InCom WG Report

PIANC n° 192 - 2019

REPORT ON THE DEVELOPMENTS

IN THE AUTOMATION AND REMOTE OPERATION
OF LOCKS AND BRIDGES
The World Association for Waterborne Transport Infrastructure
 PIANC
The World Association for
Waterborne Transport Infrastructure

PIANC REPORT N° 192

INLAND NAVIGATION COMMISSION

REPORT ON THE DEVELOPMENTS

IN THE AUTOMATION AND REMOTE OPERATION
OF LOCKS AND BRIDGES
2019
PIANC has Technical Commissions concerned with inland waterways and ports (InCom),
coastal and ocean waterways (including ports and harbours) (MarCom), environmental
aspects (EnviCom) and sport and pleasure navigation (RecCom).

This report has been produced by an international Working Group convened by the
Inland Navigation Commission (MarCom). Members of the Working Group represent
several countries and are acknowledged experts in their profession.

The objective of this report is to provide information and recommendations on good

practice. Conformity is not obligatory and engineering judgement should be used in its
application, especially in special circumstances. This report should be seen as an expert
guidance and state-of-the-art on this particular subject. PIANC disclaims all responsibil-
ity in the event that this report should be presented as an official standard.

PIANC Secrétariat Général

Boulevard du Roi Albert II 20, B 3
B-1000 Bruxelles
Belgique

http://www.pianc.org

VAT BE 408-287-945

ISBN 978-2-87223-268-0

© All rights reserved

TABLE OF CONTENTS

1 INTRODUCTION 5
1.1 Scope 5
1.2 Introduction 5
1.2.1 Structure of the Report 5
1.2.2 Reference Projects 6
1.2.3 Related PIANC Reports 7
1.2.4 Members of the Working Group 7
1.2.5 Meetings 9
2 MANAGEMENT SUMMARY 10
3 BUSINESS CASE DEVELOPMENT FOR REMOTE OPERATION AND AUTOMATION 11
3.1 Introduction to Business Case Development 11
3.2 Benefits vs. Costs 11
3.2.1 Benefits 12
3.2.1.1 One-Off/Non-recurring 12
3.2.1.2 Recurring 13
3.2.2 Costs 14
3.2.2.1 One-off/Non-recurring 14
3.2.2.2 Recurring 14
3.2.3 Risks 14
3.2.4 Opportunities 15
3.3 Notes on the Business Case 15
3.3.1 Implementation 15
3.3.2 Life Cycle of Control and Network Equipment 16
3.3.3 Design, Construction, Operation and Maintenance 16
3.3.4 Risk Assessment 17
3.3.5 Economies of Scale 17
3.3.6 Communication Network 17
3.3.7 Rallying External Stakeholders to Help Promoting a Project 18
3.4 Current Situation in the Different Countries 18
3.5 Operating Methods 24
3.5.1 Overview 24
3.5.2 Advantages and Disadvantages of Different Methods of Operation 27
4 ORGANISATIONAL IMPLEMENTATION 29
4.1 Organisational Design 29
4.2 Standardisation 30
4.2.1 What is Standardisation? 30
4.2.2 Standardisation of Processes and Procedures in Terms of Automation and Remote
Operation 30
4.2.3 Standardisation of the Work Environment 31
4.2.4 Technical Standardisation 31
4.3 Service Model to Customers 32
4.4 Interaction with the Public 32
5 OPERATIONAL IMPLEMENTATION 33
5.1 Implementation of Remote Operation 33
5.2 Definition of Processes and Procedures 33
5.2.1 Process – Remote Operation 33
5.2.2 Process – Asset Management and Maintenance 34
5.2.3 Graceful Degradation 35
5.3 Operator Skills 36
5.3.1 Workload onto the Operator 36
5.3.2 Operator Tasks 37
5.3.3 Training Requirements 37
5.3.3.1 Additional Training Requirements for Remote Control 37
5.3.3.2 Using Remote Control Systems 38
5.3.3.3 Working in a Remote control centre 38

1
 5.3.4 Function Description 38
5.4 Standardisation and Ergonomic Principles 39
5.4.1 Control Room Design 39
5.4.2 Ergonomics of the Operator Desk 40
5.4.3 Visualisation to the Operators 42
5.4.3.1 Human-Machine Interface (HMI) 42
5.4.3.2 Camera Plan 43
5.4.4 Control Room Standardisation in Europe 45
5.4.4.1 Belgium 45
5.4.4.2 Germany 48
5.4.4.3 The Netherlands 49
5.4.5 Control Room Standardisation in the USA 51
5.4.6 Control Room Standardisation in Canada 52
1.1.1. Operator Cognitive Ergonomic Study 53
6 TECHNICAL IMPLEMENTATION 54
6.1 Legislation and Technical Standards 54
6.1.1 Europe: Route to Compliance with EU Directives 54
6.1.1.1 Background 54
6.1.1.2 Compliance by Adoption of Harmonised Standards 54
6.1.1.3 Compliance by Means other than Adoption of Harmonised Standards 55
6.1.1.4 CE Marking 55
6.1.1.5 Technical File 57
6.1.1.6 Provision of Operation and Maintenance Information 57
6.1.1.7 Competence of Maintenance Engineers 58
6.1.1.8 Data Protection Regulations 58
6.1.2 USA: Standards 58
6.1.3 Canada: Standards 59
6.1.3.1 Canadian Regulations 59
6.1.3.2 Canadian Electrical Standards 59
6.2 System Architecture 59
6.2.1 Introduction 59
6.2.2 System Architecture for Remote Operation 60
6.2.3 Management of System Architecture and Complexity 62
6.3 Technical Developments 63
6.3.1 Instrumentation and Control 63
6.3.1.1 Water Level Measurement Devices 63
6.3.1.2 Position Detection 64
6.3.1.3 Programmable Logic Controllers (PLC) 65
6.3.1.4 Supervisory Control and Data Acquisition (SCADA) 66
6.3.1.5 Closed Circuit Television System (CCTV-system) 67
6.3.1.6 Communication Technology 69
6.3.2 Data Communication 70
6.3.2.1 Local Area Network (LAN) 70
6.3.2.2 Wide Area Network (WAN) 70
6.3.2.3 Communication Protocols 70
6.3.2.4 Converging Business System Networks with ‘Industrial’ Control Network Data 71
6.3.3 Automation Systems 71
6.3.3.1 Operator-Decision vs Machine-Decision 71
6.3.3.2 Automation of Water Management 72
6.3.3.3 Automation of Railway Bridges 72
6.3.3.4 Traffic Control 72
6.3.3.5 Detection Systems 74
6.3.3.6 Fully Automatic Operation 74
6.3.3.7 Self-Service for Operation by Vessel Operators 76
6.3.3.8 Vessel Self-Spotting and Self-Positioning 79
6.3.3.9 Hands-Free Mooring 80
6.3.4 Simulator Technology 81
6.3.4.1 AWATAR Simulator in Belgium, Flanders 81
6.3.4.2 Plant Simulation in Germany – PLC Control Application Software Testing 82
6.3.4.3 Simulator in the Netherlands 83

2
 6.3.4.4 Simulator in Belgium, Port of Antwerp 84
7 SAFETY 85
7.1 Introduction 85
7.2 Operational Safety 85
7.2.1 Situational Awareness 85
7.2.2 Responsibilities Relative to the Operation of Barriers 85
7.2.3 Operational Safety Relative to the Mooring Process 85
7.3 Technical Safety Solutions 86
7.3.1 Functional Safety 86
7.3.2 Hierarchy of Risk Reduction 86
7.3.3 Defining Safety Functions 87
7.3.4 Safety Requirements 87
7.3.4.1 Interlocking in the Control System 87
7.3.4.2 Safety Requirements on Video Management 88
7.3.4.3 Failsafe-PLC 89
7.3.4.4 Emergency Stop 89
7.3.5 Redundancy 92
8 SECURITY 93
8.1 Introduction to Security 93
8.2 Perimeter Protection 93
8.3 Cybersecurity 93
8.4 System Hardening 94
8.5 Traffic Monitoring 94
8.5.1 Control of Vessel Traffic 94
8.5.2 Camera Ship Recognition in Case of Collisions 94
8.5.3 Control of Local Road and Pedestrian Traffic 95
9 TRAFFIC MANAGEMENT 96
10 INFORMATION MANAGEMENT 97
10.1 Value of Information 97
10.2 (Big) Data Analysis 97
10.2.1 Data Collection Useful for Traffic Management 97
10.2.2 Water Level Management Data Collection 98
10.2.3 Data Collection Useful for Asset Management 98
10.2.4 Health Monitoring 98
11 FUTURE CONSIDERATIONS 100
11.1 Increase of Data Collection 100
11.2 Vision: Where to go to? 100
12 REFERENCES 101

LIST OF FIGURES
FIGURE 1: THE PRINCIPLES OF THE GOLDEN CIRCLE 9
FIGURE 2: SUMMARY OF THE RELATIONS DEPENDING ON THE DEGREE OF AUTOMATION AND
OPERATION 26
FIGURE 3. PROCESS DEFINITION FOR REMOTE OPERATION 34
FIGURE 4. PROCESS DEFINITION FOR MAINTENANCE AND ASSET MANAGEMENT 35
FIGURE 5: CONTROL ROOM DESIGN (REFERENCE: WSV, GERMANY) 39
FIGURE 6: EXAMPLE OF AN OPERATOR DESK AND INTERFACES 40
FIGURE 7: TESTING OPERATOR DESKS (REFERENCE: WSV, GERMANY) 41
FIGURE 8: OPERATOR CHAIR AND DESK (REFERENCE: PORT OF ANTWERP) 41
FIGURE 9: COMPARING DIFFERENT LEVELS OF DETAIL FOR SCADA REPRESENTATION 43
FIGURE 10: 3-D MODELLING AND VALIDATION OF CAMERA POSITIONS (TALLINN HARBOUR BRIDGE) 44
FIGURE 11: EXAMPLE OF CAMERA LOCATIONS REPRESENTED ON A SCADA-SCREEN 44
FIGURE 12: EXAMPLE OF A DUAL WORKSTATION (PORT OF ANTWERP PROTOTYPE) 45
FIGURE 13: SCREEN SET-UP FROM A DUAL WORKSTATION (PORT OF ANTWERP PROTOTYPE) 46
FIGURE 14: EXAMPLE OF THE STANDARD SCADA APPLICATION WHICH IS A SCHEMATIC
REPRESENTATION OF THE OBJECT IT SERVES (PORT OF ANTWERP PROTOTYPE) 46
FIGURE 15: TYPICAL CONTROL ROOM LAY-OUT IN FLANDERS 47
FIGURE 16: CONTROL ROOM STANDARDISATION IN FLANDERS - DESK SIMULATOR 48
FIGURE 17: AN EXAMPLE OF THE STANDARD SCADA SYSTEM FOR LOCKS USED BY THE GERMAN WSV
49

3
FIGURE 18: REMOTE TRAFFIC CENTRE MAASBRACHT FOR BRIDGES, LOCKS, DAMS AND PUMPING
STATIONS (INDOOR) 50
FIGURE 19: REMOTE TRAFFIC CENTRE MAASBRACHT FOR BRIDGES, LOCKS, DAMS AND PUMPING
STATIONS 51
FIGURE 20: CONCEPT OF A DUAL OPERATOR DESK ENVISIONED BY THE US ARMY CORPS OF
ENGINEERS 51
FIGURE 20: OPERATIONS CONTROL CENTRE (MAISONNEUVE) 52
FIGURE 21: MAISONNEUVE OPERATIONS CONTROL CENTRE LAY-OUT 52
FIGURE 22: NIAGARA OPERATIONS CONTROL CENTRE LAY-OUT 53
FIGURE 24: DECISION TREE FOR APPLICATION EU GUIDELINES MACHINE SAFETY 56
FIGURE 25: POSSIBLE SET-UP CONTAINING THE AUTOMATION SYSTEMS NECESSARY FOR REMOTE
CONTROL 60
FIGURE 26: POSSIBLE APPROACH FOR THE SYSTEM ARCHITECTURE FOR REMOTE OPERATION 61
FIGURE 27: REFERENCE PROJECT 'SCUO V2' 78
FIGURE 27; VESSEL SELF SPOTTING SYSTEM INSTALLATION 79
FIGURE 28: HANDS-FREE MOORING SYSTEM USED BY THE ST. LAWRENCE SEAWAY MANAGEMENT
CORPORATION 81
FIGURE 29: AWATAR SIMULATOR SET-UP 81
FIGURE 30: SCHEMATIC PRESENTATION OF THE PLC SIMULATION MODEL 82
FIGURE 31: SIMULATION SCREEN 83
FIGURE 32: PROGRAMMING SEQUENCES 83
FIGURE 34: STANDARD OPERATOR DESK IN GERMAN LOC'S WITH LOCKAGE STOP AND EMERGENCY
STOP 90
FIGURE 35: THE SAFETY CIRCUIT AS A SENSOR-LOGIC-ACTUATOR CIRCUIT 91
FIGURE 36: HARDWIRED EMERGENCY STOP USED BY THE RHÔNE TRAFFIC MANAGEMENT CENTRE,
FRANCE 91

LIST OF TABLES
TABLE 1: PREVIOUS PIANC REPORT 7
TABLE 2: RELATED PIANC REPORTS 7
TABLE 3: MEMBERS OF THE WORKING GROUP 8
TABLE 4: SUMMARY OF THE BENEFITS, COSTS, RISKS AND OPPORTUNITIES 12
TABLE 5: REMOTE CONTROL CENTRES AND THEIR CHARACTERISTICS (1) 22
TABLE 6: REMOTE CONTROL CENTRES AND THEIR CHARACTERISTICS (2) 23
TABLE 7: ADVANTAGES AND DISADVANTAGES OF DIFFERENT METHODS OF OPERATION 27
TABLE 8: OVERVIEW OF THE DIFFERENT POSSIBLE TASKS WITH BOTH LOCAL AND REMOTE CONTROL
OPERATION 37
TABLE 9: SUMMARY OF THE SPECIFICATIONS OF USED FONTS FOR GUI 48
TABLE 10: COMPARISON OF CHARACTERISTICS OF TECHNICAL COMPONENTS 62
TABLE 11: OVERVIEW OF THE WATER LEVEL MEASUREMENT TECHNOLOGIES AND THEIR
SPECIFICATIONS 64
TABLE 12: MEMBERS OF THE WORKING GROUP 101

4
1 INTRODUCTION
1.1 Scope
The Working Group has collected recent development and case studies from different countries on
remote operation of structures. The standards, guidelines and best practices in this field were reviewed
critically and recommended, if and when appropriate included as part of the final report. The matters
that were investigated include:
 new developments in remote operation of structures
 physical security including perimeter protection, intrusion detection technology, video analysis and
access control
 network security including protection of data, intrusion prevention/detection (hackers), etc.
 integration of SCADA and process control with other systems such as traffic management, RIS,
ERP, etc.
 scanning & video technology, including high-definition cameras, thermal cameras and advanced
image processing such as facial recognition
 Human Factor Engineering
 simulation technology for training & certification of operators
 big data analysis
 self-learning technology

These insights were used to create this Working Group Report 192, which focuses on the developments
in the automation and remote operation of locks and bridges to reflect technological advancement and
new considerations related to remote operation in the last ten years.
It is, however, important to remark that during the two years of existence of WG 192, other Working
Groups were founded to further investigate certain topics. These topics are discussed shortly in this
report, such as smart shipping and cybersecurity. For more information about these topics, the Working
Groups and reports mentioned in Table 2 can be consulted.

1.2 Introduction

Structure of the Report

PIANC Working Group report 192 on ‘Developments in the Automation and Remote Operation of Locks
and Bridges’ is written following the principles of ‘The Golden Circle’:

 ‘Why’ do organisations consider and implement remote operations?

 ‘How’ is it implemented?
 ‘What’ must be done for the implementation?

5
 Figure 1: The principles of 'The Golden Circle'

The structure of this report can be summarised as follows:

 Chapter 1 – Introduction
 Chapter 2 – Management Summary
 Chapter 3 – Business Case Development for Remote Operation and Automation
 Chapter 4 – Organisational Implementation
 Chapter 5 – Operational Implementation
 Chapter 6 – Technical Implementation
 Chapter 7 – Safety
 Chapter 8 – Security
 Chapter 9 – Traffic Management
 Chapter 10 – Information Management
 Chapter 11 – Future Considerations

Reference Projects

Many automation projects and remote operation of movable bridges and locks have already been
successfully implemented. Throughout the report, several examples and reference projects are touched
upon. By providing these noteworthy examples, including the lessons learnt, WG 192 strives to give the
reader an overall view on these results, trends and ideas.

This exploration takes place from a technological point of view, but there are several interactions
between technology, organisation and the implementation of work. Both conceptual issues (e.g. HMI,
ICT, safety regulations, operation and maintenance procedures, etc.) as the local technological context
(e.g. necessary alterations and/or expansions regarding hardware) are equally important.
Given the importance and use of these practical examples and reference projects, WG 192 compiled
these in dedicated brochures including additional cases, projects, best practices and technical
developments concerning the latest developments in the field of automation and remote control relevant

6
 to the different members and their organisations. The brochures and further deliverables are available
for all PIANC members, port authorities, waterway organisations and technology partners and can be
found on the PIANC websites.

Related PIANC Reports

The following PIANC report is superseded and replaced by this WG-report 192 and should be used
only for historical reference purposes:
Developments in the Automation and Remote Operation of Locks and
PIANC Report No.96 2008
Bridges

Table 1: Previous PIANC Report

Besides the report of InCom WG 96, the following PIANC reports also contain sections related to the
scope of this Working Group:

PIANC Report No. 204 Cybersecurity in Inland Navigation

Ongoing
Mechanical and Electrical Engineering – Lessons Learnt from Navigation
PIANC Report No.138 2014
Structures
Advanced and Automated Operation of Locks and Bridges – Exploitation
PIANC Report No.18 1996
par Télécommande et Automatisme des Ecluses et Ponts Mobiles
PIANC Report No.25 Maintenance and Renovation of Navigation Infrastructure 2006

Table 2: Related PIANC reports

Members of the Working Group

WG 192 consisted of the following members:

NAME ADDRESS E-MAIL

De Vlaamse Waterweg nv
Mr Lieven Dejonckheere Afdeling Bovenschelde
Head of division Guldensporenpark 105 [email protected]
Chairman of PIANC WG 192 9820 Merelbeke
Belgium
Port of Antwerp
Mr Wim Van Santvoort
Dept. Maritime Infrastructure
Senior Program Manager, Dept. [email protected]
Kauwenstein 4
Maritime Infrastructure, Port of
2030 Antwerpen
Antwerp
Belgium
Tractebel
Ms Kim Geylen
Department Water Engineering
Project Engineer, Electromechanical
Van Immerseelstraat 66 [email protected]
Engineering – Water Engineering,
2018 Antwerp
Tractebel
Belgium

Mr Michiel Coopman De Vlaamse Waterweg

Project Engineer Waterway Oostdijk 10
Technology, Department of 2830 Willebroek [email protected]
Automation & Waterway Belgium
Management, De Vlaamse Waterweg

St. Lawrence Seaway

Mr Stephen Kwok
Management Corporation
Vice President Operations of St.
Niagara Region
Lawrence Seaway Management
508 Glendale Avenue
Corporation
St. Catharines, Ontario
Sponsor of WG 192
Canada L2R 6V8

7
 St. Lawrence Seaway
Mr Leonard Swift
Management Corporation
Manager, Modernization Design &
Niagara Region
Automation, St. Lawrence Seaway [email protected]
508 Glendale Avenue
Management Corp., Business
St. Catharines, Ontario
Improvement
Canada L2R 6V8

Cerema
Mr Laurent Luchez
134, rue de Beauvais
Project Manager, Technical division
CS 60321
for Water, Sea and Waterways, [email protected]
F-60280 Margny lès Compiègne
Transport Infrastructure Division,
Cedex
Cerema
France

CNR
Mr Cyrille Chaussat
91, Route de la Roche de Glun
Adjoint au Directeur, Direction [email protected]
26503 Bourg Les Valence
Territoriale Rhône Isère, CNR
France

German Federal Waterways and

Mr Rainer Strenge
Shipping Administration
Head of Traffic Technologies Centre,
Am Berg 3, [email protected]
Federal Waterways and Shipping
56070 Koblenz
Administration
Germany

German Federal Waterways and

Mr Walif Achim Schneider Shipping Administration
Federal Waterways and Shipping Am Berg 3, [email protected]
Administration 56070 Koblenz
Germany

Mr Leon Uijttewaal
Rijkswaterstaat
Coordinating Advisor, Expert and
Derde Werelddreef 1
Lead Architect, Automation and [email protected]
2622 HA Delft
Remote Operation of Locks and
the Netherlands
Bridges, Rijkswaterstaat

Witteveen & Bos

Mr Ad Kloppenburg Leeuwenburg 8
[email protected]
Witteveen & Bos 7400 AE Deventer
The Netherlands

Tetra Tech
Mr Albert Barnes
400 112th Ave. NE, Bellevue, WA
Senior Electrical Engineer, Tetra [email protected]
98004
Tech
USA

Ms Kathy Griffin U.S. Army Corps of Engineers

Chief, Operations and Regulatory 281 Merion Drive
[email protected]
Division, U.S. Army Corps of Pittsburgh, PA 15228
Engineers USA

Royal HaskoningDHV
Mr Jason Hudson 36 Park Row
Principal Electrical Engineer, Royal Leeds [email protected]
Haskoning DHV LS1 5JL
United Kingdom

Mr Brian Molloy 1000 Liberty Ave

Project Manager, Pittsburgh District, Pittsburgh, PA 15222 [email protected]
U.S. Army Corps of Engineers USA

Table 3: Members of the Working Group

8
 Meetings

A total of seven meetings of the WG were held during the course of the project:
 Montreal (Canada) – October 2016
 Antwerp/Ghent (Belgium) – January 2017
 Lyon (France) – May 2017
 Pittsburgh (USA) – September 2017
 Falkirk (UK) – March 2018
 Koblenz (Germany) – June 2018
 Saint-Catharines (Canada) – September 2018

After the meeting in Koblenz, a draft version of the report was handed over to InCom for further review
and validation.

9
2 MANAGEMENT SUMMARY
PIANC Working Group 192 on ‘Developments in the Automation and Remote Operation of Locks and
Bridges’ sets out a framework for establishing automation of movable bridges and locks, including
remote operation, self-operation and fully automatic operation. It is a guide for authorities considering
automated and remote operation of movable infrastructure. The report is a follow-up of WG-report 96
(2008) and compares the current developments in automation and remote operation to the status ten
years ago.

The report is written following the principles of ‘The Golden Circle’. ‘Why’ do organisations consider and
implement remote operations? ‘How’ is it implemented? ‘What’ must be done for the implementation?
These three questions offer a framework to implement remote operation. But to achieve the desired
increase in efficiency and safety, it is also necessary to define an overall organisation strategy and a
clear vision. Furthermore, it is necessary to ensure the implementation is aligned with the overall
organisation of the waterway authority. The report addresses the important key factors to help waterway
authorities towards a successful implementation.

In comparison to PIANC WG 96, new technologies are addressed, and more focus is given to the
benefits of remote operation for the agency, its employees and its customers. WG 192 uses reference
projects of the participating countries to address technical developments, lessons learnt and success
factors for remote operation. By providing these noteworthy examples and lessons learnt, WG 192
strives to give the reader an overall view on current results, trends and ideas. Moreover, it includes a
technical point of view and the interaction between technology and organisation.

In addition to the technical developments, safety is still the number one priority. The theory of risk
assessment and risk reduction is specified throughout the report. In Europe, compliance with the
machinery directive when implementing remote operation is not yet standardised and there is much
debate about the definition of significant modifications. This background is included as a guidance for
safety certification.

WG 192 emphasises the importance of the human factors and the need for standardisation. The
ergonomic principles, workload balance and control room design are described in detail with some clear
examples and reference projects.

Following the design of an overall system architecture, standardisation is found to be necessary in the
transition towards remote operation. Managing the complex systems is only made possible by the
introduction of standardised processes and procedures.

The report touches upon the link with information and traffic management. Remote operation and
automation of locks and bridges is not the goal, but the way to roll out the business and organisational
strategy focussing on traffic management and corridor management and higher service levels for the
shipping and logistics sector.

10
3 BUSINESS CASE DEVELOPMENT FOR REMOTE OPERATION AND
AUTOMATION
3.1 Introduction to Business Case Development
This section will set out the framework for establishing a business case for remote operation. According
to the business case, which covers the reason for initiating a remote operation project, the costs,
benefits, risks and opportunities can be evaluated.
For countries considering the implementation of remote operation of movable bridges and locks, the
experience of other countries can be very useful in the development of their own business case.
Therefore, the business case below can provide parties who currently operate and maintain bridges and
locks locally, with a brief, high-level understanding of key factors that should be evaluated when
considering a change to remote operation as well as practical examples of remotely operated facilities
or those under consideration.
The following topics or key factors outline the content to be included in the business case. Moreover, it
comprises the questions that need to be addressed and a first possible answer to these questions.
 Agency Motivation:
Why agencies decide to implement remote bridge or lock operation?
 Customer Service and Support:
How have shipping companies and other users reacted to the change?
 Design, Construction, Operation and Maintenance:
What are the key factors that should be considered during the design, construction, operations and
maintenance phases?
 Workforce Change and Development:
What is the initial and current reaction of the workforce to the change and the major focus of
workforce development necessary to implement the change?
 Risk and Benefit Assessment:
What are the greatest risks and benefits associated with remote bridge and lock operation?
 Approximate cost and benefits of the project:
What are the approximate costs and benefits linked to the remote operation project?
 Future Outlook:
What are the trends in traffic, both in volume and nature? Will it potentially change the balance
between cost and benefit?

3.2 Benefits vs. Costs

When implementing remote operation, there are many factors to take into consideration. In this section,
a business case framework is built based on the reference projects and experiences of the several
members of WG 192. Following table summarises the one-off and recurring benefits, costs, risks and
opportunities.

11
 One-Off/Non-Recurring Recurring

 Traffic management
 Information management
 Standardisation
 Increased reliability
 Increased availability which leads to
increased customer service and
 Operator transition experience
BENEFITS  Facility condition analysis  Optimisation of operation workforce
 Innovating government  Less working time injury and safer
working environment
 Local, small maintenance
 Improved corporate identity
 Improved balance of workload
 Change in necessary skills and
competences
 More flexible deployment planning

 Operator transition
 Project costs
 License acquisitions  FTE Costs
 Local reengineering in installations  Continuous training of operational
COSTS  Hardware acquisition/construction staff and maintenance staff
costs  Maintenance
 Facility condition analysis  Cybersecurity
 Security systems and access control
 Reallocation costs

 Personal adjustment for the operators

 Less social interaction between skippers and operators
 No local presence or knowledge
RISKS  Limited possibility of direct intervention
 Observation
 Communication with recreational crafts
 Equipment dependent

 Economy of scale
OPPORT-  Social and reputational impact
UNITIES  Annual cost savings by automating/remotely operating can be re-invested into the
waterway navigation network

Table 4: Summary of the benefits, costs, risks and opportunities

Benefits

One-Off/Non-Recurring

 Operator transition: remote control and automation offers a solution for a safer operation and work
environment in comparison with manual operation.
 Facility condition analysis: the implementation of remote control goes together with a better
monitoring of conformity and safety checks for locks and bridges, that were possibly delayed before.

12
 Innovating government: when making the transition to remote control or automation, the
organisation has the possibility to apply for public grants. Governments could be willing to support
the necessary investments and transition since investing in mobility and a broader use of the
waterway network can increase the importance of waterway transport and shift traffic from road to
water.

Recurring

 Traffic management: the benefits are twofold: remote control helps to realise an effective and
efficient service with decreased trajectory time on the one hand while on the other hand ensuring
an optimal utilisation of the waterway network by all involved parties in the logistic chain. Both inland
waterway traffic flows, as railway and road traffic can be organised in a smoother way, with shorter
waiting periods. In other words, remote control and automation supports traffic management where
different traffic flows are planned, monitored and handled.
 Information management: remote operation and automation are excellent sources of data which can
increase the knowledge of the network. Data logging of traffic, number of operations, etc. can be
done for a number of reasons such as traffic planning and structural health monitoring for the
maintenance of infrastructure. Besides, information management is a crucial step towards real-time
traffic management and RIS-enabled corridor management.
 Standardisation: by introducing remote control and automation, operation sequences and processes
can be performed in a more consistent way, hence limiting human error.
 Increased reliability: depending on the design of the remote operation system, a single point of
failure could be introduced which could reduce the reliability of the whole canal/system. Therefore,
redundancy must be taken into account for more crucial waterways, canals and infrastructures to
enhance reliability.
 Maintenance plan: the bridges and locks are controlled from a remote control centre, from which
maintenance can be coordinated from a higher level and in a more cost-efficient and structured way.
 Increased availability: by performing operations from a remote location or in an automated way, it is
possible to extend the operating hours in a convenient and straightforward way without great
additional costs for operators. This way 24h/7d service becomes possible and feasible. In its turn,
an increased availability will improve the customer service and experience.
 Optimisation of operation workforce: by controlling and monitoring locks and bridges from a central
location, it is possible for a single operator or a small group of people to operate multiple
infrastructures at the same time. This way, one can increase the operating time with the same or
even a reduced workforce and as a consequence reduce the operational costs. Furthermore,
working in a remote-control operation centre is an opportunity to work together, improve collegiality
and learn from each other. Finally, more efficient operational deployment of employees can make
room for new tasks or for improvement of tasks that are shabbily treated in the past.
 Working time injury: since operators are no longer performing local, manual operations, the risk of
accidents and injuries are reduced. Thus, remote control can lead to a more ergonomic and safe
work place.
 Local, small maintenance: removing snow and ice, mowing, etc. can be reduced to a minimum when
attention is paid to the organisation and design of local buildings. These tasks can also be organised
in a more cost-efficient way, for example by subcontracting these tasks or handing them over to an
internal maintenance team.
 Improved corporate identity: improved corporate identity and image by using advanced technology
to meet today’s standards. The organisation can be seen as an innovative and modern workplace.
 Improved balance of workload: e.g. during peak moments (heavy traffic, incidents, calamities, etc.)
operators can assist each other.
 Change in necessary skills and competences: remote control and automation often means that an
operator needs to control more locks or bridges, which gives him or her more responsibility and a
more varying working condition. This introduces more task variation but also involvement of the
operators, which can lead to a higher job satisfaction.
 More flexible deployment planning (e.g. sick leave or holiday): since the employees will be
centralised in a remote control centre, there are more options and possibilities to plan holidays or
cope with sick leave.

13
 Costs

One-Off/Non-Recurring

 Operator transition: working in a remote control centre or with an automated infrastructure requires
a new and different skill set. Operators need to be trained during the transition or new operators
need to be recruited. Furthermore, in order to make a successful transition from local to remote
operation, it is necessary to provide training and assistance to the operators. This will facilitate the
transition and improve acceptance to the new way of working. The operators must not only be
familiar with operational procedures, but also must learn how to take advantage of the new
technology.
 Project costs: this item includes e.g. the design, development, training and move to production of
the automated systems, and will therefore include in-house FTE costs as well as external contractor
costs.
 License acquisitions: initial license acquisitions related to automation should be considered, i.e.
automation software as well as any potential other related software costs.
 Local reengineering in installations: local installations will need to be renovated or updated in order
to be remotely controlled or automated.
 Hardware acquisition/construction costs: building a remote-control operation centre demands big
investments in terms of hardware acquisition and construction works.
 Facility condition analysis: costs related to performing conformity and safety checks on locks,
bridges and remote-control operation centres.
 Security systems and access control: local presence on locks and bridges is no longer guaranteed.
To prevent unauthorised access to local infrastructures security systems and access control should
be provided.
 Reallocation costs: as soon as some of the employee's roles will be made redundant, the associated
cost reductions and costs to reallocate them to a new role should be included in the business case.

Recurring

 FTE costs: with the deployment of remote control, time and effort will be allocated to the
implementation. This should be defined in contrast with the decreased workload, as operational
resources might be changed into automation positions.
 Continuous and ongoing training of operational staff and maintenance staff
 Maintenance (Hardware, construction maintenance, telematics, IT, maintenance and licenses):
remote operation and automation are to a very large extent technology-dependent and hence
require the necessary maintenance so the systems can function without technical failures.
 Cybersecurity: by introducing a more complex network, cybersecurity becomes more important and
the necessary security measures should be established.

Risks

 Change for the operators: operators will have to adjust to this new way of working which requires
personal adjustments and different competences such as teamwork, etc. Because of their local
knowledge and experience, operators should be involved in the change process to manage the work
environment and internal communication. Timely and transparent communication is imperative.
Furthermore, operators need to be consulted in the planning and design of the remote control centre.
Including them in the focus group shows that their concerns are taken seriously, which can motivate
and help them to accept the transition. Sufficient time and attention must be given to the preparation
and communication to the operations staff concerning the move to remote operation centres. Not
every operator will adapt easily to the change. Operating locally requires a different mind-set and
skills and relies more on the physical senses than operating remotely, where the operator depends
on technology to provide awareness of site conditions.
 Social interaction with the skippers: direct contact is no longer possible which will result in less social
interaction between skippers and operators. Especially, leisure users on smaller locks notice the
absence of personal conversations and communication with the local operator. The operator
becomes an anonymous person at a distance. Therefore, it is very important to inform users properly
(especially during the transition period from local to remote). E.g. a digital information panel can

14
 help to solve this problem by displaying for example the expected waiting time, a phone number, a
response that the waiting ship has been spotted and is put in queue, etc. Communication and
guidelines will be given by VHF.
 No local presence or knowledge: there is no local operator to notice abnormal sounds, collisions,
crunching, engine sounds, etc. Moreover, the absence of a local operator limits the possibility of
direct intervention in case of malfunctions.
 With a central remote control centre, an operator is no longer present in situ and the ‘observation
task’ becomes more intensive.
 Not all recreational crafts are equipped with the required communication tools to interact with the
remote-control operation centre.
 The dependency on reliable high-tech equipment becomes very strong. This can be tackled by
checking the balance between redundancy, high-quality equipment, spare parts, highly competent
maintenance staff and an O&M organisation with the corresponding response time and acceptable
down time.
 Customer Service and Support
 Generally, for the WG 192 participating countries, shipping and other users have not felt any
nuisance. The effects for them are consistently positive, e.g. shipping companies mostly welcome
remote operation, especially if one of their demands is an increase in the operation time. But in most
cases vessel operators have experienced few to no difficulties with the implementation of remote
bridge operation.

Opportunities

 By grouping operations and operators in a central location, economies of scale can be attained with
regard to workforce planning, buildings, etc.
 Remote operation and automation are not solely intended for optimising workforce and enhancing
traffic management but also has a deep social and reputational impact. Companies and
governments can profile themselves as progressive and forward-looking with particular attention for
the changing needs of the personnel and waterway network users. The approach can be to embrace
tasks that are either new or that were neglected until remote control was implemented. The scope
of the reorganisation can therefore be widened to also include new tasks or increase the efficiency
of the current tasks. Another approach can be to increase the operation times while maintaining the
same operation cost and more attention can be paid to ship movements and the impact on rail and
road traffic.
 Annual cost savings by automating and remotely operating can be re-invested into the waterway
navigation network.

3.3 Notes on the Business Case

Implementation

When implementing remote operation, it is necessary to establish a long-term corporate strategy and to
define the organisational goals. The implementation will therefore be a step-by-step introduction to
remote operation throughout the organisation. The following steps must be taken:

 Organise, chart interests and involve major stakeholders (users, skippers, local communities, road
traffic, railway traffic, operators, etc.).
 Make an inventory of traffic flows and the current state of objects.
 Make an inventory of maintenance projects.
 Determine the consequences of remote control of objects in function of all the above.
 Draw up a Functional Program of Requirements (FPR).

Only after the phases above have been completed, a collective discussion on possible solutions can be
started. In this discussion, innovative concepts (monitoring traffic and proactive thinking in traffic centres)
need to be incorporated.

15
 Life Cycle of Control and Network Equipment

Life cycles of control and network equipment are considerably lower in comparison to infrastructure
works. Electromechanical equipment typically has a life cycle of 25 years, while automation components
and network equipment like PLC’s only have a life cycle of 10 to 15 years. These lower life cycles ask
for a different approach, for example software upgrades might be included in the maintenance contract.

Design, Construction, Operation and Maintenance

When planning to remotely operate any structure, key considerations include:

 Standardisation
Due to the number of remotely operated infrastructures, standardisation is considered the key
element to guarantee a safe operation. Therefore, it is important to invest a substantial amount of
effort in (re)defining new technical and procedural standards before starting the implementation.
Standards need to be developed for an optimised design, comprising the entire process system and
including the element of staffing, design and arrangement of workstations and components, as well
as the graphical user interface for operation, visualisation and camera plan. For the acceptance it is
important that the users and personnel representatives are deeply involved in the development from
an early project stage.
 Reliable, local infrastructure
It is important that all the mechanisms and structures are perfectly functional. All connections to
existing systems can be the source of a problem and, therefore, must be identified and managed
before construction. All functions of the bridge or lock must be tested and evaluated to determine
whether they are suitable for remote operation. In addition, the operation processes and safety
issues must be evaluated. It is possible that an upgrade of bridge/lock operating machinery and
control systems is necessary to maintain or improve the reliability according to all control system
functional safety considerations. Regarding the future, it can also be important to ensure extra space
for future extensions.
 Secure and reliable communications infrastructure
Time and resources must be invested to implement a reliable and resilient communication system
that allows the remote operator to safely operate the structure.
 Sufficient camera views, image refresh rates and camera resolution
Since the operators are no longer present on the local structures, camera systems must be provided
that allow the operator to maintain situational awareness of the surroundings. When the operator
operates locally at the structure itself, there is a high dependence on visual inputs. Remote control
requires that the operator has critical camera views to ensure that the operator has an overview of
the operating conditions.
 Remote emergency stop
Remotely controlled infrastructures must be provided with a secure and reliable emergency stop
system to secure safety at all times.
 Impact on local maintenance
A local operator has his place in the maintenance chain. He detects a strange noise, vibration or
leak, informs the users of the waterways and sometimes performs local maintenance, e.g. cutting
the grass, painting if necessary. All these tasks must be identified and managed in order to continue
delivering them. Maintenance subjects are particularly important and are implemented by using a
clear and robust protocol. In the design for maintenance, the following elements need to be
considered:

- Implementation of thoroughly planned and unplanned maintenance to maintain reliability

- Back-up/call out plans in the unlikely event of failure in the chain of operation
- Standardisation of hardware and software
- Investment in thorough training of the maintenance staff. The maintenance staff must be
involved in all stages of the design and build phase and must test everything together with the
contractor when commissioning.
- Check and follow-up on documentation, so that it is very detailed, up-to-date and as-built at the
time of commissioning.
Changes in the process of asset management are described in Chapter 5.2.2.

16
 Risk Assessment

All the risks that can affect the lock or bridge structure, public users, professional users, teams, including
environmental impacts must be identified and managed in a risk assessment.

The greatest risks to remote operation are system availability and operator awareness. These cannot
be overlooked, but luckily there are many ways to successfully address these concerns.

To ensure the same safety level as local operation when operating remotely, attention should be given
to technical and operational changes. In the past, limitations existed by communication latency and slow
response times caused by the transmission technology. Today, by the use of privately own fibre optic
network cables, defined SLAs are possible.

As a result of remote operation of locks or bridges there often is no one at the object in situ, which means
a keeper cannot act directly locally in case of emergency. So, safety systems or facilities (buoys,
emergency buttons, communication) must be easily reachable and usable, so that maintenance teams
or for example emergency services can easily find these and operate or repair the infrastructure.
Equipment should be designed in such a manner that it is both reliable and maintainable. Procedures
for the remote operation also have to be defined (for example how to contact and communicate with the
emergency services) and attention must be paid to the design of a camera plan. If the bridge or lock
does malfunction, downtime could increase compared to having staff immediately available on site.
Hence it is important to minimize the chances of malfunctioning or defects and have sufficient options
in place to be on site quickly and fix the defect or malfunction. Finally, the maintenance plan needs to
be worked out thoroughly to ensure that remotely operated bridges or locks are and remain in a good
condition.

The design principles for risk assessments are included in standard ISO 12100 – Safety of machinery.
Samples of risk assessment tools and the necessary guidance can be found in this standard. The
process of risk reduction is further explained in Chapter 8.3.

Economies of Scale

When investigating the costs and benefits of implementing remote operation, it is important to realise
that there is also an important learning curve on a technical as well as on an organisational level.

On a high level of abstraction, the operation of most locks (or bridges) do not differ a lot. It is therefore
wise to invest a substantial amount of effort in (re)defining new technical and procedural standards
before the implementation. These standards must allow for some flexibility since the real-world situation
will vary to a certain degree from installation to installation.

During this exercise the problems on what are deemed as ‘difficult’ installations need to be tackled. It’s
worthwhile to consider using these installations in a first proof of concept. Not only will give this increased
confidence in the quality of the end product during the further roll out to all the other less difficult
installations but it will also help to mitigate the resistance to change.

These actions will take a lot of effort and the associated costs will be quite substantial. However, if this
exercise is done thoroughly, only minor adaptations would be needed when going to the next installation.
Furthermore, the related extra costs per installation will be close to negligible, where total benefits on
the other hand could be substantial.

Communication Network

An extremely important yet expensive part of most remote-control projects is the communication
network. Although high quality hardware in itself is already far from cheap, it is almost always the fibre
optic cables that take the biggest chunk out of the remote-control budget. It is not the cables themselves
that are expensive, but the work needed to make trenches, making river crossings, underground
crossing of roads, repair pavements and asphalt, etc.

One option is to find external parties that might be interested in a collaboration to split the investment
costs. For certain trajectories a partner can be found with for instance the national railroad company, so

17
they can put their cables alongside those for remote operation. Another business model is to foresee as
many cables as possible and then lease some of the cables or a part of the fibres to third parties (one
optic cable can easily contain 100+ fibres and typically far less is required for remote control).

It is important to note that these cables are considered as basic infrastructure of the utmost importance.
Therefore, the O&M management should preferably remain in the hands of the asset management
organisation that does the O&M of the locks and/or bridges.

Rallying External Stakeholders to Help Promoting a Project

It’s important to ensure that the external stakeholders understand that there are benefits for all parties.
For every change it is important to be able to answer their question ‘What’s in it for me?’. Generally, for
the WG 192 participating countries, shipping and other users have not felt any nuisance. The effects for
them are generally speaking positive, e.g. shipping companies mostly welcome remote operation,
especially if one of their demands is an increase in the operation time. In most cases vessel operators
have experienced few to no difficulties with the implementation of remote bridge operation.

Note that external stakeholders not only include the usual day-to-day customers or authorities, but also
contractors for example. If they have the prospect of challenging and contributing to profitable projects
for a longer period, they might play an important role in promoting, lobbying, sharing the work load and
propelling the project.

3.4 Current Situation in the Different Countries

This chapter includes a description of the progress and current situation in all countries in the PIANC
WG. A short summary is included for all participating countries. Please note that this chapter gives a
general and comprehensive overview of the overall current situation in a country, where the reference
projects mentioned in Chapter 1.2 give concrete examples how remote control can be implemented
within a country or organisation.

Belgium

‘De Vlaamse Waterweg’ (Flanders, Belgium) is implementing remote operation to work towards a
dynamic management of all waterways in Flanders. Within this waterway network, there are more than
200 locks and movable bridges to facilitate the waterway navigation including the road and railway traffic.
Pumping stations and barrages allow the water management to control water levels and flows on these
waterways.

To ensure the safe and efficient operation, 365 days/year, remote operation is implemented in clusters
according to corridor management, ship navigation guidance and waterway management. Larger
clusters of installations (locks, bridges and pumping stations) and longer corridors of waterways are
controlled by a team of operators located in a centralised control room. Clustering in function of waterway
corridors is implemented to enhance the service to waterway traffic, allowing a more efficient way of
operation, better control of the navigation on the waterways and more efficient water management on
rivers and canals.

One of the already installed remote operation centres is located in Zemst. This centre is responsible for
operating all movable bridges and locks on the Brussels-Schelde Maritime Canal. It is operated 24/7,
by means of three shifts a day and every shift staffs three operators and one VTS-operator. The traffic
on the canal consists mostly out of commercial vessels. There are around 130,000 commercial ships
per year compared to 3,600 leisure ship, which leads to approximately 54,000 operations per year.

However, as locks and movable bridges are large and complex machines, the remote control requires
special attention with respect to safety, reliability, availability and standardisation. Therefore, an overall
management decision on standardisation became necessary.

In 10 years, remote operation will be the standard and will have been further developed with regards to
redundancy and efficiency. More focus will be on corridor management, ship navigation guidance and
waterway management.

18
The Port of Antwerp has conducted extensive trials on two of its major sea locks and a twin bridge with
road and rail traffic. A test remote control centre has been set up with five prototype control desks. This
elaborate proof of concept proved that remote control of complex installations is feasible without any
significant negative impact. In the near future, this test centre will be used as a testing ground for the
further design and development of the future remote control centre organisation.

Germany

The introduction of remote operation in Germany goes back to the middle of the nineties. Today
approximately 50 % of the 315 locks in Germany are remotely controlled. For design and operation of
lock operation centres, standards were developed and introduced by the German Waterways and
Shipping Administration. Based on these standards, 11 operation centres serving more than 110 lock
chambers are currently being planned or are already under construction. A new development within
remote control in Germany, is cooperation with or handover to centres in case of failures or during
periods of less traffic. Furthermore, simulator training is being developed.

In 10 years, remote operation will be the standard and lock management will be incorporated even more
into the centres, i.e. more coordination of traffic. However, developments on the user side, e.g.
autonomous ships etc. have to be taken into account when designing and implementing remote control.

France

The French waterways can be separated in two parts; one for commercial use, while the other is used
for leisure. There are connections between the canals, but in general small canals (locks < 40 metres)
are mostly for leisure navigation, whereas the bigger canals are for commercial purposes. The
commercial areas need extended opening hours all year, while leisure canals are mostly used during
summer and have less need for this. To reduce the staff costs, France has been automating small canals
and implementing remote operation of big locks and bridges for more than four decades. Nowadays,
almost 100 % of the major network (managed by Voies Navigables de France or VNF) is automated or
remote operated.

In the future, the small canals only used for leisure, or isolated locks and bridges, will remain manually
operated.

UK

Operation of the locks and bridges is a part of the leisure experience. The implementation of remote
automation of locks and bridges is limited in the UK. This is primarily because of financial constraints
due to the limited revenues which can be generated from leisure craft which accounts for the majority of
inland waterway traffic.

The automated Sandfield Bridge on the Gloucester and Sharpness Canal is quite unique in this view.
There are other examples of similar automation solutions and remote operation solutions, but they are
limited. The bridge is 21.2 m long, weighs 40 Tonnes and carries a single-track traffic. It spans the canal
which is approximately 20 m wide (narrowing to 10.8 m width under the bridge).

The bridge is operated by the boat user using a smartphone app. The bridge has been designed to be
inherently safe, using laser scanners to monitor for obstacles on the road deck (cars and people) and
underneath the bridge at water level (boats).

Notwithstanding the safety function-based deck and water laser scanning system, the installation is
relatively non-complex. The control system is based on the standard CRT solution. The CCTV is also
relatively simple in a way that it is not based on a dedicated (fibre) link and it is neither redundant nor
essential to safe operation.

The potential for future scheme development is limited. But it is planned that 14 other bridges (next to
the already automated Sandfield Bridge) on the Gloucester and Sharpness canal will be converted to
remote operation within the next 10 years to fully realise the identified potential cost savings.

19
The Netherlands

Rijkswaterstaat is responsible for the design, construction, management and maintenance of the main
infrastructure facilities in the Netherlands. This includes the main road network, the main waterway
network and water systems.

For the water systems, dry feet and sufficient clean water is reliable and useful information. That is what
integrated water management means to Rijkswaterstaat. Smooth and safe transport by water are other
ways of using water.

The Dutch waterway network is the densest in Europe. About 6,000 kilometres of rivers and canals,
many of the latter serving drainage as well as navigation, form a complex system serving all parts of the
country.

The main commercial waterways (Class IV and higher), with a total length of 2,200 kilometres, account
for about 40 % of international freight movements in the Netherlands and 20 % of domestic freight. The
main network is state-owned and operated by Rijkswaterstaat. Smaller waterways are managed by
many different provincial authorities or drainage boards. Rijkswaterstaat has 84 locks and 278 bridges.

Rijkswaterstaat has a lot of experience with design, building, operating and maintenance with remote
control bridges and lock. The first remote operating started in the early ’80. Nowadays we standardised
the requirements for operating and design with Rijkswaterstaat bridge and lock standard (LBS). For the
IT networks we have chosen for technical standardisation with solution building blocks.

Rijkswaterstaat has an i-vision and i-strategy with a horizon until 2025. To achieve higher quality, better
response to further digitization, changing requirements, cyberthreats and lower life cycle costs, there is
need for further standardisation in hardware and software with architecture- and solution building blocks
for operating-desks, operating-, control-, safety-, audio- and video systems.

USA

Currently, the United States is in the beginning stages of remote operation and automation for Lock
Facilitates. However, other forms of automation are in wide usage. Notable examples include the remote
operation of Dam gate controls on both navigation and flood risk management projects operated by the
US Army Corps of Engineers. Numerous local operators and Port Authorities also employ remote
operations in bridge infrastructure. The Army Corps of Engineers has completed the design of a
demonstration project with the Pittsburgh District of the USACE for remote operation at the existing lock
at Grays Landing in Pennsylvania, but funding is not in place for its implementation. There is also a new
lock complex project near Houma in Southern Louisiana where remote operation will be in use, but the
design is only 60 % complete.

Automation appears to be a viable solution to the increasing maintenance requirements of aging

infrastructure in the United States. Increasing base operations costs due to labour have continued to be
one of the largest cost drivers of operating civil works infrastructure and the implementation of remote
operations appears to be a potential avenue to shift scarce Operations and Maintenance (O&M) funds
from labour to much needed maintenance. In ten years, the use of remote bridge and lock operation in
the USA will still be behind the countries in Europe and in Canada, due to many issues including liability,
security, lifecycle maintenance costs, diverse design staff, and other projects competing for limited
resources. There will be projects implemented by then but nowhere on the scale or complexity as done
elsewhere.

Canada

The St. Lawrence Seaway Management Corporation (SLSMC) started remote operation of its large
movable bridges in 2003. The primary drivers were to increase operator safety and to reduce operational
costs.

Prior to 2003, the bridge operators worked alone at each bridge structure. The operator room was
incorporated into the movable portion of most of these bridges. This put the operator at risk if there was
an incident involving a vessel contacting the bridge. Moving the bridge operators to the Operation

20
Control Centres (OCC) allowed them to work in a safer environment, made operational coverage for
breaks possible, etc. Thanks to the transition to remote operation, SLSMC was able to reduce bridge
operations staff by 50 %.

SLSMC started a programme in 2013 to remotely operate all its locks. With the implementation of the
Vessel Self Spotting and Hands-Free Mooring systems, it is no longer required for the operations staff
at the locks to manually tie-up vessels. Removing the need for manual tie-up allowed SLSMC to reduce
operating staff by 67 %, leaving only the operator at the lock.

The implementation of remote lock operations drew heavily on the experience gained and technological
infrastructure already in place from previous remote bridge operation work. Moving the lock operators
to the Operations Control Centres not only provided similar employee safety benefits but also allowed
an additional 50 % reduction in lock operations staff.

In the table below there are five examples of remote control centres. For every centre there is stated
how many employees are staffed, how their shifts are structured, how many objects the centre controls
are controlled and how the centre is structured. Also, information is given concerning the traffic density
and the number of operations the centre executes.

21
 Aschaffenburg LOC, Maasbracht, St-Lambert Centre, Welland Centre,
Waterways and shipping Rijkswaterstaat, St Lawrence Seaway St Lawrence Seaway
administrations, Germany Nederland Management Centre, Canada Management Centre, Canada

8 people/shift 10 people/shift
Coordinator - 1 CSSO - 1 CSSO
Number of 34 OP’s1
Lock/bridge OP’s - 2 Traffic controllers - 2 Traffic controllers
employees 1 head of the centre
Water management OP’s - 4 OP’s - 6 OP’s
- Security desk - 1 Dispatcher
24/7 24/7 24/7 (20/03-31/12)2 24/7 (20/03-31/12)1
Operation period
3 shifts (8 hours) 3 shifts (8 hours) 4 shifts (12 hours) 4 shifts (12 hours)

17 objects 12 objects 18 objects

- 12 locks - 4 locks - 10 locks
# locks and bridges 12 locks - 1 bridge (4 adjoining bridges) (4 adjoining bridges)
- 4 dams - 4 bridges - 4 bridges
- 2 pumping stations

# operator desks 12 desks 10 dual desks 11 desks 19 desks

Size and structure of 3 control rooms 1 control room (125 m²) 1 control room (176 m²)
/
the centre 80 m² each CSSO3 office (20 m²) CSSO office (15 m²)

2 OP’s operate 4 bridges

# objects controlled Maximum 2 events at same time. Maximum 2, but only operates An OP controls 2 bridges or 2
2 OP’s operate 4 locks
by one OP Limitations on critical operations one object to a defined position locks
2 OP’s operate 6 flight locks

Commercial: 80,000/year Mixed commercial and leisure Mixed commercial and leisure
Traffic density Mainly commercial
Leisure: 23,000/year Commercial: 30,756/year Commercial: 38,292/year

# operations 96,000/year

Table 5: Remote control centres and their characteristics (1)

1
OP = Operator
2
From 1/01-19/03, winter shut-down: operations centre is staffed (security, water watch, etc.)
3
CSSO stands for Canal Service Supervisor, Operations

22
 Zemst Centre, Mouy-Sur-Seine, Châteauneuf-du-Rhone,
De Vlaamse Waterweg, Voies Navigables de France, Centre de gestion de la navigation
Belgium France sur le Rhône, France

1 head of the centre

3 OP’s/shift 36 OP‘s
Number of employees 3 OP’s/shift
1 VTS OP/shift 6 OP’s during daytime (5 a.m.-10 p.m.)
3 OP’s during night

24/7 Weekday: 14 hours

Operation period Weekend: 9 hours 24/7
3 shifts (8 hours)
Extra hours – fee

13 objects
- 1 lock 11 objects 15 objects
# locks and bridges - 7 locks - 14 locks
- 9 bridges
- 4 dams - 1 bridge
- 3 pumping stations

3 dual OP desks
# operator desks 1 VTS OP desk 7 OP desks
8 dual desks
(one per lock)
1 back-up desk

Size and structure of the centre 1 control room (105 m²) 1 control room (70 m²) 1 control room (150 m²)

Maximum 2 events at same time.

# objects controlled by one OP One at a time One or two
Limitations on critical operations

Commercial: 130,000/year Mainly commercial Mainly commercial

Traffic density
Leisure: 3,600/year 25-30 boats/day Leisure: 15,000/year

# operations 54,000/year 90,000/year

Table 6: Remote control centres and their characteristics (2)

23
3.5 Operating Methods
Selecting the type of operating method is a decisive factor for assessing the business case for a remote
operation project since it has a big impact on the costs, benefits, risks and opportunities of the project.
For example, certain methods involve very limited investments cost with the consequence that they
might pose different risks to operators and users of the waterway network. Below a general overview of
the different methods of operation is given, taking into account the advantages and disadvantages.

Overview

All operation methods can be defined by combining the degree of automation, the type of operation
and the kind of operator.

Degree of Automation:

- Hand operation
Operation of an unpowered structure.
Unpowered operation, where movable structures or components that are not equipped with
motors provide the driving force for operating the lock or bridge.

- Manual operation
Powered operation, where every decision during the lock or bridge sequence is made by a
human, not a computer.

- Semi-automatic operation
Powered operation, where some decisions during the lock or bridge sequence are made
manually by a human and some are made automatically by relay circuitry or computer logic.

- Active automatic operation

Automatic operation, where all decisions during the lock or bridge sequence are made by
relay circuitry or computer logic, but the sequence must be set into motion by the manual
decision of a user/keeper.

- Passive automatic operation

Fully automatic operation in which all decisions during the lock or bridge sequence, including
initiation of the first action, are made by relay or computer logic based on sensor input that
determines the presence of a user or vessel.

Types of operation:

- Local operation
Operation from a position near the site and with a direct view of the structure.

- Remote operation
Operation without a direct view of the structure, but using CCTV, SCADA and communication
technologies for an overview of the situation.

Operator:

- Keeper
A person employed by or acting on behalf of the waterway authority to operate the navigation
structure.

24
 - User
Any person other than a keeper who has reason to operate a navigation structure.

The possible operation methods are summarised in following table.

Automation Operation Operator

Unpowered hand operation Local User
Unpowered hand operation Local Keeper
Manual operation Local User
Manual operation Local Keeper
Semi-automatic operation Local User
Semi-automatic operation Local Keeper
Semi-automatic operation Remote Keeper
Active automatic operation Local User initiated
Active automatic operation Remote Keeper initiated
Passive automatic operation / Detection

The following flow diagram clarifies the possible relationships among the different degrees of automation
and operation and shows how the different operating methods are possible.

25
Figure 1: Summary of the relations depending on the degree of automation and operation

26
 Advantages and Disadvantages of Different Methods of Operation

Automation Operation Operator Advantages Disadvantages Preferred waterway

- Safety for the user is low (no training, possible
+ Low cost (no operators, no automation) Leisure canals with
Hand operation Unpowered User wrong operating sequences, climbing from boat)
+ Low investment cost low traffic
- Less efficient operating method
- High operating cost
+ Few competencies needed for operation
Hand operation Unpowered Keeper - Can be hard labour for the operator /
+ Low investment cost
- Less efficient operating method
+ Low cost (no operators, no automation) - Safety for the user is low (no training, climbing from Leisure canals with
Manual
Local User + Reduction of the risk of wrong operation boat) low waterway traffic
operation
sequences - Less efficient operating method and low road traffic
+ Few competencies needed for operation
- High operating cost Leisure, preferable
Manual + Safe operation
Local Keeper - Less efficient operating method with high waterway
operation + Reduction of the risk of wrong operation
- Less operating time for the operator of one object traffic
sequences
+ Low cost (no operators) - Investment for the safety for the user is high and Leisure canals with
Semi-automatic
Local User + Improved safety because of semi- there remain some safety risks (operator has no low waterway traffic
operation
automated operation sequences training, climbing from boat) and low road traffic
Commercial/Leisure,
Semi-automatic + Safe operation - High operating cost
Local Keeper preferable with high
operation + Efficient operation - Less operating time for the operator of one object
waterway traffic
+ Safe operation
- Higher maintenance cost
Semi-automatic + Efficient operation Commercial/Leisure
Remote Keeper - High investment cost (network, safety stop and
operation + Lower operation cost (but higher profile High and low traffic
safety PLC, CCTV, communication, etc.)
operators needed)
- Need for SIL certification and reliable detection
+ Safe operation
Automatic User systems Leisure canals with
Local + Efficient operation
operation initiated - Very high investment cost low road traffic
+ Low operating cost
- Very high maintenance cost
- Need for SIL certification and reliable detection
+ Safe operation
Automatic Keeper systems Commercial/Leisure
Remote + Efficient operation
operation initiated - Very high investment cost High and low traffic
+ Low operating cost
- Very high maintenance cost
- Need for SIL certification and reliable detection
+ Safe operation
Automatic systems Commercial/Leisure
Passive Detection + Efficient operation
operation - Very high investment cost High and low traffic
+ Low operating cost
- Very high maintenance cost

Table 7: Advantages and disadvantages of different methods of operation

27
4 ORGANISATIONAL IMPLEMENTATION
4.1 Organisational Design
Concerning the organisational design for remote control and automation, several aspects need to be
taken into consideration. Listed below are the different aspects focused on relevant specificities, when
relevant, of these aspects in a remote-control organisation. For some of these aspects, a dedicated
chapter is included in the report.

Structure
How can the organisational structure change to accommodate remote control?

It is necessary to analyse the current organisational structure and carefully consider if and what changes
are needed in light of the implementation of remote control. In case a change is required, the new
organisational structure needs to be translated into organisation charts and relationship hierarchies, with
the appropriate spans of control and management layers.

Resources
Who will be a part of the remote-control processes?

It is important to consider the different types of people that are required to work in the remote-control
organisation. The work related to remote control requires a different skill set than the one required for
local operators. There is more emphasis on collaboration, the tasks are less physical and might be more
difficult to manage (for example in terms of performing several tasks at the same time). Finally,
implementing remote control means that the headcount, workload, and associated FTE requirements
can be optimised.

Roles
Which roles will be introduced or disappear when transitioning to remote control? Who is responsible
for which part of the process?

It is crucial to have clear roles, responsibilities and accountability within an organization. Before remote
control, each operator was responsible for his own local operation; after implementing remote control,
operators in a remote control centre will have to work together and must depend on each other. Clear
roles and responsibilities also set process priorities which subsequently optimise performance. For more
information about the roles and responsibilities related to remote operation, we refer to Chapter 5.

Processes
What are the core processes that underpin the organisation’s ability to deliver its organisational
objectives?

Since the purpose of the remote-control process is to deliver a service to the customer, the remote-
control process might be seen as one of the core processes of the organisation. The shift to remote
control eliminates the manual and physical processes in favour of on-screen operation and automated
processes, which means there is great potential for a higher degree of standardisation.

Governance
What is the governance model of the organisation – centralised, decentralised, a mix between both?
What metrics are in place to measure how the organisation is performing? Where are the key decisions
made?

In general, the governance structure to be applied to the remote-control organisation will be centralised,
because automation inevitably leads to the transition from a decentralized to a more central model. In
order to measure how well the organisation is performing, in terms of remote control, new KPI's need to
be identified in comparison to the local operation process.

29
Infrastructure
What are the core systems and tools that the organisation uses? Are these fit for purpose? Does the
organisation manage and govern its data? Is the data high-quality and accepted as high-quality?

For a more detailed overview of the considerations and requirements concerning infrastructure and data
management we refer to Chapters 6 and 10.

Performance
How is performance management organised and how does that influence how people are rewarded?

By centralising the operations, performance can be measured in a more direct way. In addition to
individual targets, targets at group level such as for example the waiting time for vessels, number of
vessels on the waterways, satisfaction of the user will ensure positive contribution to the objectives of
the organisation.

Culture
What are the values that the organisation has set forth, and how does that affect the culture? E.g. is
there a general resistance to change? Or is everyone within the company looking forward and eager for
new evolutions?

The importance of a thorough change management cannot be emphasised enough.

4.2 Standardisation

What is Standardisation?

Standardisation is the process of implementing and establishing guidelines, rules and protocols for
repetitive situations and processes to achieve an optimal degree of uniformity and consistency in a given
field, based on the consensus of different parties. Standardisation can help to maximise compatibility,
safety, repeatability, and quality and can lead to more efficient processes and procedures. Moreover,
standardised procedures or protocols are easier to manage and can contribute to the facilitation of
training of the operators.

Standardisation of Processes and Procedures in Terms of Automation and

Remote Operation

Why is it important to standardise processes and procedures in light of remote operation and
automation?

Safety and maintenance are the main driving forces for standardisation. Standardisation is the first step
towards effective automation as highly standardised procedures and procedures pave the way for
successful automation. Remote operation and automation are a technology driven solution to enhance
procedures and processes, so it is important to have well-defined, solid procedures as a foundation.
Therefore, it is equally important to pay the necessary attention to the flexibility of the processes and
procedures to allow them to accommodate to local issues (i.e. poor visibility, local traffic system...).
Furthermore, standardisation is beneficial (if not imperative) for maintainability, steepness of the learning
curves and interchangeability of the operators.

What needs to be considered when preparing the processes and procedures?

When drafting and establishing well-defined processes and procedures, it is important to take into
account different aspects. For instance, procedures not only consolidate standard operation, but also
need to include maintenance procedures (i.e. response during faults).

A non-exhaustive list of the procedures to be considered in included in Chapter 5.2.

30
 Standardisation of the Work Environment

Why is it important to standardise the work environment in light of remote operation and automation?

Highly standardised work environments allow the operators to switch between operating desks and
possibly even between control centres. This allows to cluster the activities during calm periods, such as
during the night or winter season and makes it possible to operate from only one control centre instead
of three control centres for example. This contributes to an efficient and safe operation process, reduces
the operational costs and improves the productivity of the operators.

In certain circumstances it can still be necessary to operate a bridge or lock from the original local
operator room. It is therefore recommended to adapt the local operation to have a similar design as the
ones in the remote control centre. More information and references related to control room
standardisations can be found in Chapter 5.4.

Technical Standardisation

Due to the variety, number and age of the infrastructures, standardisation is extremely difficult. Apart
from the fact that there is often no real standard for all objects, the management is often fragmented
over various contractors. Bridges, locks and water retaining constructions are mostly designed and
deployed by third parties under governance of civil contractors which prevents standardisation and
uniformity.

It is therefore of great importance to invest in the development of a broad standard. The requirements
for the most difficult installations must be mapped to make a detailed design to meet all of them. This
way the requirements for all other (simpler) installations will be met automatically because they are just
a subset.

Technical standardisation has several benefits, including:

Maintenance benefits:

 less need for replacement parts

 faster diagnosis of malfunctions
 technical knowledge will become more widely spread
 total life cycle management of the installations will become more professional
Operational benefits:

 steeper learning curves

 increase in the interchangeability of operators
 operators can help each other in case of doubt or in case of unusual circumstances (technical
problems, unexpectedly high traffic density, etc.)
 less proneness to human error
Even from a legal point of view, standardisation is an important asset. It proves that there is a
professional approach on every aspect: risk assessment, reliability of installations, quality of training of
staff, etc.

This standard could for instance contain the following topics:

 soft- and hardware architecture

 description of the type, content, format, degree of detail of documents like operator manuals,
maintenance manuals, as-built plans (civil, mechanical, electrical, hydraulic, etc.), functional
analyses, software, technical specs and catalogues of all equipment, design calculations, etc.
 operating procedure(s)
 camera plans
 HMI (desk lay-out, SCADA images (GUI), etc.)

31
Standardisation of equipment and architecture is an objective, but standardisation of protocols is an
absolutely necessity for the information exchange of different systems (PLC, SCADA, RIS, etc.).

When making this exercise, it is important to not limit the exercise to standardising the functional
requirements on how the system is supposed to behave. One must also consider imposing standards
concerning hardware, even at a component level.

4.3 Service Model to Customers

The intention of remote operation is to offer an improved level of service to the customers. By organising
the operation of objects in a centralised place, more attention can be given to scheduling the traffic in
the overall corridor beyond the mere traffic calling the local object.

It is important to identify and involve all stakeholders and consider possible objectors (for example
motorists who assume that the bridge keeper is there to undertake traffic control) in order to smoothen
the process of remote operation. Thought must be given at how customers will be informed and engaged
in the transition to remote control. When communicating to the stakeholders, it is vital to provide them
with accurate information and give them the right amount of detail. It is recommended to tailor the
amount of information and detail for each group of stakeholders, since some stakeholders require more
information than others. Furthermore, it is important to focus in the communication on the improved level
of service or the specific advantages (for example 24/7 service) of remote control for the customers.

4.4 Interaction with the Public

Since the provision of accurate, concise and qualitative information about the remote-control plans to all
kind of stakeholders is paramount for creating a broad support base, appropriate means should be
foreseen to spread and to facilitate interaction with the public. This can be done by a wide range of
means such as websites, email, access to summary reports and consultation meetings with
stakeholders and stakeholder groups (both voluntary and institutional). Ideally, it should be possible for
the public to raise concerns or ask questions which offer a unique opportunity for discussion.

32
5 OPERATIONAL IMPLEMENTATION
5.1 Implementation of Remote Operation
Remote control of objects means that certain objects need to be (partially) modernised to make them
suitable for remote control (data communications, camera surveillance, lock door control, power supply
etc.). During the project implementation phase, impact on day-to-day operations must be minimised, to
prevent it from being interpreted as a nuisance.

5.2 Definition of Processes and Procedures

Several procedures and processes need to be redefined or new ones need to be implemented whilst
transferring from local operating modes to remote control. These procedures and processes need to be
implemented locally as well as at the remote operation centre.

When redefining the processes for remote operation, it is necessary to focus on the changes for the
users and operators. Who undertakes which task, what can be done remotely or what must be done
locally (e.g. mooring protocols). A technical focus should be combined with a wider view of all systems
and all stakeholders (skippers, locals/road users and operators).

Processes and procedures not only consolidate standard operation, but it is equally important to have
well-defined guidelines for the maintenance team during breakdowns, malfunctions or faults. Therefore,
a distinction must be made between standard remote operation and maintenance operation, when the
object is closed for traffic and is only operated for maintenance. Both operations are described in
separate processes to be able to define the necessary steps in the process. Furthermore, it is of crucial
importance to have corresponding procedures regarding the switch between regular and breakdown
maintenance operation.

Following chapters describe both processes ‘Remote Operation’ and ‘Maintenance’. The schematic view
in Figure 1 presents these processes with a non-exhaustive list of the procedures and considerations.

Process – Remote Operation

Several procedures must be developed for each operating mode and each step in the remote operation
process. For the definition of new or redefined procedures, close attention must be paid to following
aspects:

 Training of operators: competence profiles must be redefined and a training plan has to be prepared
to match these profiles.
 Traffic management: corridor management according to the blue wave, lock planning, etc.
 Communication procedures between skipper and remote operator: registration of ships per corridor.
 Mooring protocols.
 Access control.
 Registration of ships, incidents, malfunctions, etc.
 Procedures and protocols need to be flexible to allow the operator to accommodate local issues (i.e.
poor visibility, locality to schools and hospitals).

33
 Figure 2: Process definition for remote operation

Process – Asset Management and Maintenance

With the implementation of remote control and automation, an operator cannot carry out local repairs or
perform small maintenance tasks. However, when remote control of the object fails, the operator must
be able to detect and recognise significant malfunctions and depending on importance of the movable
structure, be able to switch to redundant equipment, perform local operation, or shut down the operation
and call the maintenance team. Moreover, since the operator is no longer the eyes and ears on the
ground, additional attention must be paid to object inspection. For the definition of new or redefined
procedures, close attention must be paid to following aspects.

 Object inspection (raising the frequency of inspections, adding inspection tasks to periodic
maintenance, introduction of remote condition monitoring techniques, etc.).
 Fault detection: automatic alarms, detection by operator, preventive maintenance, etc.
 Use of SCADA for monitoring, fault detection and diagnosis by the remote operator, or making the
SCADA status/fault information available in real time to (mobile) maintenance teams.
 Training of maintenance operators.
 Communication between maintenance operator at the local structure and the remote operator after
a fault detection and during maintenance operation.
 Access control.
 Lockout-Tagout: a proper ‘lockout-tagout’ procedure is recommended to monitor the engine room.
 Installation of uninterruptable power supply.
 Response time of maintenance operators.
 Registration and analysis of malfunctions.
 Procedures for remote operation failure and/or more extensive maintenance or repairs.
A centralised overview of a section of locks or bridges can be used to manage incidents, accidents and
breakdowns. For example, if a bridge breaks down in the 'open to canal' position, bridge operation on
vehicle diversion routes can be suspended to minimise traffic build-up.

Except from object inspection, fault detection and maintenance operations, preventive maintenance also
includes software updates. When implementing remote operation, software development becomes more
important and needs the necessary maintenance. The software updates can be included in the
maintenance contracts.

The process ‘Maintenance’ and most important procedures are visually presented in the figure below.

34
 Figure 3: Process definition for maintenance and asset management

Graceful Degradation

The precise definition of the necessary procedures and protocols for the above-mentioned processes
on remote operation and maintenance depends on the vision of the organisation and the preferred level
of availability. All protocols must be described for the so-called graceful degradation. Graceful
degradation is the ability of the system or network to maintain limited functionality even when a large
portion of it has been rendered inoperative. A few examples of graceful degradation can be described
in the process definition on asset management and maintenance, for example:

 teach the operators how to interpret and act correspondingly to error messages on their SCADA
 manual switching to redundant equipment from SCADA
 manual switching to auxiliary equipment from SCADA
 use another desk
 use another RCC
 go to the local installation and use the local operator desk
Several options are possible when it comes to local operation, depending on factors, such as:

 number of bridges and locks within an organisation

 distance to the locks and bridges from the remote control centre
 importance of quick resolution of the problem
 degree of standardisation of installations
Depending on these factors, organisations can have a different view on whether local operation is
necessary and under which circumstances. For instance, in the Netherlands, an organisation can opt to
rent operators from certified contractors to perform local operations and maintenance.

If there are only a few bridges and locks that are remotely controlled and these are close to the remote
control centre, it is an option to adapt the local operator desk to have the same design as the ones in
the remote control centre. If operator desks are different, operators can have great difficulty
remembering how to use the local desks and as consequence it becomes difficult to operate locally.

However, when a remote operation centre has a high number of bridges and locks, it might be very
expensive to equip every lock or bridge with a local operator desk. In this case, other options must be
considered when making the bridge or lock ready for remote control, for example by working with a
remote-control adapter which can be plugged in at the local site by a maintenance engineer.

35
If a remote control centre controls locks and bridges, which are not all in the close surrounding of the
centre, it might be a good idea to consider other options. For example, the organisation can depend on
a decentralised team of maintenance engineers who can reach the lock or bridge more easily. Another
option is to have a dedicated maintenance contract to ensure quick response and repair. They can put
the bridge or lock in a safe position, while they make the necessary repairs. Furthermore, if an operator
is not able to repair the lock or bridge, it might be better to directly call in the maintenance staff.

Finally, the applied policy will influence the need for a physical presence and the preferred option: if the
waterway is part of an important and busy connection then a local backup might be considered.
Regardless of the chosen option, specific attention needs to be paid during the operational training to
help the trainees (operator, maintenance team, contractor, etc.) understand and learn things that are
specific to an installation and to help them (re)develop a mental map of the surroundings.

5.3 Operator Skills

Workload onto the Operator

When determining the amount of operators needed and the optimal workload in a control centre, several
factors need to be taken into account. The number of structures being controlled is only one factor and
should not be the only factor to be taken into consideration. Other influencing factors could be for
example:

 the number of movements of each structure

 the time needed to operate each structure
 the distribution of the operations throughout the day, week or season
 the complexity of operation of each structure
 tide influences
 presence of special traffic, railways
 number of lanes
 road traffic density
 complexity of the structure
 maritime traffic density
 type of navigation
 presence of large vessels
 presence of dangerous goods
 presence of inexperienced leisure crafts
 the characteristics of the waterway
 difficult passages
 large currents
Based upon this workload assessment, the required number of Full-Time Employed (FTE) can be
calculated. This prevents operators from being asked to simultaneously perform too many complex tasks
or being understaffed during peak moments. This avoids risks of overburdening the operators, which
can lead to errors or absenteeism as a consequence of too much stress.

For example, in Flanders (Belgium), a study on ergonomics was performed to determine the ideal
distribution of operators. Based on this analysis, a workload of 70-80 % is optimum for the operators.
This calculation gives 20-30 % for lunch breaks, recuperation time after concentration/operation tasks,
compensation of peak moments, etc. The number of operators is calculated according to an average of
all bridge and lock cycles on the remotely controlled waterway infrastructures.

Workload should be reasonably distributed throughout the day. A workload that is too high can increase
the risk of human errors due to stress. A workload that is too low on the other hand can have an equal
result originating from loss of concentration.

The amount of people working simultaneously in a control centre is best when kept between 4 to 8
personnel. This allows for an efficient intercommunication. Furthermore, the working place is scarce with
distracting influences and allows for more concentration. If more operators are needed, it is suggested
to split the control centre in different control rooms.

36
 Operator Tasks

The responsibilities of the operators in a remote operation centre extend far beyond the responsibilities
required for local bridge and lock operation. Complex traffic situations entail an increased mental load:
operators now must imagine the overall situation. Maintaining the correct situational awareness might
prove more demanding in a remote operation centre.

The table below gives an overview of the different tasks that can be carried out in both local as remote
operation. It is possible that the operator performs all of these tasks, but this is not required. Based on
the specific situation and needs of an organisation, the tasks below can also be done by other functions,
such as a supervisor, traffic manager, operator in a RIS centre, etc.

Responsibilities – Local bridge and lock Responsibilities – Remote control lock and
operation bridge operation
 Bridge and lock operation  Bridge and lock operation
- Monitoring operation processes - Monitoring operation processes
- Monitoring and complying with - Monitoring and complying with
traffic/operation regulations traffic/operation regulations
- Monitor the safe operation - Monitor the safe operation
- Operation with camera images and SCADA
view
 Small maintenance depending on local  Register, manage, analyse incidents and
situation malfunctions and instruct technical maintenance
operators bridge control
 Instructions to shipping traffic and road  Instructions to shipping traffic and road users
users
 Contact person for external parties in case  Contact person for external parties in case of
of calamities calamities and coordinate in case of malfunction
(access control, lockout-tagout, remote
communication, etc.)
 Decide whether operation is possible according
to environmental situation, e.g. clear visibility
through camera images
 Manage a bridge management system

 Water management of a whole corridor or

waterway

Table 8: Overview of the different possible tasks with both local and remote control operation

Training Requirements

Additional Training Requirements for Remote Control

The transition from local operation to remote control operation implies a distinct skill set. The switch to
remote control comes with additional training requirements for remote operators. The regular training
requirements for local operators should be retained but supplemented with these additional training
requirements. Below is an overview of the regular training requirements:

 nautical legislation and other applicable laws

 radio communication
 basic understanding of working principles of locks and bridges
 lock and bridge operation
 basic local incident management
 basic understanding of vessel manoeuvring

37
Attention should be given to uniform training and development since it contributes to the speed at which
procedures and processes are being adopted. Furthermore, this also makes it possible to switch or
deploy competent operators at multiple locations. Training can include sessions on a simulator, to train
for example interpretation of CCTV images, getting familiar with the interface and train for emergency
situations.

The following sections discuss in more detail the additional training requirements and how these should
be included into the training.

Using Remote Control Systems

In a remote control centre, an operator should be able to operate multiple bridges and locks instead of
only one specific structure. This poses a much more challenging task compared to local operation,
specifically in building up situational awareness. Operators have to familiarise themselves with the
characteristics of each structure and surrounding traffic situation. The same goes for water management
structures and the surrounding basins and canals.

This is done by using information delivered by intermediate systems instead of line-of-sight first-hand
information, such as for example, interpreting 2-D camera images and building a 3-D mental image.
This mental image is to be complemented with information from radio-communication, radar, AIS, etc.

This requires additional skills from the operator and must be included in the training. Training should
support and help operators in developing these skills and using the different intermediate systems in a
correct way. Furthermore, the training must make the operators aware of the limitations of these systems
as well as the attention points in human perception and error. Some examples include:

 stationary objects and people are harder to detect on camera than moving ones
 people wearing the colours of the structure are less visible
 AIS signals can have some deviation
 skippers can provide discordant information by radio communication about their position or the
structure they wish to pass
Having a physical distance between the operator and the structure can sometimes lead to a mental
distance between the operator and reality. This can result in a disconnection and videogame experience.
Training should provide a preparedness for this risk and include mock drills, for example by including
local training sessions for new operators, to experience real-life encounters with passers-by, the noise
and power of the moving structure, etc.

The systems used in a control system are IT-related, so basic IT-skills should be present or acquired
by the operators.

Working in a Remote Control Centre

Working in a remote control centre requires to be able to work as a team. Experienced local operators
are usually used to working more or less independently and solitary or in very small fixed groups.
Working in a large team, often with varying composition can be challenging. It is advised to guide this
transition and to check if the skills that are needed to work as team are present or can be developed.
Sometimes more formal protocols are needed as well as a hierarchy to coordinate operations.

Function Description

When making the transition to remote control, the current tasks and responsibilities change, and new
ones are introduced. There is a need to clearly define and describe the different responsibilities and who
will play which part in the process.

In a remote-control room, a combination of different tasks exist on the working floor: water management,
vessel traffic management, bridge and lock operation, lock planning, road traffic control, emergency
response, etc. The exact function descriptions van vary between organisations, but it is important to
define these functions. To define and clarify these roles and responsibilities, it could be considerate to
use a RACI table.

38
 Responsible: Who is responsible (i.e. the person doing the work)?
 Accountable: Who is accountable (i.e. the person who should ensure the work is completed)?
 Consulted: Are there stakeholders who should be consulted about the activities?
 Informed: Are there stakeholders who should be notified of a decision or result?
Remote operation is only one of the many tasks in the remote operation centre. Remote operation allows
for a ‘detached’ overview where water management, corridor management and traffic control can all be
managed. The overall overview can be done by a supervisor/traffic manager who plans and assigns the
operational tasks to the operators of the object, sets priorities, etc. This strategy depends on the
organisation and is subject to external influences such as water management and the importance of
traffic management.

5.4 Standardisation and Ergonomic Principles

Control Room Design

As an example for control room design, the next schematic representation gives a possible approach
for an operation centre with dual work stations. Ergonomic criteria such as indoor climate, lighting,
acoustics and predetermined minimum dimensions for movement areas have to be taken into account.
Further aspects are barrier-free access, escape and rescue routes depending on the number of
personnel in the control centre. Spare space for future extensions should be considered for control room
design.

Figure 4: Control room design (Reference: WSV, Germany)

The organisational structure and necessary functions in the operation centre needs to be determined in
order to design the operations centre. Below are some examples of organisational structures:

1) A traffic controller (observer, traffic manager, coordinator, etc.) receives and registers the operation
requests, plans the operations and dispatches them to the operators.

39
2) The operator receives operation requests and handles them independently. This model is
recommended in smaller operation centres.
3) The operator is assigned to a restricted set of objects and receives a high-level planning from a
traffic manager. Typical planning horizon around or less than 4 hours. He then handles the local
planning and operations on his own.
An overview of the (entire) process is often displayed at a central location in the control room (video
wall). However, these do not replace the need for complete visual information at the actual operator
desk.

On a macro level, the ‘process supervisor’ can oversee a larger part of the process (area, corridor, etc.)
and can make considerations from this position at a network level. He can instruct the operators to adjust
the process. He can also intervene as and when required such as:

 sudden, unforeseen rises of traffic intensity

 accidents, calamities
 operator suddenly not available (sickness, etc.)
 malfunctions
Sub-processes or objects are operated from an operator desk. Information regarding these operations
is displayed at or near the workstation. This may include:

 camera footage
 radar images, preferably with AIS information added
 information systems which provide data on the vessel, vessel destination, cargo, dimensions, etc.
 SCADA-image with synoptic display of the object

Following picture shows a possible set-up of an operator desk, including identification of essential
interfaces.

Figure 5: Example of an operator desk and interfaces

Ergonomics of the Operator Desk

Work stations need to be designed in a uniform way so that objects can be operated from any station.
An object is selected from options in the menu tab and it is important that the correct VHF radio channel,
camera footage, intercom, telephone, safe emergency stop connection, etc. are automatically selected
respectively.

It is desirable that all workstations in the control room and all GUI (graphical user interface) equipment
are uniform in operation and appearance to enable operators to be able to easily control any object. As
far as GUI is concerned, this requires a consistent abstraction of the objects. Ideally, all control rooms
in one organisation should be uniform. As a result, personnel can easily be deployed at all work locations
and the operator is not overloaded or presented with unfamiliar information. However, total uniformity is
difficult to achieve.
40
Ergonomics

It is becoming common practice that the height of the workstation desk can be regulated electronically
to the wishes of the operator, in accordance to their body height when seated or even to accommodate
operators to work standing up.

Sometimes the vertical and even horizontal position of the monitors relative to the desktop can be altered
separately. An example of this is given in the picture below where the left desktop and monitors are less
extended compared to the workstation on the right.

Figure 6: Testing operator desks (Reference: WSV, Germany)

It is important to notice that there are two kinds of ergonomics. The first and best known is the physical
ergonomics which deals with things like height of operator desks, 24/7 operator chairs as presented in
the picture below, lighting, acoustics, air temperature and humidity, etc. The lesser known is the
cognitive ergonomics. This deals with the mental load on the operator. Typical topics are:

 how, when and where to present information

 how does the operator acquire enough situational awareness within a short time
 etc.

Figure 7: Operator chair and desk (Reference: Port of Antwerp)

41
Dual workstations

A dual workstation is designed so that one operator can simultaneously perform and survey two
operation processes. In principle, an operator can safely perform two simultaneous or overlapping
processes, provided that full attention is paid to a single (sub)process during the critical stages of the
process (e.g. raising/lowering a bridge or opening/closing a lock gate) and that the operator has control
over the speed of the operation (the operator decides whether a second process can be executed). This
is called ‘merging operation’.

A dual workstation allows for operation by one person but if the dimensions are not too small this does
not exclude the possibility of seating 2 operators side by side, each using his half of the workstation.
The 1 operator – dual workstation mode can be used at less busy moments (e.g. at night or in the off
season).

This merging operation versus sequential operation doesn’t always result in time gain for the waterway
and road users. But dual workstations should be considerate as a flexible set-up. For instance, if two
objects are close to each other or for bridge-lock combination, etc.

Visualisation to the Operators

Human-Machine Interface (HMI)

An important issue regarding the development of the HMI and the workstation is the extent in which
information is shared or exchanged with other stakeholders: e.g. is a vessel required only to be shown
as a dot (which is sufficient for opening a bridge in time) or does one add metadata to that dot, for
example:

 making it clear what kind of vessel it is

 if it is carrying dangerous cargo
 whether or not the vessel has a pilot on board
 check of the waterway permit

The information has to be customised for the process. Generally, a lot of information can be obtained
from an AIS signal and for instance added onto a radar image. For normal purposes, the information on
SCADA-monitors should be as abstract and concise as possible. This minimises the cognitive mental
load of the operator when interpreting the SCADA image. Abstraction also allows for more uniform
images regardless of the real physical properties of the lock or bridge.

In some situations, however, one may have the need for more detailed information. This can be the case
when the operator needs to interpret error messages or perform non-standard tasks. Maintenance
personnel also benefit when there is as much detailed information as possible. Ideally there should be
a menu with options to switch off or on certain details. Displaying a higher detail level on a separate
screen or panel can also be considered

Following figures give a comparison of a highly detailed GUI and the normal operation view for a bridge
in the Port of Antwerp.

42
 Example of SCADA with high amount of details Example of the same SCADA with minimized detail
(Port of Antwerp – Noordkasteel Bridge) (Port of Antwerp – Noordkasteel Bridge)

Figure 8: Comparing different levels of detail for SCADA representation

Finally, the graphical user interface (GUI) is only one part of the total human-machine interface (HMI).

Camera Plan

Visibility

Weather conditions have an impact on camera performance: heavy rains and fog may impair visibility.
Lock and bridge operation should be delayed when safety cannot be guaranteed. Furthermore, a
standard protocol should be defined for the operation regulations and how to operate under bad weather
conditions.

Camera plan

It is important to define a standard that suits all needs. A 3-D computer simulation of the bridges or locks
can help to facilitate this process. Mounting a camera on a cherry picker is also a possible solution in
existing situations or to validate the outcome of the 3-D exercise before installation. More detail on 3-D
modelling and simulator technology is included in Section 6.3.4.

A small bridge on a rural road over a canal with mainly recreational vessels may need no more than four
to six cameras but larger installations may need dozens or even more. Following figure, for instance,
gives the camera plan in a 3-D modelling for the Tallinn Harbour bridge in Estland (designed in the
Netherlands) to help define the camera plan (see also the movie in appendix).

43
 Figure 9: 3-D modelling and validation of camera positions (Tallinn harbour bridge)

Dead angles can be a problem for remote operation and for some bridges or locks it can be necessary
to double the amount of cameras to provide redundancy. This redundancy could also be achieved by
installing extra PTZ-cameras. To deal with all dead angles and the necessary redundancy requirements,
the camera plan for the locks in Antwerp for instance, has led to a situation with over 70 cameras per
lock.

Besides from determining the minimal camera images, it is important to consider different approaches
on the camera locations and how to show the images on the operator screens. A possible approach can
be to create a consistent perspective by installing all cameras on the same side of the waterway. In this
approach, a ship moves into the same direction on every camera image. It is also important to link this
camera position with the SCADA-screen. A simulation of this approach is presented in the following
figure.

Figure 10: Example of camera locations represented on a SCADA-screen

44
Radar

In some cases, RADAR and CCTV-images are both necessary since they complement each other. AIS
information can be added and even coupling between a CCTV-camera and the RADAR system is
possible to provide a visual means of automatically following a vessel alongside the RADAR image.

An interactive connection between camera and radar images provides a prompt to the operator to zoom
in on an approaching vessel: in case of fog, the vessel is easily identified from afar. Once its position is
known, a connected camera can automatically zoom in on its position, making the vessel visible even
more quickly.

Control Room Standardisation in Europe

Belgium

5.4.4.1.1 Port of Antwerp

Two desk prototype versions have been built: a single and a dual workstation. The dual workstation is
spacious enough to seat two persons side by side but also allows for situations when one operator
handles two objects (‘merging operation’; see 5.4.2).

The design of the installation is such that any object can be chosen on any workstation in any remote
control centre. It is only possible to operate an object from one workstation at the time. Nevertheless, a
supervisor can open a view at any object and simultaneously observe the camera and SCADA images.
For the design of a standardised operator desk it is important to implement a standard SCADA image.
To allow for adequate action in emergency situations the emergency button on his workstation is also
active.

Components are as much as possible COTS (Commercially off the shelf). For optimal cybersecurity but
also for ease of maintenance the physical and logical links between different systems (CCTV, RoIP,
VoIP, SCADA, etc.) are limited to the bare minimum and firewalls are installed.

The fibre optics of the SCADA and PLC network are physically separated from the rest of the network
(separate fibres) and use their own dedicated switches.

Figure 11: Example of a dual workstation (Port of Antwerp prototype)

45
 Figure 12: Screen set-up from a dual workstation (Port of Antwerp prototype)

Figure 13: Example of the standard SCADA application which is a schematic representation of the object it
serves (Port of Antwerp prototype)

5.4.4.1.2 Flanders

In Flanders, control room and HMI design are carried out by the Automation of Waterways, Training and
Reference-centre (AWATAR-centre). This centre includes a simulated reference-control room and
governs technical and operational specifications, apart from providing training. This includes control-
room design, operator-desk design and HMI/SCADA-design.

In the past, often dark and bunker-like designs with minimum windows were needed due to the low
quality of computer screens. However, contrast, resolution, colours and viewing angles have improved
significantly which enables the shift towards pleasant and comfortable light spaces in connection with
the nearby waterway.

Although some customisation is allowed for and needed in every control room, several aspects are
considered:

 Construction:
- large, open spaces, with the least possible visible load-bearing structures within the control
room
- provide plenty of daylight and preferably a view on the waterway
- adjustable and modular sunscreens to prevent both troublesome heat and sunshine intrusion
 Fitment:
- use carpet and other acoustically damping materials for acoustic comfort to prevent interfering
noises
- use individually adjustable and dimmable indirect lighting suitable for use with computer
screens
46
 - raised floor and false ceilings to hide cables and for easy future modifications
- use sober colours
- provide a clean, tidy room without distractions
- well-designed, low noise, low draft HVAC technics
 Lay-out:
- adjacent or incorporated break-room in visual contact and/or hearing distance from the control
room
- adjacent or underlying climate-controlled server room, to minimise noise and heat from active
hardware in the control room
- spaces between operators are large enough not to distract, close enough to communicate
- identical desk-orientation to avoid confusion
- four to eight operators in each control room, use adjacent control rooms if larger numbers are
required
- separate operational tasks from non-critical, non-urgent tasks
 Furniture:
- ergonomic 24/7 office chairs
- personal lockers
 Operator desk:
- modular ergonomic operator desks with technical compartments to hide cables and
equipment
- height adjustable work surface and monitor-stand
- designed for both small and large waterway structures, with 8 to 12 video-screens per
structure
- designed for both locks and bridges or lock-bridge and lock-lock combinations

Figure 14: Typical control room lay-out in Flanders

47
 Figure 15: Control room standardisation in Flanders – Desk simulator

Germany

In the context of standardisation, the German Waterway Administration decided to standardise the
graphic user interface for the SCADA system of locks. To provide the operators a user interface based
on ergonomic principles, the standard follows the European guidelines. This means the following two
points should be taken into account when designing the GUI:

 Because of ergonomic reasons, the number of colours should be minimised.

 Less important information has to be depicted in unsaturated (e.g. background) and important one
in saturated colours (e.g. alarms).
Readability of written text is very important. The requirements for this task were mostly derived from the
standard EN ISO 9241-303:

 A sans serif font like Arial was chosen and the character height has to be at least 16 arc minutes.
 For the standardised operating desk, a monitor with a size of 24” and a format of 16:9 was
implemented with a reading distance of approximately 970 mm.
With these specifications the character height could be determined.

Font Height Usage

1 Bold 8,7 mm  Label line
 Status bar
2 Bold 6,1 mm
 Menu heading
 Message line
 Information line
3 Normal 5,1 mm
 Values in the display fields
 Other headings in the overview or menus
 Label of buttons
3 Bold 5,1 mm  Label of display fields
 Other headings in the overview or menus

Table 9: Summary of the specifications of used fonts for GUI

48
To ensure recognition by the operators, the screen layout of the SCADA system is standardised. The
basic screen lay-out is given in the figure below.

The label informs the user about the selected plant and includes also the German Waterway
Administration logo.

Then the message line provides current and unacknowledged technical faults, with the opportunity to
show the entire alarm list.

In the status bar, there are important plant statuses and the operating mode is represented.

An overview of the plant is shown in the orientation area. All major plant components, for example
gates, valves or traffic lights, are shown here. It provides also additional information about the
components, like movements or the status of the traffic lights. These components can be selected to
operate.

Different menus or dialog windows for the dedicated plant operation appear on the operating area.

Main or essential functions, which have to be always available, are organized on the control line, an
example is the plant or operation mode selection.

Relevant but not very important information is listed on the information line. More specific the operating
desk number, the date, the time and the temperature are represented. An example of a lock can be
found in the screenshot below.

Label line Status bar Message line

Operating area
Orientation area Control line Information line
area

Figure 16: An example of the standard SCADA system for locks used by the German WSV

The Netherlands

In the Netherlands there are a lot of bridges, locks, dams and pumping station, all within a relatively
small country. Taking into account that the country is very densely populated and there is a lot of road
and waterway traffic, the expansion possibilities are limited. Therefore, the Netherlands are always
optimising their waterway and road traffic management. A specific example is the Bridge and Lock
49
standard created by Rijkswaterstaat named ‘Landelijke Brug- en Sluisstandaard’. This standard deals
with the operation of and is applied to all movable bridges and locks from Rijkswaterstaat. The standard
gives a prescription for the design of the operating process and makes demands concerning the
operating and control systems. The standard consists of a bundle of 24 specifications and has four
abstractions:

1. The Top Layer (Strategy) represents the starting points for operating, the essential laws and
regulation for operation (e.g. machine safety), the process and the organisation surrounding the
determination and management of the specifications.
2. The Second Layer (Work Process) represents specifications about the way to operate, the work
process, and how the tasks, responsibilities and powers of the operating organisation are
structured. The relations and interfaces between construction, management and maintenance are
also described.
3. The Third Layer (information requirement and operating functionality) consists of specifications
that provide the functional need for information and tools that are necessary to carry out the
operating process properly.
4. The Bottom Layer (system functionality and technical equipment) contains the specifications for
the required information and technical systems.
Rijkswaterstaat is taking the next steps to standardise their infrastructure by using technical building
blocks. They already have standard building blocks for IT, such as optic fibre network and cybersecurity.
They are now working to develop standard building blocks for operating-, control-, audio- and video
systems for bridges, locks and tunnels.

An example is the development of an integrated duo working station to operate bridges, locks, water
systems, dynamic road traffic systems and tunnels through one desk.

Figure 17: Remote Traffic Centre Maasbracht for bridges, locks, dams and pumping stations (indoor)

50
 Figure 18: Remote Traffic Centre Maasbracht for bridges, locks, dams and pumping stations

Control Room Standardisation in the USA

As the USA is a large and diverse country and the United States Army Corps of Engineers (USACE) in
particular is also a large and diverse group, control room design has not been standardised in the USA
in comparison to other countries.

Demonstrated below is a concept of the dual operator desk envisioned for a United States demonstration
project known as the 'Grays Landing Remote Operations of Locks Demonstration' by the US Army Corps
of Engineers. The operators would control both the lock chamber as well as the remote dam gates from
this station. The lessons learnt from this project will inform future standardisation efforts if remote
operation is fully implemented.

Figure 19: Concept of a dual operator desk envisioned by the US Army Corps of Engineers

51
 Control Room Standardisation in Canada

In 2014, the St. Lawrence Seaway Management Corporation embarked on a project to update the
Operations Centres and remotely operate their locks. The goal of the project was to provide a state-of-
the-art working environment for the operators. Architects were hired to design the new work spaces.

A consultant was engaged to review the architect’s plans and make recommendations regarding the
physical layout of the new Operations Control Centres (OCC) in both Maisonneuve and Niagara. This
review considered workflow, operator functions, accessibility, etc. and was aligned with current
ergonomic standards and industry best practise.

Figure 20: Operations Control Centre (Maisonneuve)

The St. Lawrence Seaway Management Corporation had been remotely operating their large lift bridges
from centralised control rooms for more than ten years. This experience, coupled with the results of the
consultant’s study, provided the guidance needed to redesign both Operations Control Centres.

In both existing Operations Centres, available space was limited, and major renovations were required
to expand the Operations Centre and its support systems. Provisions were made for high-availability
power systems, networks and communications systems. New HVAC systems were installed to
accommodate the additional heat load of the extra people and equipment. Attention was paid to
acoustics, lighting and overall décor.

Figure 21: Maisonneuve operations control centre lay-out

52
In consultation with their Operations teams, the decision was made to adopt a ‘separate workstation for
each structure’ model. This decision was in keeping with the literature available describing the
challenges of centralising control of remote structures. Their Operations Management was concerned
that the amount of change introduced to the operators should be minimised. The intent for the future will
be to evolve the workstations functionality so any structure can be operated from any workstation. This
will allow for more effective staffing of the Operations Centre as traffic conditions change.

Figure 22: Niagara Operations Control Centre lay-out

The operator workstation consists of a number of functional systems (SCADA system, CCTV, radio,
security, desktop applications, etc.). Most of these systems run on separate computers connected to
separate networks (virtual private networks) and are not allowed (for security reasons) to interconnect.
To accommodate these different applications, each operator workstation was equipped with a secure
keyboard/mouse switch which allows the user to interact with each application using a single keyboard
and mouse. This feature was deemed important to reduce the clutter of having multiple keyboards and
pointing devices on the workstation. Reducing the number of input devices also helps to reduce operator
confusion when trying to remember which device to use in an emergency.

The operator workstations are organised such that the applications associated with each monitor can
be reconfigured easily. As they gained operational experience with the new systems, they have adjusted
the layout of the monitors to be more effective.

As a result of the consultant’s review of the operational workflow within the proposed new Operations
Control Centres, they adopted a workstation ‘pod’ configuration. Workstations are organised into groups
(pods) based on their operational requirements. This arrangement requires fewer operators to operate
more structures. The operators stationed within each pod are aware of the operating condition of each
structure within the pod and can quickly respond to upsets. If vessel traffic patterns warrant assistance
from other operators stationed within the Operations Control Centre can be provided.

Operator Cognitive Ergonomic Study

The St. Lawrence Seaway Management Corporation also wanted to review the flow of information
presented to the operator. A consultant was engaged to review the presentation of information including
safety, process, security, communication, etc. This review considered the responsibility of each operator
function, the information required to perform each job safely, communication between operators, etc.
This study was aligned with current cognitive ergonomic standards and industry best practise.

This is the last major piece of the overall Remote Operation portion of the project and considered one
of the most important to long term success. This work is on-going and will be reported in more detail as
the work progresses.

53
6 TECHNICAL IMPLEMENTATION
6.1 Legislation and Technical Standards

Europe: Route to Compliance with EU Directives

Background

The European Union introduced legislative Directives that set out goals for EU countries to achieve.
However, it is up to the individual countries to devise their own laws on how to meet these goals. The
EU Directives are implemented through Regulations in the EU member states.

The following lists the primary Directives which must be considered when building new machinery or
modifying existing machinery, which would be the case if remote automation was implemented on a
moving structure such as a lock or bridge.

 Machinery Directive – 2006/42/EC

 Low Voltage Directive – 2014/35/EU
 EMC Directive – 2014/30/EU
 Pressure Equipment Directive – 2014/68/EU
 Use of Work Equipment Directive – 2009/104/EC (formerly 89/655/EC)
Movable bridges and locks are subject to compliance within the EU Directives. This Directive applies to
the following products:

(a) machinery
(b) interchangeable equipment
(c) safety components
(d) lifting accessories
(e) chains, ropes and webbing
(f) removable mechanical transmission devices
(g) partly completed machinery
Machinery is defined as follows – “an assembly, fitted with or intended to be fitted with a drive system
other than directly applied human or animal effort, consisting of linked parts or components, at least one
of which moves, and which are joined together for a specific application”.

Compliance by Adoption of Harmonised Standards

To demonstrate that the installation complies with the applicable Regulations, the adoption of
harmonised standards is implemented. The following lists the primary standards which are to be
considered and followed for lock and bridge applications to demonstrate compliance with the associated
Directives stated above.

 ISO 12100 – Safety of machinery – General principles for design – Risk assessment and risk
reduction
 ISO/TR 14121-2 – Safety of machinery – Part 2: Practical guidance and examples of methods
 ISO 13850 – Safety of machinery – Emergency stop functions – Principles for design
 IEC 61508 – Functional safety of electrical/electronic/programmable electronic safety-related
systems
 IEC 62061 – Safety of machinery – Functional safety of safety-related electrical, electronic and
programmable electronic control systems
 ISO 13849 – Safety of machinery – Safety-related parts of control systems
 IEC 60204 – Safety of machinery – Electrical equipment of machines
 IEC 61496 – Safety of machinery – Electro-sensitive protective equipment
 EN 547:1996 – Safety of machinery – Human body measurements

54
 Compliance by Means Other Than Adoption of Harmonised Standards

Alternative approaches to the use of harmonised standards can be used to demonstrate compliance
with EU Directives. For example, countries may have their own national standards and waterway
operators/employers may have their own requirements in addition. Notwithstanding, the requirements
of the EU Directives must be met.

In practice, harmonised standards and non-harmonised standards will be used in combination to meet
the EU Directives and employer requirements. A few examples of non-harmonised standards applicable
for lock and bridge applications are listed in the section.

 NEN 6787 – Design of movable bridges – Safety

 German Product Safety Act (ProdSG)

CE Marking

6.1.1.4.1 Background

Remark: In view of the relative complexity of the rules concerning CE marking for machinery, and their
comprehensive applicability, it is not possible to discuss all the possible scenarios that can arise in detail.
One must be aware that not all details or specific situations with respect to the application of the CE
marking are covered in this approach and that in case of doubt the text of the law is prevailing.

All locks and bridges need to be CE Marked if they were put into service after the associated regulations
came into force. The directive was introduced as a requirement in January 1993 and became mandatory
since 1 January 1995. There is generally no need to re-CE mark on the machine unless the machine is
changed or modified significantly. There is much debate about what constitutes a significant change or
upgrade and specialist guidance should be sought on this issue. However, to avoid doubt the following
machine changes or upgrades would constitute a significant modification therefore would require a new
CE Mark to be affixed to the machine:

 Conversion from local control to remote control

 Upgrade of control system from relay logic to PLC controller
 Design and Installation of new bridge deck or lock gate
Other less clear examples are subject to much debate, e.g. an upgrade of PLC from one manufacturer
to another (including software change).

55
6.1.1.4.2 Decision Tree for Application of CE Marking

Figure 23: Decision tree for application EU guidelines machine safety

6.1.1.4.3 Responsibility for CE Marking

A contractor neither has the operating experience or knowledge of the existing structure that the
operation and maintenance organisation have (i.e. design and historical maintenance records), nor will
he necessarily be exposed to the lessons learnt by the operation of similar locks and bridges. The
organisation should therefore pass the known operating risks onto the contractor, so the contractor has
sufficient knowledge to perform a complete risk assessment.

The contractors will often be unwilling to affix a CE mark if they have modified a lock or a bridge. There
may be no technical file (technical documentation) available and to do it correctly, it would require a
significant amount of ‘reverse engineering’ to ensure that retained parts of the machine comply with
harmonised or other applicable standards.

56
There are two approaches concerning the CE marking. In the first one, the waterway authority is itself
responsible due to the fact that they are the nominated machine manufacturer. In the second approach,
the waterway authority passes on the responsibility for CE marking to the contractor or machine
manufacturer. The last one is generally more appropriate if a completely new lock or bridge is being
constructed. However, when an existing lock or bridge is significantly modified, this last option is less
favoured by the machine manufacturer. In the case there is a new construction project awarded to one
contractor, the responsibility of CE marking can be easily passed onto this contractor. However, when
there are multiple, smaller contractors this is more difficult.

When interpreting the machine safety directive, there will always be choices that are more arbitrary. For
example, Rijkswaterstaat has set up an expert team machine safety for making complicated choices for
the organisation.

Regardless of the approach, it is strongly recommended that a strategy is put in place to ensure that the
responsibilities are agreed and that there is a common understanding of the approach. Due to the
complex installations, the scope of the project given to the contractor must be detailed.

In addition, a waterway authority always has the responsibility as owner and employer. As employer, he
must comply to the Use of Work Equipment Directive – 2009/104/EC.

Technical File

A technical file shall be assembled to demonstrate compliance with the respective EU Directives. The
content of the technical file is defined in the respective Directive.

It is the responsibility of the machine manufacturer to produce the technical file if demanded by the
policing authority. However, the machine builder has no legal responsibility to provide a copy to the
employer, unless it is specifically stated in the contract.

As the employer may need the information in the technical file for future modifications and upgrades, it
is strongly recommended that a copy is requested prior to handover of the equipment along with the
required installation, operation and maintenance Information.

Provision of Operation and Maintenance Information

Comprehensive Operation and Maintenance (O&M) Information must be provided for all installations. It
is recommended to maintain the equipment in line with the manufacturers instructions (i.e. schedule and
procedure) and keep records. It is necessary to train the maintenance engineers accordingly.
Technical manuals which document the O&M information should be controlled documents, covered by
a quality system and kept up to date. Any changes should be controlled and documented and should
be subject to change procedures. Standard operating procedures should be revised for the following
reasons:

 When new equipment has been introduced into the installation.

 When there have been significant changes to operating procedures, tasks or personnel.
 And as a result of lessons learnt.
The information in the technical manual should be presented clearly using simple language, be
unambiguous, well-structured and indexed so that the information can be readily found. Further
guidance for the structuring, content and presentation of technical manuals can be found in EN82079-
1.

Operating and maintenance information should be available on hand when required. It is becoming a
more and more common practise to store and manage such information digitally. By this method
information can be readily accessed through a tablet or a computer at each site provided a reliable
network coverage is available.

Consideration should be given to the preparation of the manuals during construction of new installations
or when upgrading an installation. Considerations would typically include:

57
 Who is responsible for production of the manuals?
 What is the content of the manuals?
 How is existing installation/retained equipment information going to be captured?
 What is the format of the manuals, what production standards should be followed, is the manual to
be produced in paper folders, digital format or both?
 With what software shall the manual be produced?

Competence of Maintenance Engineers

In most countries, the employer has legal duties to ensure the safety of all staff working on their sites.
Therefore, controlling engineer access to site, specifically those who have been entrusted by granting
them access to the equipment, needs special consideration. Firstly, the engineers need to be trusted
and made aware of the extent of the tasks they have been assessed as competent in, and secondly to
ensure that they do not act outside their area of expertise. The method and control measures by which
competency is assessed and responsibilities are assigned varies with country to country and with the
level of automation of the equipment. Also, different measures to manage the assessment of
competency are required depending on whether the engineers are directly employed or sub-contracted,
or in some cases a combination of both.

It is common for some organisations to develop specific training programmes for lock or bridge operators
who are re-deployed to undertake maintenance duties as a result of their role being redundant due to
remote operation implementation. In addition, some organisations develop in-house apprenticeships
and training schemes which are tailored to skilling individuals specifically for the maintenance tasks
required to maintain the lock or bridge equipment in their ownership/custodianship.

Data Protection Regulations

EU: Privacy Regulations

UK: The Data Protection Act 1998 mandates the requirements for the use of CCTV data.

USA: Standards

 Standard NFPA 79, Electrical Standard for Industrial Machinery

There are no machinery directive requirements in the USA. Standard NFPA 79, Electrical Standard for
Industrial Machinery, has specific requirements for machinery stop functions. In NFPA 79, there is also
a requirement to perform a machinery risk assessment. Most navigation lock machinery in the USA
operates with a Category 0 stop which is defined as an uncontrolled stop immediately removing power
to the machinery. Annex A of NFPA 79 refers to ISO 13850, Safety of Machinery – Emergency Stop –
Principles for Design, and IEC 61508, Functional Safety of Electrical/Electronic/Programmable
Electronic Safety-Related Systems.

 Engineering Manuals (USACE)

There is no CE certification required in the USA. Most of the locks in the USA are operated by the United
States Corps of Engineers (USACE). The USACE publishes engineering manuals (EM) for various
coastal and navigation structures. Included in this is EM 1110-2-2610, Mechanical and Electrical Design
for Lock and Dam Operating Equipment. The latest version of this EM was published in 2013. Chapter
12 of the EM discuses equipment and machinery controls such as PLC controls, interlocks, and
emergency stops. Chapter 13 of the EM discusses electrical support systems such as CCTV systems,
security systems, communications systems and life safety systems. Individual equipment, such as
motors, cables, and control panels need to be certified by a safety testing agency such as Underwriters
Laboratory (UL) or Intertek Testing Services (ETL).

 ISA Standards
ISA Standards help automation professionals streamline processes and improve industry safety,
efficiency, and profitability. Over 150 industry standards for automation and control systems, ensuring
the safety of electrical equipment used in hazardous locations to cost-savings for interfaces between
industrial process control computers and subsystems. Although not used as primary reference, ISA
standards could be used as a secondary guideline for design.
58
 Moveable Bridges: AASHTO Standards
In the United States, most of the moveable bridges fall under local or state justification. There is not one
unified standard for machine safety, but the American Association of State and Highway Transportation
Officials (AASHTO) produces a Moveable Highway Bridge Design Specification which has a section on
electrical design.

Canada: Standards

Canadian Regulations

In Canada, industrial safety is governed at the Provincial level. Each province has its own regulations
that are maintained and enforced. For example, Ontario established the Occupational Health and Safety
Act, which sets out the rights and duties of all parties in the workplace. Its main purpose is to protect
workers against health and safety hazards, and it provides for enforcement of the law where compliance
has not been achieved voluntarily.

Within the Act there is regulation 851, Section 7 that defines the Pre-Start Health and Safety review.
This review is a requirement within Ontario for any new, rebuilt or modified piece of machinery and the
report needs to be generated by a professional engineer.

[NOTE: The St. Lawrence Seaway Management Corporation is subject to federal regulation and not
bound by provincial Health and Safety law. However, in the event of an accident, the courts would expect
that the employer follow whichever are the most strict regulations when protecting their employees.]

Canadian Electrical Standards

The Canadian Electrical Code, CE code or CSA C22.1 is a standard published by the Canadian
Standards Associated (CSA) pertaining to the installation and maintenance of electrical equipment in
Canada.

All electrical devices connected to the Canadian electrical supply must bear the CSA label. Acceptable
compatible standards can be used, such as ULC (Underwriters Laboratories of Canada) and in some
cases the CE mark. The Canadian Electrical Code regulates the wiring of electrical devices. Wiring
systems complying with other codes are allowed if they are accepted by the authority enforcing the Code
in a particular jurisdiction.

The Canadian Electrical Code does not apply to vehicles and systems operated by electrical or
communication utilities, railway systems, aircraft or ships since these installations have their own
separate standards.

The latest (2018) edition of the Canadian Electrical Code includes provisions for the new CSA Z462
Workplace Safety standard. This new standard offers direction regarding the integration of electrical
safety programs into Occupational Health & Safety systems to support due diligence compliance
requirements. This new standard offers guidance for the recognition of electrical hazards, risk
assessment, best practices and safety training.

Additional Related References;

 CSA Z432-04 – Safeguarding of Machinery

 CSA Z460-05 – Control of Hazardous Energy – Lockout and other methods

6.2 System Architecture

Introduction

Sensors, PLC’s (programmable logic controllers), SCADA (Supervisory Control and Data Acquisition)
and communication systems are the tools used to monitor and control the mechanical component of
locks and bridges. The correct selection and implementation of these devices is essential in order to

59
achieve optimisation of the operating methods (Section 3.5), safety (Section 7), security (Section Error!
eference source not found.) and information management (Section 10). The purpose of these sections
is to draw up a short inventory of tools and development recommendations necessary for a safe and
secure operation of movable bridges and locks. The tools discussed are:

 instrumentation and control (Section 6.3.1)

 sensors for water level measurement (Section 6.3.1.1)
 sensors for gate, lock, or bridge position detection (Section 0)
 PLC’s for process monitoring (Section 6.3.1.3)
 SCADA for supervision (Section 6.3.1.4)
 VMS (Section Error! Reference source not found.)
 communication technology (Section 6.3.1.6)
 data communication (Section 6.3.2)
 automation systems (Section 6.3.3)
 operational and technical safety (Section 7)

The following schematic visualisation gives an overview of the automation systems above that can be
necessary for remote operation of movable bridges and locks, all depending on the project.

Figure 24: Possible set-up containing the automation systems necessary for remote control

System Architecture for Remote Operation

This illustration gives a framework that can be used to analyse the technical management of remote-
control operations. As can be seen in the picture, each waterway infrastructure includes some traditional
components which are engineered and made to measure. They are geographically bounded and have
no real link outside the structure. Technical management can be locally organised. Remote control
systems have components that are spread out over different locations and are all connected. These
systems are integrated within the control rooms for either lock and bridge operations, water management
or technical monitoring. These characteristics request a technical management that is coordinated and
highly standardised across the different waterway infrastructures as well as across fast evolving product-
and system-life cycles.
60
 Figure 25: Possible approach for the system architecture for remote operation

When implementing remote operation, it is recommended to divide the operation for movable bridges
and locks into a primary and secondary operating chain. To increase the availability of the system, the
secondary operating chain must be able to function independently of the primary operating chain.

The primary operating chain consists of operator desks, process-, control- and safety functions and
actuators for the operating modes regular remote operation, local operation and maintenance operation.
The availability of this primary operating chain can never be guaranteed 100 %. For this reason, an
alternative operating circuit can be required for the critical operating functions, known as the emergency
operation (or secondary operating chain).

The emergency operation can be applied if the primary operating chain fails. This operation runs via a
simplified control panel to the underlying actuators and this guarantees that the movable infrastructure
can be brought to the desired state in a safe manner. The last procedure can be hand operation to bring
this structure into a desired condition. An example is a hand crank to close a bridge or lock door. In this
case, safety must be arranged in a procedural manner. If this procedure has to be an emergency
procedure, the system must be designed to reach a safe position in an appropriate defined time.

To guarantee safety it is important that each operating possibility must be locked (safety function) in
relation to each other.

61
 Management of System Architecture and Complexity

There is not one perfect way to manage the system architecture but not all are equally effective.
Managing the system architecture means managing complexity. The transition to remote control
increases the overall system complexity rapidly. If not well managed, complex systems are vulnerable
systems that are hard to maintain and expensive to modify.

There is a relation between technology characteristics and technical management. The technical
management of the overall system reduces and manages complexity by aligning itself on (sub-)system
boundaries and (sub-)system life cycles. It is recommended to organise the technical management in
the same way as the overall system architecture.

The components used to implement a remote-control system are automation- and IT-related such as
embedded computers, software and network components. As such, they have IT-related characteristics
inherently. As such, there is a difference in complexity compared with traditional steel or concrete
structures and electrical and electromechanical components (cf. Table 10).

Traditional components Remote control components

Slow technological development Fast technology development
Long product life cycles (> 10 years) Short product life cycles (< 10 years)
Compatibility forms no big issues Compatibility issues are supplier depended
Knowledge largely supplier independent Knowledge largely supplier depended
Knowledge relatively easy to codify Knowledge difficult to codify
Wide variety of possible contractors Specialized contractors

Table 10: Comparison of characteristics of technical components

Complexity is built in, in the use of automation-related components, because first of all, dynamics
increase. Secondly, because without proper standardisation, variety becomes very high as well, even
for components with almost identical functions and purpose. With automation components, component
lifecycles are much shorter. Time from design, to implementation, maintenance, modification and finally
disposal can range between 2 to 10 years.

In a remote-control system, several components are interlinked with components that are located
outside the physical boundary of the object. Therefore, to analyse the overall system, a purely
geographical and physically bounded breakdown is impossible, and a system perspective is more
suited. This is the approach found in the field of system engineering. Each sub-system has a role to play
and provides a service to the other subsystems. Combined they achieve a higher goal than just the sum
of the services.

A measure of complexity is the degree of interconnectivity. The sub-systems of remote control have
multiple interactions, they continuously exchange information and are interdependent. Given the fast
technological evolution and short life cycles, the sub-systems vary over time, as do the interactions.

Reducing complexity on a technical level can be done by:

 modular design
 clearly identifying and defining interfaces between (sub-)systems
 using minimal specifications for the services and interfaces between (sub-)systems
 creating multipurpose, open in between-layers
 separating functions/services
 if unavoidable, proprietary brand-based standardisation
To summarise, the system should be designed in such a way that it allows for continuous, fast and easy
updates, upgrades, adaptions and modifications.

62
An interesting communication protocol that can be used as an open in-between layer, is the OPC-UA
protocol (Open Platform Communications Unified Architecture). It is increasingly used as machine-to-
machine communication protocol for systems from a wide variety of suppliers and applications. This
approach is used in Flanders, Belgium.

To reduce complexity and to manage these (sub)systems on an organisational level, organisational

structure should be at least partially aligned with a division into (technical) sub-systems. This reduces
the need to transfer knowledge and reduces variety. At the same time, this will automatically result in
more transparent system borders, clearer system-interfaces and modularity.

To further reduce the need to transfer knowledge and cope with the high dynamics, it is recommended
to manage the different life cycle phases of the components of the same system from the same
organisational entity. These implications hold true, whether the organisation uses in-house staff or
outsources most tasks. When using outsourcing, procurement-strategy for a subsystem should
comprise and integrate the different life cycle phases such as implementation, maintenance and
renewal.

6.3 Technical Developments

Instrumentation and Control

Water Level Measurement Devices

Water level measurement can be a quite simple, reliable, low-cost and efficient system if it is designed
taking account its environment.

6.3.1.1.1 The Level Sensor in its Environment

A water level sensor is based on several physical principles: the duration of the round-trip of a (radar
or ultrasonic) beam, pressure applied on a transducer immersed in the water, etc.

Many aggressions or influencing factors can change the measurement:

 fluctuation of water level (waves), transport of ice, plants, floating wastes, lather, etc.
 influence of temperature, wind, rain, vandalism, rodents, etc.
 changes or alternations by electromagnetic waves.
In order to accurately and reliably capture water level measurements, care must be taken in the
installation of these sensors to avoid influencing factors mentioned above. The installation of the sensor
in a ‘stilling tube’ is common practice to control certain environmental factors.

When choosing a sensor, following aspects should be taken into account:

 family of the sensor

 the installation principle
 the protection system
 options to avoid malfunctions and high cost of maintenance

6.3.1.1.2 Considerations when Selecting a Water Level Measurement Device

Many technologies can provide a water level measurement.

Table 11 gives some information about the most used technologies on locks and bridges.

The choice of a water level measurement system depends on the following factors:

 rise
 resistance to the influencing factors
 need for maintenance

63
In choosing a system, following choices often have to be made:

 normal sensor vs ‘smart’ sensor (a smart sensor can control itself)

 simple sensor vs embedded sensor (with display, conversion)
 wire connected vs fieldbus connected

6.3.1.1.3 Water Level Measurement and Safety Function

Water level measurement is generally considered as simple information displayed to inform the remote
operators of the objects.

Sometimes, water level systems can be included in a safety function. This is the case when the level is
used to decide if the water level is the same both sides of a lock door. Mitre gates for instance, can only
be opened if the water level is the same on both sides.

In this case, the information given by the water level measurement system has to be trustable and has
to be certified as a part of the safety chain, and possibly be re-designed with safety devices, redundancy
and advanced supervision.

Technology Accuracy Influencing Factors Comments and Advices

Can gauge flow if inclined
Radar High Almost none
Quite expensive
Needs to be protected against wind
Wind
Ultrasonic Normal Use an external temperature sensor, in a representative
Temperature
place
Sediments Is in touch with the water, so subject to a lot of aggressions
Limestone Limestone has to be removed every year
Hydrostatic Normal
Ice Sediments can reach the sensor and create a low drift of the
Mussels/plants measurement.
Floating wastes
Is in touch with the water, so subject to a lot of aggressions
Float switch Binary Ice
Should not be used for a safety function alone
Plants

Table 11: Overview of the water level measurement technologies and their specifications

Position Detection

Automated locks and bridges feature several pieces of moving equipment (machinery) including, but not
limited to:

Bridges

 Bridge deck (swing or lift)

 Counterweight
 Support wedges
 Road Traffic Barriers
 Locking Pins/Assemblies

Locks

 Gates
 Sluices
 Locking Pins/Assemblies

For the automated control sequence, the systems need to know the operating position of all the moving
equipment. This way the control system can sequentially execute the pre-programmed sequence of
operation. Traditionally, the positions of the equipment are detected using limit switches. These limit
switches would be installed so that they detect the extent of movement of the equipment (e.g. bridge

64
fully opened or fully closed, gate fully opened or fully closed, road traffic barrier fully raised or fully
lowered, etc.).
There are many different technologies which are commonly used to measure the position. Originally,
mechanically actuated limit switches were used. To keep these types of switches operating in a reliable
way requires significant maintenance to keep the moving parts free from obstruction. The problems
associated with mechanical limit switches are overcome by using non-contact type switches. There are
many technologies which fall into this category. The two common ones which have been used
successfully on locks and bridges are magnetic read switch type and proximity type (inductive or
capacitive). Installed correctly, using robust brackets and striker plates, and in line with the
manufacturer’s instructions, these types of switches can give many years of reliable operation with a
minimum amount of maintenance. Limit switch mal-operation is typically caused by water ingress
(flooding) or as a result of people inadvertently standing on them and bending the switch brackets
resulting in misalignment of the sensor/striker plate. A good design and careful specification can
significantly reduce these issues.

The use of non-contact displacement (analogue) sensors is becoming increasingly common. These
sensors can be used to measure the full range of movement of a piece of moving equipment (as opposed
to discrete positions within the full range of movement provided by limit switches). The advantage is that
the position trigger points used by the system to sequentially execute the pre-programmed sequence of
operation can be adjusted through the software – and does not require the use of manual tools (such
as screwdrivers). Similarly, desired operating characteristics such as hysteresis and dead-bands can be
implemented using the control system operating software. Being able to measure the full operating
range also provides other benefits. The control system can evaluate operating speed by constantly
monitoring the position, which can be used to determine a fault with the equipment (i.e. obstruction or
damaged equipment). This can be trended and is often used in a predictive maintenance system. One
major disadvantage of this type of sensor is that the way they are installed in the equipment makes it
more difficult to remove and repair/replace them compared to switches. Furthermore, not all types offer
an absolute measurement.

Position detection sensors are often part of a safety loop and have to meet the proper Safety Integrity
Level (IEC 61508) or PL level (EN ISO 13849). The needed safety level is determined in the safety
design (part of the technical documentation).

Programmable Logic Controllers (PLC)

6.3.1.3.1 Principle

The PLC is the interface between inputs (sensors) and outputs (actuators) and is linked to a SCADA.
When implementing remote operation, one must decide on the installation principle for the bridge or lock
operation control system. Important is the focus on how the local (PLC) control system is connected to
the remote-control system.

One approach is to install the PLC’s locally to the object itself to activate the operation and safety
functions of the movable structures. This guarantees better availability in case of a disturbed or
interrupted connection with the central remote operating location. The local PLC controls the movable
structure, the traffic lights and barriers and collects all important sensor data like the water levels, voltage
or forces, positions of the movable parts, etc. The PLC gets its necessary control commands for the
current process step through the SCADA interface on the remote operator desk.

For the operation of movable structures, it is important to determine the operation functions for which
the use of Failsafe-PLC is necessary. More details on Failsafe-PLC’s (F-PLC) are included in section
7.3.4.3.

Today's technology is limited by the possibility to let different brands of security PLC’s communicate
with each other on a SIL or PL level. The advice is to choose an architecture in such a way that the
interface between different PLC brands is possible through potential-free contacts.

65
6.3.1.3.2 Considerations when Selecting a PLC

There are a number of considerations which should be taken into account when selecting a PLC
manufacturer and type. The following lists the main considerations:

 Communication Protocols – selection of PLC/manufacturer that supports open protocol

 Safety Functions – can be implemented by a number of methods including:
- Failsafe-PLC (the safety function code run is partitioned memory within the general sequence
PLC)
- Separate Safety Relays – interlocking independent of PLC
- Separate non-safety certified control relays – provided their performance is adequate for the
safety function performance level
 Diagnostic ability – reporting of failed cards/processors
 Redundancy – hot standby (dual redundant) configuration for high availability demands like
commercial lock/bridge applications
 Processing speed – needs to be considered, but most modern PLC’s will have adequate
processing power and memory
 Open competitive tendering – procurement restrictions which may require that a manufacturer
cannot be specified, but only the performance elements
 Commonality of spares – strategy to select and stay with a certain manufacturer and type of PLC
 Environmental conditions – can the PLC (and other electronic equipment) be installed in a
conditioned environment (i.e. humidity and temperature controlled)?

The cost of the PLC is small in comparison to the complete remote operation project.

Supervisory Control and Data Acquisition (SCADA)

Typical industrial control applications consist of field sensors, actuators, PLC’s and HMI’s. All process
control, decision making, alarm condition determination, etc. functions are performed by the PLC. The
HMI provides the operator with a way to visualise the process and issue control commands (start/stop,
change set point, etc.). Additionally, most HMI software packages provide some basic logging, trending
and reporting functions.

SCADA systems typically provide high level supervisory process management, but use other intelligent
devices, such as a PLC, to interface to the ‘plant’ machinery. The HMI features are similar in scope, but
the SCADA system has typically provided centralised process control for a distributed control system.
In other words, process logic may be performed by a SCADA-system, but it is not recommended to be
done in an HMI-system and should be done in the PLC only.

For example, an owner may wish to provide coordinated water level management across the breadth of
their control area. Each individual lock PLC would have control loops to manage the water level of the
local reach above the lock but would be unaware of the impacts or interaction between locks along the
entire river/canal system. In this case, SCADA system would be programmed to provide the river/canal
wide water level management scheme and send individual set points to each lock PLC. The SCADA-
system would collect data from each lock PLC to monitor the progress of the water level management
scheme. As functionality in the HMI and PLC systems has increased, the line between SCADA and HMI
and PLC systems has become blurred.

The SCADA-system is the interface for remote operation, it enables control and operation from a PC
workstation.

 SCADA – Supervisory Control: referred to as a part of the human-machine interface – allows

operators to supervise and watch over the installation, using a synoptic representation (‘the picture’)
of the object, surrounded with the controls and information of the processes relevant for the
operation.
 SCADA – Data acquisition is the capability of measuring, displaying, and recording values that may
be of interest to the operators. Such a system can plot graphs or generate scheduled reports of any
logged value or event.

66
The SCADA screen and keyboard are the easiest way to issue commands to the operating computer
and subsequently to the PLC and to view lock or bridge status on mimics. This presentation must result
in a precise and clear overview of the local situation and operation process. It is common to programme
the mimics to guide the operator through his task, actually highlighting the preferred responses or even
blocking all other responses.

It is recommended to implement a standard Graphical User Interface (GUI) for the operation of locks
and bridges for all remote control centres of one organisation/government. The level of detail must be
decided during the configuration stage for economic reasons. Different standardised GUI images are
included in Section 5.4.3.

SCADA servers can either be installed locally or at the remote operation centre.

Closed Circuit Television System (CCTV-System)

The closed-circuit television system plays a vital role within remote operation. Most automation logic is
integrated at the local installation. The operator however, is placed at a distance. The CCTV-system
enables to operator to see what is happening at the installation. It forms the visual link between
installation and the remote control centre.

With the rapid development sensors-technology, more and more interlocks and safety functions can be
implemented and automatically controlled by the PLC. But at this moment, there are no sensors, nor
Video Content Analysis (VCA) that can fully replace the eye of the operator. Reliable detection of cars,
pedestrians and ships is still ongoing research. This may take some time, since sensors that can be
used for this purpose, usually are developed for in-factory use, meaning, at short-distances and
controlled environments. Outdoor use at large distances poses a bigger challenge.

The CCTV-system basically consists of the cameras, encoders, a data transportation medium, a
decoder, a Video Management System (VMS) and the displays. Encoding/decoding can be omitted by
using IP-cameras.

When using a CCTV-system, there is a risk of losing situational awareness. This risk can be addressed
by carefully integrating the design with the HMI-design. One has to bear in mind that the final image
quality is a combination of different factors: camera setup, technology, lens, network connection, image
compressing technique, quality of the monitor, weather conditions, backlight, etc.

A well-designed CCTV-system is an added value for the operator. It can provide multiple viewing points
and both overview and details.

It goes without saying, privacy can be an issue when using the CCTV-system. Compliance with local
privacy legislation is a precondition.

6.3.1.5.1 Placement of Cameras

Height and accessibility should be taken into account when installing the cameras. Typically, the higher
the cameras are placed, the easier it is to get a good overview of the scene. A highly placed camera is
also less subjected to disturbing influences such as rain and snowfall, glaring of the sun or blinding by
headlights of vehicles. On the other hand, cameras frequently need maintenance and adaption. To be
able to easily clean the lenses or make minor changes, they need to be easily accessible as well.
Therefore, a fixed access or easy accessibility by an aerial platform truck is advised.

It is also advised to regularly evaluate the placement of the cameras, under different weather conditions
and time and day of the year.

With locks, a special attention point is the changing scenery with changing water levels. With movable
bridges, to changing scenery due to the movement of the bridge is to be taken into account.

The use of sturdy poles is advised to minimise wind-vibrations.

67
A good design of public lighting around the installation can attribute to a good image quality. Light
sources within the image are disturbing, as well as lights that are directed upwards towards the camera.
Strong coloured lights make an image hard to interpret. An evenly distributed light strength with neutral
colour, faced downwards with no visual light sources is preferred.

6.3.1.5.2 Cameras

Camera capability (i.e. resolution, light sensitivity, etc.) improves daily as the capital cost reduces.

Modern digital cameras with IP-based technology provide for good quality and flexibility. Even high-end
types are becoming more affordable. The modern-day camera supersedes the human eye and makes
it possible to operate in even near dark conditions.

The use of Pan-Tilt-Zoom (PTZ) cameras can be of added value but the use must be well thought out.
It can be used to go into more detail when a situation requires so, for example to read ship-names or
check mooring lines. It can temporarily be used as a back-up for an out-of-service camera. Its flexibility
is also its disadvantage; safety-critical viewing points must be kept in sight. Fixed cameras are preferred
for those, although the use of pre-sets can accommodate this issue to a certain level. PTZ’s add some
complexity to operation and systems.

6.3.1.5.3 Video Management

The video management system is basically a software to collect and manage the video streams from
the cameras. It provides an interface to both view the live video, and access recorded video-sources
and stream those sources to specific displays. It can manage the recording and storing of video sources.

In compliance with what is written about management of system architecture and complexity, it is a
recommended to separate the different layers of the CCTV-system and use industry standards.
Separating the choice of the VMS-system, from the choice of the cameras, allows more flexibility in the
future and allows for different speeds of technological development of the different layers.

By defining a standard concerning video handling based on standard streaming and PTZ formats
(ONVIF Profile S) and standardised routing decisions, the video handling is more robust, flexible, secure
and according industry standards. Besides that, video handling is easier to be integrated with other
business processes (like analytics) and services by delivering video streams in the format the device
expects.

Inventory of business-, functional and technical requirements must lead to the selection of a suitable
VMS. In this regard, it is worth mentioning that most VMS systems are developed to be used in security
and surveillance applications and not in machinery-operation and safety applications. This sometimes
shows in the functionality and performance of these systems. When using a VMS for safety-critical
applications, special attention must be given to functionalities like:

 detecting freezing of screens

 clear, sharp images
 minimal latency
 detecting and signalling latency-issues
 type and brands of cameras that are supported
 safely linking correct images with corresponding HMI

Some newer developments include:

 Stitching: merging images from different cameras into one larger image. This makes it easier for the
operator to interpret. Furthermore, mentally building an overall view is no longer necessary.
 Video Content Analysis (VCA) is the automatic analysation of video images to detect certain
scenarios. VCA interprets images and recognises human, maritime and road movements.

On the business side, it is to be decided if all video streams need to be accessible on all sites or just at
the corresponding control rooms.
68
Choosing one of the larger VMS suppliers gives the advantage of a multitude of standard capabilities.
However, custom made adaptions, support, etc. may be a lot harder to achieve. For this, a smaller, more
dedicated supplier may be favourable.

Communication Technology

6.3.1.6.1 VHF

For remote operation, an issue is the processing of a large number of messages transmitted partly over
the same frequency and partly over a different frequency. One must avoid the operator’s exposure to
too much or noisy messages. On the other hand, there is no room for errors in the addressing of shipping
traffic and the operator must pay careful attention to communication or stated otherwise, which vessel
near which object he is addressing.

Quick and easy switching between VHF radio channels is important. To efficiently respond to a call, it is
recommended that the operator can visualise the geographical origin of the call. Considering the
vastness of a network of waterways in a country, the transmission power of VHF-radio (both onshore as
on vessels) requires attention. Signals should not be transmitted or received from too far away.

To gain flexibility in the operations of locks and bridges it is essential that the communication means
can be rerouted from any object to any remote operator centre. To realise a nationwide VHF
communication network, it is essential to have a common, system independent interface and protocol
between the VHF transceiver on-site and the remote operation centre.

6.3.1.6.2 Two-Way Intercom

Communication between road/fairway users and control locations may take place using a two-way
intercom. A speaker system may prove necessary depending on the local situation. Sometimes, a
microphone is placed near the lock chamber to allow communication from the site to the control room.
There seems to be a trend towards the provision of maritime traffic information (e.g. about delays,
obstructions, etc.), which is triggered automatically by the operation of the equipment. DRIP’s (Dynamic
Route Information Panel) are making their appearance in informing maritime traffic (e.g. information on
waiting times).

6.3.1.6.3 VoIP

In addition to traditional VHF messages, there is a migration to electronic notifications over IP. A
dedicated VoIP (Voice over Internet Protocol) could be considered instead of relying on a general
network.

VoIP is the ability to use the IP network for the transmission of digitised radio signals as a replacement
for the two-way radio communications. Advantages to consider are the cost-effective communication
and the improved reliability by using the installed network infrastructure for remote operation. An
improved interoperability is introduced because VoIP can combine all communication systems into one
communication channel. VoIP gateways have been developed to enable existing two-way analogues or
digital transceivers to be interfaced with IP networks. IP network design should take into account the
aspects of echo, latency, jitter, etc. to guarantee Quality of Service (QoS).

6.3.1.6.4 Standardisation of Voice Data Stream for VHF Communication Systems

To achieve a standardisation of VoIP, Rijkswaterstaat (The Netherlands) has investigated the usability
and maturity of the EUROCAE ED-137 standard for VoIP ATM components. Interoperability between
VHF communication systems of different manufacturers was also an issue in the ATM sector and to
solve this, the ED-137 was developed by the European Organisation for Civil Aviation Equipment.

The protocol is based on standard VoIP consisting of SIP and RTP but with additional header
information. This additional header information contains the PTT and squelch signals to activate the
transceiver on site.

69
ROIP gateways are devices which connect an analogue radio with a 4W E+M analogue interface to a
network. The device translates the ED-137 voice data stream to analogue and activates the transceiver.
In case of an ED-137 compliant radio, the gateway is built in to the radio itself.

It is concluded that interfacing, based on ED-137 voice data streams is possible and the existing radio
sites can be easily integrated in the communication system using ‘ROIP’ gateways.

The standard standardises the voice data streams. Specific radio configuration settings are not
standardised, this remains vendor-specific. For usage in the maritime/inland waterway domain some
additional features are needed, such as the use of receiver voting/diversity and simulcast.

Data Communication

The biggest threat to reliable operation through data networks is the failure of the data network.
Redundancy and the existence of emergency (backup) controls are therefore of the utmost importance
and should be considered at the design stage. A high performing network (redundant, fast and able to
transmit a large amount of data simultaneously) is key to success. In addition, where video images are
transmitted, the use of industry-proven image data compression standards should be considered and
implemented.

Local Area Network (LAN)

The LAN is the local area network, local at the bridge or lock site. Necessary for local and remote
operation of the structures. For local data-communications (LAN) in movable bridges, locks and water
retaining constructions, it is recommended to define a reference design and standardisation of the LANs.
This way data-communication becomes robust, flexible, secure and according to industry standards.

Wide Area Network (WAN)

WAN or Wide Area Network is to connect the local infrastructure with the remote operation centre. A
reliable WAN connectivity from remote operation centres to all bridges, locks and water retaining
constructions is necessary for safe operation. When implementing remote operation, WAN must support
connectivity to all objects to accommodate critical aspects of remote control, like emergency stops,
control system signals, video systems and voice (Intercom, VHF, VOIP, etc.). Especially real-time video
requires a high-speed network connection to achieve a sufficiently high frame rate and an accuracy with
minimal latency.

A remote operation system is typically utilising fibre optic networks to allow for large amounts of data to
be transmitted from the local bridge/lock, back to the remote control centre in the form of sensor arrays
(positional data, pressure, level readings, etc.) and live camera images. To achieve a higher availability,
a ring-shaped structure can be designed, guaranteeing communication through the other segments of
the ring in case of link breakage.

In the Port of Antwerp for instance, the incoming and outgoing signals are no longer guided over classic
cabling from the peripheral elements to the central PLC, but to decentralised ‘IO islands’ scattered over
the site. These islands are connected to the central processors by a high-performing (fibre optical)
network. This setup not only avoids extensive cabling, but also prevents interference from disruptive
signals.

Communication Protocols

Most modern control systems support Ethernet communications, which are advantageous to remote
operations. The selection of an efficient control system communication protocol is not as critical as it
once was when long distance communication was limited in bandwidth and transmission errors were
common.

Typically, the communication protocol selected is constrained by the control system hardware and the
operator interface software. When multiple protocols are supported, key characteristics for selection are:

70
 Ethernet compatible communication protocol
 time stamping of data at the control system
 report by exception techniques to minimise data packet size
 support for cyber encryption: increased emphasis on critical infrastructure security requires more
rigor in protecting the data flow between the control system and the operator interface

For example, OLE for Process Control (OPC) has become a popular communication protocol within the
industrial control system environment. OPC allows data to be resolved by a tag name. The OPC
communication architecture is server/client based. Each client (data consumer or provider) registers its
tag database with the server. The client (data consumer) polls the server for changes (individually set
parameters per tag) since the last poll. The server polls clients (data providers) for changes in a similar
manner. Efficiency is achieved as multiple clients (data consumers) can register the same tag and
receive individual updates without duplicating control scans. Each data point is time stamped at the
source (control system) so that event sequences can be reproduced without the effect of transport
delays.

Converging Business System Networks with ‘Industrial’ Control Network Data

This section is intended to discuss the network aspects of converging business system networks with
‘industrial’ control network data. The main issues are ‘bandwidth allocation’ to the carried data stream
packages and the fire-wall of the systems from each other for security.

The network between the site (lock or bridge location) and the central control centre can either be
shared, fully separate or partially separated.

There are pros and cons to having a single (converged) or separate networks to carry the service data.
Separate networks allow for physical segregation of the services carried out and can make maintenance
and fault finding easier. Converging separate services onto a single network can reduce installation and
maintenance costs but can add complication as it can require the implementation of several data
protocols required. Where a converged network is implemented, it has to be carefully configured to
ensure that priority of service issues do not affect the quality of services due to network delays (i.e. loss
of CCTV frames, delays to bridge/lock commands reaching the site).

In particular the implementation of remote emergency stopping requires special consideration. To

successfully implement remote emergency stopping over a network requires special consideration to
ensure that the desired SIL/PLr is met. One such protocol which has been successfully used in remote
applications is ProfiSafe.

When implementing remote control and automation on a shared network carrying other services,
extensive cooperation is required between the IT Departments and Engineering Department.

Automation Systems

Operator-Decision vs Machine-Decision

When implementing remote operation, it must be considered to implement automated process

decisions, such as when an operator can start a procedure and when the process can be automated.
Semi-automated systems limit the number of actions the operator can perform. An example is closing a
lock door: the operator pushes the button ‘close door’ and the operating system autonomously initiates
the actions below (typical):

 starting the electric motor

 declutching the brakes
 accelerating the door
 maintaining the door at speed
 initiating deceleration
 stopping the door at the right position
 clutching the brakes

71
 disengaging the installation

Automation of Water Management

For straightforward water management situations with clear boundary conditions and stable influences,
water management can be completely automated. Pumping stations and weirs can be controlled fully
automated when they have a fixed target level and few dynamic or extraordinary situations.

Water management however can become very complex, in for example the following:

 navigation and water management are deeply interconnected in terms of water usage
 trade-offs between navigation and water management need to be made
 salinity and environmental parameters need to be managed
 high dynamics with frequent extreme situations of very high or very low discharges
 prior or predicted weather conditions have a high impact in the decision making
 high impact of upstream water basins or structures
 high impact on downstream water basis or structures
 transnational agreements to be followed

In such situations, it can be near to impossible to develop a clear algorithm that’s effective in every
situation. It is advised to separate the decision-making process and the (machinery) control of the weirs
and pumping stations. A decision-support system can take into account a large number of parameters
from different sources and can present a number of predictions based on different inputs and
hypotheses. This can be made much more sophisticated, dynamic and flexible than a control system.
Based on the different predictions, a human can then oversee the results and make the final decision
as input for the control system. A near real-time feedback between decision support system and the
control system should be in place.

This approach is currently implemented for the complex water management of the canal Ghent-
Terneuzen (Belgium-the Netherlands), and its newly built lock.

Automation of Railway Bridges

For the automation and remote operation of railway bridges, a specific agreement with the local railway
authority is necessary. For example, at ‘De Vlaamse Waterweg’ (Belgium) remote control is introduced
to improve customer service on the one hand and make the control of railway bridges more cost-efficient
on the other hand. Several agreements were closed between de Vlaamse Waterweg and the local
railway authority to reach this goal and remotely control some of the railway bridges. In these
agreements special attention is paid to maintain the operational reliability, to ensure that operational
malfunctions have no major impact on the railway and waterway traffic. One area of attention concerning
operational reliability, is the data transport between the bridge and the remote control room, which needs
to be fail proof. This is done by upgrading the data security and installing the necessary backup systems.

Traffic Control

Traffic control management is the topic of PIANC InCom’s permanent Working Group 125, and the aim
of this report is not to describe these systems, but to give some information about the relation between
the traffic control systems and the operation of locks and bridges.

The following systems are developed to aid traffic control on important maritime junctions and a national
network of waterways. Ship and cargo information is needed for accurate response in case of calamities.
The implementation of these systems enables further professionalisation and integration of traffic control
on an increasing number of waterways.

Systems may increase sustainability: if a vessel will be delayed further on, the skipper/captain can be
informed. New technologies enable looking further ahead and enable operators to guide traffic over their
entire route (waterway corridors). This process may be automated extensively, making it possible to
automatically signal deviations and thus adjusting planning.

72
The exchange of information between the waterway managers and skippers can improve the navigation
performance. Knowing where the boats are, where they go, and their speeds, a lock or bridge keeper
can delay or start an operation to optimise the medium waiting time. Knowing the exact time, the bridge
or lock will operate (lock planning), a boat can adjusts its speed, and save fuel and money. Globally,
this exchange of information is a very good example of a win-win partnership.

 AIS – Automatic Identification System

AIS is composed of an on-board transmitter which gives the name, position, speed, course of a boat.
The information can be received by other boats or by ground antennas to be embedded in computer
systems.

An AIS transponder can include a navigation system (according to the Inland ECDIS S-57 standard)
and uses VHF frequencies to communicate. Depending on the waterway, the combination of radar
images and AIS information can be an added value.

Currently, not only sea-going vessels, but also inland navigation vessels use AIS transponders. These
transponders make sailing routes available beforehand. Correct analysis of the vessel position, course
and speed enables operators to predict the traffic volume and arrival time at locks and bridges. This
information can help to prioritise and plan traffic (e.g. if a vessel will be delayed during its journey, it is
no use giving it priority at an earlier stage).

 VTS – Vessel Traffic Services

The main objectives of VTS is to:

- aid the mariner in the safe and efficient use of navigable waterways
- afford unhindered access to pursue commercial and leisure activities, subject to any
restrictions that may exist
- contribute to keeping the seas and adjacent environment free from pollution

 RIS – River Information Services

RIS support inland navigation traffic and transport management and, where feasible, coordination with
other forms of transport. River information services include:

- geographical, hydrological and administrative data on waterways (‘fairway information’)

- data relevant to navigation in the short, medium and long term (‘tactical and strategic traffic
information’)
- action in the event of an accident (‘calamity abatement support’)
- statistics, customs services, waterway charges and port dues
EU countries must:

- ensure their RIS are efficient, allow for expansion and can coordinate with other systems
- supply all RIS users with the relevant data on navigational and voyage planning
- establish RIS centres according to regional needs
- designate authorities to oversee RIS application and the exchange of international data
The European Commission is responsible for setting out, by agreed deadlines, the technical guidelines
for the planning, implementation and operational use of RIS. These include:

- an electronic chart display and information system

- electronic ship reporting
- notices to skippers
- vessel tracking and tracing systems
- compatibility of RIS equipment

 Lock planning software

In order to prepare for a smart traffic management system, one must invest in a lock planning software
which can combine the standard lock planning with the available information of AIS and route planning
registrations of skippers.

73
 Detection Systems

Detection systems used for ship, vehicle and pedestrian detection can improve safety by detecting
obstructions before or during movement of bridges and lock doors. As a result, detections can alert the
operator or directly avoid the movement. In a more developed system, detection sensors can allow more
automated systems to operate without bridge or lock operator (passive automatic operation).

Each technology has its own limits. Sensor selection must not only be based on efficiency but also on
maintenance issues, availability and safety. The more sophisticated the sensor is, the more specialised
tools, software, and training provided to the maintenance crew must be. A technology inventory in
included in appendix.

A few practical examples:

a) Laser scanners
In safety solutions, the detection range of laser scanners is limited depending on the angular resolution
and spot diameter. E.g. in case of detection in a horizontal detection area, it might be possible that a leg
isn’t detected at larger distances because it can stand between two beams. The positioning of
safeguards is documented with respect to the distance and approach speeds of parts of the human body
(EN ISO 13855:2010).

For use on movable bridges and locks, the performance of laser scanners is affected by bad weather
conditions like fog, rain, snow, etc. Use of multi-echo technology enhances the reliability by filtering
smaller echoes caused by the environment.

A practical example for road traffic detection is described in Section 6.3.3.66.3.3.6.

b) Radar detectors
Radar is more applicable in outdoor conditions since the sensor’s functions are unaffected by wind, rain,
fog, humidity and air temperature, making it ideal for outdoor harbour conditions. Radar/microwave
detectors or through-beam detectors can detect at large distances up to 100 m. Marine radars for
imaging radars can detect at even larger distances up to 1 km.

For detection of ships, when slow movements or stationary objects must be detected, FMCW radars
should be used.

For detection of vehicles and peoples on a bridge, radar can experience false detections caused by
reflections on the metal bridge structure.

A practical example for ship detection is described in Section 6.3.3.6 .

c) Electrostatic sensors
Electrostatic sensors rely on minute variations in dielectric properties to infer positional variations and
internal composition from contact-free capacitive measurements. Currently, it is also developed for
pedestrian detection to warn truck drivers for collisions with cyclists and pedestrians concealed by the
vehicle’s lateral blind spot. A practical example for person detection is described in Section 6.3.3.6.

d) LIDAR
LIDAR (Laser Imaging Detection and Ranging) sensors use light energy, emitted from the sensor, to
scan the background and measure variable distances. This generates a matrix of ToF measurements
to produce very detailed maps. A practical example for ship position detection is described in Section
6.3.3.8.

Fully Automatic Operation

To ensure a safe automatic operation, detection sensors are used for a safe supervision of the different
areas of movable bridges and lock gates. In these areas, pedestrians, vehicles and vessels may be at
risk before, during and after the operation to open or close the bridge/lock gate. With remote operation,
74
this supervisory task is done by an operator relying on cameras. With fully automatic operation, this task
is automated by means of equipment which can reliably detect objects, people, vehicles and ships in
the areas at risk. The reference projects which are touched upon only briefly below, are elaborated
further in the dedicated brochure on reference project designed by the WG, as stated in Chapter 1.2.

6.3.3.6.1 Reference Canal and River Trust, UK

In 2017, the Canal and River Trust implemented a fully automated swing bridge which took responsibility
for the activation of the emergency stop (on the occurrence of a hazardous event). The emergency stop
was replaced by laser scanners which scan the road deck and areas under and around the bridge
approaches to automatically stop the bridge movement on detection of an obstruction which could lead
to an entrapment hazard. Although this has been implemented successfully, this solution may not be
suitable in certain circumstances (i.e. poor weather or on bridges where the width of the navigation is
too wide).

The bridge is currently fully operational and, if necessary, in cases such as a breakdown or road traffic
event, operational teams are dispatched to assess the situation and operate locally from a traditional
control pedestal.

Trials demonstrated that lasers are not good enough in detecting matt black objects (i.e. vessel hulls).
This problem was handled by the supplier by modifying the lasers to lower threshold and revise the pass
criteria.

A Safety Analysis Report concluded that the identified control system safety functions implemented are
capable of providing a level of risk reduction which is commensurate with the target SIL levels.

6.3.3.6.2 Reference the Netherlands

In the province Overijssel (the Netherlands) bridges have been operated automatically for a
considerable time: sensors detect approaching vessels and scan the bridge deck and the area near the
barriers.

The Port of Rotterdam has conducted a test on the Erasmus bridge using heat sensitive cameras to
detect pedestrians at night or in case of rain. The conclusion was that this type of camera should be
used as an addition to, rather than an alternative to classic cameras.

6.3.3.6.3 Reference Port of Antwerp, Belgium

To anticipate the development of maritime logistics, the Antwerp Port Authority has started the ‘ARGUS
project’. This project is a quest for technical opportunities to improve the operating productivity of
movable bridges and locks.

The goal of the ARGUS project is designing an automated control system for all movable bridges and
locks of the Port of Antwerp. A proof of concept installation is designed to compare and evaluate different
types of detection systems, measurement principles and technologies, and comparable technologies
from different suppliers. The difficulty of this feasibility study is to verify if new technologies on the market
can be combined successfully into a new system which complies with the constraints of the port
regarding reliability, safety regulations and the European machinery directive.

The proof of concept has resulted in a first selection of possible applicable detection systems. The tested
LIDAR laser scanners, microwave barriers and radar scanners were evaluated to be very accurate.
Technologies based on video content analysis were more focussed on security applications and are
therefore not applicable for safety solutions. But even for the more accurate detection technologies,
there is currently no product fully applicable. For the use in a fully automatic control system, the detection
system needs further development for this combination of safety SIL certification and reliability in a
specific outdoor environment.

The proof of concept installation will be updated according to the test results in combination with new
technologies, e.g. high-frequency radar technology and electrostatic sensors. These technologies will
be further tested in 2018/2019. Not only detection technologies will be tested and compared, also the

75
environmental requirements will be taken into account. The sensor performance will be analysed for
different environmental conditions, rain, heavy rain, snow, fog, etc.

Self-Service for Operation by Vessel Operators

6.3.3.7.1 Introduction to Self-Operation

Self-operation is a particular way of introducing automation and remote control, especially in leisure
navigation, for serving locks and bridges. This type of operation allows vessel operators to operate the
object without intervention from a remote control operator. Different degrees of self-operation exist,
ranging from manual operation by the vessel operator, to advanced and innovative remote terminals so
that control and steering can happen without leaving the vessel. A central control room will have
oversight of all bridge and lock status and activity through SCADA- and CCTV-systems but does not
interfere in the operation of the objects itself. The control room can also act as a single point of contact
for vessel operators in case of emergencies or malfunctions.

Self-operation fits particularly on the small canals with little traffic, but is not appropriate for big canals,
high traffic level areas and harbours where the lock valve water velocities including the size and weight
of vessels produce more problematic or dangerous situations.

Mistakes that should be avoided when implementing self-operation are listed below:

 A lock or bridge keeper doesn’t only operate a lock or bridge, they also perform safety functions,
traffic optimisation and report on maintenance and diagnostics.
 Mechanisation and automation do not work on ill structures. If the self-operation projected includes
mechanisation, the structure must be in good health. You can't implement automatic systems if the
mechanical parts cannot move easily. It is highly recommended to make a diagnosis and renew, if
necessary, all civil and mechanical parts of the concerned works.
 It's better to implement a simple system: it costs less, needs less maintenance and is easier to
modify or improve. But the design of a simple system needs a comprehensive analysis to be
efficient, safe, and available, and a strict application of methods and rules must be done.

6.3.3.7.2 Different Ways of Self-Operation

All following solutions have to be implemented complementary to the prescription discussed in the
introduction (maintenance, diagnostic, statistics, etc.)

1. Self-Operating Using Handles (Or Similar)

In this solution, a helmsman climbs on the platform and manually operates on handles to move doors,
sluices or bridge. Normally, no dangerous movements can be undertaken, providing operating
instructions can be enough.

To go on the platform, some equipment is needed:

 a dock or a wharf with bollards to get out of the boat in safe conditions (and in later)
Note: in France, the ladders on a lock wall are considered as safety equipment, and don't have to be used in normal
conditions.
 a footpath to walk to the platform
 lighting, if necessary
There are two problems with this solution:

 for the lock, both sluices (upstream and downstream) can be opened at the same time, so the
upstream pool can get empty, and the downstream pool can overflow
 anyone with a compatible handle can operate the work

76
2. Self-Operating Using Electrical Push Button (Or Similar)

The principle is the same as the predecessor, but it's easier to avoid unexpected movement. In this
solution, it is easy:

 to design a helpful lock/user interface (with indicator lamps, instructions, etc.)

 to control if a movement is requested at a favourable time and unexpected movements can be
avoided
 to put an emergency stop
 to call for maintenance

Some concepts can be used:

 one button for each function (start drive, open sluice, close sluice, etc.)
 one button to open and one to close sluices and doors
 one button for all functions
 a mix of this different concepts

3. Self-Operating Using a Radio Remote Control

This concept is a little different from the previous one: the buttons are on-board, and generally a solution
with a few buttons is preferred.

Note that the helmsman doesn’t order a movement, he requests for the permission to pass the bridge
or lock. In the afore-mentioned cases, the helmsman decides to move a door and is responsible for the
risks (for example to close the doors when a boat is entering a lock). In this case, the demand is
registered, and the lock will be prepared when the cycle allows it, and the doors will close after a defined
time.

Nevertheless, a problem can occur if a helmsman asks for lockage when a boat is entering the lock. A
procedure must be given to the helmsman to increase their awareness on this point. Some concepts
can be used:

 one button to cross upstream, one downstream, one lockage, one stop
 one button to cross, one for lockage, one stop
In this solution, no specific equipment is requested, but the remote terminals have to be distributed and
reclaimed after use.

4. Self-Operating Using Advanced Remote Terminal

This solution is quite similar to the previous one, but the remote terminal allows an advanced
management of the boats and lockage.

The helmsman asks to pass the bridge or lock, and the boat is added to a waiting list. When the lock or
bridge is ready, it will check sizes and priorities and decide which of the boats will be allowed to
enter/cross first. The boats will be allowed to cross individually. A single boat cannot start the lockage,
the lock will ask each helmsman in the lock if he/she is ready. All of them must answer ‘yes’ to start the
lockage.

6.3.3.7.3 Reference Project in France

In France, self-operating is possible by using an advanced remote terminal. The remote control has one
button to ask a crossing, one for lockage and one emergency stop.

The locks that are mostly used by leisure navigation, are automated to keep a good amplitude of
operating hours, even in winter when only few boats are on the canals. The users are generally equipped
with a remote terminal to ask for lockage.

77
Many terminals have been developed since 1990’s, and users have often to change of terminal when
they travel in France.

Figure 26: Reference project ‘SCUO v2’

A new remote terminal is called SCUO – (Communication System between the User and the
Infrastructures) and consists out of several technologies: 433 MHz and 866 MHz radio systems, GPS,
GSM, safety buttons, submersion detection, updating software, etc. it can communicate with old
automation systems.

The terminal fulfils the classical benefits of standardisation (compatibility, maintenance, development
costs).

Concerning the system, the connection to RIS is a big step to know the user and systems behaviour
and to define the future operation mode choices.

6.3.3.7.4 Reference Project in UK – Canal and River Trust – 2016

The Canal and River Trust currently has fourteen mechanised bridges on the Gloucester & Sharpness
canal that are operated by staff for the use of skippers. Manning of these bridges is not only costly but
has a number of negative impacts on customer service. This project has looked at new technologies
that will improve both customer experience alongside reducing costs to the Trust.

A solution has been developed that will transform the navigation experience through an innovative
design which offers a primary method of ‘Self-Service’ remote operation to skippers.

As a skipper approaches a bridge, a previously downloaded software application on their ‘smart device’
will automatically detect they are within a Trust ‘Self-Service Zone’ for a particular bridge. The application
will ask if they wish to operate the structure ahead. A simple one touch request on their ‘smart device’
will operate the structure, while giving updates on the sequence of operation and instructions to wait
and proceed as appropriate. Operation will only be possible for registered users with an appropriate
waterway license.

There will be no requirement for the skipper to leave their boat. The application will be secure, and
skippers will need to register with specified details before downloading it. A number of lasers installed
strategically on the bridge deck and canal within the bridge operating zone together with existing safety
systems and interlocks will ensure safe and reliable operation.

A bridge control room will have oversight of all bridge status and activity through SCADA- (Supervisory
Control & Data Acquisition) and CCTV-systems. The control room will also act as a single point of
contact for skippers and bridge users.

78
 Vessel Self-Spotting and Self-Positioning

Radars are increasingly used to enable vessels to position themselves with respect to the shore/mooring
platform. In the meantime, satellite navigation has been developed to such level that localisation is
accurate up to a few decimetres. Information relevant to safe passage through a canal may be
communicated by systems using localisation as well as by beacons on the shore. In some visibility
conditions this is even more accurate and therefore safer.

In 2005, The St. Lawrence Seaway Management Corporation (SLSMC) began investigating
technologies to automatically spot vessels within their locks. Prior to this time, vessel spotting was
performed manually by operators stationed at each lock structure. Manually spotting the vessel required
operators to walk along the lock wall adjacent to the bow of the vessel and provide the vessel captain
with spotting instructions via radio. As many of the vessels that transit the seaway locks are maximum
size (225.5 x 23.8 metres or 740 x 78 feet) positioning the vessel in the lock is critical to prevent accidents
during the lockage process.

The key drivers in the original development of a vessel self-spotting system were:

1) provide sub-meter vessel position measurement accuracy

2) operate reliably in all weather conditions (fog, heavy rain, heavy snow, etc.)
3) minimise radio communication as the vessel enters the lock
4) allow customised final mooring position for each vessel
5) eliminate the requirement to install any expensive equipment on the vessel itself
6) relieve SLSMC operations staff from having to spot the vessel and allow them to secure the vessel
mooring lines more quickly
7) reduce the number of operations staff required to moor a vessel

Various technologies were investigated that would meet the business requirements above. The result
was a laser-based positioning system that scanned the front of the vessel as it entered the lock,
determined the most forward part of the vessel and displayed the vessel position in relation to the final
mooring position using a large digital display.

The resulting system consists of two laser scanners mounted at each end of the lock. To achieve 3-D
scanning, the laser scanner was oriented to scan vertically approximately 110° and a rotary stage
actuator is used to provide horizontal scanning. Two large 4-digit displays are mounted at each end of
the lock to provide the captain with visual indication of vessel position. An automated radio message is
broadcasted to provide the captain with audio indication of vessel position.

Figure 27: Vessel self-spotting system installation

79
During the thirteen years of service, the vessel self-spotting system has undergone a number of
improvements. Increased accuracy and detection distance were realised by synchronising the rotating
laser (vertical scan) with the rotary stage (horizontal scan). Errors caused by reflections off the water
were corrected using the vessel dimensions and draft to eliminate scanning one meter above the water
line.

Generally, the system has performed well over the years. However, the accuracy could still be further
improved by modifying a wide range of vessel hull configurations and paint colours. The next step in
driving the performance and accuracy to a higher level is taking into account environmental conditions
(heavy snow and rain) and component obsolescence SLSMC is currently investigating LIDAR
technologies for the next generation vessel self-spotting system. With the advent of remote lock
operation, the vessel self-spotting system role becomes critical.

Hands-Free Mooring

The St. Lawrence Seaway Management Corporation designed a hands-free mooring system to replace
the steel cables used to moor vessels during the lockage process. Primary to the design were the safety
aspects of protecting workers and users from the danger of cable breaks. Additionally, the physical effort
required to handle the steel cables was an increasing source of injury to the staff. Lastly, the elimination
of the requirement for vessels to be outfitted with steel cables allows a greater percentage of the world
fleet to successfully transit the system.

The hands-free mooring system is comprised of automated mooring robots which employ vacuum pads
to hold the vessel in position during the lockage process. The system was designed to provide 20 tonnes
of holding force per suction pad and there are three double pad systems installed at each lock. Two
mooring machines (four pads) were deemed to be sufficient to replace the steel cables previously
required to moor full-size vessels. A third mooring machine was added to provide spare capacity for
maintenance cycles and to accommodate vessels with hulls that make it difficult to achieve a proper
vacuum seal.

The automated mooring system is being integrated into the lock automation system to make it more
effective. Data from the traffic management system will automatically be sent to the mooring system as
the vessel approaches the lock. This data will indicate how many vacuum pads are required to achieve
the minimum system capacity to safely process this specific vessel. Also, the data will include the initial
vacuum pad position (height above the water) where the mooring system has the best chance to
successfully attach to each vessel.

The hands-free mooring system, as implemented by the St. Lawrence Seaway Management Corp., has
proven to be very effective on all of the vessel fleet that transits their system. Currently, hands free
mooring is not used for pleasure craft, military vessels, cruise line vessels, vessels with damaged hulls
or vessels with insufficient freeboard. In the pleasure craft, military vessels and cruise line vessel, the
concern is the potential of hull damage (abrasion, etc.). When the hull is damaged or has incompatible
features (rivets, rub/wear bars, etc.), the hands-free mooring system often cannot achieve the required
vacuum capacity to safety secure the vessel. Otherwise, great success was achieved in mooring to all
sizes of vessels up to the Seaway maximum (23.8 m x 225.6 m).

The installation of the hands-free mooring systems has facilitated the move of the operators from each
lock into the control centre. The elimination of wire lines has allowed the vessels to reduce the number
of crew members required on deck during a canal transit. They have not only realised this as a direct
cost savings, but also reduced the need for ‘safety rest’.

80
 Figure 28: Hands-free mooring system used by the St. Lawrence Seaway Management Corporation

Simulator Technology

AWATAR Simulator in Belgium, Flanders

The goal of the AWATAR project in Belgium (Automation of Waterways: Training and Reference Centre)
is the development of technical, functional and operational standards for remote operation of bridges
and locks, integrating them into a training simulator and setting up a training course for operators.

A virtual world of waterways with different types of locks and bridges is created within the simulator.
These virtual locks and bridges can be operated from a reference control room, serving as a realistic
representation of a real control room. The purpose of the AWATAR project is to streamline and
standardise the way in which infrastructure is automated as well as operated remotely, by creating
reference designs as well as standardised operating procedures. More specifically, the simulator serves
as an aid for:

 co-creating a user-centred and standardised human-machine interface in cooperation with

experienced operators
 evaluating and fine-tuning of operating procedures and functional specifications
 drawing up the functional and technical standards for remote control operation
 training new and experienced operators on how to operate installations remotely, in both normal as
exceptional circumstances
 creating buy-in for all personnel involved in the transition process
 facilitate and speed-up the technical conversion projects from manual/local control to remote/central
control by virtually prototyping and testing items such as camera viewing-angles, specific HMI’s,
functional safety

The use of detailed, uniform and standardized technical and operational specifications increases safety
and at the same time enlarges the flexible deployment of personnel across installations and control
rooms. The AWATAR simulator also serves as a tool to provide training and instructions for the operators
with the goal to build trust and cooperation. This is of vital importance to mitigate reluctance to this new
form of remote operation.

Figure 29: AWATAR simulator setup

81
 Plant Simulation in Germany – PLC Control Application Software Testing

There are different tasks in the field of automation of plants or machines. One main task is the
development of PLC control application software. In the past it was quite normal to have a rudimentary
software test on electric panels. These tests were far away of testing or simulating the software
application for the whole lockage process. This made it complicated and time-consuming in the later
software commissioning phase. Usually the PLC control application software could be developed before
the construction of the control cabinet was finished. The drawback is that comprehensive testing is
nearly impossible.

Nowadays, it is possible to design a software simulation model of the lock where the behaviour of the
real process is mapped. The PLC can be connected to the model and the application software can be
tested. Therefore, it is necessary to generate a simulation model which fits all needed aspects of the
real-world process.

The newest approach is to generate a simulation which has nearly the same behaviour as the real lock.
The starting point for this is a configuration software which has:

 modern graphical interface for the development of the virtual lock

 numerical methods for the physical properties of the virtual lock
 visualisation of the behaviour of the lock for better understanding
 interfaces for different bus systems
 real-time simulation environment
This simulation environment runs on a standard PC with an interface to the bus system which is
connected to the PLC controller and to the SCADA-system (HMI). It is possible to test the PLC
application software in the same way as it runs on the real lock. While testing the application software,
the engineer is able to force the sensor or actuator signals in the simulation environment to provoke
malfunctions and its response to the application software.

The benefits of this approach are the following:

 testing the PLC application software without the real lock

 improving the PLC application software while testing
 shorting the software commissioning time because of better software
 training the operators before they work on the real centre/lock

Because of the PLC simulation model, the PLC application software contractor can also be enforced to
demonstrate the development status of the software. The public client is now able to assess it without
affecting the real lock. In Germany, this approach is more and more frequently used for locks, bridges,
and the new ship lift in Niederfinow. A schematic presentation is depicted below.

Figure 30: Schematic presentation of the PLC simulation model

82
 Simulator in The Netherlands

For the new Tallinn Harbour Bridge, a 3-D model of the bridge was used to simulate the remote control
interface. A gaming engine (Unreal Engine) was used to program the interactive elements. The
simulation is used to optimise the camera plan and the GUI. Using this tool, the operation of the bridge
could be showed to the future operators. Further, using the tool in the design phase has prevent costly
changes during or after commissioning.

Figure 31 shows the simulation interface. Simulated camera images are shown on the left and the
operator panel on the right. By clicking on the operator buttons the opening or closing process can be
started. Once started, the traffic signals are activated and the movement of barriers, bridges and passing
ships can be seen on the screen on the right.

Figure 32 shows an example of the programming interface. Actions performed on the simulation screen
are connected to animated objects (e.g. blinking signals, moving bridge) and their desired behaviour is
defined in building blocks.

Figure 31: Simulation screen

Figure 32: Programming sequences

83
 Simulator in Belgium, Port of Antwerp

The purpose of this simulator was fourfold:

1. Providing an environment for the development of the HMI (desk layout) and design of the GUI.
This way, it was easier to show the operators what their future workplace would look like and how
the SCADA images and operation procedures were implemented. The simulator was extremely
helpful during discussions since it provided almost lifelike images and the movements and reactions
of the installations were very realistic.
2. Providing an environment to develop the camera plans. Initially, the first draft of the camera plan is
done on paper. Then this design is put into the simulator. The simulator allows for a great number
of adjustments each camera: xyz-coordinates, viewing direction, image resolution, aspect ratio,
lens, etc. The simulator also allows showing a desired camera image on a specific monitor at a
specific moment, thus providing only the necessary information in accordance with the executed
step in the operating procedure.
3. Providing a developing and testing environment for the SCADA and PLC code during future
(smaller) modifications.
4. Providing a training tool for the operators and maintenance staff. Beside the normal operations, the
trainer can also trigger a number of specific situations:
a. pedestrian on the bridge, ship in the path of a lock door, etc.
b. partial power outage, lock door out of order, navigation light does not work, etc.
Special features:

 For each object, the actual PLC code is used in the simulator, with only minor adaptations
 The speed of movement of bridges, lock doors, barriers etc. are exactly as in real life
 Time and date can be set, and the position of the sun follows accordingly, so for instance reflections
of the sun can be examined to prevent blinding of cameras
 Simulation of rain, fog, snow
 The simulator contains the height of the tides on the river Scheldt, according to the tidal calendar of
a certain reference year. The filling or emptying time of a lock changes in relation to the water level
differences between docks and river
 A number of different vessel types are 3-D modelled and can move through the locks or bridges and
the adjacent waterways
 Road traffic contains cars, trucks, forklifts, pedestrians, trains
 Traffic reacts to the traffic or navigation lights
 Gauges on the SCADA screen show measurements like opening angle of a bridge, opening distance
of a sliding lock door, electrical currents

84
7 SAFETY
7.1 Introduction
Section 6.1 already discussed on the legislations and technical standards that are important for the
development and production of safe machinery. The risk assessment should describe the necessary
risk reduction measures that have to be carried out.

This section will describe some considerations on the practical implementation of safety measures. The
requirements are described for operational safety and technical safety.

7.2 Operational Safety

Situational Awareness

When operators only operate remotely, they might lose the knowledge of the object in situ and
surroundings. Therefore, it is important that remote operators develop and maintain knowledge of the
local infrastructure, local characteristics and the surrounding environment. This can be achieved by
periodical trainings at the object.

The whole installation should allow for a so-called graceful degradation e.g. built in redundancy through
redundantly configured loops in the network, double connections etc. If, despite these precautions, the
connection with the local object is compromised, an emergency stop should automatically and
immediately follow. Since local operation is then the only option, an operator or maintenance engineer
may be dispatched to locally monitor and operate the bridge or lock. The installation is switched from
remote to local control and the operator or maintenance engineer will use the local control equipment.

All depends on the management decision on defined procedures and training requirements, as
discussed in Chapter 5 – Operational implementation.

Responsibilities Relative to the Operation of Barriers

Traffic signs for road and water traffic implicate regulations fixed by law for the road and waterway users.
There is no doubt that the responsibility to stop at the red traffic sign lies with the road traffic. But when
operators operate remotely, the traffic lights and barriers are not in direct view for operation.

How a waterway authority approaches the operational responsibilities according to the operation of
barriers, bridges and locks can be different, for example do the operators have camera images of
approaching road traffic? A waterway manager can decide not to present camera images of approaching
road traffic to the operator. E.g. in the Netherlands, the operator is not responsible for not stopping cars
and a sign is installed at the barriers to notify road traffic of the ‘automatically closing barriers’.

Another approach is to present the camera images of approaching road traffic to the operator, but the
reason to do so is not for safety reasons. The view of approaching traffic can help to assess the possible
nuisance to the road traffic. The camera images help the operator to avoid unnecessary traffic jams
when closing for road traffic.

Besides the view of approaching road traffic, it is important to mention the responsibility of the operator
when activating moving parts. He is therefore also responsible for moving the barriers and to perform
control of the area under the barriers before closing.

Operational Safety Relative to the Mooring Process

When implementing remote operation, no assistance in the mooring process is given to the skipper. In
particular, leisure crafts sometimes need help in larger locks. In the USA for example, the tow operators
will ‘pull doubles’ in some cases, which is essentially when they have a tow of barges that exceeds the
size of the lock. The standard practice is to have the lock operators tie off and lock one half of the barges
without the tow boat. It would require a change in operating procedure to stop locking doubles and would

85
require on-site operators. This constraint only affects locks that are smaller than the standard size (i.e.
smaller than a 1200’ chamber) within the USACE inventory.

In general, in order to guarantee a safe operation, a risk assessment is necessary to define the
necessary requirements. If extra requirements are necessary, different solutions are possible:

 The St. Lawrence Seaway Management Corporation has designed a hands-free mooring system
(see 6.3.3.9).
 Use of floating mooring systems or in smaller locks with ropes or vertical tubes as mooring systems.
 In the UK, skippers can operate the lock by using a smartphone application. Users do not have to
moor their boat if they’re using the app, provided there is no restrictions preventing operation.
 In the Netherlands and in France, stewards are employed at very busy objects on very busy periods
(holiday season). They give assistance and additional instructions to the skippers. The actual
operation remains at the remote control centre.
 Etc.

7.3 Technical Safety Solutions

Functional Safety

Functional safety is part of the overall safety of a system or piece of equipment and generally focuses
on the safety-critical control system components and related software. It looks at aspects of safety that
relate to the function of a device or system to ensure that it works with high reliability in response to
commands it receives. In a systemic approach, functional safety circuits detect potentially dangerous
conditions, situations or events that could result in undesired action that could harm somebody or cause
significant damage. It enables corrective or preventive actions to avoid or reduce the impact of an
accident.

The aim of functional safety is to bring down risk to a tolerable level and reduce its negative impact.
Functional safety measures risk by how likely it is that a given event will occur and how severe it would
be; in other words: how much harm it could cause.

To ensure the same safety level as local operation when operating remotely, a risk assessment is
necessary by following the hierarchy of risk reduction and defining the safety functions.

Hierarchy of Risk Reduction

Risk reduction measures must be implemented according to the hierarchy of risk reduction which is
applied in the following sequence:

Step 1: Inherently safe design measures

Inherently safe design measures eliminate hazards or reduce the associated risks by a suitable choice
of design features of the machine itself and/or interaction between the exposed persons and the
machine. In other words, the primary importance is electromechanical reliability, it is useless to automate
an unreliable structure.

Step 2: Safeguarding and/or complementary protective measures

Taking into account the intended use and the reasonably foreseeable misuse, appropriately selected
safeguarding and complementary protective measures can be used to reduce risk when it is not
practicable to eliminate a hazard or reduce its associated risk sufficiently by using inherently safe design
measures.

Step 3: Information for use

Where risks remain, despite step 1 and 2, the residual risks shall be identified in the information for use.
The information for use could include, but is not limited to, the following:

86
 operating procedures for the use of the machinery, consistent with the expected ability of personnel
who use the machinery or other persons who can be exposed to the hazards associated with the
machinery
 the recommended safe working practices for the use of the machinery and the related training
requirements are adequately described
 sufficient information, including warning of residual risks for the different phases of the life of the
machinery
 the description of any recommended personal protective equipment, including detail as to its need
as well as to training needed for its use
Refer to EN12100 for further details on the route to risk reduction.

Defining Safety Functions

The following defines the sequence of steps which should be taken to implement a safety function. The
following steps are intended to provide an outline guide, but expert input should be sought from a
suitable experienced designer.

Step 1: A risk assessment is undertaken to identify potential risks. A common approach to risk
assessments is to adopt and comply with ‘EN12100 Safety of machinery – General Principles for Design
– Risk Assessment and Risk Reduction’. For each identified risk, a reduction measure(s) shall be
considered. The considered risk reduction measure shall be considered in order as defined in the
‘hierarchy of risk reduction’. In some cases, the selected risk mitigation measure might be the
implementation of a ‘safety function’ within the control system.

Step 2: Safety functions should be implemented according to the selected standard. Typically, EN ISO
13849-1 or EN IEC 62061. These standards should be followed to determine the required performance
level (in the case of EN ISO 13849-1) or SIL Level (in the case of EN IEC 62061).

Step 3: A decision needs to be made as to whether the safety function will be implemented using
hardwired relay logic or using a safety PLC/programmable safety relay. It is preferred that all equipment
used within the safety function should be designed for use in a safety system and should carry a suitable
CE Mark.

Step 4: The circuit configuration should be designed and implemented within the control system circuits
and where applicable, software.

Step 5: The implemented control system should be appropriately validated and verified as the adopted
standard and documented for future reference.

Safety Requirements

Interlocking in the Control System

Operation of a lock or a bridge in an incorrect sequence can lead to unacceptable hazards. To overcome
this, hard-wired or software interlocks are implemented to ensure that mal-operation of equipment
cannot occur.

There are different types of interlocks which broadly fall into two categories, being safety interlocks and
asset protection interlocks. At the onset of the design it is desirable to assume that safety interlocks
should not be overridden.

Depending on the consequence of failure, interlocks can be categorised as ‘soft-interlocks’ or ‘hard-

interlocks’. Soft-interlocks are generally the ones which have a low impact if they are overridden or not
implemented. Hard-interlocks are generally the ones which would have a high consequence impact if
they are overridden or not implemented (e.g. could lead to an unacceptable risk to personnel or serious
asset damage). The decision to allow the operator to override interlocks is dependent on the pressures
of keeping waterway or road traffic flowing and the impact which would result from personnel injury or
object damage.

87
The requirements for system interlocks are derived from the risk assessment of the object. A quantified
risk assessment defines the level of risk which may result in the need to assign the interlocks as ‘safety
functions’ in which case a suitable standard would be selected and followed (i.e. EN ISO 13849-1 or EN
IEC 62061). Once the safety function performance target (PLr/SIL) is defined, suitable components need
to be selected and implemented to meet the target. This may be CE marked safety certified components
or non-safety certified components. The requirement to use CE Marked safety certified components is
largely dependent upon the PLr/SIL of the specific safety function.

When defining the interlock requirements, consideration needs to be given to the required object
availability and the responsibility allocated to the operator. It may be considered acceptable for the
operator to override certain low consequence interlocks under certain conditions. Before giving an
operator access to override functions, his skill level should be assessed and the approach to risk of the
operating company should be determined.

It is recommended that the interlocks are implemented close to the object under control (i.e. the object
site PLC panel). Interlocking through the remote control system should be avoided as they would not be
available when controlling local from the site. Some interlocks may be implemented remotely. An
example of this would be the implementation of a token system interlock which allows objects to be
directed from a specific control desk.

It is common practice to implement safety interlocks using hardwired relays, safety relays or through a
safety PLC.

As an example, in the UK interlocking for a movable bridge would typically include the following:

 The road traffic lights shall be red before it is possible to lower the road traffic barriers.
 The road traffic barriers shall be lowered before it is possible to raise or swing the bridge deck.
 The green light for the vessels can only be lit when the bridge is fully opened.
 The bridge deck can only be lowered when the red light for the vessels is lit.
 The bridge deck shall be fully lowered before it is possible to raise the road traffic barriers.
 The road traffic barriers shall be raised before the road traffic lights turn off.
The interlocks above operate independently of the bridge control system PLC. The non-safety certified
PLC is used to provide sequence control of the bridge.

In a number of locks a restraint cable or boom is implemented which protects the downstream gates
from vessel impacts when entering the lock. An asset protection interlock is implemented to prevent the
gate being opened until the restraint cable or boom is lifted.

Safety Requirements on Video Management

Many safety requirements must be implemented on the video management system. First, all safety
areas must be displayed continuously. If PTZ-cameras are used, all risk areas must be presented, even
if the PTZ-camera is moved. This can only be achieved by using fixed cameras on all risk areas.

Cameras can also be categorised by importance depending on the importance of the availability of the
bridge or lock. CCTV cameras of absolute importance will be applied with a redundancy so that in case
of a network link loss or fault detection the other camera can be chosen automatically. This redundancy
can also be achieved by a PTZ-camera that will automatically take over the necessary camera image.
Also, detection sensors or video analytics could support the operator with extra information on the
camera images.

It is important to link the required camera image on the operator screen. Usually, the correct camera
image is not automatically linked to the monitor. Extensive commissioning and periodic tests should
provide enough certainty. On top of this, the camera identification should be visible on the screen. PTZ-
cameras can also be programmed to return to a predefined position after a certain time.

It is not yet standard practice to automatically detect frozen images. However, in one of the upper
corners of the monitor the internal clock of the camera can be displayed. The operator can conclude
that something is wrong when this display doesn’t change or shows erratic behaviour.

88
Latency is another important aspect of the CCTV requirements. The end-to-end latency depends on the
latency of the camera (e.g. a framerate of 25 fps introduces a 40 ms latency), the network latency
(depending on bandwidth) and latency of the receiver. The receiving buffer in the client is the part that
affects the latency the most. With a big buffer the chance of a jerky video stream is reduced, and the
video will be able to play evenly. However, that comes with a cost of added latency, which is intolerable
in case of remote operation.

Failsafe-PLC

When it comes to failsafe-PLC’s, an important question is whether one needs to use a failsafe-PLC for
the sequence control of all remotely operated objects or not. Below, some considerations are given on
how WG192 members tackled this question.

1) All safety functions and emergency stops must be managed by a safety PLC, hard-wired relay logic
or safety (monitored) relay.
2) The connection between the remote operator desks and the local installations should be established
and monitored via safety PLC’s, depending on the risk assessment in a redundant setup and
dedicated to the particular desk.
3) The normal program and bridge or lock sequences can be changed in a non-safety certified PLC,
without affecting the safety functions.
4) All logic to control a bridge or lock can be situated at the object itself. This setup allows for operating
the object locally independently for instance when the connection with the remote control centre is
compromised.

Emergency Stop

The emergency stop is the function which is intended to avert arising or reduce existing hazards to
persons, damage to machinery or work in progress, and is initiated by a single human action [NEN-
12100]. They are provided as a backup for use in emergency only. The following requirements apply:

 the actuators shall be clearly identifiable, clearly visible and readily accessible
 the hazardous process shall be stopped as quickly as possible without creating additional hazards
 the emergency stop control shall trigger or permit the triggering of certain safeguard movements
where necessary
 for more detailed provisions, see ISO 13850
Depending on the risk analysis and the step in the process, different stop categories should be
implemented. IEC 60204-1 defines the following three categories of stop functions:

 Stop category 0 – Stopping by immediate removal of power to the machine actuators (uncontrolled
stop)
 Stop category 1 – A controlled stop with power available to the machine actuators to achieve the
stop and then removal of power when the stop is achieved
 Stop category 2 – A controlled stop with power left available to the machine actuators
To help categorise the different stops, following examples can be included:

 Stop category 0
Emergency stops near moving parts, for instance in the technical rooms, need to remove all power
immediately to prevent further harm to maintenance operators.
 Stop category 1
 Stop category 2
According to the machine directive, in certain situations it is acceptable to not only stop the
moving parts, but also to start a new movement if this stops the dangerous process or situation.
For instance, emergency stops to stop the water flow must activate the closing of the valves.

The remote emergency stops are also safety stops and have to be certified, including the safe
transmission of emergency stops from the remote operation centre to the local structures.

89
Generally, each operator desk has a physical emergency stop button on the desk, which is a hardware
red mushroom button and is connected to the local emergency stop circuit. The connection is performed
by a failsafe-PLC and failsafe network. The remote emergency circuit is always checking the status of
the connection. As a supplement, it is also possible to implement a virtual button on the SCADA for the
so-called ‘process stop’ (= accelerated controlled stop).

Most importantly, the emergency stop should be under the supervision of the person controlling the lock
or bridge. This indicates, in case of self-operation, that the user terminal should include an emergency
button. In case of fully automatic operation, the detection systems should be able to activate the
emergency circuit. When a remote control centre is supervising the self-operation infrastructures, a
control stop should be available at the remote operation centre for operational reasons. Depending on
the safety case, a safety certification should be evaluated.

The certification process of remote emergency stops can be implemented in different ways, as illustrated
by the following examples of the workgroup members.

Germany

In the remote operation centres of the Federal Waterways and Shipping Administration of Germany,
every standard operator desk has two safety stops installed, namely one lockage stop and one
emergency stop.

The lockage stop immediately brings the current lock process in a safe state by stopping movement of
lock gates and shutting down the valves to keep the water level in the lock chamber. The emergency
stop will immediately stop all mechanical movements, however, water level still moves.

Figure 33: Standard operator desk in German LOC's with lockage stop and emergency stop

The Netherlands

In remote operating centres in the Netherlands, the emergency stop activates the stop of the current
operating process. The cameras are directed towards the operation, the waterway and road traffic, so
the stop will most likely be necessary for stopping the process. Emergency stops locally at the objects
are hardwired stops of the moving parts.

90
The remote stops are a SIL 2 certified, routable emergency stop system. They are designed as potential-
free switching contacts, with safety-related monitoring. This has the property that the platform selection
of the object is independent of the platform selection of the control centres.

With regard to failure probability calculation, it must be taken into account that the emergency stop circuit
extends over several objects. Determining the total failure probability of the emergency stop circuit
therefore becomes more complex, but not impossible.

When the safety circuit is defined as a sensor-logic-actuator circuit, the emergency shutdown circuit of
remote control will form the sensor part, with the coupled emergency stop circuit of the object forming
the logic and actuator part. Together, the entire failure probability of the circuit can be determined.

Figure 34: The safety circuit as a sensor-logic-actuator circuit

For example, if a new object needs to be connected to an existing remote control, the failure probability
data of the SRCF of the remote control will be supplied as input for the failure probability calculation of
the SRCFs of the object. The failure probability calculation can thus always be made conclusive.

The operating mode arbitration of the object (selector switch) is used to disable the emergency stop
circuit of the remote if it is operated locally. This ensures that the object is independent from the remote
central during local operation, even if the remote emergency stop circuit is no longer available due to
malfunction or maintenance.

France

In France for example, in the Rhône traffic management centre of CNR, a specific emergency procedure
is implemented. All operator desks are installed with an emergency button to stop the operating process.
But for every infrastructure managed from the control room, an extra hardwired emergency stop is
positioned on the wall in order to complete safety certification.

Figure 35: Hardwired emergency stop used by the Rhône traffic management centre, France

91
 Redundancy

It is important to carefully think about the ways the remote control equipment can fail, what the impact
is on operations and how to mitigate the effects. All redundancies must be defined by a specific study,
based on the MTBF, MTTR and need for safety redundancy. It is also more and more customary to
include economical and reputational impact in the risk assessment.

One possible approach is for instance to have two different remote operation centres. Having two
different remote centres also allows for critical (and therefore usually redundant) automation
infrastructure to be spread and to continue operations for instance after a destructive fire. If they are
located at a sufficient distance from each other this can also be beneficial for the continuity in case of a
larger scale calamity (e.g. gaseous chemical leak in a port). Otherwise, if the network link(s) to the
remote operation centre fails, an operator must be sent to site to operate the bridge or lock locally.

There are different approaches on how to determine the size of the control centres and how to man
them:

 The most ‘luxurious’ is to have two centres that are each capable of maintaining 100 % of operations.
In one scenario centre A is used nearly all the time and centre B is only used in case of emergency
and during periodic tests. In another scenario both centres are manned all the time for 50/50 %.
 A more economical approach is to have two remote operation centres that are each capable of
handling 70 % or 80 % and are normally manned for 50 %. In that case when one centre is out of
order operations can still continue but with some restrictions.
In any case, it is wise to install a few reserve desks at each remote centre. In case of a breakdown or
maintenance of a desk one can easily switch to a reserve desk and in case of unavailability of a complete
centre the desks are already in place to provide the extra needed capacity.

Next to the concept of a redundant remote centre, it can be recommended to include back-up PLC’s,
UPS and a fully redundant ring communication network, especially for infrastructures with high demand
of availability.

Also, all manual controls as well as local operator work stations are to be maintained as a back-up to
remote operation. If the remote terminal for some reason loses connectivity, lock operators could still
return to the facility to operate in either a manual override, or through the PLC based system but locally
from the lock walls.

When service is based on self-operation, remote control equipment is relatively simple because it is not
necessarily based on a dedicated (fibre) link and it is not redundant nor essential to safe operation.
Short duration failures of the remote operation centre or CCTV will not result in the bridge being taken
out of operation. This is because the centre/CCTV is in that case used for supervision only. During
prolonged failure, the bridge can be taken out of remote operation/supervision as a precaution.

92
8 SECURITY
8.1 Introduction to Security
When implementing remote operation, different security issues occur. First, there is no more local
presence of an operator, which results in necessary access control for perimeter protection and
redefining security responsibilities for traffic monitoring. Second, by introducing a more complex
network, cybersecurity becomes more important.

The previous section on safety introduces the definition functional safety and the implementation of
safety functions. A first step in defining the safety functions according to the machine directive, is the
definition of the boundaries of the machine. These boundaries can be used for defining the scope of the
security project.

8.2 Perimeter Protection

Remote operation of objects seriously reduces personal presence at the objects and the ‘observation
task’ becomes more intensive. In order to avoid trespassing by unauthorised persons, additional security
is recommended. If necessary, a fence and access control should be installed. This is especially
applicable on larger locks, infrastructure near a school, public areas or in city centres. Sometimes the
travelling community can plug into a lock or bridge power network, so fences are not always an efficient
solution. In many cases this would follow from the risk identification and evaluation process according
to the Machinery Directive or similar regulations. Access management doesn’t only protect the perimeter
from trespassing but is also applicable for maintenance operators. With the implementation of access
control, everyone who wants to access (trespassing or visitors) must register. This way, no one can be
on site without the operator knowing. For this reason, perimeter protection is also a safety issue. Last,
perimeter protection doesn’t only protect road users, it also means perimeter protection for waterway
users who for instance try to exit the lock chamber.

Also, when there is no longer a local operator present it is more likely that buildings and equipment are
more prone to external threats like vandalism or burglary. It may also prove wise to invest in intrusion
alarms, fire detection and extinguishing equipment. In all cases, enough cameras should be installed,
and the images should be recorded and kept for a sufficient amount of time (for example 30 days).

Sometimes special perimeter protection measures are imposed by law or other regulations for reasons
of national security like the ‘Maritime Security Act’ (Canada) or the ‘ISPS’ (EU & USA).

8.3 Cybersecurity
The issue of cybersecurity is a critical one in relationship to remote operation. It is certainly one of the
largest risk factors – loss of connectivity between the control centre and the facility could be catastrophic,
and at the least inefficient and expensive.

The implementation of security services is only possible when the impact on primary business
processes, especially those that affect public safety, is known and understood. The necessary security
measures should therefore always be determined by a formal risk assessment.

The implementation of highly segmented or zoned networks implies an application level infrastructure
that is architected and designed for such usage. Application development and deployment is a key area
in which contributions to security is to be expected. Industrial Automation specialists are often new in
this terrain. It is essential to get all stakeholders involved and especially the ‘civil’ projects department,
as large civil projects tend to underestimate the criticalness of IT and automation, due to the fact that
risks are expressed in financials and the automation risks diminish accordingly. Especially for larger
industrial automation projects, like the implementation of remote operation, different systems merge into
the operation system, for instance the connection between the own network and external communication
protocols likes AIS.

93
For the technical part, it is essential to have security processes in place because from the moment the
environment is being monitored, a lot of anomalies and unexpected behaviour is going to be exposed.
Therefore, there is need for people and software to interpret, channel and take corrective measures.

PIANC InCom WG 204 on Cybersecurity (2019) will describe this issue more in detail, but the link to
remote operation is important. With the implementation of remote operation, cybersecurity becomes a
part of the machine. Changes towards virtual machines, communication network for the operation of
movable bridges and locks, access control, etc. are only a few examples of the importance of
cybersecurity within the safety certification process.

8.4 System Hardening

In addition to other types of security, hardening of the control system should be looked at from an
environmental perspective to prevent any temporary or permanent failures of the control equipment.
Environmental items which could affect control system performance include temperature, humidity, ice,
lightning strikes, flooding, earthquake and high winds. At a minimum, the control system equipment
should be placed in a suitable enclosure to handle the different environmental effects. If necessary,
additional items like heaters, air conditioners, dehumidifiers, shock dampers, and bracing should be
considered. In places where flooding can occur, consider providing waterproof equipment (where
practical) or placing the equipment out of the flood zone area. In areas where lightning strikes are
common, provide an adequately designed lightning protection system.

8.5 Traffic Monitoring

Following consideration is a consequence of the local absence of an operator. Because there is no local
presence, law enforcement changes.

Control of Vessel Traffic

In many cases, the operator controls all vessel traffic and follows up on waterway permits, control of
(dangerous) goods, collisions, etc. Control of vessel traffic is possible by using dedicated supportive
tools like AIS, radar, etc. This responsibility could also be given to another department. In Europe for
example, mentioned tasks are sometimes executed by the operator, but they can also be the
responsibility of central RIS (River Information Services) centres.

The use of a smartphone application with a waterway license tie-in could prevent unlicensed operation
and use of waterway.

Normally, the waterway police authority is separated from other departments’ responsibility. But one of
the operator’s duties is to observe whether the regulations on navigational traffic are respected around
the movable infrastructures. In the case of a moving bridge, the nature of these violations is usually of
the following types:

 entering a bridge channel or a lock when the navigational light is not green
 not following the instructions concerning the order in which to enter a lock or pass a bridge

These violations can easily be spotted and recorded with cameras.

Camera Ship Recognition in Case of Collisions

There are a great number of cameras to be used for remote operation. In Belgium for example, all
images are kept thirty days in case of a police order. For example, some of the cameras in the Port of
Antwerp that the locks are equipped with, are solely to record possible damages. Especially the corners
of the entrances are accident-prone. Procedures are put in place to safeguard privacy laws and the use
of these images in an evidence chain. The same goes for radar images and VHF communication.

94
 Control of Local Road and Pedestrian Traffic

A disadvantage of going remote is that it becomes more difficult to exercise road traffic controlling and
directing tasks. Certainly, in urban environments or for instance on touristic bicycle routes one may
encounter problems with people that climb over or under the barriers or refuse to evacuate a bridge or
with total disregard for red traffic lights and so on.

An operator on site is usually considered to have some authority and if he is assertive enough, he will
almost always succeed in convincing the road users to obey his instructions. An extra element of
authority can be wearing a uniform.

When going remote there is no complete solution to replace local presence. This can be only partially
covered by having enough CCTV-cameras for detection of violations and having the right procedures in
place to be able to use recorded images as proof.

In addition to camera images, it is also useful to install speakers on the bridge to give vocal instructions.
Some types of loudspeakers are bidirectional: this means that they can also be used as microphones,
so the road users can communicate with the operator.

In some countries the bridge keepers even act as official capacity. The Belgian traffic regulation code
for instance, explicitly mentions the bridge keepers as qualified to monitor and control the traffic on their
bridge and in the immediate vicinity. They are mandated to give directions to the road traffic, ask for the
identity of drivers, pedestrians, cyclists, etc.

For example, in the Port of Antwerp, operators can make a draft police report when they detect violations
of the traffic code. After a preliminary investigation by the harbour master (who is, by law, an officer of
the judicial police), the latter can decide to send a police report to the office of the Public Prosecutor.

95
9 TRAFFIC MANAGEMENT
Traffic management refers to managing and facilitating marine and inland waterway traffic and includes
all facilities and guidelines which are used to improve the safety and efficiency of marine and inland
waterway traffic. The aim is double: realising an effective and efficient service on the one hand, while
on the other hand ensuring an optimal utilisation of the waterway network by all involved parties in the
logistic chain. In other words, through traffic management different traffic flows are planned, monitored
and handled.

After successfully rolling out remote operation, traffic management should be one of the main areas to
focus on. The need to consider an advanced corridor management system is deemed necessary,
especially on corridors with high volumes of traffic, larger vessels or commercial navigations.
Implementation of remote operation also makes it feasible to extend bridge/lock operating hours, using
the same number of operators. Consequently, 24/7 service hours become possible and more attractive
to the waterway authorities. Finally, remote operation and traffic management can allow the waterway
authorities to implement priority traffic planning, improved capacity planning and lock planning.

Traffic managements also offers multiple advantages for waterway users:

By introducing traffic management, a so-called ‘Blue Wave’ can be created. The Blue Wave focuses
on a smooth passage for ships while minimising possible delay for road traffic by open bridges. In a
broader sense, the Blue Wave aims to improve all facilities which results in a faster travelling time for
waterway traffic. The time gains are obtainable by a better exchange of information between waterway
authorities, inland navigation and road traffic. Especially information concerning locks, bridges and
availability of moorings in the ports create a higher efficiency.

With the implementation of remote operation, traffic management is done by the control room manager
or operator, with help of AIS or RIS information. This makes it possible to offer waterway traffic
guidance and control to all waterway network users on the whole length of the corridor and even
beyond. Due to specific local differences, there is no general algorithm to manage the traffic. Every
corridor has its own specific waterway traffic and must include customer-directed traffic management.

Moreover, advanced traffic management offers possibilities for smoother logistic control of bulk and
cargo since exchanging data and information will be easier.

Besides the advantages for waterway users, traffic management and remote operation is an essential
prerequisite for autonomous shipping and e-navigation. Traffic management improves the awareness
of a ship’s surroundings with information on navigation hazards, other vessels and port infrastructure
which is crucial for ships to operate in an autonomous manner. The main aim of the e-Navigation concept
is to develop a system which can properly organise all the ship’s data at one place in order to help
improving navigational safety of the ships. Therefore, it is of crucial importance that accurate data is
made available, which is one of the key components of traffic management. For an elaborated
explanation and more details on autonomous shipping and e-Navigation we refer to the deliverables of
the dedicated PIANC Working Groups.

96
10 INFORMATION MANAGEMENT
10.1 Value of Information
In general, information management is not the first motivation of introducing remote control. However,
remote control systems and centres are using a lot of data that might be valuable for other purposes.
Since remote control systems already require investments in information technology and data
transmission capabilities, it is usually only a small extra effort to use this same infrastructure to increase
the sort and amount of data collected of the waterway network and infrastructures. Data that used to be
entered manually for reporting purposes, can be often be collected automatically.

It is important when designing remote control systems and the overall architecture, to think about the
way the data can be made available. If not, the risk arises that the data is contained within separate
systems, without means to transfer and share it to other systems.

By capturing and combining data from different sources, new kinds of information and insights can be
created and presented.

Different use of data leads to different requirements about the speed, resolution and accuracy of this
data. For example, lock operation requires real-time water level values each second, whereas for
historical water level trend analysis, one value each 15 minutes may suffice. A well-thought strategy
concerning this can largely reduce the needed performance and capacity of the technical systems and
data transmission capabilities and as such, the cost of the information.

Some providence is advised towards the nature and usage of the collected data, since operators might
have solicitude about it being used to monitor their personal actions and performance. While this may
be justified in some cases, clear communication about the reasons and goals of data-collection, is
recommended.

10.2 (Big) Data Analysis

Data Collection Useful for Traffic Management

Real-time lock and bridge status data can be provided to skippers and inland waterborne transport
service providers for improving traffic planning in a multi-modal environment. Availability of up-to-date
status information of all locks and bridges in the transport network contributes to traffic planning reliability
and constitutes an important step towards RIS-enabled corridor management.

A key element for improving traffic flow and optimising waterway infrastructure in the sense of traffic
management is to make this information available to skippers and inland waterborne transport service
providers. By its nature a remote operation centre is a central point for a number of traffic and
infrastructure data:

 real-time ships position data via radio communication and AIS land infrastructure
 ship data (length, width, cargo etc.) via reporting or AIS
 ETA, ETD of particular ships according to lock planning procedures
 status information’s to locks and bridges
 waterway information’s (temporary restrictions)
 etc.
Data collection of traffic is not only important for skippers, also waterway authorities can use this data
for data logging of navigation statistics such as lock and bridge passage, nature of goods passing each
corridor, direction and routes of all vessels, etc. Analysis of this statistical data and collection on ship
movements will optimize the workflow on remote operation centres and enhance the knowledge of traffic
on their waterway. This knowledge provides input to predict future traffic flows and where to extend
operation services.

Next to traffic flow data, CCTV images, AIS, radar, RIS information and radio communication should be
logged in order to analyse incidents and investigate accidents.

97
 Water Level Management Data Collection

Traditionally, water level management used to be done with a rather local and short-term view. The lock,
weir or pumping station keeper would assess the water levels in the immediate vicinity of the asset and
act on it.

By introducing remote control and combining it with data from other sources, a much wider proactive
view, that can achieve more refined and more coordinated actions.

Water levels from a whole region can be assessed and combined with weather predictions, available
buffer capacity, historical data, ground water levels etc. By centralising operations of weirs and pumping
stations, the available discharge capacities can be optimised, as well as water usage during droughts.
By integrating information of expected ship arrivals and associated water usage, an even more refined
water management can be achieved. This can also be used to analyse, coordinate and prepare for
future events that could impact operations.
A proper water management is a condition to operate locks and to accommodate shipping. Bad water
conditions like high level, lack of water or heavy currents, can stop or restrict the navigation and therefore
impact the behaviour of some users (stops, reduce speed to reduce fuel consumption, etc.). The keepers
and navigation managers should be able to know the water condition information (level and current
velocity estimation), thus they can predict user behaviour (ETA). Moreover, they could inform users
about the hydrological context and the navigation conditions, directly or through RIS systems.

However, due to the specialised nature, high-level water management and flood monitoring could be
separated from the remote operation and locks. A separate operator, interface or even remote control
and information centre could be designed, dedicated to water management. It is often found that during
normal operation, water management can be fully automated. During exceptional situations, often an
approach is preferred with human-in-the-loop, supported by a decision-support-system.

Data Collection Useful for Asset Management

Since remote control components have shorter life and maintenance cycles than structural components,
this poses a larger challenge in asset management. To manage this, it is recommended to utilise a
professional asset management system (AMS).

Such an AMS facilitates planning and documentation of operational procedures, maintenance activities,
costs by asset, maintenance histories, equipment condition data, repair frequencies, replacement parts
and materials, and related operation and maintenance records including labour and overtime utilisation.

In addition, the data collected in AMS is intended to be available for use and analysis by maintenance
personnel, facility or project managers, and upper level management. Each group's needs and
requirements for maintenance data can vary, so defining the correct amount, type, and level of detail for
each audience is critical.

The maintenance data collected in AMS along with asset classifications and attributes serves numerous
functions across the organization through improved maintenance analysis, condition assessments,
inventories, maintenance costs analysis, and work load levelling. Ultimately, the data collected will be
used in the development and justification of future Operations & Maintenance (O&M) budget items.

It is desired and expected that the AMS will be linked with the health monitoring system. Future
developments include the use of building information models (BIM) and Augmented Reality.

The technical documentation of remote operation systems should be made readily available and allow
for easy updates and version management.

Health Monitoring

The signals from the sensors on automated maritime assets (bridges, weirs, locks, water barriers and
pumping stations) can be used as valuable input by the waterway authorities for early detection of

98
malfunctions, predictive maintenance and automated performance monitoring. This allows to
professionalise maintenance operations and to evolve towards data driven predictive maintenance.

Every input/output of the PLC’s that might prove useful for error diagnostics should be logged. Process
data like motor currents and hydraulic pressures, lockage levelling speed, possible leakage and
bridge/lock/doors/valves/etc. status signals can be used for maintenance purposes and process
optimisations on the infrastructures. With the decrease in sensor-cost is becoming more common to add
extra sensors or measurement devices, especially for this purpose. By setting thresholds or windows,
abnormal circumstances can be detected or even predicted. Long-term deterioration and trends can be
analysed.

The health monitoring system may also include monitoring of structural components, such as
displacements of foundations, dykes and dams.

The sensor data and machine state values should be collected in a central system and made readily
available on dashboards, accessible by maintenance personnel. This can be done by the SCADA-
system used for remote control or a separate parallel system designed for this purpose.

In some organisations, it is starting to become more common to have a highly skilled remote helpdesk
for fault-analysis and support. Some issues may be solved remotely, in other cases, it is an aid for the
on-site technical crew.

Apart from already remote-controlled assets, it might be added value to include non-remote-controlled
assets in the health monitoring system. Since there is less need for real-time or high-resolution data,
different, cheaper modes of data transmissions can be used, such as wireless low power
communications. Recently, fast technological developments in this field are being made, mostly referred
to as Internet of Things (IoT) or Industry 4.0 technology.

99
11 FUTURE CONSIDERATIONS
11.1 Increase of Data Collection
The amount of recorded data is ever increasing as new systems will arrive with new interesting
information (river view, BIM, on board recording, new localisation systems, big data about user’s
behaviour, etc.). The biggest challenge will be to manage and sort out the records to quickly reach the
interesting information.

More improvement will come from the relation between operation and maintenance data. Using all
available data will refine and even redefine existing maintenance strategies by for example using motor
currents for predictive maintenance purposes.

The increase of data collection will also have a deep impact on data protection. Data management is
currently a hot topic as the new General Data Protection Regulations came into force on 25 May 2018.
All EU operators have or are currently reviewing their data management.

11.2 Vision: Where To Go To?

As already discussed in previous sections, many technology developments are currently accelerating
the remote operation evolution. Organisations that manage inland waterway infrastructure, are rapidly
introducing cyber-physical technologies or will do so in the next decade and are evolving towards the
cyber-physical waterway (CPW). In cyber-physical systems, physical and software components are
deeply intertwined, it is the combination of IT-related and networked components into physical
infrastructures such as locks, weirs, movable bridges and waterway-infrastructure in general.

In the coming years, management of technology will become more advanced. Use of virtual reality for
operator training and smart video analytics as an aid for safe bridge and lock operation are already being
implemented, projects on smart mobility and smart objects are currently starting to analyse maintenance
requirements and traffic management is being enhanced according to the blue wave and corridor
management.

Asset management will probably be enhanced based on artificial intelligence. Smart sensors will define
algorithms for an overall analysis of the waterway infrastructure. Monitoring moving equipment to check
the health condition (e.g. bearings) are possible and can help to maintenance plans and prevent failures.

Smart autonomous shipping is expected to be the next evolution in traffic management, the combination
of unmanned ships and cars has a potential for a smarter view on corridor traffic. This will result in the
need for automatic mooring systems to be implemented and in the need for development of automatic
communication systems between systems of ships and remote control systems. Fully automatic control
of movable waterway infrastructure is an even further goal in the project of smart shipping and smart
infrastructure.

100
12 REFERENCES
Standardisation and Ergonomic Principles

Videowall Information Design – An interesting publication on this subject can be found on the website
of the Dutch consultancy firm ErgoS, among others: https://www.ergos.nl/rd/publications/.
In November 2017, VHP Human performance investigates merging operation of bridges:
https://www.vhphp.nl/ritsend-bedienen-bij-bruggen-heeft-geen-zin/

Technical implementation

Technical Standards
Machinery Directive CE-marking: www.eur-lex.europa.eu and www.ec.europa.eu.
Canadian regulations:
{Reference; Ontario Government, Ministry of Labour website}
{Reference; Canada Occupational Health and Safety Regulations (SOR/86-304)}
Directive 2005/44/EC on harmonised river information services (RIS) on the EU’s inland waterways
IALA VTS Manual 2016

PIANC WG 192 Reference Brochures

Working Group members:

NAME Organisation
Mr Lieven Dejonckheere De Vlaamse Waterweg
Mr Wim Van Santvoort Port of Antwerp
Ms Kim Geylen Tractebel
Mr Michiel Coopman De Vlaamse Waterweg
Mr Stephen Kwok
St. Lawrence Seaway Management Corporation
Mr Leonard Swift
Mr Laurent Luchez Cerema
Mr Cyrille Chaussat Compagnie Nationale du Rhône
Mr Rainer Strenge
German Federal Waterways and Shipping Administration
Mr Walif Achim Schneider
Mr Leon Uijttewaal Rijkswaterstaat
Mr Ad Kloppenburg Witteveen & Bos
Mr Albert Barnes Tetra Tech
Ms Kathy Griffin
U.S. Army Corps of Engineers
Captain Brian Molloy
Mr Jason Hudson Royal HaskoningDHV

Table 12: Members of the Working Group

101
 PIANC Secrétariat Général
Boulevard du Roi Albert II 20, B 3
B-1000 Bruxelles
Belgique

http://www.pianc.org
VAT BE 408-287-945

ISBN 978-2- 87223-268-0

EAN 9782872232680