EP3541682B1 - Train-oriented line safety logic for railway safety systems - Google Patents

Description

The present invention relates to a method for train-oriented safety logic for railway safety systems.

The trackside safety systems (signal box, RBC, in some cases also control technology) must ensure both safe signaling and smooth operations for rail traffic and optimally support the operational processes. The demands regarding capacity (throughput) have increased before and since the introduction of electronic security systems and will continue to increase due to social developments. At the same time, there is a demand for cheaper and less complex solutions (cost pressure from infrastructure operators).

To help you determine in which part of a railway safety system the invention proposed here works, an overview of the current structure of safety systems and a possible simplified structure for the future is provided Figure 1 shown. The inventions proposed below aim to significantly reduce the SIL 4 proportion of a railway safety system while maintaining the safety level according to the state of the art and to demonstrate the resulting opportunities.

1. 1. Siemens: Stellwerk Simis^® W CH + RBC Trainguard^® 200 RBC + Leittechnik Iltis^®
2. 2. Thales: Stellwerk Elektra II + RBC Thales + Leittechnik Iltis Diese Stellwerke basieren entweder auf dem ursprünglichen Spurplanprinzip (Simis^® W CH) oder auf dem ursprünglichen Verschlussplanprinzip (Elektra II), wobei aufgrund der Möglichkeiten in den elektronischen Systemen und den Tools zu deren Bereitstellung die Umsetzung dieser Prinzipien nicht mehr in reiner Form erfolgt.

There are several versions of electronic trackside safety systems from several manufacturers. In relation to the customer SBB (infrastructure operator with one of the highest train densities in rail transport in Europe) these are the following:

1. 1. Siemens: Simis ^® W CH signal box + RBC Trainguard ^® 200 RBC + Iltis ^® control technology
2. 2. Thales: Elektra II signal box + RBC Thales + Iltis control system These signal boxes are based either on the original track plan principle (Simis ^® W CH) or on the original closure plan principle (Elektra II), although due to the possibilities in the electronic systems and the tools to provide them, these principles are no longer implemented in a pure form.

What both approaches have in common is that every possible shunting and train journey is handled via route instances. The route is the ordered set of all relevant instances of switches, track sections, etc., which form the route from a possible start to the next possible destination. This state of the art is, for example, in European patent application EP 0 105 182 A2 shown where block formations implemented in relay signal boxes are provided for route elements and all route elements belonging to this block are simply reserved for the train, regardless of its position within the respective block, and blocked for all other train journeys.

This applies in particular to the control technology and the central part of the signal box (component IIC/OMC for Simis ^® W CH) or for the entire signal box (Elektra II). The RBCs of both manufacturers tend to follow the lane planning principle, but are in each case based on reliable information from the respective signal box, which in turn is determined on the basis of the above-mentioned route instances.

The number of route instances and their combinations (several consecutive routes) makes up a significant part of the security system data. The route data of route instances must be consistent with the underlying external system, as it ensures continuity and declare that routes are uninterrupted and thus bear safety responsibility (SIL 4). Therefore, during conversions and extensions - in addition to the individual elements such as switches, etc. - they must always be maintained consistently and checked for completeness and correctness.

In the previous capacity increases (both with ETCS L0 or L1LS as well as with ETCS L2), the approach was to create even more route sections by subdividing them with additional start and destination elements (optical signals or ETCS stop signals/ETCS location signals, in short EHS/ESS). This requires a much higher number of signals and route instances and their combinations and has a negative impact on the controllability of this data.

Ideas for ETCS L3 go one step further and attempt to determine the optimal length of these and even more additional route instances in some approaches (Virtual Subsectioning, Virtual Block). However, the only criterion used in these approaches is often the improvement of the headway between two trains, especially at higher speeds. In this area, moving block is hardly considered to be an added value in view of driving in the absolute braking distance and the risks are still judged to be too high for driving in the relative braking distance at high speeds. However, what is neglected in these approaches is the development and provision of new criteria for optimal operation (both train sequence, timetable and energy consumption) at moderate speeds in complex, densely trafficked zones.

The complexity was also increased in the existing electronic, trackside safety systems in that new route types (emergency train route, following train route, oncoming train route, etc.) and further functionalities for ETCS L2 were introduced at the request of the infrastructure operator SBB. In addition, the division of the signal box and RBC leads to increased complexity, as these new functionalities cause cross-dependencies between these two subsystems.

Due to the above-mentioned cost pressure, the SBB itself as an infrastructure operator is striving for its own development, which has become known under the keyword "NextGen" and, among other things, some of the above-mentioned problems with the existing technology of security systems are addressed. In this context, a “risk-based, geometric security logic” is proposed as a new approach. This approach deals very intensively with the risk assessment function based on the concept of danger areas, which either consist of the portion of the topology required for a train, including protective spaces, or of areas in which uncontrollable activities take place or there are disruptions. However, no instantiable model is defined that shows how these properties of the danger areas and risk assessment function are classified and processed or guaranteed at runtime. Furthermore, the special operational cases (emergency operations, workarounds) that are anchored in today's operating processes are not yet sufficiently taken into account.

The present invention is therefore based on the object of specifying a method for securing the travel of a rail vehicle over a section of a track network with which a high Safety level according to SIL4 and at the same time a high level of flexibility in route use can be achieved.

1. a) während der Fortbewegung des Schienenfahrzeugs die aktuelle Position des Schienenfahrzeugs und die für das Schienenfahrzeug von einem Leitsystem vorgegebenen Fahrtkriterien ausgewertet werden und ein Schutzraum nach vorne bestimmt wird, und
2. b) die im Abschnitt des Gleisnetzes angeordneten Fahrwegelemente in einem Spurplanprinzip abgebildet sind und ausgehend von der Position des Schienenfahrzeugs und den Fahrtkriterien jeweils immer das oder die nächsten Fahrwegelemente inkl. der den Schutzraum für diese nächsten Fahrwegelemente seitlich gewährenden Fahrwegelemente, die ausserhalb des bereits für die Fahrt reservierten Fahrwegs zuzüglich des zuvor bestimmten Schutzraums nach vorne liegen, in der für die Fahrt erforderlichen Stellung und Ausdehnung eindeutig für die Identität dieses Schienenfahrzeuges reserviert und ggfs. eingestellt werden.

According to the invention, this object is achieved by a method for securing a journey of a rail vehicle or rail vehicle group - hereinafter referred to as a rail vehicle - over a section of a track network, in which:

1. a) while the rail vehicle is moving, the current position of the rail vehicle and the travel criteria specified for the rail vehicle by a control system are evaluated and a protective space to the front is determined, and
2. b) the route elements arranged in the section of the track network are mapped in a track plan principle and, based on the position of the rail vehicle and the travel criteria, always the next route element or elements, including the route elements that laterally provide the protective space for these next route elements, which are outside the already for the The route reserved for the journey, plus the previously determined protective space, lies to the front, in the position and extent required for the journey, clearly reserved for the identity of this rail vehicle and, if necessary, adjusted.

In this way, the route instances known from today's known security procedures and the start-destination element instances required for them can be completely eliminated because the security logic now works train-oriented and no longer route-oriented and route elements for the train journey only relate to the next one or more outside the The determined protective area at the front is reserved (blocked) for traffic for a certain extent, which means that the reservation can be immediately made available again for other train journeys even after the crossing if the track is available. With it Neither the signal box nor the control system side need to exchange information about the entire reservation of a route and keep it up to date, which means that the individual route elements have to be reserved (locked) for a shorter period of time for a particular train journey and therefore much earlier or longer for one Reservation through other trains are available. On the one hand, this results in a higher throughput on the route and, on the other hand, a reduction in the complexity of today's signal box and control system logic, which significantly saves engineering costs and necessary costs, especially when converting the route or building new sections of the route into the existing infrastructure expenses for admission.

In an advantageous development of the present invention, it can be provided that the reservation for the track elements passed over by the rail vehicle or for a certain extent thereof is canceled if one of the Track clearance message assigned to the track element, be it by means of receiving the information about the position and integrity from the train and/or be it by way of the clearance status determined by an axle counting system and/or track circuit, the clearance status for the clearance detection section associated with the track element or for one determines a certain extent of this. In this way, the route elements can be made available again very quickly for other reservations or for an extension of the reservation for a rail vehicle taking the same route.

A criterion that is particularly relevant to safety when it comes to keeping trains as dense as possible is the current braking distance of a rail vehicle. It therefore makes sense if the current braking distance is taken into account when determining the length of the protective space to the front.

Driving criteria can sometimes result in very different safety regimes to ensure the safety of a rail vehicle's journey. Therefore, with regard to the flexibility of the train-oriented safety logic, it is very advantageous if one or more process variables, such as target speed, timetable stability and distance length, can be selected as travel criteria.

With regard to the train-oriented security logic, it is particularly advantageous if a unique train instance that can be addressed on the control system side is formed from the position of the rail vehicle and the identity of the onboard unit. In this way, the rail vehicle linked to this train instance can be secured in a train-oriented manner according to the travel criteria selected for the rail vehicle. The secured route elements are therefore assigned to the train instance, which also enables existing reservations of route elements for subsequent rail vehicles to be updated. For this purpose, it is particularly useful if the train instances are consecutive Rail vehicles are linked in the corresponding position and orientation when the same track elements are used and this link is deleted when the position or orientation no longer corresponds. In this way, existing reservations can be extended without the need for a new check of the position of the route elements on the signal box or control system side.

Further advantageous embodiments of the present invention can be found in the remaining subclaims.

• Figur 1 in schematischer Darstellung die Struktur von heute bestehenden Bahnsicherungsanlagen und einer zukünftigen mit Zuginstanzen arbeitenden zugorientierten Sicherungslogik;
• Figur 2 in schematischer Darstellung eine Beispieltopologie für einen Teil eines Bahnnetzes mit einem Ausschnitt des Spurplans bezüglich eines auf diesem Teil verkehrenden Zuges;
• Figur 3 in schematischer Darstellung einen Ablauf zur Plausibilisierung und Reservierung für den Start des in Figur 2 dargestellten Zuges bezüglich seiner Startfreigabe und seinen Fahrweg sowie der erforderlichen Reservierung von Schutzräumen;
• Figur 4 in schematischer Darstellung eine Überwachung des Fahrwegs und der zugehörigen Schutzräume der in Figur 3 gezeigten Zugfahrt sowie das Verfahren zur Bildung der Fahrerlaubnis (Movement Authority MA);
• Figur 5 in schematischer Darstellung Auswirkungen bei einem Überwachungsentfall auf den Fahrweg und den Schutzraum sowie eine zugehörige Kürzung der Fahrerlaubnis (EoA = End of Authority); und
• Figur 6 in schematischer Darstellung einen Betriebsablauf mit einem Schwerpunkt auf Folgefahrten und die "Vererbung" von bereits erstellten Reservierungen für Fahrwegelemente zugunsten einer nachfolgenden Zugfahrt.

Preferred exemplary embodiments of the present invention are explained in more detail with reference to the accompanying drawings. Show:

• Figure 1 a schematic representation of the structure of existing railway safety systems and a future train-oriented safety logic working with train instances;
• Figure 2 a schematic representation of an example topology for a part of a railway network with a section of the track plan relating to a train running on this part;
• Figure 3 a schematic representation of a process for plausibility checks and reservations for the start of the in Figure 2 the train shown regarding its start clearance and route as well as the required reservation of shelters;
• Figure 4 a schematic representation of monitoring of the route and the associated shelters of the in Figure 3 shown train journey as well as the procedure for obtaining a driving license (Movement Authority MA);
• Figure 5 a schematic representation of the effects of a loss of monitoring on the route and the protected area as well as an associated reduction in the driving license (EoA = End of Authority); and
• Figure 6 a schematic representation of an operational process with a focus on subsequent journeys and the "inheritance" of reservations that have already been created for route elements in favor of a subsequent train journey.

A number of basic assumptions are made in train-oriented route safety logic:

A - Basic lane planning principle

As is already usual, track element instances of track elements, such as switches, track sections and intersections, are managed by a safety logic instance. These route elements are arranged and linked according to the lane plan principle in the same order as they are located in the outdoor area.

1. a) Eindeutigkeit des Fahrwegs zwischen zwei Weichen/Kreuzungen;
2. b) maximale Zuglänge für Streckengleise;
3. c) maximale Länge für Gleisfreimeldetechnik, sofern erforderlich; und
4. d) Aufstellungsort von EHS/ESS in der Aussenanlage.

When it comes to track sections, if possible, only the minimum required sections are managed. The criteria for this are:

1. a) Clearness of the route between two switches/crossings;
2. b) maximum train length for mainline tracks;
3. c) maximum length for track vacancy detection technology, if required; and
4. d) Installation location of EHS/ESS in the outdoor area.

This also limits the number of EHS/ESS to what is operationally necessary. Start-destination element instances (signals) with safety logic functionality for EHS/ESS installed outdoors are no longer required in the new approach.

At the interfaces to old signal boxes with ETCS L0 or L1LS, start-destination element instances (also without Backup logic functionality, only with control and monitoring logic) still required, e.g. in connection with FAP or block. However, they can also be integrated according to the track plan principle.

Level crossings and their effects on every track that lies within the area of influence of the respective level crossing can also be integrated into an adequate representation according to the track plan principle.

The neighborhood relationships created by the lane planning principle are used as a basis for the communication of the route safety logic (see also the neighboring ports in Figure 2 ). Close dependencies between direct neighboring route elements are consistently evaluated and monitored. Remote dependencies, if necessary, are evaluated and monitored through recursion or propagation along the neighborhood relationships. In addition to the neighborhood relationships, the route elements have relationships to the control technology, to trains and to GFM information (see the other ports in Figure 2 ).

B - Train/shunting instances instead of route instances

Instead of route instances, train or shunting instances are now managed in the new route safety logic. The basis of these instances is the identity of the vehicle device (onboard unit ID number or OBU ID for short) and the respective assigned train numbers. Train instances can also be linked to one another in order to coordinate and monitor subsequent trips or oncoming trips, if permitted. In order to be able to guarantee the continuity and freedom from interruptions of valid routes, a plausibility principle is derived as a full replacement (see point F below).

C - Abstraction of the type of track clearance/position reporting

1. a) Einfache Freimeldeinformation: {frei | belegt | gestört}
2. b) Gerichtete Freimeldeinformation: {keine Information| Richtung1 | Richtung 2 | beide}
3. c) Geometrische Freimeldeinformation: {keine Information| Belegte Länge ab Strang x | Belegte Länge bis Strang x} , je nach Fahrwegelement gibt es üblicherweise 2 bis 4 Stränge

The type of track vacancy reporting (conventionally with axle counters and track circuits or with ideally reliable, safe position reports of all possible objects and people in the vicinity of the track) is modeled abstractly, so that the new track safety logic corresponds to the existing track vacancy reporting technology (varies locally, depending on the expansion phase, requirements). can act more conservatively or more progressively. The information is available to the track element instances in an abstracted and standardized form, i.e. independent of the specific type of track vacancy notification implemented in the track:

1. a) Simple free registration information: {free | occupied | disturbed}
2. b) Directed release information: {no information| Direction1 | Direction 2 | both}
3. c) Geometric free reporting information: {no information| Occupied length from strand x | Occupied length up to strand x}, depending on the route element there are usually 2 to 4 strands

With conventional means, for example, only the basic free/occupied/faulty notification information can be provided; no information applies here to the directional and geometric free notification information. With any available higher-value clearance information, the lower-value clearance information can be replicated. If higher-value clearance information is not available, {no information} applies to it.

The more detailed position reports are reliably available, the more finely granular (optimal in terms of capacity) the new train-oriented route security logic can process the monitoring. As long as simple release information is securely available, it will be used primarily when Free reporting is also used directly, as it may be available earlier depending on the frequency of position reports.

D - Only route safety logic

The new train-oriented route safety logic is implemented without being separated into a “signal box” and “RBC” part. The interfaces to the on-board units (OBUs) and thus to the trains required for interoperability, i.e. the Euroradio protocol and the telegram contents and procedures in accordance with ETCS specifications, will continue to be compatible and the information from the trains will be maintained via this interface used consistently.

The interfaces required for the outdoor systems to switches, level crossings, track vacancy detection technologies (either wire interfaces for old signal boxes from cable termination frames or RaSTA with standardized interface protocols for electronic signal boxes) will be maintained in a compatible manner or supplemented in a downwardly compatible manner.

E - Reduction of the SIL 4 share

The interface to and from the control technology will be fundamentally changed because route instances no longer exist. Tasks that only have a controlling nature are outsourced to the control technology because they are not safety-relevant on their own.

In the new train-oriented route safety logic, only those parts that must be SIL 4 are arranged. The proportion of SIL 4 is already significantly reduced for this aspect alone.

The parts in the control technology, which are closely related to safety-relevant functions in the new train-oriented route safety logic, will continue to roughly meet SIL 2 with regard to process safety must. However, this proportion can also be made compact and reduced. A separation of SIL2 and SILO parts can be achieved here. Overall, this is schematic in Figure 1 illustrated.

F - Greatly simplified route safety logic

The modeled route elements receive their reservation orders with the required parameters train number, OBU ID, orientation (direction 1, 2), position (left, right) at switches, crossings, reserved length (from/to position), target speed, if necessary other parameters, directly from the control technology.

In Figure 3 Based on this, the basic process for reservation orders and for the plausibility check of the start or another route element during an already existing journey is shown. Further route extensions result from the recursion of the subsequently derived principles for plausibility checks and protective spaces.

1. a) Anmeldung des betreffenden Zuges via interoperable ETCS-Schnittstelle von der OBU in der zugorientierten Streckensicherungslogik und Zuordnung zu einer entsprechenden Zuginstanz
2. b) Meldungen der Zuginstanz in der zugorientierten Streckensicherungslogik an die Leittechnik über die Anmeldung inkl. Movement Authority-Request, kurz MA-Request
3. c) Ermittlung des Sollfahrweges und ggf. der Sollgeschwindigkeit aus dem fortwährend optimierten Fahrplan (Produktionsplanung) und weiteren allgemeinen und der momentanen Situation entsprechenden dispositiven Kriterien und sowie aus der Kenntnis der Topologie der Station/Strecke heraus.

Prerequisite for the in Figure 3 The scenario presented is the following points:

1. a) Registration of the train in question via the interoperable ETCS interface from the OBU in the train-oriented route safety logic and assignment to a corresponding train instance
2. b) Messages from the train authority in the train-oriented route safety logic to the control technology via the registration including Movement Authority Request, MA request for short
3. c) Determination of the target route and, if necessary, the target speed from the continuously optimized timetable (production planning) and other general dispositive criteria that correspond to the current situation and from knowledge of the topology of the station/route.

A reservation of a route element is primarily considered valid if, at the time of this, there is no other reservation of the route element under consideration or, in other words, no other reservation is managed by the train-oriented route security logic. Exceptions to this basic rule can be defined for special cases.

To check the plausibility of the route, the train number (can change if the OBU ID is identical), OBU ID, orientation, position and length (from/to position) are required. The rules and the result of the plausibility check in general form can be seen from the decision table in Table 1. Table 1: Decision table for plausibility check of route; R stands for rule Conditions B R1 R2 R3 R4 R5 R6 R7 B1: Route element <UUID_FWE> is validly reserved in direction <Ri_FWE> and position <La FWE> N J J J J J J B2: Length of the reservation in this direction <Ri_FWE> and location <La_FWE> applies to the end of this route element - N J J J J J B3: In the direction <Ri_FWE> there is a neighboring route element <UUID NFWE> - - N J J J J B4: This neighboring route element <UUID_NFWE> is validly reserved in a direction <Ri_NFWE> and position <La_NFWE> that matches the route element - - - N J J J B5: Length of the reservation in this direction <Ri_NFWE> and location <La NFWE> applies from the beginning of this neighboring route element - - - - N J J B6: Train number and OBU ID are identical for this route element and this neighboring route element - - - - - N J Result A1: Route in route element <UUID_FWE> is not valid x A2: Route is only valid within the route element <UUID_FWE> X X X X X A3: Route is valid from route element <UUID_FWE> to neighboring route element <UUID_NFWE> x

• FWE: Fahrwegelement
• NFWE: Nachbarfahrwegelement
• <UUID_FWE>, <UUID_NFWE>: universell eindeutige Identifikationsnummer
• <Ri_FWE>, <Ri_NFWE>: Richtung {Ril = typischerweise nach rechts, Ri2 = typischerweise nach links}
• <La_FWE>, <La_NFWE>: Lage {nicht relevant, links, rechts}

Legend to table 1:

• FWE: route element
• NFWE: neighboring route element
• <UUID_FWE>, <UUID_NFWE>: universally unique identification number
• <Ri_FWE>, <Ri_NFWE>: Direction {Ril = typically to the right, Ri2 = typically to the left}
• <La_FWE>, <La_NFWE>: Location {not relevant, left, right}

Note on condition B4: <Ri_FWE> and <Ri_NFWE> must generally be identical. However, a change in direction is to be expected at certain points in a rail network due to a track loop or a track triangle (e.g. Zurich Hardbrücke). Therefore, the two directions must be compatible with each other, but not identical in every case. Directional jumps must be recorded in the track plan. The same applies to jumps in mileage. Only when all conditions B1 to B6 and thus rule R7 are met can result A3 be reached, which affirms the validity of the route from the current route element to the neighboring route element.

In Table 2, an FMEA is carried out regarding the individual errors to be considered in the reservation orders. The combination of several individual errors also leads to the disclosure of inconsistencies. Table 2: FMEA for plausibility check of route with regard to individual errors Reservation route element Reservation of neighboring route element Result Rule remark G3 (Train A, OBU ID A, Ri1, to the end) W9 (train A, OBU ID A, Ri1, left, from the beginning) A3 R7 OK W9 (train A, OBU ID C, Ri1, left, from the beginning) A2 R6 Incorrect OBU ID transferred W9 (train F, OBU ID A, Ri1, left, from the beginning) A2 R6 Incorrect train number transferred W9 (Train A, OBU ID A, Ri1, left, from 50m after the start) A2 R5 Position transferred offset by 50m, gap, therefore not plausible W9 (train A, OBU ID A, Ri1, left, before the start) A2 R5 Position outside of neighboring route element, overlap, still not plausible W9 (train A, OBU ID A, Ri2, left, from the beginning) A2 R4 Transferred wrong direction W9 (train A, OBU ID A, Ri1, right, from the beginning) A2 R4 Transferred incorrect position G11 (Train A, OBU ID A, Ri2, to the end) any A2 R3 End of topology G3 (train A, OBU ID A, Ri1, until 50m before the end) W9 (train A, OBU ID A, Ri1, left, from the beginning) A2 R2 Position transferred offset by 50m, gap, therefore not plausible G3 (train A, OBU ID A, Ri1, after end) W9 (train A, OBU ID A, Ri1, left, from the beginning) A2 R2 Position outside the route element, overlap, still not plausible no reservation G3 any A1 R1 The route element was not reserved or a completely different route element was reserved

With the principle derived in Table 1 and the findings from Table 2, a "safe" plausibility check of valid routes is generally possible (SIL 4 task). This becomes all the more important because the task of controlling when and where a train/a Shunting movement is to be carried out, from which the route safety logic is outsourced (SIL 0 task). “Safely” formulated route instances according to the state of the art are therefore no longer necessary.

For the start, a further plausibility check is also evaluated, which, however, depends on the quality of the track vacancy information and a valid position report (see also point C). The rules and the result of the plausibility check in general form can be seen from the decision table in Table 3. Table 3: Decision table for plausibility check start; R stands for rule Conditions R1 R2 R3 R4 R5 R6 R7 B1: Route element <UUID_FWE> is validly reserved in direction <Ri_FWE> and position <La_FWE> N J J J J J J B2: For this route element as a neighboring route element, the conditions according to "Truth table plausibility check route" rule R7 are not met - N J J J J J B3: For this route element, the simple clear information is equal to {occupied, disturbed} - - N J J J J B4: For this route element the geometric clearance information is not equal {no information} - - - N J J J B5: Train number and OBU ID for this route element are also the source of the geometric clearance information (train position report) - - - - N J J B6: Geometric clearance information contains the position of the train with train number and OBU ID in the leading position for <Ri_FWE> - - - - - N J Result A1: Route element <UUID FWE> is not valid as a start X X X A2: Route element <UUIO_FWE> is valid as a start in mode SR (TAF) X X X A3: Route element <UUID_FWE> is valid as a start in OS/FS mode X

The directional clearance information is not relevant for the start plausibility check, since all values are possible here, especially if the direction value does not correspond to the <Ri_FWE> direction (turn-around).

The train's position report is only included in the geometric clearance information if this position report meets sufficient criteria.

For the optimal protection area, the target speed parameter is primarily required. If the protective space cannot be achieved laterally in accordance with the underlying rules (risk function, formulas if necessary, etc.), the speed is reduced. If the protective space at the front cannot be achieved in accordance with the rules (risk function, formulas if necessary, etc.), the speed is reduced or the missing length is deducted from the reserved route length.

These rules can be formulated using a traditional security logic approach as well as a possible "risk-based, geometric" security logic approach. What these approaches should have in common is that they are formulated much more simply and, if possible, without special cases compared to today's security logic (technically determined dependencies, established and unadjusted regulations and rules, etc.).

In Figure 4 will be based on the expiry Figure 3 The basic further process up to obtaining a valid driving license is shown.

In Figure 5 will be based on the expiry Figure 4 The effect of a loss of monitoring in the route and in a protected area is shown.

Further properties and corresponding behavior in the train-oriented route safety logic

1. a) The train travels in accordance with the MA issued (and, if necessary, further optimizations ATO, etc.), the status and extent of which is also reported to the control technology, and updates its position/speed/train integrity of the associated train instance in the route safety logic regularly and, if necessary, in relation to the balise and also the control technology.
2. b) The train instance also makes a significant contribution to the abstracted track vacancy information.
3. c) After the train has passed the tail end, the route security logic can either release the corresponding reservation of the route elements as a whole or continuously release it for subsequent train instances (depending on the quality of the track clearance notification and train integrity of the preceding train instance). These status changes are immediately transmitted to the control technology so that it can continually make new decisions.
4. d) In particular, the position reports of the train instances from the route security logic and the associated MA serve as a new basis for the train number progression, which is currently still based on the occupancy of route element instances and stop positions of signal instances.
5. e) If the control technology for a following train controls route elements that are occupied by the train in front or are monitored for it in the same direction and position, the route safety logic links the train instance of the following train with the train instance of the train in front. Continuous monitoring of the distance is implemented depending on the quality of the track vacancy information, position and speed reports and train integrity.
6. f) If the control technology for a follow-up train that is already linked controls route elements in a different position, this follow-up link is resolved. A surveillance for the A follow-up train is possible as soon as the adjustable track element assumes the new position.
7. g) If the control technology controls track elements for a train (for planning reasons, e.g. combining) which are occupied by an oncoming train or which are monitored for this in the opposite direction but in the same position, the route safety logic links the train instance of the opposing train with the Train instance of the oppositely directed train instance (as a opposite link). Continuous monitoring of the distance is implemented depending on the quality of the track vacancy information, position and speed reports.

G - Mixed operation ETCS L2 / L3

The approach formulated in points A, B, C, D, E and F enables mixed operation of ETCS L2 and L3. As long as a preceding train reliably transmits its train integrity and the type of track vacancy notification has sufficient quality, the following train can follow in ETCS L3 and, if necessary, in the relative braking distance.

H - Exceptional operational situations, emergency operations, etc.

1. a) Langsamfahrstellen (TSRs) und Sperren, diese sollten jedoch möglichst ähnlich (Abstraktion als kategorisierte Belegung von differenzierter Qualität) gehandhabt werden, um unterschiedliche Spezialfunktionen zu vermeiden.
2. b) Notbedienungen auf einzelne Fahrwegelemente (Umgehung einer Weiche bzw. deren Flankenschutzes, eines Gleisabschnittes, etc.). Diese gelten nach heutigen Risikoakzeptanzkriterien jeweils nur für eine Zug-/Rangierfahrt. Durch derartige Notbedienungen können Besetzte Einfahrten oder Notzugfahrten gehandhabt werden, wobei auch hier eine Abstraktion im o.g. Sinne anzustreben ist.
3. c) Vereinigen/Trennen/Wenden ist ohne weitere Bedienungen mittels punktgenauer Bestimmung von Movement Authorities im Mode FS (ETCS Full Supervision) möglich.

Even in future operations that will continue to be automated, digitized and optimized, exceptional operational situations and emergency operations cannot be completely ruled out. The following features are intended for this.

1. a) Slow speed zones (TSRs) and barriers, but these should be handled as similarly as possible (abstraction as categorized occupancy of differentiated quality) in order to avoid different special functions.
2. b) Emergency operations on individual track elements (bypassing a switch or its side protection, a section of track, etc.). According to today's risk acceptance criteria, these only apply to one train/shunting trip. Such emergency operations can cause occupied entrances or Emergency train journeys are handled, although here too an abstraction in the sense mentioned above should be sought.
3. c) Combining/separating/turning is possible without further operations by precisely determining movement authorities in mode FS (ETCS Full Supervision).

I - Example of the novel interaction of track elements and train instances in an operational process

In the following Figure 6 an excerpt of an operational process with a focus on subsequent trips can be seen. It is shown how the features shown under A to F work in the new train-oriented route safety logic.

Train A has a valid route towards track 400 and shelters and continues.

Train B has a valid route to switch 7 (route and additional shelter at the front) and has just stopped.

Train C originally followed train B (with a following link) until the control system wanted to control switch 3 in the other position (left). At this moment, the train C follow-up link to train B was deleted. After train B released switch 3, it could be incorporated into the route for train C and the route, including the necessary shelters, could be further extended. When extending to track 3, this is now controlled in the same direction. This sets the follow-up link train C to train A. Continuous distance control comes into play as train A reports full train integrity. Train C can follow train A in relative braking distance. The control technology will also control switches 9 and 10 for train C and, due to the same location and direction, the subsequent link to train A will be retained. When train A finally releases track 3, the link from train instance A to track 3 is taken over by train instance C without interruption.

Train D only has a valid route including an additional protective space at the front up to and including switch 4. Despite the request for switch 5 (even if the left position would already be present), monitoring there is refused, as train D would otherwise enter the side protective space monitored for train C would penetrate the flank. Switch 6 has also been requested, but due to the current situation, which does not correspond to the requested situation, it cannot yet be monitored for train D.

The additional protective space at the rear is defined by the Min Safe Front End, the train length, the train integrity and, if necessary, a safety margin (this results in a Min Safe Rear End), shown for trains A, C and D. If there is no or no train integrity, the Additional protective space at the rear extended to the next track vacancy detection limit as a fallback level, shown for train B.

Advantages feasibility, migration

By eliminating signal instances and route instances in the signal box and in the control technology, unnecessary data storage, which must be consistent, is avoided and therefore does not need to be checked or updated and maintained during conversions/expansions. The comparison of the quantity structures using an example of a security system (Sion - Sierre, with level limits to L0 or L1/LS at both signal box limits) in Table 4 shows this clearly.

In addition to these advantages in the security system itself, the security system can also be planned much more efficiently and easily by the infrastructure operator (e.g. planning effort for SBB security systems up to process step SIOP-A). The associated complexity is eliminated. Experience has shown that there are often many rounds of clarification and corrections until signal plans are stable.

Both effects lead directly to direct cost savings in the engineering of the security systems and thus also to savings in follow-up costs resulting from delays caused by this work.

The EHS and ESS in the outdoor system listed in the last column of Table 4 only fulfill the function of allowing the train driver to recognize a defined stopping point or position (especially in SR mode or in the event of a fault). In the train-oriented route safety logic, this no longer plays an essential role in terms of the safety logic functionality or only the position is managed. Table 4: Comparison of quantity structure using the example of the Sion - Sierre security system; SA stands for security system Element type SA previously L0 or L1/LS SA so far L2 SA new L3, virtual sections SA L2/L3 with new train-oriented route safety logic Track section 129 (signal box) 139 (signal box) 146 (signal box) 139 139 (RBC) 146 (RBC) Crossing 1 (signal box) 1 (signal box) 1 (signal box) 1 2 (RBC) 2 (RBC) Switch/derailment device 109 (signal box) 109 (signal box) 109 (signal box) 109 109 (RBC) 109 (RBC) Clearance section 176 186 186 186 block 4 4 4 4 Dwarf signal (ZS) / ETCS shunting signal (ERS) 142 142 142 0 Main signals visual 100 8th 8th 8th ETCS stop signal (EHS) or ETCS location signal (ESS) in the outdoor system 0 113 155 113 Start-destination elements (signal, block) in the security system 193 (signal box) 214 (signal box) 256 (signal box) 8th 214 (RBC) 256 (RBC) Shunting routes (including combinations, without detours) 1339 1339 1339 0 Train routes (including combinations, without detours) 1397 2047 approx. 3500 0

A notice:

The number of train routes is based on the assumption that there is only one route instance per elementary start-destination combination. This assumption is fulfilled with the Simis ^® W CH signal box type. For other signal box types, the number is higher because a separate route instance may be required for each required train route type. Detour trips are not taken into account in Table 4 because they are not handled via separate route instances.

In the new train-oriented route safety logic, the complexity is greatly reduced by eliminating the route instances, the associated remote dependencies and by outsourcing the controlling portion and minimizing the SIL 4 portion. This has a direct positive impact on the development of such route safety logic, including all necessary work areas.

Because the signal box and RBC functionalities are now only operated in a single route safety logic, the double storage of data regarding the track topology is no longer necessary (route elements, signals) and the comparison of element instances for data exchange via the interface. This also greatly reduces the complexity of functions that require close cooperation between the two systems.

Advantages Effectiveness, performance, capacity

The track equipment with regard to the quality of the track vacancy information can be built geographically selectively. A higher quality can be installed in zones with dense traffic than in zones with low traffic volumes. Likewise, the equipment installed on the vehicles for more precise position reporting can be installed selectively. For example, in S-Bahn traffic in dense traffic zones, all trains are equipped with train integrity monitoring and equipment for more precise position reporting.

Thanks to the abstracted track vacancy information with high quality and the elimination of fixed route sections due to the signals, operation in ETCS L3 can be implemented up to and including driving within the relative braking distance. This allows the throughput at critical points to be significantly increased. This makes it possible to drive under full supervision (FS) onto a track that is still occupied by a train that has already left. In comparison, with L2 operation in its current form, such a journey can be carried out exclusively under On-Sight (OS), which inevitably leads to undesirable delays. Even with optical signaling, this was already possible efficiently, but with more residual risk, by means of an occupied follow-up trip.

In addition, effectiveness is achieved for every operational case. In contrast to a route layout with "planned optimized" road sections, where deviations from the plan inevitably arise in reality (unexpected acceleration or braking behavior, operationally changing conditions), which no longer occur or are only bad can be balanced, you can react dynamically in every situation and get the best possible result.

It is possible to react to every position report and not only when a position report is reported in such a way that a fixed route section (real or virtual) is assessed as being free again. The temporal discretization of the position report and a local discretization that does not correspond to it have previously led to additional delays in the entire control process. By eliminating the local discretization in route sections, such delays are eliminated without replacement.

Advantages feasibility, migration

The introduction of the new train-oriented route safety logic is decoupled from the introduction of new (trackside) localization techniques and from the upgrading of vehicles for L3 capability (train integrity, on-board localization techniques). By limiting the solution approach to the route safety logic and the control technology, an interoperable migration with various vehicles that are at least L2 capable is possible. This is the case in Switzerland, for example, on the SBB rail network.

A later upgrade of more precise localization techniques and vehicle equipment does not require any adjustments to the new train-oriented route safety logic. It may then simply work more effectively.

By abstracting the track vacancy information, the time at which a solution for train-oriented route safety logic is implemented is independent of the development of More intelligent track vacancy detection techniques and more precise position reports. When these are available, they can be used to further increase capacity through more optimal utilization.

Differentiation from alternatives

Alternatively, the trains themselves could communicate even more independently with control devices on the route, so that the share of the trackside safety system is further reduced. To do this, the control technology would have to transmit trackside information to the trains. However, this requires new interfaces to the OBUs, which jeopardizes interoperability, especially with ETCS. In addition, it is then problematic to carry out a plausibility check of the route safely, which means that successful proof of safety is questionable.

This would be a viable alternative in local transport, in which, for example, the route knowledge is stored statically on the vehicles, since it involves a known topology and a limited, uniform and controllable number of vehicles in a closed system. However, these boundary conditions do not apply to long-distance transport.

Claims (6)

1. Method for safeguarding a journey of a rail vehicle or a group of rail vehicles - referred to below as rail vehicle - over a section of a track network, in which

   a) during the movement of the rail vehicle, the current position of the rail vehicle and the journey criteria predetermined for the rail vehicle by a control system are evaluated and a protected space forwards is determined, and

   b) the route elements arranged in the section of the track network are mapped in a track plan principle and based on the position of the rail vehicle and the journey criteria, in each case the next journey element or elements including the journey elements granting the protected space laterally for these next journey elements, which lie forwards outside of the route already reserved for the journey plus the previously determined protected space, are reserved and if necessary adjusted uniquely for the identity of this rail vehicle in the position and stretch required for the journey.
2. Method according to claim 1, characterised in that the reservation for the journey elements traversed by the rail vehicle or for a specific stretch thereof is cancelled when a line clearance signal assigned to the journey element, whether by way of receiving the information of the position and integrity of the train and/or by way of the clearance state determined by an axle counting system and/or track circuit, determines the clearance state for the clearance section associated with the journey element for a specific stretch.
3. Method according to claim 1 or 2, characterised in that the current braking distance covered influences the determination of the length of the protected space forwards.
4. Method according to one of the preceding claims,
   characterised in that
   one or more process variables, such as target speed, travel plan stability and distance length, can be selected as the journey criteria.
5. Method according to one of the preceding claims,
   characterised in that
   a unique addressable train entity on the control system side is formed from the position of the rail vehicle and the identity of the onboard unit.
6. Method according to claim 5,
   characterised in that
   the train entities of consecutive rail vehicles are linked in terms of corresponding position and orientation when demands are placed on the same journey elements and this linking is cancelled if the position or orientation begin no longer to correspond.

Images