EP3696048B1

EP3696048B1 - System and method for traffic management of railway networks

Info

Publication number: EP3696048B1
Application number: EP19157570.3A
Authority: EP
Inventors: Davide NUCCI; Massimo ROSTI; Filippo ELIA
Original assignee: Alstom Ferroviaria SpA
Current assignee: Alstom Ferroviaria SpA
Priority date: 2019-02-15
Filing date: 2019-02-15
Publication date: 2021-06-23
Anticipated expiration: 2039-02-15
Also published as: AU2020200952A1; DK3696048T3; EP3696048A1

Description

The present invention concerns a system and a method for traffic management of railway networks.
As known, railways networks are very complex systems formed by many components and devices such as, for example, interconnected track lines, points, railway level crossings, stations, train convoys, signaling systems, decentralized and centralized control centers, et cetera.
Clearly, all these components and devices must be properly coordinated, continuously monitored, and timely operated, in order to ensure the correct and efficient functioning of the whole railway network, while satisfying the highest standards of safety, which is a very critical aspect in the railroad industry.
To this end, in particular thanks to the development of computer and IC technologies, various solutions have been recently devised for advanced and safer management of traffic in railway networks.
These solutions are essentially based on the generation of virtual data and/or availability of real data, such as the railway architecture, the operating state of traffic signals, the positions of trains or of points, and the like.
Data, either collected from the field and/or built virtually, are elaborated in control centers where management of railway traffic is conducted on the basis thereof.
For example, a typical configuration of a traffic management system for railways foresees the use of one or more traffic servers monitoring the state of equipment and the positions of trains.
When an abnormality is detected, based for instance on the status signal received from a signaling device, a warning information is output towards a terminal display where an operator is required to launch an appropriate action which is elaborated and put in place for execution by one of the servers.
An example of a solution aimed at improving traffic management systems for railway applications is disclosed in US 2015/0213080 A1 in which various initial data about tracks layout are collected and saved in a database where the track layout is modeled. Then, subsequent virtual data are elaborated and saved in a verification database and a processing device compares the subsequent data with the initial data in order to improve track data to be sent to central control units and/or to onboard controllers of trains.
Another solution related to traffic management systems for railway networks is described in EP 2 735 492 A2 , which deals specifically with traffic timetables where a current operating timetable is replaced by a new timetable generated on the basis of operative information received from the field, e.g. train delays, traffic disruption or the like.
Patent US 6,135,396 discloses a system for controlling the operation of a plurality of freight trains, including a communication processor which is in wireless communication with wayside resources having associated interface units (WIU), such as signals, switches. The system comprises a central control station having: an HMI for receiving instructions from a train system operator; a database containing data about the track layout, the location of the wayside resources, the rules regarding the use of the track and the wayside resources; a movement planner which determines a movement plan for each train; a movement controller which determines the specific commands for the trains and the wayside resources which are needed to implement the movement plan for each specific train. A safety checker receives the specific commands determined and checks if the implementation of such commands by trains or wayside resources would cause a safety violation.
Patent application US 2009/184210 A1 discloses a method and a system for reducing, in a centralized train control system, the portion of a centralized server application that is considered vital. In particular, a so-called adjudicator, i.e. a software module, ensures that a request from a non-vital function if issued as a command from a server to trackside or train-borne systems is issued as a vital directive, wherein the adjudicator evaluates the request for using vital resources in order to validate or reject it.
Although prior art solutions, like the ones previously mentioned, have afforded and tried over the years to improve various aspects of traffic management in railway systems, there is still room and desire for further improvements.
Therefore, it is a main aim of the present invention to fulfill at least partially such room and desire, and hence to provide a system and method for traffic management of a railway network, having improved performances in particular as regard to safety related aspects and operations, and especially when dealing with generation, management and execution of pluralities of operations to be executed.
Within the scope of this aim, an object of the present invention is to provide a system and method for traffic management of a railway network having, with respect to prior art solutions, an increased level of integration and coordination among various components and operators involved in the traffic management of railway networks.
An additional object of the present invention is to provide a system and method for traffic management of a railway network which can be applied and scalable to different and varying architectures and sizes of railway networks.
Yet a further object of the present invention is to provide a system and method for traffic management of a railway network which is highly reliable, easy to realize and at competitive costs.
This aim, these objects and others which will become apparent hereinafter are achieved by a traffic management system for a railway network according to claim 1.
This aim, these objects and others which will become apparent hereinafter, are achieved also by a method for traffic management of a railway network, according to claim 8.
Further characteristics and advantages will become apparent from the description of some preferred but not exclusive exemplary embodiments of a system and method according to the present disclosure, illustrated only by way of non-limitative examples with the accompanying drawings, wherein:

Figure 1 shows schematically a traffic management system for a railway network, according to a possible embodiment;
Figure 2 is a flow diagram illustrating a method for traffic management of a railway network, according to a possible embodiment.
Figure 3 is a sketch showing an example of information displayed to operators during execution of a safety procedure carried by the system and method according to the invention;
Figure 4 shows schematically another embodiment of a traffic management system for a railway network according to the present invention;
Figure 5 is a block diagram schematically illustrating the generation of a multi-phase intervention plan for a railway network.

It should be noted that in the detailed description that follows, identical or similar components, either from a structural and/or functional point of view, have the same reference numerals, regardless of whether they are shown in different embodiments of the present disclosure; it should also be noted that in order to clearly and concisely describe the present disclosure, the drawings may not necessarily be to scale and certain features of the disclosure may be shown in somewhat schematic form.
Further, when the term "adapted" or "arranged" or "configured" or "shaped", is used herein while referring to any component as a whole, or to any part of a component, or to a combination of components, it has to be understood that it means and encompasses correspondingly either the structure, and/or configuration and/or form and/or positioning of the related component or part thereof, or combinations.
In particular, for electronic and/or software means, each of the above listed terms means and encompasses electronic circuits or parts thereof, as well as stored or running software codes and/or routines, algorithms or complete programs, suitably designed for achieving the technical results and/or the functional performances for which such means are devised.
With reference to figure 1, a traffic management system for a railway network 200, indicated by the overall reference number 100 (hereinafter "the system 100"), comprises at least one communication interface 1 which is in operative communication with field devices 201 of the railway network 200 to be managed.
For example, the communication interface 1 can comprise a gateway server.
In the present disclosure, the definition of a railway network 200 encompasses cumulatively either the structural components forming a complete infrastructure of a railway network or any sub-part thereof, such as for example, one or more track lines, railway stations, cross levels, points, and the like, as well as the functional devices, hereby indicated as field devices 201, which are associated to such infrastructure and are suitable for allowing monitoring and correct operations of the railway network 200 and any parts thereof, for instance trackside devices such as signaling devices, switch machines, station control centers, or trains and/or on board train controllers, et cetera....
Clearly, in manners well-known or readily available to those skilled in the art, the configuration of the railway network 200 or parts thereof, including the field devices 201, can vary according to the applications.
As illustrated in figure 1, the system 100 comprises a storage device, 5, e.g. a storage database or server, and at least one human machine interface 10 for interfacing with one or more operators who are devoted to supervise the correct functioning of the whole railway network 200 or any part thereof under their responsibility, for example safe operators and assistants.
For instance, the human machine interface 10 can comprise one or more workstations or consoles installed in a centralized control room.
The system 100 comprises a system 20 for monitoring and controlling the railway network 200, wherein the monitoring and controlling system 20 is configured to generate one or more batches, i.e. one or more groups, of command instructions suitable to be issued for execution to one or more of the field devices 201 by the one or more operators of the system 100.
For example, the monitoring and controlling system 20 can comprise a programmable software and related circuitry tool for monitoring the state of the railway network 200 in terms of infrastructure and traffic, for assuming if necessary automatic control and supervision based on real-time events and, by collecting relevant operational data in real time, for assessing occurring situations and generating corresponding command instructions for operators, for instance for resolving incoming operative conflicts.
The system 100 comprises at least one elaboration device 30 which is for example in operative communication with the at least one communication interface 1 and with the at least one human machine interface 10.
In particular, the elaboration device 30 is configured, upon generation by the monitoring and controlling system 20 of at least one batch of command instructions, to carry out a safety procedure for evaluating a response of the railway network 200 in relation to the generated at least one batch of command instructions, and to output to the at least one human machine interface 10, for the attention and in case action of one or more operators, information indicative of the results of the safety procedure carried out, as for example illustrated in figure 3.
According to the invention the elaboration device 30 is configured to carry out, as a part of the safety procedure, a pre-execution validation procedure for verifying if the command instructions included in the generated at least one batch fulfill desired operative conditions of the railway network 200, and to output to the at least one human machine interface 10, for the one or more operators, information indicative of the results of the pre-execution validation procedure carried out.
In this way, by carrying out a validation procedure before a generated batch of command instructions is issued for execution to one or more of the field devices 201, the traffic system operators have the possibility to verify in advance if the batches of command instructions to be executed are compliant with the actual status of the railway network or, if applied, could violate any constraint thereof.
Accordingly, the level of safety in managing interventions on the railway network 200, thanks to this preventive check, is substantially increased.
Once verified that the command instructions of a generated batch subjected to the validation procedure fulfill the desired operative conditions of the railway network 200, an operator can output to the communication interface 10, via the elaboration device 30, the pre-validated batch of command instructions for immediate execution.
In turn, the communication interface 1 dispatches the batch to one or more of the field devices 201 for the material execution.
The elaboration device 30 is also configured to allow an operator to send, via the elaboration device 30, the pre-validated batch to the storage device 5 where it is saved for later execution.
In this way, it is possible to improve the efficient management of the railway network 200, according to a more flexible and desired schedule since the batches of command instructions are prepared and planned in advance and, once validated and stored, they can be retrieved and are ready for immediate application at request.
According to an embodiment, the elaboration device 30 is configured to carry out, as a part of the safety procedure, a post-execution confirmation procedure for verifying if an expected operative status of the railway network 200 based on the foreseen execution of a generated batch of command instructions corresponds with the actual status of the railway network 200 based upon signals received from one or more field devices 201, via the communication interface 1, after execution of the generated batch of commands instructions, and then to output to the human machine interface 10, for the attention and in case action of one or more operators, information indicative of the results of the post-execution confirmation procedure carried-out.
For example, the expected status is based on network configuration data stored in a database, e.g. in the storage device 5, where a list of expected statutes are saved and can be retrieved, case by case, using the command instructions under execution as an input for, while information of the results of the confirmation procedure can be presented to the operators by means of text messages and/or graphic symbols, or any combination thereof.
Hence, operators of the system 100 have the possibility to check if the batch of command instructions has been correctly and completely executed according to the desired configuration of the railway network 200 to be achieved, eventually closing the task in the affirmative case.
In the contrary case, the execution of batch command instructions is aborted and operators have further the possibility to execute another instance of the same batch of command instructions.
In this way, the level of safety in managing interventions on the railway network is further increased.
According to an embodiment, the post-execution confirmation procedure is preferably carried out on a batch of command instructions which has been subjected to the pre-execution validation procedure.
However, depending on the applications and operative circumstances, it would be possible, if necessary, to carry out the post-execution confirmation procedure on a batch of command instructions which was not subjected to the pre-execution validation procedure.
According to the invention, the monitoring and controlling system 20 is configured to generate, not only a single batch of command instructions, but also complete intervention plans scheduled for the railway network 200, wherein each of the intervention plans comprise one or more phases which are arranged according to a desired sequence of execution and each phase includes, namely is formed by, a corresponding batch of command instructions suitable to be sent to and executed by one or more of the field devices 201.
For example, an intervention plan can be related to a global maintenance operation planned for the railway network 200 and is composed by different phases, with a phase formed by a batch of commands.
In practice, as shown in figure 5, each command instruction 101-106, corresponds to a planned action to be executed, and various command instructions are grouped in a batch of concatenated command instructions forming a phase of the plan.
For instance, in the example illustrated in figure 5, phase A is formed by a set of command instructions 101, 102, phase B is formed by a set of command instructions 103, 104, phase C is formed by a set of command instructions 105, 106.
In turn, the phases are concatenated with each other, according to a desired sequence of operations, forming as a whole an intervention plan 400 which can be initially pre-stored, e.g. inside the same monitoring and controlling system 20, or elsewhere.
When the monitoring and controlling system 20 requires operators to execute the intervention plan 400, similarly to what previously described about one single batch of command instructions, the elaboration device 30 is configured to retrieve the intervention plan and carry out the pre-execution validation procedure for each individual command instruction included in the one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan, and then to output to the human machine interface 10, for the attention and in case action of one or more operators, information indicative of the results of the pre-execution validation procedure carried out for each individual command instruction included in each phase of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan.
Also in this case, once verified that the command instructions of each phase of the selected intervention plan fulfill the desired operative conditions of the railway network 200 to be achieved, an operator can trigger direct execution of the pre-validated intervention plan for the field devices 201.
Alternatively, the elaboration device 30 is further configured to allow operators to save the intervention plan in the storage device 5 for later direct execution, and/or to generate a template based on the pre-validated selected intervention plan and to save the template in the storage device 5 where it is stored for later generation of additional intervention plans.
In particular, according to an embodiment, the elaboration device 30 is configured to assign a unique identifier to each individually saved batch of command instructions or to each intervention plan or intervention template, for direct and correct retrieval thereof by the elaboration device 30, when related execution or use is requested to operators by the monitoring and controlling system 20.
In this way, it is possible to build an archive of intervention plans which can be used at request and more than once, or to have a starting template having at least some parts pre-validated and usable for completion with additional batches, so that to generate new intervention plans in a quicker way.
Further, also in this embodiment the elaboration device 30 is preferably configured to carry out the post-execution confirmation procedure and to output to the human machine interface 10, for the attention and in case action of one or more operators, information indicative of the results of the post-execution confirmation procedure carried out for each individual command instruction included in each phase of a selected intervention plan, and cumulatively for each complete phase of the selected intervention plan.
In this way, for an intervention plan under execution, it is possible to verify, step by step, if the batch of command instructions forming a phase and each overall phase itself have been completely and correctly executed.
Thus, operators are able to verify if the expected operative status of the railway network 200 based on the foreseen execution of a phase corresponds with the actual status of the railway network 200 based upon signals received from one or more field devices 201, via the communication interface 1, after execution of the batch of commands instructions forming each phase.
In this way, it is possible to verify the correct execution on a multi-phase plan and in case to stop it if anything did not proceed as necessary.
For example, the exemplary intervention plan illustrated in figure 5 can be part of a global maintenance intervention plan scheduled for the railway network 200, where operators need to take possession, i.e. to isolate, a sub-area of the network 200 first, to execute maintenance needed after, and then to proceed with a following sub-area, et cetera.
Accordingly, phase A of the intervention plan would include all command instructions needed to take possession of the specific subarea, phase B of the intervention plan would include all command instructions needed to perform maintenance in the isolated/specific subarea, and phase C of the intervention plan would include all command instructions needed for re-putting in operation the specific sub-area.
The same process, with corresponding phases can be repeated sub-area after sub-area, in a way that allows incrementing and decrementing the areas under possession, with great flexibility and minimizing the impact on the railway traffic.
Then, the elaboration device 30 outputs to the human machine interface 10, for the attention and in case action of one or more operators, information indicative of the results of the confirmation procedure carried-out for each command instruction included in the batch forming a phase and for each phase as a whole.
In particular, the elaboration device 30 is configured to output to the human machine interface 10, within the post execution confirmation procedure, a command for an operator to stop execution of an intervention plan, if for at least one of the command instructions included in a phase or for the overall phase of the intervention plan under execution, the actual status of the railway network 200 differs from the expected status.
In this way safety is substantially improved due to the fact that if one of the command instructions in a phase, e.g. in phase A, would fail, operators would immediately know that the selected sub-area is not in the needed safety conditions for having workers deployed there, and therefore workers can be prevented from entering in such potentially unsafe sub-area.
System operators have then the possibility to try again completion of the phase, or in the end to abort and remove all command instructions already executed.
Clearly, a command for an operator to stop execution is likewise applicable when carrying out a post-execution confirmation procedure on a generated single batch of command instructions previously described if, for at least one of the command instructions under execution, the actual status of the railway network 200 differs from the expected status.
Further, also when dealing with a complete intervention plan formed by one or more concatenated phases, it is possible to carry out the post-execution confirmation procedure preferably on an intervention plan subjected to the pre-execution validation procedure.
However, depending on the applications and operative circumstances, it would be possible, if necessary, to carry out the post-execution confirmation procedure on an intervention plan which was not subjected to the validation procedure.
Depending on the applications, operators of the traffic management system 100 according to the present invention, can decide, e.g. at design time, whether the safety procedure above described, and in particular the pre-execution validation procedure and/or the post-execution confirmation procedure, can be executed always, or only if certain conditions are met.
In one embodiment of the traffic system 100 according to the present invention, the elaboration device 30 is configured to carry out an identification procedure for an operator to verify if at least one command instruction included in a generated batch of command instructions, be it an individual batch or a batch forming a phase of a multi-phase intervention plan, meets a predetermined criteria, and only in the affirmative case, to carry out the safety procedure, and in particular any of the related pre-execution validation procedure and/or post-execution confirmation procedure, for the batch subjected to the identification procedure.
In particular, according to the invention, a list of possible commands is predefined and stored, for example in the elaboration device 30, wherein the commands are classified each according to at least a first category and a second category, with the commands of the first category having a hierarchical importance higher than those commands belonging to the second category, in particular as regard to safety related actions.
For instance, the pre-listed command instructions are classified as "vital" or "critical" for the first category, and as "standard" for the second category, with respect to a reference criteria establishing that failure of execution of a standard command instruction per se would not cause any safety related issue on the railway network 200, while failure of execution of a vital or critical command would cause safety issues which must be prevented or mitigated as quickly as possible.
When vital or critical command instructions are included in a batch, such batch and all information and data related therewith are preferably always routed through the elaboration device 30, either when operators will issue such command instructions for execution to the communication interface 1, or as regard to the status signals received by the communication interface 1 in response to the application of the batch of command instructions, which status signals should be properly transferred and displayed to the operators on the human machine interface 10.
According to an embodiment, the elaboration device 30 is a drawing server, e.g. a graphical programmable tool comprising suitable software code and related circuitry, which is configured to generate, on one or more of the displays 15 associated to the human machine interface 10, graphical information indicative of the safety procedure carried out, and in particular of the related pre-execution validation procedure and/or post-execution confirmation procedure carried out.
For example, for the pre-execution validation procedure, the elaboration device 30 will provide to the human machine interface, the list of the command strings and related graphic visualization associated to all controls included and the general information associated to the current batch.
In case of a post-execution confirmation procedure, if for example a batch/phase is composed by twenty individual command instructions, operators will see on one or more of the displays 15, a total of twenty-one results displayed, namely one for each individual command, and one for the whole batch/phase.
In this way, operators can obtain at a glance, a feedback on whether the execution of multiple command instructions is proceeding correctly, as for example illustrated with the sketch of figure 3.
According to an embodiment, the elaboration device 30 is configured to generate a graphical comparator comprising a first expected execution image and a second resulting execution image visualized on the one or more displays 15, wherein if the first and second images differ from each other, the elaboration device 30 is configured to output to the human machine interface 10 a corresponding information allowing to enter a failure mode.
According to an embodiment schematically illustrated in figure 4, the system 100 comprises a plurality of elaboration devices 30, i.e. at least two elaboration devices 30.
In particular, if only two elaboration devices 30 are used, they would be substantially identical to each other and would be capable to perform exactly the same tasks in a synchronized way and independently from each other, thus allowing safe redundancy for the whole system 100.
In a particularly preferred embodiment of the system 100 according to the invention, there is provided a plurality of elaboration devices 30, each being capable to perform the same procedures previously described.
According to this embodiment, the elaboration devices 30 can be divided in groups of two or more elaboration devices 30, wherein each group is assigned to a dedicated sub-part of the railway network 200, and the elaboration devices 30 of the same group are configured to perform the same tasks in a synchronized way and independently from each other.
According to this embodiment, the at least one human machine interface 10 is configured to selectively connect with at least two of the plurality of elaboration devices 30 via a communication bus 25, which is substantially a multiplexer, hosted for example by the storage device 5.
During operations, the elaboration devices 30 publish dynamically their respective load which is taken into account by the communication bus 25.
If a human machine interface 10 queries the communication bus 25, the communication bus 25 provides the IP address of the elaboration device 30 to which the querying human interface 10 should preferably connect to.
Such indication is for example based on a load balancing principle, i.e. the communication bus 25 indicates to the human machine interface 10 the right and less loaded elaboration device 30, thus allowing a faster and more efficient management of data handling among the various parts of the system 100.
Further, as illustrated in figure 4, it is possible for the system 100 to be scaled up as desired, namely to comprise a plurality of human machine interfaces 10 for interfacing each with one or more operators, and a plurality of communication interfaces 1 for interfacing with the various field devices 201 of the railways network 200, wherein the plurality of elaboration devices 30 is in operative communication with the plurality of human machine interfaces 10 and the plurality of communication interfaces 10, and wherein each of the plurality of human machine interfaces 10 is configured to selectively connect with at least two of the plurality of elaboration devices 30 by querying the communication bus 25.
If needed, also the number of storage devices 5 can be increased, as well as that of the monitoring and controlling systems 20.
In this way, the system 100 is easily scalable to railway networks 200 of different size, complexity and architecture, thus being applicable either to a local network or expandable to a wider one, with the expansion that can be implemented at any time.
With reference to figure 2, a method for traffic management of a railway network 200, according to the invention, indicated therein by the overall reference number 300, comprises the steps of:

310: generating, for instance by means of a monitoring and controlling system 20, at least one batch of command instructions suitable to be issued for execution by one or more operators to one or more of field devices 201 of the railway network 200;
320: carrying out, by at least one elaboration device 30, a safety procedure for evaluating a response of the railway network in relation to said generated at least one batch of command instructions, wherein, information indicative of the results of the safety procedure carried out are output, to at least one human machine interface 10, for the one or more operators.

According to the invention the step 320 of carrying out a safety procedure comprises the sub-steps of:

321: carrying out, by means of the at least one elaboration device 30, a pre-execution validation procedure for verifying if the command instructions included in said generated at least one batch fulfill desired operative conditions of the railway network; and
323: outputting, to the at least one human machine interface 10, for the one or more operators, information indicative of the results of the pre-execution validation procedure carried out.

The method 300 further comprises the following step of:

335 issuing the pre-validated at least one batch of command instructions for execution to one or more of said field devices 201; or alternatively, the following step of:
340: saving in the storage device 5 the pre-validated at least one batch of command instructions for later execution.

Preferably, the elaboration device 30 is configured to assign a unique identifier to each individually saved batch of command instructions.
According to an embodiment, in the method 300, the step 320 of carrying out a safety procedure comprises the sub-steps of:

322: carrying out, by means of the at least one elaboration device 30, a post-execution confirmation procedure for verifying if an expected operative status of the railway network 200 based on the generated at least one batch of command instructions corresponds with the actual status of the railway network based upon signals received from one or more of said field devices 201, via said at least one communication interface 1, after execution of the generated at least one batch of commands instructions; and
324: outputting to the at least one human machine interface 10, for said one or more operators, information indicative of the results of the post-execution confirmation procedure carried out.

According to the invention of the method 300, the step 310 of generating at least one batch of command instructions, comprises generating, by the monitoring and controlling system 20, one or more intervention plans scheduled for the railway network 200, wherein each of the intervention plans comprises one or more phases which are arranged according to a desired sequence of execution and each phase includes, in particular is formed by, a corresponding batch of command instructions suitable to be sent to and executed by one or more of the field devices 201.
Accordingly, within the step 320 of carrying out a safety procedure, the sub-step 321 of carrying out a pre-execution validation procedure comprises:

carrying out the validation procedure for each individual command instruction included in the one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan.

In turn, the sub-step 323 of outputting, to the at least one human machine interface 10, for one or more operators, information indicative of the pre-execution validation procedure carried out, comprises:

outputting, to the at least one human machine interface 10, for one or more operators, information indicative of the results of the pre-execution validation procedure carried out for, each individual command instruction included in the one or more phases of the selected intervention plan, and cumulatively for each complete phase of the selected intervention plan.

According to this embodiment, the method 300 comprises, at step 335, issuing the pre-validated selected intervention plan for execution to one or more of the field devices 201, or alternatively, at step 340, saving the pre-validated selected intervention plan for later direct execution.
Yet alternatively to step 335 or 340, the method 300 can comprise the steps of:

345: generating a template based on the pre-validated selection intervention plan; and
346: saving the template for later generation of additional intervention plans.

In particular, according to an embodiment, the elaboration device 30 is configured to assign a unique identifier to each intervention plan or to each intervention template for direct and correct retrieval thereof when related execution or use is requested to operators by the monitoring and controlling system 20.
According to an embodiment of the method 300, the step 322 of carrying out a post-execution confirmation procedure comprises the sub-steps of:

carrying out the post-execution confirmation procedure for each individual command instruction included in the one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan; and wherein the step of outputting to said at least one human machine interface 10, for said one or more operators, information indicative of the results of the confirmation procedure carried out for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan.

In turn, the sub-step 324 of outputting to the at least one human machine interface information indicative of the results of the post-execution confirmation procedure carried out, comprises:

outputting, to said at least one human machine interface 10, for the one or more operators, information indicative of the results of the post-execution confirmation procedure carried out for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan.

According to an embodiment, the method 300 comprises the further step of:

350: stopping execution of an intervention plan if, for at least one of the command instructions included in a phase of the intervention plan under execution, the actual status of the railway network differs from the expected status.

As previously indicated, depending on the applications, users can decide, e.g. at design time, whether the safety procedure above described, and in particular the pre-execution validation procedure and/or the post-execution confirmation procedure, can be executed always or only if certain conditions are met.
Accordingly, the method 300 according to the present invention comprises a step of:

360: executing an identification procedure to verify if at least one command instruction included in a generated batch of command instructions, be it an individual batch or a batch forming a phase of a multi-phase intervention plan, to be sent for execution to said one or more field devices 201 meets a predetermined criteria, and only in the affirmative case, to carry out the safety procedure, and in particular any of the related pre-execution validation procedure and/or post-execution confirmation procedure, for the batch subjected to the identification procedure.

As indicated, the elaboration unit 30 can be constituted by a graphical server and accordingly, in order to output to said at least one human machine interface 10, for one of more operators, information indicative of the results of the safety procedure carried out, and in particular of the related pre-execution validation procedure and/or post-execution confirmation procedure carried out, the method 300 comprises:

generating, via the elaboration device 30, a graphical comparator comprising for example a first expected execution image and a second resulting execution image visualized on the one or more displays 15.

If the first and second images differ from each other, the method 300 comprises the further step of entering a failure mode.
In particular, an error message can be displayed if at least one command instruction included in the batch is not compliant with the current field configuration of the railway network 200, or an elaboration error occurred.
Finally, when a plurality of elaboration devices is used, the method 300 comprises the steps of querying a communication bus 25 and, based on the indication of the communication bus 25, selectively connecting to the elaboration device 30 indicated.
It is evident from the foregoing description that the system 100 and method 300 according to the present invention allow offering a solution where the level of safety of operations is substantially increased over known systems, in a more efficient and integrated way.
Indeed, operators are offered the possibility to control and apply multiple commands at the same time, where the commands of vital or critical type are always routed via an elaboration device 30 from a human machine interface 10 to a communication interface 1, and vice-versa, thanks to the bidirectional communication established between the human interface 1 and the associated elaboration server 30, and between the elaboration device 30 and the associated communication interface 1.
These results are achieved according to a solution which meets the highest standard of safety and reliability, and which is easy to be implemented and expanded at a competitive cost, in principle to any type and size of railway network.
In particular, the system 100 and method 300 according to the invention integrate in a well-coordinated way, functionalities that in prior solutions cannot be performed or are partially performed by separate and independent tools.
The system 100 and method 300 thus conceived are susceptible of modifications and variations, all of which are within the scope of the invention as defined by the appended claims; for example, as those skilled in the art would appreciate, the type of graphical representation can be varied, or even some information to the operators can presented in other forms, such as text messages, light or audio warnings, et cetera.

Claims

A traffic management system (100) for a railway network (200), comprising:
- at least one communication interface (1) in operative communication with field devices (201) of said railway network (200);

- at least one human machine interface (10) for interfacing with one or more operators;

- a system (20) for monitoring and controlling said railway network (200), said monitoring and controlling system (20) being configured to generate one or more batches of command instructions suitable to be issued for execution to one or more of said field devices (201) by said one or more operators; and

- at least one elaboration device (30) configured, upon generation by said monitoring and controlling system (20) of at least one batch of command instructions, to carry out a safety procedure for evaluating a response of the railway network in relation to said at least one generated batch of command instructions, wherein said elaboration device (30) is further configured to output to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the safety procedure carried out,
wherein said elaboration device (30) is configured to carry out a pre-execution validation procedure for verifying if the command instructions included in said generated at least one batch fulfill desired operative conditions of the railway network, and to output to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the pre-execution validation procedure carried out;
and wherein, once verified that the command instructions subjected to the pre-execution validation procedure fulfill said desired operative conditions of the railway network (200), the elaboration device (30) is further configured to allow said one or more operators to issue the pre-validated at least one batch of command instructions for execution to one or more of said field devices (201), or for saving in a storage device (5) of the traffic management system the pre-validated at least one batch of command instructions for later execution, and in that said monitoring and controlling system (20) is configured to generate intervention plans scheduled for said railway network (200), each of said intervention plans comprising one or more phases which are arranged according to a desired sequence of execution and each phase includes a corresponding batch of command instructions suitable to be sent to and executed by one or more of said field devices (201);
and wherein said at least one elaboration device (30) is further configured to:
- carry out said pre-execution validation procedure for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan; and

- output to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the pre-execution validation procedure carried out for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan;
and wherein, once verified that the command instructions of each phase of said selected intervention plan fulfill the desired operative conditions of the railway network, said elaboration device (30) is further configured to allow said one or more operators to issue the pre-validated selected intervention plan for execution to one or more of said field devices (201), or to save the pre-validated selected intervention plan in a storage device (5) of the traffic management system for later direct execution, or to generate a template based on the pre-validated selected intervention plan and to save said template in said storage device (5) for later generation of additional intervention plans.
A traffic management system (100) according to claim 1, wherein said elaboration device (30) is configured to:
- carry out a post-execution confirmation procedure for verifying if an expected operative status of the railway network (200), based on said at least one generated batch of command instructions, corresponds with an actual status of the railway network, based upon signals received from one or more of said field devices (201), via said at least one communication interface (1), after execution of said at least one generated batch of commands instructions; and

- output to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the post-execution confirmation procedure carried out.
A traffic management system (100) according to claim 2, wherein said at least one elaboration device (30) is configured to:
- carry out said post-execution confirmation procedure for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan; and

- output to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the post-execution confirmation procedure carried out for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan.
A traffic management system (100) according to claim 3, wherein said elaboration device (30) is configured to generate, within said post-execution confirmation procedure, a command for an operator to stop execution of an intervention plan if, for at least one of the command instructions included in a phase or for a complete phase of the intervention plan under execution, the actual status of the railway network (200) differs from the expected status.
A traffic management system (100) according to one or more of the previous claims, wherein said elaboration device (30) is configured to carry out an identification procedure for said one or more operators to verify if at least one command instruction included in a generated batch of command instructions to be sent for execution to said one or more field devices (201) meets a predetermined criteria, and only in the affirmative case, to carry out said safety procedure for said batch of command instructions.
A traffic management system (100) according to one or more of the previous claims, wherein said elaboration device (30) is a drawing server configured to generate and output on one or more displays (15) associated to said at least one human machine interface (10), for said one or more operators, graphical information indicative of the results of the safety procedure carried out.
A traffic management system (100) according to claim 1, wherein it comprises a plurality of elaboration devices (30), wherein said at least one human machine interface (10) is configured to selectively connect with at least two of said plurality of elaboration devices (30) via a communication bus (25).
A method (300) for traffic management of a railway network (200), comprising the steps of:
- (310): generating at least one batch of command instructions suitable to be issued for execution by one or more operators to one or more of field devices (201) of the railway network (200);

- (320): carrying out a safety procedure for evaluating a response of the railway network in relation to said at least one generated batch of command instructions, characterized in that information indicative of the results of the safety procedure carried out are output to said at least one human machine interface (10), for said one or more operators,
wherein said step (320) of carrying out a safety procedure comprises the sub-steps of:
- (321): carrying out a pre-execution validation procedure for verifying if the command instructions included in said generated at least one batch of command instructions fulfill desired operative conditions of the railway network (200); and

- (323): outputting to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the pre-execution validation procedure carried out; and wherein the method comprises the further step of:

- issuing (335) the pre-validated at least one batch of command instructions for execution to one or more of said field devices (201), or saving (340) in a storage device (5) of the traffic management system the pre-validated at least one batch of command instructions for later execution;
and in that said step (310) of generating at least one batch of command instructions suitable to be issued for execution by one or more operators to one or more of field devices (201) of the railway network (200) comprises:
- generating one or more intervention plans scheduled for said railway network, each of said intervention plans comprising one or more phases which are arranged according to a desired sequence of execution and include a corresponding batch of command instructions suitable to be sent to and executed by one or more of said field devices (201);
and wherein said sub-step (321) of carrying out a pre-execution validation procedure comprises:
- carrying out said pre-execution validation procedure for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan;
and wherein said sub-step of outputting (323) to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the pre-execution validation procedure carried out, comprises:
- outputting to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the pre-execution validation procedure carried out for each individual command instruction included in said one or more phases of the selected intervention plan and cumulatively for each complete phase of the pre-validated selected intervention plan;
and wherein the method comprises a further step selected from the following alternative steps:
- issuing (335) the pre-validated selected intervention plan for execution to one or more of said field devices (201); or

- saving (341) the pre-validated selected intervention plan for later direct execution; or

- generating (345) a template based on the pre-validated selection intervention plan and saving (346) said template for later generation of additional intervention plans.
A method (300) for traffic management according to claim 8, wherein said step (320) of carrying out a safety procedure comprises the sub-steps of:
- (322): carrying out a post-execution confirmation procedure for verifying if an expected operative status of the railway network (200), based on said generated at least one batch of command instructions, corresponds with an actual status of the railway network, based upon signals received from one or more of said field devices (201) after execution of said generated at least one batch of commands instructions; and

- (324): outputting to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the post-execution confirmation procedure carried out.
A method (300) for traffic management according to claim 8, wherein said sub-step (322) of carrying out a post-execution confirmation procedure comprises:
- carrying out said post-execution confirmation procedure for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan;
and wherein said sub-step (324) of outputting to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the post-execution confirmation procedure carried out for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan, comprises:
- outputting to said at least one human machine interface (10), for said one or more operators, information indicative of the results of the post-execution confirmation procedure carried out for each individual command instruction included in said one or more phases of a selected intervention plan and cumulatively for each complete phase of the selected intervention plan.
A method (300) for traffic management according to claim 10, wherein it comprises the further step of:
- (350): stopping execution of an intervention plan if, for at least one of the command instructions included in a phase or for a complete phase of the intervention plan under execution, the actual status of the railway network differs from the expected operative status.