Thanks TVP45 for your thoughtful good answer

Based on your answer you seem to be very knowledgeable on rail transportation. My background is aerospace and marine systems.

"A train system is a complicated one and you'd have to monitor a lot of items to know the system health. For example, one of the things that will screw up an ATC is leakage across the rails from dirt and low pH rain; how do you monitor that?"

I agree that trains are complicated but also helicopters which have been investigating HUMS since 1997, autonomous vehicles since 2002, and Space Shuttle after the ill-fated STS-107 Columbia mission.

To me diagnostic systems for detecting and logging faults is ok for non-critical systems; however, on automated systems used in place of a human operator on a vehicle having many passengers, it is my opinion that a system health monitoring is warranted based on the number of lives involved.

"What sort of HUMS were you thinking of putting on Metro?"

You are probably more qualified to answer your question than me. But what I would envision would be an onboard system for monitoring the vehicle self-health and an external system for monitoring the rails to the extent possible with the current technological state of art. All key components and subsystems of the automated system that its failure has the capability of putting passenger's safety in jeopardy should be monitor for degradation based on the most likely mode(s) of failure.

The benefit of HUMS besides increased safety is more efficient maintenance, increased vehicle lifetime, and reduced cost over the life of the vehicle.

I've thought about this a bit more, and I think you might put something like that on board a railcar. You could check (probably) rail shunting, wayside pickups, wheel roundness, bearing temperature, and brake condition. Some of that is already done, but I don't know if it's done in any coordinated manner. I haven't done any railway work since the late 80's, and quite a bit has changed.

From preliminary reports, none of that would have made any difference in the WMATA accident since early indications point to a faulty track circuit. But, I also though that you might overlay a GPS based safety system and use something like your HUMS program to monitor line health. That would give the control room guys a heads up if headways were decreasing too much against weather and so on.

I've been asked a similar question in my factory. A suggestion came up to put rpm sensors, current sensors and voltage sensors on all motors, position sensors on all valves, vibration sensors on all equipment, etc. Such a move is going to be very expensive. Curiously, not many people knew that analyzing process readings can be just as good as additional sensors. It just needs training.

The case of Air France 447 is probably a bit different. You're in a plane where you need to monitor hundreds of readings and have to interpret them quickly. You don't have much time to make a long, careful analysis.

The pitot tube is supposed to have a de-icing system to prevent the tube from clogging. Apparantly, it wasn't working. You can put sensors to detect if it's working or not. However, these sensors can also fail and give false readings.

In my opinion, the removal of the third man in the cockpit (the flight engineer) was a wrong move. He could do the analysis work since both pilots will be busy flying the plane. They took him out on the premise that automation has made his role redundant.

regards,

Vulcan

The pitot tubes on 447 were defective and still flying. This, and no flight engineer, are decisions driven by the bean counters, not pilots!

I agree. Removing the flight engineer from the cockpit was a mistake. It was his responsibility to supervise the systems and make critical decisions regarding same. During an in-flight emergency, the pilot and copilot are preoccupied with maintaining level flight. It was the responsibility of the FE to accurately diagnose the problem with a particular system and provide a remedy in a timely manner. It's a shame that airline safety as been circumvented by the illusion that a flight engineer was no longer required.

I posted this comment. apparently, I was not logged-in.

I agree with comments 2 through 6 about the elimination of the flight engineer has put passenger safety at a higher risk level. However, it is my opinion that the crux of the problem is that Governments are more concerned about business survivability then passenger safety and only react after a catastrophe.

From my perspective as a controls engineer, whenever the process directly affects user safety it would be negligent to not have sensor and control redundancy. Redundancy is very common in the chemical industry when things quickly explode if not controlled properly.

When you have system redundancy both systems must exactly match, otherwise will go into emergency mode. What happens in emergency mode is up to the process manager and does not necessarily have to shut the system down. At a minimum it can alarm the system managers to focus operator attention on a problem area. This can be monitored by onboard operators or remotely via telemetry. All of this is existing off-the-shelf technology.

There is an old rule, that if you want to find the root of problems (and crime), then follow the money trail. I wonder if this complex problem results from financial issues? After a very long safety record, why would something catastrophic like this happen? It suggests to me that the system works fine, if properly maintained, and adequately operated with a full complement of staff. I bet some yes-man manager somewhere has been cutting corners with service and staff....

Chris

How about not using automatic systems for critical transportation? All automatic systems should be made "fail safe" or not used at all.

Well, there's the big question of whether computer programs can really be fail-safe. I don't think we can go back to the older methods.

Redundancy should be a requirement on any system that your life depends on it. With the DC Metro accident, having GPS with a interrogating transponder may have prevented this accident. If the automated system that failed on that train is so critical to the safe operation, then that system should had been designed to fail in a safe "limp mode" so as to be able to move the train to the maintenance shop. As far as Air France 447, the auto pilot preformed as it should have, disengaging when one of the flight parameters are exceeded. The Pitot tubes icing up could have caused the A/P to disengage, but the Pilots should have seen a split in their air speed indicators (which is the #1 indication of Pitot problems). The auto pilot won't forewarn when it going to disengage, you just have your hands full when it does. If the Pitot tubes did ice up there's nothing that the Capt., F/O, or a F/E can do, other than get out of the icing conditions by flying by seat of their pants. But there again the Pilots should not have put themselves in a situation where they stacked so many small problems against themselves. It's unfortunate that it happened.