ES2240911T3 - SYSTEM FOR THE DETECTION OF THE OCCUPATION OF A RAILWAY LINE AND FOR DIGITAL COMMUNICATION WITH THE TRAINS THAT CIRCULATE THROUGH THAT RAILWAY LINE. - Google Patents

Abstract

A system for occupancy detection in a railroad line, or the like, and for digital communication with trains that run along said railroad line, which uses coded signals transmitted to the tracks, said tracks being segmented into various galvanically insulated sections, and each track section being connected to a control and monitoring subunit which communicates with a central control unit. According to the invention, each subunit for controlling and monitoring the means that generate a signal when a train is detected on the corresponding section, which signal is transmitted by the transmitter associated to an end of the block to the associated receiver at the opposite end of the block in the direction opposite to the train running direction, and which train detection signal is provided before transmitting a carrier having a predetermined fixed low frequency to a phase modulator of the track segment, which modifies the carrier phase for predetermined time intervals between two definite phases, with reference to a reference signal having the carrier frequency, the time intervals between the frequency steps of the two phase settings having a predetermined length, and said train detection signals being uniquely differentiated for each block, by setting different time intervals between two successive phase steps. <IMAGE>

Description

System for detecting the occupation of a railway line and for digital communication with trains that circulate along that railway line.

The invention relates to a system for Occupancy detection on a railway line, or similar, and for digital communication with trains running along of the mentioned railway line, according to the preamble of claim 1.

Such systems are well known and may have Various construction architectures. The newspaper article "LZB 700, Die moderne Zugbeeinflussung mit lnforrnationsübertragung über die Fahrzeug schienen ", Signal + Draht, 84 (1992) 6, describes such a system. The invention has as object to improve a system according to the preamble of the claim 1, such that it allows the use of subunits of control and supervision that have a construction and operation that limits construction efforts, thanks to fact that they can be used easily or in combination with existing systems, or in combination with various configurations of system, or in possible combination with other types of objects that will be controlled or supervised at the same time as They maintain very high levels of security. The invention has as additional object is to provide a system like the one described in this document, in which the train detection and digital communication settings are very simplified

The invention achieves the above purposes. carrying out the characteristics of claim 1.

The dependent claims refer to The improvements of the invention.

The characteristics of this invention and the advantages derived from it will appear clearer from the following description of an embodiment illustrated in the accompanying drawings, in which:

Figure 1 is a block diagram simplified inventive system, in which the links of communication to diagnostic devices have been omitted for reasons of simplicity.

Figure 2 is a functional block diagram of the subunit to control and monitor the circuit element of follow up.

Figure 3 is block diagram of the module vital computer with reference showing all interfaces as well How the structure works.

Figure 4 is a block diagram of the section to control and monitor the computer module vital.

Figures 5 and 6 show a section map of protection 121 at different levels of detail.

Figure 7 is a block diagram of the module to generate the train detection signals and / or the signals of coded communication

Figure 8 is a block diagram of the demodulator / amplifier.

Figure 9 is a simplified diagram of the H bridge.

Figure 10 is a block diagram of the module tracking interface which is also called as a module Protection, inversion and diagnosis.

Figure 11 shows a block diagram of the Investment section in greater detail.

Figure 12 is a schematic view of the Investment performance

Figure 13a and 13b are schematic views of the connections to verify the status of the relay switch investment.

Figure 14 is a block diagram of a Diagnostic section of the monitoring circuit.

Figure 15 is a block diagram of the Functional acquisition module and signal recognition tracking circuit

Figure 16 is a block diagram of the module of acquisition and recognition.

Figure 17 is a block diagram of the power supply for the acquisition module and recognition.

Figure 18 is a block diagram of the input circuit

Figure 19 is a block diagram of the block logical according to figure 17.

Figure 20 is a block diagram of the interface between the acquisition and recognition module and the vital computer module.

Figure 21 is a block diagram of the section generating the test signal.

With reference to figure 1, a system for Occupancy detection on a railway line, or similar, and for digital communications with trains running along the railway line comprises at least one track that forms the railway line and that is divided into a plurality of successive segments galvanically isolated having a length default, the so-called blocks, the rails of each forming a basic element, called track circuit. In the Figure 1, the track circuits are indicated as Cdb1, Cdb2 and Cdb3. These track circuits use the rails to send the signals that allow the detection of the train in the corresponding circuit of track, and to communicate with a train. In addition, you can use the signals sent to each track segment to detect any failures or damages.

The system includes a central control unit and supervision 1, which is especially referred to as the ASCV Stationary Control, which generates and transmits the signals of control to execute train detection procedures and / or train communication procedures related to a T train that is in that way and / or to execute the procedures of diagnosis. The central control unit communicates with the circuit of track of each block section by means of a subunit 2 of control and supervision, 2 ', 2' ', associated with each block section or track circuit Cdb1, Cdb2 and Cdb3 to generate and receive codes that the subunit executes the procedures to detect the presence of a T train within the associated block, the communication procedures and / or diagnostic procedures and transmits the control signals that correspond to the presence or absence of the T train within the block corresponding and / or the appropriate communication established with the train and / or diagnostic signals related to the track circuit and informs the central control unit supervision of the result of them. Each subunit 2 of control and supervision it is associated with each corresponding block section and its respective track circuit Cdb1, Cdb2 and Cdb3, and connects to the terminal ends thereof by means of a transmitter 3 and a receiver 4. Each subunit 2 and its respective block Cdb1, Cdb2 and Cdb3 associated with it are uniquely identified by middle of a given ID code.

Therefore, the control unit and supervision is interposed between the central unit 1 and its respective element Cdb1, Cdb2 and Cdb3, and allows to control element of "track circuit", by delivering a signaling of busy / unoccupied and code transmission functions and decoding

The subunit 2, 2 ', 2' 'is a modular system that can be configured to be used in several different contexts of the application. This description refers to an application Designed for double-insulated rail track circuits. In these types of tracks, both rails are mechanically interrupted, and the traction power is returned by connections Inductive

The control and supervision subunits 2 are designed for use in bidirectional track circuits and, with To this end, an investment characteristic of signal transmission to propagate the detection signals of trains and communication signals coded in the direction opposite to the direction of advance of the train.

Figure 2 shows a preferred embodiment of a subunit of control and supervision.

Module 102, called Computer Module vital, it is an extended double Europe plate (233 x 220 mm), which It has general purpose features that includes resources basic calculation and communications and interfaces through a parallel bus, with application specific I / O modules. In the application described herein, module 102 of vital computer joins module 202 to generate and transmit the train detection signals and communication signals encoded, with module 302 to acquire and recognize the signals of the track circuit and with a module 402 to connect with the rails of the track circuit element and to reverse the direction of signal transmission in the track circuit, as well as for the Track circuit diagnostic protection.

The vital computer module 102 controls the subunit 2, manages communication with the stationary apparatus and controls the different modules 202, 302, 402 what makes up the subunit 2 of control and supervision.

The vital computer module 102 has two main sections:

a control section consisting of a system microprocessor that includes the required peripherals (the Program memory, random access memory (RAM), serial interfaces, auxiliary clock and signal generating circuits reset, monitoring circuits). The section of control includes process software that is identical for all particular applications in relation to the functions of security and protection, and is specialized through software application-specific configuration, in which you have in account system specific configuration and codes selection. The control section is also assigned all the functions for communication with central unit 1 and for manage the interface (VCM_IOBUS) with the other modules of the subunit 2 of control and supervision.

A vital protection section, that is a test and protection unit that uses hardware blocks and software blocks and software blocks related to the code of security are independent of the specific configuration of the system, but they form a system to certify that the words check code or check words that the control section is generating based on feedback transmitted by modules 202, 302, 402, controlled by means of said section to the section itself, to check compatibility with the control received and with the proper execution of the function controlled. The test and protection unit has the function to ensure the attainment of a state of security in case of failures in the control section. The operation of the section of Protection is independent of the specific application. The security architecture of the vital computer module 102 is the reagent type; the protection section has the task of identify any behavior that could affect potentially to the security of the control section and force the system to a state of security within a given time. The section protection is designed with inherent safety techniques before the failure. Therefore, the vital computer module 102 carries perform the following functions:

subsystem control logic;

serial interface with the stationary apparatus;

interface management with the other boards (VCM_IOBUS);

protection logic

Module 202 to generate and transmit the train detection signals and communication signals encoded is a power plate designed to generate from The signal to be transmitted to the track circuit is safe. This is a peripheral plate without a microprocessor and its function is generate an output signal to the track circuit in response to logic transmitted control.

The module will securely ensure:

that no code other than the code is generated order;

that the transmitted signal is at a level appropriate.

The module is divided into two logical sections: the first section is designed to generate a modulated digital pulse width, or a PWM signal that is the requested code. The second section is a power amplified pulse width demodulator, or a PWM demodulator that provides the signal to be transmitted to the track. The pulse width modulation PWM code generation section is protected by means of a pulse width modulated signal (PWM) rereading function. The vital computer module 102 receives the information of the relegated function and can compare the code that is actually synthesized by the module 202 with the code required by the control of the central unit 1. If an inconsistency is found, the computer module 102 vital disables the transmission of the code through a vital mechanism. The demodulation and power section, cascaded with the generation section, are designed with inherent safety techniques against the
failure.

The acquisition of the track circuit signal and the recognition module 302 is designed to receive the track circuit signals and consists of a processing channel of dual digital signal and a stage decoupling of the signal from input that is designed with inherent security techniques Facing the fault.

The 302 module is a smart card that measures and decode the signal in the track circuit.

The 302 module that is designed to measure safe way and decode the track circuit signals use composite safety design techniques and is composed of what following logical blocks:

a block to decouple the circuit signal from track and generate two different signals. This function is carried out. by implementing inherent security techniques against the failure;

two different process channels that separately they interface with computer module 102 vital through dual port memories, and receiving two different input signals from module 302.

The two signal processing channels based on Digital signal processors (DSP) generate two outputs independent of the vital computer module 102. Outputs of the two channels are checked in consistency for the section of control of the vital computer module 102.

The security architecture of module 302 it implies a continuous check of each measurement channel, by the use of logically generated test signals to ensure, as shown in more detail below, both the protection against common errors, such as fault detection in Individual channels

The 402 module to interconnect with the rails of the track circuit element and to reverse the direction of signal transmission in the track circuit, as well as for the diagnostic protection of the track circuit, carries out the TX / RX inversion logic functions, isolation from / to the station; measure analog quantities for purposes of diagnosis, and manages the interface with the system diagnosis.

Module 402 is physically composed of a plate and a Rx and Tx transformer tray, and implements the Two following independent logical blocks:

the vital block;

The diagnostic block.

The vital functions carried out by the First block are:

the reversal of the track circuit;

the interconnection with the track and the isolation of the same, both in transmission and reception.

Diagnostic functions in amounts of yard, carried out by the second block are:

yard diagnostic circuits (voltages, currents, isolation);

microprocessor module for the acquisition of physical quantities and interconnection with the diagnostic network;

serial interface with computer module 102 vital.

Module 402 must be carried out in a manner Safe, the function of interconnecting with the track and isolation from it and the investment function.

The interconnection with the track is obtained through of isolation transformers (required to ensure that a voltage of 4 kVdc be maintained between the control subunit and supervision 2 and the track); these transformers are located in a different additional rear tray, but it belongs functionally and logically to this board. The investment function you must ensure that the Tx and Rx are stably connected to the opposite ends of the track circuit. The architecture of Safety of this function is of the reactive type, and is just as for ensure that the subsystem can be switched to the state of security in case of failure. The plate is controlled through the vital computer module through the VCM_IOBUS, for all vital functions. Architecture too provides a second communication channel, a serial line, between module 402 and vital computer module 102 that is used to receive the useful data for the diagnostic section, it is say the direction of transmission of the requested signal.

Diagnostic functions for data yard are managed by means of an optional commercial module with an on-board microprocessor that is designed to manage the network Diagnostic The data acquisition circuits of yard of Diagnostics are made of non-vital hardware; The information of diagnosis only relative to the locomotive / yard interface is transmits over the diagnostic network, if it is present.

The control and supervision unit is Designed with reactive safety techniques. From a point of functional view, the security of a system / subsystem / equipment railway signaling involves the identification of a safe state and in the application of design techniques that allow restoring a potentially safe state in case of occurrence of any dangerous failure. For the subunit of control and supervision 2, when the context of their functions is considered within the signaling system, the status "insurance" is deducted as follows:

no transmission of encrypted information to train, said condition being affordable by disconnecting safe way of the transmission section or using signals normalized;

detection of a "busy" state for the interconnected track circuit;

no dangerous tension in the parts accessible to service personnel;

ensure the maintenance of the conditions of security even when:

the permitted excitation powers of the Specification be present;

the rail is broken;

the insulation of an insulating joint between two adjacent track circuits have been lost.

In consideration of the function carried out by the subunit 2 of control and supervision and the times of response, for example with reference to actual train detection and / or the code transmission times, the implementation of a reactive security architecture with composite security and inherent security elements against failure for the main logic. This approach implies a 64-bit encoding of Boolean input variables in two parallel process channels (32-bit code words for each processing channel, with different coding in the two channels), Word processing code according to a default logic, a retest of the outputs through a separate process from main process, and the output generation, the last function carried out using security hardware against failure. The security architecture requires that the control process and the protection process be managed by two processors independent. The control process generates the code words to feed the protection process, carried out in a different processor that cyclically consumes the code words and Detects possible control process errors. The intervention of the protection section forces the control subunit 2 and supervision to the security state defined above.

Additional advantages can be obtained from the implementation of a reactive security architecture for generate a PWM signal that represents the code that will be transmitted to the track. The generated signal is reread and sent to the main logic that, in case of failure, triggers the section of protection.

Reciprocally, an inherent architecture of security against failure (ie hw of security against failure) should be used to demodulate and to amplify the PWM signal transmitted to the track.

The investment function can be managed advantageously through a reactive security architecture with the hardware security elements against failure. The relays of investment are controlled in a non-vital way but their status It is reread in safety conditions against failure and transmitted to the main logic that activates the protection section whenever a fault occurs.

For all communications from the subunit 2 control and supervision to the main unit 1 has selected a security layer (FSFB2) to ensure the integrity of the information received and transmitted by the Apparatus Stationary, whenever a system is used to interconnect plates (VCM_OBUS) that can ensure the integrity of the information exchanged between the vital computer module 102 and the other modules 202, 302, 402 within the control subunit 2 and supervision. Particularly, for all vital functions connected to the bus, you must securely secure a single route, as well as the content of the information, regardless of its physical and functional characteristics.

The function of receiving the track signal is carried out through a composite security architecture. The architecture in use includes such failure detection mechanisms to ensure the restoration of a security state, in a given time, whenever a failure occurs in one of the two elements.

A separation between the non-vital diagnostic functions and vital functions as well such as the transmission of different signals in track circuits adjacent, when no path is provided, to allow insulation loss detection at the junctions of isolation.

Figure 3 shows a functional scheme of the vital computer module 102 in greater detail.

The vital computer module 102 has been developed with "general purpose" features, to execute control, supervision and protection procedures. The plate has such characteristics that can be used in several different applications; application specific operation is obtained by modifying the management software and for this purpose the process software is separated from the configuration software which contains all the specific information of the system. The software configuration that provides the special features of the process software for the specific application is located in an area of dedicated memory, for example a memory snapshot.

The vital computer module 102 is composed of two different functional blocks, that is the control section and supervision 120 and protection section 121 respectively.

The control and supervision section 120 is based on the use of a microprocessor with different peripherals, such as serial line controllers, timers, etc; in the application mentioned in this document for the track circuit control and supervision subunit, this section is designed to manage the basic functions of the track circuit Periodically performs a processing cycle (called the main cycle), through which it communicates, of a vital way with the central control and the supervision unit (of the one that receives the code that will be generated and the address of advance of the train, and for this purpose it transmits the information of state of the track circuit), and controls the other modules 202, 302, 402 to manage the investment, transmission and functions of reception. In addition, the control section 120 periodically performs a retest of all reactive logic blocks of security (rereading the position of the investment block and the signal generated by module 202); this check that is done in the called the retest cycle, it is used to verify the consistency between the control state and the detected state.

The main cycle is used to perform each T seconds, all low priority logical operations (for example reception information from the device stationary and consequently determining the controls that they must be transmitted to the module boards). The second cycle, or retest cycle has a duration of 50 ms and is used for perform all operations that must be performed more frequently (such as re-checking the status of the block of inversion and verification of the generated signal) to allow a faster fault detection. The duration T of the main cycle is an integer multiple of the retest cycle time and It constitutes the unit of time of the subsystem.

The control and supervision section transmits a set of check words to the protection section whose words are used to verify the proper functioning of All operations related to security. Each of the two cycles generates a set of check words, during their respective processing operations whose words are called "main check words" and "words of retest check "respectively.

Therefore, the main functions of the control and supervision section 120 can be summarized as follow:

reception from the stationary apparatus of the information that contains the type of code that will be generated and of the direction of advance of the train;

transmission of position control inversion circuit to module 402, and continuous verification of actual state of said block;

code generation control transmission to module 202, and continuous verification that the generated signal, transmitted to the track, really the same as requested;

acquisition of the track circuit signal from the two channels of module 302 and verification of the consistency of the information read from the two channels with each other and with the code really generated;

transmission of all circuit information of track to central control and supervision unit 1;

Diagnostics

The protection section based on microprocessor 121 monitors the behavior of the section of control 120 and its own behavior and stops the generation of vital tension whenever a malfunction is detected. Generate, in vital mode, the voltage used to enable the switches vital, in module 202, which allow signal transmission generated to the track. The checks made by the section of protection 121 are both logical and time checks; the protection section periodically receives check words from control section 120, whose test words are used to confirm the proper functioning of all operations related to security, and check the validity of same. If the check words are logically correct, these arrive at well defined time intervals and is not detected no fault through the diagnostic process itself of the section protection 121 that can provide power to the vital switches in any other case, the process of self-diagnosis removes said power supply, and prevents any signal transmission to the track circuit.

The security architecture of module 102 of vital computer is of the reactive type; protection section 121 has the task of identifying any risk behavior security potential and force the system to a safe state within a given time. Protection section 121 ensures that that vital tension is disabled both in the case of evil operation of control section 120 as in the case of risks identified by control section 121 in the others modules 202, 302, 403 and in the case of failures of the section protection 121 same. For this purpose, as best explained to later, protection section 121 is designed with inherent safety techniques against failures.

Figure 4 is a block diagram of the control and supervision section 120 of the computer module vital.

A CPU 20 is connected to: a RAM 21 and to a 21 'instant memory, 22 series line controllers, a polynomial divider 23, an interface VCM_IOBUS 24, the interface with protection section 25.

The CPU uses a microprocessor, for example a INTEL i386EX, consisting of an i386EX core and a broad set of peripherals; the core has an internal architecture 32-bit and an external 16-bit bus. The latter is connected with the appropriate support circuits required for your operation, such as: the generator circuit of the reset, power drop analyzers, various different oscillators to ensure independence over time between the various functions (particularly provided: a 50 MHz oscillator for the microprocessor, a 20 MHz oscillator dedicated to one of the three programmable logics, and an oscillator of 10 MHz dedicated to the two asynchronous serial lines), a circuit of surveillance that is activated whenever a bad is detected operation in control section 120, disabling of that mode interfaces and generating an interrupt request.

The memory consists of RAM integrated circuits Fixed 21 with a maximum total capacity of 1 Mbyte and two circuits integrated 21 'instant memories, with a total capacity maximum of 4 Mbytes. Instant memory 21 'contains the program application-specific management and parameters of system configuration.

Three serial line controllers are provided 22, one that is inside the processor and the other two outside it. The controller inside the processor manages two channels asynchronous that are compatible with component 16450 whose interface Electrical is of the RS232 type.

The two external controllers are identical, and each of them manages two full-duplex channels which can be programmed as synchronous and asynchronous. These directors can be managed, depending on the needs of the application, in operation survey, interruption and in operation DMA The electrical interface of the two serial lines associated with the first external controller and used for connection to the FNET network it is of type V35 (the differential and clock data that are of the type from RS485); considering that one associated with the second controller is of the RS232 type.

Block 23 consists of a polynomial divisor called (PD) which is a processor peripheral based on a programmable device, and used to validate vital data, to generate CRC polynomials, and to act as a Boolean operator to check the proper sequence of operations. This check generates check words that are passed inside of the vital computer module, in given times, from the CPU 20 of control section 120 to protection section 121. This function uses a 20 MHz oscillator, to depend on a base of time that is independent of the time base of the microprocessor.

The VCM_IOBUS 24 interface is based on a programmable device The purpose of this interface is to allow Direct management of vital I / O modules or cards expansion with a compatible interface. The VCM_IOBUS interface ensures:

the appropriate routing of the module; for this function randomization techniques and signature of the primitive technique, for example in control units 1.

The interface with the protection signal is provided by an 8-bit bus, which consists of a subset of the processor bus used to connect the memories on the plate and peripherals. Through this bus, the CPU transfers the check words of vital operations to the protection section.

Figures 5 and 6 show the section of 121 protection in greater detail. The protection section has the function of monitoring the behavior of the control section 120 and its own behavior and is activated in case of an operation inappropriate, to configure the system in safe conditions. This is obtained by generating or not generating a tension at what is known as the vital tension to enable the transmission of train detection signals and / or signals of coded communication. This section receives periodically check words (check check words every 50 ms and main test words every T seconds, T being an integer multiple of 50 ms) and check the validity of the same. If the check words are correct, provide power to the vital circuits, that is, it generates the voltage vital, in any other case remove that power supply. Check words are consumed in a destructive way ensuring that a given set cannot be used anymore at once. The protection section includes a controller of the vital power supply 32 that does not interpret the meaning of the check words received, but that uses them on the basis of their numerical characteristics by processing the Same as digital signals. Also, the check words they change from one cycle to the next, since control section 120 modify by an incremental value before transmitting them.

The hardware / software security rules of diversity are implemented in protection section 121 between the controller system and the controlled system (even when use the inherent security hardware against failure), as well as the navigation rules of the data structure, with a data structure of a well defined class, with values predetermined, although different for each processing cycle.

The protection section is composed of following three functional blocks, as shown in the figure 5. Block 32 constitutes the processing logic of the word of check that it is of digital type and that it has the function to process the check words received from the section control 120, using Dual Port RAM 33 and to generate a pair of appropriate frequency signals and work cycles.

The active vital filter block 34 has the purpose of safely checking that the characteristics of the signals received (frequency and duty cycle) comply with the prescribed characteristics and enable the generation of the vital tension as long as no fault has been detected. He filter has inherent safety features against the failure that ensure the enable signal to the vital generator only generated if the two input frequencies have the prescribed frequency and cycle characteristics of job;

the vital generator block 35, also designed with the inherent security features against failure, It is intended to physically generate the output voltage desired, if enabled by the frequency signal coming from the active vital filter 34. This voltage can be used as a signal of vital enablement, for all hardware functions and software functions that can only be operational in conditions of security.

The PLC word logic block of processing check 31 has the function of checking vital way the vital processing operations performed by the vital computer module 102. The check words are exchanged with control section 120 through a memory Dual port 33 and by exchanging two signals digital communication initiation, nominated indicators, and more precisely: a PETITION indicator (REQ) and an indicator PREPARED (RDY).

Data structures provided to logic of processing check word "feed" the processing operations of the logical component thereof and, when they are correct, they cause the safe generation of two signals digitals that have precise frequency and ratio values of work and phase cycle (vital frequencies). The element of final check consists of an analog filter 34 that is designed with inherent safety techniques against failure (active vital filter, AVF) and that only produces the frequency for enable the VG 35 vital power generator if the frequencies Digitally generated are correct in all respects. By consequently, the presence of this enable signal conforms securely that digital logical processing operations resulting from receipt of check words appropriate within the data structures, they are correct. Any error of the checkword, or loss of receipt of the word of verification at the prescribed times, causes the disabling of the vital generator.

In order to ensure that the action of checking is constantly vital over time, they are provided two cycles of retest time in module 102 of vital computer (VCM) corresponding to the transfer of sets of check words for the system cycle that is running (main cycle or retest cycle) at PCL 31 processing check word logic. The cycle principal has a period T, an integer multiple of the cycle of 50 ms retest (50 ms time selected because it allows to detect an error and disable the vital generator 35 in a sufficiently short time to avoid failure of the subsystem).

Once the words of check, the word logic microprocessor of processing check 31 processes them, using various algorithms hardware retest software and hardware (adder circuit  CRC, time counters / timers), for securely provide the generation of two signals digital to confirm proper operation of the system. The circuit that manages the reset / monitoring signal of the processing check word logic ensures the proper operation of power controller logic vital 31; If the management software, for any reason or wrong functioning, whatever reason, does not redispate surveillance, it triggers a reset signal that attempts a reset of the vital power controller Vital power controller.

The block diagram of the word logic of processing check 31 is shown in Figure 6. As shown in the figure, the latter also uses a microprocessor which is independent of the microprocessor of the control section 120. The microprocessor in use is an INTEL 8085 microprocessor of 8 bits that auto-connect to the appropriate support circuits, required for its operation, such as: a circuit reset generator, a 5 MHz oscillator used as a clock generator, a monitoring circuit that is reset in a predetermined time; if this does not happen (for example due to a disconnection of the microprocessor from the protection section) is triggers surveillance to generate the reset signal of CPU

The following devices connect to the microprocessor 132: RAM and EPROM memories 232, 232 ', a dual port RAM 33, a timer 332, a circuit cyclic redundancy check or CRC 422, an I / O port 532

The memory is composed of a circuit integrated fixed RAM and an integrated circuit EPROM 232, 232 '. EPROM 232 'memory includes firmware for secure processing of check words that are not applicable specific.

The dual port RAM 33 that is based on a Programmable logic is used to exchange information with the CPU of control section 120. Check words for check the vital operations are received through this RAM 33. The arbitrator that controls access to dual port RAM is controlled by protection section 121 and uses two lines digital control (PREPARED and REQUEST lines). As he microprocessor (8085) of protection section 121 which has Master functions such as the microprocessor (80386 EX) section control 120 that has slave functions, access the RAM of dual port 121.

The 332 timers whose clocks are different from the CPU 132 clocks, to ensure the independence of the time base, they are sixteen counters bits that measure the different signals that depend on the function that performed; are used to count the number of "states of machine "vital power controller processor and for Measure code execution times. The CRC 432 circuit performs polynomial division operations on sequences of data received, and generates a result in the form of "rest" of the sixteen bit division; it is used for the operations of processing of the check word and for the operations of "runtime" check on the content of the EPROM 232 '. The CRC 432 circuit is provided in hardware form, since which is a particularly difficult function for the microprocessor, in the event that it is provided in software form.

The I / O port is used to manage certain digital signals, more precisely: frequency signals vital for active safety filter 34, a reset signal of surveillance, REQ and RDY signals to manage access to dual port RAM 33.

The active vital filter block 34 is in its mostly made of discrete analog circuitry, and it has designed with inherent safety rules against failure. Have the purpose of safely detecting the simultaneous presence of signals that have well defined characteristics. Yes the signs above meet the prescribed characteristics (frequency and duty cycle), activates the generation enable signal of vital tension (OK_PWM).

The frequency, the duty cycle and the peculiar timing characteristics required for consider the waveforms as valid, determine a high level of security against self-impulses, since the generation involuntary of two signals with these characteristics is very unlikely.

If the two signals are transmitted in the form correct, and in an appropriate manner and at an appropriate time, the Active filter generates the following output signals:

a signal to enable the vital generator VG 35;

an optically isolated diagnostic signal for inform the operator of the proper operation through the ENABLE LED illumination.

The VG Vital Generator block, indicated with the number 35, is itself an analog circuitry discrete, and designed with the inherent safety rules Facing the fault. This block is intended to generate physically the vital output voltage (+12 Vdc at 1.5 W). This enabled by means of the active vital filter 34, from the 24 Vdc1 continuous voltage. this tension, if present, enable the code generation to be transmitted to the by means of the train detection signal and / or the signal generator of the coded communication.

one

2

       \ vskip1.000000 \ baselineskip
    

Figure 7 is a block diagram of the train detection signal and or of the generation module of the coded communication signal 202. This module has the function of safely generating the signal to be transmitted to the track in response to the control given by the vital computer module 102. Its structure can be used in several contexts in which signals that have different characteristics must be generated. The board is specialized for different application contexts using different configurations of programmable logic devices
mables

Module 202 is composed of the following three logical sections:

The generator and tester section 40. This section consists of two different blocks; the first is a digital synthesizer 140 that provides two logical signals of output, corresponding to the PWM modulation of the required signal by the vital computer module 102. The two signals generated are different, to directly control, the downward flow of the vital switches 41, the bridge 143 (figures 8 and 9) and to improve the ability to identify any wrong operation of the test block 240, consisting of itself in two similar functional sections, it has the function of check the two PWM output signals of the vital switches 41. Each section dynamically provides module 102 of vital computer, in each test cycle, of a word of checking that it is a function of both the signal sampled in that cycle as of a start word, the so-called condition prior, received by the vital computer module 102. The security architecture is of the reactive type: if there is a Inconsistency between the control information and the words of reread check, protection section 121 of the module vital computer puts the system in a safe state, deactivating therefore the transmission of a signal to the track, through the vital switches (see below).

The vital switch block 41 is formed by two replicated circuits and transfers the signals from the section from generator and tester 40 to the amplifier section of power 43, provided that the "vital tension" generated by the protection section 121 of vital computer module 102 be I presented. The vital computer module 102 only generates said voltage if the check words are consistent with the signal requested and all other conditions of system security The security architecture of switches is of the inherent type of security against the failure.

The power amplifier 43 demodulates the PWM signals and amplifies them in an amount sufficient for the transmission of them to the road. Said amplifier is inherent. safety against failures, and prevents any degradation of the signal transmitted to the road towards more permissive conditions.

The detection signal generation module of the train and of the coded communication signal 202 receives and transmit information and / or controls using the parallel bus of interface (VCM_IOBUS).

The enable of signal transmission is a discrete signal (OK_PWM) that corresponds to the "voltage vital "safely managed by the protection section 121 of the vital computer module 102.

The control of the code to be generated, received by the vital computer module 102, through the VCM_IOBUS is acquired by the section based on programmable logic of generator 140. Depending on the control received, the section of generator 140 synthesizes two logical signals PWM1 and POWM2 that correspond to the generation control required by module 102 of vital computer. It will be noted that the PWM modulation technique delivers the signal amplitude information for the signal that will be generated during the ACTIVATED periods (1 logical) and OFF (logical 0) of the corresponding PWM signal. Both Signs usually deny each other. When the function of habilitation is active, that is, vital tension is present generated by protection section 121 of module 102 of vital computer, the two PWM1 and PWM2 signals are transmitted to the power amplifier 43 to generate the signal to be transmitted to the track.

The tester section 240 consists of a Programmable logic and manages two "tester" sections independent within it, which validate the PWM1_F and PWM2_F respectively (which, as shown in Figure 7, are the  PWM1 and PWM2 signals of the downflow from the switches vital).

The generator and tester sections 140, 240 are totally independent, and use two programmable logic and separate time bases (generated by different clocks). The tester section allows module control logic 102 vital computer validate the signals transmitted to the power amplifier 43, that is, allows you to check the control pulse sequences generated by the section of generator 140 and transferred to the power stage through vital switches 41.

In each control cycle, each tester generates a check word to the vital computer module 102 which is a function of:

the preloaded word from computer module 102 vital in each cycle (which is different depending on the tester and of the cycle);

the duration and state of the pulses for the signal to the input of tester 240;

the position of the fronts in the signal previous.

The dynamic functioning and diversity of output words issued by each tester are assured by the variability of the preloaded word of the module 102 vital computer that is different depending on the tester and of the cycle, so even when a constant PWM signal be present at the entrance of each tester, they are generated differently check words.

It will be noted that the control sent by the generator section 140 and the preload and pre-read functions of the check word of each tester are under strict time control by means of the vital computer module 102, so that the accuracy of the PWM sequence, introduced to amplification stage 43 is ensured both by the accuracy of the check words and by the time between two read operations
successive

When a malfunction is detected, the vital computer module can force the system to a state sure, disabling the generation of signals that are going to be transmitted to the track, through the vital switch 41. The module 102 vital computer only generates the enable vital tension if the check words are consistent with the signal requested and all security conditions have been verified of the system.

The data interface between module 102 of vital computer and the signal generator module 202 is protected by randomizing vital data to ensure a safe behavior even when errors occur module routing in the VCM_IOBUS.

The two digital signals PWM1 and PWM2, generated by the generator section 140 connects to the amplifier of power through vital switches 41, which use optoisolators to ensure galvanic isolation between the two sections

From the functional point of view, each vital switch 41, when enabled, is designed to pass the PWM control pulses to the stage controllers of power; vice versa, when an operation is detected defective, it is disabled and in this case it is designed to Cancel any output control signal.

For this purpose, each switch is equipped in such a way so that it is:

fast enough to ensure the passage of PWM control signals, limit pulse distortions transmitted, reduce the delay introduced between the signal input and output signal (whose delay is small and fine defined, so that the feedback signal can be controlled easily), ensure that no fault can short-circuit the switch, if controlled to be open, secure, when there is no vital tension present, that the PWM signal is blocked, allow continuous dynamic testing in its operational state, to turn it off when the PWM signal transmitted to the amplifier power is deformed.

The output signal of each vital switch 41 is continuously, independently and autonomously reapproved through the corresponding certification section, to verify the accuracy of it. Therefore, any failure, even if it is temporary and only on one of the two switches,  involving a change in the output of the vital switch signal, is recognized by the vital computer module 102 that disables both switches by sending a control of "without signal to track "to power amplifier 43.

The enable control is shared by the two switches and is issued by protection section 121 of the vital computer module 102 (Vital voltage - OK_PWM). Saying control is only vitally generated when all conditions of System security have been verified. Any failure of vital switch, in the "switch enabled" state, no constitutes risk factors because any problem that occurs during this operational state it is detected by the system of Feedback retest (section 121 of module 102 vital computer, which monitors the safe operation of the subsystem, you can disable vital switches). The switches are made in such a way that they ensure that a "open switch" condition does not cause failures of short circuit, or failures that produce an output signal.

Both vital switches are based on the same inherent safety circuit against failure that modules vital input, so that the same rules can be used Basic safety compliance.

The power amplifier block 43 is used to demodulate and to amplify the PWM logic signals to generate from securely the power signal to be transmitted to the wing track and is designed with inherent safety design techniques Facing the fault. The power amplifier whose diagram of blocks shown in figure 8, is composed of: a bridge H 143, an AC / DC converter 243, a control logic 343, a filter Exit LC 443.

Strictly speaking, the power section of the power amplifier consists of the bridge H 143 to which delivers the direct current and that is controlled by the output of the signals coming from controller logic 343. This block is composed of four power switches that are arranged to form an H (see figure 9), two of them called the upper switches (A and C) and two of them called the lower switches (B and D). The four of them switches are controlled by the check signals obtained from the two inputs PWM1_F and PWM2_F issued by the vital switches The PWM1_F signal to logic 1 enables the closing of switch A while logical 0 enables switch B; PWM2_F signal has the same operation over The other pair of switches. When PWM1_F and PWM2_F are complementary voltage is obtained applied to the load having a positive, negative or zero polarity that depends on the corresponding work cycle.

The AC / DC converter 343 is used to start from the 220 VAC input, the DC voltage required for power of bridge H 143. Also, it is used to generate the voltages of isolated auxiliary power required by the block "controller logic" 343. The "logic of controller "343 is designed to adapt and filter the digital PWM signals, emitted by vital switches 41, directly stops the signals to control the switches of bridge power H. Each switch control signal has The following features: logical signal conditioning to adapt the voltage and / or current levels to the values required by the power switch; galvanic separation of the control signals emitted by the vital switches, by means of an optically isolated circuit: power stage independent, different from the power supply of the H 143 bridge; no deformation of the PWM information to be transferred; noise immunity; without self-impulses that could affect the inherent safety of the power amplifier.

In addition, the four controller circuits that are considered together in the bridge switching network have the following characteristics: the 4 controllers only use two logical control signals; the UPPER switches and the BOTTOM switches of the H-bridge can be turned on simultaneously, to obtain a zero load voltage; the power switches can be controlled in complementary columns to prevent the bridge supply voltage from being short-circuited; the time required to open a switch before closing the other switch in the same column is met (to avoid the problem mentioned in the previous article); the power supplies of the controller are separated, to prevent the load or that the switches are short-circuited by means of common terminals: in particular, three separate power supplies are used, one for the LOWER switches, and one for each switch
HIGHER.

The LC output filter is designed to eliminate the high frequency component of the PWM (25 kHz), including components of the switching frequency of the power block, and to allow the passage of the useful low frequency band of the PWM signal spectrum that contains the harmonic components desired.

Figure 10 is a block diagram of the module which acts as an interface with track 402, also called a module Investment, diagnostic and protection. This module performs The following functions: protection and isolation at 4 KV / 5 min. from route; reversal of the direction of the signal transmission on the track; in order to ensure that that encoded information is transmitted to the train, the direction of propagation of the signal must be opposite to the direction of advance of the train; the acquisition and the transmission of diagnostic information to the device stationary.

These functions are carried out by the module 402 which is composed of a circuit board and a tray of Transmitter of transmission / reception.

The board included in the 402 interface module It can be logically divided into two functional areas:

the first area dedicated to investment of the signal on the track circuit includes the relays inverters, the so-called investment block 50, and the circuits for reading the control and the position of the relevant inverter relay 51. It is also required that this area be a function of protection, as it must provide isolation between relay contacts connected to yard wires and logical circuits

The second area, dedicated to diagnoses, includes circuits 52 to measure some electrical quantities of diagnostic interest such as voltages and currents in the field cables and the measurement cable insulation. From again, this area is required to have the protection functions, since which should provide galvanic isolation between the signals of diagnosis and the rest of the control and control subunits 2 supervision.

The TRANSF Tx / Rx tray is connected between the investment function boards and logic boards of Transmission of train detection signal and module generation of coded communication signal 202, acquisition signal of the track circuit and the recognition module 302. The TRANSF Tx / Rx tray performs the following functions:

insulation (at 4 KVdc) between the plates logic of the control and supervision subunit 2 and the cables of yard;

the transmission signal setting;

protection of the reception function against high surges outside the operational band of the circuit via;

the recovery of quantities that are going to Acquire for diagnostic purposes.

The tray contains the following components: a TA transmitter transformer, which has a primary winding and a secondary winding with variable shots; a transformer of reception TR which has a primary winding and a secondary winding TR1 and TR2 (TR1 is used for the function of reception, while TR2 is used for diagnostic purposes); a printed circuit board, on which the connector for the TA transformer control sockets and an LRC filter designed to protect the module from the acquisition and recognition of the track circuit signal 302 are mounted, connected in series between the TR1 socket of the isolation transformer TR and the input of said module 302. The TA transformer is controlled as a function of the distance between the cabin and the track; can be done additional control over terminal boxes, mainly relative to the length of the track circuit.

The most significant functions of the Module circuit 402 are:

relay inversion diagnostic circuits (including the "Control and relay position" block and the block "relay investment management") (including "diagnostic management" blocks and blocks "RS232 serial communication").

Investment block 50 will ensure that the Left (Sx) and right (Dx) signals are connected so stable at opposite ends of the track circuit and that can be invert as a function of the direction of advance of the train over the line. In particular, the direction of the signal transmission coded to be sent to the track will always be contrary to the direction of advance of the train. In this architecture, the circuit that makes the investment is not considered vital, while the function to retest the actual position of the switch is considered vital. In addition, such as the withdrawal of the signal from Track transmission is ensured by turning off the transmitter, the function investment should not necessarily securely secure the disconnection of the track circuit. In addition, the investment block 50 which is directly connected to the track circuit provides the isolation required at 4 KVdc between the subsystem and the track.

The selection control, as well as the function of rereading of the position of the investment block 50 are managed by the vital computer module 102, via the bus parallel VCM_IOBUS.

The inversion function is based on the use of a pair of relays, called ddx and dsx, which when properly controlled, connect the transmitter to the end of the CdB and the receiver to the opposite end. The relay switching function is always performed when there is no transmission signal present; this allows to ensure the reliability of the required function; Also, if the above operational conditions are considered, no particular surface treatment on the relay contacts is required. The control is coded by a programmable logic that can be accessed through the VCM_IOBUS that generates the signals to control the two relays. Since this architecture requires an excited relay and a non-excited relay so that the transmitter can be connected to one end and the receiver to the other end, or vice versa, the only allowed combinations of the control signals are ON / OFF and OFF / ON. The unwanted condition of the two excited relays or the two non-excited relays is recognized by the re-reading function that forces the subsystem to a state
sure.

Figure 13a shows the connection scheme between the two relays and the contact states for the address of left train feed (sx), while Figure 13b is applicable for the opposite direction.

       \ newpage
    

Each relay includes: four contacts, used to the real investment function; two contacts, used to detect the position of the relays; a contact used for the functions of diagnosis.

The two relays selected for this function are safety relays of the printed circuit board whose Main features are: forced guide contacts, it is say mechanically connected in such a way that the contacts in Closed rest and open contacts at rest cannot be closed simultaneously; even when a fault occurs (it is say, a contact is stuck), a minimum distance is ensured opening for antagonistic contacts; insulation of contact / contact and contact / coil 4 kdc (whose characteristic is required to ensure the necessary isolation between the subsystem and pathway); exchange contacts are not provided, but  only normally closed contacts (NC) or contacts normally open (NA) that switch to the opposite state when the relay is activated; 3 NC contacts and 4 NO contacts.

The rereading function is managed by the vital computer module 102 which dynamically calculates two words through two parallel circuits, ie MODULE0 and MODULE1 (Figure 13). Each reread circuit uses an NO contact of one relay and an NC contact of the other relay, connected in series; As the two relays are controlled exclusively, one circuit has both contacts closed, while the other circuit has both contacts open (as shown in Figure 13 for the case "sx"). With reference to Figure 13, the words to be recirculated control the DRIVE0 and DRIVE1 signals, while the retest retest words use the SENSE0 and SENSE1 signals; The SENSE signal is the logical negation of the corresponding DRIVE signal, provided that both contacts are closed (whose condition can only be fulfilled for one of the two readout circuits). If no reread is made or an incorrect reread is made, either by the circuit enabled for word recirculation (both contacts must be closed) or by the circuit that should be disabled (both contacts must be open), this is interpreted as a block malfunction of
investment.

The vital circuit to reread the state of investment block 50 is designed in such a way that any component failure or loss of power supply prevents Reading the test word: the accuracy of the word from  checking depends on the proper reception of the word from hardware check (randomization, signature).

The data interface between module 102 of vital computer and the module of protection, investment and diagnosis 402 is protected by common signature techniques and randomization

The security architecture of this function is of the reactive type, and is such as to ensure that the subsystem It can be switched to safety status in case of a failure.

The following table lists the connected signals to the investment block.

       \ vskip1.000000 \ baselineskip
    

       \ vskip1.000000 \ baselineskip
    

       \ vskip1.000000 \ baselineskip
    

(Table goes to page next)

3

Diagnostic functions for data yard are carried out on non-vital hardware and are handled by medium of a commercial module with a microprocessor on the board which connects to the system diagnostic network. The module commercial called Echelon, is a module of "purpose general "that manages 10 discrete I / O channels; through the Using an external A / D converter, you can purchase 8 channels Additional analogs

The microprocessor module includes a second RS232 serial interface that connects to vital computer module 102 and is used to receive the information required to verify the yard signal, such as the direction of signal transmission on the track circuit. The previous module is optional and only provides when a diagnostic network is available, for example of the Echelon type, to which the diagnostic information over the cabin / yard interface is only transmitted.

In the protection module architecture, inversion and diagnostic, the diagnostic module is used to Acquire the following quantities:

left cable insulation (sx) and right (dx) to the track (this information is also displayed via two front panel LEDs);

current on the secondary winding of the transmission transformer (measured by an effect sensor Hall);

tension on the secondary winding of the transmission transformer (measured by an effect sensor Hall);

power of the received band signal (the signal it is received by means of a secondary winding separated from the receiving transformer);

signal strength received out of band;

carrier frequency modulation of the transmission signal

All circuits required for the signal acquisition and conditioning are fed by medium of an autonomous power supply and isolated at 4 kV DC of the track.

The structure of the diagnostic module is like the one shown in figure 14.

Figures 15 to 21 show various details of the acquisition of the signal of the track circuit and the module recognition. This module is designed as a signal receiver of safety track circuit operating in the 40 Hz band at 1 kHz, and is used to recognize encoded signals provided by the code block system n and the signals "fixed frequency" used when no one is provided code.

The security architecture of the APRX module, As mentioned above, it includes two channels of acquisition and conditioning 60, 61, which are decoupled by middle of an input stage 62. The latter is designed with inherent security techniques against failure, ensuring that Output signals acquired by the two channels cannot degrade to more permissive conditions due to failure.

Each channel 60, 61, based on a processor DSP digital signal, use dedicated hardware and include, as shown in figure 16 in detail, test functions of self-regulation that work continuously and regardless of the state of the track circuit.

Failure detection for each channel is performed measuring the locally generated test signals; particularly facilitated: a signal to check the amplitude appropriate input signal; a signal to verify the appropriate frequency of the input signal; one monitor for all internal supply voltages and voltages of reference.

Denial of failure effects are assigned to the exit construction function that requires an appropriate measure of all test signals and of reference to generate the permissive output information.

The board is composed of the following blocks Functional: a power supply block 63 that provides all internal supplies and reference voltages required by the two channels of module 302, a signal circuit input 64 that is designed with inherent security techniques Facing the fault and distributing the received signal to both channels 60, 61 and allows adding the amplitude test signal to the input signal; channel A 60 and channel B 61 that are made of replicated hardware The two channels work so independent, that is, they acquire the track signal and transmit the code / fixed frequency information detected in the path to the module 102 vital computer through dual port memory 70.

Each processing channel 60, 61 are in turn composed of the following functional blocks: logic 160, 161, which has the following functions: measurement of the signal of track circuit; measurement of test signals and signals internal reference; signal demodulation and recognition of the codes; coding and transfer of information to vital computer module 102;

A test logic 260, 261 that provides the test, amplitude and frequency signals used to check the integrity of the measurement channel.

Each channel uses a dual port RAM 70 to exchange information with vital computer module 102, to through the VCM_IOBUS interface. Said data interface between the vital computer module 102 and the acquisition module and of Signal recognition of track circuit 302 is protected by randomizing vital data to ensure a safe behavior even when errors occur module routing to VCM_IOBUS.

The signal recognition algorithm of track circuit used by each of the two channels 60, 61 generates an internal word of "present / absent signal"; these words that are predetermined for each signal of fixed and different code / frequency for both channels 60, 61, are initialized at the beginning of each cycle with the code / fixed frequency "absent". Each channel 60, 62 samples the signal of the track circuit at sampling rates slightly different, that is, they differ by about 16 kHz. So the signal sampled is filtered digitally and analyzed by two parallel processes that discriminate it as a code or as the signal fixed frequency, and more precisely:

Code recognition: the filtered signal is demodulates, thereby obtaining the square wave that constitutes The code modulator signal. The recognition of a code particular, such as that obtained from the duration analysis ON / OFF of said square wave, change the word corresponding to the code recognized from absent to present;

The recognition of the fixed frequency signal: recognition of the fixed frequency signal is obtained comparing the phase of the acquired signal with a 50Hz signal from internal reference. The recognition of a frequency signal particular fixed is obtained by analyzing the phase difference previous in the time domain (phase / counter and phase times transition); the word that corresponds to the frequency signal Fixed recognized is changed from absent to present.

Each of the previous inner words, associated with any code or signal of fixed frequency, are additionally changed and made available to the module VCM 102 vital computer in dual port memory 70, using a process that uses a word, called "time setpoint", preloaded from the vital computer module 102 in each cycle and varying from one cycle to another; the previously determined word of fixed code / frequency detected / absent; the appropriate measure of All test signals and reference signals.

The dynamic functioning and diversity of output words issued by each channel are insured by means of the variability of the preloaded time setpoint from the vital computer module 102, and varying from one cycle to other, and by different code / fixed frequency coding made by the two channels 60, 61, so even when detect the same signal at the input of the two channels, they are generated Different status words.

The result comparison function produced by the two channels 60, 61 is not assigned to this module, but to the vital computer module 302. This configuration of the design allows to carry out the function in a way self-sustaining

The following table list, as shown schematically in figure 17, the interface signals between the module 302 and the other plates of the control subunit (2) and supervision.

4

As shown in Figure 16, the block of power supply 63 and the signal circuit block of Input 62 is common to both channels; a description will be provided later for both common blocks, while it will be described only one of the two processing channels that are functionally identical

Figure 17 schematically shows the block Functional for internal power supplies. This block It has the following entries:

+5 VDC: voltage generated and controlled by the Switching power supply contained in the logic frame. The following internal power supplies are obtained from of this power supply voltage, thanks to the voltage regulators replicated for both channels:

the voltages of 3.3 V / 1.8 V and ± 5 V required for the proper functioning of logic;

The test reference voltage (2.5 V) used as a reference voltage to generate the test signal of amplitude;

24Vdc2: the following power supplies internal are obtained from this tension:

a voltage of 4.1 V that is used as a reference for the amplitude of the track signal; are provided voltage regulators replicated on both channels for this function.

the supply voltage for both the measuring device of the track signal as for the generator frequency test signal.

The tensions generated are summarized in the following table:

100

       \ vskip1.000000 \ baselineskip
    

The previous functional block 63 complies with the following security rules:

ensures independence between the tensions of reference used to measure the track signal (as derived 24V2) and the voltage used to generate the signal amplitude test. This allows to detect any change of measurement reference voltage caused by failures or variations of The supply voltage.

ensures independence between the voltage used to generate the time base of the logic (derived from the voltage 5 V) and the voltage used to generate the test signal of frequency (derived from 24 VDC2);

ensures the independence of tensions of reference between the two processing channels. This condition is get using physically separate voltage regulators.

Figure 18 shows the block diagram of the input circuit 52 for the track circuit signal that is composed of the following functions: bridge adder 162, anti-lapping filters 262.

The signal input stage 62 includes a bridge adder 162 that performs the dual function of distribute the track circuit signal to the two measurement channels 60, 61 and adding the amplitude test signal of each channel to the road sign

The input signal circuit is designed as an "inherent security against failure" way, to make sure that the relationship between the voltage of block output and block input voltage does not increase due to failures, without being detected through the measurement of the test signal

This block uses a transformer that has two secondary windings for signal distribution. The signs test are injected creating a bridge that is balanced between a central outlet of the secondary winding and the measuring point Of the signal.

The components of the measuring bridges will have such a technology that ensures that no increase in the voltage at the measuring point due to failures.

By choosing to use a signal from test to check the amplitude of the signal measurement, it ensures the detection of faults in the downward flow from the injection point of the test signal (for this reason, said injection point will be at the highest point); all the upstream circuits from the signal injection point amplitude test will be designed with inherent rules of Security against failure.

Flow down from the separation block of the signal 164, a low-pass anti-lap filter is provided for each processing channel 60, 61 The filter has a frequency of cut such that it ensures that module 302 has an input band 1 kHz

The potential effects of the filter 262 anti-lapping on safety could be:

an altered input / output signal ratio; particularly, an increase in profit (or a decrease in attenuation) has adverse effects on safety. This event hypothetical is detected by measuring the amplitude test signal that is  injected into the upstream from the anti-lapping filter 264. Furthermore, since the filters are made only of passive components that have negligible attenuation in the passing band, this event is really impossible;

the cutoff frequency altered. An increase of the cutoff frequency beyond half the frequency of sampling (Nyquist theorem) potentially affects security, therefore power noise could be expected beyond of said frequency, and said characteristics that may to be confused with the expected signals, due to the overlap. He remedy for this is assigned in the logic block that uses a sampling frequency - 16 kHz, therefore above the band of train noise. In addition, the use of modulated signals both in code transmission conditions as in conditions without code provide an additional security key.

The logic functional block 160, 161, such as the shown in figure 21, performs the following functions:

Sampling of 8 analog signals, with one sampling rate of up to 18 kHz per channel;

processing of acquired signals;

Interface with computer module 102 vital.

The functional logic block is composed of The following three physical blocks:

An acquisition block 80 that is based on a ADC analog to digital converter device for sampling and measuring 8 analog signals;

A processing block 81, which is based on a microprocessor specifically designed for the operations of Digital Signal Processing (DSP), and in the use of memories snapshots, clocks, and oscillators;

an interface 82 with the common interface module 102

The acquisition block 80 is composed of a ADC device that has eight input channels as used as follows:

channel 1: sampling of the track signal. It will be noticed that the track signal is translated in amplitude due to the presence of the amplitude test signal.

channel 2: sample of the test signal of frequency.

Channels 3, 5, 7: show the voltage of internal reference.

Channels 4, 6, 8: Sample reference grounding

ADC devices provide an output digital corresponding to the input voltage when sampling; East output value depends on the reference voltage provided to device.

The architecture of the measurement channel that uses the previous test signals allow to detect and manage so appropriate any measurement error.

It will be noted that the choice of adding the signal of amplitude test to the track signal allows a check complete and continuous acquisition channel dedicated to the measure of the track signal.

Other potential signal sampling errors They may be:

wrong acquisition channel: the signals existing in the different channels of the ADC have been defined with said frequency, modulation and amplitude characteristics different that cannot be confused. This malfunction prevents any recognition of the signals for the channels relevant.

Sample rate drift: this risk it is prevented by measuring the frequency of the test signal of frequency that, as stated above, is not generated by the time base generating device of the section of logic.

Each channel 60, 61 are equipped with a DSP microprocessor; said microprocessors are specifically designed to perform sequential multiplication operations and of sum to determine the digital filters. DSP processor which runs the application software, is designed to filter and demodulate the signals and recognize their codes. Also, this block includes the required auxiliary circuits For DSP operation, more precisely:

a clock generator, being the drift of this signal detected by measuring the frequency of the signal frequency test;

an instant memory used to store the application program, under power failure conditions. Ignition code integrity check protects against all risks associated with this function;

RAM: the DSP microprocessors of the Selected family include a RAM memory "on circuit integrated "which is sufficient for applications of the state of the technique, so no additional memory is needed in the actuality For future applications, it is expected to add a additional optional memory to the board;

a device based on programmable logic that form dual port memory in common with module 102 of vital computer and other logical functions such as the external address decoding, and device control of  acquisition.

An interface with computer module 102 vital. This interface is provided with a dual port memory. Any simultaneous access to memory by module 102 vital computer and recognition and acquisition module of the track circuit signal 302, that is, the VCM and the APRX is managed through dedicated logic circuits. Both memory Dual port as the relevant logic circuits consist of programmable hardware Protection against any failure of the Dual port memory function, such as freezing of data, erroneous routing or erroneous access arbitration is provides through software remedies.

For each processing channel 80, 61, they provide two different routing areas, designed to the exchange of vital information and non-vital information respectively. As shown in Figure 20, when route the predetermined vital data areas, the data provided by module 302 are changed by the mechanical randomization of bus data that is performed physically on the motherboard. The randomization is carried out of a different way for each position of the motherboard; is technique allows to differentiate the outputs generated by each module. This provides protection against any error of routing for the modules in the VCM_IOBUS. The accesses to non-vital areas are not differentiated by randomization; this simplifies the management of non-vital data within the vital computer module, thus avoiding any decoding as a function of the routed module.

The test logic module 260, 261, as shown in figure 21, generates two test signals, is say:

Test 1 to check the amplitude of the channel measure;

Test 2 to verify the time base of the measurement channel

The generation of the test signal1 provides a signal whose amplitude can be set by logic; the logic cyclically change the amplitude of the test signal for ensure the vitality of the function. For security reasons, the reference voltage used to generate the test signal1 and the used to measure the track signal are independent and generated through self-contained power supplies. This condition is provided by the "power supply" block that generates the measurement reference voltage of the external voltage of 24Vdc2 and the reference to generate the test signal from external voltage of +5 V. This technique ensures that each channel can independently detect such changes from any power supply voltage to alter the values of reference voltage

Conversely, the test signal2 has the purpose of providing the logical function of a reference of unrelated frequency - time base. To this end, the module security architecture includes, for this function, a dedicated oscillator whose supply voltage is independent of the logical supply voltage (the voltage of +5 Vb, as illustrated in figure 22, is generated by the block of "source of power "from a voltage of 24VDC2, while the Logic power is derived from the voltage of +5 V).

Figure 22 shows a particular configuration of the system, in which current signals are used for the train detection as well as signal encoding of train communication code four.

A train is detected by injecting a signal from fixed current in each track circuit, that is a signal that have a fixed current level once decoded. The signal transmitted by the transmitter to the track circuit to the receiver in a direction opposite to the direction of advance of the train Receive if no train is detected. When a train is present, the rails are shorted by the train itself, and the receiver is not  It is reached by no signal.

The subunit (2) of control and supervision of according to the invention and with the above description can be properly programmed by the configuration program appropriate system specific cooperating with the program independent processing of the specific structure of the system to the application of automatic block of code ITALIA 4, and can handle (transmit / receive / recognize) the following signals:

codes;

"fixed frequency" signal used to get the busy / unoccupied function when not provided no code (no path or routing).

As described above, the circuit of via is encoded by interrupting a frequency carrier a predetermined number of times per minute (modulation of amplitude). This application uses four types of code. These types are obtained using an interrupted 50 Hz carrier 75, 120, 180 or 270 times per minute (the corresponding code is indicated by the number of interruptions per minute).

The characteristics of the detection signal of Fixed current train (CF) must ensure the maintenance of safety conditions even when losses of insulation at the junctions between adjacent track circuits. The architecture of the subunit (2) of control and supervision of according to the invention allows to provide a transmitter for each track circuit connected by the network with the central unit (1) of control and supervision. The carriers that transmitters use They are produced locally, with no phase relationship between them. I dont know can make any assumptions about the phase difference between two adjacent track circuits.

Therefore, a modulation will be introduced in the CF signal that is different between adjacent track circuits and that It is adapted to ensure safety conditions even when power is transferred from a track circuit and the following.

The configuration implemented in this document Includes the use of different signals CF signals (4 sets) for be appropriately assigned to track circuits to ensure that said signal is not present in the track circuits adjacent. In all sets, the signal is composed of a 50 Hz carrier transmitted alternately in phase and in phase opposition with respect to a 50 Hz reference hypothetical The sets are differentiated by the intervals of time between two successive phase steps. Opposite sections they are connected by signal periods of 555.55 Hz, to ensure A progressive transition This provision provides, upon departure of a bandpass filter tuned to 50 Hz, an amplitude signal constant that ensures the detection of occupancy in any moment.

The signal implemented is shown in the figure 22

The frequencies of the signal are selected in based on the following rules:

The frequencies of 50 Hz and 55.55 Hz cannot interfere or be interfered with by any equipped track circuit with adjacent phase control receivers; it will be noted that the two systems use the 50 Hz frequency in a different way, it is that is, the phase control receiver uses it in a continuous wave, and the control and supervisory subunit 2 in accordance with this invention uses it for alternation with the frequency of 66.55 Hz.

filter attenuation at module input acquisition and recognition of the signal (which is tuned at 50 Hz) at the frequency of 55.55 Hz it is compensated by means of amplification of inductive track connections;

an appropriate noise mask, such as the noise mask FS-96 ensures that, around 50 Hz, no noise can limit normal operation.

The duration of section T1 is used for differentiate the different track circuit assemblies, as indicated in the following table:

5

Section T2 has a duration of 90 ms (512 periods), whose value allows a phase change of 180º.

The time T1 has been determined considering that:

T1 will be a short period to reduce the degradation of receiver response time, in case of loss of isolation to the union; when there is a loss of isolation, the signal is expected to be disturbed by a signal in phase emitted by the adjacent track circuit, causing this mode, for a few ms, an increase in the signal at the receiver. The longest signal increase time is equal to the time shorter between the duration of the track circuit signal relevant and at the time of the track circuit signal adjacent;

The difference T1 between the two sets will be at least 100 ms, to ensure recognition of the set at The signal belongs.

According to a variant embodiment, it can be Use a code nine code. In this case, the signal previously mentioned coded PWM can be added or it can superimpose on an additional signal derived by means of a identical PWM modulation of a carrier that has a frequency different, that is, a carrier of 100 to 200 Hz, in particular 178 Hz

The list of abbreviations and acronyms, used in the figures and in the description

@ determined measure to A / D analog to digital ADC analog converter to digital ASCV station apparatus vital computer ASCVGS station apparatus of vital computer for stations big AVF Vital Filter Active AC, AC, AC current alternate DC, DC DC, Current keep going CdB Circuit of via FC Current fixed CPU Central Unit of process CRC Redundancy check cyclic GIVES Digital to analogical DSP Signal processor digital

FNET Field network FSFB2 Bus field with security against failure - Second generation HDLC Data link control High level Hw Hardware IS Entrance exit MGRC Module code generator and receiver NISAL Logic to ensure integrated security numerical PAL Panel feeding PCL Logic Control indicted P.S. Divider Polynomial PWM Modulation width of pulses RAM Access memory random RCF Receiver Control phase Rx Reception SALT Logic to ensure safety SIL Level of safety integrity MR Specification of requirements of subsystem SW software Tx Transmission UAB Unity pisya feed (boxes terminals) V \ textamp V check and validation VG Generator Vital VPC2 Power controller, version 2.

Claims (22)

1. A system for occupancy detection on a railway line, or similar, and for communication digital with trains running along the line of railway, in which, a) the road that forms the railway line is divided into a plurality of isolated successive track segments galvanically that have a predetermined length, the called blocks, the rails of each segment of isolated track forming a track circuit (cdB, cdB1, cdB2, cdB3) to detect the presence of a train within the aforementioned isolated track segment, to communicate with a train within the mentioned track segment isolated and / or to detect diagnostic data about the status of said segment of isolated track; b) a central unit (1) of control and supervision that generates and transmits signals from control to execute train detection procedures and / or train communication procedures related to a train circulating on that segment of the isolated road and / or to execute diagnostic procedures; c) whose central control unit (1) and supervision communicates with the track circuit (cdB, cdB1, cdB2, cdB3) of each segment of isolated track by means of a subunit (2, 2 ', 2 '') control and supervision, associated with each of the isolated track segment or track circuits (cdB, cdB1, cdB2, cdB3) to generate and receive codes, and whose subunit (2, 2 ', 2' ') of control and monitoring executes the procedures to detect the presence of a train (T) within the isolated track segment Associate, communication procedures and procedures diagnostic and transmits the corresponding control signals to the presence or absence of the train within the corresponding segment of isolated track and / or to the appropriate communication established with the train and / or the diagnostic signals related to the circuit via (cdB, cdB1, cdB2, cdB3) and informs the central unit (1) of control and supervision over its results; d) each subunit (2, 2 ', 2' ') of control and of supervision associated with each corresponding segment of isolated track being connected to the ends thereof by means of a transmitter and receiver (3, 4); e) and each subunit (2, 2 ', 2' ') of control and supervision and its segment of associated isolated pathway identified uniquely by means of an identification code default (ID); characterized in that each subunit (2, 2 ', 2'') of control and supervision that generates and receives the aforementioned codes comprises: f) a reactive security architecture with the that said subunit is equipped; g) a vital computer Module (102) based on microprocessor that contains the programs to manage and control peripheral modules to generate and transmit train detection signals and communication signals encoded, for the reception signals coming from the track circuit (cdB, cdB1, cdB2, cdB3) of the corresponding isolated track segment, to communicate, that is, receive e interpret the controls of the central control and the unit (1) of supervision, and to transmit train detection and communication information, as well as to manage communication and timed activation of peripheral modules; (h) a module (202) to generate the signals of train detection and coded communication signals controlled by the vital computer module (1); i) a module (302) to acquire and recognize the mentioned train detection signals and the mentioned signals communication codes from the track circuit (cdB, cdB1, cdB2, cdB3) whose signals are relevant to the corresponding segment of isolated track that is controlled by means of the vital computer module (102) and that provides the mentioned signals received by the track circuit of corresponding segment of isolated track; j) a module (402) to connect to the output of the module (202) to venerate the train detection signal and / or the communication signal encoded with isolated track segments and to connect the module input (302) to acquire and recognize the mentioned train detection signals and the coded communication signals of the track circuit (cdB, cdB1, cdB2, cdB3) with the isolated track segment whose module (402) is controlled by the vital computer module (102), with respect to the  connection of the two transmitter and receiver (3, 4) that connect the segment of the track isolated and arranged on the track at the ends of the corresponding segment of isolated track, alternatively with the module output (202) to generate the detection signal of the train and / or the coded communication signal and with the input of the module (302) to acquire and recognize the detection signals of the train and coded communication signals; k) the vital computer module (102) including a control and supervision section (120) that generates the codes to check the proper execution of the detection signal of train and / or the generation of the coded communication signal and / or the operations of reception and interpretation of the signal of coded communication from the track circuit, whose check codes are provided to a unit (121) of protection check that checks them for accuracy, and has a section (35) to disable the vital operations of the subunit (2, 2 ', 2' ') of control and supervision generating and receiving codes and to force the system to a state more restrictive, for example, the state of road occupation, when Detects an invalid verification code. 2. A system as claimed in claim 1, characterized in that the control and supervision section (120) and the protection check unit (121) have different microprocessors. 3. A system as claimed in claim 1 or 2, characterized in that the control and supervision section (120) and the protection check unit (121) include processing software independent of the configuration (21, 232 ') as well as configuration software (21', 232) that constitutes the database to execute the processing software according to the system configuration. 4. A system as claimed in one or more of claims 1 to 3, characterized in that the module (202) for generating the train detection signal and / or the coded communication signal includes a generator (140) of a pair of PWM signals, which are used to generate the train detection signal and / or the communication signals encoded by means of a power amplifier / demodulator (43), said pair of PWM signals being provided to the amplifier / power demodulator through a switch (41), which is controlled by the protection check unit (121) based on the confirmed accuracy of the pair of signals obtained by the pulse width modulation performed by the module (102) of a vital computer that receives said pair of PWM signals and checks them for consistency with the control signals received from the central control and supervision unit (1), and generates, as a result, the code d e check to be analyzed by the protection check unit (121). 5. A system as claimed in claim 4, characterized in that the power amplifier / demodulator (43) has an inherent safety construction against failure. A system as claimed in one or more of claims 1 to 5, characterized in that the module (302) for acquiring and recognizing signals from the track circuit (cdB, cdB1, Cdb2, cdB3) includes a input stage (62) to decouple the input signal to two processing channels (60, 61), by means of a digital signal processor whose outputs are provided to the vital computer module (102) that verifies its identity and, as a result , generates a word code that will be checked for accuracy by the protection checking unit (121). 7. A system as claimed in claim 6, characterized in that the input stage (62) for decoupling the two signal processing channels (60, 61) has an inherent safety construction against failure. 8. A system as claimed in one or more of claims 3 to 7, characterized in that a device for inverting the connection of the transmitter and receiver (3, 4) at the two ends of each segment of isolated track has an inherent safety construction against failure. 9. A system as claimed in one or more of the preceding claims, characterized in that the protection check unit (121) has an inherent safety construction against failure. 10. A system as claimed in one or more of the preceding claims, characterized in that the protection checking unit (121) checks the verification codes for accuracy by destructive processing thereof. 11. A system as claimed in one or more of the preceding claims, characterized in that each control and supervision subunit (2, 2 ', 2'') that generates and receives the train and / or detection signals The coded communication signals comprise a means for generating a signal when a train is detected in the corresponding isolated track segment whose signal is transmitted by the transmitter (3, 4) associated to one end of the isolated track segment to the associated receiver (4 , 3) at the opposite end of the isolated track segment in the opposite direction to the direction of the train's advance, whose train detection signal is provided before transmitting a carrier that has a low frequency fixed default to a track segment phase modulator isolated that modifies the carrier phase for the intervals of predetermined time between two phases defined with reference to a reference signal that has the carrier frequency, having the time intervals between the frequency steps of the two phase configurations a predetermined length; and said train detection signals being uniquely differentiated for each segment of isolated track, by setting different time intervals between two successive phase steps. 12. A system as claimed in claim 11, characterized in that a defined number of different train detection signals are provided within an isolated track segment, each being differentiated from the other with respect to the interval between two transitions of successive carrier phase, the timed phase modulators associated with the individual track segments isolated from the railway line being configured such that these train detection signals have different time intervals between successive phase transitions, in particular different from those signals transmitted to the directly adjacent isolated track segments. 13. A system as claimed in claims 11 or 12, characterized in that a progressive slope between two successive phase steps is provided, having a duration and frequency such as to provide a uniform phase transition. 14. A system as claimed in one or more of the preceding claims from 11 to 13 characterized in that the carrier is approximately 50 Hz. 15. A system as claimed in one or more of the preceding claims from 11 to 14, characterized in that the phase transitions occur between a phase configuration in which the signal is in phase with a reference signal and a phase configuration in which the signal is in phase opposition with respect to a 50 Hz reference signal. 16. A system as claimed in one or more of the preceding claims from 11 to 15, characterized in that the slope between two successive phase transitions has a frequency of 55.55 Hz. 17. A system as claimed in one or more of the preceding claims from 11 to 16, characterized in that the train detection signal has a total duration corresponding to the sum of the intervals of five successive phase transitions and the duration of five pending. 18. A system as claimed in one or more of the preceding claims from 11 to 17, characterized in that the control and supervision unit (2, 2 ', 2'') that generates and receives the signals from Train detection and / or coded communication signals have only one means of code generation defined. 19. A system as claimed in claim 18, characterized in that a defined number of uniquely defined codes is provided, each being defined by means of a predetermined pulse width modulation, that is, by means of a predetermined number of times per minute that the carrier is excluded. 20. A system like the one claimed in the claim 19, characterized in that the carrier is at 50 Hz, provided that four codes are provided whose pulse width modulation corresponds to the carrier interrupt performed a predetermined number of times per minute, and particularly 75, 120, 180 and 270 times per minute respectively. 21. A system as claimed in one or more of the preceding claims from 11 to 20, characterized in that the control and supervision subunit (2, 2 ', 2'') that generates and receives the signals from train detection and / or the coded communication signals has at least one output for the train signal detection and for the coded communication signals and at least one input for the signals acquired from said output and the input being connected with the track connection interfaces (3, 4) that can alternately have transmission and reception functions, and which are connected alternately by means of an inverting circuit of the connection to said output and to said input respectively, in response to the control of the central control and supervision unit (1) and as a function of the direction of advance of the train within the corresponding segment of isolated track. 22. A system as claimed in claim 21, characterized in that said track connection interfaces consist of transmission / reception transformers.