EP1338492B1 - System zur Gleisfreimeldung einer Eisenbahnstrecke und zur Kommunikation mit Zügen auf dieser Strecke - Google Patents

System zur Gleisfreimeldung einer Eisenbahnstrecke und zur Kommunikation mit Zügen auf dieser Strecke Download PDF

Info

Publication number
EP1338492B1
EP1338492B1 EP03100263A EP03100263A EP1338492B1 EP 1338492 B1 EP1338492 B1 EP 1338492B1 EP 03100263 A EP03100263 A EP 03100263A EP 03100263 A EP03100263 A EP 03100263A EP 1338492 B1 EP1338492 B1 EP 1338492B1
Authority
EP
European Patent Office
Prior art keywords
signal
signals
train
control
module
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP03100263A
Other languages
English (en)
French (fr)
Other versions
EP1338492A1 (de
Inventor
Claudio Tavoni
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alstom Ferroviaria SpA
Original Assignee
Alstom Ferroviaria SpA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alstom Ferroviaria SpA filed Critical Alstom Ferroviaria SpA
Publication of EP1338492A1 publication Critical patent/EP1338492A1/de
Application granted granted Critical
Publication of EP1338492B1 publication Critical patent/EP1338492B1/de
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L23/00—Control, warning, or like safety means along the route or between vehicles or vehicle trains
    • B61L23/08—Control, warning, or like safety means along the route or between vehicles or vehicle trains for controlling traffic in one direction only
    • B61L23/14—Control, warning, or like safety means along the route or between vehicles or vehicle trains for controlling traffic in one direction only automatically operated
    • B61L23/16—Track circuits specially adapted for section blocking
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L3/00—Devices along the route for controlling devices on the vehicle or vehicle train, e.g. to release brake, to operate a warning signal
    • B61L3/16—Continuous control along the route
    • B61L3/22—Continuous control along the route using magnetic or electrostatic induction; using electromagnetic radiation
    • B61L3/24—Continuous control along the route using magnetic or electrostatic induction; using electromagnetic radiation employing different frequencies or coded pulse groups, e.g. in combination with track circuits
    • B61L3/246—Continuous control along the route using magnetic or electrostatic induction; using electromagnetic radiation employing different frequencies or coded pulse groups, e.g. in combination with track circuits using coded current
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L1/00—Devices along the route controlled by interaction with the vehicle or vehicle train, e.g. pedals
    • B61L1/18—Railway track circuits
    • B61L1/181—Details
    • B61L1/188—Use of coded current

Definitions

  • the invention relates to a system for occupancy detection in a railroad line, or the like, and for digital communication with trains that run along said railroad line, according to the preamble of claim 1.
  • the invention has the object of improving a system according to the preamble of claim 1, in such a manner as to allow the use of control and monitoring subunits which have such a construction and operation as to limit construction efforts, thanks to the fact that they can be used easily either in combination with existing systems, or in combination with various system configurations, or in possible combination with other types of objects to be controlled or monitored, while maintaining very high safety levels.
  • the invention has the additional object of providing a system as described hereinbefore, wherein the train detection and digital communication arrangements are highly simplified.
  • a system for occupancy detection in a railroad line, or the like, and for digital communication with trains running along said railroad line comprises at least one track which forms the railroad line and is divided into a plurality of successive galvanically insulated segments having a predetermined length, the so-called blocks, the rails of each segment forming a basic element, named track circuit.
  • Track Circuits are indicated as Cdb1, Cdb2 and Cdb3. These Track Circuits use rails to send the signals that allow train detection on the corresponding track segment, and to communicate with a train. Moreover, the signals sent to each track segment may be used to detect any track failures or damages.
  • the system includes a central control and monitoring unit 1, which is specially named Stationary Control Apparatus ASCV, which generates and transmits control signals to execute train detection procedures and/or train communication procedures relating to a train T on that track and/or to execute diagnostic procedures.
  • the central control unit 1 communicates with the track circuit of each block section by means of a control and monitoring subunit 2, 2', 2'', associated to each block section or track circuit Cdb1, Cdb2 and Cdb3 to generate and receive codes, which subunit executes the procedures to detect the presence of a train T within the associated block, the communication procedures and/or the diagnostic procedures and transmits control signals corresponding to the presence or absence of the train T within the corresponding block and/or to the proper communication established with the train and/or diagnostic signals relating to the track circuit and informs central control and monitoring unit about the results thereof.
  • ASCV Stationary Control Apparatus
  • Each control and monitoring subunit 2 is associated to each corresponding block section and to its respective track circuit Cdb1, Cdb2 and Cdb3, and is connected to the terminal ends thereof by means of a transmitter 3 and a receiver 4.
  • Each subunit 2 and its respective block Cdb1, Cdb2 and Cdb3 associated thereto are uniquely identified by a predetermined ID code.
  • control and monitoring subunit is interposed between the central unit 1 and its respective element Cdb1, Cdb2 and Cdb3, and allows to control the "Track circuit" element, by providing occupied/unoccupied signalling and code transmission and decoding functions.
  • the subunit 2, 2', 2'' is a modular system which may be configured to be used in several different application contexts.
  • This disclosure relates to an application designed for double insulated rail track circuits. In this type of tracks, both rails are mechanically interrupted, and traction power is returned by inductive connections.
  • the control and monitoring subunits 2 are designed for use on two-direction track circuits and, to this end, a signal transmission inversion feature is provided to propagate train detection signals and coded communication signals in the direction opposite to the train running direction.
  • Figure 2 shows a preferred embodiment of a control and monitoring subunit.
  • the module 102 is an extended double Europe board (233x220mm), having "general purpose” features, which includes basic computation and communication resources and interfaces, by means of a parallel bus, with application-specific I/O modules.
  • the Vital Computer Module 102 interfaces with the module 202 for generating and transmitting train detection signals and coded communication signals, with the module 302 for acquiring and recognizing track circuit signals and with a module 402 for interfacing with the rails of the track circuit element and for inverting the signal transmission direction on the track circuit, as well as for track circuit diagnostic protection.
  • the Vital Computer Module 102 supervises the subunit 2, manages the communication with the Stationary Apparatus and controls the other modules 202, 302, 402 which compose the control and monitoring subunit 2.
  • the Vital Computer Module 102 has two main sections:
  • a control section which consists of a microprocessor system, including the required peripherals (program memory, Random Access Memory (RAM), serial interfaces, auxiliary clock and reset signal generating circuits, watchdogs).
  • the control section includes processing software, which is identical for all applications, particularly as regards safety and protection functions, and is specialized by means of application-specific configuration software, wherein the specific system configuration and the desired code selections are accounted for.
  • the control section is also allocated all the functions for communication with the central unit 1 and for managing the interface (VCM_IOBUS) with the other modules in the control and monitoring subunit 2.
  • a vital protection section i.e. a checking and protecting unit which uses hardware blocks and safety code-related software blocks which are independent from the specific system configuration, but form a system for certifying the check codewords or checkwords being generated by the control section based on the feedback transmitted by the modules 202, 302, 402, controlled by said section to the section itself, to control the compatibility with the received control and the proper execution of the controlled function.
  • the checking and protecting unit has the function of ensuring the achievement of a safety state in case of failures in the control section.
  • the operation of the protecting section is independent from the specific application.
  • the safety architecture of the Vital Computer Module 102 is of the reactive type; the protection section has the task of identifying any behavior which might potentially affect the safety of the control section and to force the system into a safety state in a given time.
  • the protection section is designed with inherent fail-safe techniques. Therefore, the Vital Computer Module 102 accomplishes the following functions:
  • the module 202 for generating and transmitting train detection signals and coded communication signals is a power board designed to safely generate the signal to be transmitted to the track circuit. This is a peripheral board with no microprocessor and its function is to generate an output signal to the track circuit in response to the control transmitted by the logic.
  • the module shall safely ensure:
  • the module is divided into two logic sections: the first section is designed to generate a digital Pulse Width modulated, or PWM signal, which is the requested code.
  • the second section is a power amplified Pulse-Width demodulator, or PWM demodulator, which provides the signal to be transmitted to the track.
  • the Pulse Width Modulation PWM code generation section is protected by a Pulse Width Modulated (PWM) signal reread function.
  • PWM Pulse Width Modulated
  • the Vital Computer Module 102 receives the information from the reread function and can compare the code that is actually synthesized by the module 202 with the code required by the control of the central unit 1. If an inconsistency is found, the Vital Computer Module 102 disables code transmission by means of a vital mechanism.
  • the demodulation and power section, cascaded with the generation section is designed with inherent fail-safe techniques.
  • the track circuit signal acquisition and recognition module 302 is designed to receive signals from the track circuit and consists of a double digital signal processing channel and of an input signal decoupling stage, which is designed with inherent fail-safe techniques.
  • the module 302 is a smart card which measures and decodes the signal on the track circuit.
  • the module 302 which is designed to safely measure and decode track circuit signals uses composite safety design techniques and is composed of the following logic blocks:
  • the two Digital Signal Processor (DSP)-based processing channels generate two independent outputs toward the Vital Computer Module 102.
  • the outputs from the two channels are checked for consistency by the control section of the Vital Computer Module 102.
  • the safety architecture of the module 302 involves a continuous check of each measuring channel, by using logically generated test signals to ensure, as is shown in greater detail below, both the protection against common errors, and the detection of failures on the individual channels.
  • the module 402 for interfacing with the rails of the track circuit element and for inverting the direction of signal transmission in the track circuit, as well as for diagnostic protection of the track circuit, accomplishes functions of TX/RX inversion logic, of insulation from/to the yard; measures analog quantities for diagnostic purposes, and manages the interface with the diagnostic system.
  • the module 402 is physically composed of a board and of a Rx and Tx transformer tray, and implements the two following independent logic blocks:
  • the vital functions accomplished by the first block are:
  • the diagnostic functions on yard quantities, accomplished by the second block are:
  • the module 402 must safely accomplish, the function of interfacing with the track and of insulation therefrom and the inversion function.
  • the interface with the track is obtained by means of insulating transformers (which are required to ensure that a 4 KVdc voltage is maintained between the control and monitoring subunit 2 and the track); these transformers are allocated on a different additional rear tray, but belong functionally and logically to this board.
  • the inversion function must ensure that the Tx and the Rx are stably connected to the opposite ends of the track circuit.
  • the safety architecture of this function is of the reactive type, and such as to ensure that the subsystem may be switched to the safety state in case of a failure thereof.
  • the board is controlled by the Vital Computer Module through the VCM_IOBUS, for all vital functions.
  • the architecture also provides a second communication channel, a serial line, between the module 402 and the Vital Computer Module 102, which is used to receive useful data for the diagnostic section, i.e. the transmission direction of the requested signal.
  • the diagnostic functions for yard data are handled by an optional commercial module with an on-board microprocessor, which is designed to manage the diagnostic network. Diagnostic yard data acquisition circuits are made of non vital hardware; diagnostic information only relating to the cab/yard interface are transmitted over the diagnostic network, if present.
  • the control and monitoring subunit is designed with reactive safety techniques. From a functional point of view, the safety of a railroad signaling system/subsystem/equipment consists in the identification of a safe state and in the implementation of design techniques that allow safe state restoration upon occurrence of any potentially dangerous failure. For the control and monitoring subunit 2, when the context of its functions is considered within the signaling system, the "safe" state is deducted as follows:
  • the implementation of a reactive safety architecture with composite safety and inherent fail-safe elements for the main logic is justified.
  • This approach involves a 64-bit coding of Boolean input variables on two parallel processing channels (32 bit codeword for each processing channel, with different coding on the two channels), codeword processing according to a default logic, a recheck of the outputs by a process separated from the main process, and output generation, the latter function being accomplished by using fail-safe hardware.
  • the safety architecture requires that the control process and the protection process are handled by two independent processors. The control process generates checkwords to feed the protection process, implemented on a different processor, which cyclically consumes the checkwords and detects possible control process errors. The intervention of the protection section forces the control and monitoring subunit 2 into the above defined safety state.
  • Advantages may be further obtained from the implementation of a reactive safety architecture to generate a PWM signal representing the code to be transmitted to the track.
  • the generated signal is reread and sent to the main logic which, in case of failure, triggers the protection section.
  • failsafe hw an inherent fail-safe architecture
  • the inversion function may be advantageously handled by a reactive safety architecture with fail-safe hw elements.
  • the inverting relays are controlled in a non vital manner but their status is reread in fail-safe conditions and transmitted to the main logic which triggers the protection section whenever a failure occurs.
  • a safety layer (FSFB2) has been selected to ensure the integrity of the information received and transmitted by the Stationary Apparatus, whereas a system for interconnecting the boards (VCM_OBUS) is used, which may ensure the integrity of the information exchanged between the Vital Computer Module 102 and the other modules 202, 302, 402 inside the control and monitoring subunit 2.
  • VCM_OBUS system for interconnecting the boards
  • the track signal receiving function shall be accomplished by means of a composite safety architecture.
  • the architecture in use includes such failure detection mechanisms as to ensure that a safety state may be restored, in a given time, whenever a failure occurs at one of the two elements.
  • a separation is also recommended between non vital diagnostic functions and vital functions, as well as the transmission of different signals on adjacent track circuits, when no path is provided, to allow the detection of insulation losses at the insulating joints.
  • Fig. 3 shows a block diagram of the Vital Computer Module 102 in greater detail.
  • the Vital Computer Module 102 has been developed with "general purpose" features, to execute control, monitoring and protection procedures.
  • the board has such characteristics that it can be used in several different applications; the application-specific operation is obtained by modifying the management software and to this end the process software is separated from the configuration software which contains all system-specific information.
  • the configuration software which provides the special characteristics of the process software for the specific application is allocated in a dedicated memory area, e.g. a flash memory.
  • the Vital Computer Module 102 is composed of two distinct functional blocks, i.e. the control and monitoring section 120 and the protection section 121 respectively.
  • the control and monitoring section 120 is based on the use of a microprocessor with different peripherals, such as, for instance, serial line controllers, timers, etc.; in the application mentioned herein for the track circuit control and monitoring subunit, this section is designed to handle the basic functions of the track circuit. It periodically performs a processing cycle (named main cycle), whereby it communicates, in a vital manner, with the central control and monitoring unit 1 (wherefrom it receives the code to be generated and the train running direction, and whereto it transmits track circuit status information), and controls the other modules 202, 302, 402 to manage the inversion, the transmission and the reception functions.
  • a processing cycle named main cycle
  • control section 120 periodically performs a recheck of all reactive safety logic blocks (by rereading the inversion block position and the signal generated by the module 202); this check, which is performed in the so-called rechecking cycle, is used to verify the consistency between the control and the detected status.
  • the main cycle is used to perform, every T seconds, all low-priority cyclic operations (e.g. receiving information from the Stationary Apparatus and consequently determining the controls to be transmitted to the module boards).
  • the second cycle, or recheck cycle has a duration of 50 ms and is used to perform all the operations that must be performed more frequently (such as the recheck of the inversion block status and the verification of the generated signal) to allow a faster failure detection.
  • the duration T of the main cycle is an integer multiple of the recheck cycle time and constitutes the time unit of the subsystem.
  • the control and monitoring section transmits a set of checkwords to the protection section, which words are used to verify the proper performance of all safety-related operations.
  • Each of the two cycles generates a set of checkwords, during its respective processing operations, which words are named "main checkwords” and "recheck checkwords” respectively.
  • control and monitoring section 120 may be summarized as follows:
  • the microprocessor-based protection section 121 monitors the behavior of the control section 120 and its own behavior and stops the vital voltage generation whenever a malfunction is detected. It generates, in vital mode, the voltage used for enabling the vital switches, on the module 202, which allow the transmission of the generated signal to the track.
  • the checks performed by the protection section 121 are both logic and time checks; the protection section periodically receives checkwords from the control section 120, which checkwords are used to confirm the proper performance of all safety-related operations, and checks the validity thereof.
  • checkwords are logically correct, they arrive in well defined time ranges and no failure is detected by the self-diagnostic process of the protection section 121, which can supply power to vital switches, otherwise, the self-diagnostic process removes such power supply, and prevents any signal transmission to the track circuit.
  • the safety architecture of the Vital Computer Module 102 is of the reactive type; the protection section 121 has the task of identifying any potential safety jeopardizing behavior and of forcing the system into a safe state in a given time.
  • the protection section 121 ensures that vital voltage be disabled both in case of malfunctioning of the control section 120 and in case of risks identified by the control section 121 on the other modules 202, 302, 403 and in case of failures of the protection section 121 itself.
  • the protection section 121 is designed with inherent fail-safe techniques.
  • Figure 4 is a block diagram of the control and monitoring section 120 of the Vital Computer Module.
  • a CPU 20 is connected to: a RAM memory 21 and a FLASH memory 21', serial line controllers 22, a Polynomial Divider 23, an VCM_IOBUS interface 24, the interface with the protection section 25.
  • the CPU uses a microprocessor, e.g. INTEL i386EX, consisting of a core i386CX and of a wide set of peripherals; the core has a 32-bit internal architecture and a 16-bit external bus.
  • a microprocessor e.g. INTEL i386EX, consisting of a core i386CX and of a wide set of peripherals; the core has a 32-bit internal architecture and a 16-bit external bus.
  • the latter is connected with the appropriate support circuits required for its operation, such as: the Reset generating circuit, Power Down analyzers, several different oscillators to ensure time independency between the various functions (particularly there are provided: a 50 MHz oscillator for the microprocessor, a 20 MHz oscillator dedicated to one of the 3 programmable logics, and a 10 MHz oscillator dedicated to the two asynchronous serial lines), a Watchdog circuit which is triggered whenever a malfunction is detected at the control section 120, thereby disabling the interfaces and generating an interrupt request.
  • the Reset generating circuit such as: the Reset generating circuit, Power Down analyzers, several different oscillators to ensure time independency between the various functions (particularly there are provided: a 50 MHz oscillator for the microprocessor, a 20 MHz oscillator dedicated to one of the 3 programmable logics, and a 10 MHz oscillator dedicated to the two asynchronous serial lines), a Watchdog circuit which is triggered whenever a malfunction is detected
  • the memory consists of two fixed RAM chips 21 with a maximum total capacity of 1Mbytes and two FLASH memory chips 21', with a maximum total capacity of 4 Mbytes.
  • the FLASH memory 21' contains the application-specific management program and system configuration parameters.
  • Three serial line controllers 22 are provided, one being inside the processor and the other two outside it.
  • the controller inside the processor manages two asynchronous channels, which are compatible with the component 16450, whose electric interface is of the RS232 type.
  • the two external controllers are identical, and each of them manages two full-duplex channels, that can be programmed as synchronous and asynchronous. These controllers may be managed, depending on the application needs, in polling, in interrupt and in DMA operation.
  • the electric interface of the two serial lines associated to the first external controller and used for the connection to the FNET network is of the V35 type (the differential data and clock being of the RS485 type); whereas the one associated to the second controller is of the RS232 type.
  • the block 23 consists of a so-called Polynomial divider (PD), which is a processor's peripheral based on a programmable device, and used to validate vital data, to generate CRC polynomials, and to act as a Boolean operator to check the proper sequence of operations.
  • PD Polynomial divider
  • This check generates checkwords which are passed, inside the Vital Computer Module, at given times, from the CPU 20 of the control section 120 to the protection section 121.
  • This function uses a 20 MHz oscillator, to rely on a time base that is independent from the microprocessor time base.
  • the interface VCM_IOBUS 24 is based on a programmable device. The pur pose of this interface is to allow direct management of vital I/O modules or expansion cards with a compatible interface.
  • the interface VCM_IOBUS ensures:
  • the interface with the protection signal is provided by an 8-bit bus, which consists of a subset of the processor bus used to connect the on-board memories and peripherals. Through this bus, the CPU transfers the checkwords of vital operations to the protection section.
  • FIGS. 5 and 6 show the protection section 121 in greater detail.
  • the protection section has the function to monitor the behavior of the control section 120 and its own behavior and is triggered in case of unproper operation, to set the system into safety conditions. This is obtained by generating or not generating a voltage that is known as Vital voltage for enabling the transmission of train detection signals and/or coded communication signals.
  • This section periodically receives checkwords (recheck checkwords every 50 ms and main checkwords every T seconds, with T being an integer multiple of 50 ms) and checks the validity thereof. If checkwords are correct, it supplies power to vital circuits, i.e. generates the vital voltage, othewise it removes such power supply.
  • the protection section includes a vital power supply controller 32 which does not interpret the meaning of received checkwords, but uses them on the basis of their numeric characteristics, by processing them as digital signals. Moreover, the checkwords change from one cycle to the other, since the control section 120 modifies them by an incremental value before transmitting them.
  • Diversity hardware/software safety rules are implemented in the protection section 121 between the controller system and the controlled system (even when inherent fail-safe hardware is used), as well as data structure navigation rules, with a data structure of a well-defined class, with predetermined values, though different for each processing cycle.
  • the protection section is composed of the following three functional blocks, as shown in Figure 5.
  • the block 32 constitutes the checkword processing logic, which is of the digital type and has the function to process the checkwords received from the control section 120, by using the Dual Port RAM 33 and to generate a pair of appropriate frequency signals and duty cycles.
  • the Active Vital Filter block 34 has the purpose of safely checking that the characteristics of the received signals (frequency and duty-cycle) comply with the prescribed characteristics and of enabling Vital Voltage generation provided that no failure has been detected.
  • the filter has inherent fail-safe features that ensure that the enabling signal to the vital generator is only generated if the two input frequencies have the prescribed frequency and duty-cycle characteristics;
  • the Vital Generator block 35 also designed with inherent fail-safe characteristics, has the purpose of physically generating the desired output voltage, if enabled by the frequency signal coming from the Active Vital Filter 34. This voltage may be used as a vital enabling signal, for all hardware and software functions that can only be operative in safety conditions.
  • the Processing Checkword Logic PCL block 31 has the function to vitally check the vital processing operations performed by the Vital Computer Module 102. Checkwords are exchanged with the control section 120 through a Dual Port Memory 33 and by exchanging two handshake digital signals, named flags, and more precisely: a REQUEST flag (REQ) and a READY flag (RDY).
  • REQ REQUEST flag
  • RY READY flag
  • the data structures provided to the Processing checkword logic "feed" the processing operations of the logic component thereof and, when correct, cause the safe generation of two digital signals having precise frequency and duty-cycle and phase relation values (vital frequencies).
  • the final check element consists of an analog filter 34, which is desgned with inherent fail-safe techniques (Active Vital Filter, AVF) and which only produces the frequency for enabling the Vital power generator VG 35 if the digitally generated frequencies are correct in all respects. Therefore, the presence of this enabling signal safely confirms that the digital logic processing operations, resulting from the reception of the proper checkwords inside the data structures, are correct. Any checkword error, or missed reception of checkwords in prescribed times, causes the vital generator to be disabled.
  • VCM Vital Computer Module 102
  • main cycle has a period T, an integer multiple of the recheck cycle, which lasts 50 ms (a time of 50 ms was selected because it allows to detect an error and disable the vital generator 35 in a sufficiently reduced time to avoid subsystem failures).
  • the microprocessor of Processing Checkword Logic 31 processes them, by using a number of software algorythms and hardware rechecking hardware (CRC adding circuit, time check counters/timers), to safely provide the generation of two digital signals to confirm proper system operation.
  • the circuit which manages the reset/watchdog signal of the Processing Checkword Logic ensures proper operation of the Vital Power Controller logic 31; if the management software, for any reason or manfunctioning whatsoever, does not retrigger the Watchdog, a Reset signal is triggered which attempts a restart of the Vital Power Controller.
  • the block diagram of the processing checkword logic 31 is shown in Fig. 6. As shown in the Figure, the latter also uses a microprocessor, which is independent from the one of the control section 120.
  • the microprocessor in use is an 8-bit INTEL 8085 microprocessor, which is itself connected to appropriate support circuits, required for its operation, such as: a Reset generator circuit, a 5 MHz oscillator used as a clock generator, a Watchdog circuit to be rearmed in a predetermined time; if this does not occur (e.g. due to a shutdown of the protection section microprocessor), the watchdog is triggered to generate the CPU reset signal.
  • RAM and EPROM memories 232, 232' RAM and EPROM memories 232, 232', a Dual Port RAM memory 33, a Timer 332, a Cyclic Redundancy Check or CRC circuit 432, an I/O Port 532.
  • the memory is composed of a fixed RAM chip and an EPROM chip 232, 232'.
  • the EPROM memory 232' includes the firmware for safely processing the checkwords which is not application-specific.
  • the Dual Port RAM 33 which is based on a programmable logic, is used to exchange information with the CPU of the control section 120.
  • the checkwords for checking the vital operations are received through this RAM 33.
  • the arbiter which controls the access to the Dual Port RAM, is controlled by the protection section 121 and uses two digital control lines (READY and REQUEST lines). Both the microprocessor (8085) of the protection section 121, which has master functions, and the microprocessor (80386 EX) of the control section 120, which has slave functions, access the Dual Port RAM 121.
  • the CRC circuit 432 performs polynominal division operations on sequences of received data, and generates a result in the form of 16-bit "remainder" of the division; it is used for checkword processing operations and for "runtime" check operations on the EPROM content 232'.
  • the CRC circuit 432 has been provided in hardware form, since it is a particularly difficult function for the microprocessor, if it is provided in software form.
  • the I/O port is used to drive certain digital signals, more precisely: vital frequency signals for the Active Safety Filter 34, a Watchdog rearming signal, REQ and RDY signals for managing the access to the Dual Port RAM 33.
  • the Active Vital Filter block 34 is mostly made of a discrete analog circuitry, and has been designed with inherent fail-safe rules. It has the purpose of safely detecting the simultaneous presence of signals having well-defined characteristics. If the above signals comply with the prescribed characteristics (frequency and duty cycle) , it triggers the Vital Voltage generation enabling signal (OK_PWM).
  • the active filter If the two signals are transmitted in correct form, and in proper manners and times, the active filter generates the following output signals:
  • the Vital Generator block VG is itself made of a discrete analog circuitry, and has been designed with inherent fail-safe rules. This block has the purpose of physically generating the Vital output voltage (+12Vdc @1.5W), if it is enabled by the Active Vital Filter 34, from the continuous voltage of 24Vdc1. This voltage, if present, enables the generation of the code to be transmitted to the track by the train detection signal and/or the coded communication signal generator.
  • Block interfacing signals Communication bus Identifies the address bus, the data bus and the 8085-specific control signals RDY Advises the PLC of the end of checkword transfer from the control section REQ Advises the control section of the availability to receive new checkwords into the Dual Port RAM.
  • F1 (PCL ⁇ AVF) Fixed frequency signal (500 Hz 50%) transmitted to the AVF block for the following test phase
  • F2 PCL ⁇ AVF
  • Fixed frequency signal (5 KHz 25% on) transmitted to the AVF block for the following test phase ENABLE (AVF ⁇ PCL) Operational status of the AVF module, read by the PCL, and duplicated on the LED OUT_F (AVF ⁇ VG)
  • Enabled Vital voltage generation OK_PWM (5 KHz 25% off) OK_PWM (VG ⁇ PINV) Vital voltage OK_PWM used to enable signal transmission to the CdB on the PINV board.
  • Output signals Min. Typ. Max. Unit OK_PWM - 12 - V
  • FIG. 7 is a block diagram of the train detection signal and or coded communication signal generating module 202.
  • This module has the function of safely generating the signal to be transmitted to the track in response to the control given by the Vital Computer Module 102. Its structure may be used in various contexts in which signals having different characteristics must be generated. The board is specialized for the different application contexts by using different configurations of programmable logic devices.
  • the module 202 is composed of the following three logical sections:
  • This section is formed by two different blocks; the former is a digital synthesizer 140 which provides two logical output signals, corresponding to the PWM modulation of the signal required by the Vital Computer Module 102.
  • the two generated signals are different, so as to directly drive, downstream from the vital switches 41, the bridge 143 (Figs. 8 and 9) and to improve the capability of identifying any malfunctioning of the checker block 240.
  • the second checker block 240 itself consisting of two similar functional sections, has the function of checking the two PWM output signals of the vital switches 41.
  • Each section dynamically provides the Vital Computer Module 102, at each check cycle, with a checkword which is a function both of the signal sampled in that cycle and of a starting word, the so-called precondition, received by the Vital Computer Module 102.
  • the safety architecture is of the reactive type: if there is an inconsistency between control information and the reread checkwords, the protection section 121 of the Vital Computer Module sets the system to a safe state, thereby disabling the transmission of a signal to the track, through the Vital Switches (see below).
  • the Vital Switch block 41 is formed by two replicated circuits and transfers the signals from the generator and checker section 40 to the power amplifier section 43, provided that the "Vital voltage" generated by the protection section 121 of the Vital Computer Module 102 is present.
  • the Vital Computer Module 102 only generates such voltage if checkwords are consistent with the requested signal and all other safety conditions of the system have been checked.
  • the safety architecture of the switches is of the inherent fail-safe type.
  • the power amplifier 43 demodulates the PWM signals and amplifies them to a sufficient extent for transmission thereof to the track.
  • Said amplifier is of the inherent fail-safe type, and prevents any degradation of the signal transmitted to the track toward more permissive conditions.
  • the train detection signal and coded communication signal generation module 202 receives and transmits information and/or controls by using the interface parallel bus (VCM_IOBUS).
  • VCM_IOBUS interface parallel bus
  • Signal transmission enabling is a discrete signal (OK_PWM) which corresponds to the "vital voltage" safely handled by the protection section 121 of the Vital Computer Module 102.
  • the control of the code to be generated, as received by the Vital Computer Module 102, through VCM_IOBUS is acquired by the generator programmable logic-based section 140.
  • the generator section 140 synthesizes two logical signals PWM1 and POWM2 corresponding to the generation control required by the Vital Computer Module 102.
  • the modulation technique PWM reports signal amplitude information for the signal to be generated during the ON periods (logical 1) and OFF (logical 0) of the corresponding PWM signal.
  • the two signals normally negate each other.
  • the enabling function is on, i.e. the vital voltage generated by the protection section 121 of the Vital Computer Module 102 is present, the two signals PWM1 and PWM2 are transmitted to the power amplifier 43 for generating the signal to be transmitted to the track.
  • the checker section 240 consists of a programmable logic and manages two independent "checker” sections inside it, which validate PWM1_F and PWM2_F signals respectively (which, as shown in Fig. 7, are the signals PWM1 and PWM2 downstream from vital switches).
  • the generator and checker sections 140, 240 are totally independent, and use two separate programmable logics and time bases (generated by different clocks).
  • the checker section allows the control logic of the Vital Computer Module 102 to validate the signals transmitted to the power amplifier 43, i.e. allows it to check the control pulse sequences generated by the generator section 140 and transferred to the power stage throgh vital switches 41.
  • each checker At each control cycle, each checker generates a recheck word toward the Vital Computer Module 102, which is a function of:
  • the dynamic operation and diversity of the output words issued by each checker is ensured by the variability of the word preloaded from the Vital Computer Module 102, which is different depending on the checker and cycle, whereby, even when a constant PWM signal is present at the input of each checker, different recheck words are generated.
  • control sent by the generator section 140 and the recheck word preloading and reading functions of each checker are under strict time control by the Vital Computer Module 102, whereby the correctness of the PWM sequence, input to the amplification stage 43 is ensured both by the correctness of checkwords and by the time between two successive read operations.
  • the Vital Computer Module can force the system to a safe state, by disabling the generation of signals to be transmitted to the track, through vital switches 41.
  • the Vital Computer Module 102 only generates the enabling vital voltage if checkwords are consistent with the requested signal and all other safety conditions of the system have been checked.
  • the data interface between the Vital Computer Module 102 and the signal generating module 202 is protected by scrambling vital data to ensure a safe behavior even when module routing errors on VCM_IOBUS occur.
  • the two digital signals PWM1 and PWM2, generated by the generator section 140 are connected to the power amplifier through Vital switches 41, which use optoisolators to ensure galvanic insulation between the two sections.
  • each Vital Switch 41 when enabled, is designed to pass PWM control pulses toward the drivers of the power stage; vice versa, when a malfunction is detected, it is disabled and in this case it is designed to cancel any output control signal.
  • each switch is provided in such a manner as to be:
  • each Vital Switch 41 is continuously, independently and autonomously rechecked by the corresponding certification section, to verify the correctness thereof. Therefore, any failure, though temporary and only on one of the two switches, involving a change of the signal output from the Vital Switch, is recognized by the Vital computing module 102, which disables both switches, thereby sending a "no signal to the track" control to the power amplifier 43.
  • the enabling control is shared by the two switches and is issued by the protection section 121 of the Vital Computer Module 102 (Vital voltage - OK_PWM). Said control is only vitally generated when all safety conditions of the system have been checked. Any failure of the vital switch, in the "enabled switch” state, does not constitute risk factors because any problem occurring during this operational state is detected by the feedback recheck system (the protection section 121 of the Vital Computer Module 102, which supervises the safe operation of the subsystem, may disable the Vital Switches).
  • the switches are made in such a manner as to ensure that an "open switch” condition does not cause short-circuit failures, or failures resulting in an output signal.
  • Both Vital Switches are based on the same inherent fail-safe circuit as the Vital input modules, so that the same basic safety compliance rules may be used.
  • the power amplifier block 43 is used to demodulate and amplify the logical PWM signals to safely generate the power signal to be transmitted to track and is designed with inherent fail-safe design techniques.
  • the power amplifier whose block diagram is shown in figure 8, is composed of: an H bridge 143, an AC/DC converter 243, a driver logic 343, an output LC filter 443.
  • the power section of the power amplifier consists of the H bridge 143, which is supplied with direct current and is driven by the signals output from the driver logic 343.
  • This block is composed of 4 power switches which are arranged to form an H (see Fig. 9), two of them being named Top switches (A and C) and two being named Bottom switches (B and D).
  • the four switches are driven by the check signals obtained from the two inputs PWM1_F and PWM2_F issued by the vital switches.
  • the PWM1_F signal to the logical 1 enables the closing of switch A , whereas to the logical 0 it enables the switch B; the PWM2_F signal has the same operation on the other pair of switches.
  • the PWM1_F and PWM2_F are complementary, a voltage applied to the load is obtained having a positive, negative or null polarity depending on the corresponding duty-cycle.
  • the AC/DC converter 343 is used to generate, from the 220 VAC input, the DC voltage required to power the H bridge 143. Also, it is used to generate the insulated auxiliary supply voltages required by the "Driver logic" block 343.
  • the "Driver logic” block 343 is designed to adapt and filter the digital PWM signals, issued by the Vital switches 41, to directly generate the signals for driving the power switches of the H bridge.
  • Each switch driving signal has the following characteristics: logical signal conditioning to adapt the voltage and/or current levels to the values required by the power switch; galvanic separation of the control signals issued by the vital switches, by means of an optoisolated circuit; independent supply stage, different from the supply of the H bridge 143; non-deformation of the PWM information to be transferred; noise immunity; no self-pulsing which might affect the inherent safety of the power amplifier.
  • the four driver circuits which are comprehensively considered in the bridge-like switching network, have the following characteristics: the 4 drivers only use two logical control signals; the TOP and BOTTOM switches of the H bridge may be switched on simultaneously, to obtain a null voltage on the load; the power switches may be controlled in columns complementarily to prevent the bridge power supply from being short-circuited; the time required to open a switch prior to closing the other switch of the same column is met (to avoid the problem mentioned in the previous item); the driver power supplies are separate, to prevent the load or the switches from being short-circuited by common terminals: particularly, three separate power supplies are used, one for BOTTOM switches, and one for each TOP switch.
  • the output LC filter is designed to remove the high-frequency component of the PWM (25 KHz), including the components of the power block switching frequency, and to allow the passage of the useful Low Frequency band of the PWM signal spectrum, which contains the desired harmonic components.
  • Fig. 10 is a block diagram of the track interfacing module 402, also named protection, inversion and diagnostic module.
  • This module accomplishes the following functions: protection and insulation at 4 KV/5 min from the track; inversion of the signal transmission direction over the track; in order to ensure that coded information is transmitted to the train, the signal propagation direction must be opposite to the train running direction; acquisition and transmission of diagnostic information toward the Stationary Apparatus.
  • module 402 which is composed of a circuit board and of a transmit/receive transformer tray.
  • the board included in the interfacing module 402 may be logically divided into two functional areas:
  • the second area dedicated to diagnostics, includes the circuits 52 for measuring some electric quantities of diagnostic interest, such as voltages and currents on the field cables and measuring cable insulation. Again, this area is required to have protection functions, since it must provide galvanic insulation between the diagnostic signals and the rest of the control and monitoring subunits 2.
  • the Tx/Rx TRANSF tray is connected between the inversion function and the transmission logic boards of the train detection signal and coded communication signal generation module 202, the track circuit signal acquisition and recognition module 302.
  • the Tx/Rx TRANSF tray accomplishes the following functions:
  • the tray contains the following components: a transmit transformer TA, having a primary and secondary winding with variable taps; a receive transformer TR, having a primary and two secondary windings TR1 and TR2 (TR1 is used for the receive function, whereas TR2 is used for diagnostic purposes); a printed circuit board, whereon the connector for the control taps of the TA transformer and an LRC filter designed to protect the track circuit signal acquisition and recognition module 302 are mounted, connected in series between the tap TR1 of the TR insulating transformer and the input of said module 302.
  • the TA transformer is controlled as a function of the distance between the cab and the track; additional control may be effected on terminal boxes, mainly relating to the length of the track circuit.
  • circuit portion of the module 402 The most significant functions of the circuit portion of the module 402 are:
  • the inversion block 50 shall ensure that the left (Sx) and right (Dx) signals are stably connected to the opposite ends of the track circuit and that they can be inverted as a function of the train running direction on the line.
  • the transmission direction of the coded signal to be sent to the track shall be always opposite to the train running direction.
  • the circuit which performs the inversion is not deemed vital, whereas the function of rechecking the actual position of the switch is considered vital.
  • the inversion function since the removal of the transmission signal from the track is ensured by switching the transmitter off, the inversion function shall not necessarily safely ensure the disconnection from the track circuit.
  • the inversion block 50 which is directly connected to the track circuit, provides the required insulation at 4 KVdc between the subsystem and the track.
  • the selection control, as well as the function of rereading the position of the inversion block 50 are handled by the Vital Computer Module 102, through the parallel bus VCM_IOBUS.
  • the inversion function is based on the use of a pair of relays, named ddx and dsx which, when appropriately controlled, connect the transmitter to an end of the CdB and the receiver to the opposite end.
  • the relay switching function is always performed when no transmission signal is present; this allows to ensure the required function reliability; also, if the above operational conditions are considered, no particular surface treatments are required on relay contacts.
  • the control is coded by a programmable logic which may be accessed through the VCM_IOBUS, which generates the signals for driving the two relays. Since this architecture requires an excited relay and a non-excited relay in order that the transmitter may be connected to one end and the receiver to the other end, or vice versa, the only admitted combinations of the driving signals are ON/OFF and OFF/ON. The undesired condition of both excited or non excited relays is recognized by the reread function, which forces the subsystem to a safe state.
  • Figure 13a shows the connection scheme between the two relays and the contact status for the left (sx) train running direction, whereas Figure 13b is applicable for the opposite direction.
  • Each relay includes: 4 contacts, used for the actual inversion function; 2 contacts, used for detecting the position of the relays; 1 contact used for diagnostic functions.
  • the two relays selected for this function are printed circuit board safety relays, whose main characteristics are: Forced guide contacts, i.e. mechanically connected in such a manner that quiescent closed contacts and quiescent open contacts cannot be closed simultaneously; even when a failure occurs (i.e. a contact is stuck), a minimum opening distance is ensured for antithetic contacts; contact/contact and contact/coil 4Kdc insulation (which characteristic is required to ensure the necessary insulation between the subsystem and the track); no exchange contacts are provided, but only normally closed (NC) or normally open (NA) contacts, which are switched to the opposite state when the relay is triggered; 3 NC contacts and 4 NA contacts.
  • NC normally closed
  • NA normally open
  • the reread function is handled by the Vital Computer Module 102 which dynamically circulates two words through two parallel circuits, i.e. MODULE0 and MODULE1 ( Figure 13)
  • Each reread circuit uses a NA contact of a relay and a NC contact of the other relay, connected in series; since the two relays are controlled exclusively, one circuit has both closed contacts, whereas the other circuit has both open contacts (as shown by Fig. 13 for the "sx" case).
  • the words to be recirculated drive the DRIVE0 and DRIVE1 signals
  • the reread reckeck words use the SENSE0 and SENSE1 signals
  • the SENSE signal is the logical negation of the corresponding DRIVE signal, provided that both contacts are closed (which condition may be only met for one of the two reread circuits). If no reread or an incorrect reread is performed either by the circuit enabled for word recirculation (both contacts should be closed) or by the circuit that should be disabled (both contacts should be open), this is interpreted as an inversion block malfunction.
  • the vital circuit for rereading the state of the inversion block 50 is designed in such a manner that any component failure or power supply loss prevents the checkword from being read: the correctness of the checkword depends on the proper reception of the checkword by the hardware (scrambling, signature)
  • the data interface between the Vital Computer Module 102 and the protection, inversion and diagnostic module 402 is protected by common signature and scrambling techniques.
  • the safety architecture of this function is of the reactive type, and such as to ensure that the subsystem may be switched to the safety state in case of a failure thereof.
  • the diagnostic functions for the yard data are implemented on non vital hardware and are handled by a commercial module with an on-board microprocessor, which is connected to the system diagnostic network.
  • the commercial module named Echelon, is a "general purpose" module, which manages 10 discrete I/O channels; by using an external A/D converter, it can acquire 8 additional analog channels.
  • the microprocessor module includes a second serial RS232 interface, which is connected to the Vital Computer Module 102 and is used to receive the information required to check the yard signals, such as the signal transmission direction over the track circuit.
  • the above module is optional and is only provided when a diagnostic network is available, e.g. of the Echelon type, whereto diagnostic information about the cab/yard interface are only transmitted.
  • the diagnostic module is used to acquire the following quantities:
  • All the circuits required for signal acquisition and conditioning are powered by a self-contained power supply and insulated at 4KV DC from the track.
  • the structure of the diagnostic module is as shown in Figure 14.
  • FIGS 15 to 21 show several details of the track circuit signal acquisition and recognition module.
  • This module is designed as a safety track circuit signal receiver operating in the 40 Hz-1kHz band, and is used to recognize the coded signals provided by the n-code block system and the "fixed frequency" signals used when no code is provided.
  • the safety architecture of the APRX module includes two acquisition and conditioning channels 60, 61, which are decoupled by an input stage 62.
  • the latter is designed with inherent fail-safe techniques, ensuring that the output signals acquired by the two channels cannot degrade to more permissive conditions due to a failure.
  • Each channel 60, 61 based on a Digital Signal Processor DSP, uses dedicated hardware and includes, as Fig. 16 shows in detail, self-standing test functions, which operate continuously and independently from the track circuit state.
  • Failure detection for each channel is performed by measuring the locally generated test signals; there are particularly provided: a signal for checking the proper amplitude of the input signal; a signal for checking the proper frequency of the input signal; a monitor for all internal supply and reference voltages.
  • the board is composed of the following functional blocks: a power supply block 63, which provides all internal power supplies and reference voltages required by the two channels of the module 302, an input signal circuit 64, which is designed with inherent fail-safe techniques and distributes the receive signal to the two channels 60, 61 and allows to add the amplitude test signal to the input signal; the channel A 60 and the channel B 61 which are made of replicated hardware.
  • the two channels operate independently, i.e. acquire the track signal and transmit the code/fixed frequency information detected on the track to the Vital Computer Module 102 through a Dual Port Memory 70.
  • Each processing channel 60, 61 is in turn composed of the following functional blocks: a logic 160, 161, having the following functions: measuring the track circuit signal; measuring the test signals and the internal reference signals; demodulating the signal and recognizing codes; coding and transferring the information to the Vital Computer Module 102; a test logic 260, 261, which provides the test, amplitude and frequency signals that are used to check the integrity of the measuring channel.
  • Each channel uses a Dual Port RAM 70 to exchange information with the Vital Computer Module 102, through the VCM_IOBUS interface.
  • Said data interface between the Vital Computer Module 102 and the track circuit signal acquisition and recognition module 302 is protected by scrambling vital data to ensure a safe behavior even when module routing errors to VCM_IOBUS occur.
  • the track circuit signal recognition algorithm used by each of the two channels 60, 61 generates an internal "present/absent signal" word; these words that are predetermined for each code/fixed frequency signal and different for the two channels 60, 61 are initialized at the start of each cycle with "absent" code/fixed frequency.
  • Each channel 60, 62 samples the track circuit signal at slightly different sampling frequencies, i.e. differing by about 16 KHz. Then, the sampled signal is digitally filtered and analyzed by two parallel processes which discriminate it as a code or fixed frequency signal, and more precisely: Code recognition: the filtered signal is demodulated, thereby obtaining the square wave which constitutes the code modulating signal.
  • the recognition of a particolar code changes the word corresponding to the recognized code from absent to present;
  • Fixed frequency signal recognition the recognition of the fixed frequency signal is obtained by comparing the phase of the acquired signal with an internal 50Hz reference signal.
  • the recognition of a particular fixed frequency signal is obtained by analyzing the above phase difference in the time domain (phase/counterphase and transition times); the word corresponding to the recognized fixed frequency signal is changed from absent to present.
  • Each of the above internal words, associated to any code or fixed frequency signal, are further changed and made available to the Vital Computing Module VCM 102 in the Dual Port memory 70, by a process that uses a word, named "Time Stamp", preloaded from the Vital Computing Module 102 at every cycle and varying from one cycle to the other; the previously determined detected/absent code/fixed frequency word; the proper measure of all test and reference signals.
  • the dynamic operation and diversity of the output words issued by each channel is ensured by the variability of the "Time Stamp" preloaded from the Vital Computing Module 102, and varying from one cycle to the other, and by the different code/fixed frequency coding performed by the two channels 60, 61, whereby even when the same signal is detected at the input of the two channels, different status words are generated.
  • VCM_IOBUS 41 Parallel bus for communicating vital information to the VCM Rx Input 2 Insulated track signal receiving line from MPD/CC +5V System supply generated by the switching power supply 24Vdc2 2 Self-contained power supply generated by the PAL.
  • the Power supply block 63 and the Input Signal Circuit block 62 are common to both channels; a description will be provided below for both common blocks, whereas only one of the two processing channels, which are functionally identical, will be described.
  • Figure 17 schematically shows the functional block for generating internal power supplies. This block has the following inputs:
  • the generated voltages are summarized in the following table: Generated power supplies Description Power supplies for the logic of the two channels A/B Generated by a voltage of +5V by means of a voltage reguator (3.3/1.8) for the operation of the logic of the two channels.
  • Ref. Test1 signal gen Channels A/B Voltage generated by the 5V voltage as a reference for the test1 signal. Power supply for the +5V logic of channels A/B Power supply voltage of +5V for the two channels. Reference for measuring channels A/B Voltage generated by the 24VdC2 voltage as a reference for measuring the channels.
  • Supp. Test2 signal gen Channels A/B Power supply voltage generated by the 24VDC2 voltage for the test2 signal generator.
  • the above functional block 63 meets the following safety rules:
  • Fig. 18 shows the block diagram of the input circuit 62 for the track circuit signal, which is composed of the following functions: bridge adder 162, antialiasing filters 262.
  • the signal input stage 62 includes a bridge adder 162 which accomplishes the double function of distributing the track circuit signal to the two measuring channels 60, 61 and of adding the amplitude test signal of each channel to the track signal.
  • the input signal circuit is designed in an "inherent fail-safe" manner, to safely ensure that the ratio between the block output voltage and the input voltage does not increase, due to failures, without being detected through test signal measurement.
  • This block uses a transformer having two secondary windings for signal distribution. Test signals are injected by creating a bridge which is balanced between a center tap of the secondary winding and the signal measuring point.
  • the components of the measuring bridges shall have such a technology as to ensure that no voltage increase can be expected on the measuring point due to failures.
  • test signal By choosing to use a test signal to check the signal measuring amplitude ensures the detection of failures downstream from the test signal injection point (for this reason, said injection point shall be situated at the uppermost point); all circuits upstream from the amplitude test signal injection point shall be designed with inherent fail-safe rules.
  • a low-pass, antialiasing filter is provided for each processing channel 60, 61.
  • the filter has such a cutoff frequency as to ensure that the module 302 has an input band of 1 KHz.
  • the logic functional block 160, 161, as shown in Fig. 21, accomplishes the following functions:
  • the logic functional block is composed of the following three physical blocks:
  • the acquisition block 80 is composed of an ADC device having eight input channels, that are used as follows:
  • the ADC devices provide a digital output corresponding to the input voltage upon sampling; this output value depends on the reference voltage provided to the device.
  • the architecture of the measuring channel which uses the above test signals, allows to detect and appropriately handle any measuring errors.
  • Each channel 60, 61 is equipped with a DSP microprocessor; such microprocessors are specifically designed to perform sequential multiplication and addition operations to determine digital filters.
  • the DSP processor which executes the application software, is designed to filter and demodulate the signals and recognize the codes thereof. Also, this block includes the auxiliary circuits required for DSP operation, more precisely:
  • An interface with the Vital Computer Module 102 This interface is provided by a Dual Port memory. Any simultaneous access to the memory by the Vital Computer Module 102 and the track circuit signal acquisition and recognition module 302, i.e. the VCM and the APRX is managed by dedicated logic circuits. Both the Dual Port Memory and the relevant logic circuits consist of programmable hardware. The protection against any failure of the Dual Port memory function, such as data freezing, wrong routing or wrong access arbitration is provided by software remedies.
  • each processing channel 60, 61 two different routing areas are provided, designed for vital and non vital information exchange respectively.
  • the data provided by the module 302 are changed by the mechanical scramble of bus data, which is physically performed on the mother board. Scrambling is performed in a different manner for each mother board position; this technique allows to differentiate the outputs generated by each module. This provides a protection against any routing errors for the modules on the VCM_IOBUS. Accesses to non vital areas are not differentiated by scrambling; this simplifies the management of non vital data inside the Vital Computing Module, thereby avoiding any decoding as a function of the routed module.
  • test logic module 260 As shown in Figure 21, generates two test signals, i.e.:
  • the generation of the Test1 signal provides a signal whose amplitude may be set by the logic; the logic cyclically changes the amplitude of the test signal so as to ensure the function vitality.
  • the reference voltage used for generating the signal Test1 and that used for measuring the track signal are independent and generated by self-contained power supplies. This condition is provided by the "Power supply" block, which generates the measuring reference voltage from the external voltage of 24Vdc2 and the reference for generating the test signal from the external voltage of +5V. This technique ensures that each channel can independently detect such changes of any power supply voltages as to alter the reference voltage values.
  • the Test2 signal has the purpose of providing the logic function with a time base-unrelated frequency reference.
  • the safety architecture of the module includes, for this function, a dedicated oscillator whose supply voltage is independent from the logic powering voltage (the voltage of +5Vb, as illustrated in Fig. 22, is generatad by the "Power supply” block, from a voltage of 24VDC2, whereas the logic supply derives from the +5V voltage).
  • Fig. 22 shows a particular configuration of the system, wherein fixed current signals are used for train detection, as well as a four code train communication signal coding.
  • a train is detected by injecting a fixed current signal in each track circuit, i.e. a signal having a fixed current level once it is decoded.
  • the signal transmitted by the transmitter to the track circuit toward the receiver in a direction opposite to the train running direction is received if no train is detected.
  • the rails are short-circuited by the train itself, and the receiver is not reached by any signal.
  • control and monitoring subunit 2 may be appropriately programmed by the appropriate system-specific configuration program, which cooperates with the processing program, independent from the system-specific structure, for the ITALIA 4 code Automatic Block application, and can handle (transmit/receive/recognize) the following signals:
  • the track circuit is coded by interrupting a carrier frequency a predetermined number of times per minute (amplitude modulation).
  • This application uses four code types. These types are obtained by using a 50 HZ carrier interrupted 75, 120, 180 or 270 times a minute (the corresponding code is indicated by the number of interruptions per minute).
  • the characteristics of the Fixed Current (CF) train detecting signal must ensure the maintenance of safety conditions even when insulation losses occur at the joints between adjacent track circuits.
  • the architecture of the control and monitoring subunit 2 according to the invention allows to provide a transmitter for each track circuit connected by the network with the central control and monitoring unit 1.
  • the carriers that are used by transmitters are produced locally, hence with no phase relation with each other. No assumption can be made regarding the phase difference between two adjacent track circuits.
  • a modulation shall be introduced in the CF signal, which is different between adjacent track circuits and is adapted to ensure safety conditions even when power is transferred from a track circuit and the following one.
  • the arrangement implemented herein includes the use of different CF signals (4 sets) to be appropriately allocated to track circuits so as to ensure that said signal is not present on adjacent track circuits.
  • the signal is composed of a 50 Hz carrier alternately transmitted in phase and in phase opposition with respect to a hypothetical 50 Hz reference.
  • the sets are differentiated by the time intervals between two successive phase steps.
  • Opposed sections are connected by 5 55.55 Hz signal periods, to ensure a progressive transition.
  • This arrangement provides, at the output of a 50Hz tuned pass band filter, a constant amplitude signal, which ensures occupancy detection anytime.
  • Signal frequencies are selected based on the following rules:
  • the section T2 has a duration of 90 ms (5 f2 periods), which value allows to reach a phase shift of 180°.
  • a nine code coding may be used.
  • the above mentioned PWM coded signal may be added or superposed to an additional signal derived by an identical PWM modulation of a carrier having a different frequency, i.e. a carrier of 100 to 200 Hz, particularly of 178 Hz.

Claims (22)

  1. System zur Gleisfreimeldung einer Eisenbahnstrecke, oder ähnliches, und zur digitalen Kommunikation mit Zügen auf dieser Strecke, wobei
    a) das Gleis, das die Eisenbahnstrecke formt, in eine Vielzahl von aufeinanderfolgenden, galvanisch isolierten Gleissegmenten unterteilt ist, die eine bestimmte Länge haben, die sogenannten Blöcke, wobei die Schienen jedes isolierten Gleissegments einen Gleisstromkreis (cdB, cdB1, cdB2, cdB3) bilden, um das Vorhandensein eines Zuges in diesem isolierten Gleissegment zu erkennen, um mit einem Zug innerhalb dieses isolierten Gleissegmentes zu kommunizieren und/oder um Diagnosedaten über den Zustand dieses isolierten Gleissegments zu erkennen;
    b) eine zentrale Steuer- und Überwachungseinheit (1) vorgesehen ist, die Steuersignale erzeugt und sendet, um Zugerkennungsprozeduren und/oder Zugkommunikationsprozeduren in Bezug auf einen Zug auf diesem isolierten Gleissegment auszuführen und/oder Diagnoseprozeduren auszuführen;
    c) diese zentrale Steuer- und Überwachungseinheit (1) durch eine Steuer- und Überwachungsuntereinheit (2, 2', 2"), die jedem isolierten Gleissegment oder Gleisstromkreis (cdB, cdB1, cdB2, cdB3) zugehörig ist, mit dem Gleisstromkreis (cdB, cdB1, cdB2, cdB3) jedes isolierten Gleissegments kommuniziert, um Codes zu erzeugen und zu empfangen, und diese Steuer- und Überwachungsuntereinheit (2, 2', 2") die Prozeduren zum Erkennen des Vorhandenseins eines Zugs (T) im zugehörigen isolierten Gleissegment, die Kommunikationsprozeduren und/oder die Diagnoseprozeduren ausführt und dem Vorhandensein oder der Abwesenheit des Zugs im entsprechenden isolierten Gleissegment und/oder der geeigneten Kommunikation, die mit dem Zug hergestellt wird, und/oder Diagnosesignalen in Bezug auf den Gleisstromkreis (cdB, cdB1, cdB2, cdB3) entsprechend Steuersignale sendet, und die zentrale Steuer- und Überwachungseinheit (1) über deren Ergebnisse informiert;
    d) jede Steuer- und Überwachungsuntereinheit (2, 2', 2"), die jedem entsprechenden isolierten Gleissegment zugehörig ist, durch einen Sender und einen Empfänger (3, 4) mit seinen Enden verbunden ist;
    e) und jede Steuer- und Überwachungsuntereinheit (2, 2', 2") und ihr zugehöriges isoliertes Gleissegment durch einen bestimmten Identifikationscode (ID) auf einmalige Weise identifiziert sind;
       dadurch gekennzeichnet, dass jede Steuer- und Überwachungsuntereinheit (2, 2', 2"), die diese Codes erzeugt und empfängt, umfasst
    f) eine reaktive Sicherheitsarchitektur, mit welcher diese Untereinheit ausgestattet ist;
    g) ein mikroprozessorbasiertes Vital-Computer-Modul (102), das die Programme zur Verwaltung und Steuerung von Peripheriemodulen zum Erzeugen und Senden von Zugerkennungssignalen und codierten Kommunikationssignalen enthält, um Signale vom Gleisstromkreis (cdB, cdB1, cdB2, cdB3) des entsprechenden isolierten Gleissegments zu empfangen, um zu kommunizieren, d.h. die Steuerungen von der zentralen Steuer- und Überwachungseinheit (1) zu empfangen und zu interpretieren, und um die Zugerkennungs- und Kommunikationsinformation zu senden, sowie um die Kommunikation und die zeitgesteuerte Auslösung von Peripheriemodulen zu verwalten;
    h) ein Modul (202) zum Erzeugen von Zugerkennungssignalen und codierten Kommunikationssignalen, das vom Vital-Computer-Modul (1) gesteuert wird;
    i) ein Modul (302) zum Erfassen und Erkennen der Zugerkennungssignale und codierten Kommunikationssignale vom Gleisstromkreis (cdB, cdB1, cdB2, cdB3), die relevante Signale für das entsprechende isolierte Gleissegment sind, das vom Vital-Computer-Modul (102) gesteuert wird und ihm diese Signale zuführt, die vom Gleisstromkreis des entsprechenden isolierten Gleissegments empfangen werden;
    j) ein Modul (402), um den Ausgang des Moduls (202) zum Erzeugen des Zugerkennungssignals und/oder des codierten Kommunikationssignals an der Schnittstelle mit dem isolierten Gleissegment zu verbinden, und um den Eingang des Moduls (302) zum Erfassen und Erkennen der Zugerkennungssignale und der codierten Kommunikationssignale vom Gleisstromkreis (cdB, cdB1, cdB2, cdB3) an der Schnittstelle mit dem isolierten Gleissegment zu verbinden, wobei dieses Modul (402) vom Vital-Computer-Modul (102) so gesteuert wird, dass die zwei Sender und Empfänger (3, 4), die das isolierte Gleissegment an der Schnittstelle verbinden und an den Enden des entsprechenden isolierten Gleissegments auf dem Gleis angeordnet sind, abwechselnd mit dem Ausgang des Moduls (202) zum Erzeugen des Zugerkennungssignals und/oder codierten Kommunikationssignals und mit dem Eingang des Moduls (302) zum Erfassen und Erkennen der Zugerkennungssignale und der codierten Kommunikationssignale verbunden werden;
    k) das Vital-Computer-Modul (102) einen Steuer- und Überwachungsabschnitt (120) einschließt, der Codes erzeugt, um die korrekte Ausführung der Erzeugung des Zugerkennungssignals und/oder des codierten Kommunikationssignals und der Empfangs- und Interpretationsvorgänge des Zugerkennungssignals und/oder codierten Kommunikationssignals vom Gleisstromkreis zu prüfen, diese Prüfcodes einer Schutzkontrolleinheit (121) zugeführt werden, die sie auf ihre Korrektheit hin prüft, und einen Abschnitt (35) aufweist, um die vitalen Vorgänge der Steuer- und Überwachungsuntereinheit (2, 2', 2") zum Erzeugen und Empfangen von Codes zu deaktivieren, und um einen eingeschränkten Zustand des Systems zu erzwingen, z.B. einen Gleisbesetzungszustand, wenn ein ungültiger Prüfcode erkannt wird.
  2. System nach Anspruch 1, dadurch gekennzeichnet, dass der Steuer- und Überwachungsabschnitt (120) und die Schutzkontrolleinheit (121) verschiedene Mikroprozessoren aufweisen.
  3. System nach Anspruch 1 oder 2, dadurch gekennzeichnet, dass der Steuer- und Überwachungsabschnitt (120) und die Schutzkontrolleinheit (121) konfigurationsunabhängige Verarbeitungssoftware (21, 232') enthalten, sowie Konfigurationssoftware (21', 232), welche die Datenbank ausmacht, um die Verarbeitungssoftware der Systemkonfiguration gemäß auszuführen.
  4. System nach einem oder mehreren der Ansprüche 1 bis 3, dadurch gekennzeichnet, dass das Modul (202) zum Erzeugen des Zugerkennungssignals und/oder codierten Kommunikationssignals einen Generator (140) eines Paars PWM-Signale umfasst, die verwendet werden, um mit Hilfe eines Leistungsverstärkers/Demodulators (43) das Zugerkennungssignal und/oder die codierten Kommunikationssignale zu erzeugen, wobei dieses Paar PWM-Signale dem Leistungsverstärker/Demodulator durch einen Schalter (41) zugeführt wird, der von der Schutzkontrolleinheit (121) gesteuert wird, nachdem die Korrektheit dieses Signalpaars bestätigt wurde, das durch Pulsweitenmodulation erhalten wird, die vom Vital-Computer-Modul (102) durchgeführt wird, das dieses Paar PWM-Signale empfängt und es auf seine Konsistenz mit den Steuersignalen hin überprüft, die von der zentralen Steuer- und Überwachungseinheit (1) empfangen wurden, und als Ergebnis den Prüfcode erzeugt, der von der Schutzkontrolleinheit (121) analysiert wird.
  5. System nach Anspruch 4, dadurch gekennzeichnet, dass der Leistungsverstärker/Demodulator (43) einen inhärenten ausfallsicheren Aufbau hat.
  6. System nach einem oder mehreren der Ansprüche 1 bis 5, dadurch gekennzeichnet, dass das Modul (302) zum Erfassen und Erkennen der Signale vom Gleisstromkreis (cdB, cdB1, cdB2, cdB3) eine Eingangsstufe (62) umfasst, um das Eingangssignal zu zwei Verarbeitungskanälen (60, 61) durch einen Digitalsignalprozessor zu entkoppeln, dessen Ausgaben dem Vital-Computer-Modul (102) zugeführt werden, der ihre Identität prüft und als Ergebnis einen Prüfcode erzeugt, der von der Schutzkontrolleinheit (121) auf seine Korrektheit hin überprüft wird.
  7. System nach Anspruch 6, dadurch gekennzeichnet, dass die Eingangsstufe (62) zur Entkopplung der zwei Signalverarbeitungskanäle (60, 61) einen inhärenten ausfallsicheren Aufbau hat.
  8. System nach einem oder mehreren der Ansprüche 3 bis 7, dadurch gekennzeichnet, dass ein Gerät zur Umkehr der Verbindung des Senders und Empfängers (3, 4) an den zwei Enden jedes isolierten Gleissegments einen inhärenten ausfallsicheren Aufbau hat.
  9. System nach einem oder mehreren der vorhergehenden Ansprüche, dadurch gekennzeichnet, dass die Schutzkontrolleinheit (121) einen inhärenten ausfallsicheren Aufbau hat.
  10. System nach einem oder mehreren der vorhergehenden Ansprüche, dadurch gekennzeichnet, dass die Schutzkontrolleinheit (121) die Prüfcodes durch löschende Verarbeitung auf ihre Korrektheit hin überprüft.
  11. System nach einem oder mehreren der vorhergehenden Ansprüche, dadurch gekennzeichnet, dass
       jede Steuer- und Überwachungsuntereinheit (2, 2', 2") zum Erzeugen und Empfangen von Zugerkennungssignalen und/oder codierten Kommunikationssignalen Mittel umfasst, um ein Signal zu erzeugen, wenn ein Zug auf dem entsprechenden isolierten Gleissegment erkannt wird, wobei dieses Signal vom Sender (3, 4), der zu einem Ende des isolierten Gleissegment gehört, zum zugehörigen Empfänger (4, 3) am entgegengesetzten Ende des isolierten Gleissegments übertragen wird, in der Richtung, die der Fahrtrichtung des Zuges entgegengesetzt ist,
       wobei das Zugerkennungssignal einem Phasenmodulator des isolierten Gleissegments zugeführt wird, bevor ein Träger mit einer vorgegebenen festen Niederfrequenz gesendet wird, wodurch die Trägerphase vorgegebene Zeitintervalle lang zwischen zwei bestimmten Phasen moduliert wird, in Bezug auf ein Bezugssignal, das die Trägerfrequenz hat, wobei die Zeitintervalle zwischen den Frequenzschritten der zwei Phaseneinstellungen eine vorgegebene Länge haben;
       und diese Zugerkennungssignale für jedes isolierte Gleissegment auf einmalige Weise differenziert sind, indem verschiedene Zeitintervalle zwischen zwei aufeinanderfolgenden Phasenschritten eingestellt werden.
  12. System nach Anspruch 11, dadurch gekennzeichnet, dass in einem isolierten Gleissegment eine bestimmte Zahl von verschiedenen Zugerkennungssignalen vorgesehen ist, die alle in Bezug auf das Intervall zwischen zwei aufeinanderfolgenden Trägerphasenübergängen voneinander differenziert sind, wobei die zeitgesteuerten Phasenmodulatoren, die den einzelnen isolierten Gleissegmenten der Eisenbahnstrecke zugehörig sind, so eingestellt sind, dass diese Zugerkennungssignale zwischen aufeinanderfolgenden Phasenübergänge verschiedene Zeitintervalle haben, die sich insbesondere von denen unterscheiden, die zu den direkt benachbarten isolierten Gleissegmenten gesendet werden.
  13. System nach Anspruch 11 oder 12, dadurch gekennzeichnet, dass ein progressiver Anstieg zwischen zwei aufeinanderfolgenden Phasenschritten vorgesehen ist, der solch eine Dauer und Frequenz aufweist, dass ein gleichmäßiger Phasenübergang gewährleistet wird.
  14. System nach einem oder mehreren der vorhergehenden Ansprüche 11 bis 13, dadurch gekennzeichnet, dass der Träger etwa 50 Hz aufweist.
  15. System nach einem oder mehreren der vorhergenden Ansprüche 11 bis 14, dadurch gekennzeichnet, dass zwischen einer Phaseneinstellung, in der das Signal mit einem Bezugssignal phasengleich ist, und einer Phaseneinstellung, in der das Signal in Bezug auf ein Bezugssignal von 50 Hz gegenphasig ist, Phasenübergänge auftreten.
  16. System nach einem oder mehreren der vorhergehenden Ansprüche 11 bis 15, dadurch gekennzeichnet, dass der Anstieg zwischen zwei aufeinanderfolgenden Phasenübergängen eine Frequenz von 55,55 Hz aufweist.
  17. System nach einem oder mehreren der vorhergehenden Ansprüche 11 bis 16, dadurch gekennzeichnet, dass das Zugerkennungssignal eine Gesamtdauer hat, die der Summe der Intervalle von fünf aufeinanderfolgenden Phasenübergängen und der Dauer von fünf Anstiegen entspricht.
  18. System nach einem oder mehreren der vorhergehenden Ansprüche 11 bis 17, dadurch gekennzeichnet, dass die Steuer- und Überwachungsuntereinheit (2, 2', 2") zum Erzeugen und Empfangen von Zugerkennungssignalen und/oder codierten Kommunikationssignalen Mittel zum Erzeugen von auf einmalige Weise definierten Codes aufweist.
  19. System nach Anspruch 18, dadurch gekennzeichnet, dass eine bestimmte Zahl von einmalig definierten Codes vorgesehen ist, die alle durch eine bestimmte Pulsweitenmodulation definiert sind, d.h. durch eine bestimmte Zahl von Malen pro Minute, mit der der Träger ausgeschlossen ist.
  20. System nach Anspruch 19, dadurch gekennzeichnet, dass der Träger 50 Hz aufweist, wogegen vier Codes vorgesehen sind, der Pulsweitenmodulation der Trägerunterbrechung entspricht, die mit einer bestimmten Zahl von Malen pro Minute durchgeführt wird, und insbesondere jeweils 75, 120, 180 und 270 Mal/Minute.
  21. System nach einem oder mehreren der vorhergehenden Ansprüche 11 bis 20, dadurch gekennzeichnet, dass die Steuer- und Überwachungsuntereinheit (2, 2', 2") zum Erzeugen und Empfangen von Zugerkennungssignalen und/oder codierten Kommunikationssignalen mindestens einen Ausgang für Zugerkennungssignale und für codierte Kommunikationssignale und mindestens einen Eingang für die Signale hat, die vom isolierten Gleissegment erfasst werden, wobei diese Ausgänge und Eingänge mit Gleisverbindungsschnittstellen (3, 4) verbunden sind, die abwechselnd Sende- und Empfangsfunktionen aufweisen können, und durch einen Verbindungsumkehrschaltkreis jeweils abwechselnd mit diesem Ausgang und Eingang verbunden werden, der Steuerung der zentralen Steuer- und Überwachungseinheit (1) entsprechend und je nach Fahrtrichtung des Zuges innerhalb des entsprechenden isolierten Gleissegments.
  22. System nach Anspruch 21, dadurch gekennzeichnet, dass diese Gleisverbindungsschnittstellen aus Sende-Empfangs-Transformatoren bestehen.
EP03100263A 2002-02-22 2003-02-10 System zur Gleisfreimeldung einer Eisenbahnstrecke und zur Kommunikation mit Zügen auf dieser Strecke Expired - Lifetime EP1338492B1 (de)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
IT2002SV000008A ITSV20020008A1 (it) 2002-02-22 2002-02-22 Impianto per il rilevamento della condizione di libero/occupato di una linea ferroviaria o simili e per la comunicazione digitale con treni
ITSV20020008 2002-02-22

Publications (2)

Publication Number Publication Date
EP1338492A1 EP1338492A1 (de) 2003-08-27
EP1338492B1 true EP1338492B1 (de) 2005-04-13

Family

ID=27638692

Family Applications (1)

Application Number Title Priority Date Filing Date
EP03100263A Expired - Lifetime EP1338492B1 (de) 2002-02-22 2003-02-10 System zur Gleisfreimeldung einer Eisenbahnstrecke und zur Kommunikation mit Zügen auf dieser Strecke

Country Status (6)

Country Link
EP (1) EP1338492B1 (de)
AT (1) ATE293063T1 (de)
DE (1) DE60300486T2 (de)
ES (1) ES2240911T3 (de)
IT (1) ITSV20020008A1 (de)
PT (1) PT1338492E (de)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2457134C1 (ru) * 2011-01-19 2012-07-27 Виталий Сергеевич Котов Устройство контроля состояния рельсовых цепей
RU2486091C1 (ru) * 2011-12-30 2013-06-27 Федеральное государственное бюджетное образовательное учреждение высшего профессионального образования "Самарский государственный университет путей сообщения" (СамГУПС) Способ контроля состояния рельсовой линии
RU2562027C1 (ru) * 2014-06-23 2015-09-10 Открытое акционерное общество "Научно-исследовательский и проектно-конструкторский институт информатизации, автоматизации и связи на железнодорожном транспорте" (ОАО "НИИАС") Устройство для централизованной автоблокировки с бесстыковыми рельсовыми цепями тональной частоты
CN106347414A (zh) * 2016-08-31 2017-01-25 北京交控科技股份有限公司 一种用于列车相向运行时移动授权的计算方法以及装置

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7315770B2 (en) 2004-02-03 2008-01-01 General Electric Company Railway controller with improved application programming
CN100562451C (zh) * 2004-02-03 2009-11-25 通用电气公司 具有改进的应用编程的铁路控制器
ITFI20050021A1 (it) * 2005-02-08 2006-08-09 Ge Transp Systems S P A Telealimentatore ad onde convogliate
CZ298373B6 (cs) * 2006-01-13 2007-09-12 Ažd Praha S. R. O. Zpusob zachování bezpecného stavu elektronických bezpecnostne relevantních zarízení se složenou bezpecností pri poruše
ES2371298T3 (es) 2008-02-14 2011-12-29 Alstom Transport Sa Sistema de detección de trenes en líneas ferroviarias.
MX2012000847A (es) 2009-07-17 2012-07-17 Invensys Rail Corp Comunicaciones de circuito de via.
US8500071B2 (en) 2009-10-27 2013-08-06 Invensys Rail Corporation Method and apparatus for bi-directional downstream adjacent crossing signaling
US8660215B2 (en) 2010-03-16 2014-02-25 Siemens Rail Automation Corporation Decoding algorithm for frequency shift key communications
US8297558B2 (en) 2010-03-17 2012-10-30 Safetran Systems Corporation Crossing predictor with authorized track speed input
RU2457136C2 (ru) * 2010-06-16 2012-07-27 Государственное образовательное учреждение высшего профессионального образования "Самарский государственный университет путей сообщения" (СамГУПС) Способ контроля состояния рельсовой линии
DE102011076047A1 (de) * 2011-05-18 2012-11-22 Siemens Aktiengesellschaft Zugsicherungssystem mit puls-code-modulierter Führerstandssignalisierung
RU2492089C2 (ru) * 2011-09-26 2013-09-10 Закрытое акционерное общество "Научно-производственный центр "Промэлектроника" (ЗАО "НПЦ "Промэлектроника") Способ контроля состояния рельсовой линии
DE102013217324A1 (de) * 2013-08-30 2015-03-05 Siemens Aktiengesellschaft Verfahren und Systemkonfiguration zur Systemdiagnose in einem sicherheitstechnischen System
CN107867308B (zh) * 2016-09-23 2023-10-10 河南蓝信科技有限责任公司 一种电子轮对设备及其方法
JOP20190123A1 (ar) * 2017-06-14 2019-05-28 Grow Solutions Tech Ll أنظمة وطرق للاتصال عبر مسار بعربة صناعية
CN109581415B (zh) * 2019-01-25 2024-01-23 中国人民解放军海军航空大学 一种基于gnss的同步计算和授时控制的装置与方法
CN111884733B (zh) * 2020-07-15 2022-05-17 武汉博畅通信设备有限责任公司 一种智能电台检测系统及方法
CN114325161B (zh) * 2021-09-27 2023-10-27 北京全路通信信号研究设计院集团有限公司 一种兼容性性能测试方法及系统
CN114475697B (zh) * 2022-04-01 2023-06-30 北京全路通信信号研究设计院集团有限公司 一种低频发码设备及发码方法
CN115208321B (zh) * 2022-07-12 2023-04-11 固安信通信号技术股份有限公司 轨道电路特征信号的相位调制方法、解调算法及用途

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4740972A (en) * 1986-03-24 1988-04-26 General Signal Corporation Vital processing system adapted for the continuous verification of vital outputs from a railway signaling and control system
JP3430857B2 (ja) * 1997-05-15 2003-07-28 株式会社日立製作所 列車在線検知システム及び列車在線検知方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2457134C1 (ru) * 2011-01-19 2012-07-27 Виталий Сергеевич Котов Устройство контроля состояния рельсовых цепей
RU2486091C1 (ru) * 2011-12-30 2013-06-27 Федеральное государственное бюджетное образовательное учреждение высшего профессионального образования "Самарский государственный университет путей сообщения" (СамГУПС) Способ контроля состояния рельсовой линии
RU2562027C1 (ru) * 2014-06-23 2015-09-10 Открытое акционерное общество "Научно-исследовательский и проектно-конструкторский институт информатизации, автоматизации и связи на железнодорожном транспорте" (ОАО "НИИАС") Устройство для централизованной автоблокировки с бесстыковыми рельсовыми цепями тональной частоты
CN106347414A (zh) * 2016-08-31 2017-01-25 北京交控科技股份有限公司 一种用于列车相向运行时移动授权的计算方法以及装置
CN106347414B (zh) * 2016-08-31 2018-06-05 交控科技股份有限公司 一种用于列车相向运行时移动授权的计算方法以及装置

Also Published As

Publication number Publication date
ITSV20020008A1 (it) 2003-08-22
DE60300486T2 (de) 2006-02-23
PT1338492E (pt) 2005-09-30
EP1338492A1 (de) 2003-08-27
ES2240911T3 (es) 2005-10-16
ATE293063T1 (de) 2005-04-15
DE60300486D1 (de) 2005-05-19

Similar Documents

Publication Publication Date Title
EP1338492B1 (de) System zur Gleisfreimeldung einer Eisenbahnstrecke und zur Kommunikation mit Zügen auf dieser Strecke
JP3430857B2 (ja) 列車在線検知システム及び列車在線検知方法
US9731733B2 (en) Method and apparatus for an interlocking control device
US4763267A (en) System for indicating track sections in an interlocking area as occupied or unoccupied
CN105398472A (zh) 一种平台主机插件
EP2786913B1 (de) Schaltpunkt-Maschinenverwaltungseinheit
US9038965B2 (en) Method and sequential monitoring overlay system for track circuits
US7437605B2 (en) Hot standby method and apparatus
KR100414031B1 (ko) 다중계 처리장치 및 다중계 처리장치에 접속된 콘트롤러및 다중계 처리시스템
US4611775A (en) Railway track switch control apparatus
US8005585B2 (en) Method for determining the occupancy status of a track section in particular following a restart of an axle counting system, as well as an evaluation device and counting point for this
CN111831507B (zh) 具有安全等级设计的tcms-riom控制单元
RU40284U1 (ru) Микропроцессорная система автоблокировки с децентрализованным размещением аппаратуры и специализированной сетью передачи данных
RU2536990C1 (ru) Двухканальная система для регулирования движения поездов
JP5161158B2 (ja) Ａｔｃ送信器
JP3792944B2 (ja) 無電源地上子
US20120005543A1 (en) Secure checking of the exclusivity of an active/passive state of processing units
Foley The impact of electrification on railway signalling systems
CN110143220A (zh) 一种安全型轨道信号发送器
CN214750590U (zh) 轨道电路信息读取模块
JP2004302708A (ja) 多重系情報処理装置
Kurz et al. Time synchronization in the eurobalise subsystem
Akita et al. Safety and fault-tolerance in computer-controlled railway signalling systems
JP3970438B2 (ja) Ａｔｃシステム地上局の送受信装置
CN105388883A (zh) 主机插件的运行自检方法和装置

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT SE SI SK TR

AX Request for extension of the european patent

Extension state: AL LT LV MK RO

17P Request for examination filed

Effective date: 20031002

17Q First examination report despatched

Effective date: 20031118

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: ALSTOM FERROVIARIA S.P.A.

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT SE SI SK TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT SE SI SK TR

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

Ref country code: LI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

Ref country code: CH

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REF Corresponds to:

Ref document number: 60300486

Country of ref document: DE

Date of ref document: 20050519

Kind code of ref document: P

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050713

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050713

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050714

REG Reference to a national code

Ref country code: SE

Ref legal event code: TRGR

REG Reference to a national code

Ref country code: GR

Ref legal event code: EP

Ref document number: 20050402070

Country of ref document: GR

REG Reference to a national code

Ref country code: PT

Ref legal event code: SC4A

Effective date: 20050712

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2240911

Country of ref document: ES

Kind code of ref document: T3

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20060228

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20060228

ET Fr: translation filed
26N No opposition filed

Effective date: 20060116

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20050413

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 14

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 15

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 16

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: SE

Payment date: 20200220

Year of fee payment: 18

Ref country code: DE

Payment date: 20200219

Year of fee payment: 18

Ref country code: GR

Payment date: 20200220

Year of fee payment: 18

Ref country code: PT

Payment date: 20200121

Year of fee payment: 18

Ref country code: NL

Payment date: 20200219

Year of fee payment: 18

Ref country code: GB

Payment date: 20200219

Year of fee payment: 18

Ref country code: ES

Payment date: 20200322

Year of fee payment: 18

Ref country code: IE

Payment date: 20200219

Year of fee payment: 18

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20200219

Year of fee payment: 18

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: BE

Payment date: 20210217

Year of fee payment: 19

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 60300486

Country of ref document: DE

REG Reference to a national code

Ref country code: SE

Ref legal event code: EUG

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20210210

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210906

Ref country code: SE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210211

Ref country code: PT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210810

REG Reference to a national code

Ref country code: NL

Ref legal event code: MM

Effective date: 20210301

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210301

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210901

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210210

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210210

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210228

REG Reference to a national code

Ref country code: ES

Ref legal event code: FD2A

Effective date: 20220510

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20220218

Year of fee payment: 20

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210211

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20220228

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220228