LIGHT RAIL TRANSIT

Dr Teo Ho Pin asked the Minister for Communications and Information Technology (a) how many times has the LRT system broken down since its operations in November 1999; (b) has the Ministry identified and adequately addressed the system failure that led to the human error causing the train collision in November 2000; (c) why were the trains allowed to operate notwithstanding the fact that "missing trains" had been detected a number of times; and (d) what were the safety tests conducted on the LRT system under Singapore's climatic conditions prior to its operations.

The Minister of State for Communications and Information Technology (Dr John Chen Seow Phun) (for the Minister for Communications and Information Technology): Mr Speaker, Sir, the Bukit Panjang LRT commenced operations on 6th November 1999. Since the start of operations, there have been 42 cases of disruptions, where each disruption exceeded 20 minutes. 32 of them occurred during the first six months of operation when the system was `bedding-in'. It is normal for minor operational problems to occur in the initial months of operation of a complicated system like the BP LRT. Even though key members of the operational personnel had brought along with them significant experience in the MRT system, they still had to gain experience in operating and maintaining the LRT system. I am glad to inform Members that after the initial period of bedding-in the system, the availability of the LRT has improved steadily to its current commendable level. The LRT system now has an availability of above 99.5%. This translates to a total delay of only 6 minutes in a 20-hour daily service. The delay is not just by one car, we are talking about the delay accumulated over all the cars in the 20-hour daily service. This availability compares favourably, if not better than other similar systems around the world.

Following the LRT vehicle collision that occurred on 19th November, a Committee of Investigation was appointed by the Land Transport Authority (LTA) to investigate the collision. The Committee completed its investigation last month. It found that the incident was caused entirely by a procedural error by the train controller. The Committee also found that the train safety system had worked as designed. Therefore, there was no system failure. Arising from this incident, LTA has directed the operator, SLRT Pte Ltd, to retrain all its staff to enhance their knowledge of the system and procedures, and to do so on a continuing basis. LTA reports that the company has already put in place measures to tighten its operating and safety procedures, as well as to raise training standards for its railway staff. LTA will also work with the operator to implement other measures to further strengthen the LRT operations and procedures.

With regard to Dr Teo's third question, I would like to reiterate that there was no failure or problem on the part of the system hardware or software. The system responded as designed. When the system did not detect the particular LRT train, it placed an electronic shield in the last known position of the vehicle. This is to prevent any other vehicle from coming into the shielded area and, hence, prevent a collision. The train controller had not followed proper procedures when he reset the system without establishing the position of the lost train. The incident on 19th November 2000 was the first time that a loss of train detection occurred. If the correct procedure had been followed, the automatic train protection feature in the system would have functioned as designed, and the trains would not have collided. This fundamental and key safety feature of the system has been designed to very high standards, and has been checked and verified as working properly at all times.

With regard to safety tests on the system, extensive tests on all parts of the LRT system were conducted in simulated local environment conditions prior to system operation. Verification tests to ensure that the system met safety criteria were conducted on such items as the signalling system, the vehicle detection system, the vehicle and the wayside automatic train protection system. The tests undertaken showed that all safety requirements identified by the hazard analyses were met in the Singapore environment. The tests and the results were reviewed and confirmed acceptable by an independent third party System Safety Certification Consultant.

Dr Teo Ho Pin: May I ask the Minister of State is it safe to run the trains when the system detects a missing train and what other measures have the Ministry taken to ensure that the LRT system is safe, besides the manual safety check system as proposed by SLRT recently?

Dr John Chen Seow Phun: Sir, if a train is found missing, the system will not allow the train to operate until the operator resets the system. So the correct procedure therefore is for the operator to find out where the missing train is, make sure that the missing train is accounted for or taken out of the system before he resets the system. Because the interlocking feature and the safety feature of the system are such that there will be automatic train protection and detection, prevention of collision, the right sequencing, and so on, if the system is operated, as designed, there will not be any chances of collision. But in this case, the operator overrode and reset the system without accounting for the missing train. That is why when the system did not detect any missing train after the reset, it would not take the missing train into consideration. Hence the accident. So this is to answer the Member's question on safety.

What else did LTA ask the operator to do? LTA has, besides asking them to conduct refresher training and enhance training standards, also asked SLRT to review its management structure to strengthen the team in the area of railway operation and signalling. What we found out is that the personnel in the SLRT, prior to the collision, were mainly maintenance people from MRT. So we are asking them to strengthen the operation aspect of the management structure. Also, we have asked SLRT to review all its procedures requiring human intervention to deal with safety critical functions and ensure that these are clearly stated, that there is no ambiguity, so that procedures can be followed to the letter, so to speak.

Dr Wang Kai Yuen: I would like to find out from the Minister of State how he could convince the commuter that the system is safe if the train is physically there and yet, through a manual reset, the train would disappear into virtual space. How could anyone say that such a system is certified safe?

Dr John Chen Seow Phun: Sir, the procedure, as I have said, is that before they reset, they will have to ensure that the train is accounted for. In this case, for some reason, the controller had forgotten to follow the procedure, and an error occurred. It is not a software or hardware system problem. It is a human intervention problem. This is the first part.

The second part is how do we ensure that human intervention does not result in error. Therefore, the SLRT has recommended that we have a check-and-balance system. How do we have a check-and-balance system? We will have to ensure that before the controller can press the reset button, he must check with the shift manager. This is one step. So if both agree that they reset, then they will reset.

Secondly, we are even thinking of asking the SLRT that perhaps they should have two buttons, just like your two-key system. So these are things that we can do, and will do, in order to make sure that, procedurally, there will be no room for error.

Dr Teo Ho Pin: Sir, is it normal for the system to detect missing trains and, if the system can detect missing trains, under what kind of circumstances will the system prompt that there are missing trains in the SLRT system? So it must be the software, or there must be some reason for some system failure somewhere, that is why the system detects missing trains and that is why you need to do this manual reset.

Dr John Chen Seow Phun: Sir, trains are detected by sensors and these sensors are under the car and attached to the track. It could be due to contact problem or it could also be due to foreign objects or dirt that comes into the contact. So it happened that the sensor failed although, in this case, there is redundancy in the sense that there are two contacts. But it is unlike MRT. For the MRT, they have a long train and the train has a long continuous contact whereas, here, it is a single car. So it is possible that, under exceptional conditions, it loses contact. And when it loses contact, the system is unable to detect it 100%. When this happens, there must be a procedure to rectify it. This procedure has been put in place, but, unfortunately, in this incident, the operator had not followed the procedure.

So we cannot have an automated system without the train detection system. A train detection system means that we must have sensors, and sensors can fail and that is where human intervention comes in.

Mr Low Thia Khiang (Hougang): May I ask the Minister of State why the system does not have a safety feature that will not allow it to be reset until all the trains in the system are accounted for? That will prevent human error from resetting it.

Dr John Chen Seow Phun: If you want to start the train operation afresh, you will have to reset the system, otherwise the system will just freeze because there will be no power to all the trains when the computer system detects a fault and the trains will just freeze. So, in order to restart the system, you will have to reset it. And before you reset, you must ensure that everything is accounted for. That is the way an automated train system is run.

Dr Vasoo: Sir, the Minister of State has given a very interesting viewpoint on this missing train. I was trying to find out whether he has a system to deal with a missing operator, because human errors accounted for all these problems.

Dr John Chen Seow Phun: Sir, I do not think we have a problem of a missing operator.

Mr Speaker: We will take one last question from Dr Tan Boon Wan.

Dr Tan Boon Wan (Ang Mo Kio): Mr Speaker, Sir, the Minister of State said that there is no hardware and no software problem. Evidently, the train has gone missing. And, if it was not for a hardware or software problem, how could the train have gone missing?

Dr John Chen Seow Phun: Sir, we cannot have a system where the components never fail. There is no hardware in the world where its components never fail. When we talk about system failure, both hardware and software, we are talking about the system not functioning, as designed, as a result of any component or software failure. The LRT system is functioning as designed. The system recognises that there will be occasions for component failure and so on and so forth, and the system takes care of that. So, in this case, there is no problem in the system hardware and software. The problem lies in the human intervention part, where it is not strictly followed.