EP2874857B1 - Operating a rail vehicle by means of an etcs device, railvehicle and apparatus - Google Patents

Description

The invention relates to a method for operating a rail vehicle by means of a secondary ETCS device in case of failure of the primary ETCS device. Also, a rail vehicle and a device are accordingly proposed.

The European Train Control System (ETCS for short) is a component of a single European Rail Traffic Management System, developed under the abbreviation ERTMS. The second technical component of this digital railway technology is the GSM-R railway mobile communications system. ETCS is intended to replace the large number of individual train protection systems deployed in individual countries.

ETCS takes over several functions. It monitors the local maximum speed, the maximum speed of the train, the correct distance of the train, the direction of travel, the suitability of the train for the route and the observance of special operating regulations.

• streckenseitig die im Gleis verlegten Eurobalisen oder Euroloops bei ETCS Level 1, sowie bei ETCS Level 2 und 3 die mit dem Stellwerk verbundene ETCS-Streckenzentrale (RBC, Radio Block Centre),
• fahrzeugseitig die ETCS-Onboard Unit (OBU), die die empfangenen Daten auswertet, dem Triebfahrzeugführer anzeigt und den Zug im Gefahrenfall automatisch vor einem Gefahrenpunkt zum Halten bringt.

This information is processed by the building blocks of the ETCS:

• Trackside Eurobalises or Euroloops on the track at ETCS Level 1, ETCS Level 2 and 3 ETCS (Radio Block Center) linked to the interlocking,
• On the vehicle side, the ETCS onboard unit (OBU), which evaluates the received data, displays it to the driver and automatically stops the train in case of danger in front of a danger point.

The ETCS vehicle device (also referred to as ETCS device) consists essentially of ETCS computer (also referred to as "EVC", European Vital Computer), Driver Machine Interface (DMI), pathway meter, GSM-R transmission facility (including Euroradio), balise reader and brake access.

In addition to ETCS levels, ETCS modes are also defined. The modes describe the states in which the EVC can be located. An overview can be found e.g. at http://en.wikipedia.org/wiki/ETCS.

The ETCS vehicle equipment is not completely redundant. This leads to individual failures in the EVC hardware as well as in connected components, such as the balise antenna, to a complete system failure. The ETCS vehicle device usually changes to the state "system failure" and is consequently isolated. Unless complete redundant equipment is present on the vehicle and trackside, there is no longer a viable vehicle backup system available in this case.

On the one hand, it is known to equip routes and rail vehicles with redundant systems. Thus, in addition to the ETCS facilities, second levels of national security systems are used. National train protection systems are present on the vehicles and can operate as stand-alone systems when the ETCS system is isolated in conventional mode.

On the other hand, there are operational regulations for driving without a supervised train protection system, in which the operation is carried out in personnel responsibility.

EP 2 253 525 A1 concerns a train control method. The method comprises: securing train control data of a RBC (Radio Block Center) and obtaining backup data, the train control data being for control a train passing through the line center; Obtaining the alternative control information of the trains and controlling the trains by means of the backup data. Also, a route center, an on-board unit and a train control system ARC (Active Radio Control) are provided. If the trains managed by the RBC require alternative control, the RBC can be replaced to control the trains, ensuring that the trains can drive normally under control.

EP 1 614 604 A1 discloses a method of switching from a first to a second train protection system. In this case, as a function of signals generated by the first train protection system, a drive signal for the second train protection system is generated by a switching device and the second train protection system is kept passive via the drive signal. The second train protection system is activated when the switching device does not detect signals transmitted by the first train protection system. The interruption of the signals can thus be carried out operationally by the first train protection system or even in case of disturbances of the first train control system or the transmission paths. This ensures that both train control systems are not active at the same time and that in the event of a fault the entire system is activated to the "safe" side. In case of a disturbance of the transmission path or the signal evaluation both train protection systems can be active. A mutual influence in the sense of a Zwangsbremsauslösungsverhinderung does not occur if both systems have different, uncoupled access to the emergency brake (main air line).

The object of the invention is to avoid the abovementioned disadvantages and in particular to provide as far as possible automated support for train protection even in the event of a failure of an ETCS hardware.

This object is achieved according to the features of the independent claims. Preferred embodiments are in particular the dependent claims.

• das eine primäre ETCS-Einrichtung mit einem primären Rechner und eine Führerstandsanzeige sowie eine sekundäre ETCS-Einrichtung mit einem sekundären Rechner aufweist,
• bei dem in einem Fehlerfall der primären ETCS-Einrichtung von dem primären Rechner auf den sekundären Rechner umgeschaltet wird,
• bei dem der sekundäre Rechner zum Betrieb des Schienenfahrzeugs eingesetzt wird,
• bei dem der sekundäre Rechner aktiviert und zum Betrieb des Schienenfahrzeugs in Verbindung mit der Führerstandsanzeige der primären ETCS-Einrichtung eingesetzt wird.

To achieve the object, a method is proposed for operating a rail vehicle,

• comprising a primary ETCS device with a primary computer and a cab display and a secondary ETCS device with a secondary computer,
• in which, in the event of an error, the primary ETCS device is switched from the primary computer to the secondary computer,
• in which the secondary computer is used to operate the rail vehicle,
• in which the secondary computer is activated and used to operate the rail vehicle in conjunction with the cab display of the primary ETCS device.

The computer is a processing component, a computer, a microcontroller or a plurality of these elements. The computer itself can also be redundant or distributed. The computer is in particular an on-board computer of a car of the rail vehicle. The computer is also referred to here as an example as an EVC or ETCS computer or may be part of such.

The primary computer or primary ETCS device is normally used to operate the rail vehicle. If the error occurs, then a - possibly restricted - train protection function can still be guaranteed by means of the then activated secondary computer (or at least part of the secondary ETCS device). This has the advantage that the train command in case of failure Component of the primary ETCS device can still be continued automatically at least in some cases of error.

It should be noted that the rail vehicle (also referred to as "train") has at least one car, the car may be a traction vehicle, a travel car, a freight car or a combination of such compartments or functions. The traction unit has a driver's cab (also referred to as an operator station) and can be designed with or without drive. The traction vehicle may in particular be a locomotive. The ETCS device is preferably arranged in a car of the rail vehicle.

It should also be noted that the rail vehicle can have a plurality of secondary ETCS devices (each with a computer) and that, if appropriate, a (secondary) computer can be activated from these multiple secondary ETCS devices.

• einen Ausfall einer Komponente der primären ETCS-Einrichtung;
• eine Fehlermeldung betreffend die primäre ETCS-Einrichtung.

Eine andere Weiterbildung ist es, dass

• in dem Fehlerfall die primäre ETCS-Einrichtung isoliert geschaltet wird,
• der sekundäre Rechner von einem Zustand "schlafend" in einen aktiven Zustand versetzt wird.

A development is that the error case includes at least one of the following options:

• a failure of a component of the primary ETCS facility;
• an error message regarding the primary ETCS facility.

Another training is that

• in the event of an error, the primary ETCS device is switched to isolated,
• the secondary computer is put from an asleep state to an active state.

• in dem Fehlerfall das Schienenfahrzeug abgebremst wird,
• im Stillstand des Schienenfahrzeugs die primäre ETCS-Einrichtung zumindest teilweise, insbesondere bis auf ein Aufzeichnungsgerät und eine Führerstandsanzeige, mittels ETCS-Isolierschalter isoliert geschaltet und eine ETCS Level 2 Verbindung zu einer ETCS-Streckenzentrale unterbrochen wird.

In particular, it is a training that

• in the event of a fault, the rail vehicle is braked,
• at standstill of the rail vehicle, the primary ETCS device at least partially isolated, in particular with the exception of a recording device and a cab display, isolated by means of ETCS insulation switch and an ETCS Level 2 connection to an ETCS line center is disrupted.

Unless the cab display in the car of the rail vehicle with the primary ETCS device was the cause of the system failure and is still functional, e.g. the secondary computer in conjunction with this cab display the function of vehicle security.

It is also a development that the primary ETCS device is switched isolated and this isolation is signaled to the secondary computer, in particular via a bus system, a line or a radio link.

As a result of this signaling, the secondary computer can be activated and used to operate the rail vehicle.

• eine Überwachung der höchsten zulässigen Geschwindigkeit des Schienenfahrzeugs,
• eine Überwachung der höchsten zulässigen Geschwindigkeit der Strecke, insbesondere basierend auf externen Vorgaben.

Furthermore, it is a development that the secondary computer is used to operate the rail vehicle by providing at least one of the following functionalities:

• a monitoring of the maximum permissible speed of the rail vehicle,
• monitoring the maximum permissible speed of the route, in particular based on external specifications.

A next development is that in case the track and the rail vehicle are equipped for ETCS Level 2, the secondary computer will provide the same modes in ETCS Level 2 as the computer of the isolated primary ETCS device and will communicate with the ETCS line center based on the radio transmission device, in particular the GSM-R radio transmission device.

In this case, the secondary computer can ensure the full safety functionality of the rail vehicle.

One embodiment is that the secondary computer for the operation of the rail vehicle uses a first balise antenna at the tip of the rail vehicle with respect to its direction of travel.

Also in this case, the secondary computer can ensure the full security functionality of the rail vehicle.

An alternative embodiment is that the secondary computer, if the balise antenna at the top of the rail vehicle is not usable, uses another balise antenna of the rail vehicle for the operation of the rail vehicle.

For example, in the ETCS Level 2 mode, the distance from the used balise antenna to the top of the rail vehicle (this is known due to the composition of the rail vehicle) can be considered as a fixed offset. Thus, in the control of the rail vehicle, this distance can be processed by the second computer and a distance corrected by the distance can be reported to the ETCS line center. In this respect, the second computer provides transparent processing of the data for the ETCS route center.

A next refinement is that the secondary computer, in particular in a mode ETCS Level 1, provides a reduced security functionality for the operation of the rail vehicle.

The reduced security functionality requires in particular a control of the operation by the motor coach driver. For example, with reduced backup functionality, a speed monitor (the maximum speed of the rail vehicle and / or the temporary speed restriction) are provided, the responsibility of the control of the speed is in this case the railcar driver.

The statements concerning the method apply correspondingly to the other categories of claim.

• mit einer primären ETCS-Einrichtung aufweisend einen primären Rechner und eine Führerstandsanzeige,
• mit einer sekundären ETCS-Einrichtung aufweisend einen sekundären Rechner,
• wobei in einem Fehlerfall der primären ETCS-Einrichtung die primäre ETCS-Einrichtung inaktiv schaltbar ist,
• wobei in dem Fehlerfall der sekundäre Rechner aktivierbar ist und für den Betrieb des Schienenfahrzeugs in Verbindung mit der Führerstandsanzeige der primären ETCS-Einrichtung einsetzbar ist.

The above object is also achieved by a rail vehicle

• having a primary ETCS device comprising a primary computer and a cab display,
• with a secondary ETCS device having a secondary computer,
• wherein in case of failure of the primary ETCS device, the primary ETCS device is inactive switchable,
• wherein in the event of an error, the secondary computer is activated and can be used for the operation of the rail vehicle in conjunction with the cab display of the primary ETCS device.

• in einem Fehlerfall einer primären ETCS-Einrichtung, die einen primären Rechner und eine Führerstandsanzeige aufweist, die Vorrichtung eine Nachricht zur Aktivierung erhält und nach dem Abschalten der primären ETCS-Einrichtung aktivierbar und zum Betrieb des Schienenfahrzeugs in Verbindung mit einer Führerstandsanzeige der primären ETCS-Einrichtung einsetzbar ist.

The above object is also achieved by means of a device for operating a rail vehicle, which has a secondary ETCS device with a secondary computer and which is set up such that

• in the event of failure of a primary ETCS device having a primary computer and a cab display, the device receives an activation message and is activatable upon powering down the primary ETCS device and operating the rail vehicle in conjunction with a cab display of the primary ETCS device can be used.

The device may be the secondary ETCS device, in particular the secondary computer of this secondary ETCS device.

The solution presented here further comprises a computer program product which can be loaded directly into a memory of a digital computer, comprising program code parts which are suitable for carrying out steps of the method described here.

Furthermore, the above problem is solved by means of a computer-readable storage medium, e.g. any memory comprising computer-executable instructions (e.g., in the form of program code) adapted for the computer to perform steps of the method described herein.

The above-described characteristics, features and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following schematic description of exemplary embodiments which will be explained in more detail in conjunction with the drawings. In this case, the same or equivalent elements may be provided with the same reference numerals for clarity.

Fig.1

eine schematische Darstellung eines Schienenfahrzeugs mit einer Vielzahl von Wagen, von denen ein Teil der Wagen ETCS-Einrichtungen mit EVCs aufweisen;

Fig.2

ein beispielhaftes Umschalten zwischen ETCS-Einrichtungen, insbesondere EVCs der ETCS-Einrichtungen, anhand eines Flussdiagramms.

Show it

Fig.1

a schematic representation of a rail vehicle with a plurality of cars, a part of the carriage having ETCS devices with EVCs;

Fig.2

an exemplary switching between ETCS devices, in particular EVCs of the ETCS devices, using a flowchart.

In rail vehicles with multiple ETCS vehicle devices that are electrically connected, a secondary EVC, which until then was in the "sleeping" mode, also responds upon isolation of the leading active EVC (ie primary EVC) as ETCS computer) the function of the vehicle security.

It should be noted that primary EVC and secondary EVC are chosen only as illustrative terms for the fact that one of the computers (the primary EVC) was previously active and is at least partially replaced by the other computer (the secondary EVC). Accordingly, the primary EVC is part of the primary ETCS device and the secondary EVC part of the secondary ETCS device. Preferably, several ETCS devices are provided in a rail vehicle, for example in different cars of the rail vehicle.

Thus, at least part of the automated train protection, in particular the ETCS functionality, can be maintained.

Depending on the vehicle and route design, backup functions are maintained to varying degrees.

For example, if a failure occurs in the primary ETCS device that requires a change to a "system failure" mode, the rail vehicle will be decelerated and at standstill this failed primary ETCS device will be isolated using ETCS isolation switches. This disables all backup features associated with the ETCS facility. An existing connection to the RBC in ETCS Level 2 will be lost. The components Juridical Recorder (JRU) and Driver Machine Interface (DMI) are preferably unaffected by such isolation.

Unless the cab display in the car of the rail vehicle with the primary ETCS device was the cause of the system failure and is still functional, e.g. the secondary EVC after a mode change in conjunction with this cab display the function of vehicle safety.

The secondary ("sleeping") EVC is signaled the isolation of the primary EVC (ETCS systems and thus their EVCs are electrically connected). Depending on the structure of the rail vehicle, this signaling is realized via a bus system (MVB, Profinet, CAN), a line or a radio link.

The secondary EVC leaves the mode "sleeping" and takes over the safety functions of the rail vehicle. The scope of these backup functions may vary, ranging e.g. from simple maximum speed monitoring to full train supervision.

Fig.1 shows a schematic representation of a rail vehicle 101 with a plurality of cars, of which a part of the carriage have an ETCS device 103 to 106. Each of the ETCS devices 103 to 106 has, inter alia, a computer 108 to 111 (also referred to as EVC). The rail vehicle 101 moves in the direction of travel 102, before the occurrence of the error, the ETCS device 106 is active, the other ETCS devices 103 to 105 are inactive, eg in the state "sleeping". If the error occurs in the ETCS device 106, then it is at least partially deactivated and, for example, the computer 110 of the ETCS device 105 takes over. The computers 108 to 111 and the ETCS devices 103 to 106 are in Fig.1 exemplified via a bus 107 connected.

1. (a) Szenario 1:
   • Strecke und Schienenfahrzeug sind für ETCS Level 2 ausgerüstet, der sekundäre EVC und die Führerstandsanzeige sind über einen Bus miteinander verbunden.
   • Der sekundäre EVC stellt gleiche Modi in ETCS Level 2 zur Verfügung wie der primäre (vormals aktive) EVC und baut eine Verbindung zum RBC über GSM-R auf.
   • Besteht Zugriff auf die Daten der Balisenantenne an der Spitze des Schienenfahrzeugs (über einen separaten und/oder abgesetzten Balisenkanal), so können die Sicherungsfunktionen im vollen Umfang bereitgestellt bzw. aufrechterhalten werden.
   • Besteht hingegen kein Zugriff auf diese Daten, werden die Daten z.B. der lokalen Balisenantenne desjenigen Wagens, in dem der sekundäre EVC verortet ist, verwendet. Die Sicherungsfunktion ist damit eingeschränkt, weil die Daten zu spät (nicht an der Spitze des Fahrzeugs) abgegriffen werden. Mit anderen Worten hat die Spitze des Schienenfahrzeugs die Balise längst überfahren bevor die lokale Balisenantenne die Daten von der Balise erhält. Hierbei werden z.B. Grenzbalisen zu spät erkannt, was zu einer verzögerten Reaktion führt.
2. (b) Szenario 2:
   • Die Strecke ist für ETCS Level 1 ausgerüstet, der sekundäre EVC und die Führerstandsanzeige sind über einen Bus miteinander verbunden.
   • Besteht Zugriff auf die Daten der Balisenantenne an der Fahrzeugspitze, werden die gleichen Modi wie im primären EVC bereitgestellt.
   • Besteht hingegen kein Zugriff auf die Daten der Balisenantenne an der Spitze des Schienenfahrzeugs, wird eine deutlich eingeschränkte Überwachung von dem sekundären EVC bereitgestellt. So wird vorzugsweise lediglich eine vorgegebene maximale Geschwindigkeit und eine temporäre Geschwindigkeitseinschränkung überwacht.
   • Da Daten von der Strecke nicht an der Spitze des Schienenfahrzeugs abgegriffen werden, erfolgt eine Reaktion ggf. zu spät; die Zugsicherungsfunktion ist entsprechend eingeschränkt.
3. (c) Szenario 3:
   • Der sekundäre EVC kann unabhängig von dem ETCS Level als Quelle für das Geschwindigkeitssignal genutzt werden. Insofern kann die Geschwindigkeitsinformation von dem sekundären EVC auf der Führerstandsanzeige desjenigen Wagens, der das primäre ETCS-System aufweist, angezeigt werden.

Advantageously, the following scenarios can be distinguished:

1. (a) Scenario 1:
   • Track and rail vehicle are equipped for ETCS Level 2, the secondary EVC and the cab display are connected by a bus.
   • The secondary EVC provides the same modes in ETCS Level 2 as the primary (formerly active) EVC and establishes a connection to the RBC via GSM-R.
   • Having access to the data of the balise antenna at the top of the rail vehicle (via a separate and / or remote balise channel), the backup functions can be fully deployed or maintained.
   • If, on the other hand, there is no access to this data, the data will be used, for example, by the local balise antenna of the car in which the secondary EVC is located. The backup function is therefore limited because the data is tapped too late (not at the top of the vehicle). In other words, the top of the rail vehicle has long passed the balise before the local balise antenna receives the data from the balise. For example, border balises are detected too late, which leads to a delayed reaction.
2. (b) Scenario 2:
   • The track is equipped for ETCS Level 1, the secondary EVC and the cab display are connected by a bus.
   • If the beacon antenna data is available at the top of the vehicle, the same modes are provided as in the primary EVC.
   • On the other hand, if there is no access to the data from the beacon antenna at the top of the rail vehicle, significantly limited monitoring is provided by the secondary EVC. Thus, preferably only a predetermined maximum speed and a temporary speed limit are monitored.
   • Since data from the track is not tapped at the top of the rail vehicle, a reaction may be too late; the train protection function is restricted accordingly.
3. (c) Scenario 3:
   • The secondary EVC can be used as the source of the speed signal, regardless of the ETCS level. As such, the speed information from the secondary EVC may be displayed on the cab display of the car having the primary ETCS system.

If a display component fails in the cab display of the primary ETCS system cart, the remaining display may be used to display the necessary information for safe train operation. Preferably, a condensed representation of the information can be selected for this or it can be switched between different views.

If a GSM-R module of the primary ETCS device fails, the GSM-R module of the secondary ETCS device can be used, if necessary by means of the secondary EVC.

Fig.2 illustrates an exemplary switching between ETCS devices, in particular EVCs of the ETCS devices, using a flowchart.

In a step 201, an error is detected in the primary ETCS device, the rail vehicle is decelerated to a standstill in a step 202. In step 203, the primary ETCS device is at least partially disabled (e.g., disabled, isolated), and in step 204, the previously dormant EVC of the secondary ETCS device is activated. In a step 205, the rail vehicle is operated by means of the secondary EVC. Such an operation may e.g. Depending on the ETCS level, the train protection functionality may vary.

The autonomous design of the primary and secondary ETCS facilities can thus reduce the reliability.

Thus, the proposed solution makes it possible for an ETCS device incorporated in rail vehicles, which until now is only passively dormant in "sleeping" mode, to now provide backup functions in the event of failure of the primary ETCS device (or a part thereof) and thus acts as a redundant system with full or reduced backup function.

One advantage is that the availability of technical train protection by ETCS in trains with multiple ETCS facilities is significantly increased, thereby reducing the relapse to a backup based on operational regulations with personnel responsibility, which increases the safety of the overall system.

While the invention has been further illustrated and described in detail by the at least one embodiment shown, the invention is not so limited and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

LIST OF REFERENCE NUMBERS

101

track vehicle

102

direction of travel

103-106

ETCS (vehicle) facility

107

electrical connection of the ETCS devices or EVCs, e.g. in the form of a bus system

108-111

EVC (computer of the ETCS facility)

201-205

Steps of a procedure to use a secondary ETCS device or a secondary ETCS device computer

Claims (12)

1. Method for operating a rail vehicle (101),

   - which has a primary ETCS device (106) with a primary computer (111) and a driver's cab display as well as a secondary ETCS device (105) with a secondary computer (110),

   - in which, if a fault occurs in the primary ETCS device (106), switching takes place from the primary computer (111) to the secondary computer (110) (201, 204),

   - in which the secondary computer (110) is used to operate the rail vehicle (101) (205)

   - in which the secondary computer (110) is activated and used to operate the rail vehicle (101) in conjunction with the driver's cab display of the primary ETCS device (204, 205).
2. Method according to claim 1, in which the fault comprises at least one of the following options:

   - a failure of a component of the primary ETCS device;

   - a fault message regarding the primary ETCS device.
3. Method according to one of the preceding claims,

   - in which if a fault occurs the primary ETCS device is switched in isolation (203),

   - in which the secondary computer is shifted from a "sleeping" state to an active state (204).
4. Method according to one of the preceding claims,

   - in which if a fault occurs the rail vehicle is slowed down (202),

   - in which when the rail vehicle is stationary the primary ETCS device is at least partially, in particular except for a recording unit and a driver's cab display, switched in isolation by means of ETCS isolation switches and an ETCS Level 2 connection to an ETCS radio block centre is interrupted (203).
5. Method according to one of claims 3 or 4, in which the primary ETCS device is switched in isolation and this isolation is signalled to the secondary computer, in particular via a bus system, a circuit or a radio connection (107).
6. Method according to one of claims 3 to 5, in which in the event that the route and the rail vehicle are equipped for ETCS Level 2, the secondary computer provides the same modes in ETCS Level 2 as the computer of the isolated primary ETCS device and communicates with the ETCS radio block centre on the basis of the radio transmission device, in particular the GSM-R radio transmission device.
7. The method according to one of the preceding claims, in which the secondary computer is used to operate the rail vehicle by providing at least one of the following functionalities:

   - monitoring of the highest admissible speed of the rail vehicle,

   - monitoring of the highest admissible speed of the route, in particular based on external specifications.
8. Method according to one of the preceding claims, in which the secondary computer uses a first balise antenna at the head of the rail vehicle in relation to its direction of travel for operation of the rail vehicle.
9. Method according to claim 8, in which if the balise antenna at the head of the rail vehicle cannot be used, the secondary computer uses another balise antenna of the rail vehicle for operation of the rail vehicle.
10. Method according to claim 9, in which the secondary computer, in particular in an ETCS Level 1 mode, provides reduced backup functionality for operation of the rail vehicle.
11. Rail vehicle (101)

    - with a primary ETCS device (106) having a primary computer (111) and a driver's cab display,

    - with a secondary ETCS device (105) having a secondary computer (110),

    - wherein if a fault occurs (201) in the primary ETCS device, the primary ETCS device can be switched to an inactive state (203),

    - wherein if a fault occurs the secondary computer can be activated and used for operation of the rail vehicle in conjunction with the driver's cab display of the primary ETCS device (106) (204, 205).
12. Apparatus (110, 105) for the operation of a rail vehicle (101) which has a secondary ETCS device (105) with a secondary computer (110) and which is configured in such a way that

    - if a fault occurs in a primary ETCS device, which has a primary computer (111) and a driver's cab display, the apparatus receives an activation message and can be activated and used for operation of the rail vehicle in conjunction with the driver's cab display of the primary ETCS device after the primary ETCS device has been switched off (201, 203, 204, 205).

Images