combined or substituted with one another where context allows.

For example, the features of the depot safety system described in relation to the first aspect of the present invention may be provided as part of method of the second aspect of the present invention. For example, the method may comprise functions performed by components of the system, such those performed by movement control devices, operator units, worker management modules, list handlers, and others as described herein. Furthermore, such features may themselves constitute further aspects of the present invention. For example, the features of the operator unit, worker management module, list handler and other features themselves constitute further aspects of the present invention.

Brief description of the drawings

In order for the invention to be more readily understood, embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings in which:

Figure 1 is a schematic overhead view of a train maintenance depot 100 that includes various components of the depot safety system 1 according to an embodiment of the present invention; and

Figure 2 is a schematic block diagram of a depot safety system 1, as deployed within the depot 100 of Figure 1.

Specific description of the preferred embodiments

Figure 1 is a schematic overhead view of a train maintenance depot 100. The depot 100 includes various components of the depot safety system 1 of an embodiment of the present invention as will be described.

The depot 100 comprises a first rail road 10, and a second rail road 20. A train can be berthed at each road 10, 20 to have maintenance performed on it using maintenance facilities 4, such as a fuel dispenser 4a and an effluent tank extraction system 4b. This requires workers to traverse the rail roads 10, 20 to engage such facilities with the berthed trains.

The depot also comprises a third rail road 30, and a rail switch 33 which can be operated to connect the third rail road 30 with one of the first and second rail roads 10, 20 as defined by the position of the rail switch 33. In the context of the present invention, the third rail road 30 functionally becomes part of the first or second rail road when so connected.

Figure 1 schematically shows the first rail road 10 without a train, and the second rail road 20 with a berthed train 2. An inbound train 3 on the third rail road 30 can be safely directed to the first rail road 10 as will be described further below.

A first walkway 13 is positioned adjacent to the first rail road 10, and a second walkway 23 is positioned adjacent to the second rail road 20. The walkways 13, 23 define safe regions of the depot 100 that workers can retreat to before and during train movements on the rail roads 10, 20. A raised gantry 15 is provided as an extension of the first walkway 13 access to which is restricted via a gantry access door 16.

For simplicity in explaining embodiment of the invention, only these three rail roads, and their associated components are shown in Figure 1. However, it will be understood the depot 100 normally has many more rail roads, rail switches, and other parts such as dead end cripple lanes, berthings, provisioning buildings, storage, train washing facilities, and the like.

Figure 2 is a schematic block diagram of a depot safety system 1 , as deployed within the depot 100 of Figure 1.

The depot safety system 1 comprises a first operator unit 14 associated with the first rail road 10 and a second operator unit 24 associated with the second rail road 20.

The first operator unit 14 comprises a display unit 41, a camera 42, a housing 43 and supports 44. The display unit 41 comprises a resistive touch screen that forms at least part of a user interface (Ul) configured to receive inputs and commands from an operator. In alternative embodiments, a different user interface may be provided.

The Ul also provides feedback to the operator information about the operation and status of the system 1 , for example via graphical elements shown on the screen. The housing 43 surround and protects the display unit 41 from harsh working environments, and the supports 44 secure the operator unit 14 to an appropriate fixed location within the first walkway 13 that provides a relatively clear view of the first rail road 10, and the third rail road 30 that feeds into it.

In the interests of simplicity, only the first operator unit 14 is shown with structural features in Figure 2. However, the second operator unit 24, shown as a block in Figure 2, has the same structural features as described in relation to the first operator unit 14, and is functionally equivalent to it. It is located on the second walkway 23 at a location that provides a relatively clear view of the second rail road 20, and the third rail road 30 that feeds into it. Thus an operator of either the first or second operator unit can perform a relatively reliable visual inspection of the relevant rail roads before initiating train movements thereon.

The operator units 14, 24, are communicative connected via a network 8 to a server 5, and a set of movement control devices 9. For enhanced reliability, the network connection is hardwired in the present embodiment of the invention. However, in alternatives, wireless communications between these components may be used. The server 5 comprises a worker management module 6, an authorised worker database 6a, a list handler 7, a first work list 7a associated with the first road, and a second worker list 7b associated with the second road.

For increased reliability, the server 5 is a local server, connected via a local area network connection to the operator units 14, 24. However, in alternative embodiments, the server 5 may be implemented as a cloud server accessible via an internet connection. In further alternatives, the server 5, at least in part, may be implemented on one of the operator units 14, 24. Notably, the worker management module 6, the authorised worker database 6a, and the list handler 7, at least in part, may be provided on the operator units 14, 24. Moreover, in alternative embodiments, each operator unit 14, 24 may locally manage its own worker list, for example, with the first worker list 7a being managed by the first operator unit 14, and the second worker list 7b being managed by the second operator unit 24.

The movement control devices 9 include: a first set of signals 11a, 11b, 11c, 11d, and a first speaker 12, associated with the first rail road 10; a second set of signals 21a, 21 b, 21c, 21d, and a second speaker 22, associated with the second rail road 20; and a third set of signals 31a, 31b, and a derailer 32 associated with the third rail road 30.

Referring back to Figure 1 , each movement control device 9 is generally located on or adjacent to the rail road with which it is associated. The first operator unit 14 is configured for communication with the first set of signals 11a, 11b, 11c, 11d, the first speaker 12, the rail switch 33, the derailer 32 and the third set of signals 31a, 31b. The second operator unit 24 is configured for communication with the second set of signals 21a, 21b, 21c, 21d, the second speaker 22, the rail switch 33, the derailer 32 and the third set of signals 31a, 31b.

Specifically, the operator units 14, 24 can be controlled by an operator to transmit instructions to the relevant movement control devices 9 to switch them between a protecting configuration in which they protect against train movement, and an unprotecting configuration in which they permit train movement along an associated rail road 10, 20, 30. When the movement control devices 9 are in a protecting configuration, the system effectively is in a safe setting in which workers can safely occupy the associated rail road, whereas when the movement control devices 9 are in an unprotecting configuration, the system is in an unsafe setting in which workers must stay clear of the relevant rail road.

Prior to, or during switching of at least one of the movement control devices 9 to the unprotecting configuration, the system further has a warning setting in which at least one warning device is activated to notify workers that the system will be switching from a safe setting to an unsafe setting, so that any worker occupying the rail road must clear the rail road.

For example, the first operator unit 14 can receive an operator input, via the Ul, to start the process of allowing movement of the inbound train 3 onto the first rail road 10. Initially, the operator unit 14 communicates with the rail switch 33 to join the third rail road 30 to the first rail road 10. Subsequently, a safety check is performed in that the first operator unit 14 communicates with the server 5 to determine if any workers are registered to be working on the first rail road 10. Specifically, the list handler 7 queries the worker list 7a associated with the first rail road 10. If all workers on the list are deregistered from working on the first rail road 10, the server 5 permits the first operator unit 14 to switch the movement control devices 9 from a protecting configuration to an unprotecting configuration.

The switch does not necessarily occur immediately, but rather in stages with a sufficient delay to allow the movement control device 9 to complete their operations in order, and to notify workers in the vicinity of the first and third rail roads 10, 30 of the imminent movement of the inbound train 3. Naturally, a train operator is also provided with notice of the need to initiate a train movement.

In particular, in an initial stage of switching movement control devices 9 to the unprotecting configuration, the operator unit 14 transmits instructions to the first speaker 12 to active it as a warning device. In doing so, the first speaker 12 issues an audible warning to workers on the first rail road 10 that a train will soon be moving across the first rail road 10.

During the initial stage of switching movement control devices 9 to the unprotecting configuration, the operator unit 14 also transmits instructions to the derailer 32 so the derailer shifts into a position relative to the third rail road 30 such that it allows the inbound train 3 to traverse the derailer 32 unimpeded during movement from the third rail road 30 to the first rail road 10.

In the protecting configuration, the derailer 32 would derail the inbound train 3. As switching to the unprotecting configuration is not necessarily instantaneous, a delay is allocated to allow the derailer 32 to complete its movement. Moreover, in the present embodiment, the derailer 32 comprises a position sensor that monitors the position of the derailer 32 relative to the third rail road 30. This is reported to operator units 14, 24 thereby providing them with feedback about whether the derailer 32 is correctly in the protecting or unprotecting configuration. This ensures that a fault with the derailer 32, for example causing it to become stuck in or between positions, is detectable by operator units 14, 24. This allows appropriate remedial action to be taken, such as aborting later stages of switching movement control devices 9 to the unprotecting configuration, preventing a train movement, and issuing a notification signalling the fault of the derailer 32.

Additionally, the derailer 32 comprises a train presence sensor for detecting the presence of a train passing the derailer 32 when in the unprotecting configuration. This allows the derailer 32 itself to prevent accidental derailment of a train in the case that a train has not fully passed the derailer 32. This may occur if an operator unit 14, 24 issues an early signal to switch the derailer 32 to the protecting configuration before the train has fully passed it. The train presence sensor of the derailer ensures that the derailer 32 can delay switching to the protecting configuration until the train has been detected by the train presence sensor to have completely finished passing the derailer 32.

After a suitable delay has been allowed for workers to be warned to clear the first rail road 10, and the derailer 32 is detected to be successfully in the unprotecting configuration, the first operator unit 14 switches the third set signals 31a, 31b of the third rail road 10, 30 to an unprotecting configuration. Additionally, a pair of the first set of signals 11c, 11d of the first rail road 10 that are proximal to the third rail road are also switched to the unprotecting configuration. Specifically, the colour of light, and configuration of these signals indicate to a train operator that the train should be moved from the third rail road 30 to the first rail road 10. Another pair of the first set of signals 11c, 11 d of the first rail road 10 that are distal from the third rail road may remain in the protecting configuration, indicating to a train operator that the train should not move along the first rail road 10 beyond that other pair of signals 11c, 11d.

When the inbound train 3 has moved to the first rail road 10, and has stopped completely, the system may be switched back from the unsafe setting to the safe setting, whereby workers can approach the first rail road 10 to carry out maintenance on the previously inbound train 3 now berthed at the first rail road 10.

To verify that the train 3 is at the correct location, and has completely stopped, the system 1 may comprise train position and/or movement sensors - for example, integrated with or extensions of the movement control devices 9. This ensures that workers are notified to keep off the rail road 10, for example via maintaining audible warnings via speaker 12, 22 of the relevant rail road 10, 20.

Assuming the system is in a safe configuration for a particular rail road 10, 20, workers can approach the associated operator unit 14, 24 to log in as working on the relevant rail road 10, 20. In the case of workers logging in to work on the first rail road 10, the first operator unit 14 is configured to receive a log in command via the Ul shown on the display unit 41. The Ul presents a user-interactable virtual log-in button which, when activated by a worker via the touchscreen, enables the camera to serve as a biometric reader of the logging-in worker. Moreover, the camera is enabled to capture an image of the logging-in worker, the image being processed by the operator unit 14 to derive from it biometric data in the form of facial data. Once the image is capture, the camera is deactivated.

The operator unit 14 then transmits a log in request to the server 5, the log in request including the biometric facial data. Implicitly, the log in request also specifies that it is the first rail road 10 that is the subject of the log in request.

The log in request is processed by the worker management module 6 of the server 5 to determine whether the logging-in user is authorised to work on the first rail road 10. Using the biometric facial data included with the log-in request, the worker management module performs a facial recognition routine that determines who the worker is.

In the present embodiment, the facial recognition routine is performed within the server, with the facial data included with the log-in request being compared with facial data stored within the authorised worker database to determine a match. However, in alternatives, the worker management module 6 may utilise a third-party facial recognition service to determine the match.

In any case, the worker management module 6 queries the authorised worker database 6a to determine whether the logging-in worker is authorised to work on the first rail road 10. Assuming the logging-in worker is authorised, the worker management module 6 sends an affirmative log in response to the operator unit 14. Additionally, the worker management module 6 communicates with the list handler 7 to update the worker list 7a associated with the first road 10 to register the logging-in worker as working on the first rail road 10.

The first operator unit 14 receives the affirmative log in response from the worker management module 6 indicating that the worker is authorised and registered to work on the rail road, and in response issues a log in confirmation to the worker via the Ul of the first operator unit 14.

Additionally, upon receiving the affirmative log in response, the operator unit 14 may also grant access to regions of the depot 100. For example, access to the raised gantry 15 may be granted to authorised workers via the deactivation of an electromechanical lock employed on the gantry access door 16. A similar process occurs when workers activate a log in command at the second operator unit 24 associated with the second rail road 20. Again, the authorised worker database 6a is checked to determine that the worker is authorised to work on the second rail road 20, and if so, an affirmative log in response is sent to the second operator unit 24 allowing the worker to receive confirmation via the Ul of the second operator unit 24. In this case, the list handler 7 updates the work list 7b associated with the second road 20 to register the logging-in worker as working on the second rail road 20.

Advantageously, this arrangement ensures that only workers that are authorised to work on a particular rail road 10, 20 and/or access a particular region of the depot 100, are permitted to do so. Moreover, workers cannot share nor unintentionally lose access rights, because the use of biometric authentication obviates the need for access keys or cards. Additionally, the use of biometrics ensures that that workers cannot be accidentally logged out of working on a particular rail road, which would otherwise expose them to danger.

To illustrate this, and by way of an extension to the above example, the first operator unit 14 is also configured to receive a log out command, via the Ul, for a logging-out worker to be deregistered from working on the rail road associated with the first operator unit 14. The camera is enabled as before, and facial data is obtained from the image of the logging-out worker. The operator unit 14 then transmits a log out request to the worker management module 6, the log out request including the biometric facial data of the logging-outworker.

The worker management module 6 is configured to receive the log-out request from the first operator unit, and using the biometric facial data included with the log-out request, perform a facial recognition routine that determines whether the logging-out worker was previously registered to work on the first rail road 10. Assuming so, an affirmative log out response is sent to the first operator unit 14, and the worker management module communicates with the list handler 7 to update the worker list 7a associated with the first road 10 to deregister the logging-out worker from working on the rail road. The operator unit 14 issues a log out confirmation to the worker via the Ul on receipt of the affirmative log out response from the worker management module. Thus, the Ul indicates to the logging-out worker that the worker is deregistered from working on the rail road associated with the first operator unit 14.

To preserve worker privacy and data integrity, an encryption function is applied to the captured image of the worker, the encryption function being a one-way function. The oneway function ensures that facial data cannot be reverse engineered to obtain the source image of the worker. However, the facial data retains sufficient correspondence with the source image to allow unambiguous matching of the facial data derived from image captured by the operator units 14, 24, with that stored in the authorised worker database 6a, even if different source images are used. One way this can be implemented is via a signature generator which converts captured image into a set of vectors, for example represented by a hexadecimal string. A high level of correspondence between the set of vectors correlate with a high level of correspondence between the faces in the source images.

As described, the operator units 14, 24 are configured for log in and log out of workers to work on an associated rail road 10, 20, and also when all workers are deregistered from working on a particular rail road 10, 20, the operator units 14, 24 allow instructions to be transmitted to warning 12, 22 and movement control devices 9. The operator units 14, 24 are further configured to provide additional functions via which worker authorisations and registrations are managed. Specifically, the operator units 14, 24 are configured to conduct a manager log in, the manager log in enabling worker management functions on the operator unit, including a worker addition function.

The worker addition function configures a given operator unit 14, 24 to receive a worker addition command, via the Ul, that indicates that a new worker is to be added as an authorised worker for a rail road 10, 20 associated with the respective operator unit 14, 24. In response to the worker addition command, the operator unit 14, 24 enables the camera 42 to obtain biometric facial data from the new worker. Additional worker details, such as the name and authorisation level of the new worker is also obtained via suitable prompts issued by the Ul. The operator unit 14, 24 is then configured to transmit a new worker addition request to the worker management module, the new worker addition request including the obtained biometric facial data of the new worker, and the additional worker details. The operator unit 14, 24 is then configured to issue a worker addition confirmation via the Ul on receipt of an affirmative worker addition response from the worker management module 6 indicating that the new worker has been added to the authorised worker database.

This allows new workers to be added to the authorised worker database 6a directly from the operator units 14, 24, effectively from the depot floor itself. However, it can be desirable to set up authorised workers in advance and/or remote from the depot 100, as well as perform other management functions. To this end, the system comprises a remote management unit 50. The remote management unit is configured to interface with the operator units 14, 24, the worker management module 6, and/or the list handler 7, depending on the management function to be performed. In particular, the remote management unit interfaces with these components to add or remove workers from the authorised worker database and/or register or deregister workers from the list of workers working on a predetermined rail road 10, 20. In certain embodiments, the remote management unit 50 may be part of the server 5. Further alternative will be apparent to those skilled in the art. Thus, it is intended to embrace all such alternatives, modifications and variations that fall within the scope of the appended claims.