Technology International Incorporated 0f Virginia
Department of Transportation-RITA

U.S. Department of Transportation (DOT)

John A. Volpe National Transportation Systems Center; Research and Innovative Technology Administration (RITA)

A RELIABLE LOCOMOTIVE CAB ALERTER        

Topic: 1992 DOT-FR 1 ADVANCED LOCOMOTIVE CAB ALERTER (Dec 1992-May 1993)

Contract # DTRS-57-92-C-0100 Research and Special Programs Administration, Federal Railroad Administration, Department of Transportation (DOT); John A. Volpe National Transportation System Center, 55 Broadway, Kendall Square, Cambridge, MA

Issuing Activity Contracting Officer Technical Representative (COTR): Mr. Garold Thomas

PI: Dr. Zeinab A. Sabri

Project Team: David C. Greig, Heba A. Sabri, Dr. S. Keith Adams; Mr. John L. DiFulco, Certified Locomotive Engineer with Illinois Central Gulf Railroad; Shane P. Babin

Publications

Zeinab A. Sabri; David C. Greig, Heba A. Sabri and S. Keith Adams (May 1993). A Reliable Locomotive Cab Alerter. Technology International Incorporated of Virginia (TII-VA) LaPlace, LA; Report DOT/FRA/CT-93-3; Contract # DTRS-57-92-C-0100, for Department of Transportation, Federal Railroad Administration, Research and Special Programs Administration, John A. Volpe National Transportation System Center, 55 Broadway, Kendall Square, Cambridge, MA.

Patents

Sabri, Heba A.; Abdallah. Omar M.; Sabri, Zeinab A.; Husseiny, Abdo A. and Sabri, Aziz A. (2009). Locomotive Engineer Cab Alert Apparatus. US Patent pending.

Summary

To meet the needs of the Federal Railroad Administration (FRA) safety program for an innovative advance in the design of an alerter system to be used in locomotive cabs, Technology International Incorporated (TII) developed and evaluated several concepts for an advanced, reliable locomotive cab alerter (CabAlerter), including:

(1).                              A DigiAlerter based on a low-cost data entry device similar to a touchtone telephone keypad and to other handheld devices used for remote data entry. In its general form, the device is simply comprised of a keypad with a Liquid Crystal Display (LCD) window located on the top of a set of buttons or touchpad membrane. Each key is assigned a number or letter. A randomly programmed code formed of a string of characters to be entered is flashed on the LCD. Each number/letter or the whole code will flash for a short time and then disappear before the next number/letter is displayed. In the final model, the entire code will be displayed for a predetermined amount of time. By touching keys and entering a sequence of numbers or letters, a timer can be reset before the end of a selected time interval. The alphanumeric code will change each time the reset is required. Mental alertness is necessary to read the displayed code and simultaneously enter the code on the DigiAlerter pad. The random change of the code does not allow the engineer to systematically enter the code from memory without cognitive action.

(2).             A KeyAlerter similar to devices suggested to prevent drunk drivers from starting the ignition of the car before being sober enough to drive, wherein the user resets a timer by turning a key after alignment with a beam of light. The KeyAlerter is the simplest of all concepts considered here.

(3).             A MovAlerter design that involves touching a moving target (such as a bull's eye) on a touchscreen. The target moves in straight lines and bounces off the screen boundaries. The size and speed of the motion of the target can be adjusted within predetermined bounds. The engineer has to touch the touchscreen at the location of a moving target to affect a reset of the timer. The timer will only be reset by hitting the target on the touchscreen. Failure to hit the target the first time sets a localized alarm on the MovAlerter which is reset by subsequent success. Failure in the second round sets the actual alarm, which can only be reset by success of a third attempt. Success is awarded by an audible sound and a display on the screen. Failure is followed by a buzzer and actuation of alarms and eventual stopping of the train. The MovAlerter requires mental alertness to locate and touch the target on the MovAlerter screen. The target will appear at a random point on the screen and will require coordination and cognition to follow its path and score a hit.

(4).                  A dynamic PC-based DynAlerter similar to system simulators, which engage the operator in retraining as a secondary task whenever no primary tasks are required. This assures continuous alertness of the engineer at all times. The DynAlerter is viable provided that the engineer would not be overloaded to the extent of overlooking his/her task. The device has to be mounted in such a way that all annunciators will be in the Line-of-Sight (LOS) and road following functions can be performed. The central thrust of the DynAlerter lies in the collection and organization of valid, realistic operation and test items from actual railroad operations, together with an assemblage of the necessary hardware and software to administer the retraining and testing. The tests have to be stimulating and interesting to assure alertness. A system similar to the DynAlerter is successfully used by Electricite' de France (EDF) for operators of power plants. The integration of the DynAlerter in alert systems can be accomplished by introducing the timer or light prompts on the screen of the computer.

Railroads have employed many devices to warn the locomotive engineer of impending danger. These include fuses, torpedoes, flags, lights, fires, the deadman switch, and radio communication (where available). The key issue of all devices is to maintain the level of conscious alertness of the engineer. Modern alerter systems produce a light signal prompt at regular intervals if an engineer's action does not otherwise reset a timer before the end of the selected time interval. The engineer's response involves touching, and in most cases operating a control (such as the throttle) on the operator's console or pressing the alerter reset switch. If the appropriate reset action is not taken in a specified period of time, an audible alarm will sound. The same actions that reset the light prompt will reset the audible alarm. If response is not made to the alarm within a specified period of time, the train brakes are automatically applied and the train is stopped. It is now believed that an experienced engineer can and may reset the alerter timer when the light prompt appears (before the audible alarm) while actually dozing or asleep and thereby defeat the purpose of the alerter system.

Information available on environmental work stress in the locomotive cab was analyzed. An interview was held with an engineer from the Illinois Central Railroad with over 30 years of experience in the Baton Rouge district. He confirmed observations made earlier and offered additional insights based on personal experience, including:

(1)               The deadman switch, which has been used on some locomotives, is impractical from the standpoint of postural fatigue and unreliable as an indicator of alertness.

(2)               Work hours are long.

(3)               Long and irregular hours of duty make it difficult to stay alert or even awake during monotonous periods, especially at night. Dozing off was a problem for a significant number of train crew personnel on some occasions.

(4)               Wheel noise is more harmful to hearing than engine and horn noise.

(5)               Climate control is lacking in the cab.

(6)               There is a need for an alertness monitoring and/or alerting system of some kind. All control of cab crew alertness should be confined to the cab. Outside signaling or intervention is unnecessary, unwarranted, and unacceptable.

Three basic strategies were examined for maintaining alertness in the locomotive cab:

(1)               Monitoring alertness by sampling and encouraging a self-alertness assurance strategy: This involves monitoring the alertness with two levels of testing and an alerting stimulus (alarm or cool air stream) to the engineer. This strategy is the one being pursued because it is the most practical, reliable, and acceptable approach.

(2)               Maintenance of alertness through the introduction of secondary, possibly artificial tasks:  While this strategy has theoretical merit based on laboratory research and application in other settings, it is not practical or acceptable to operators in this application.  It is unrealistic to expect the engineer to perform tasks not related to his/her job just to prove alertness. These secondary tasks could also cause distraction from primary tasks in the event of unexpected emergencies.

(3)               Having operating cab crew members maintain each other's alertness or take over each other's job functions: This is a type of "buddy" system that would require each of two or three crew members to monitor each other's alertness. Since crews often work together on the same schedule, all members could be fatigued at the same time. There would also be a tendency to cover for someone with a chronic alertness problem. Railroad job classification rules also forbid job substitution in the cab. Only a few conductors and brakeman are qualified to perform the duties of the locomotive engineer. The helper also cannot serve as a conductor.

Studies of locomotive operation were conducted to provide the basis for simulating train operation in the laboratory, which was needed for full scale laboratory testing and evaluation of the DigiAlerter and other cab alerter systems.  Information on locomotive operation was gathered from visits to locomotive cabs and a study of cab operating systems, accompanied by a locomotive engineer; discussions with locomotive engineers; and studies of several manuals of operating rules and instructions for train operation.

The locomotive cab presents severe restrictions in the location and size of a cab alerting device. Considering the geometry and layout of the cab and of the engineer's workstation, it is feasible to locate the cab alerting system somewhere on the throttle stand.  Several locations could be used; however, it is necessary that the alerting device be small, no more than five to six inches on a side and no more than two to three inches deep so that it does not protrude into the work area. Any device placed in a locomotive cab has to be protected from vibration, dust, moisture, temperature extremes, and occasional impacts. Simplicity and ruggedness are necessary for a device to perform reliably with a minimum of maintenance over time under these conditions.

Design requirements and feasibility criteria were established indicating that the device has to be:

(1)                                Physically sound, rugged, compact, portable, and tamper-proof.

(2)               Compatible with existing equipment and alert systems:  capable of interfacing with telecommunication systems, intervening equipment (e.g. braking system), and can be easily retrofitted in existing alert systems (e.g. audible or visual alarms).

(3)               Compatible with cab layout and operation area:  located within easy reach of the engineer while he/she is seated in a normal working position, visible under all operating conditions, and must not cover other displays or controls.

(4)                                Easy to operate  operation causes minimum or no distraction from other operating tasks; operation should be stimulating, but not frustrating, boring, or routine; operation should involve manipulation and cognition tasks; errors can be recovered within a window of time; operation relies on randomness and changes after every use; operation is simple but not systematic and requires alertness.

(5)               Functional,  capable of indicating a level of alertness necessary for operating a locomotive, of providing cause-independent evaluation, and of establishing threshold for acceptable operation and processing time limitation; cannot be simply by-passed or rigged for self-response; has a built-in virtual award and penalty system, such as a pleasant tune as opposed to noise; provides feedback stimuli to the engineer's action; capable of interacting with intervening activity (to alert the engineer or stop the train) should this be necessary; easily programmable.

(6)               Simple, reliable design:  clear displays and controls, does not cause prolonged postural stress, poses minimal visual and cognitive demands.

(7)               Compatible with cab operation environment: unaffected by severe weather extremes, thermal stresses, dust, fumes, odors, and withstands high levels of vibration.

(8)               Cost-effective: low lifecycle cost, long service life.

(9)               Acceptable by users:  acceptable by locomotive engineers and other operating personnel as a device to assure their personal safety, not as a means for management to invade their personal work space or individual work behavior, acceptable to FRA.

Using these design and functional requirements and feasibility criteria, several concepts were screened and rank ordered according to the degree of meeting the criteria.  Trade-offs was made between the DigiAlerter and other systems (MovAlerter, KeyAJerter, DynAlerter) on a conceptual basis.  A Locomotive Cab Alerter Simulator (LCAS) was developed for evaluation of the concepts and for comparison of design options. Trade-offs were made using the DigiAlerter as the baseline design. Other trade-offs were considered regarding the frequency of alertness testing and actions to be taken when no response is given in the alarm mode of a two level response task.  Trade-offs involving the type of response required in the alertness monitoring test, including the length and type of display (letters versus numbers) were evaluated experimentally. Additional trade-offs were made during simulated locomotive operation tests to finalize the design of the DigiAlerter as an alertness monitoring device.

TII has selected DigiAlerter as a viable CabAlerter that meets the FRA requirements and meets all the feasibility criteria.  The DigiAlerter was designed, constructed, and bench-tested as a Proof-of-Concept (POC) CabAlerter for prototyping and field demonstration.  The CabAlerter system is intended to ensure that the locomotive engineer remains alert to operating restrictions or otherwise stops the train if the engineer does not respond properly to provide prompts. This low-cost innovation can be retrofitted to alerter systems already in service.

A full scale software model was implemented on a 486 microprocessor to emulate the actual "look and feel" of the DigiAlerter from a visual and functional perspective.  The program allows an evaluation of the system and the user responses through parameters such as length of the alphanumeric string, allowable response time before an alert mode is entered, number of times the user must correctly respond to codes in the alarm mode before the simulation resumes normal operation, probability of a letter occurring in the code, and minimum and maximum bounds on the delay between new codes.

The POC hardware design of the DigiAlerter consisted of a sixteen-key keypad with an attached four character Light Emitting Diode (LED) display. Upon starting the prototype DigiAlerter, it generates four random characters in the range 0 to 9 or A through F.  These characters are then displayed on the LED readout.  The user must enter the code though the keypad.  If he/she enters the code correctly, the system will delay approximately one to two minutes and then display another four-digit code.  If the user enters the code incorrectly, the system will switch to an alarm state.  Once in the alarm state, the system will not generate additional codes until the reset button is pressed. Two LED's, one red (alert mode) and one green (normal mode), were provided for indication of the state of the DigiAlerter. As long as correct codes are entered, the green LED will remain lit. If an incorrect character is entered, however, the red LED will turn on.

Several preliminary tests were performed, including an alert testing computer simulation using keypads, the DigiAlerter emulator on the microprocessor, and the POC hardware.

A standard keypad entry device was interfaced with a PC using specially written software to produce a LCAS similar in operation to the TII DigiAlerter. The LCAS generates random codes of selected length and type (numeric, alphanumeric, or letters only) at random intervals on a screen to the user (representing the locomotive engineer) whose task is to repeat the code by entering it on a keypad in order to reset a timer which will then delay for a randomly chosen interval.  At the end of this interval the process is repeated.  If the user fails to enter the code within a specified time or if he/she enters an incorrect character, the system switches into an alarm mode. When this happens, the user must enter another randomly selected code correctly using the keypad a specified number of times within a specified time period in order to cancel the alarm mode.  If the user fails to complete the required sequences in the alarm mode, the alarm will be activated.  The program written for this experiment specified that the train would automatically be stopped (as when the braking system is put into emergency mode when the conductor activates the emergency brake).

A series of controlled laboratory experiments were conducted, using LCAS. The experiments involved four independently tested male subjects aged 22-26 years to investigate the concepts and alertness criteria and to determine the optimum characteristics of the response required to verify alertness. Since the job of operating a locomotive is variable in its cognitive demands and does not require a fixed posture or eye focal point, the task used to simulate this job consisted of engaging the subject in a group conversation with three other male participants while also providing background music.  Other normal computer related activity (conversation, printing laboratory reports, etc.) was present in the surrounding area.

It was determined experimentally that a recommended alertness test protocol, consisting of a visually presented six-letter string, be keyed in using a standard alphanumeric keypad, possibly with an audio or visual signal indicating that the test is being made. Failure to respond correctly or within 13.35 seconds would result in the activation of a signaled alarm mode requiring the correct entry of two additional six-letter codes.  Failure to perform this second level task would result in intervention or a stream of cool air being blown into the engineer's face, possibly from several angles. It was estimated that the alertness test should be given every 10-30 minutes during long runs across sparsely populated areas.

The software emulation test was carried out simultaneously with hardware design. After a random delay, the program displays a variable length code consisting of letters and numbers. The user then has a fixed amount of time to respond by selecting the correct digits from the simulated keypad using the mouse. If the user enters the code correctly within the specified time limit, the program waits a random amount of time before displaying a new code. If the user enters the code incorrectly or takes too much time to respond, the program enters the alert mode. The user must in this case correctly respond to a user-specified number of random codes to prevent the system from setting off a simulated alarm (a buzzer). If the correct code is entered each time, the program will return to normal operation, waiting a random amount of time before displaying a new code.  If the user fails to enter in each code correctly, the program will inform the user that an error has occurred. Following each session, the program records the results of the simulation to a file. These results include:  the user's identification number, the length of the generated codes, the probability of occurrence of letters, the correct character and missed character (in the case of a failure), the time the user required to respond to each code, and a result code. The data file is particularly useful in determining the optimum parameters for the final hardware implementation of the DigiAlerter.

The POC hardware model was tested for operability and functionality. Considering the attributes of a viable CabAlerter, the POC tests and the construction and operability tests of the POC model of the DigiAlerter have shown that the selected alerter is technically feasible and commercially viable.

The feasibility evaluation shows that:

(1)               Physical soundness: The DigiAlerter POC model is compact and portable and can be further reduced in size by burning all controls on a chip. Although the device is relatively rugged, the prototype can be further ruggedized for field use. Tamper proofing of the device can be easily achieved due to the limited entry points and the simplicity of the design. The box itself can be well sealed or formed by a plastic mold that will not allow reaching the internals without destruction of the casing. The low cost of the device will allow for such an option. The use of microchips adds another layer of safeguarding against deliberate tampering. Ruggedness and tamper proofing will be provided in the prototype model in Phase II.

(2)               Compatibility with existing equipment and alert systems: Although the POC model was not designed to interface with other systems (except with a computer), the DigiAlerter can be programmed to interface with telecommunication systems and intervening equipment (e.g. braking system). Failure to properly respond to the alerter can produce a signal through appropriate leads to the proper destination for actuation of an alarm or control system. The DigiAlerter can be easily retrofitted in existing alert systems (e.g. audible or visual alarms). If desired, it can be connected to a deadman switch for validation.  All interfaces will be designed and tested in Phase II.

(3)               Compatibility with cab layout and operation area:  The compactness of the DigiAlerter allows the location of the device within easy reach of the engineer while he/she is seated in a normal working position.  Several locations in the cab have been considered to allow visibility under all operating conditions and to avoid obstruction of the view of other displays or controls. The portability and compactness of the device will provide many possibilities. In fact, a locomotive engineer may prefer one location over another that provides him/her convenient access that is more suited to his/her physical attributes. In Phase II recommended locations will be provided.

(4)                                Operability: The DigiAlerter POC model is simple and easy to operate; however, the sequence of operation is not systematic and does require alertness. The use of touch buttons and keypad configurations is becoming part of several daily activities.  The simulations and emulation showed that the keypad type of device is the easiest to operate and is the most reliable in operation compared to the other devices whether in use or proposed. Operation of the device causes no distraction from other operating tasks.  Matching alphanumerics is moderately challenging, but not frustrating. Random change of the displayed numbers/letters after every use is relatively stimulating and prevents the alert test from becoming boring or routine. The touch pad manipulation to match the display involves cognitive action. In case of an inadvertent error, the engineer can recover and enter the correct response within a short window of time.

(5)                                Functionality: The DigiAlerter POC model cannot be simply by¬≠passed or rigged for self-response. Additional safeguard tamper proofing will be provided in the design and construction of the prototype.  Currently, the POC model has a simple built-in virtual award and penalty system. Other systems may be considered for the prototype.  Both provide feedback stimuli to the engineer's action. The device simplicity makes the alertness test brief without the need for special skills or training. However, sufficient cognitive demand is provided to prevent execution of the test in a semiconscious state as in turning off an alarm clock. The demand does not interfere with other operating tasks by causing distraction. In Phase II simple prototype interfaces will allow for interacting with intervening activity (to alert the engineer or stop the train) should this be necessary.  The device simulation has shown a capability to indicate a level of alertness necessary for operating a locomotive engine. The number of allowed attempts before sounding the alarm establishes the threshold for acceptable operation and the limitation on the processing time. Failure or success in the alert test is independent of the cause of non-alertness, whether it is induced by sleep, drowsing, or intoxication.

(6)               Design appropriateness: The DigiAlerter POC model design is simple and reliable.  The constructed model has clear displays and controls. Clarity will be improved in the prototype to minimize visual and cognitive demands.  The use of an EPROM makes the programming of the device simple, but requires subject-matter-expert. The layout design does not require prolonged postural stress to operate.

(7)               Compatibility with cab operation environment: The rugged casing provides some protection from severe weather extremes and from dust (from sanding of wheels for traction), fumes, odors, etc.  However, additional protective measures may be necessary to ensure high performance when the device is subjected to high thermal stresses.  The location and installation of the device in the cab will affect its ability to withstand high levels of noise and vibration. These are easily implemented and will be part of the activity in Phase 2.

(8)               Cost competitiveness:  The cost of production of the DigiAlerter is low.  The touch buttons (or touch surface) is likely to wear out from frequent use. The life of the surface will be shortened if used with soiled fingertips. In general the device life may not exceed five years with heavy use. Overhauling may be limited to change of the casing.  However, the low capital cost may make replacement more cost-effective.  Testing the device operability against a calibrated system is simple and a self-testing feature may be introduced. Testing the electric circuits will be the same as any simple device. Visual inspection of the surface is sufficient. A short service life is not a drawback in the present case due to low replacement cost and because frequent refurbishment or modernization of the system will contribute to its utility in testing of alertness.

(9)               Acceptability: The team for Phase I included railroad engineers with over thirty years experience.  The input and responses to this new alerter system assures the acceptance, by the end users and their Union, of this new addition to the train cab.

(10)           Further Applications: In addition to its obvious utility in the railway industry for maintaining operator alertness, the DigiAlerter has further applications in other areas requiring alertness, such as the airline industry, the entire transportation service industry, security companies, and the military. The DigiAlerter was designed with these multiple applications in mind and was consequently designed so as to be easily modifiable to suit its use in any particular setting.

Based on the POC model, the results of the tests, and the feasibility estimates, a prototype alerter was designed for implementation in Phase II. Also, plans are provided for Phase II, which will involve demonstration of the alerter in an actual moving environment. The DigiAlerter prototype planned for Phase II must perform the following functions:

1.                  Test the alertness of the locomotive engineer.

2.                  Provide stimulus, such as a cool air stream, scented mist, etc., in the event initial tests indicate lack of alertness.

3.                  Take over train control function and notify central command post in the event of failure of the operator to respond.  This will result in complete stopping of the train.

The concept for stimulation of the engineer has been established, options include cool air stream, scented mist, etc. Actuation signals are available in the POC model. Phase II will incorporate the appropriate refreshing system and the interfaces with other cab equipment and devices. In addition, Environmental Qualification (EQ) must be performed. This requires consideration of the operability of the DigiAlerter in the locomotive cab environment as well as the ability of the engineer to smoothly interact with the device. The prototype design and construction in Phase II will accommodate for EQ factors in selection of the type and resolution of the display as well as the surface of the keypad (protected buttons versus membrane switch touchpad).