EP3323693A1 - Train-oriented route securing logic for train safety installations - Google Patents

Abstract

The present invention has for its object to provide a method for securing the travel of a rail vehicle over a section of a rail network, with a high level of security SIL4 and at the same time a high flexibility in the route utilization can be achieved. This object is achieved according to the invention by a method for securing a journey of a rail vehicle or rail vehicle network - hereinafter generally referred to as rail vehicle - over a section of a rail network, in which: a) the current position of the rail vehicle and evaluated for the rail vehicle by a guidance system driving criteria are evaluated and a shelter is determined to the front, and b) the arranged in the section of the track network infrastructure elements are mapped in a track plan principle and starting from the position of the rail vehicle and the driving criteria respectively always the next or the Fahrwegelemente including. The protective space laterally granting infrastructure elements, the outside of the already reserved for the journey travel plus of the shelter to the front, in the position and extent required for the journey clearly reserved for the identity of this rail vehicle and, if necessary, be set. In this way, the Fahrstrasseninstanzen known from the currently known security procedures and start-destination element instances with their backup logic functionalities can be completely eliminated because the backup logic is now train-oriented and no longer stretch-oriented and Fahrwegelemente for the train ride only in relation to the one or the next Outside of the determined shelter forward infrastructure elements reserved for a certain extent the journey (locks), so that the reservation can be made immediately available for other train journeys even after crossing at present track vacancy of a certain extent. Thus, neither the circuit board side nor the control system side, the information on the entire reservation of a road replaced and kept current, resulting in driving to the fact that the individual infrastructure elements less long for a specific train journey reserved (locked) must be and thus much earlier or longer for a reservation by other trains are available. Thus, on the one hand, a higher throughput on the route and on the other a reduction in the complexity of today's interlocking and control system logic brought about, which is especially for conversions of the line or new parts of track parts in the existing infrastructure significantly to the saving of engineering expenses and necessary Expenses for admission leads.

Description

The present invention relates to a method for train-oriented safety logic for railway safety systems.

The track-side safety systems (interlocking, RBC, and to some extent also control technology) must guarantee railway traffic both safe and trouble-free operation and optimum support of the operating processes. The capacity requirements (throughput) have increased before and since the introduction of electronic security systems and will continue to increase as a result of social development. At the same time, the demand for cheaper and less complex solutions (cost pressure from infrastructure managers) is in the air.

For orientation, in which part of a railway safety system the invention proposed here works, is an overview of the current structure of safety systems and a possible simplified structure for the future in FIG. 1 shown. The inventions proposed below aim to significantly reduce the SIL 4 fraction of a railway safety system while maintaining the safety level according to the prior art and to point out the resulting opportunities.

$$2.\mathrm{Thales}:\mathrm{Stellwerk\; Elektra\; II}+\mathrm{RBC\; Thales}+\mathrm{Leittechnik\; Iltis}$$

There are several variants of several manufacturers for the electronic trackside safety systems. Related to the customer SBB (infrastructure operator with one of the highest train density densities in Europe) these are the following: $$1.\mathrm{Siemens}:\mathrm{Interlocking\; Simis\circledR \; W\; CH}+\mathrm{RBC\; Trainguard\circledR }200\mathrm{RBC}+\mathrm{Control\; technology\; Iltis\circledR }$$

$$\mathrm{Second}\mathrm{Thales}:\mathrm{Interlocking\; Elektra\; II}+\mathrm{RBC\; Thales}+\mathrm{Control\; technology\; Iltis}$$

These interlockings are based either on the original track plan principle (Simis® W CH) or on the original one Closing plan principle (Elektra II), whereby the implementation of these principles is no longer in a pure form due to the possibilities in the electronic systems and the tools to provide them.

Common to both approaches is that every possible maneuvering and train ride on road authorities is handled. In this case, the driveway is the ordered set of all relevant instances of turnouts, track sections, etc., which form the driveway from a possible start to a next possible destination.

This applies in particular to the control technology and the central part of the interlocking (component IIC / OMC in Simis® W CH) or to the entire interlocking (Elektra II). The RBCs of both manufacturers are more in line with the track plan principle, but in any case they rely on reliable information from the respective interlocking, which in turn is based on the og. Fahrstrasseninstanzen be determined.

The number of lane entities and their combinations (multiple consecutive lanes) accounts for a significant portion of the data from the backup system. The infrastructure data of road authorities must be consistent with the underlying outdoor facilities, as they declare the continuity and freedom from interruption of traffic routes and thus bear safety responsibility (SIL 4). Therefore, in the case of conversions and extensions - in addition to the individual elements such as points, etc. - they must always be consistently maintained and checked for completeness and correctness.

In the previous increases in capacity (both with ETCS L0 or L1LS as well as with ETCS L2), the approach was pursued even more sections of the route by the division with other start and end elements (optical signals or ETCS stop signals / ETCS location signals, EHS / ESS for short). This results in a much higher number of signals and driving street instances and their combinations and has a negative effect on the controllability of this data.

Ideas for ETCS L3 go one step further and try to find in some approaches the optimal length of these and even more additional driving directions (Virtual Subsectioning, Virtual Block). However, the only criterion used in these approaches is often the improvement of the headway between two trains, especially at higher speeds. Moving Block is hardly considered to be an added value in this area in the context of driving in absolute braking distance and for driving in the relative braking distance at high speeds, the risks are still judged to be too high. However, what is missing in these approaches is the development and provision of new criteria for optimal operation (both train sequence, timetable and energy consumption) at moderate speeds in complex, crowded areas.

The complexity has also been increased in the existing electronic trackside safety systems insofar as new types of roadway (emergency train route, follow-up train route, return train route, etc.) and other functions for ETCS L2 have been introduced at the request of the infrastructure manager SBB. In addition, the distribution of interlocking and RBC leads to increased complexity, since it is these new functionalities that cause cross-dependencies between these two subsystems.

SBB itself, as an infrastructure manager, is aiming for a proprietary development due to the above-mentioned cost pressure, which has become known under the keyword "NextGen" and, among other things, some of the above-mentioned problems with the existing technology of security systems addressed. In this context, a new approach proposes a "risk-based, geometric security logic". This approach deals very intensively with the risk assessment function based on the concept of hazard areas, which consist either of the part of the topology required for a train, including shelters, or of areas in which non-controllable activities take place or where disruptions exist. However, an instantiable model is not defined in which one can recognize how these properties of the hazard areas and the risk assessment function are arranged and executed or guaranteed at runtime. Furthermore, the special operational cases (emergency operations, bypasses) that are anchored in today's operating processes are not sufficiently taken into account.

The present invention is therefore based on the object of specifying a method for securing the travel of a rail vehicle over a section of a rail network, with which a high level of security according to SIL4 and at the same time a high flexibility in the route utilization can be achieved.

1. a) die aktuelle Position des Schienenfahrzeugs und die für das Schienenfahrzeug von einem Leitsystem vorgegebenen Fahrtkriterien ausgewertet werden und ein Schutzraum nach vorne bestimmt wird, und
2. b) die im Abschnitt des Gleisnetzes angeordneten Fahrwegelemente in einem Spurplanprinzip abgebildet sind und ausgehend von der Position des Schienenfahrzeugs und den Fahrtkriterien jeweils immer das oder die nächsten Fahrwegelemente inkl. der den Schutzraum seitlich gewährenden Fahrwegelemente, die ausserhalb des bereits für die Fahrt reservierten Fahrwegs zuzüglich des Schutzraums nach vorne liegen, in der für die Fahrt erforderlichen Stellung und Ausdehnung eindeutig für die Identität dieses Schienenfahrzeuges reserviert und ggfs. eingestellt werden.

This object is achieved according to the invention by a method for securing a journey of a rail vehicle or rail vehicle network - hereinafter generally referred to as rail vehicle - over a section of a rail network, in which:

1. a) the current position of the rail vehicle and evaluated for the rail vehicle by a guidance system driving criteria are evaluated and a shelter is determined to the front, and
2. b) the arranged in the section of the track network infrastructure elements are mapped in a track plan principle and starting from the position of the rail vehicle and the driving criteria respectively always the next or the next infrastructure elements including the protection space laterally granting infrastructure elements outside of the already reserved for the journey roadway plus the shelter forward, in the required position and extent for the journey clearly reserved for the identity of this rail vehicle and possibly adjusted.

In this way, the known from the currently known safety procedures Fahrstrasseninstanzen and the required start-destination element instances can be completely eliminated because the backup logic is now train-oriented and no longer stretch-oriented and Fahrwegelemente for the train ride only in relation to the next or outside the determined protection space for forward driving elements for a certain extent for the passage reserved (locks), so that the reservation can be made immediately after crossing the existing track vacancy again for other train trips available. Thus, neither the circuit board side nor the control system side, the information on the entire reservation of a road replaced and kept current, resulting in driving to the fact that the individual infrastructure elements less long for a specific train journey reserved (locked) must be and thus much earlier or longer for a reservation by other trains are available. Thus, on the one hand, a higher throughput on the route and on the other a reduction in the complexity of today's interlocking and control system logic brought about, which is especially for conversions of the line or new parts of track parts in the existing infrastructure significantly to the saving of engineering expenses and necessary Expenses for admission leads.

In an advantageous embodiment of the present invention, it may be provided that the reservation for the run over by the rail vehicle track elements or for a certain extension of which is lifted if one Track associated with track element, whether by way of obtaining the information of the position and integrity of the train and / or be it by way of determined by an axle counting and / or track circuit idle state, the free state for the associated with the track element free field section or for a determines certain extent of this. In this way, the infrastructure elements can very quickly be made available again for other reservations or for an extension of the reservation for a railroad vehicle taking the same route.

A particularly safety-relevant criterion with regard to the most dense sequence of trains is the current braking distance of a rail vehicle. It therefore makes sense if the current braking distance length flows into the determination of the length of the protective space to the front.

Driving criteria can sometimes cause very different safety regimes for securing the travel of a rail vehicle. It is therefore very advantageous with regard to the flexibility of the train-oriented safety logic if one or more process variables, such as desired speed, timetable stability and distance length, can be selected as travel criteria.

With regard to the train-oriented safety logic, it is particularly advantageous if a unique train system side addressable train instance is formed from the position of the rail vehicle and the identity of the on-board unit. In this way, the rail vehicle linked to this train instance can be secured in a train-oriented manner in accordance with the travel criteria selected for the rail vehicle. The Zuginstanz are therefore assigned the secured infrastructure elements, which thus allows an update existing reservations of infrastructure elements for subsequent rail vehicles. For this purpose, it is particularly expedient if the train instances successive Rail vehicles are linked when claiming the same infrastructure elements in a corresponding position and orientation and this link is deleted when no longer corresponding position or orientation. In this way, existing reservations can be extended without the interlocking or control system side, a new examination of the position of the infrastructure elements would be required.

Further advantageous embodiments of the present invention can be taken from the remaining subclaims.

• Figur 1 in schematischer Darstellung die Struktur von heute bestehenden Bahnsicherungsanlagen und einer zukünftigen mit Zuginstanzen arbeitenden zugorientierten Sicherungslogik;
• Figur 2 in schematischer Darstellung eine Beispieltopologie für einen Teil eines Bahnnetzes mit einem Ausschnitt des Spurplans bezüglich eines auf diesem Teil verkehrenden Zuges;
• Figur 3 in schematischer Darstellung einen Ablauf zur Plausibilisierung und Reservierung für den Start des in Figur 2 dargestellten Zuges bezüglich seiner Startfreigabe und seinen Fahrweg sowie der erforderlichen Reservierung von Schutzräumen;
• Figur 4 in schematischer Darstellung eine Überwachung des Fahrwegs und der zugehörigen Schutzräume der in Figur 3 gezeigten Zugfahrt sowie das Verfahren zur Bildung der Fahrerlaubnis (Movement Authority MA);
• Figur 5 in schematischer Darstellung Auswirkungen bei einem Überwachungsentfall auf den Fahrweg und den Schutzraum sowie eine zugehörige Kürzung der Fahrerlaubnis (EoA = End of Authority); und
• Figur 6 in schematischer Darstellung einen Betriebsablauf mit einem Schwerpunkt auf Folgefahrten und die "Vererbung" von bereits erstellten Reservierungen für Fahrwegelemente zugunsten einer nachfolgenden Zugfahrt.

Preferred embodiments of the present invention will be explained in more detail with reference to the attached drawings. Showing:

• FIG. 1 a schematic representation of the structure of today existing railway safety systems and a future train-based train-oriented backup logic;
• FIG. 2 a schematic representation of an example topology for a part of a railway network with a section of the track plan with respect to a train running on this part;
• FIG. 3 in a schematic representation a process for plausibility and reservation for the start of in FIG. 2 illustrated train with respect to its take-off clearance and its route and the required reservation of shelters;
• FIG. 4 a schematic representation of a monitoring of the infrastructure and the associated shelters of in FIG. 3 shown train journey and the procedure for the formation of the driving license (Movement Authority MA);
• FIG. 5 in a schematic representation effects in a monitoring incident on the infrastructure and the shelter as well an associated reduction of the driving license (EoA = End of Authority); and
• FIG. 6 a schematic representation of an operating sequence with a focus on follow-on trips and the "inheritance" of already created reservations for infrastructure elements in favor of a subsequent train ride.

Train-oriented route safety logic makes a number of basic assumptions:

A - Basic track plan principle

As previously customary, track element instances of track elements, such as switches, track sections, and intersections, are managed by a backup logic entity. These track elements are arranged according to the track plan principle in the order and linked, as they are also in the outdoor area.

1. a) Eindeutigkeit des Fahrwegs zwischen zwei Weichen/Kreuzungen;
2. b) maximale Zuglänge für Streckengleise;
3. c) maximale Länge für Gleisfreimeldetechnik, sofern erforderlich; und
4. d) Aufstellungsort von EHS/ESS in der Aussenanlage.

In the track sections, only the minimum required sections are managed as far as possible. Criteria for this are:

1. a) Uniqueness of the route between two points / intersections;
2. b) maximum train length for railroad tracks;
3. c) maximum length for train detection technology, if required; and
4. d) Location of EHS / ESS in the outdoor area.

Thus, the number of EHS / ESS is limited to the operationally necessary measure. Start-target-element instances (signals) with back-up logic functionality for outdoor EHS / ESS are no longer needed in the new approach.

At the interfaces to old gearboxes with ETCS L0 or L1LS, start-target-element instances (also without Backup logic functionality, only with setting and monitoring logic) still required, eg in connection with FAP or block. However, they can also be integrated according to the tracking plan principle.

Level crossings and their effects on each track, which lies within the influence of the respective level crossing, can also be integrated in an adequate representation according to the track plan principle.

The neighborhood relationships arising from the track plan principle are used as the basis for the communication of the route safety logic (see also the neighboring ports in FIG. 2 ). In the process, close dependencies between direct neighboring path elements are consistently evaluated and monitored. Remote dependencies, if necessary, are evaluated and monitored by recursion or propagation along neighborhood relationships. In addition to the neighborhood relationships, the infrastructure elements have links to control technology, trains and GFM information (see the other ports in FIG. 2 ).

B - Train / shunting authorities instead of road authorities

Instead of driving road authorities, train or shunting authorities are now managed in the new route safety logic. The basis of these instances are the identity of the vehicle unit (onboard unit ID number or also briefly OBU ID) and the respectively assigned train numbers. Train instances can also be linked with each other to coordinate and monitor follow-up trips or counter-journeys, if permitted. Nevertheless, in order to be able to guarantee the continuity and absence of interruption of valid routes, a plausibility principle is derived as a complete replacement (see point F below).

C - Abstraction of the type of track vacancy / position report

1. a) Einfache Freimeldeinformation: {frei | belegt | gestört}
2. b) Gerichtete Freimeldeinformation: {keine Information | Richtung1 | Richtung 2 | beide}
3. c) Geometrische Freimeldeinformation: {keine Information | Belegte Länge ab Strang x | Belegte Länge bis Strang x} , je nach Fahrwegelement gibt es üblicherweise 2 bis 4 Stränge

The type of track vacancy (conventionally with axle counters and track circuits or with ideally reliable, safe position messages of all possible located near the track objects and people) is abstracted modeled so that the new track safety logic according to the existing track-free signaling technology (locally different, depending on the expansion phase, needs) more conservative or progressive. The information on the infrastructure elements is abstracted and normalized, ie independent of the specific type of track vacancy realized on the track:

1. a) Simple clearance information: {free | occupied | disturbed}
2. b) Judicial clearance information: {no information | Direction1 | Direction 2 | both}
3. c) Geometric free message information: {no information | Occupied length from strand x | Occupied length to strand x}, depending on the track element, there are usually 2 to 4 strands

With conventional means, e.g. Only the basic free field information is provided free / occupied / disturbed, for the directional and geometrical free message information no information is valid here. With each higher-value free message information available, the low-order free message information can be simulated. If a higher-level clearance information is not available, then this applies to {no information}.

The more detailed position reports reliably available, the finer granular (optimal in terms of capacity), the new train-oriented route safety logic to edit the monitoring. As long as a simple indicia information is safe, this is especially when Free messages also used directly, as they may be available earlier, depending on the frequency of position reports.

D - Only one route safety logic

The new train-oriented route safety logic is realized without a separation into a "signal box" and "RBC" part. The interfaces required for interoperability with the on-board units (OBUs) and thus with the trains, i. the Euroradio protocol and the telegram content and procedures in accordance with the ETCS specifications will be maintained in a compatible manner and the information of the trains via this interface will be used consistently.

The necessary interfaces for exteriors to turnouts, level crossings, train detection systems (either core interfaces for old signal boxes from cable termination rack or RaSTA with standardized interface protocols for electronic signal boxes) will be continued compatible or supplemented backward compatible.

E - reduction of the SIL 4 share

The interface to and from the control technology is being fundamentally changed, since the traffic route authorities no longer exist. Tasks, which have only controlling character, are outsourced to the control technology, since they alone are not security-relevant.

In the new train-oriented route safety logic only those parts are arranged, which must necessarily be SIL 4. The proportion SIL 4 is already greatly reduced for this reason alone.

The components in the control technology, which are closely related to safety-relevant functions in the new train-oriented route safety logic, will continue to meet approximately SIL 2 in terms of process safety have to. However, this proportion can also be made compact and reduced. An unbundling of SIL2 and SIL0 shares can be achieved here. Overall, this is schematic in FIG. 1 illustrated.

F - Very simplified route safety logic

The modeled infrastructure elements receive their reservation orders with the required parameters: train number, OBU ID, orientation (direction 1, 2), position (left, right) for turnouts, intersections, reserved length (from / to position), target speed, further parameters, if required directly from the control technology.

In FIG. 3 Based on this, the basic process for reservation orders and for the plausibility of the start or of another infrastructure element during an existing trip is shown. Further track extensions result from the recursion of the subsequently derived principles for the plausibility check and the shelters.

1. a) Anmeldung des betreffenden Zuges via interoperable ETCS-Schnittstelle von der OBU in der zugorientierten Streckensicherungslogik und Zuordnung zu einer entsprechenden Zuginstanz
2. b) Meldungen der Zuginstanz in der zugorientierten Streckensicherungslogik an die Leittechnik über die Anmeldung inkl. Movement Authority-Request, kurz MA-Request
3. c) Ermittlung des Sollfahrweges und ggf. der Sollgeschwindigkeit aus dem fortwährend optimierten Fahrplan (Produktionsplanung) und weiteren allgemeinen und der momentanen Situation entsprechenden dispositiven Kriterien und sowie aus der Kenntnis der Topologie der Station/Strecke heraus.

Prerequisite for in FIG. 3 The scenarios presented are the following:

1. a) Registration of the train in question via interoperable ETCS interface of the OBU in the train-oriented route safety logic and assignment to a corresponding train instance
2. b) Notifications of the train instance in the train-oriented route safety logic to the control system via the registration incl. Movement Authority Request, in short MA request
3. c) Determination of the desired driving distance and possibly the target speed from the continuously optimized timetable (production planning) and further general and the current situation corresponding dispositive criteria and out of the knowledge of the topology of the station / route out.

A reservation of a route element is considered to be valid primarily if there is no other reservation of the considered route element at the time of it, or in other words that no other reservation is managed by the train-oriented route assurance logic. Exception rules for this basic rule can be defined for special cases.

For the plausibility of the guideway the train number (can change with identical OBU ID), OBU ID, orientation, position and length (from / to position) are required. The rules and the result of the plausibility check in general form are shown in the decision table in Table 1. Table 1: Decision table plausibility guideline; R stands for rule Conditions B R 1 R 2 R 3 R 4 R 5 R 6 R 7 B1: Route element <UUID_FWE> is reserved in the direction of <Ri_FWE> and position <La_FWE> N J J J J J J B2: Length of reservation in this direction <Ri_FWE> and location <La_FWE> is valid until the end of this route element - N J J J J J B3: There is a neighboring route element <UUID_NFWE> in direction <Ri_FWE> - - N J J J J B4: This neighboring travel route element <UUID_NFWE> is validly reserved in a direction <Ri_NFWE> suitable for the travel route element and appropriate location <La_NFWE> - - - N J J J B5: Length of reservation in this direction <Ri_NFWE> and location <La_NFWE> applies from the beginning of this adjacent route element - - - - N J J B6: Train number and OBU ID are identical for this route element and this adjacent route element - - - - - N N J Result A1: Track in track element <UUID_FWE> is not valid x A2: Track is valid only within the track element <UUID_FWE> x x x x x A3: The route is valid from the route element <UUID_FWE> to the adjacent route element <UUID_NFWE> x Legend to Table 1: - FWE: Track element
- NFWE: adjacent pathway element
- <UUID_FWE>, <UUID_NFWE>: universally unique identification number
- <Ri_FWE>, <Ri_NFWE>: direction {Ri1 = typically to the right, Ri2 = typically to the left}
- <La_FWE>, <La_NFWE>: Location {not relevant, left, right}

Note on condition B4: <Ri_FWE> and <Ri_NFWE> must generally be identical. However, due to a track loop or a track triangle (e.g., Zurich Hardbrücke), a change in direction may occur at certain points in a rail network. Therefore, the two directions must be appropriate to each other, but not identical in each case. Directional jumps must be stored in the track plan. The same applies to jumps in the kilometer. Only when all conditions B1 to B6 and thus the rule R7 are met, can it come to the result A3, which affirms the validity of the route from the current track element to the adjacent track element.

Table 2 shows an FMEA regarding the individual errors to be considered in the reservation orders. The combinations of several individual errors also lead to the disclosure of discrepancies. Table 2: FMEA for plausibility test Track with regard to single fault Reservation track element Reservation of the adjacent route element Result rule comment G3 (train A, OBU ID A, Ri1, until the end) W9 (train A, OBU ID A, Ri1, left, from the beginning) A3 R7 OK W9 (train A, OBU ID C, Ri1, A2 R6 Wrong OBU ID left, from the beginning) transfer W9 (train F, OBU ID A, Ri1, left, from the beginning) A2 R6 Transfer wrong train number W9 (train A, OBU ID A, Ri1, left, from 50m to the beginning) A2 R5 Transfer position offset by 50m, gap, therefore, not plausible W9 (train A, OBU ID A, Ri1, left, before start) A2 R5 Position outside of adjacent driving element, overlap, nevertheless not plausible W9 (train A, OBU ID A, Ri2, left, from the beginning) A2 R4 Transfer wrong direction W9 (train A, OBU ID A, Ri1, right, from the beginning) A2 R4 Wrong situation transferred G11 (train A, OBU ID A, Ri2, until the end) any A2 R3 End of topology G3 (train A, OBU ID A, Ri1, until 50m before the end) W9 (train A, OBU ID A, Ri1, left, from the beginning) A2 R2 Transfer position offset by 50m, gap, therefore, not plausible G3 (train A, OBU ID A, Ri1, after the end) W9 (train A, OBU ID A, Ri1, left, from the beginning) A2 R2 Position outside of track element, overlap, nevertheless not plausible no reservation G3 any A1 R1 Track element was not or it was reserved a completely different infrastructure element

With the principle derived from Table 1 and the findings from Table 2, a "safe" plausibility check of valid routes is basically possible (SIL 4 task). This is all the more important because the tax task, when and where a train / a Shunting maneuver is to be outsourced from the route safety logic (SIL 0 task). "Safe" formulated road traffic authorities according to the state of the art are therefore no longer required.

An additional plausibility check is additionally evaluated for the start, which however depends on the quality of the track vacancy information and a valid position message (see also point C). The rules and the result of the plausibility check in general form are shown in the decision table in Table 3. Table 3: Decision table plausibility check Start; R stands for rule conditions R 1 R 2 R 3 R 4 R 5 R 6 R 7 B1: Route element <UUID_FWE> is reserved in the direction of <Ri_FWE> and position <La_FWE> N J J J J J J B2: The conditions according to the "truth table plausibility guideline" rule R7 are not fulfilled for this track element as a neighboring track element - N J J J J J B3: For this route element, the simple clearance information is the same {occupied, disturbed} - - N J J J J B4: Geometric free message information is not equal for this route element {no information} - - - N J J J B5: Train number and OBU ID for this route element are also the source of the geometric free field information (position message of the train) - - - - N J J B6: Geometric free message information contains the position of the train with train number and OBU ID in the leading position for <Ri_FWE> - - - - - N J Result A1: Track element <UUID_FWE> is not valid as start x x x A2: Route element <UUID_FWE> is valid as start in mode SR (TAF) x x x A3: Track element <UUID_FWE> is valid as start in mode OS / FS x

Directed free message information is not relevant for the plausibility check Start, since all values are possible here, especially if the direction value does not correspond to the direction <Ri_FWE> (turning trip).

The position message of the train is only entered into the geometric clearance information if this position message satisfies sufficient criteria.

For the optimum protection space, the parameter target speed is primarily required. If the shelter can not be reached laterally according to the underlying rules (risk function, formulas, etc.), the speed will be reduced. If the shelter can not be reached according to the rules (risk function, formulas, etc.), the speed is reduced or the missing length is deducted from the reserved distance.

These rules can be formulated on the basis of a traditional backup logic as well as the approach of a possible "risk-based, geometric" backup logic. Common to these approaches is that they are much simpler and possible without special cases compared to today's security logic (technical dependencies, established and unadjusted regulations and rules, etc.) formulated.

In FIG. 4 is based on the process FIG. 3 the fundamental further process until the formation of a valid driver's license.

In FIG. 5 is based on the process FIG. 4 the effect of each case of a monitoring failure in the infrastructure and in a shelter shown.

Further properties and corresponding behavior in the train-oriented route safety logic

1. a) The train travels according to the issued MA (and possibly further optimizations ATO, etc.), the status and extent of which is also reported to the control system, and updated regularly and possibly balisen related position / speed / train integrity of the associated train instance in the track safety logic and also the control technology.
2. b) The Zuginstanz also provides a significant contribution to the abstracted track vacancy information.
3. c) The route safety logic can thus release the corresponding reservation of the infrastructure elements either as a whole after passing through the train connection or continuously release for subsequent train instances (depending on the quality of track vacancy and train integrity of the preceding train instance). These state changes are also immediately transmitted to the control technology so that it can make new decisions on an ongoing basis.
4. d) In particular, the position messages of the train instances from the route safety logic and the associated MA thus serve as a new basis for the train number advance, which is currently still based on assignments of Fahrwegelementinstanzen and stops signal instances.
5. e) If the control system for a follow-up train controls elements which are occupied by the preceding train or are monitored for the same in the same direction and position, the route safety logic links the train instance of the train with the train instance of the preceding train instance. A continuous monitoring of the distance is realized depending on the quality of the train free message information, position and speed message and train integrity.
6. f) If the control system for an already linked follow-on train directs track elements in another position, then this follow link is resolved. A monitor for the Following train is possible as soon as the adjustable track element occupies the new position.
7. g) controls the control (for dispositive reasons, eg unify) for a train on infrastructure elements, which are occupied by an oncoming train or monitored for this in the opposite direction, but the same situation, the route link logic links the Zuginstanz the return train with the Zuginstanz of the opposing Zuginstanz (as Gegenlink). Continuous monitoring of the distance is realized depending on the quality of track vacancy information, position and speed signal.

G - mixed operation ETCS L2 / L3

By the formulation formulated in points A, B, C, D, E and F, a mixed operation ETCS L2 and L3 can be realized. As long as a preceding train transmits its train integrity safely and the type of track release report has sufficient quality, the following train can follow in the ETCS L3 and, if necessary, in the relative braking distance.

H - exceptional situations, emergency operations, etc.

1. a) Langsamfahrstellen (TSRs) und Sperren, diese sollten jedoch möglichst ähnlich (Abstraktion als kategorisierte Belegung von differenzierter Qualität) gehandhabt werden, um unterschiedliche Spezialfunktionen zu vermeiden.
2. b) Notbedienungen auf einzelne Fahrwegelemente (Umgehung einer Weiche bzw. deren Flankenschutzes, eines Gleisabschnittes, etc.). Diese gelten nach heutigen Risikoakzeptanzkriterien jeweils nur für eine Zug-/Rangierfahrt. Durch derartige Notbedienungen können Besetzte Einfahrten oder Notzugfahrten gehandhabt werden, wobei auch hier eine Abstraktion im o.g. Sinne anzustreben ist.
3. c) Vereinigen/Trennen/Wenden ist ohne weitere Bedienungen mittels punktgenauer Bestimmung von Movement Authorities im Mode FS (ETCS Full Supervision) möglich.

Even in a future further automated, digitized and optimized operation exceptional situations and emergency operations are not completely excluded. The following features are provided for this purpose.

1. a) TSRs and locks, but these should be handled as closely as possible (abstraction as a categorized assignment of differentiated quality) in order to avoid different special functions.
2. b) Emergency operations on individual infrastructure elements (bypassing a switch or its flank protection, a track section, etc.). According to today's risk acceptance criteria, these apply in each case only to one train / maneuvering trip. Through such emergency operations Occupied entrances or Notzugfahrten be handled, and here, too, an abstraction in the above sense is desirable.
3. c) Unifying / separating / reversing is possible without further operations by means of pinpoint determination of Movement Authorities in Mode FS (ETCS Full Supervision).

I - Example of the Novel Interaction of Fahrwegelement- and Zuginstanzen in a single operation

In the following FIG. 6 is a section of an operating sequence with a focus on follow-up trips visible. It will be shown how the features shown under A to F act in the new train-oriented route safety logic.

Train A has a valid track towards track 400 and shelters and continues.
Train B has a valid track to turnout 7 (driveway and additional shelter at the front) and has just stopped.
Train C was originally followed by train B (with Folgelink) until the control center wanted to control turnout 3 in the other position (left). At this moment the Folgelink train C on train B was deleted. After train B had released the switch 3, this could be included in the track for train C and the track including the necessary shelters be further extended. In the extension to track 3 this is now driven for the same direction. As a result, the following link train C is set to train A. Continuous distance control comes into play as train A reports full train integrity. Train C can follow train A in the relative brake distance. The control system will also operate for train C as a result of turnout 9 and turnout 10, and due to the same position and direction the follow link to train A will remain. If train A finally releases track 3, the link of train instance A to track 3 is taken over by train instance C without interruption.
Train D has only one valid guideway incl. Additional shelter up to and including turnout 4. Despite requested turnout 5 (even if the left turn would already exist) the monitoring is denied there, because train D otherwise in the monitored for train C side shelter in the flank would invade. Switch 6 is also required, but can not be monitored for train D due to the current situation, which does not correspond to the requested position.

The additional shelter at the rear is defined by the Min Safe Front End, the train length, the train integrity and possibly a safety margin (this results in a Min Safe Rear End), shown for train A, C and D. In the absence or absence of train integrity, the additional shelter rear extended to the next track free reporting limit as a fallback level, shown for train B.

Advantages of feasibility, migration

By eliminating signal instances and Fahrstrasseninstanzen in the interlocking and in the control technology unnecessary data storage, which must be consistent avoided and therefore must not be checked and not maintained and maintained during conversions / extensions. Comparing the quantity structures to an example of a security system (Sion - Sierre, with level limits to L0 or L1 / LS at both interlocking limits) in Table 4 shows this impressively.

In addition to these advantages in the security system itself, the security system can also be planned much more efficiently and more easily by the infrastructure manager (eg planning expenses for SBB security systems up to process step SIOP-A). The associated complexity is therefore eliminated.

Experience has shown that there are often many clarifications and correction rounds until signal plans are stable.

Both effects lead directly to direct cost savings in the engineering of the safety systems and thus to savings in follow-up costs that result from delays caused by this work.

The EHS and ESS in the outdoor system listed in Table 4 in the last column only fulfill the function that the driver recognizes a defined breakpoint or point of view (especially in SR mode or in the event of a fault). In train-oriented route safety logic, this no longer plays an essential role in the safety logic functionality or merely manages the position. Table 4: Comparison of quantity structure using the example of the Sion - Sierre security system; SA stands for security system Element SA so far L0 or L1 / LS SA so far L2 SA new L3, virtual sections SA L2 / L3 with new train-oriented route safety logic track section 129 (signal box) 139 (signal box)
139 (RBC) 146 (signal box)
146 (RBC) 139 crossing 1 (signal box) 1 (signal box)
2 (RBC) 1 (signal box)
2 (RBC) 1 Soft / derailment device 109 (signal box) 109 (signal box)
109 (RBC) 109 (signal box)
109 (RBC) 109 Free reporting section 176 186 186 186 block 4 4 4 4 Dwarf signal (ZS) / ETCS shunting signal (ERS) 142 142 142 0 Main signals optically 100 8th 8th 8th ETCS stop signal (EHS) or ETCS location signal (ESS) in the outdoor area 0 113 155 113 Start-destination elements (signal, block) in the security system 193 (signal box) 214 (signal box)
214 (RBC) 256 (signal box)
256 (RBC) 8th Rangierfahrstrassen (including combinations, without detours) 1339 1339 1339 0 Train routes (including combinations, without detours) 1397 2047 about 3500 0

Note:

The number of train lines is based on the assumption that there is only one single route instance per elementary start-destination combination. This assumption is fulfilled for the Simis® W CH type of control box. For other types of interlocking, the number is higher because a separate route instance may be needed for each required train-route type. Detour rides are not considered in Table 4 because they are not handled by separate lane authorities.

In the new train-oriented route safety logic, the complexity is greatly reduced by the elimination of the route instances, the associated remote dependencies and by the outsourcing of the controlling share and minimization of the share SIL 4. This has a direct positive effect on the development of such route safety logic including all necessary work areas.

The fact that functionalities of the interlocking and RBC are only operated in a single route safety logic eliminates the duplication of data regarding the track topology (Track elements, signals) and the adjustment of element instances for data exchange via the interface. It also greatly reduces the complexity of features that require close collaboration between the two systems.

Benefits Effectiveness, performance, capacity

The track equipment with regard to the quality of track vacancy information can be built geographically selectively. In zones of dense traffic higher quality can be installed than in areas of low traffic. Likewise, the equipment installed on the vehicles for a more precise position indication can be selectively installed. For S-Bahn traffic in busy areas, e.g. all trains equipped with train integrity monitoring and equipment for more precise position reporting.

Due to the abstracted track vacancy information with high quality and the elimination of the fixed lane sections due to the signals, operation in the ETCS L3 up to driving in the relative braking distance can be realized. This can significantly increase the throughput of critical points. Driving under Full Supervision (FS) into a still occupied track by an already outgoing train is thus made possible. By comparison, running on L2 as it is today can only be done under On-Sight (OS), which inevitably leads to unwanted delays. Even with optical signaling this was already efficient, but with more residual risk, by means of a busy follow-up drive possible.

In addition, the effectiveness is achieved for each operating case. In contrast to a route layout with "planned optimized" sections of the route, inevitably in reality deviations from the plan arise (unexpected acceleration or braking behavior, operationally changing conditions), which no longer or only bad can be balanced, can react dynamically in any situation and get out the possible optimum.

Namely, it can be reacted at every position message and not only when a position message is reported such that thus a locally defined route section (real or virtual) is considered free again. The temporal discretization of the position message and a local discretization that does not correspond to it lead so far to additional delays in the entire control sequence. The elimination of local discretization in sections of the route eliminates such delays without replacement.

Advantages of feasibility, migration

The introduction of the new train-oriented route safety logic will be decoupled from the introduction of new (track-side) localization techniques and the upgrading of vehicles for L3 capability (train integrity, on-board localization techniques). Limiting the solution to the route safety logic and the control technology, an interoperable migration with various vehicles, which are at least L2-capable, possible. This is the case, for example, in Switzerland on the SBB rail network.

A later upgrade of more precise localization techniques and vehicle equipment does not require any adjustments to the new train-oriented route safety logic. It then acts if necessary simply simply more effective.

Due to the abstraction of track vacancy information, the timing of implementing a solution of the train-oriented route safety logic is independent of the development of smarter track free reporting techniques or more precise position reports. Once these are available, they can be used to make more capacity by optimizing their use.

Differentiation to alternatives

Alternatively, the trains could communicate even more self-sufficient with control devices on the track, so that the trackside share of the security system is further reduced. However, the control system would have to transmit track-side information to the trains. However, this requires new interfaces to the OBUs, which endangers interoperability, especially with ETCS. In addition, it is problematic to perform a plausibility of the guideway safely, making a successful safety case is questionable.

In local traffic, this would be a viable alternative in which e.g. the route knowledge is statically deposited on the vehicles, since each is a known topology and a limited, consistent and manageable number of vehicles in a closed system. In long-distance traffic, however, these boundary conditions do not apply.

Claims (6)

Method for securing a journey of a rail vehicle or rail vehicle network - hereinafter referred to as rail vehicle - over a section of a rail network, in which: a) the current position of the rail vehicle and evaluated for the rail vehicle by a guidance system driving criteria are evaluated and a shelter is determined to the front, and b) the arranged in the section of the track network infrastructure elements are mapped in a track plan principle and starting from the position of the rail vehicle and the driving criteria respectively always the next or the Fahrwegelemente including. The protective space laterally granting infrastructure elements, the outside of the already reserved for the journey travel plus of the shelter to the front, in the position and extent required for the journey clearly reserved for the identity of this rail vehicle and, if necessary, be set. A method according to claim 1, characterized in that the reservation for the runway elements driven over by the rail vehicle or for a certain extension of which is lifted when a track element associated track information, either by way of obtaining the information of the position and integrity of the train and / or whether it is determined by means of the free state determined by an axle counting system and / or track circuit, the free state for the free-field section associated with the track element or for a certain extent thereof. A method according to claim 1 or 2, characterized in that
in the determination of the length of the shelter forward to the current braking distance length flows. Method according to one of the preceding claims,
characterized in that
as driving criteria one or more process variables, such as target speed, timetable stability and distance length, are selectable. Method according to one of the preceding claims,
characterized in that
from the position of the rail vehicle and the identity of the on-board unit, a unique train system side addressable train instance is formed. Method according to claim 5,
characterized in that
the train instances of successive rail vehicles are linked when the same track elements are loaded in a corresponding position and orientation, and this link is deleted when the position or orientation no longer corresponds.

Images